[{"actor":{"category":"external","country":null,"motive":"unknown","name":"UNC5820","variety":"state_affiliated"},"attack_techniques":["T1041","T1078","T1190","T1552"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":["CVE-2024-47575","CVE-2025-61624","CVE-2024-26008"],"data_types":["internal","secrets"],"disclosed_date":"2026-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"6701be27ea1ecc2597308d2305842d564e139af2","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-19","outcome":"no_letter","url":null},"notes":null,"org_country":"unknown","org_id":"0482826a3ef8","org_name":"Undisclosed telecommunications organization","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The actor gained initial access by exploiting the FortiManager zero-day vulnerability CVE-2024-47575.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack","type":"press","url":"https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/"}],"summary":"UNC5820 exploited FortiManager vulnerabilities to access a telecommunications organization’s environment, deploy the PeerStitch implant, and exfiltrate a configuration archive.","supporting_quote":"Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.","technology_involved":["FortiManager","FortiGate","FortiOS"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Fortinet"},"veris_action":"hacking","derived":{"vendors":[{"id":"f7168c22c35a","name":"Fortinet"}],"actor_id":"unc5820","kev":[{"cve":"CVE-2024-47575","kev_added":"2024-10-23","name":"Fortinet FortiManager Missing Authentication Vulnerability","days_listed_before_incident":726,"product":"Fortinet FortiManager"},{"cve":"CVE-2025-61624","kev_added":"2026-10-16","name":"Fortinet Multiple Products Path Traversal Vulnerability","days_listed_before_incident":3,"product":"Fortinet Multiple Products"},{"cve":"CVE-2024-26008","kev_added":null,"name":null,"days_listed_before_incident":null,"product":"fortinet fortios"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2026-10-19","discovered_date":"2026-10-13","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"5604c03c0dade5bd43aa69a23f4e344f74221c96","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"JP","org_id":"f48c84fd9458","org_name":"Studio","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in part of Studio's features allowed a third party to access its cloud environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Studio Breach in Japan: A No-Code Website Builder Exposes Its Customers' Form Data and API Keys","type":"mastodon","url":"https://japancyberwatch.com/articles/studio-website-builder-breach-form-data-api-keys-2026"}],"summary":"A third party exploited a vulnerability in Studio's features to access its cloud environment, where customer data could be retrieved from outside.","supporting_quote":"Studio's first report, published on October 16 and updated twice since, describes the attack this way: a third party abused a vulnerability in part of Studio's features to get into the cloud environment Studio uses, and left the data there retrievable from outside.","technology_involved":["Studio cloud environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Andrew","variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-19","discovered_date":"2025-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"967f29efd1b19c6c813262fb19c6f8132b9cdbbc","impact_type":"data_theft","incident_date":"2025-01-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"US","org_id":"dc6ff78bb700","org_name":"Oracle Health","org_type":"technology_saas","ransomware":true,"records_affected":19929149,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oracle Health data breach exposes nearly 20 million patients","type":"mastodon","url":"https://www.foxnews.com/tech/oracle-health-data-breach-exposes-nearly-20-million-patients?utm_source=flipboard&utm_medium=activitypub"}],"summary":"An attacker used stolen customer credentials to access a legacy Cerner server and copy patient information.","supporting_quote":"Investigators found evidence suggesting that an attacker used stolen customer credentials to access a legacy server sometime after January 22.","technology_involved":["Cerner systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"andrew"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"fe55097e739a1da8ea66cd9ea2f2372b5782ba76","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"6d5f4b6789f6","org_name":"IDScan","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"It sure looks like hackers breached a major ID card verification service","type":"mastodon","url":"https://justpaste.in/news/it-sure-looks-like-hackers-breached-a-major-id-card-verification-service/"}],"summary":"IDScan was identified as the likely source of identity documents reportedly exfiltrated and offered for search on the Nexus site.","supporting_quote":null,"technology_involved":["IDScan identity verification service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2026-10-19","discovered_date":"2026-10-16","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"f7b9e15cde110e4db9c301f7ac5fcd1516b599a1","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"KR","org_id":"cdefb3631050","org_name":"Hollys Coffee","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Korea's Hollys Coffee Membership System Compromised","type":"mastodon","url":"https://beyondmachines.net/event_details/south-korea-s-hollys-coffee-membership-system-compromised-p-n-8-6-w/gD2P6Ple2L"}],"summary":"Hollys Coffee identified unauthorized access to its legacy membership database, exposing personal information, account credentials, and service usage data.","supporting_quote":null,"technology_involved":["legacy membership database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","secrets","internal"],"disclosed_date":"2026-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"8f399525de0a2636b21a49c960811fef0ae31c44","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-19","outcome":"no_letter","url":null},"notes":null,"org_country":"RU","org_id":"9294cdefbcf2","org_name":"FirstVDS","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited a vulnerability in the VMmanager 6 virtualization management platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Hackers steal customer data from major Russian hosting provider FirstVDS","type":"press","url":"https://therecord.media/russia-cyberattack-firstvds-cloud"}],"summary":"Attackers exploited a vulnerability in FirstVDS's VMmanager 6 platform and copied data from customers' virtual servers.","supporting_quote":"According to the company, the attackers exploited a vulnerability in VMmanager 6, a virtualization management platform developed by Russian software company ISPsystem.","technology_involved":["VMmanager 6"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"ISPsystem"},"veris_action":"hacking","derived":{"vendors":[{"id":"05ef00ce8dcc","name":"ISPsystem"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Seven Deadly Sins","variety":"organized_crime"},"attack_techniques":["T1195","T1199"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"d4caacc9fbaf48723057ae9f42a167be6e37f8bf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"attack_techniques without supporting words dropped: T1213","org_country":"AU","org_id":"ed2ba4c533a3","org_name":"Canva","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized access to Canny allowed access to enterprise customer records through Canny’s connection to Canva’s Salesforce account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Aussie software giant Canva confirms third-party data incident","type":"mastodon","url":"https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident"}],"summary":"Canva said unauthorized access to the third-party tool Canny exposed some enterprise customer records through its connection to Canva’s Salesforce account.","supporting_quote":"“The unauthorised access to Canny allowed access to some enterprise customer records through its connection to Canva’s Salesforce account, including business contact details and routine business documentation,” the spokesman told Cyber Daily.","technology_involved":["Canny","Salesforce"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Canny"},"veris_action":"hacking","derived":{"vendors":[{"id":"ea0fa51332ba","name":"Canny"}],"actor_id":"sevendeadlysins"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"cf254df74d8a00779df76e67a9749bd4e44d09a3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50302e54e504","org_name":"The Way to My Heart Inc. (Global PAD Association)","org_type":"nonprofit","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Way%20to%20My%20Heart%20Inc.%20%28Global%20PAD%20Association%29-2026-10-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Qilin","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"4ef6411902571e01752bb7687941b6799dc40140","impact_type":"unknown","incident_date":"2026-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"MY","org_id":"3c7410a2c638","org_name":"Pengurusan Aset Air Berhad","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Pengurusan Aset Air Berhad Ransomware Claim by Qilin (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-18-pengurusan-aset-air-berhad-ransomware-claim-by-qilin-oct-2026"}],"summary":"Qilin claimed on its leak site that it had compromised Pengurusan Aset Air Berhad, but the claim and any data exposure remain unverified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"qilin"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"2019","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"cdda96bff117183897f2847e98cc900f20959806","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"6072a9e20451","org_name":"Napoleon Perdis","org_type":"retail_ecommerce","ransomware":null,"records_affected":339055,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Napoleon Perdis Data Breach Exposes 340,000 Customer Records via Third-Party Provider","type":"mastodon","url":"https://beyondmachines.net/event_details/napoleon-perdis-data-breach-exposes-340000-customer-records-via-third-party-provider-q-w-i-f-n/gD2P6Ple2L"}],"summary":"Napoleon Perdis reported unauthorized access to legacy customer records stored by Retail Express, affecting 339,055 individuals.","supporting_quote":"The incident is caused by a cyber attack on Retail Express, a third-party service provider previously used by the company to store legacy customer records.","technology_involved":["Retail Express","legacy customer-record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Retail Express"},"veris_action":"unknown","derived":{"vendors":[{"id":"3383f997600b","name":"Retail Express"}],"actor_id":"2019"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-18","discovered_date":"2026-10-13","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"5945a4d8c0bf8e836dc3a3d27726e10e825e5a38","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CA","org_id":"bf918dc24b97","org_name":"More Rewards","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"More Rewards Data Breach Exposes Personal Information of Grocery Customers","type":"mastodon","url":"https://beyondmachines.net/event_details/more-rewards-data-breach-exposes-personal-information-of-grocery-customers-o-w-e-m-7/gD2P6Ple2L"}],"summary":"More Rewards disclosed unauthorized activity on a database server containing customer profiles; the access method and number of affected individuals were not disclosed.","supporting_quote":null,"technology_involved":["database server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"GordonFreeman","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"5d43b0e40394abfc9311385352affc8a1efed7c5","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AR","org_id":"f35d8fab6243","org_name":"Ministry of Health of Chaco","org_type":"government","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇦🇷 We tracked a data breach claim by GordonFreeman naming Argentina's Ministry of Health of Chaco. The actor alleges obt","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117463025991030218"}],"summary":"GordonFreeman claims to have obtained 2.5 million COVID-19 vaccination records from Argentina's Ministry of Health of Chaco.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"gordonfreeman"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Chaos","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-18","discovered_date":"2026-08-18","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"6f578a4a96f926af5cd2ac75fc74dff4d5be3f4a","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"7c4cf25387eb","org_name":"Mankato Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Mankato Clinic Discloses Data Breach Following Ransomware Attack Claims","type":"mastodon","url":"https://beyondmachines.net/event_details/mankato-clinic-discloses-data-breach-following-ransomware-attack-claims-p-x-f-o-3/gD2P6Ple2L"}],"summary":"Mankato Clinic reported a data security incident after the Chaos ransomware group claimed it stole data; the clinic said the intrusion was identified on August 18, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"chaos"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-18","id":"aabd096b4a270d05e63d82c9c7093d93218f58f7","impact_type":"data_theft","incident_date":"2026-05-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"aa6b98ee0e94","org_name":"Gîtes de France","org_type":"retail_ecommerce","ransomware":null,"records_affected":117574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Gîtes de France Breach: 117K Emails & Phone Numbers Exposed (2026)","type":"mastodon","url":"https://www.yazoul.net/breaches/breach/g-tes-de-france-breach-117k-emails-phone-numbers-exposed-2026"},{"fetched_at":null,"title":"Have I Been Pwned: Gîtes de France","type":"hibp","url":"https://haveibeenpwned.com/Breach/GitesDeFrance"}],"summary":"A reported breach affecting Gîtes de France departmental branches exposed approximately 117,574 customer records, including contact and booking details.","supporting_quote":null,"technology_involved":["booking systems","customer databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-19","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Everest","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"676075d3eb0c3f0531f4ca96bc44d2439fcc09ae","impact_type":"data_theft","incident_date":"2026-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e290b01ff97e","org_name":"Brenner Base Tunnel","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Brenner Base Tunnel Ransomware Claim by Everest (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-17-brenner-base-tunnel-ransomware-claim-by-everest-oct-2026"}],"summary":"Everest claimed to have compromised Brenner Base Tunnel and exfiltrated data, but the claim and affected entity have not been independently verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"everest"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"TheHatman","variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-18","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"ef9aa97ff864e7802bdc0435b731d28a59ec2e93","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"GB","org_id":"d582b1ede2ec","org_name":"AstraZeneca","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇬🇧 We tracked a data breach claim by TheHatman listing AstraZeneca, a UK-based pharmaceutical company. The actor claims ","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117460945822041911"}],"summary":"TheHatman claims to have obtained AstraZeneca employee records using compromised Azure tenant credentials.","supporting_quote":"The actor claims over 280,000 employee records including names, emails, job titles, departments, phone numbers, and addresses, allegedly obtained via compromised Azure tenant credentials.","technology_involved":["Azure"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thehatman"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2026-10-17","discovered_date":"2026-10-16","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"b82ac45419f52a668f5af1c2a98603673e2c0174","impact_type":"data_theft","incident_date":"2026-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"933418b3d828","org_name":"Yamato Transport","org_type":"transportation_logistics","ransomware":null,"records_affected":5310000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Yamato Transport Discloses Breach of 5.3 Million Payment Service Records","type":"mastodon","url":"https://beyondmachines.net/event_details/yamato-transport-discloses-breach-of-5-3-million-payment-service-records-6-f-v-o-i/gD2P6Ple2L"}],"summary":"Yamato Transport reported that data was stolen from its Kuroneko Pay-Later Service, affecting approximately 5.31 million records; the method of access was not disclosed.","supporting_quote":null,"technology_involved":["Kuroneko Pay-Later Service","payment service system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Play","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"fc56bca895ec282655ce8d12ebd55057954e4400","impact_type":"data_theft","incident_date":"2026-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BE","org_id":"bee742c6ab70","org_name":"WSBI-ESBG","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"WSBI-ESBG Ransomware Claim by Play (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-17-wsbi-esbg-ransomware-claim-by-play-oct-2026"}],"summary":"The Play ransomware group claimed it exfiltrated data from WSBI-ESBG, but the claim has not been independently verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"play"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Returnero","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"481e184a7ceab43b3a9872726c9f214c4d5166ad","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"MX","org_id":"306dddc416df","org_name":"Secretaria de Salud","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇲🇽 We tracked a data breach claim by Returnero listing Secretaria de Salud, Mexico's Ministry of Health. Sample shared i","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117457325929735542"}],"summary":"A breach claim by Returnero listed Secretaria de Salud and included a sample with user profiles, plaintext passwords, emails, phone numbers, and health officials’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"returnero"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-18","id":"01d2b95714cc5179cf4489825733b5bc3cb3c260","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d7d6bf6645ba","org_name":"OpenCode","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys","type":"mastodon","url":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html"},{"fetched_at":null,"title":"OpenCode API Key Breach: OpenAI, Anthropic Keys at Risk | The CyberSec Guru","type":"mastodon","url":"https://thecybersecguru.com/news/opencode-api-key-breach/"}],"summary":"An intruder reached a legacy system at OpenCode, potentially exposing provider keys saved by some OpenCode Console users.","supporting_quote":null,"technology_involved":["OpenCode Console"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-19","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2026-10-17","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"ed838c1ec907680671613c7e4fad356e092188fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"no_letter","url":null},"notes":null,"org_country":"US","org_id":"9f511a4fbe67","org_name":"Mid Florida Dermatology & Plastic Surgery","org_type":"healthcare","ransomware":null,"records_affected":85585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Mid Florida Dermatology & Plastic Surgery Reports Breach Affecting 85,000 Patients","type":"mastodon","url":"https://beyondmachines.net/event_details/mid-florida-dermatology-plastic-surgery-reports-breach-affecting-85000-patients-z-0-4-7-a/gD2P6Ple2L"}],"summary":"Mid Florida Dermatology & Plastic Surgery reported a breach affecting 85,585 individuals, with personal, medical, financial, and credential information exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"The Gentlemen/VYPR","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"d4227edd1b74f7454992af5e783f9b6923af9e22","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f8d0b74508c0","org_name":"Medical Data Rx","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Law Firm Investigates Class Action Following Medical Data Rx Breach A law firm is investigating a class action lawsuit","type":"mastodon","url":"https://mastodon.social/@netsecio/117457363784983972"}],"summary":"Medical Data Rx, a Michigan-based IT provider, experienced a ransomware attack attributed to The Gentlemen/VYPR that disrupted healthcare data access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"thegentlemenvypr"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"pear","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"da8e918543f01fb8a7544da84f4f1b6e85fd60d8","impact_type":"unknown","incident_date":"2026-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"7335d0a301c7","org_name":"Macfarlan Capital Partners","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Macfarlan Capital Partners Ransomware Claim by pear (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-16-macfarlan-capital-partners-ransomware-claim-by-pear-oct-2026"}],"summary":"A ransomware group using the name pear allegedly listed Macfarlan Capital Partners as a victim, but the claim and any data exposure remain unverified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"pear"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"a32e148b979d3b5e96fcddb6f25c25452cd7a98c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f016ccf1247","org_name":"Kymberlie McNicholas","org_type":"nonprofit","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kymberlie%20McNicholas-2026-10-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"INC Ransom","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-17","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"4ad6c09e59ef6899dc10f63ad8140ccd70db7ca0","impact_type":"both","incident_date":"2026-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"a1e6ab29e781","org_name":"Kannarr Eye Care","org_type":"healthcare","ransomware":true,"records_affected":14003,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Kannarr Eye Care Notifies 14,000 Patients Following INC Ransom Attack","type":"mastodon","url":"https://beyondmachines.net/event_details/kannarr-eye-care-notifies-14000-patients-following-inc-ransom-attack-1-8-z-g-m/gD2P6Ple2L"}],"summary":"Kannarr Eye Care reported that the INC Ransom group encrypted systems and viewed or took sensitive health and personal records affecting 14,003 individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"incransom"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"a9b440daf3b18657414881906577180c6f1b7508","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"US","org_id":"5e798f0fec60","org_name":"Florida DMV","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Florida DMV Notifies Drivers of Data Breach; ShinyHunters Claims Leak Florida DMV confirms data breach after an attack","type":"mastodon","url":"https://mastodon.social/@netsecio/117457363578940484"}],"summary":"Florida DMV reported a data breach after an attacker used compromised credentials, while ShinyHunters claimed responsibility and alleged theft of 500,000 files.","supporting_quote":"Florida DMV confirms data breach after an attacker used compromised credentials.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"440dde5a604dc1a1eb757702631554a544eb2760","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"d92b26d33789","org_name":"ETS","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Millions of California Students' Data Exposed in Testing Provider Breach Massive data breach at testing provider ETS e","type":"mastodon","url":"https://mastodon.social/@netsecio/117457363195461518"}],"summary":"ETS reportedly suffered a breach in which names, addresses, and demographic information of millions of current and former California public school students were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-17","discovered_date":"2026-09-25","entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"5492eddf4ed1ad047543d1e5332e75bacb2f5233","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-17","outcome":"no_letter","url":null},"notes":null,"org_country":"US","org_id":"832528a4c850","org_name":"Educational Testing Service","org_type":"nonprofit","ransomware":null,"records_affected":5700000,"reviewed":false,"root_cause":"A stolen credential was used to access the ETS SFTP site.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"ETS Data Breach Exposes Records of Millions of California Students","type":"mastodon","url":"https://beyondmachines.net/event_details/ets-data-breach-exposes-records-of-millions-of-california-students-a-u-0-j-y/gD2P6Ple2L"},{"fetched_at":null,"title":"Standardized testing hack exposes names and addresses of millions of students","type":"mastodon","url":"https://www.latimes.com/california/story/2026-10-16/state-testing-student-data-hack"},{"fetched_at":null,"title":"\"The personal data of millions of California students is compromised after hackers breach the New Jersey-based Education","type":"mastodon","url":"https://sfba.social/@ucaccessnow/117460798842073583"},{"fetched_at":null,"title":"Millions of California Students' Data Exposed in Testing Provider Breach","type":"mastodon","url":"https://cyber.netsecops.io/articles/california-student-data-breach-exposes-millions-of-records/?utm_source=mastodon&utm_medium=social&utm_campaign=daily"}],"summary":"Educational Testing Service reported that an attacker used a stolen credential to access its SFTP site and copy student assessment files.","supporting_quote":"The attacker used a stolen credential to enter an ETS Secure File Transfer Protocol (SFTP) site.","technology_involved":["SFTP"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-18","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110","T1114","T1213","T1530"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2026-10-17","discovered_date":"2026-10-14","entry_asset":"api_or_integration_token","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-17","id":"d561e61238d263fc460c193a22195d180835f2bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"unknown","org_id":"9581c758c411","org_name":"ConnectWise","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A compromised vendor-side API secret was used to gain entry.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"ConnectWise SkyKick Credentials Abused to Compromise Microsoft 365 Tenants","type":"mastodon","url":"https://beyondmachines.net/event_details/connectwise-skykick-credentials-abused-to-compromise-microsoft-365-tenants-5-a-j-8-z/gD2P6Ple2L"},{"fetched_at":null,"title":"Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","type":"mastodon","url":"https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html"},{"fetched_at":null,"title":"Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","type":"press","url":"https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/"},{"fetched_at":null,"title":"ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants","type":"mastodon","url":"https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html"},{"fetched_at":null,"title":"🚨 BREAKING: The ConnectWise Cloud Backup breach is a serious warning for every Microsoft 365 admin and MSP. 🔎 IoCs, affe","type":"mastodon","url":"https://mastox.eu/@thecybersecguru/117462962749613432"},{"fetched_at":null,"title":"ConnectWise Cloud Backup Breach: OAuth Abuse, Microsoft 365 Exposure, IoCs and Remediation Guide The ConnectWise Cloud B","type":"mastodon","url":"https://thecybersecguru.com/news/connectwise-cloud-backup-breach/"}],"summary":"ConnectWise confirmed that attackers used a compromised vendor-side API secret to access customer Microsoft 365 environments.","supporting_quote":"Attackers used a compromised vendor-side API secret to gain entry.","technology_involved":["ConnectWise Cloud Backup","SkyKick","Microsoft 365","Microsoft Graph","Microsoft OneDrive","Microsoft SharePoint","Microsoft Teams"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"ConnectWise"},"updated_at":"2026-10-19","veris_action":"hacking","derived":{"vendors":[{"id":"9581c758c411","name":"ConnectWise"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"76bc0bc90ce6c6c974424bac24c87068bca5c8f0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2760836cc47c","org_name":"Catawba County","org_type":"government","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Catawba%20County-2026-10-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1199"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-18","id":"e94af7d976e8b75f15e1ffb805717db1b0bac975","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"US","org_id":"625d4ec0ee36","org_name":"Boston Children’s Health Physicians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Attorney General James and Attorney General Tong Secure $2.7 Million from Pediatric Health Network and IT Company for Failing to Protect Customer Data","type":"mastodon","url":"https://ag.ny.gov/press-release/2026/attorney-general-james-and-attorney-general-tong-secure-27-million-pediatric"},{"fetched_at":null,"title":"NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach","type":"press","url":"https://databreaches.net/2026/10/17/ny-ag-james-and-ct-ag-tong-secure-2-7-million-from-boston-childrens-health-physicians-and-xtium-for-2024-data-breach/"}],"summary":"Hackers accessed Boston Children’s Health Physicians’ network through a breach at its security services provider, XTIUM, and stole patient records.","supporting_quote":"In August 2024, XTIUM suffered a breach that allowed hackers to access 18 of its clients’ networks, including BCHP’s.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"XTIUM"},"updated_at":"2026-10-18","veris_action":"hacking","derived":{"vendors":[{"id":"87e5fd33248d","name":"XTIUM"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Rhysida","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"02d1a133b64aa6b017c0408bab99ec349c81018f","impact_type":"both","incident_date":null,"initial_access":"unknown","notes":null,"org_country":"US","org_id":"ad8ca6db6785","org_name":"Unnamed Maryland county","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Rhysida says it stole a Maryland county's files and is threatening to leak them unless paid. 9 detections, 21 IOCs. Full","type":"mastodon","url":"https://mastodon.social/@threadlinqs/117450830118969340"}],"summary":"Rhysida claimed to have stolen files from an unnamed Maryland county and threatened to leak them unless paid.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"rhysida"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Storm","variety":"organized_crime"},"attack_techniques":["T1199"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"bc68160b8f459affa17272645de2b720e82e41e9","impact_type":"data_theft","incident_date":"2026-09-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1199","notes":null,"org_country":"unknown","org_id":"a5e6eb46938f","org_name":"The Money Store","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"The Money Store Data Breach: What to Do Now | DataTrail","type":"mastodon","url":"https://www.datatrail.app/breach/the-money-store/"}],"summary":"The Money Store said an unauthorized third party accessed systems through an outside service provider’s remote monitoring and management tool and took information from residential mortgage loan files.","supporting_quote":"An unauthorized third party had gotten in on or about September 8, 2026, through a remote monitoring and management tool used by one of its outside service providers, and took information from the affected systems.","technology_involved":["remote monitoring and management tool"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"storm"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"45f834505577493a9ebc3b10101947eb012d7dc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3cd731a7f5d2","org_name":"The Krum Public Library","org_type":"government","ransomware":null,"records_affected":36360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005429"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"fc829c9f497ee7e978f0ab5cdac4739c9049011f","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"dfedad172b2c","org_name":"Synnovis","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Russian man linked to deadly NHS contractor hack arrested","type":"press","url":"https://databreaches.net/2026/10/16/russian-man-linked-to-deadly-nhs-contractor-hack-arrested/"}],"summary":"A 2024 hack of blood testing company Synnovis disrupted pathology services across several London hospitals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"14568a0bbcb046e39e6878b6bbb3144778257be1","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b5a3f9f4aa3","org_name":"Stitch Connect Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":113727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005430"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"thegentlemen","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"243e95d02fa7b599863a57f32fb96c77a0ddb09c","impact_type":"unknown","incident_date":"2026-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"a415ea82af6a","org_name":"St Peters Anglican Primary School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"St Peters Anglican Primary School Ransomware Claim by thegentlemen (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-16-st-peters-anglican-primary-school-ransomware-claim-by-thegentlemen-oct-2026"}],"summary":"Thegentlemen allegedly listed St Peters Anglican Primary School on its leak site, but the claim has not been independently verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"thegentlemen"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"2c151c66c8578d29f45f4c90b75a720a585ed396","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"no_letter","url":null},"notes":null,"org_country":"SO","org_id":"4f6f2ee662d9","org_name":"Somalia Ministry of Justice and Constitutional Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇸🇴 We tracked a data breach claim by ShinyHunters targeting Somalia's Ministry of Justice and Constitutional Affairs. Th","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117448858361435696"}],"summary":"ShinyHunters allegedly leaked notarial transaction records from Somalia's Ministry of Justice and Constitutional Affairs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"2de9217ba595f4819dec1e7ed8eff26e5dce8ba6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"83f9aa268d54","org_name":"Priory School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"UK School Faces Data Breach After Photographer's Vehicle Targeted","type":"mastodon","url":"https://osintsights.com/uk-school-faces-data-breach-after-photographers-vehicle-targeted?utm_source=mastodon&utm_medium=social"}],"summary":"A camera bag containing SD memory cards was stolen from a Pret-a-Portrait vehicle, and the cards may have held Priory School photographs and pupil names and class information.","supporting_quote":"“Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” wrote Jon Curtis-Brignell, headteacher at Priory School in Lewes.","technology_involved":["SD memory cards"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Pret-a-Portrait"},"veris_action":"physical","derived":{"vendors":[{"id":"be6bca079967","name":"Pret-a-Portrait"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"LockBit","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"f600a4e0e46dbaea7615ff482d304d35ae8525ed","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"38c0c5f26082","org_name":"Poole Group","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Poole Group investigating Lockbit ransomware attack","type":"mastodon","url":"https://www.cyberdaily.au/security/14307-exclusive-poole-group-investigating-lockbit-ransomware-attack"}],"summary":"Poole Group confirmed a cyber incident affecting part of its IT environment after LockBit claimed the attack and threatened to leak allegedly stolen data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"lockbit"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"fe357ed54983e27cb554475274f9a09243c1f41b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"043f7bf2c361","org_name":"OFX Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"OFX Group Confirms Unauthorized Access to Client and Applicant Personal Information","type":"mastodon","url":"https://beyondmachines.net/event_details/ofx-group-confirms-unauthorized-access-to-client-and-applicant-personal-information-b-g-n-3-l/gD2P6Ple2L"}],"summary":"OFX Group reported unauthorized access to internal files containing personal information, while stating that its client platform databases, client accounts, and funds were not accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"791596b4d10684427a74ed56ab690b728de35624","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"extracted","url":"https://oag.ca.gov/system/files/DATA%20BREACH%20NOTICE%20-%20NWS.pdf"},"notes":null,"org_country":"US","org_id":"3cd68a2c4c49","org_name":"Neuro Wellness Spa","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DATA%20BREACH%20NOTICE%20-%20NWS.pdf"}],"summary":"Neuro Wellness Spa inadvertently emailed a file containing patient information to another patient.","supporting_quote":"On August 24, 2026, a file containing patient information was inadvertently emailed to another patient instead of the correct document.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"e93f3f1201c5b0fc472ad0ec4de7b887203e5c3e","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"notes":null,"org_country":"KR","org_id":"708f17393d45","org_name":"National Health Insurance Service","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"KR: NHIS Employee Sold Data, Victims Uninformed for Three Months","type":"press","url":"https://databreaches.net/2026/10/16/kr-nhis-employee-sold-data-victims-uninformed-for-three-months/"}],"summary":"A National Health Insurance Service employee illegally sold subscribers’ personal information to external parties.","supporting_quote":"A National Health Insurance Service (NHIS) employee was dismissed for illegally selling personal information of health insurance subscribers to external parties, but victims have yet to be notified of the data breach.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"95bd175cde17fdcd850ef65a8ab55c7952e07950","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ead4fd11e33","org_name":"Mountrail County Medical Center","org_type":"healthcare","ransomware":null,"records_affected":24447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005423"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"7645d34169c40a29045b455dba26adca572f7f29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","notes":null,"org_country":"US","org_id":"7b5e582d2032","org_name":"Missouri Central Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers used phishing to gain access through a legacy account they targeted to bypass security controls.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Missouri Central Credit Union Email Breach Exposes Member Financial Data","type":"mastodon","url":"https://beyondmachines.net/event_details/missouri-central-credit-union-email-breach-exposes-member-financial-data-h-q-p-0-j/gD2P6Ple2L"}],"summary":"Missouri Central Credit Union reported unauthorized access to its email environment through phishing, exposing members' personal and financial information.","supporting_quote":"Attackers used a phishing scheme to gain entry into the credit union's email systems.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-10-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"7ec5fcfd36771766f3ce96a09f1c3be7c67ce135","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c91c8481b89","org_name":"Klein Independent School District","org_type":"education","ransomware":null,"records_affected":37966,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005431"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"0be4ca29dfd74b5a77d0980a2810df8b5a1026d1","impact_type":"data_theft","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"extracted","url":"https://oag.ca.gov/system/files/John%20G.%20Yphantides%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"157690767a63","org_name":"John G. Yphantides, a Professional Law Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/John%20G.%20Yphantides%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed the organization's network and acquired files between April 9 and April 13, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-08-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"0c85549051f7197bc792bd4058956b3dc8ec3472","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"465d45e2ece6","org_name":"Iroquois Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":217703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005425"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":"2024-09-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"39440ee99cf4db3f9a41e9174a3f98cdf6045156","impact_type":"data_theft","incident_date":"2024-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"extracted","url":"https://oag.ca.gov/system/files/Inner%20City%20Education%20Foundation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"84b3e73892d3","org_name":"Inner City Education Foundation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631486"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Inner%20City%20Education%20Foundation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Inner City Education Foundation reported that an unauthorized actor accessed certain systems and may have taken information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-19","id":"2fac13e768259f96547c42f9f8c7c01715fe49c5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbef53047362","org_name":"Ganxxet, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ganxxet%2C%20Inc.-2026-10-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"de479be603463e6ba6f5753ed425b086a35e7384","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a183553053da","org_name":"Encore Enterprises","org_type":"other","ransomware":null,"records_affected":4488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005426"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"DataSuckers","variety":"organized_crime"},"attack_techniques":["T1041","T1078","T1530","T1552"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"1324c6bb32fd00364be2ad12edc30c732ba20d0c","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"RU","org_id":"29c3c092795a","org_name":"Dodo Pizza","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Dodo Pizza's corporate credentials were exposed on GitHub and were used to access interconnected company systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia","type":"press","url":"https://therecord.media/russia-datasuckers-hackers-arrested"},{"fetched_at":null,"title":"Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia","type":"press","url":"https://databreaches.net/2026/10/16/moscow-police-detain-suspected-datasuckers-hackers-linked-to-breaches-in-ukraine-and-russia/"}],"summary":"Attackers used exposed Dodo Pizza corporate credentials to access company systems, including cloud storage and databases, and reportedly stole customer information.","supporting_quote":"The attack reportedly began when the hackers discovered Dodo Pizza's corporate credentials exposed on GitHub.","technology_involved":["GitHub","cloud storage","databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"hacking","derived":{"actor_id":"datasuckers"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"816f5e925e25ecadcef06904b624f6195b099deb","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"14d34c6b3f0d","org_name":"Delek US Energy, Inc.","org_type":"other","ransomware":null,"records_affected":2566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005427"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Qilin","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","other"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"9d4348ccb82697420d7da80563951e2f23ff3ab3","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"no_letter","url":null},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"AU","org_id":"06ad4b592ec1","org_name":"Chadwick Switchboards","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Aussie tech company with links to Defence, law enforcement allegedly breached by ransomware attack","type":"mastodon","url":"https://www.cyberdaily.au/security/14311-exclusive-aussie-tech-company-with-links-to-defence-law-enforcement-allegedly-breached-by-ransomware-attack"}],"summary":"Qilin listed Chadwick Switchboards and published a dataset that allegedly included accounts, admin data, staff folders and product data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"qilin"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","other"],"disclosed_date":"2026-10-16","discovered_date":"2026-09-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"ab9f61ae0da1c51c5d2479ac766c7184efe5181b","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-17","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_3_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"54c2f884ef93","org_name":"CDE","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized party used a compromised login credential to access the SFTP site.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631485"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_3_Redacted.pdf"}],"summary":"An unauthorized party used a compromised login credential to access an SFTP site used to exchange California student information with CDE and copied files.","supporting_quote":"The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information.","technology_involved":["SFTP site"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ETS"},"updated_at":"2026-10-17","veris_action":"hacking","derived":{"vendors":[{"id":"832528a4c850","name":"ETS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"5bdad532045aa2e5e3b550406984d6a3039fd4bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"47d664f69267","org_name":"BK Japan","org_type":"retail_ecommerce","ransomware":null,"records_affected":11180000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"BK Japan Discloses Data Breach Exposing 11.18 Million App Member Records","type":"mastodon","url":"https://beyondmachines.net/event_details/bk-japan-discloses-data-breach-exposing-11-18-million-app-member-records-3-r-0-4-e/gD2P6Ple2L"}],"summary":"BK Japan reported unauthorized access to the system managing mobile app member information, affecting approximately 11.18 million customer records.","supporting_quote":null,"technology_involved":["mobile app member information system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-10-16","discovered_date":"2026-08-12","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"f3f2b847561fb9b2062b6fb1d2e1ada2c1534b25","impact_type":"data_theft","incident_date":"2026-08-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CH","org_id":"6280e1eace23","org_name":"Beyond Gravity","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Beyond Gravity Reports Data Theft Following Targeted Cyberattack","type":"mastodon","url":"https://beyondmachines.net/event_details/beyond-gravity-reports-data-theft-following-targeted-cyberattack-2-z-2-8-m/gD2P6Ple2L"}],"summary":"Beyond Gravity reported data theft after detecting malicious activity in its IT systems on August 12, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"b0697f5c70acff91d9bfbcb6783417996e23872b","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"no_letter","url":null},"notes":null,"org_country":"unknown","org_id":"a3c69aa99294","org_name":"BAE Systems","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"BAE Systems cyberattack disrupts US federal court operations","type":"press","url":"https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/"}],"summary":"A cyberattack on BAE Systems disrupted the bankruptcy noticing systems it operates for the U.S. federal courts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Rhysida","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-18"},"first_seen":"2026-10-17","id":"b6358efbab8fafe0dee7d1abce0a9ed542d3311b","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"726c77fe2687","org_name":"Anne Arundel County","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Anne Arundel County Confirms Data Breach Following Rhysida Ransomware Claims Anne Arundel County, Maryland, confirmed a ","type":"mastodon","url":"https://infosec.exchange/@beyondmachines1/117456378876983531"},{"fetched_at":null,"title":"📰 Rhysida Ransomware Gang Hits Anne Arundel County, Steals 2.6TB of Data Rhysida ransomware gang claims responsibility f","type":"mastodon","url":"https://mastodon.social/@netsecio/117457363363053051"},{"fetched_at":null,"title":"Baltimore suburb confirms August data breach after ransomware claims","type":"press","url":"https://therecord.media/anne-arundel-county-maryland-confirms-data-breach"}],"summary":"Anne Arundel County confirmed a data breach after the Rhysida ransomware group claimed it stole government data and demanded a ransom.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-18","veris_action":"unknown","derived":{"actor_id":"rhysida"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"blacknevas","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"3fad174918f4cc526d8dd4a90ef11415a87c81eb","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AE","org_id":"780ae150bc07","org_name":"Amity University Dubai","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Amity University Dubai Ransomware Claim by blacknevas (Sep 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-15-amity-university-dubai-ransomware-claim-by-blacknevas-sep-2026"}],"summary":"The ransomware group blacknevas claimed that it had breached Amity University Dubai and listed alleged student and staff data on its leak site; the claim is unverified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"blacknevas"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Candiru","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-17","id":"65c806658f23872f32c6d1e53c5b738e4ee09e38","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ca68d90f9884","org_name":"Al Jazeera","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Zero-Click Ads: How an Unpatched Browser Can Be Silently Led to Spyware","type":"mastodon","url":"https://beyondmachines.net/event_details/zero-click-ads-how-an-unpatched-browser-can-be-silently-led-to-spyware-x-q-1-i-p/gD2P6Ple2L"}],"summary":"Citizen Lab reported that at least 45 Al Jazeera devices were targeted with spyware delivered through zero-click ads in 2024 and 2025.","supporting_quote":null,"technology_involved":["browser","in-app WebView"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"candiru"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Qilin","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"8d3f679b3d30746e43d6f150ad42f4fecd5d0521","impact_type":"unknown","incident_date":"2026-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3436297b19aa","org_name":"The Golden Legacy Financing","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Golden Legacy Financing Ransomware Claim by Qilin (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-14-golden-legacy-financing-ransomware-claim-by-qilin-oct-2026"}],"summary":"Qilin allegedly listed The Golden Legacy Financing on its leak site, but the claim and any data access or encryption have not been verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"qilin"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-10-15","discovered_date":"2026-10-13","entry_asset":"api_or_integration_token","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"ab5ad68b6c2956ab8ea9f116842bf8f2852e0b66","impact_type":"data_theft","incident_date":"2026-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"d2aafce73a95","org_name":"SourceNext Corporation","org_type":"technology_saas","ransomware":null,"records_affected":22519960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"SourceNext Data Breach in Japan: 22.5 Million Member Records Taken Through an API, Including Encrypted Passwords","type":"mastodon","url":"https://japancyberwatch.com/articles/sourcenext-member-data-breach-passwords-2026"}],"summary":"SourceNext Corporation said attackers abused its member information retrieval API and took data from 22,519,960 member records.","supporting_quote":null,"technology_involved":["member information retrieval API","member information management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"nightspire","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"6049932e7ed8ca3c3d37c4f573d745227661c370","impact_type":"data_theft","incident_date":"2026-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"no_letter","url":null},"notes":null,"org_country":"unknown","org_id":"5b7f18e8602a","org_name":"So**n Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"S*o**n* Public Schools Ransomware Claim by nightspire (Sep 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-15-s-o-n-public-schools-ransomware-claim-by-nightspire-sep-2026"}],"summary":"nightspire claimed that So**n Public Schools was a ransomware victim and said data was not available.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"nightspire"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"INC Ransom","variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal","credentials","secrets"],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"d3f884a0ddceff8eceac2b9e62db5764c3f61bc4","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f362f06de392","org_name":"Sangre de Cristo Electric Association","org_type":"energy_utilities","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Network intrusion disrupts Sangre de Cristo Electric Association services in Colorado","type":"mastodon","url":"https://dysruptionhub.com/sangre-de-cristo-colorado-cyber-intrusion/"}],"summary":"Sangre de Cristo Electric Association reported an intrusion that disrupted bill payments and telephone services; INC Ransom claimed it stole information, which the cooperative has not confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"incransom"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Direwolf","variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-15","discovered_date":"2026-08-21","entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"634d1bf5a33a16cf3f949a30e629f6bf3725b397","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-21","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"US","org_id":"9dc455756436","org_name":"Photon Health","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited a previously unknown vulnerability in Photon Health’s self-hosted Metabase application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Photon Health Discloses Data Breach After Metabase Zero-Day Exploitation","type":"mastodon","url":"https://beyondmachines.net/event_details/photon-health-discloses-data-breach-after-metabase-zero-day-exploitation-u-v-0-i-z/gD2P6Ple2L"}],"summary":"Photon Health said attackers exploited a previously unknown vulnerability in its self-hosted Metabase application and accessed stored data that may have been exfiltrated.","supporting_quote":"Attackers exploited a previously unknown vulnerability in Photon Health’s self-hosted Metabase application, which was used for business intelligence, product metrics, and customer dashboards.","technology_involved":["Metabase"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"direwolf"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-15","discovered_date":"2026-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"b51420f89337b238f6e335dfcf46b0bad55591e1","impact_type":"data_theft","incident_date":"2026-09-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"extracted","url":"https://oag.ca.gov/system/files/MLD%20-%20Sample%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"bccaddca5721","org_name":"MLD Mortgage Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MLD%20-%20Sample%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005428"}],"summary":"MLD Mortgage Inc. reported that an unauthorized third party accessed its environment through a service provider's remote monitoring and management platform and acquired information from affected systems.","supporting_quote":"Our investigation determined that, beginning on or about September 8, 2026, an unauthorized third party accessed a portion of our environment through a remote monitoring and management platform used by a third-party service provider that supports our environment.","technology_involved":["remote monitoring and management platform"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-16","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-15","discovered_date":"2025-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-15","id":"0e9aa1f7b323f446e22aa6cd0fcb7720e9022dd6","impact_type":"both","incident_date":"2025-04-23","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"8db520bceeac","org_name":"Legal Aid Agency","org_type":"government","ransomware":true,"records_affected":250000,"reviewed":false,"root_cause":"Criminals exploited vulnerabilities in the Legal Aid Agency's IT systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978","type":"press","url":"https://therecord.media/uk-legal-aid-cyberattack-data"},{"fetched_at":null,"title":"UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","type":"mastodon","url":"https://osintsights.com/uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records?utm_source=mastodon&utm_medium=social"},{"fetched_at":null,"title":"The Legal Aid Agency held onto records from 1978, got hacked, then sat on it for 18 months before admitting the full dam","type":"mastodon","url":"https://infosec.exchange/@Javvad/117444135996410518"},{"fetched_at":null,"title":"UK Legal Aid Agency: Hackers stole records dating back to 1978","type":"press","url":"https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/"},{"fetched_at":null,"title":"UK Legal Aid Agency Hack Scope Widens After Forensic Review","type":"press","url":"https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/"},{"fetched_at":null,"title":"Legal Aid Agency cyberattack: Compromised data goes back to 1978","type":"press","url":"https://databreaches.net/2026/10/15/legal-aid-agency-cyberattack-compromised-data-goes-back-to-1978/"},{"fetched_at":null,"title":"Here's the official statement, delivered to Parliament yesterday: https:// commonsbusiness.parliament.uk/ Document/10810","type":"mastodon","url":"https://infosec.exchange/@AAKL/117445745079192516"},{"fetched_at":null,"title":"The UK Legal Aid Agency breach from April 2025 has expanded after forensic review to include records dating back to 1978","type":"mastodon","url":"https://infosec.exchange/@cyberworldops/117445644915925942"},{"fetched_at":null,"title":"UK Legal Aid Agency Breach Exposes Decades of Personal Records","type":"mastodon","url":"https://osintsights.com/uk-legal-aid-agency-breach-exposes-decades-of-personal-records?utm_source=mastodon&utm_medium=social"}],"summary":"Criminals exploited vulnerabilities in the Legal Aid Agency's IT systems, accessed personal information, and exfiltrated data.","supporting_quote":"happened because criminals were able to exploit vulnerabilities in the LAA’s IT systems and gain access to systems containing personal information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-16","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"8c2991858545eee96dd45878153d922db486f8d6","impact_type":"data_theft","incident_date":"2026-10-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"KR","org_id":"62bb112b77c8","org_name":"Korean Federation of Community Credit Cooperatives","org_type":"financial","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":"Attackers exploited vulnerabilities on web pages to gain access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Korean Federation of Community Credit Cooperatives Report Cyberattack, Data Breach","type":"mastodon","url":"https://beyondmachines.net/event_details/korean-federation-of-community-credit-cooperatives-report-cyberattack-data-breach-n-r-4-v-3/gD2P6Ple2L"}],"summary":"The Korean Federation of Community Credit Cooperatives reported that attackers exploited web page vulnerabilities and exfiltrated data affecting approximately 400 insurance customers.","supporting_quote":"Attackers exploited vulnerabilities on web pages to gain access.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"n0n","variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"812b31cd74c2833a8c74c44979716efa8edfe979","impact_type":"both","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"AU","org_id":"d73dfb8d7a7c","org_name":"Hunter Neurology","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Hunter Neurology investigating patient data breach claims","type":"mastodon","url":"https://www.cyberdaily.au/security/14305-exclusive-hunter-neurology-investigating-patient-data-breach-claims"},{"fetched_at":null,"title":"Hunter Neurology Ransomware Claim by N0n (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-13-hunter-neurology-ransomware-claim-by-n0n-oct-2026"}],"summary":"Hunter Neurology is investigating n0n’s claim that patient data was stolen in an incident affecting a third-party provider’s environment, and n0n threatened to publish the data.","supporting_quote":"“Based on our investigations to date, we understand this claim relates to an incident affecting the environment of a third-party technology provider that hosts and supports our systems,” a spokesman for Hunter Neurology told Cyber Daily.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-15","veris_action":"hacking","derived":{"actor_id":"n0n"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-15","discovered_date":"2026-10-13","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-16","id":"26d40d540ec70ef20d3fb2b808cbf0c2736303b1","impact_type":"unknown","imported_from":null,"incident_date":"2026-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"no_letter","url":null},"notes":null,"org_country":"JP","org_id":"5d7f06bd7527","org_name":"Burger King Japan","org_type":"retail_ecommerce","ransomware":null,"records_affected":11180000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Burger King Japan disclosed a breach affecting 11.18 million app membership records in its member management system. At ","type":"mastodon","url":"https://infosec.exchange/@cyberworldops/117451496403721856"},{"fetched_at":null,"title":"Burger King Japan Data Breach: 11.18 Million App Members' Names, Phone Numbers and Birth Dates Taken","type":"mastodon","url":"https://japancyberwatch.com/articles/burger-king-japan-app-member-data-breach-2026"},{"fetched_at":null,"title":"Burger King Japan Data Breach Affects 11.18 Million App Members","type":"mastodon","url":"https://hackread.com/burger-king-japan-data-breach-11-million-app-members/"},{"fetched_at":null,"title":"Burger King Japan data breach exposes 11 million customer records","type":"press","url":"https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/"},{"fetched_at":null,"title":"11.18 million Burger King Japan app members' details leaked. Read the company's apology notice, link below. # BurgerKing","type":"mastodon","url":"https://infosec.exchange/@Javvad/117451426728094936"},{"fetched_at":null,"title":"Burger King Japan Breach Compromises 11 Million Customer Records","type":"mastodon","url":"https://osintsights.com/burger-king-japan-breach-compromises-11-million-customer-records?utm_source=mastodon&utm_medium=social"}],"summary":"Burger King Japan disclosed a breach affecting 11.18 million app membership records in its member management system.","supporting_quote":null,"technology_involved":["member management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"fa40deee1d741067e3b5c229aab838e63491173c","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"4a6b50367134","org_name":"Administrative Office of the U.S. Courts","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Federal bankruptcy courts dealing with outages after contractor cyberattack","type":"press","url":"https://therecord.media/federal-bankruptcy-courts-dealing-with-cyberattack-outage"}],"summary":"A cyberattack involving BAE Systems disrupted the Bankruptcy Noticing Center used by federal bankruptcy courts, halting production of bankruptcy notices.","supporting_quote":"A cyberattack on a U.S. government contractor has impacted the platform used by all federal bankruptcy courts across the country.","technology_involved":["Bankruptcy Noticing Center (BNC)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"BAE Systems"},"veris_action":"hacking","derived":{"vendors":[{"id":"a3c69aa99294","name":"BAE Systems"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"HYFLOCK","variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"6b771bb5d03c751408c5fc8ad2b52ab63a0a7c21","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"added688acda","org_name":"YYC Advisors","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"YYC Advisors Ransomware Claim by HYFLOCK (Sep 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-14-yyc-advisors-ransomware-claim-by-hyflock-sep-2026"}],"summary":"HYFLOCK claimed on its leak site that it exfiltrated approximately 300GB of data from YYC Advisors, but the claim and victim identity are unverified and internally inconsistent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"hyflock"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-10-14","discovered_date":"2026-10-05","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"5a79ba0d4290ba7088a87425c05308b586be6e74","impact_type":"disruption_or_ransomware","incident_date":"2026-10-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"f7c060be87f4","org_name":"Ride On Express Holdings","org_type":"retail_ecommerce","ransomware":true,"records_affected":6500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Ride On Express Investigates Potential Data Breach Affecting Up to 6.5 Million Customer Records","type":"mastodon","url":"https://beyondmachines.net/event_details/ride-on-express-investigates-potential-data-breach-affecting-up-to-6-5-million-customer-records-v-k-l-s-l/gD2P6Ple2L"}],"summary":"Ride On Express Holdings reported unauthorized access to externally operated servers used by its food delivery services, while the server provider reported a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"78fca487653ca8cb06e2178a4dff82fc6f06b371","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-14","outcome":"no_letter","url":null},"notes":null,"org_id":"a0c4a0371cf0","org_name":"Origin Energy","org_type":"energy_utilities","ransomware":null,"records_affected":900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Origin Energy chairman Scott Perkins stated that no stolen customer data from the July breach has been published online ","type":"mastodon","url":"https://mastodon.social/@hacksgr/117439396722621342"}],"summary":"Origin Energy said a July breach affected approximately 900,000 current and former customers and exposed personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-14","discovered_date":"2026-10-12","entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"5510bd75bd6ef8353de85d7c50c971c4e6da44c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"60e580e48e3d","org_name":"OK Savings Bank","org_type":"financial","ransomware":null,"records_affected":183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"OK Savings Bank Investigates Potential Data Breach","type":"mastodon","url":"https://beyondmachines.net/event_details/ok-savings-bank-investigates-potential-data-breach-w-l-s-p-h/gD2P6Ple2L"}],"summary":"OK Savings Bank detected unauthorized access to a loan application page, and information belonging to 183 customers may have been exposed.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":"2026-08-22","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"eb489558b982d125f83420617d43c8fee5a5b912","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"e6b8526ac457","org_name":"Mobileum","org_type":"technology_saas","ransomware":null,"records_affected":45,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Mobileum Data Breach Exposes Names and Social Security Numbers","type":"mastodon","url":"https://beyondmachines.net/event_details/mobileum-data-breach-exposes-names-and-social-security-numbers-h-w-5-y-h/gD2P6Ple2L"}],"summary":"Mobileum reported unauthorized access to its network environment, and an investigation found that affected systems contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"updap","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"05638b0012c3083bc71b419c0ab6275513faae7f","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"1f11215d008a","org_name":"Ministry of Internal Affairs of Russia","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇷🇺 We tracked a data breach claim by updap listing Rospassport, the Russian Federal Passport system operated by the Mini","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117438202546807597"}],"summary":"A post reported that updap claimed a 636 GB dump from Rospassport containing passport details and other personal information.","supporting_quote":null,"technology_involved":["Rospassport"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"updap"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"The Gentlemen","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-10-14","discovered_date":"2026-10-05","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"46a1d85104de8efca7c7f0b49fb79e25ce30e803","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"attack_techniques without supporting words dropped: T1567","org_country":"AU","org_id":"997a3e3e02e0","org_name":"Mandurah State Emergency Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Mandurah SES confirms operations unaffected by ransomware attack","type":"mastodon","url":"https://www.cyberdaily.au/security/14294-exclusive-mandurah-ses-confirms-operations-unaffected-by-ransomware-attack"}],"summary":"Mandurah State Emergency Service confirmed unauthorised access to a server containing historical records, and data from the incident was later published online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"thegentlemen"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Payouts King","variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2026-10-14","discovered_date":"2026-01-12","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"bc3b619d9ae8a26fc19ab35d6c4951c4a5ba4abe","impact_type":"data_theft","imported_from":null,"incident_date":"2025-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"b98128bdb165","org_name":"Lehigh Valley Restaurant Brands","org_type":"retail_ecommerce","ransomware":null,"records_affected":17892,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Lehigh Valley Restaurant Brands Data Breach Affects Approximately 18,000 Individuals as Payouts King Claims 411 GB Stolen","type":"mastodon","url":"https://beyondmachines.net/event_details/lehigh-valley-restaurant-brands-data-breach-affects-approximately-18000-individuals-as-payouts-king-claims-411-gb-stolen-y-x-m-z-z/gD2P6Ple2L"}],"summary":"Lehigh Valley Restaurant Brands reported that files were copied from its systems, affecting 17,892 individuals, and Payouts King claimed responsibility.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"payoutsking"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":"2026-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"98c122f2537ea0d6deb3c423d96f21c37bad48da","impact_type":"data_theft","incident_date":"2026-08-13","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual_Notice_Template.pdf"},"notes":null,"org_country":"US","org_id":"79513812acf5","org_name":"Kern County Superintendent of Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in a third-party software product the organization used allowed unauthorized access to part of its environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631271"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual_Notice_Template.pdf"}],"summary":"Kern County Superintendent of Schools reported that a vulnerability in a third-party software product allowed unauthorized access to part of its environment, and personal information was obtained.","supporting_quote":"On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment beginning August 13, 2026.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-15","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Storm","variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"78c890680b5fb57b7a9d515dd826a3da2335e8e9","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"unknown","org_id":"d45606dc45f3","org_name":"Johnson Investment Counsel","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The breach followed the compromise of a third-party MSP.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Johnson Investment Counsel Discloses Data Breach via Third-Party MSP Johnson Investment Counsel discloses data breach ","type":"mastodon","url":"https://mastodon.social/@netsecio/117439628431900153"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Johnson%20Investment%20Counsel-2026-10-16"}],"summary":"Johnson Investment Counsel disclosed a data breach after a third-party MSP was compromised; Storm claimed theft of client data including SSNs.","supporting_quote":"Johnson Investment Counsel discloses data breach after third-party MSP was compromised.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"storm"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"weak_or_reused_password","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"a7716c2061f2c2e47bfaa73f525c139cbff4a850","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-14","outcome":"no_letter","url":null},"notes":null,"org_country":"DK","org_id":"9231ed1b9091","org_name":"Denmark's national population register","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"Pays ApS accounts reportedly used the weak password “123456”.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"🚨 Denmark’s CPR data breach is a cybersecurity nightmare. 🇩🇰 8.8 MILLION identities exposed. 🔓 Pays ApS accounts reporte","type":"mastodon","url":"https://mastox.eu/@thecybersecguru/117440607907239185"}],"summary":"Denmark’s national population register was accessed through a trusted third party, exposing 8.8 million identities.","supporting_quote":"Pays ApS accounts reportedly used the password “123456”.","technology_involved":["national population register"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Pays ApS"},"veris_action":"unknown","derived":{"vendors":[{"id":"c673c37ff0c6","name":"Pays ApS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"weak_or_reused_password","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"63dad4e0d801a0907dc4e00a9d4021a663b86088","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"99f3e10aeec3","org_name":"Denmark's national CPR register","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"A weak “123456” password at the IT vendor was reportedly the entry point.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"🤖 Denmark's national CPR register: ~8.8M ID numbers (nearly the whole population) exposed. Entry point reportedly a weak","type":"mastodon","url":"https://infosec.exchange/@cloud/117437400358207126"}],"summary":"Denmark's national CPR register reportedly exposed about 8.8 million ID numbers after an entry point involving a weak password at IT vendor Pays ApS.","supporting_quote":"Entry point reportedly a weak \"123456\" password at a small IT vendor, Pays ApS.","technology_involved":["CPR register"],"third_party":{"archetype":null,"involved":true,"vendor":"Pays ApS"},"veris_action":"hacking","derived":{"vendors":[{"id":"c673c37ff0c6","name":"Pays ApS"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-14","id":"aae4c661f67208167404e20788fde4288c8e20df","impact_type":"data_theft","incident_date":"2026-01-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_id":"2979fbcbdf63","org_name":"Crunchbase","org_type":"technology_saas","ransomware":true,"records_affected":560000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"@ XposedOrNot += Crunchbase Data Breach The Crunchbase # databreach occurred in January 2026 when the private company in","type":"mastodon","url":"https://infosec.exchange/@XposedOrNot/117439903005370032"},{"fetched_at":null,"title":"Have I Been Pwned: Crunchbase","type":"hibp","url":"https://haveibeenpwned.com/Breach/Crunchbase"}],"summary":"Crunchbase was reportedly targeted by ShinyHunters in January 2026, and data later published online included 560,000 unique email addresses and associated personal and professional information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Dark Project","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"c9bca1f06908a4c5a9fb24952564848417d25eb3","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ce79eddf962d","org_name":"Claire's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Retailer Claire's Investigates Data Breach Claim by 'Dark Project' Group Retailer Claire's is investigating a potentia","type":"mastodon","url":"https://mastodon.social/@netsecio/117439628879765844"}],"summary":"Claire's is investigating a data breach claim by Dark Project, which says it stole 1.71 TB of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"darkproject"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"12ec81f15691e51b81fedd64789df4a7b7a01e0a","impact_type":"unknown","incident_date":"2025-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"no_text","url":"https://oag.ca.gov/system/files/BDG%20Law%20Group-%20Regulator%20Notice%20Letter_Wave%202_CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eaea9b48a5bb","org_name":"BDG Law Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631323"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"f62b87ae5d0cd855d996bb2ce15635323a4c175e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"ba6ae62bee41","org_name":"BBC International LLC","org_type":"manufacturing","ransomware":null,"records_affected":42,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"BBC International Data Breach Potentially Exposes Employee PII and Health Information","type":"mastodon","url":"https://beyondmachines.net/event_details/bbc-international-data-breach-potentially-exposes-employee-pii-and-health-information-0-m-8-m-r/gD2P6Ple2L"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#BBC%20International%20LLC-2026-10-16"}],"summary":"BBC International reported unauthorized access to its environment that may have exposed personal, financial, and medical information of employees and related individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-14","discovered_date":"2026-08-27","entry_asset":"api_or_integration_token","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"7610d85ca252037f2958af9358b135269a06240c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20AssuranceAmerica%20Managing%20General%20Agency%2C%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"95be2bf89df9","org_name":"AssuranceAmerica Managing General Agency, LLC","org_type":"financial","ransomware":null,"records_affected":22952,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20AssuranceAmerica%20Managing%20General%20Agency%2C%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20AssuranceAmerica%20Managing%20General%20Agency%2C%20LLC.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005424"}],"summary":"AssuranceAmerica Managing General Agency detected suspicious activity involving an API endpoint used for insurance quotes, and personal information was improperly obtained.","supporting_quote":null,"technology_involved":["API endpoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110","T1190","T1552","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal","secrets"],"disclosed_date":"2026-10-14","discovered_date":"2026-10-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-19"},"first_seen":"2026-10-14","id":"964615a0665cd99c0e86d0bca67d2b59e881cf7d","impact_type":"both","incident_date":"2026-10-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"JP","org_id":"02e31072bd01","org_name":"Arcadia Inc.","org_type":"technology_saas","ransomware":null,"records_affected":3140000,"reviewed":false,"root_cause":"A directory traversal flaw on the media server gave the attacker access to internal URLs and source files, including a config file containing a secret key used for login between services.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Japan Disaster Alert Email Breach: Up to 3.1 Million Addresses Exposed at SpeeCAN RAIDEN, and 1.4 Million Phishing Emails Sent Through It","type":"mastodon","url":"https://japancyberwatch.com/articles/arcadia-speecan-raiden-disaster-alert-breach-2026#how-the-attackers-got-in"},{"fetched_at":null,"title":"Arcadia Inc. Data Breach Halts Disaster Alert Services Across Japan","type":"mastodon","url":"https://beyondmachines.net/event_details/arcadia-inc-data-breach-halts-disaster-alert-services-across-japan-i-m-p-g-6/gD2P6Ple2L"},{"fetched_at":null,"title":"Japan Disaster Alert Email Breach: Up to 3.1 Million Addresses Exposed at SpeeCAN RAIDEN, Used by Hundreds of Municipalities","type":"mastodon","url":"https://japancyberwatch.com/articles/arcadia-speecan-raiden-disaster-alert-breach-2026"},{"fetched_at":null,"title":"Arcadia Data Breach Potentially Exposes Millions of Emergency Alert Records","type":"mastodon","url":"https://beyondmachines.net/event_details/arcadia-data-breach-potentially-exposes-millions-of-emergency-alert-records-p-q-q-s-s/gD2P6Ple2L"}],"summary":"Attackers exploited a directory traversal flaw on Arcadia's media server, accessed internal files and information, and used a backdoor to send phishing emails through Arcadia's system.","supporting_quote":"A media server that serves attachments had a directory path traversal flaw that gave access to internal URLs","technology_involved":["media server","internal login API"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-19","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-13","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"d949ad9a85238e921c36c72e0228e73706d19577","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42bd81d48dde","org_name":"zizzl, llc.","org_type":"financial","ransomware":null,"records_affected":6447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005411"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-13","id":"73c8209e395668058622ffbceb9730ee3f888cd3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"3f829b4a81f6","org_name":"Vibetech","org_type":"professional_services","ransomware":null,"records_affected":13700000,"reviewed":false,"root_cause":"The database was publicly accessible without authentication or password protection.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Unsecured Vibetech-Linked Database Exposes 13.7 Million Breach Records","type":"mastodon","url":"https://beyondmachines.net/event_details/unsecured-vibetech-linked-database-exposes-13-7-million-breach-records-v-k-x-v-b/gD2P6Ple2L"},{"fetched_at":null,"title":"AI Firm Exposes 14M Credentials in Unsecured Database","type":"mastodon","url":"https://osintsights.com/ai-firm-exposes-14m-credentials-in-unsecured-database?utm_source=mastodon&utm_medium=social"}],"summary":"A database linked to Vibetech was publicly accessible without authentication and exposed approximately 13.7 million records from historical breaches and leaks.","supporting_quote":"A security researcher traced the exposed IP address to a .in domain associated with Vibetech and found that the database could be accessed through a web browser without authentication.","technology_involved":["database","threat intelligence dashboard"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-14","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Panzer","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"195a8d3e5d7831d333b062e8556d382634f61c97","impact_type":"data_theft","incident_date":"2026-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"c909664c50d7","org_name":"Valode & Pistre","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Valode & Pistre Ransomware Claim by Panzer (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-13-valode-pistre-ransomware-claim-by-panzer-oct-2026"}],"summary":"The Panzer ransomware group claimed to have exfiltrated data from Valode & Pistre, but the claim has not been independently verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"panzer"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":"2026-08-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"9be6dee054395b10d48d812a46f7b1dbb2aa8b8f","impact_type":"data_theft","incident_date":"2026-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tulare%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"a06e64b59f16","org_name":"Tulare Joint Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631234"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tulare%20Sample%20Notice_0.pdf"}],"summary":"Tulare Joint Union High School District identified unauthorized activity and later determined that an unknown actor copied or downloaded certain files and folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":"2026-10-11","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7cc1ff6a9411095620298472d256fbdff9bcbd66","impact_type":"disruption_or_ransomware","incident_date":"2026-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"838860ff3686","org_name":"The Foschini Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South African clothing retailer Foschini Group investigating cyberattack on British fashion brands","type":"press","url":"https://therecord.media/foschini-group-south-africa-cyber"}],"summary":"The Foschini Group reported a cyberattack that disrupted IT systems at three of its British fashion brands.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"BO Team","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dccea1eb0e89694077725d2bb2b6caaf9df05424","impact_type":"disruption_or_ransomware","incident_date":"2026-10-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"a5e2b53ae958","org_name":"SkyNet","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Russian internet provider SkyNet reports outages after cyberattack claimed by Ukrainian hackers","type":"press","url":"https://therecord.media/russian-internet-provider-skynet-reports-outages-ddos"}],"summary":"SkyNet reported service disruptions from a DDoS attack that it said began on October 6, while BO Team separately claimed responsibility for attacks on the provider.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"boteam"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Havbomor","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0a79bae287a4068155590d502fc2cece5902033b","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"74c937e7e41d","org_name":"Raptor Supplies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇺🇸 We tracked a data breach claim by Havbomor naming Raptor Supplies, a US government and defense contractor. The actor ","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117433579292383069"}],"summary":"Havbomor claimed that a database containing over 100 million records related to military, government, and civilian contractors was breached at Raptor Supplies.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"havbomor"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"2b1d568831316589656f140390ec932aeb7b2e70","impact_type":"unknown","incident_date":"2026-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_-_Porter__Company_-_Adult_No_CM_Notice_Letter_Template%2840257131.2%29_V2_40289983v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa4ce829022f","org_name":"Porter and Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631249"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005421"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"86fdc5748a9aca9362eb0e0315b1a05b3f775336","impact_type":"data_theft","incident_date":"2026-09-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"c44b70d0ac49","org_name":"Pays ApS","org_type":"professional_services","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"At least three Pays accounts, including an administrator account, used the weak password “123456”; the hacker also said access was obtained with a leaked former employee password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"`123456’ password used in massive Danish CPR data breach - The Copenhagen Post","type":"mastodon","url":"https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/"},{"fetched_at":null,"title":"Denmark’s CPR Breach: How ‘123456’ Exposed 8.8 Million Records and the Systemic Collapse of Third-Party Trust Denmark's ","type":"mastodon","url":"https://thecybersecguru.com/news/denmark-cpr-breach-pays-aps-123456/"}],"summary":"Hackers used compromised access associated with Pays to retrieve information from Denmark’s CPR register and store it externally.","supporting_quote":"At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access to Denmark’s CPR register, Politiken reports.","technology_involved":["CPR register"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"56cc2f309661c020ffd550b368fb368dcc347f81","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69402cea7f72","org_name":"Murray County","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Murray%20County-2026-10-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1213"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-14","id":"e2e6b5b3cf6fafc051dc1d2f6992cea01cf748b9","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"unknown","org_id":"c13344b4d4bd","org_name":"Meta","org_type":"technology_saas","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":"An employee's stolen credentials were used to access Meta's GitHub repositories; the source of the stolen credentials is not stated.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Meta GitHub Breach Exposes Code, Data of 1,500","type":"mastodon","url":"https://shattered.io/meta-github-breach-1500-people-2026"},{"fetched_at":null,"title":"Meta GitHub Breach: Stolen Credentials Expose Source Code and Personal Data of 1,500 People Meta's GitHub breach exposed","type":"mastodon","url":"https://thecybersecguru.com/news/meta-github-breach-source-code-data-1500-people/"},{"fetched_at":null,"title":"Meta Discloses GitHub Repository Breach Affecting Approximately 1,500 Individuals","type":"mastodon","url":"https://beyondmachines.net/event_details/meta-discloses-github-repository-breach-affecting-approximately-1500-individuals-9-l-t-w-l/gD2P6Ple2L"},{"fetched_at":null,"title":"🔐 Meta GitHub breach: a stolen employee credential gave attackers access to product source code and personal data on ~1,","type":"mastodon","url":"https://techhub.social/@cyberkendra/117435120451426557"},{"fetched_at":null,"title":"Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach","type":"press","url":"https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/"},{"fetched_at":null,"title":"Hackers used stolen credentials in a recent Meta GitHub breach to steal proprietary source code and the personal data of","type":"mastodon","url":"https://infosec.exchange/@DailyCyberSecurity/117443887036024150"},{"fetched_at":null,"title":"🚨 BREAKING: Meta has suffered a GitHub breach. 🔎 What happened, what remains unknown, and the security lessons for every","type":"mastodon","url":"https://mastox.eu/@thecybersecguru/117440387800229288"},{"fetched_at":null,"title":"Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach","type":"mastodon","url":"https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach"}],"summary":"An external group used an employee’s stolen credentials to access Meta GitHub repositories and take business data and personal information.","supporting_quote":"Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal data for a limited number of people, most of whom were Meta employees.","technology_involved":["GitHub"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"GitHub"},"updated_at":"2026-10-16","veris_action":"hacking","derived":{"vendors":[{"id":"6a05e21126a6","name":"GitHub"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":"2025-11-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"69064b1a8360ea14280da8690774d43f039dfdc2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ae4e16be3b8","org_name":"Mercadien PC Certified Public Accountants","org_type":"financial","ransomware":null,"records_affected":5219,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005417"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":"2025-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-15","id":"7ebdeebfe680fae9f9fbb6d3cf65b4185b09084c","impact_type":"data_theft","incident_date":"2025-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"extracted","url":"https://oag.ca.gov/system/files/Magna%20Hospitality%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"70381443b2b6","org_name":"Magna Hospitality Group","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Magna Hospitality Group Discloses Ransomware Breach Exposing 385 GB of Data","type":"mastodon","url":"https://beyondmachines.net/event_details/magna-hospitality-group-discloses-ransomware-breach-exposing-385-gb-of-data-h-8-v-6-5/gD2P6Ple2L"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631245"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Magna%20Hospitality%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Magna%20Hospitality%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Magna Hospitality Group reported that an unauthorized actor accessed certain systems and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dc554a33f768e67c190be3146e5b25b65bebe8a8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"7da72c73eb0f","org_name":"Liberating Research","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"UK: Commercial market research and data-gathering firm in the medical space leaked health data","type":"press","url":"https://databreaches.net/2026/10/13/uk-commercial-market-research-and-data-gathering-firm-in-the-medical-space-leaked-health-data/"}],"summary":"A data leak at Liberating Research contained sensitive medical information relating to almost 100,000 people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"0a3c33cfafa0574fd79718e2a6eba684f8153a6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-12","initial_access":"unknown","letter":{"date":"2026-10-15","outcome":"extracted","url":"https://oag.ca.gov/system/files/JM%20Bullion%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ef4197f9fe97","org_name":"JM Bullion, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1022,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631226"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20JM%20Bullion%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JM%20Bullion%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005419"},{"fetched_at":null,"title":"JM Bullion Data Breach: What to Do Now | DataTrail","type":"mastodon","url":"https://www.datatrail.app/breach/jm-bullion/"}],"summary":"JM Bullion reported suspicious activity affecting its network from April 12 to April 14, 2026, and said affected data included individuals' names with other information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"a79256d5c15851eb66513537ecf3a97615b179e0","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"5c30019a1f57","org_name":"Housing Ombudsman Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"UK Housing Ombudsman Probes Third-Party IT Breach","type":"mastodon","url":"https://osintsights.com/uk-housing-ombudsman-probes-third-party-it-breach?utm_source=mastodon&utm_medium=social"}],"summary":"A third-party IT security incident affected the Housing Ombudsman Service’s case management system, disrupting online complaint filing while the service investigates whether personal information was affected.","supporting_quote":null,"technology_involved":["case management system"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-13","discovered_date":"2026-05-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"33bdadbae6ab20aba324094bcdd4745ae2a8d1e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25b8f044b412","org_name":"EnTrans Holding, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3311,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005415"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-13","discovered_date":"2026-08-07","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"8b3f05750803cb5ce602264b8807c166f2eb3201","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f62abba4c21f","org_name":"Desert Orthopaedic Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Desert Orthopaedic Center Data Breach Exposes Patient Information","type":"mastodon","url":"https://beyondmachines.net/event_details/desert-orthopaedic-center-data-breach-exposes-patient-information-t-3-f-n-y/gD2P6Ple2L"}],"summary":"Desert Orthopaedic Center reported unauthorized access to its network, and an investigation found that patient information may have been accessed or copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b34b3bd766729306f9e5afccc3205d2c81557790","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ba78ef4d0b6c","org_name":"Defense Manpower Data Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Pentagon data breach exposes records of over 3M people","type":"mastodon","url":"https://www.foxnews.com/tech/pentagon-data-breach-exposes-records-over-3m-people"}],"summary":"The Defense Manpower Data Center reported unauthorized access to personally identifiable information affecting living and deceased individuals, with no indication the information had been misused.","supporting_quote":null,"technology_involved":["DMDC information system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"weak_or_reused_password","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"45e7d7f253f3c9749727d273777b56e4f6376716","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"2757689cc81c","org_name":"Danish Central Register of Persons","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"A Pays ApS account used to access the registry was protected by the password “123456”.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records — IT and data services company with weak passwords linked source of the hack","type":"mastodon","url":"https://www.tomshardware.com/tech-industry/cyber-security/hacker-claims-123456-password-let-them-breach-the-danish-national-registry-accessing-8-8-million-records-it-and-data-services-company-with-weak-passwords-linked-source-of-the-hack"}],"summary":"A hacker used a Pays ApS account protected by the password “123456” to access the Danish Central Register of Persons and retrieve 8.8 million records.","supporting_quote":"According to The Register, Pays ApS, an IT and data services company that lets customers reference the Danish Central Register of Persons (CPR) was the source of the hack, with the hacker saying that one of the accounts they breached was only protected by a ‘123456’ password.","technology_involved":["Danish Central Register of Persons (CPR)","web-based front-end"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Pays ApS"},"veris_action":"hacking","derived":{"vendors":[{"id":"c673c37ff0c6","name":"Pays ApS"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"cbf6dca5790097ff48f4f0ecf07c29043d79237f","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0c56118a8caf","org_name":"Cooperative U","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers reportedly exploited a vulnerability in refrigeration controllers, but the article does not identify which vulnerability was used.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Refrigeration Controller Hack Spoils Food Across European Supermarkets","type":"press","url":"https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/"}],"summary":"Attackers reportedly exploited a vulnerability in Danfoss refrigeration controllers and changed settings, affecting several Cooperative U stores.","supporting_quote":"Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages.","technology_involved":["Danfoss refrigeration controllers"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Danfoss"},"veris_action":"hacking","derived":{"vendors":[{"id":"8c2a9e160f08","name":"Danfoss"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Interlock","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d6df0d318dea07c654dc08de9b8672c5584a20a8","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"2f2608f599f9","org_name":"Concord Eye Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Concord Eye Center Ransomware Claim by Interlock (Oct 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-12-concord-eye-center-ransomware-claim-by-interlock-oct-2026"}],"summary":"Interlock allegedly claimed that it compromised Concord Eye Center and exfiltrated patient, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"interlock"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1199"],"confidence":"low","control_failure":"weak_or_reused_password","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-13","discovered_date":"2026-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"96ab366a12f2096459969aa86b6335ade7e0cd7f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"supporting_quote not found verbatim in source; confidence lowered; attack_techniques without supporting words dropped: T1213","org_country":"DK","org_id":"2a6e6d7d8071","org_name":"Central Register of Persons","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"The attacker reportedly entered through a Pays ApS account protected by the weak password \"123456\".","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Weak Password Exploited in Denmark's 8.8M Person Data Breach","type":"mastodon","url":"https://osintsights.com/weak-password-exploited-in-denmarks-88m-person-data-breach?utm_source=mastodon&utm_medium=social"}],"summary":"An intruder reportedly used a Pays ApS account to access personal information in Denmark's Central Register of Persons.","supporting_quote":"A person claiming responsibility told the Danish newspaper Politiken that they gained entry to the CPR system through an IT company account protected by the password \"123456\".","technology_involved":["CPR register","IT company account"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Pays ApS"},"veris_action":"hacking","derived":{"vendors":[{"id":"c673c37ff0c6","name":"Pays ApS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"38c65255c3e9b7b38944e060cceacef7d096babf","impact_type":"disruption_or_ransomware","incident_date":"2026-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c934727abc90","org_name":"Canonical","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Canonical Infrastructure Disrupted by Second Major DDoS Attack of 2026","type":"mastodon","url":"https://beyondmachines.net/event_details/canonical-infrastructure-disrupted-by-second-major-ddos-attack-of-2026-t-j-0-z-c/gD2P6Ple2L"}],"summary":"Canonical reported a DDoS attack on October 8, 2026, that caused intermittent outages across its websites and temporary loss of access to some services.","supporting_quote":null,"technology_involved":["canonical.com","ubuntu.com","Ubuntu blog","developer portal","jaas.ai","maas.io","Livepatch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"4908092155378ba7557dd5f8a337b0a95199e2c8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee1a4fef8c04","org_name":"Arkansas Hospice Inc.","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005416"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Arkansas%20Hospice%20Inc.%20d/b/a%20LifeTouch%20Health-2026-10-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"ByteToBreach","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-14"},"first_seen":"2026-10-14","id":"23111b69d26695e8d802cc4b7ed4856f2211fd97","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"57781d8ce286","org_name":"Ampath Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Attackers claim to have stolen 80 million South African patient records in massive Ampath Laboratories data breach","type":"press","url":"https://databreaches.net/2026/10/13/attackers-claim-to-have-stolen-80-million-south-african-patient-records-in-massive-ampath-laboratories-data-breach/"}],"summary":"Ampath Laboratories reported a cyberattack, and ByteToBreach claimed that more than 80 million patient records were exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"bytetobreach"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"94756e1669c3b733c63a73e63ab2b4fc02d7e5e2","impact_type":"unknown","incident_date":"2026-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"no_text","url":"https://oag.ca.gov/system/files/ABPM_Letter_A_-_Adult_CM%2839926523.1%29_v2__Static_Proof_R2%2840256146.1%29_Redacted_40290666v1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a82e71beeb5f","org_name":"American Board of Preventive Medicine","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631233"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005422"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":"2026-10-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2352ae98e710519c3261c46a42766efe5d7437b5","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"67ee1ade98d5","org_name":"Terrell Independent School District","org_type":"education","ransomware":null,"records_affected":1672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005406"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-12","discovered_date":"2026-09-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"55d6443bbd977b7c0efd58178af5ec9cacefef86","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2ef27844adf4","org_name":"Squire Patton Boggs (US) LLP","org_type":"retail_ecommerce","ransomware":null,"records_affected":3824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005408"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Squire%20Patton%20Boggs%20%28US%29%20LLP-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8a845ebca0088dcefc98e16b450cf40db52eb5ff","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f228fd7cbf01","org_name":"Sharecare","org_type":"healthcare","ransomware":true,"records_affected":318185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sharecare","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sharecare"}],"summary":"ShinyHunters targeted Sharecare in an extortion campaign and published data it claimed was taken from the company, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Synq1xxs","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"88dd2e981a82a979a9efc022daa19d8bbe8ade77","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AR","org_id":"f4db26b05dfe","org_name":"Sanatorio San Geronimo","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇦🇷 We tracked a data leak claim by Synq1xxs listing Sanatorio San Geronimo, a healthcare facility in Argentina. The acto","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117426030285463814"}],"summary":"Synq1xxs claimed to have leaked an alleged database sample containing approximately 10,000 records associated with Sanatorio San Geronimo.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"synq1xxs"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":"2025-11-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"cf0038e2e29e319b789e4a815bf9be4286c70eb7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-15","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_Q3870_CB_DBM-5993_L01_SAS_1_0.pdf"},"notes":null,"org_country":"US","org_id":"1c61765e0b93","org_name":"Mercadien, P.C. CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631182"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_Q3870_CB_DBM-5993_L01_SAS_1_0.pdf"}],"summary":"Mercadien confirmed that an unauthorized third party accessed files from its systems that may have contained individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"xv9k2mreader","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4304567ed2166d0fd0066190c6ec6429c47232dc","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"0222d80e6e06","org_name":"LabQuest","org_type":"healthcare","ransomware":null,"records_affected":466000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇷🇺 We tracked a data breach claim by xv9k2mreader listing LabQuest, a Russian laboratory provider. The actor alleges a 4","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117429018758333722"}],"summary":"A data-breach claim by xv9k2mreader alleges that LabQuest’s patient database, containing personal and medical information, was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"xv9k2mreader"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-12","discovered_date":"2026-07-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"54156f0117d05eaf6575e00d89a0cb5e9a0fa776","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5de1045ce4f","org_name":"JM Bozeman Enterprises","org_type":"retail_ecommerce","ransomware":null,"records_affected":3211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005405"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"38de0d94cbeac93cd0a9c542ff2a71643e0defc1","impact_type":"disruption_or_ransomware","incident_date":"2026-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"f6045965eb58","org_name":"Intermarché","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Cyberattack shuts down refrigerators at French supermarkets","type":"press","url":"https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/"}],"summary":"Intermarché reported a cyberattack affecting refrigeration systems in some stores, leaving fresh and frozen food display units out of service.","supporting_quote":null,"technology_involved":["Danfoss refrigeration controllers","Danfoss control software"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1853b6116aa2b346a3d25078e180df993c3428fa","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"6e86d3943f6f","org_name":"IDCF Cloud","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"A massive IDCF Cloud ransomware attack has paralyzed critical infrastructure in Japan, causing data breaches and severe ","type":"mastodon","url":"https://infosec.exchange/@DailyCyberSecurity/117427145855726366"}],"summary":"A ransomware attack on IDCF Cloud reportedly caused data breaches and disruptions affecting companies in Japan.","supporting_quote":null,"technology_involved":["IDCF Cloud"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"2019","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"84f88e8db70a2506ba90064b49ee13a519ceaeea","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"AU","org_id":"4fd37a3dcef5","org_name":"Icon Cancer Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: Australian patient data compromised in Icon Cancer Centre hack","type":"mastodon","url":"https://www.cyberdaily.au/security/14285-exclusive-australian-patient-data-compromised-in-icon-cancer-centre-hack"},{"fetched_at":null,"title":"Australian patient data compromised in Icon Cancer Centre hack","type":"press","url":"https://databreaches.net/2026/10/12/australian-patient-data-compromised-in-icon-cancer-centre-hack/"}],"summary":"Icon Cancer Centre confirmed unauthorised access to patient information held on a supplier’s system.","supporting_quote":"“Icon Oncology Group is managing a data breach incident involving unauthorised access to some patient information held on a supplier’s system,” the group said.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"actor_id":"2019"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1b74c7f4b1fa10421b8a36fb246026b3ef97465a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_id":"46d12fb15b0b","org_name":"H&M Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"H&M Probes Possible Data Breach by ShinyHunters Group","type":"mastodon","url":"https://osintsights.com/hm-probes-possible-data-breach-by-shinyhunters-group?utm_source=mastodon&utm_medium=social"}],"summary":"H&M Group said it was investigating online claims of a possible data breach and had no indication that its data environment was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"weak_or_reused_password","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"67b0548bafd2a1350c95e7f682ff4a536e9a8ec6","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"cb1b951d60de","org_name":"Denmark's Central Person Register","org_type":"government","ransomware":null,"records_affected":8750000,"reviewed":false,"root_cause":"A weak administrator password and accounts using '123456' at a Danish IT company were linked to the breach.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"A weak administrator password and accounts using '123456' at a Danish IT company have been linked to a major data breach","type":"mastodon","url":"https://mastodon.social/@hacksgr/117426145420295422"}],"summary":"An attacker used legitimate permissions associated with a Danish IT company to query Denmark's Central Person Register, exposing approximately 8.75 million identification records.","supporting_quote":"A weak administrator password and accounts using '123456' at a Danish IT company have been linked to a major data breach exposing approximately 8.8 million national identification records.","technology_involved":["Central Person Register"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1199"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":"2026-10-02","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bbe5dc70ecfbf6ccfbf5efe9201832c92ee82b5f","impact_type":"data_theft","incident_date":"2026-09-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"a7cb6a939599","org_name":"Denmark Central Person Register","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"At least three third-party user accounts, including a privileged administrator account, used the weak password '123456'.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Denmark's National Population Register Breached, 8.8M Records Exposed","type":"mastodon","url":"https://cyber.netsecops.io/articles/denmark-national-population-register-breached-exposing-8-8-million/?utm_source=mastodon&utm_medium=social&utm_campaign=daily"}],"summary":"Attackers used a third-party company's account to access the Denmark Central Person Register and exfiltrate personal data of approximately 8.8 million individuals.","supporting_quote":"This allowed an attacker to gain access to the CPR system for an extended period of 21 days, beginning September 10, 2026, systematically exfiltrating sensitive citizen data.","technology_involved":["Central Person Register (CPR)"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Pays ApS"},"veris_action":"hacking","derived":{"vendors":[{"id":"c673c37ff0c6","name":"Pays ApS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"endpoint","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"60d66231af6aa900a201f777ea0fe7f3404d0c2e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"malware_other","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"92f6788a4242","org_name":"Daiichi Kosho","org_type":"other","ransomware":null,"records_affected":8700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Karaoke Giant Daiichi Kosho Supplier Breach Exposes 8.7M Customers A supplier data breach at Japanese karaoke giant Da","type":"mastodon","url":"https://mastodon.social/@netsecio/117433960992986937"},{"fetched_at":null,"title":"Daiichi Kosho Breach Exposes 8 Million Customer Records","type":"mastodon","url":"https://osintsights.com/daiichi-kosho-breach-exposes-8-million-customer-records?utm_source=mastodon&utm_medium=social"},{"fetched_at":null,"title":"Karaoke Giant Reveals Data Breach Impacting Eight Million","type":"mastodon","url":"https://www.infosecurity-magazine.com/news/karaoke-giant-data-breach-eight/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale"},{"fetched_at":null,"title":"Daiichi Kosho Data Breach: 8.7M Users Exposed [2026]","type":"mastodon","url":"https://shattered.io/daiichi-kosho-karaoke-data-breach-2026/"}],"summary":"A breach involving malware on a supplier employee’s PC may have exposed the personal information of 8.7 million Daiichi Kosho customers.","supporting_quote":"The incident was caused by malware on a supplier employee's PC.","technology_involved":["employee PC"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-15","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-12","discovered_date":"2026-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50d599dc8e51136d43bec1a85c8157feeae189da","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d7d19ea4e229","org_name":"Austin Independent School District","org_type":"education","ransomware":null,"records_affected":44652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005407"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"The Gentlemen","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"94242cdc322eed6524968f6c75fc91e31e552c0b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"ec2b2fd70591","org_name":"All Souls St Gabriels School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Exclusive: All Souls St Gabriels School investigating cyber incident in wake of ransomware claims","type":"mastodon","url":"https://www.cyberdaily.au/security/14287-exclusive-all-souls-st-gabriels-school-investigating-cyber-incident-in-wake-of-ransomware-claims"}],"summary":"All Souls St Gabriels School is investigating unauthorized access after The Gentlemen claimed the school as a victim and threatened to publish information.","supporting_quote":"A spokesperson for the school told Cyber Daily that it is aware of the claim and is continuing to investigate “a cyber incident involving an unauthorised party accessing a part of our systems”.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"thegentlemen"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d6e89c5b9f714ce4eb10e2578e9e2d85ad926fdd","impact_type":"disruption_or_ransomware","incident_date":"2026-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6631d4a7dba1","org_name":"Ahold Delhaize","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Ahold Delhaize Disconnects Global Networks Following Cybersecurity Breach","type":"mastodon","url":"https://beyondmachines.net/event_details/ahold-delhaize-disconnects-global-networks-following-cybersecurity-breach-f-j-i-r-h/gD2P6Ple2L"},{"fetched_at":null,"title":"Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems","type":"press","url":"https://www.securityweek.com/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/"},{"fetched_at":null,"title":"Retail giant Ahold Delhaize takes systems offline after cyberattack","type":"press","url":"https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/"}],"summary":"Ahold Delhaize reported a cybersecurity incident that led it to take several systems offline and disrupted digital services across multiple brands.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Majinahanashi","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"95883f5bd24f769d6afcda54ba5ed1abc82153b2","impact_type":"unknown","incident_date":"2026-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"659c004412ef","org_name":"SON-VIDEO","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"SON-VIDEO Ransomware Claim by Majinahanashi (Jul 2026)","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-11-son-video-ransomware-claim-by-majinahanashi-jul-2026"}],"summary":"Majinahanashi allegedly listed SON-VIDEO on its leak site, but the claim and any data theft remain unverified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"majinahanashi"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"482dd6dbf02a287f2a8eb7042c65fa1ef4ed5123","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-11","outcome":"no_letter","url":null},"notes":null,"org_country":"unknown","org_id":"77c97ec2e660","org_name":"Ricardo","org_type":"unknown","ransomware":null,"records_affected":890000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"⚠️ Ricardo breach exposes 890k user accounts Attackers accessed names, postal addresses and phone numbers; # Ricardo say","type":"mastodon","url":"https://poliversity.it/@ransomnews/117423487113409740"}],"summary":"Attackers accessed names, postal addresses and phone numbers associated with 890,000 Ricardo user accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"703ebcec4655720cf9ef9fa7eaec992425d9a027","impact_type":"disruption_or_ransomware","incident_date":"2026-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"882198eede1f","org_name":"Coopérative U","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Cyberattack disrupts refrigeration at hundreds of French supermarkets","type":"press","url":"https://therecord.media/cyberattack-disrupts-refridgeration-in-france"}],"summary":"A cyberattack disrupted refrigeration at Coopérative U stores after attackers remotely triggered the units’ defrost function.","supporting_quote":null,"technology_involved":["Danfoss refrigeration controllers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":"US","motive":"financial","name":"Daniel Rhyne","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7bc9bfe2c337c515af2c69625d6a28ca753d3d02","impact_type":"disruption_or_ransomware","incident_date":"2023-11-25","initial_access":"insider","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"d5849c3a1aae","org_name":"Unnamed industrial firm","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison","type":"press","url":"https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/"}],"summary":"A core infrastructure engineer used scheduled tasks to disrupt access to his company’s systems and demanded 20 bitcoin.","supporting_quote":"A Kansas City, Missouri man has been sentenced to 32 months in jail for crimes related to a ransom attack against his own company.","technology_involved":["domain controller","servers","workstations"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse","derived":{"actor_id":"danielrhyne"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-10-10","discovered_date":"2026-10-02","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b042bbce765685867557b6fbaf6a3abdf156bd81","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"DK","org_id":"fbbae8275ef9","org_name":"Central Person Register","org_type":"government","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":"A private company's legitimate access to the national database was abused.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"📰 Denmark's National Population Register Breached, 8.8M Records Exposed Massive data breach in Denmark's Central Person ","type":"mastodon","url":"https://mastodon.social/@netsecio/117433962110062754"},{"fetched_at":null,"title":"Massive Danish CPR Data Breach Linked to Simple Password","type":"mastodon","url":"https://en.killbait.com/massive-danish-cpr-data-breach-linked-to-simple-password.html?utm_source=mastodon_social&utm_medium=social&utm_campaign=killbait.mastodon_social"},{"fetched_at":null,"title":"📰 Denmark's National Population Register Breached, 8.8M Records Exposed Massive data breach in Denmark's Central Person ","type":"mastodon","url":"https://mastodon.social/@netsecio/117423978238058505"},{"fetched_at":null,"title":"“123456” password used in massive Danish CPR data breach","type":"press","url":"https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/"}],"summary":"Attackers abused a private company's legitimate access to Denmark's Central Person Register, exposing personal data for 8.8 million people.","supporting_quote":"Attackers abused a private company's legitimate access to the national database.","technology_involved":["Central Person Register (CPR)"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"81720d4b4e21ff4499c4e70dba042f213466ea97","impact_type":"data_theft","incident_date":"2026-08-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices%20Re%20Photon.pdf"},"notes":null,"org_country":"US","org_id":"180cb216ffa6","org_name":"Blueberry Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor exploited a previously unknown vulnerability in Metabase software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631135"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices%20Re%20Photon.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005414"}],"summary":"Blueberry Pediatrics reported that an actor exploited a vulnerability in Metabase to access its environment and steal patient data.","supporting_quote":"The exploitation of that vulnerability resulted in unauthorized access to Blueberry Medical’s Metabase environment and the theft of a copy of certain patien t data.","technology_involved":["Metabase"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Metabase"},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"61946df9be20","name":"Metabase"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-09","discovered_date":"2026-10-01","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0f7b659fbdc1074e6e79756bfc7502717aae47d1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-08-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f90ce51f8882","org_name":"Waco Independent School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited a vulnerability in a third-party software product used by Frontline Education to access its environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Waco ISD Employee Data Exposed in Frontline Education Security Incident","type":"mastodon","url":"https://beyondmachines.net/event_details/waco-isd-employee-data-exposed-in-frontline-education-security-incident-n-e-j-k-u/gD2P6Ple2L"}],"summary":"Waco Independent School District employee and applicant information was exposed in a Frontline Education security incident after attackers exploited a vulnerability in software used by the provider.","supporting_quote":"Attackers exploited a vulnerability in a third-party software product used by Frontline Education to gain unauthorized access to a portion of its environment.","technology_involved":["Frontline Education"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Frontline Education"},"veris_action":"hacking","derived":{"vendors":[{"id":"1a3ecfb9142e","name":"Frontline Education"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"EndZone","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"703d14a0e0eac3a452c0d10f30d2cb8d502e5e0f","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1894884e0908","org_name":"Trump Mobile","org_type":"telecom","ransomware":true,"records_affected":3615,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Trump Mobile hack and apparent lack of FCC authorization raise security alarms","type":"mastodon","url":"https://arstechnica.com/tech-policy/2026/10/trump-mobile-doesnt-seem-to-have-fcc-authorization-for-phone-service-senator-says/"},{"fetched_at":null,"title":"Leak-site claim by EndZone","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VHJ1bXAgTW9iaWxlQEVuZFpvbmU"}],"summary":"A report said hackers stole personal data belonging to 3,615 Trump Mobile customers; the attack method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"endzone","claim_groups":["endzone"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"pkevin","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f03b13425492fdc51a27045bce66fff3aba9db54","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"TW","org_id":"96028c76e655","org_name":"Taiwan Ministry of the Interior","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"🇹🇼 We tracked a data breach claim by pkevin naming Taiwan's Ministry of the Interior (ris.gov.tw), alleging possession o","type":"mastodon","url":"https://infosec.exchange/@darkwebsonar/117411052546657826"}],"summary":"pkevin claimed possession of a Taiwan Ministry of the Interior citizen registry database containing 23.5 million records.","supporting_quote":null,"technology_involved":["citizen registry database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"pkevin"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"UmBra","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b14283544a109aa1c176abe580eaf459b15243f3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"96ee6e9a5939","org_name":"SOCOCO","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"SOCOCO Ransomware Claim by UmBra - October 2026","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-09-sococo-ransomware-claim-by-umbra-october-2026"},{"fetched_at":null,"title":"Leak-site claim by UmBra","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U09DT0NPQFVtQnJh"}],"summary":"UmBra claimed on its leak site that it exfiltrated data from SOCOCO, but the claim has not been independently verified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"umbra","claim_groups":["umbra"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f975e11e4f6df5396f233f1a8348750e8150ba51","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df384c9d29bd","org_name":"Sawyer Savings Bank","org_type":"financial","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sawyer%20Savings%20Bank-2026-10-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6a88b028ff41e5a03b9e71e31bf1176de7be6dd5","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"277ab0b245e0","org_name":"Neogen","org_type":"manufacturing","ransomware":true,"records_affected":435963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Neogen Breach: 436K Email Addresses Leaked by ShinyHunters (2026)","type":"mastodon","url":"https://www.yazoul.net/breaches/breach/neogen-breach-436k-email-addresses-leaked-by-shinyhunters-2026"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TmVvZ2VuIENvcnBvcmF0aW9uQHNoaW55aHVudGVycw"},{"fetched_at":null,"title":"Have I Been Pwned: Neogen","type":"hibp","url":"https://haveibeenpwned.com/Breach/Neogen"}],"summary":"ShinyHunters published data it claimed came from Neogen, including 435,963 unique email addresses, after an extortion demand went unpaid.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":"BY","motive":"espionage","name":"Belarusian Cyber Partisans","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e459b22cddc9a73b35d41ce8c70f82757af5df11","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"ba5832e878c6","org_name":"Moscow Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Belarusian hacktivists admit to 2023 breach of Russian state healthcare network","type":"press","url":"https://therecord.media/belarusian-cyber-partisans-claim-2023-russia-healthcare-hack"}],"summary":"The Belarusian Cyber Partisans claimed a 2023 intrusion into the Moscow Department of Health, and researchers reported that attackers accessed sensitive medical information without disrupting operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"belarusiancyberpartisans"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"BYOD","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5ab7859ddfa5123137b485f751a6018ef2003335","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"53faa4df4690","org_name":"Liberty X","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Liberty X Ransomware Claim by BYOD - Oct 2026","type":"mastodon","url":"https://www.yazoul.net/intel/claim/2026-10-08-liberty-x-ransomware-claim-by-byod-oct-2026"}],"summary":"BYOD claimed to possess Liberty X data in an unverified leak-site post, but no breach or data exfiltration was independently confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"byod"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"648e2a40c14970cbd817f360ece17adbbaa7658e","impact_type":"both","imported_from":null,"incident_date":"2026-06-03","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"28836e9558be","org_name":"iRhythm","org_type":"manufacturing","ransomware":true,"records_affected":360000,"reviewed":false,"root_cause":"A social engineering attack enabled access to third-party-hosted business applications.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Hundreds of thousands impacted by data breach at biosensor firm iRhythm","type":"press","url":"https://therecord.media/irhythm-data-breach-reports"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20iRhythm.pdf"},{"fetched_at":null,"title":"iRhythm Data Breach Impacts at Least 360,000 People","type":"press","url":"https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/"},{"fetched_at":null,"title":"📰 iRhythm Notifies Over 360,000 Patients of Data Breach from June Medical device maker iRhythm is notifying over 360,000","type":"mastodon","url":"https://mastodon.social/@netsecio/117428276488003574"}],"summary":"iRhythm reported that attackers used social engineering to access third-party-hosted business applications and exfiltrate personal and medical information.","supporting_quote":"The hackers gained access to unidentified third-party-hosted business applications through a social engineering attack.","technology_involved":["third-party-hosted business applications"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d6bd71da0c8bbda994a2333dd3666cc62d0be75b","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2026-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"c972c05b2f5e","org_name":"IDC Frontier","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"IDCF Cloud Ransomware Attack: Data in Four Zones Likely Unrecoverable; JR East and JR Kyushu Say Up to 7.4 Million Email Records May Have Leaked","type":"mastodon","url":"https://japancyberwatch.com/articles/idcf-cloud-unauthorized-access-outage-2026"},{"fetched_at":null,"title":"Ransomware attack disrupts Japan's IDCF Cloud used by govt clients","type":"press","url":"https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/"},{"fetched_at":null,"title":"Cyberattack at IDC Frontier disrupts services around nation","type":"press","url":"https://databreaches.net/2026/10/09/cyberattack-at-idc-frontier-disrupts-services-around-nation/"},{"fetched_at":null,"title":"Japan Declares First-Ever Cybersecurity State of Emergency","type":"mastodon","url":"https://cyber.netsecops.io/articles/japan-declares-first-cybersecurity-state-of-emergency-after-massive-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=daily"}],"summary":"IDC Frontier confirmed that a third-party ransomware attack disrupted four zones of IDCF Cloud, affecting 495 companies and local governments.","supporting_quote":null,"technology_involved":["IDCF Cloud"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f370fa0c68b6cf02e4d3e03a1aff151a5848ccfe","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0e9f335c7c68","org_name":"Google","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Google Domains Impacted by Recent ccTLD Hijacks","type":"press","url":"https://www.securityweek.com/google-domains-impacted-by-recent-cctld-domain-hijacks/"}],"summary":"Google domains were affected by hijacks of third-party country-code domains that led to unauthorized HTTPS certificates being issued.","supporting_quote":null,"technology_involved":["authoritative DNS"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"235f616182b14561bfff547e9a9db7aeab6ca5e3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"US","org_id":"577e24b98ad3","org_name":"Federal Bureau of Investigation","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"A third-party contractor-managed platform failed to install a security update.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"FBI arrests another suspected ShinyHunters hacker after agency breach","type":"press","url":"https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/"},{"fetched_at":null,"title":"FBI touts another ShinyHunters arrest in response to data breach","type":"press","url":"https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation"},{"fetched_at":null,"title":"On October 9, 2026, FBI Director Kash Patel announced the arrest of another suspected ShinyHunters associate. The group ","type":"mastodon","url":"https://mastodon.social/@hacksgr/117412532318240202"},{"fetched_at":null,"title":"FBI arrests suspected member of ShinyHunters in connection with breach of bureau's jobs website","type":"mastodon","url":"https://www.cbsnews.com/news/fbi-shinyhunters-arrest-jobs-website-hack/?ftag=CNM-00-10aab7e&linkId=1018860676"},{"fetched_at":null,"title":"FBI Director Kash Patel says agents arrested another suspected ShinyHunters co-conspirator amid an investigation that in","type":"mastodon","url":"https://infosec.exchange/@cyberworldops/117411818330160548"},{"fetched_at":null,"title":"FBI Blames Contractor’s Missed Patch for ShinyHunters Breach","type":"press","url":"https://databreaches.net/2026/10/06/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/"},{"fetched_at":null,"title":"Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe","type":"press","url":"https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/"},{"fetched_at":null,"title":"FBI announces yet another arrest allegedly connected to the FBI Jobs hack","type":"press","url":"https://databreaches.net/2026/10/10/fbi-announces-yet-another-arrest-allegedly-connected-to-the-fbi-jobs-hack/"},{"fetched_at":null,"title":"The FBI announced a ShinyHunters suspect arrest following the FBIJobs.gov data breach. Learn how a missing Oracle People","type":"mastodon","url":"https://infosec.exchange/@DailyCyberSecurity/117428303160548122"},{"fetched_at":null,"title":"Piratage du FBI : un correctif oublié chez un prestataire","type":"mastodon","url":"https://www.zataz.com/piratage-du-fbi-un-correctif-oublie-chez-un-prestataire/"},{"fetched_at":null,"title":"FBI Apprehends Suspect in ShinyHunters Hacking Case","type":"mastodon","url":"https://osintsights.com/fbi-apprehends-suspect-in-shinyhunters-hacking-case?utm_source=mastodon&utm_medium=social"}],"summary":"The FBI reported a breach involving a third-party contractor-managed platform, with ShinyHunters claiming it stole FBI data.","supporting_quote":"The FBI has since said the incident stemmed from a third-party contractor-managed platform that failed to install a security update.","technology_involved":["Oracle PeopleSoft","AWS GovCloud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0c176287951b0a85dcc785d5e874f1428da811ac","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8b6067f97d9","org_name":"Evan Chadwick","org_type":"other","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Evan%20Chadwick-2026-10-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Anubis","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-10-09","discovered_date":"2026-05-23","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6d71f851f26a93077ff291e16de7cacfb6da5de6","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"5e174a2f852d","org_name":"Casper Orthopedic Associates","org_type":"healthcare","ransomware":null,"records_affected":56197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Casper Orthopedic Associates Data Breach Affects More Than 56,000 Individuals","type":"mastodon","url":"https://beyondmachines.net/event_details/casper-orthopedic-associates-data-breach-affects-more-than-56000-individuals-u-o-b-f-k/gD2P6Ple2L"}],"summary":"Casper Orthopedic Associates disclosed a cyberattack discovered on May 23, 2026, that may have exposed patient information affecting 56,197 individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"anubis"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-09","discovered_date":"2026-09-18","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a113bec94af42058bafcf3dbd3d421ec9542797e","impact_type":"data_theft","incident_date":"2026-09-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CA","org_id":"bd1b33e4f096","org_name":"Canadian Mennonite University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Canadian Mennonite University Data Breach Exposes Personal and Tax Information","type":"mastodon","url":"https://beyondmachines.net/event_details/canadian-mennonite-university-data-breach-exposes-personal-and-tax-information-o-j-t-d-o/gD2P6Ple2L"}],"summary":"Canadian Mennonite University reported that an unauthorized party accessed files containing personal and tax information, and that information was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2026-10-09","discovered_date":"2026-03-20","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"098bc2c50919523167f65cad3fecbf23bfb4bc1e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"e5547d236c79","org_name":"Atlantic Digestive Specialists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Atlantic Digestive Specialists Data Breach Exposes Patient Information","type":"mastodon","url":"https://beyondmachines.net/event_details/atlantic-digestive-specialists-data-breach-exposes-patient-information-d-n-s-a-i/gD2P6Ple2L"}],"summary":"Atlantic Digestive Specialists reported unauthorized access to files containing personal and protected health information after suspicious activity was detected in March 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Xuanye Group","variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"581fadb9d20292fea4656bb3aa797cd35ebe95e5","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"35e2c293b537","org_name":"ASOS","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An attacker impersonated a trusted contact to obtain an employee's login credentials, which were then used to access information on third-party platforms.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"ASOS links data breach to social engineering attack, credential theft","type":"mastodon","url":"https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/"},{"fetched_at":null,"title":"Asos confirms breach of customer data after hackers send rogue app notification The hackers alerted the fashion giant’s ","type":"mastodon","url":"https://mastodon.social/@justpaste/117423654321630513"}],"summary":"ASOS said an attacker impersonated a trusted contact to obtain an employee’s credentials and access information on third-party platforms, exposing personal and account-related information.","supporting_quote":"We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials,","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"social","derived":{"actor_id":"xuanyegroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f723daa7ebc180f5084196ea6bf6fb28118cda26","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected restored 2026-10-10: source states 14.64 million; the verbatim guard did not accept scaled figures (fixed)","org_country":"unknown","org_id":"fe7c53fad753","org_name":"Adventure Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":14640000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Adventure Inc. Data Breach Affects Approximately 14.64 Million Skyticket Customer Records","type":"mastodon","url":"https://beyondmachines.net/event_details/adventure-inc-data-breach-affects-approximately-14-64-million-skyticket-customer-records-j-o-l-x-1/gD2P6Ple2L"}],"summary":"Adventure Inc. reported unauthorized access to Skyticket administrative functionality from October 2 to October 4, 2026, affecting approximately 14.64 million customer records.","supporting_quote":null,"technology_involved":["Skyticket administrative functionality"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7728a3c21ad7a0e0e060bc54f98bd4b898961544","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1eae0670b84","org_name":"Winona County","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Winona%20County-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4059dc594c2ddd3be011ff6cefef3b56c81e0c29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"768344c6f623","org_name":"National Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#National%20Life%20Insurance%20Company-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"845387dd69e28f94313f0efac7ca25cb85f5594c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a0c9acb4a14","org_name":"Home, Hope and Healing, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Home%2C%20Hope%20and%20Healing%2C%20Inc.-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"SilentRansomGroup","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ce89631086933d20d98e2bdc50ce687e7701fc46","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ab6bf3a61ee","org_name":"Holland & Knight, LLP","org_type":"other","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Holland%20%26%20Knight%2C%20LLP-2026-10-08"},{"date":"2026-09-01","fetched_at":null,"title":"Leak-site claim by SilentRansomGroup","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SG9sbGFuZCAmIEtuaWdodEBTaWxlbnRSYW5zb21Hcm91cA"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"actor_id":"silentransomgroup","claim_groups":["silentransomgroup"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v2","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"94937949aba3d31e0267c2f3b9895436a9670842","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"KR","org_id":"0699a9f572f9","org_name":"Coupang","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"KR: Coupang files lawsuits against 620 billion won fine over data leak","type":"press","url":"https://databreaches.net/2026/10/08/kr-coupang-files-lawsuits-against-620-billion-won-fine-over-data-leak/"}],"summary":"Coupang reported a November 2025 data breach affecting more than 33 million customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c64030b1aec1200dae7655d2c6e9140c75f5caff","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c27d6e732e29","org_name":"Citizens & Northern Bank","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Citizens%20%26%20Northern%20Bank-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0ed54c80c323d96e8751dea6885f211028e34748","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1199e7a29cd1","org_name":"Ant Farm II, LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ant%20Farm%20II%2C%20LLC-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3fe6ae1bc82b42b284f393957cbd14b6a1d5bed3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"66bf7e086b09","org_name":"Allied Physicians Group, PLLC","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Allied%20Physicians%20Group%2C%20PLLC-2026-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-07","discovered_date":"2026-07-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"34f3c73ccfa86503dfed5e15aaca245c588f66e3","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5b0f946bf8e","org_name":"Secure Healthcare Information Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Secure%20Healthcare%20Information%20Management%2C%20LLC-2026-10-07"},{"fetched_at":null,"title":"Secure Healthcare Information Management Data Breach Exposes Patient Information","type":"mastodon","url":"https://beyondmachines.net/event_details/secure-healthcare-information-management-data-breach-exposes-patient-information-y-4-x-d-h/gD2P6Ple2L"}],"summary":"Secure Healthcare Information Management reported unauthorized access to its network, and a review found potentially affected files containing personal and protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-14","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b33df8f8cace003087452a02dbea83d870c45bdb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9edd69123e20","org_name":"Marking Services, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Marking%20Services%2C%20Inc.-2026-10-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b35f46a1ea58a0e0e588a551724a05bacddc1fb3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84d9809725d9","org_name":"Hasbro, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hasbro%2C%20Inc.-2026-10-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bdad54c93557f9197f15fbbdb1ea211648935d95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a061f92bdbc0","org_name":"Factory Five Racing, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Factory%20Five%20Racing%2C%20Inc.-2026-10-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22b23015474b0ab483335c95afc40f72c1191a30","impact_type":"data_theft","imported_from":null,"incident_date":"2026-10-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"fa1e73684539","org_name":"Double Counter","org_type":"technology_saas","ransomware":null,"records_affected":274922,"reviewed":false,"root_cause":"The breach was attributed to a vulnerability in the Metabase analytics tool.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Double Counter","type":"hibp","url":"https://haveibeenpwned.com/Breach/DoubleCounter"}],"summary":"Double Counter data was accessed through a vulnerability attributed to the Metabase analytics tool, and a corpus containing email addresses and Discord usernames was published publicly.","supporting_quote":"In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool .","technology_involved":["Metabase analytics tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Metabase"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"61946df9be20","name":"Metabase"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fa80b39e9c4a92303056cf7127539406bfbebfa","impact_type":"both","incident_date":"2026-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f984f7cc3dc1","org_name":"CyrusOne","org_type":"technology_saas","ransomware":true,"records_affected":373460,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CyrusOne","type":"hibp","url":"https://haveibeenpwned.com/Breach/CyrusOne"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q3lydXNPbmUsIExMQy5Ac2hpbnlodW50ZXJz"}],"summary":"ShinyHunters attempted to extort CyrusOne and published data allegedly obtained from the company, including contact information and support tickets.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3fa8b350fafaad5918bcd6ef856617392890f9a","impact_type":"data_theft","imported_from":null,"incident_date":"2023-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"3a0a23448735","org_name":"Angel One","org_type":"financial","ransomware":null,"records_affected":7900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Angel One","type":"hibp","url":"https://haveibeenpwned.com/Breach/AngelOne"}],"summary":"Angel One confirmed that data leaked online in connection with a breach that occurred in April 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-07","discovered_date":"2026-06-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1e0b2219bc9cd9746e6b0ca396fa42b9c686468","impact_type":"data_theft","incident_date":"2026-06-19","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alisal%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"1468141b02be","org_name":"Alisal Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630952"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alisal%20Exhibit%20A.pdf"}],"summary":"Alisal Union School District reported that information may have been accessed or downloaded without authorization during activity discovered in June 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c15e807948643b1a55bfd09e6969eb51a6fb4383","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62e767567499","org_name":"Penquis CAP","org_type":"nonprofit","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Penquis%20CAP-2026-10-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-06","discovered_date":"2026-06-08","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-17"},"first_seen":"2026-10-10","id":"84ff8c5398ee93ebd56cfdc2c10288c30c89f4e7","impact_type":"unknown","incident_date":"2026-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-17","outcome":"no_text","url":"https://oag.ca.gov/system/files/iRhythm_NoticeLetter_2026%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"5cad456157e3","org_name":"iRhythm Technologies","org_type":"healthcare","ransomware":true,"records_affected":8200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"DATE: October 16, 2026 at 02:50PM SOURCE: HEALTHCARE INFO SECURITY Direct article link at end of text block below. Confi","type":"mastodon","url":"https://mastodon.clinicians-exchange.org/@rsstosecurity/117452107807623626"},{"fetched_at":null,"title":"iRhythm Notifies Victims of June 2026 Cybersecurity Attack - NetSec.News","type":"mastodon","url":"https://www.netsec.news/irhythm-cybersecurity-attack/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630879"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005401"}],"summary":"A news report stated that a hack affecting iRhythm Technologies involved 8.2 million patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-09-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c52c0ff946d87b0c3d52c4bb1a4998f2ff4e7373","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7cf632ff5c13","org_name":"Healthcare Highways, LLC","org_type":"other","ransomware":true,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005395"},{"fetched_at":null,"title":"Healthcare Highways Confirms Data Breach Following Chaos Ransomware Claim","type":"mastodon","url":"https://beyondmachines.net/event_details/healthcare-highways-confirms-data-breach-following-chaos-ransomware-claim-i-y-o-4-g/gD2P6Ple2L"}],"summary":"Healthcare Highways reported unauthorized access to its systems and copying of information, while the Chaos ransomware group claimed to have stolen company and client records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-15","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ac299b0c0db7253a2345b9073e967a8b8d90ab9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DBM-6073_HARMAN_L01_SAS_V2.pdf"},"notes":null,"org_country":"US","org_id":"54960d86c22d","org_name":"Harman Fitness","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DBM-6073_HARMAN_L01_SAS_V2.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005403"}],"summary":"Harman reported unauthorized network access on September 4, 2025, involving personal, health, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-05-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ac1590c1c8b627da23a3e019ad6d69fede6078f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea76dbc44cde","org_name":"Fragomen, Del Rey, Bernsen & Loewy, LLP","org_type":"other","ransomware":null,"records_affected":1753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005396"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fragomen%2C%20Del%20Rey%2C%20Bernsen%C2%A0%26%20Loewy%2C%20LLP-2026-10-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-09-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8e1a9d2dc2e5e09eff7fca0295b2fc7c72b101f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f566149b35f1","org_name":"Flowco Holdings Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005398"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"837fff987532ae5a215f3a395fc28405c0a8897e","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a101ea8a331","org_name":"Edgewood ISD","org_type":"education","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005399"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-10-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e767ddd52567ce70b07aa5235fa84539c5554ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecb510153939","org_name":"Cleburne Independent School District","org_type":"education","ransomware":null,"records_affected":3187,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005404"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-06","discovered_date":"2026-09-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7df80cead1d04fc987a3e2907d2d5b88168ebb1","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"856a065885e9","org_name":"Capitol Pain Institute","org_type":"healthcare","ransomware":null,"records_affected":666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005400"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5a06aaf3d09e5cb4d6fb0126eed8a69633f6010e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"997900f638ac","org_name":"Arthur J. Jerry","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Arthur%20J.%20Jerry-2026-10-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5a49af445b855903cb94a8d30b6a7ee15f02a784","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"36002a94097d","org_name":"North Slope Borough School District","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#North%20Slope%20Borough%20School%20District-2026-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"632160e1e96d3b1e8dc105b024052f69c8be7a58","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c27665a1faa","org_name":"Covercraft Industries, LLC","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Covercraft%20Industries%2C%20LLC-2026-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4e722bd1dc04b092dac0b136d3d53420c1854650","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3404eaa4c93","org_name":"Cerner Corporation","org_type":"healthcare","ransomware":null,"records_affected":2464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cerner%20Corporation-2026-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4824e37e1197505307d9c2d3b2efb16de0a2a0e9","impact_type":"data_theft","incident_date":"2026-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Advantest%20Corporation%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cdf4d3ead1ba","org_name":"Advantest America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630848"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Advantest%20Corporation%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Letter.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Advantest%20America%2C%20Inc.-2026-10-05"}],"summary":"Advantest reported that an unauthorized third party accessed its systems and extracted data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f614ba7c1b9e67a72fd7c9b4494aee2d807fbe71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a492f6e3d8fc","org_name":"Access Residential Management","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Access%20Residential%20Management-2026-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d5805eabeb3ed821946486f5001e89f2d6395686","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c7e667119b0","org_name":"The Hudson River Museum of Westchester, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Hudson%20River%20Museum%20of%20Westchester%2C%20Inc.-2026-10-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c97ad04ccd15177e4c0da23785af87947b25ddfe","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"648c7e191951","org_name":"World Acceptance Corporation","org_type":"financial","ransomware":null,"records_affected":232401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005385"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a13d558ec800237b2cdbbd9dac20b730276c584","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c23d6390b66","org_name":"Walnut Creek Special Utility District","org_type":"government","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005391"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"887b9152be329762909c6a65aa0180cb4820a92e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4629c0950914","org_name":"The Woodlands Arts Council","org_type":"nonprofit","ransomware":null,"records_affected":2923,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005384"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab23759e2809c7f56f6ca709ab921021b8a2b4d3","impact_type":"data_theft","incident_date":"2026-08-31","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Attachment%20A%20--%20Sample%20Individual%20Notice%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"b61f1c8579a6","org_name":"Sheppard, Mullin, Richter & Hampton LLP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"A social engineering event led to an attorney's unauthorized disclosure of documents.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630779"},{"fetched_at":null,"title":"Leak-site claim by SilentRansomGroup","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U2hlcHBhcmQsIE11bGxpbiwgUmljaHRlciAmIEhhbXB0b25AU2lsZW50UmFuc29tR3JvdXA"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Attachment%20A%20--%20Sample%20Individual%20Notice%20%28Redacted%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005397"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sheppard%2C%20Mullin%2C%20Richter%20%26%20Hampton%2C%20LLP-2026-10-02"}],"summary":"A social engineering event led a Sheppard attorney to disclose documents containing personal information to an unknown third party.","supporting_quote":"On August 31, 2026, a single Sheppard attorney was the victim of a sophisticated social engineering event which resulted in the unauthorized disclosure of certain documents to an unknown third-party.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social","derived":{"claim_groups":["silentransomgroup"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b5861107c104ae8b7970fdad9f06dc0ec8a6568","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a49bd24580cd","org_name":"PSI Premier Specialties Inc.","org_type":"healthcare","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005377"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"62bd838f854b5d427b5deb12293ad0be4b0d1f7d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"943aed3a3199","org_name":"Pro Holdings, LLC","org_type":"education","ransomware":null,"records_affected":10608,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005386"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-08-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56a59d1c521f8fc339f1ec957b85353b5569d995","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c236c779dac","org_name":"Midvale Indemnity Company","org_type":"financial","ransomware":null,"records_affected":38381,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005388"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Midvale%20Indemnity%20Company-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4c5f3b2772f8c092607b54b9193e532c2ef0c2a4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c0bcefb1ef4","org_name":"Little River Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":47467,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005378"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-08-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ddc15b571f15634aacc5dc93c8e4bb5c77fa256b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c695da4f684a","org_name":"Innovative Alternatives, Inc","org_type":"nonprofit","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005394"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b4f07135827fd95996bb24c5ef2fcf94406cc86","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26a0f3c85a10","org_name":"i.e.Smart Systems, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":914,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005374"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a4ea36a4871f7e6af72862a6a8b3b317c535164d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a48dcbadc8a","org_name":"Heuer Publishing","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Heuer%20Publishing-2026-10-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-08-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64cc7c0cff0d0a4613766d5698644041f8862657","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e2917b03869","org_name":"Greenberg Traurig, LLP (“GT”)","org_type":"other","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005392"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Greenberg%20Traurig%2C%20LLP%20%28%E2%80%9CGT%E2%80%9D%29-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"Wallstreet","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-09-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"afc53b1990c752e0699724585170af61574371ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a881c571d3fb","org_name":"Goldston Oil Corporation","org_type":"retail_ecommerce","ransomware":true,"records_affected":412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005383"},{"date":"2026-09-10","fetched_at":null,"title":"Leak-site claim by Wallstreet","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/R29sZHN0b24gT2lsIENvcnBvcmF0aW9uQFdhbGxzdHJlZXQ"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"wallstreet","claim_groups":["wallstreet"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-02","discovered_date":"2026-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a7a67e1338296d1beddc17a3bddfeaa2524316e","impact_type":"data_theft","incident_date":"2026-05-04","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fragomen_Sample%20US%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8202cf731f67","org_name":"Fragomen","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A social engineering campaign was associated with unauthorized remote access to a user account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630760"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fragomen_Sample%20US%20Notice%20Letter.pdf"}],"summary":"Fragomen reported that an unauthorized third party gained remote access to a user account in a social engineering campaign and copied some files containing personal information.","supporting_quote":"On May 5, 2026, Fragomen learned that an unauthorized third party gained remote access to a single user account, which we determined was part of a social engineering campaign.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"59609678bbafc9a5b3601f32c8904ee370305a7c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89fa9d87a1f5","org_name":"Family Medical Associates of Raleigh, PA","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Family%20Medical%20Associates%20of%20Raleigh%2C%20PA-2026-10-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-02","discovered_date":"2026-08-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4710b13175c2fec2264f7be7edd5af90e99d3a0d","impact_type":"unknown","incident_date":"2026-08-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc29d215d50a","org_name":"7 to 7 Dental & Orthodontics","org_type":"healthcare","ransomware":null,"records_affected":3526,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005387"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ec27958f4bb7b6813bf89f97091077f805d0f828","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"16db2edd68b6","org_name":"Virgo Gems, LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Virgo%20Gems%2C%20LLC-2026-10-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae5f76617794571f91adaab88a1cd91797230a28","impact_type":"unknown","incident_date":"2025-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Marana%20Health%20Center%20California%20Attorney%20General%20Notice_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e466c6fcbb0","org_name":"Marana Health Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630668"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d1057d239defd684612115022a5a75f7f3df8ba9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20cc7d4958f1","org_name":"Live Nation Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Live%20Nation%20Entertainment%2C%20Inc.-2026-10-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-01","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f954e17aa5b79a2e44b6a53f075c19fe6f41bb3a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20Template.pdf"},"notes":null,"org_country":"US","org_id":"3c52653d8de0","org_name":"Lincoln Property Company Commercial LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20Template.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005393"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lincoln%20Property%20Company%20Commercial%20LLC-2026-10-02"}],"summary":"Lincoln Property Company Commercial LLC reported that an unauthorized party accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-10-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4e89f45f4be03e3dd12c4a11cc4bca50619054a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aldrich%20Services%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"af2579cc4450","org_name":"Aldrich Services LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aldrich%20Services%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown individual accessed an Aldrich employee email account, and the review identified personal information that may have been affected.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"899fa216912e9860b517dddfd408e8f2f61298bc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a389086120c","org_name":"ViewSonic Corporation","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ViewSonic%20Corporation-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"07889f37e5eecd01cd4440c91b86c1312a987e26","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05c442664718","org_name":"Universal Dermatology & Vein Care","org_type":"healthcare","ransomware":null,"records_affected":35295,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-30-universal-dermatology-vein-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1ea905ed6d752a2903f38709624b7f8b8210bd4a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea412826969a","org_name":"The Woodlands Art Council","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Woodlands%20Art%20Council-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-30","discovered_date":"2026-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4373117707a73291c3ccba97531f9e6c190659a8","impact_type":"data_theft","incident_date":"2026-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Proof_ProHoldings_Adult_V3%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"a82bfea9af0f","org_name":"ProCamps","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Proof_ProHoldings_Adult_V3%20%282%29.pdf"}],"summary":"ProCamps reported that an unknown actor acquired company data that included personal information.","supporting_quote":null,"technology_involved":["cloud storage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeec5fa76259cc8536ef46d93e378e68445ceef3","impact_type":"unknown","incident_date":"2026-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Nishiyamato_Notice_Letter_Template_40227271v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b0c12f6bbfe","org_name":"Nishiyamato Academy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630609"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30757fbfc44b8f7ba7f238dab2a64591c59e1c9f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-09-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CH","org_id":"5a8bf94c498e","org_name":"Medela","org_type":"manufacturing","ransomware":true,"records_affected":423947,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Medela","type":"hibp","url":"https://haveibeenpwned.com/Breach/Medela"}],"summary":"Medela data was reportedly obtained during a ShinyHunters extortion campaign and later published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"608993240b474562230e858d2dbcaec22b12dc74","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"476a30d267b6","org_name":"MEBS Global Reach","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#MEBS%20Global%20Reach-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3cf58c49f8e79828331d0f0fe135501da4fcebcf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6735f7dc0395","org_name":"McKenzie Creative Brands","org_type":"other","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#McKenzie%20Creative%20Brands-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ada9967f13c8c9b99fea77342efb38f29ea6d7e","impact_type":"unknown","incident_date":"2026-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DriveWealth%20-%20Redacted%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e54cbe8050f3","org_name":"DriveWealth","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630619"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005389"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-30","discovered_date":"2026-08-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5602a0d687d6d073a950bfb9a6dee129680c47ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Connect%20-%20California%20AG%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2d10c0deb160","org_name":"American Family Connect Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630618"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Connect%20-%20California%20AG%20Notification.pdf"}],"summary":"An unauthorized third party used personal information from other sources to generate auto insurance quotes and may have acquired driver’s license numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f4b8229b4110577f1aa48980bcc29c26f2391730","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0cf83e0ef8c5","org_name":"Texas Mutual Insurance Company","org_type":"financial","ransomware":null,"records_affected":267,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005373"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-09-29","discovered_date":"2026-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"7aea82f6a88bb2f83f2b3da9181dd2dbd7295299","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Saber%20Healthcare%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8c1b2fa8c191","org_name":"Saber Healthcare Inc","org_type":"healthcare","ransomware":null,"records_affected":427084,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005370"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Saber%20Healthcare%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Saber%20Healthcare%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Saber%20Healthcare%20Inc.-2026-09-26"}],"summary":"Saber Healthcare reported unauthorized activity in its computer systems, and information that may have been accessed included personal, financial, and medical data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-09-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"396c547b0547e61b438edacf914d4b76d121252d","impact_type":"data_theft","incident_date":"2026-09-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted_Proof_-_Adult_Non_MA_40214715v1_0.pdf"},"notes":null,"org_country":"US","org_id":"5c32fd2a8d31","org_name":"Poppins Payroll Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized access resulted from a Metabase security vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630541"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted_Proof_-_Adult_Non_MA_40214715v1_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005380"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Poppins%20Payroll%20Company.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Poppins%20Payroll%20Company-2026-09-30"}],"summary":"Poppins Payroll Company detected unauthorized access to a system resulting from a Metabase security vulnerability, and personal information may have been accessed or acquired.","supporting_quote":"On September 3, 2026, we detected unauthorized access to a system as a result of the Metabase security vulnerability.","technology_involved":["Metabase"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Metabase"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"61946df9be20","name":"Metabase"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5f981a105733b5f5a9fd591c5bb25f229c72600d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8aa95608652b","org_name":"Petrovits, Patrick, Smith & Company, LLC","org_type":"financial","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Petrovits%2C%20Patrick%2C%20Smith%20%26%20Company%2C%20LLC-2026-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88a8421c7762ee15bb19974ef613451465d7c34c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"998869cf0583","org_name":"PDCM Insurance","org_type":"financial","ransomware":null,"records_affected":39759,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005375"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#PDCM%20Insurance-2026-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"fa487dac1702d5e71aa5773e8ded93773dbf35c3","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Pavillon%20International%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"10a6865596a4","org_name":"Pavillon International Inc.","org_type":"unknown","ransomware":null,"records_affected":3102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Pavillon%20International%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Pavillon%20International%20Inc..pdf"}],"summary":"Pavillon International Inc. reported that an unauthorized actor accessed portions of its network and took some data without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-07-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96f98432d4ebb6cfe59516d1f0f988536596f605","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6170050fd876","org_name":"Ozark Interests, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005368"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-29","discovered_date":"2026-01-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ebf7d8cbf6450536b4796b2e34c34009a30f4666","impact_type":"unknown","incident_date":"2026-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69c8c8de68ca","org_name":"Lamb Weston Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":7175,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lamb%20Weston%20Holdings%2C%20Inc.-2026-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-29","discovered_date":"2026-07-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7e988bc3e041fd9eb4503d7df28ac179c9d66df","impact_type":"unknown","incident_date":"2026-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1054daa30160","org_name":"Integrated Sleep and Weight Specialists","org_type":"healthcare","ransomware":null,"records_affected":404,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005333"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"145eb237acf1e2c0bc8b7432d4008b0dfec86524","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"692332c34748","org_name":"Indiana University Health, Affiliated Covered Entity","org_type":"healthcare","ransomware":null,"records_affected":2080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-29-indiana-university-health-affiliated-covered-entity"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5253e05cf0c9687f4249648e96bfa70ad30a39dd","impact_type":"data_theft","incident_date":"2026-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%2012%20Month%20Consumer%20Notice_CA.pdf"},"notes":null,"org_country":"US","org_id":"adbccd233c63","org_name":"City of McMinnville","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630525"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%2012%20Month%20Consumer%20Notice_CA.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005379"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20McMinnville-2026-09-29"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#City%20of%20McMinnville-2026-09-29"}],"summary":"The City of McMinnville reported that information may have been accessed and copied without authorization between June 1 and July 18, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d8b4eeefeeb686fe69525ef33a6da439fc59a57","impact_type":"unknown","incident_date":"2026-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f64dd0c44db","org_name":"Challenge Financial Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630536"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"thegentlemen","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-08-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd01df2c286d960398cf475f9c4843bc0c5b4bb3","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"165aa12da252","org_name":"CAZ Investments LP","org_type":"financial","ransomware":true,"records_affected":13817,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005372"},{"date":"2026-08-21","fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q0FaIEludmVzdG1lbnRzQHRoZWdlbnRsZW1lbg"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"thegentlemen","claim_groups":["thegentlemen"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-29","discovered_date":"2026-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50e91b884a0e7e8af9b0c8a6354a1458ce5d40fa","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"691844a6a8b1","org_name":"Borger Independent School District","org_type":"education","ransomware":null,"records_affected":4261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005376"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6aa1c9663988debcdd021b83a7a711705cf0fc9b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e2d4620f57c9","org_name":"Association of the Bar of the City of New York","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Association%20of%20the%20Bar%20of%20the%20City%20of%20New%20York-2026-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-28","discovered_date":"2026-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c70cc13f72e1294dd13f8876677d2f67a0f536f","impact_type":"data_theft","incident_date":"2026-08-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Buchalter%20Example%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"513f50ce7c6a","org_name":"San Bernardino County","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Buchalter%20Example%20Notice.pdf"}],"summary":"Information belonging to Arrowhead Regional Medical Center patients was included in data from Buchalter that was subject to unauthorized acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Buchalter"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"b403ca09485b","name":"Buchalter"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"96c23d373d5601de9631e4a63db854a09da01aaa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e07a7e7ba232","org_name":"PeoplesBank","org_type":"financial","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#PeoplesBank-2026-09-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e3c3934257a56c41187906289ab788eff8260e87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89066ce9c226","org_name":"Indico Data Center","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Indico%20Data%20Center-2026-09-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6c71ae70bceb0aaff2dadf4d223e20b70837755f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e7575a75869","org_name":"DentaQuest","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#DentaQuest-2026-09-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-27","discovered_date":"2026-07-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56752be1537fc68fe2df3e2b851adfda1906f834","impact_type":"data_theft","incident_date":"2026-07-03","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Upbound%20Group%2C%20Inc.%20-%20Sample%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"9a9c280b32cb","org_name":"Upbound Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630390"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Upbound%20Group%2C%20Inc.%20-%20Sample%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005381"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Upbound%20Group%2C%20Inc.-2026-09-28"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Upbound%20Group%2C%20Inc.-2026-09-26"}],"summary":"Upbound Group reported that an unauthorized third party accessed cloud applications and obtained files containing personal information.","supporting_quote":null,"technology_involved":["cloud applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"be69be89b87b8ba70d126d70cf579019bb8dd56b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"258aeb299d2a","org_name":"Waterford Hotel Group, LCC & LMD Holding Company, LLC","org_type":"other","ransomware":null,"records_affected":242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Waterford%20Hotel%20Group%2C%20LCC%20%26%20LMD%20Holding%20Company%2C%20LLC-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e8394cc8eeb585335a1e810813c8e361edacee3e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c86d6fbad7c2","org_name":"Vascular Associates of South Alabama","org_type":"healthcare","ransomware":null,"records_affected":623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-25-vascular-associates-of-south-alabama"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"92021fbfa66ccb22bf7754985c4ebec6d5f01298","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#TD%20Bank-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-25","discovered_date":"2026-01-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88ce088ec48cb55d776adedf149ee6077fbfa1d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd150dbca182","org_name":"Structural and Steel Products","org_type":"other","ransomware":null,"records_affected":1143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005365"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-15"},"first_seen":"2026-10-15","id":"ee5ec5ced8834b2abdd5dee19b866eed613367ec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c11421438a3","org_name":"Source Care Management, LLC d/b/a NextStep Care","org_type":"healthcare","ransomware":null,"records_affected":685,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-25-source-care-management-llc-d-b-a-nextstep-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"def61b553314fb917b5b762df5d4f2a8252ee280","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc6c8fd499e2","org_name":"Restorative Therapies, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Restorative%20Therapies%2C%20Inc.-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68e65440df6506e3934027c859fc5b6892a915fe","impact_type":"unknown","incident_date":"2026-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Consumer%20Notice%20Sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ede9a71ca2de","org_name":"OneMain Financial Group, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630345"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005366"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20OneMain%20Financial.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#OneMain%20Financial%20Group%2C%20LLC-2026-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-25","discovered_date":"2025-10-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da3281fc41b629450ddec335a32e2246811f7a53","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-27662%20MedImpact%20Healthcare%20Systems%20Ad%20CM%20%28Letter%20B%29%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"2b3edd3e0910","org_name":"MedImpact Healthcare Systems, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630343"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-27662%20MedImpact%20Healthcare%20Systems%20Ad%20CM%20%28Letter%20B%29%20r3prf.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005371"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MedImpact%20Healthcare%20Systems%2C%20Inc.-2026-09-26"}],"summary":"MedImpact identified unauthorized activity in certain systems and determined that certain data relating to affected individuals was potentially impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fb7702f40a2f78514ab7671bfe157ab0b89f1d55","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c7a70adc848","org_name":"Kostelic and Associates 3PLLC","org_type":"healthcare","ransomware":null,"records_affected":535,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-25-kostelic-and-associates-3pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-25","discovered_date":"2026-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a15fb2587ae3689ac430353eb1a32e37a5b4fe14","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kings%20United%20Way_Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8de1cbb611df","org_name":"Kings United Way","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630314"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kings%20United%20Way_Notification%20Letter.pdf"}],"summary":"Kings United Way discovered that sensitive information had been inadvertently posted to a data sharing platform.","supporting_quote":null,"technology_involved":["data sharing platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"76af182216c3ac24a74becb88ecfc5ed2f58a526","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbe83fffd5d7","org_name":"Harbor Fish Market","org_type":"other","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Harbor%20Fish%20Market-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-25","discovered_date":"2026-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c75b7c1d0206cfc18018ae93fd00189b76164e5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab8e2be571e7","org_name":"HarbisonWalker International, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":16046,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005362"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#HarbisonWalker%20International%2C%20Inc.-2026-09-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-25","discovered_date":"2026-01-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13aa08421906452cca81f299c9319c10575d76ef","impact_type":"data_theft","incident_date":"2026-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GTI%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e0d2188806c7","org_name":"Gallagher Transport International Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630300"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GTI%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005367"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Gallagher%20Transport%20International%20Inc.-2026-09-25"}],"summary":"Gallagher Transport International reported that an unauthorized third party accessed systems and copied files on January 11, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-25","discovered_date":"2025-05-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54cf15cb5c9fa39be5deed32c16e556abed677c7","impact_type":"data_theft","incident_date":"2025-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20FASS%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e13251a3cc44","org_name":"Financial Administrative Support Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20FASS%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Financial%20Administrative%20Support%20Services-2026-09-25"}],"summary":"Financial Administrative Support Services reported that an unknown actor accessed certain systems and accessed and/or copied information, including names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-09-25","discovered_date":"2025-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"158278117b04007bee2bfe2b3e0a0ef0c06c6dd2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Corpay%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5936a9dcf475","org_name":"Corpay","org_type":"financial","ransomware":null,"records_affected":28473,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005360"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Corpay%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Corpay%2C%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Corpay%2C%20Inc.-2026-09-21"}],"summary":"An unauthorized actor accessed Corpay’s ICD Portal and viewed and/or took information related to Swift drivers and representatives.","supporting_quote":null,"technology_involved":["ICD Portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-25","discovered_date":"2026-01-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5971473e7aae551953e2b586424e228db1035c06","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0bb986f21e7a","org_name":"CITGO Petroleum Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":4611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005361"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-16","id":"a4cc74d0f8e799888032ac8a0ab44466792a0016","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10f20bbafbee","org_name":"Center for bone and Joint Surgery of the Palm Beaches","org_type":"healthcare","ransomware":null,"records_affected":5461,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-25-center-for-bone-and-joint-surgery-of-the-palm-beaches"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c11965a422488158d0e6433c0f3823fb8385221f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f43a7852d71c","org_name":"Bee, Bergvall & Co","org_type":"financial","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bee%2C%20Bergvall%20%26%20Co-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5e3b009b2ae9195a6130ff2ec77068324d1c7ec9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2d7f8ec94d5","org_name":"Aesto, LLC","org_type":"other","ransomware":null,"records_affected":27,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Aesto%2C%20LLC-2026-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-24","discovered_date":"2026-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9902fdb65f53f07a8c1ac8b05ddcb72b98af7d3","impact_type":"data_theft","incident_date":"2026-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pe%C3%B1a%20%26%20Bromberg%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"3567a79d8375","org_name":"Peña and Bromberg","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630232"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pe%C3%B1a%20%26%20Bromberg%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed certain computer systems and acquired files containing individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1054f07710093fd125bb1b09a98176bdb07527fe","impact_type":"unknown","incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SSN_Rev2_Redacted_40157812v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0a43bab0f7c","org_name":"NSE Insurance Agencies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630194"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b9e435495ae9e30a4c707c740a4718b061514ad7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c4e57251870","org_name":"Ladenburg Thalmann & Co. Inc.","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ladenburg%20Thalmann%20%26%20Co.%20Inc.-2026-09-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fe40daefcb3465e224d8c4959e3af8a733f9d0d","impact_type":"unknown","incident_date":"2026-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/HILT-Trust%202020-A%20-%20Sample%20Individual%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"216791c1caa7","org_name":"HILT-Trust 2020-A and its underlying trusts and affiliates (\"HILT\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630200"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2c353efc52a6f3f138c80f1f7fb1bc2cc0c392f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d487fe68463d","org_name":"Boyd Gaming Corporation","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Boyd%20Gaming%20Corporation-2026-09-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-24","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9df73d3b6fd51065b36fb1d475d35d66ff63d894","impact_type":"data_theft","incident_date":"2026-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20-%20Blanchard_Final_Redacted_CA.pdf"},"notes":null,"org_country":"US","org_id":"70e19904d787","org_name":"Blanchard Training & Development, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630239"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20-%20Blanchard_Final_Redacted_CA.pdf"}],"summary":"Blanchard Training & Development reported a security incident in which personal information may have been copied by an unauthorized individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cb87ab3afca7a17fcce44e1022e61e8a2793ce1","impact_type":"unknown","incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A.%20Notice%20of%20Data%20Event_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"244f86fb463e","org_name":"5Star Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630231"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"eb3bf717cde4456e545af80aa59ea3783d4d598a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb7d14a105aa","org_name":"Lee County Mosquito Control District","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lee%20County%20Mosquito%20Control%20District-2026-09-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7211acee69cd539959a1a0c9ff021e4522fa25a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c0fb3716013","org_name":"Health Access Network Inc.","org_type":"healthcare","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Health%20Access%20Network%C2%A0Inc.-2026-09-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-23","discovered_date":"2026-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d73146dc7508d029ba202f0d1dea73da514191f","impact_type":"data_theft","incident_date":"2025-09-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fairwinds%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9284ae2662ad","org_name":"Fairwinds Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630165"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fairwinds%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005364"}],"summary":"Information relating to Fairwinds Credit Union members may have been accessed or acquired in a cybersecurity incident within Mercadien’s systems.","supporting_quote":"Importantly, this incident occurred within Mercadien’s systems and did not involve a compromise of FAIRWINDS’ systems.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Mercadien"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"74d51783fb3d","name":"Mercadien"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5e4883651f630a1e1c899345b9322dc592e4b840","impact_type":"data_theft","incident_date":null,"initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"9ace2241abb2","org_name":"Astrana Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/asth-20260922x8k.htm"},{"fetched_at":null,"title":"8-K EXHIBIT 99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1083446/000110465926109822/tm2625986d1_ex99-1.htm"}],"summary":"Astrana Health reported that social engineering attempts targeting employees led to unauthorized activity and access to or acquisition of confidential information.","supporting_quote":"The incident involved a series of social engineering attempts in which threat actors, impersonating Company personnel and spoofing the Company’s main corporate telephone number, contacted certain employees in an effort to obtain unauthorized access to Company systems.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"price":{"ticker":"ASTH","base_day":"2026-09-23","returns":{"1":{"day":"2026-09-24","raw":0.0029,"adj":0.0037},"5":{"day":"2026-09-30","raw":0.0358,"adj":0.0426}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-22","discovered_date":"2026-01-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1dbbcc5b193d1e0168ff1e5fd55eda783a16e363","impact_type":"data_theft","incident_date":"2026-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Modoc%20Medical%20Center%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"81bc63864fe0","org_name":"Modoc Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Modoc%20Medical%20Center%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Modoc Medical Center reported that an unknown actor accessed systems and downloaded files between January 19 and January 27, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2026-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"28b46c661944885ae489884dfee881ee9654f66b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fba99b5c6657","org_name":"Kid CenterEd, PLLC","org_type":"education","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kid%20CenterEd%2C%20PLLC-2026-09-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9a5ef9d82793225a7a908be6e356e3846a2735e2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ddf124e2b1de","org_name":"Woodlawn Hospital","org_type":"healthcare","ransomware":null,"records_affected":742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-21-woodlawn-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"114dac189a1d9c62643256c999a8eb5d383c2c13","impact_type":"data_theft","incident_date":"2026-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/United%20Underwriters%20-%20Individual%20Notice%20-%20SAMPLE_0.pdf"},"notes":null,"org_country":"US","org_id":"fddf30af4bb0","org_name":"United Underwriters","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630066"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/United%20Underwriters%20-%20Individual%20Notice%20-%20SAMPLE_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005358"}],"summary":"United Underwriters reported that an unauthorized actor downloaded files containing personal information from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b72c27c3147af4bb38144c543d49504ac3812ddb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"181b703f02cb","org_name":"Three Oaks Hospice of West Houston","org_type":"healthcare","ransomware":null,"records_affected":351,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005346"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5a42234a40ee8cf5acf3b89adbf28a5baacd34e5","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"128562080364","org_name":"Three Oaks Hospice of San Antonio","org_type":"healthcare","ransomware":null,"records_affected":857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005345"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ee28bc6395791b0aee4da3fe62d5bff24be3276","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d2bc88e9a541","org_name":"Three Oaks Hospice of North East Texas","org_type":"healthcare","ransomware":null,"records_affected":449,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005344"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4654c135b9fdc1b27a0b327e1e2a78b5507d53f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e6aea3677d5","org_name":"Three Oaks Hospice of Fort Worth","org_type":"healthcare","ransomware":null,"records_affected":4582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005343"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3f4102f7a69e28a05a2d08b45d9fe430d12a1fa","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7881ef27ec0b","org_name":"Three Oaks Hospice of El Paso","org_type":"healthcare","ransomware":null,"records_affected":756,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005341"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-07-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"058a101ed87e07dfa152115c1f83966a8b8ad4ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"deaef00a65ed","org_name":"The City of Jacksonville, TX","org_type":"government","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005349"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-21","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9d0720b70fb97fcff75237db36c9704471d60c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Adult%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"79b024df3845","org_name":"Ridgeway Pharmacy Ltd","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630056"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Adult%20-%20Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005359"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ridgeway%20Pharmacy%20Ltd-2026-09-21"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ridgeway%20Pharmacy%2C%20Ltd-2026-09-21"}],"summary":"An unauthorized party accessed records on Ridgeway Pharmacy Ltd’s website that may have included personal, medical, and financial information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-03-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"429a1184104fdd955036f66908ecac65a6eb5049","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"28b5c91fccf2","org_name":"Mitchell County Hospital District","org_type":"healthcare","ransomware":null,"records_affected":22986,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005342"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b5c2dd3baae2a2b3e0747cadeba4c012ba48d17a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a272d56e219","org_name":"Millstone Medical Outsourcing, LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Millstone%20Medical%20Outsourcing%2C%20LLC-2026-09-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"28b1978a5673ec472eff3c6afe58bdd5c495325c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"683731d833cf","org_name":"Imagine the Possibilities","org_type":"healthcare","ransomware":null,"records_affected":1693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-21-imagine-the-possibilities"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fca2eb69ff537d4fcf9ab900c8e60e26f7d4188d","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbfd2f1a36e8","org_name":"IDScan.net","org_type":"retail_ecommerce","ransomware":null,"records_affected":13000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005350"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#IDScan.net-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-21","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f0f3f93bff4cc6c38bbfb97e7c0dcf79f1fcf6c","impact_type":"both","incident_date":"2025-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fun%20For%20Less%20Tours%20-%20Adult%20CM_R2.pdf"},"notes":null,"org_country":"US","org_id":"94ba45ac8c5d","org_name":"Fun For Less Tours, Inc.","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630062"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fun%20For%20Less%20Tours%20-%20Adult%20CM_R2.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005357"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fun%20For%20Less%20Tours%2C%20Inc.-2026-09-21"}],"summary":"Fun For Less Tours discovered a ransomware attack in which an unauthorized third party accessed its computer network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-09-21","discovered_date":"2025-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9491da452b8e75c8fed68c1ad3b74747e471107e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Friesen_Adult_CM.pdf"},"notes":null,"org_country":"US","org_id":"711fa5b988f0","org_name":"Friesen Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630087"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Friesen_Adult_CM.pdf"}],"summary":"Friesen Group reported that an unauthorized user accessed its network and may have accessed data including a person’s name and test data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ec2854005481b820af5748417b0fe15ac1b7d66","impact_type":"unknown","incident_date":"2026-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Ethan%20Conrad%20-%20CA%20Notice%20Letter%20Proof%20%28Redacted%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e9626a6a527","org_name":"Ethan Conrad Properties","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630085"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-06-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"94b9b50fe65e22d0fcb1addfeca7f8089621b306","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1fb673d0718","org_name":"Doctor's Choice Home Care","org_type":"healthcare","ransomware":null,"records_affected":14333,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005355"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"57d2ea0b48a7d2f8fcff19e9bba30cec73d50766","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97b64c85d13f","org_name":"Call-on-Doc","org_type":"healthcare","ransomware":null,"records_affected":648535,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005352"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Call-On-Doc%2C%20Inc.-2026-09-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3677e9bb50ba4be18b3871bb4930c1c4e7a62b90","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-25","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"937cd4b72a27","org_name":"Burger King Russia","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Burger King Russia","type":"hibp","url":"https://haveibeenpwned.com/Breach/BurgerKingRussia"}],"summary":"Burger King Russia customer data was exposed after an August 2024 attack on the Mindbox marketing automation platform.","supporting_quote":"In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform.","technology_involved":["Mindbox marketing automation platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Mindbox"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"9a9f423156ef","name":"Mindbox"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5e760b435514613ac43d3ad0c6d80994e8dc5e65","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a01075a9e04b","org_name":"Boston Capital Holdings LP","org_type":"other","ransomware":null,"records_affected":54968,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005348"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Boston%20Capital%20Holdings%20LP-2026-09-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5db7313ca374d70d1fdafcd1d7fb11b283da509d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"665ea808563c","org_name":"Azure Farms, Inc.","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Azure%20Farms%2C%20Inc.%2C%20d/b/a%20Azure%20Standard-2026-09-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-07-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58f25c13b057755ab063bd4f71395bdd24381a9d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cab911305f85","org_name":"Aprio Advisory Group, LLC","org_type":"financial","ransomware":null,"records_affected":2557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005354"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-21","discovered_date":"2026-08-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25a7460eee4002faa6444b6bbb967dc6e474f263","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6184580dfba","org_name":"Affordable Mortgage Advisors","org_type":"financial","ransomware":null,"records_affected":1161,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005353"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c3af3e5d077d69e8829819d6dcc553c38d5a3b7e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab54c8663721","org_name":"Applied Healthcare Nursing Division, Inc. d/b/a Doctor's Choice Home Care","org_type":"healthcare","ransomware":null,"records_affected":14333,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-19-applied-healthcare-nursing-division-inc-d-b-a-doctor-s-choice-home-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ab15f2eeed0d4b9971a8f0f9ae3b13f629312ebc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"113dbad04908","org_name":"Wellington at Seven Hills Homeowner's Association, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Wellington%20at%20Seven%20Hills%20Homeowner%27s%20Association%2C%20Inc.-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3a03895b1993d6e5128a2f871326db9864aff238","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"198382f553a9","org_name":"SOUND HSA, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#SOUND%20HSA%2C%20Inc.-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-18","discovered_date":"2026-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1437cae104982f137672be9fff4884f40a4185ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Seyfarth%20Shaw%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6b29e0bd880a","org_name":"Seyfarth Shaw LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629966"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Seyfarth%20Shaw%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005356"}],"summary":"Seyfarth reported that a small number of documents containing personal information were sent by email to an unauthorized recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"683f3cab6255109cb59dcfe95135330f036375d2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a77eee6842d","org_name":"OU Medicine, Inc.","org_type":"healthcare","ransomware":null,"records_affected":854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-18-ou-medicine-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a4278854b3533037d53e050ff017b3a9a77ea6f","impact_type":"unknown","incident_date":"2026-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USBFS4975_Opportune-Adult-file2.pdf_23%2840124410.1%29_Redacted_40140877v1.pdf"},"notes":null,"org_country":"US","org_id":"45d0cd9c7a83","org_name":"Opportune LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629948"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USBFS4975_Opportune-Adult-file2.pdf_23%2840124410.1%29_Redacted_40140877v1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005351"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Opportune%20LLP-2026-09-18"}],"summary":"Opportune LLP notified affected people of a security incident involving personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-09-18","discovered_date":"2026-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1be8a3a9d4b10b64fefa71914b93d2a64395ca8","impact_type":"data_theft","incident_date":"2025-12-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Appendix_0_0.pdf"},"notes":null,"org_country":"US","org_id":"7228017f7478","org_name":"Los Angeles City Attorney's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor used a compromised credential to acquire data from the file share.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629957"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Appendix_0_0.pdf"}],"summary":"An unauthorized actor used a compromised credential to acquire data from the Los Angeles City Attorney's Office file-sharing platform.","supporting_quote":"We immediately launched an investigation, secured the file share, and determined that an unauthorized actor used a compromised credential to acquire data from the file share between December 28, 2025, and January 22, 2026.","technology_involved":["file-sharing platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ca74ea62febcb048e74657f6af670382cd093eef","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f30baa09f439","org_name":"LeMaitre Vascular, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#LeMaitre%20Vascular%2C%20Inc.-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"24deccaf43e49d6309bd4c9c927a7d80339b50a3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ccd5cfb13fad","org_name":"G.I. Medicine Associates, P.C.","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#G.I.%20Medicine%20Associates%2C%20P.C.-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"804d039a7d8d85f1fcd91ac6d83046843329f870","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7113bf3d433e","org_name":"American Service Center Associates, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#American%20Service%20Center%20Associates%2C%20LLC-2026-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"598cb2057cfed53710e288e44b5f8337ef7a24d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba4d844eaf24","org_name":"Three Oaks Hospice of Dallas","org_type":"healthcare","ransomware":null,"records_affected":6032,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005340"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e36283885d7f28dcf2282683c0e6a949939ed818","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"984e4ee272b7","org_name":"Three Oaks Hospice of Austin","org_type":"healthcare","ransomware":null,"records_affected":427,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005339"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a6a0ecc0d27efbec6ff9a0a9acae87bb3d79de34","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c6b479f8dc0d","org_name":"Three Oaks Hospice, Incorporated","org_type":"professional_services","ransomware":null,"records_affected":36622,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-17-three-oaks-hospice-incorporated"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005347"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ea58c07c2f432296f5acf5482180ee30e1164ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc0d8e57e60d","org_name":"TEXAS REGIONAL ASTHMA, ALLERGY & IMMUNOLOGY CENTER","org_type":"healthcare","ransomware":null,"records_affected":5200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005337"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-07-07","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42125eb346819bbb4d1d592a4492f2e44fa20804","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Partnership%20HealthPlan%20-%20Breach%20Notification%20Letter%20%28Clarity%20Incident%29.pdf"},"notes":null,"org_country":"US","org_id":"0bcb10f3f543","org_name":"Partnership HealthPlan of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Partnership%20HealthPlan%20-%20Breach%20Notification%20Letter%20%28Clarity%20Incident%29.pdf"}],"summary":"Partnership HealthPlan of California reported that mailings contained information belonging to unrelated members, including names, dates of birth, and member identification numbers.","supporting_quote":"Our investigation found that some mailings sent between May 13, 2026, and July 8, 2026, contained information belonging to unrelated members.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c543f2b30e655b7568e143bf22a6316fc97a99f5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6c80bdb40ec","org_name":"Lincoln Investment Planning, LLC","org_type":"financial","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lincoln%20Investment%20Planning%2C%20LLC-2026-09-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c893d14789b2eff8621ce96f6eb6f365d94a3bb7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c0c96ac3e09","org_name":"LeTourneau University","org_type":"education","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005335"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3ee0f375916166e2042000138423dfee35d56f8a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f339a74495cc","org_name":"Elevation Hospice of Utah, LLC","org_type":"healthcare","ransomware":null,"records_affected":2003,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005338"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-17","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"503ef6fdc9eb20e409fffa43e114c30110a09792","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"979a925c4956","org_name":"Centennial Bank (","org_type":"financial","ransomware":null,"records_affected":8227,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005334"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29feec209ea81602d4119aaecf39ade4559fa4ea","impact_type":"unknown","incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CallonDoc%2C%20Inc.%20-%20Individual%20Notice%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a01fdc84887","org_name":"CallonDoc, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629887"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"98bbea7f8acc202f710e33263ec0834df4ab7662","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3959e18c693f","org_name":"WindRose Health Network","org_type":"healthcare","ransomware":null,"records_affected":33158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-16-windrose-health-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c70ecd578f9d3fce6a5bd58f9ceacf0c52735335","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b15cacebe6a8","org_name":"Tessco, LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tessco%2C%20LLC-2026-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b45ecf286151ed0513e965d82b9dd2b39f4dc2e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae1d07944c25","org_name":"Powerhouse Retail Services","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Powerhouse%20Retail%20Services-2026-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b3fcb38146c08b4eb1c9981f5108b90c97f6465a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb2bcc578455","org_name":"Ocracoke Health Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":29,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ocracoke%20Health%20Center%2C%20Inc.-2026-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"90eeca97a99caccb1489fa011ffc4f537b24a62d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f139f0963d7","org_name":"Kurt J. Lesker Company","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kurt%20J.%C2%A0Lesker%20Company-2026-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c1f4da3c07c83effe933b76d5b886e1ed26b5e4b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6a5f9096d2c","org_name":"AVL Growth Partners, an Ampleo Company","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AVL%20Growth%20Partners%2C%20an%20Ampleo%20Company-2026-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b0630c93a636ee1efa4d958778198b4a402b21e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e7fb88873d91","org_name":"At Home Medical, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1091,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-16-at-home-medical-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c1fdaf1674e1e99a582a8f2b45e61504164219f1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5952a34b3c91","org_name":"AngMar Management Services","org_type":"professional_services","ransomware":null,"records_affected":126196,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-16-angmar-management-services"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005363"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6bd297756852052c87d72580f664796261c919c1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Alpine%20Agency%20of%20the%20Midlands%2C%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df8d566a56c7","org_name":"Alpine Agency of the Midlands, LLC","org_type":"unknown","ransomware":null,"records_affected":6443,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Alpine%20Agency%20of%20the%20Midlands%2C%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2c8853a5e5ea80c48098e299337f7326c308698f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90a4ae516f8d","org_name":"Advanced Radiology Services, P.C.","org_type":"healthcare","ransomware":null,"records_affected":826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-16-advanced-radiology-services-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-15","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b579c74cdfda430eeba09b69b278debafaacd118","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3cdade7181d9","org_name":"Texas Spine Consultants, PLLC","org_type":"healthcare","ransomware":null,"records_affected":99068,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005332"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Texas%20Spine%20Consultants%2C%20PLLC-2026-09-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-15","discovered_date":"2025-09-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f18d685df201689b12ff479cddef68ed3be223f","impact_type":"data_theft","incident_date":"2025-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TKD%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"abce1935002b","org_name":"Tarter Krinsky & Drogin LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TKD%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Unauthorized access to certain Tarter Krinsky & Drogin LLP servers resulted in information stored on them being viewed or obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"03a69cfab68de3ccca5872163e2ab568f86e3961","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69d6f330359f","org_name":"Nevada Estate Planning and Probate, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Nevada%20Estate%20Planning%20and%20Probate%2C%20LLC-2026-09-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-15","discovered_date":"2025-10-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b63c9e26de9ba585b6c22d9397ff2b44bca1d011","impact_type":"unknown","incident_date":"2025-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20with%20No%20Credit%20Monitoring%20-%2027659-medimpact-healthcare-systems-ad-no-cm-letter-a-r1prf%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"7f0abb2576d3","org_name":"Leggett & Platt, Incorporated Employee Benefits Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629789"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20with%20No%20Credit%20Monitoring%20-%2027659-medimpact-healthcare-systems-ad-no-cm-letter-a-r1prf%20%28002%29.pdf"}],"summary":"Unauthorized activity in MedImpact systems resulted in data relating to the plan member being included among potentially impacted data.","supporting_quote":null,"technology_involved":["MedImpact"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MedImpact"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"435c0710f424","name":"MedImpact"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-15","discovered_date":"2026-08-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c963506fdd718a1d9f4d0de6467d9763c190f841","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1735b5451b89","org_name":"–\tGreater Austin Merchants Association","org_type":"retail_ecommerce","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005331"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3a9ed17fca938fb4518c07b7ca9f4fa0ba8d5466","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ea928a947f2","org_name":"Camden-on-Gauley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-15-camden-on-gauley-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dae0ffe41d162b06046e03477b202b20c10940a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd397aaa3938","org_name":"C2M LLC","org_type":"other","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#C2M%20LLC%20d/b/a%20Click2Mail-2026-09-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"df27a917172160423e0e5f913052c9af9119f879","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6677b88ab58c","org_name":"Bacon County Health Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-15-bacon-county-health-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-15","discovered_date":"2026-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e7cc3fd660a75c87693f4253d2f75e0259aeebf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alliance%20Environmental%20Group%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"bc22a4bbbe18","org_name":"Alliance Environmental Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629776"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alliance%20Environmental%20Group%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Alliance Environmental Group, LLC found that files containing personal information were accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"869dac778c552fb88edb503d313ee2faf5b84158","impact_type":"unknown","incident_date":"2025-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PHS_Redacted_Notice_Letter_40106534v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb35e02f5d69","org_name":"Paradigm Healthcare Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629754"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"293c499efe0ec202922b248702b869e3a8fbb5b8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c584faefe1dd","org_name":"LPL Financial LLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#LPL%20Financial%20LLC-2026-09-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"71d162421950436e8653868b86e72804ee0f6b27","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed480f169ceb","org_name":"Lakes Region Visiting Nursing Association","org_type":"healthcare","ransomware":null,"records_affected":1274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-14-lakes-region-visiting-nursing-association"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"30acfdbf1561863878fea083e46bb93408fd4d0d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a875c6ce2b5","org_name":"HealthStream, Inc.","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#HealthStream%2C%20Inc.-2026-09-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-09-14","discovered_date":"2026-07-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-09","id":"d0c255a3ebad9f9e2213ad93ca20a88298f8a1de","impact_type":"data_theft","incident_date":"2026-07-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Clover%20Health%2C%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"567215558fd1","org_name":"Clover Health","org_type":"healthcare","ransomware":null,"records_affected":138677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-14-clover-health"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Clover%20Health%2C%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Clover%20Health%2C%20LLC.pdf"}],"summary":"Clover Health reported that an unauthorized party used employee credentials to access company applications and data, including personal information.","supporting_quote":"The investigation determined that, between July 3, 2026, and July 4, 2026, an unauthorized party gained access to access credentials belonging to three non-managerial Company employees and then used those credentials to access certain Company applications and data.","technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-09","id":"bc5eb8920bdad0d3e3c17e8ee2c31b405dad332d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"a354be4c5e96","org_name":"CenterPoint Energy","org_type":"energy_utilities","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"CenterPoint Energy Breach Exposes 1M Customer Records","type":"mastodon","url":"https://osintsights.com/centerpoint-energy-breach-exposes-1m-customer-records?utm_source=mastodon&utm_medium=social"},{"fetched_at":null,"title":"CenterPoint Energy Data Breach Impacts 1 Million Texans","type":"press","url":"https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/"},{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1130310/000110465926107560/tm2625326d1_8k.htm"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005412"},{"fetched_at":null,"title":"📰 CenterPoint Energy Data Breach Impacts Over 1 Million Texas Residents CenterPoint Energy reports a data breach impacti","type":"mastodon","url":"https://mastodon.social/@netsecio/117450944308644482"}],"summary":"CenterPoint Energy reported unauthorized access to customer data through an externally facing system, with approximately 1 million Texans affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-17","veris_action":"unknown","derived":{"price":{"ticker":"CNP","base_day":"2026-09-14","returns":{"1":{"day":"2026-09-15","raw":-0.0173,"adj":-0.0127},"5":{"day":"2026-09-21","raw":-0.0171,"adj":-0.0337},"21":{"day":"2026-10-13","raw":0.0184,"adj":-0.0041}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3523fcbfb6e56f194265d8aba8649bf72afa3c90","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-11","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Sample_CA_2026SEPT14.pdf"},"notes":null,"org_country":"US","org_id":"c01921e87a83","org_name":"Cambridge Mercantile Corp.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Klue’s CRM integration infrastructure was compromised, allowing access to Corpay’s CRM data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Sample_CA_2026SEPT14.pdf"}],"summary":"An unauthorized third party compromised Klue’s CRM integration infrastructure and accessed Corpay CRM data, which may have included personal information.","supporting_quote":"As we understand from Klue, an unauthorized third party compromised Klue’s CRM integration infrastructure and, between June 11 and June 12, 2026, accessed CRM data of many of Klue’s customers, including Corpay’s CRM data.","technology_involved":["Klue","CRM"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Klue"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ef0bfef53079","name":"Klue"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccaba5cd72e79009ef07421607a02280c2b746ee","impact_type":"data_theft","incident_date":"2025-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Accela_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"9005f7cd626a","org_name":"Accela, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629676"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Accela_CA%20App%20%26%20Sample_0.pdf"}],"summary":"An unauthorized actor accessed Accela’s secure file transfer portal and acquired copies of files stored on Accela’s computer systems.","supporting_quote":null,"technology_involved":["secure file transfer portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f4ba6cb618cb929288c4d7317b33f229a1378e5","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fd807ef3142f","org_name":"Chess.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chess.com (2026)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Chess2026"}],"summary":"Records allegedly sourced from Chess.com were posted online, and analysis suggested they had been obtained by scraping.","supporting_quote":null,"technology_involved":["Chess.com accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"64b6e3027cf4f10e22d29cd8cec1827657782fb9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"575fe5a1d738","org_name":"Cornerstone Staffing Services, Inc.","org_type":"other","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cornerstone%20Staffing%20Services%2C%20Inc.-2026-09-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-11","discovered_date":"2025-11-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdf54f472adcd8fc5259f4a2f52b8b23b8c4d05f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_Q3728_SUFFOLK_DBM-5989_L01_SAS_1%28121252245.1%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2dc9b63cf258","org_name":"Suffolk Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629581"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_Q3728_SUFFOLK_DBM-5989_L01_SAS_1%28121252245.1%29_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005328"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Suffolk%20Federal%20Credit%20Union-2026-09-11"}],"summary":"A former service provider to Suffolk Federal Credit Union reported unauthorized access to its computer environment that may have involved the credit union’s customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Mercadien, P.C., CPAs"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"74d51783fb3d","name":"Mercadien"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"285f800eb28076af58d589f01984b8f40beed1a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c947c6e3f2a","org_name":"Score Services LLC","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Score%20Services%C2%A0LLC%C2%A0%20d/b/a%20Score%20Capital-2026-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-11","discovered_date":"2026-08-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aa527a2819e5f5dcdb2b71330e7fcd1a30dada3e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46606be9fcf6","org_name":"Quatrro Business Support Services, Inc. (“Quatrro”)","org_type":"retail_ecommerce","ransomware":null,"records_affected":188218,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005320"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-11","discovered_date":"2026-08-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aa3a3cd9eecc2212d2d9aed27ea3f833249d07fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d561e7e1d8c","org_name":"North Dallas Shared Ministries","org_type":"nonprofit","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005325"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fdce6ba7307b6e695ebd207836f4d1f39c12c26e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"52e3ac052ef3","org_name":"MIV Buyer, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#MIV%20Buyer%2C%20LLC-2026-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-11","discovered_date":"2026-07-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fe84738d5e1e8d1588d35ce0d4221c905038fbfe","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"70708983235f","org_name":"Heart of Texas Workforce Development Board, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005324"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-11","discovered_date":"2026-08-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fffa94a0803bbb264451cf67605c332e0b89e3c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15c95775c720","org_name":"Costa Solutions, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":22482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005321"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e7b75dd8c90b421ed31b2178a1de4d2bc5d788a","impact_type":"unknown","incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CSSI_CA_Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"120c3cd3982d","org_name":"Cornerstone Staffing Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629595"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005330"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cornerstone%20Staffing%20Solutions%2C%20Inc.-2026-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d850a9b5ac3d8eff40cc9b08d83c70f963ee8d","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CPG%20-%20Aesto.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87e384ee6876","org_name":"Catalyst Physician Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629605"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005329"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-11","discovered_date":"2026-07-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46e96c89f1019f3563d9923c96ebb76f186c3c6b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07fe14490f3d","org_name":"Cardinal Services LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":2241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005322"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"928c582906013e4cce9a68f7a57e84b752f8b3ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4333b2366db7","org_name":"Vernon & Waldrep OB-Gyn Associates","org_type":"healthcare","ransomware":null,"records_affected":17435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-10-vernon-waldrep-ob-gyn-associates"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005326"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-10","discovered_date":"2026-04-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"b79a32b5e42a36f8d2cebbb594c026d350c5eabc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Prescribe%20FIT%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1d5ea8bc3ef2","org_name":"Prescribe FIT, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1303,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Prescribe%20FIT%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Prescribe%20FIT%2C%20Inc..pdf"}],"summary":"Prescribe FIT discovered an unauthorized compromise of an email account on or around April 13, 2026, where personal information was contained.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d42004395f4c4721f137a6dc8917ea1ac4d7417b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0cc20721fe09","org_name":"Petco Animal Supplies Stores, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Petco%20Animal%20Supplies%20Stores%2C%20Inc.-2026-09-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3d0a4df237f7a6be4ed9cd29b98a16b9e2c5f981","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c6e34d7bb712","org_name":"Persona Dental","org_type":"healthcare","ransomware":null,"records_affected":3386,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-10-persona-dental"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"16500f9553f1cdd28c1630b66e4de41c342f83a0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d9a04f4abe73","org_name":"Midkiff, Muncie & Ross, P.C.","org_type":"other","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Midkiff%2C%20Muncie%20%26%20Ross%2C%20P.C.-2026-09-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9ff15ede9a6f12aa4b240932504685d7d43d542f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b7c18448fe8","org_name":"Marion Military Institute","org_type":"education","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Marion%20Military%20Institute-2026-09-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0a63469726c329aec075000d76a73016eebcaed5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d952377da7c5","org_name":"Interim HealthCare Inc.","org_type":"healthcare","ransomware":null,"records_affected":1283,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-10-interim-healthcare-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"90fe2afc093e7fae9e31f3ed3d3140dc9742e38b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"56cbbf5992b3","org_name":"Heywood Healthcare Inc., Henry Heywood Memorial Hospital, Athol Memorial Hospital, and Heywood Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Heywood%20Healthcare%C2%A0Inc.%2C%20Henry%20Heywood%20Memorial%20Hospital%2C%20Athol%20Memorial%20Hospital%2C%20and%20Heywood%20Medical%20Group%2C%20Inc.-2026-09-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cef4f2f50f813bc895225e4e17d12a3978c75f60","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"fc91e0512bde","org_name":"Conduent Incorporated","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1677703/000167770326000113/cndt-20260910.htm"}],"summary":"Conduent disclosed an agreement in principle to settle lawsuits related to a previously disclosed January 2025 cybersecurity incident in which individuals’ personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"CNDT","base_day":"2026-09-10","returns":{"1":{"day":"2026-09-11","raw":-0.0063,"adj":-0.0149},"5":{"day":"2026-09-17","raw":0.0759,"adj":0.0697},"21":{"day":"2026-10-09","raw":0.0127,"adj":-0.0147}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e90ebabf4d8d0d257ee40fbabc32b7988f98ffc4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3772df36476","org_name":"Comprehensive Orthopedics & Musculoskeletal Care, LLC","org_type":"healthcare","ransomware":null,"records_affected":21897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-10-comprehensive-orthopedics-musculoskeletal-care-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b6a0e2938d10bd40ecaa84787357eab771bbad31","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5114778abafd","org_name":"Alma Family Services","org_type":"healthcare","ransomware":null,"records_affected":2753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-10-alma-family-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"40b4e16c823b6f66410f6da9795a1acfe7634d68","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1c4289a00a5","org_name":"U.S. Bank","org_type":"financial","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#U.S.%20Bank-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1fee8e9601f80668f11af113a5de5655491b5d4c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"37a7c3fc230c","org_name":"Quattro Business Support Services, Inc","org_type":"other","ransomware":null,"records_affected":27,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Quattro%20Business%20Support%20Services%2C%20Inc-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-09","discovered_date":"2025-12-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fb26ac0a4c91474512fc2e8ff4e7e43267fcd36","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quatrro_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"55b3eea1c890","org_name":"Quatrro Business Support Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quatrro_CA%20App%20%26%20Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Quatrro%20Business%20Support%20Services%2C%20Inc.-2026-09-09"}],"summary":"Quatrro reported unauthorized access to certain files containing personal information from November 11 to 19, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b6c2c9d1bddcaa0b1fc6ec8069bd51bb8842f739","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e07cf9b3b5a1","org_name":"Novocure Inc.","org_type":"healthcare","ransomware":null,"records_affected":1464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-09-novocure-inc"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Tm92b0N1cmUgTGltaXRlZEBzaGlueWh1bnRlcnM"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["shinyhunters"],"price":{"ticker":"NVCR","base_day":"2026-09-09","returns":{"1":{"day":"2026-09-10","raw":-0.0179,"adj":-0.0119},"5":{"day":"2026-09-16","raw":0.0377,"adj":0.0487},"21":{"day":"2026-10-08","raw":-0.0902,"adj":-0.1053}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-09","discovered_date":"2026-08-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6078f3df575662ba47a80c101fd4ea27b90d007b","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"12869752edd5","org_name":"Northwest Paper Box Manufacturers","org_type":"unknown","ransomware":null,"records_affected":752,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Paper%20Box%20Manufacturers-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b8b18482fbd446890f57ac5a0958ed28fc88ce28","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"23c09679daa4","org_name":"Next Level Medical, LLC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-09-next-level-medical-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-09","discovered_date":"2026-07-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e5cb8988bfaba87d2dc516fcf6311f93eb9e3d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"216791c1caa7","org_name":"HILT-Trust 2020-A and its underlying trusts and affiliates","org_type":"financial","ransomware":null,"records_affected":41153,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005318"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6d02753fc44e1f450865f4a50d27c1bc84dace16","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dc3f048fd9f1","org_name":"HILT-Trust 2020-A","org_type":"financial","ransomware":null,"records_affected":91,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#HILT-Trust%202020-A-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"SilentRansomGroup","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11f8511e0d9a9c9b453abd595293925c39b6fc9d","impact_type":"data_theft","incident_date":"2026-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Greenberg%20Proposed%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b5c76e4b79bc","org_name":"Greenberg Traurig, LLP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629493"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-630659"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Greenberg%20Proposed%20Consumer%20Notice.pdf"},{"date":"2026-09-02","fetched_at":null,"title":"Leak-site claim by SilentRansomGroup","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/R3JlZW5iZXJnIFRyYXVyaWdAU2lsZW50UmFuc29tR3JvdXA"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Greenberg%20Traurig%2C%20LLP.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Greenberg%20Traurig%2C%20LLP-2026-09-08"}],"summary":"Greenberg Traurig reported that an unauthorized individual obtained a limited number of files containing personal information on August 26, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"silentransomgroup","claim_groups":["silentransomgroup"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-09","discovered_date":"2026-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bc7078fa2980bad20e059e6714e8cbf53d82d804","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e26a37e67666","org_name":"Eckert Seamans Cherin & Mellott, LLC","org_type":"other","ransomware":null,"records_affected":379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005313"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005409"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c56730ec5dae6041b5a473ef2458b1f50ca1c627","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cab6e58ec373","org_name":"City of North Adams","org_type":"government","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#City%20of%20North%20Adams-2026-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7a7913348cb0afb7e16d98ce8623cb12e3293f7a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d15ca0230abb","org_name":"Azle Cube Smiles PLLC","org_type":"healthcare","ransomware":null,"records_affected":3280,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-09-azle-cube-smiles-pllc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005323"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"api_or_integration_token","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0c6b81d51d098f3dd5cbc7e8a85bac1049766a49","impact_type":"data_theft","imported_from":null,"incident_date":"2026-09-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"actor name 'thegentlemen' not in source; cleared","org_country":"US","org_id":"6d706c963ff3","org_name":"Veradigm Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Credentials obtained from the vendor’s environment were used to access Veradigm’s API.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1124804/000119312526385249/mdrx-20260908.htm"},{"fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VmVyYWRpZ21AdGhlZ2VudGxlbWVu"}],"summary":"An unauthorized party used vendor-environment credentials to access Veradigm’s API and download copies of patients’ personal data.","supporting_quote":"Based on the Company’s investigation to date, an unauthorized party obtained credentials from the vendor’s environment to a Company application programming interface used by the vendor to provide services on behalf of the Company’s customers.","technology_involved":["API"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["thegentlemen"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"40bf82e4cf7b9979d742dfda7a496fbddf5f1d8f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e47bd2b6bf4f","org_name":"Strategic Wealth Advisors","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Strategic%20Wealth%20Advisors-2026-09-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"11bde7ae57808f90ad755876334c630e8572179c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee1f4b2afd17","org_name":"Pilgrim Title & Closing Services LLC and/or Pilgrim Title Insurance Company and/or Montalbano, Bellevue & St. Sauveur, LLP","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Pilgrim%20Title%20%26%20Closing%20Services%20LLC%20and/or%20Pilgrim%20Title%20Insurance%20Company%20and/or%20Montalbano%2C%20Bellevue%20%26%20St.%20Sauveur%2C%20LLP-2026-09-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4418ef446cf7378debd623af8a8238388c007485","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89a5d5d9bfc5","org_name":"Lexington Hospital Corporation","org_type":"healthcare","ransomware":null,"records_affected":67000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-08-lexington-hospital-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"262e0a976ee45e71112d30279014ade12549d733","impact_type":"unknown","incident_date":"2026-04-22","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/00617240t3_Kroll_ELN-28104_D15_0903_AUDITS_Redacted%20%28ADULT%201YR%29.pdf"},"notes":null,"org_country":"US","org_id":"a8b4d9a1b97e","org_name":"Hibbett Retail, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629439"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/00617240t3_Kroll_ELN-28104_D15_0903_AUDITS_Redacted%20%28ADULT%201YR%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005316"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Hibbett%20Retail%2C%20Inc..pdf"}],"summary":"Hibbett Retail, Inc. notified affected people of an incident involving records that contained their names and engagement numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"48fe074d2b007bc5f3abe42f9c1b6a344481bb35","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4413f62442a4","org_name":"Hibbert Retail, Inc.","org_type":"other","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hibbert%20Retail%2C%20Inc.-2026-09-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"33fd9240b8a8c319e2bbfa5bbe9bd03a1e36ce4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9d71da391868","org_name":"Ascent Global Logistics, Inc.","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ascent%20Global%20Logistics%2C%20Inc.-2026-09-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1a36df63f40a216f8fb5769b3e955d3432fb020e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8035b5f0a72b","org_name":"Hamaspik (Choice and Inc.)","org_type":"healthcare","ransomware":null,"records_affected":8181,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-06-hamaspik-choice-and-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-04","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"1d868a632808c2d4764ba60ac1caaa3ec78b1597","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Virta%20Health%20Corp.%20%26%20Virta%20Medical%2C%20PC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4c17a79587d9","org_name":"Virta Health","org_type":"healthcare","ransomware":null,"records_affected":14636,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005309"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Virta%20Health%20Corp.%20%26%20Virta%20Medical%2C%20PC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Virta%20Health%20Corp.%20%26%20Virta%20Medical%2C%20PC.pdf"}],"summary":"Virta Health reported that files in a data repository separate from its production platform may have been accessed, potentially exposing personal information.","supporting_quote":null,"technology_involved":["data repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0a35f9d29c08e6462c1d08e0d4116f4c572e6aa7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb98a1bd8f7e","org_name":"Provident Behavioral Health","org_type":"healthcare","ransomware":null,"records_affected":25086,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-provident-behavioral-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8c959d54827ce1201366ed45f3b9629fd9cd291c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"552baea1610b","org_name":"Monroe Health Care","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Monroe%20Health%20Care-2026-09-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"41e2c6f4594886a564a65d5feb22326b8249b2b7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3bc50a597706","org_name":"Minuteman Press Macon","org_type":"professional_services","ransomware":null,"records_affected":1489,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-minuteman-press-macon"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"39e43d3024febb2ea3a5d06cb37bf6da07e345a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f7fe6edf61f","org_name":"Life Unlimited, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-life-unlimited-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-09-04","discovered_date":"2026-04-07","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"1f6e550c32f97fff7618e4db2afedb9967018cca","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42695.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"90885c8c2d2c","org_name":"LHC Group","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-lhc-group-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005312"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42695.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42695.pdf"}],"summary":"A threat actor used stolen credentials to access patient documents on a third-party vendor’s platform.","supporting_quote":"LHC’s investigation determined that a threat actor stole credentials to access a large volume of files from the vendor’s platform that contained patient Protected Health Information (“PHI”).","technology_involved":["referral management platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6539fc11575ac6e0d2cf368fdfb69583dcafdb4f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"49108eb13e71","org_name":"Green Mountain Power","org_type":"other","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Green%20Mountain%20Power-2026-09-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-09-04","discovered_date":"2026-08-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf2a85258567ee6a711a9f97b2170805df7f0d64","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elixir%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"97e679812639","org_name":"Elixir Medical Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629325"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elixir%20-%20California%20Notification.pdf"}],"summary":"Elixir Medical Corporation reported that an unauthorized party accessed its computer network and that potentially at-risk files contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"23e30e8f2603616c5f93a97a5d72ec7cd5e50ac8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ceebd4bea1bf","org_name":"COMHAR, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-comhar-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2026-09-04","discovered_date":"2026-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f108c4aea54083ab0fd8b2ab49851f43c771ea","impact_type":"data_theft","incident_date":"2026-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_Q3591_CATALYST_DBM-5969_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"41d667ee8f53","org_name":"Catalyst Brands LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629314"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_Q3591_CATALYST_DBM-5969_L01_SAS_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005314"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Catalyst%20Brands%20LLC-2026-09-04"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Catalyst%20Brands%20LLC-2026-09-04"}],"summary":"Catalyst Brands LLC reported that an unauthorized third party accessed servers managed by a third party and obtained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-04","discovered_date":"2026-01-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"6dbb1f1ea03a2288d5bae9857b42156c13e0892a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Brown%2C%20Jake%20%26%20McDaniel%20PC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0458f17cd2ce","org_name":"Brown, Jake & McDaniel, P.C.","org_type":"professional_services","ransomware":null,"records_affected":43605,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005310"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Brown%2C%20Jake%20%26%20McDaniel%20PC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Brown%2C%20Jake%20%26%20McDaniel%20PC.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Brown%2C%20Jake%20%26%20McDaniel%2C%20P.C.-2026-09-03"}],"summary":"Brown, Jake & McDaniel, P.C. reported that an unauthorized actor accessed its network and potentially downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fd8e27afa4b5a94d1d2468d780ac8d4d788e4e5a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d13b238e08c","org_name":"Brome Bird Care Inc.","org_type":"other","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Brome%20Bird%20Care%20Inc.-2026-09-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-09-04","discovered_date":"2025-10-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"828a847013a3641e9c29a0a41aa8c312c91a176b","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42696.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"d3018eab5385","org_name":"Bimbo Bakeries USA","org_type":"manufacturing","ransomware":null,"records_affected":786,"reviewed":false,"root_cause":"A zero-day vulnerability in Oracle EBS allowed unauthorized parties to access and acquire files stored in the application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42696.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42696.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bimbo%20Bakeries%20USA-2026-09-04"}],"summary":"Unauthorized parties exploited a zero-day vulnerability in Bimbo Bakeries USA’s Oracle EBS and accessed and acquired files containing personal and financial information.","supporting_quote":"Oracle’s eBusiness Suite Application (“Oracle EBS”) had a zero-day vulnerability that allowed unauthorized parties to exploit hundreds of Oracle customers EBS instances and access / exfiltrate data, including Bimbo Bakeries USA’s (“BBU”).","technology_involved":["Oracle EBS"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-04","discovered_date":"2025-12-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a73df9058488475b855f60acb59e86e8a7364aa","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BBU%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"d3018eab5385","org_name":"Bimbo Bakeries USA","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day vulnerability in Oracle E-Business Suite allowed unauthorized parties to acquire stored files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BBU%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005311"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bimbo%20Bakeries%20USA-2026-09-04"}],"summary":"Bimbo Bakeries USA reported that a zero-day vulnerability in Oracle E-Business Suite allowed unauthorized parties to acquire files containing personal information.","supporting_quote":"The investigation determined on December 6, 2025 that the zero-day vulnerability allowed unauthorized parties to acquire files stored in the Oracle’s E-Business Suite application.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6ae247c85d9b614a77d4d42e0cb26d4b5d86cb63","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58be8d804324","org_name":"Beaver County Behavioral Health","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-04-beaver-county-behavioral-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ae12a0d95c644fb219dfc583257a58b10f4beef","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42682.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4c17a79587d9","org_name":"Virta Health","org_type":"healthcare","ransomware":null,"records_affected":134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42682.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42682.pdf"}],"summary":"Virta Health identified unauthorized activity involving a separate data repository, where files containing personal information may have been accessed.","supporting_quote":null,"technology_involved":["data repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-04-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3e6be0d493d954befa6366f34739b05e9f429194","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42680.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5bc2e969dedf","org_name":"The Lighthouse for the Blind, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42680.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42680.pdf"}],"summary":"An unauthorized party accessed a Lighthouse email account, where files containing individuals’ names were present.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2026-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7210440d266cc863811b92f5222af64aaf969f09","impact_type":"unknown","imported_from":null,"incident_date":"2026-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42675.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dac72e3fe1ed","org_name":"Mogren, Glessner & Ahrens, P.S.","org_type":"professional_services","ransomware":true,"records_affected":1379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42675.pdf"},{"fetched_at":null,"title":"Leak-site claim by pear","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TW9ncmVuLCBHbGVzc25lciAmIEFocmVucywgUC5TLkBwZWFy"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42675.pdf"}],"summary":"Mogren, Glessner & Ahrens, P.S. filed a breach notification concerning an incident dated June 9, 2026; the available text does not describe the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"claim_groups":["pear"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1bd9ecc1296681cd4a42e03bda3bc5fe803889e0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Issaqueena%20Pediatric%20Dentistry.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c647b389f108","org_name":"Issaqueena Pediatric Dentristry","org_type":"unknown","ransomware":null,"records_affected":55251,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Issaqueena%20Pediatric%20Dentistry.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-08-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"019c367a0be7741ba89a4092c0355b7f164b3907","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89a80b33e06b","org_name":"FCCI Insurance Group","org_type":"financial","ransomware":null,"records_affected":1370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005300"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e319b216f7a3d19bce0b25fa6b2d2136f71e0ff7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd99fe892706","org_name":"Coryell County, Texas","org_type":"government","ransomware":null,"records_affected":542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005304"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93bd7e4c4b881e8219f1443658eebe71c4cbbb3f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c195cd574132","org_name":"Capital Family Physicians","org_type":"healthcare","ransomware":null,"records_affected":2545,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-03-capital-family-physicians"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f354ec5b87dccf1bd73fbf579aac3b9f86872d84","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c499bcd7bb20","org_name":"Bristol Bay Native Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":368,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005299"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-03","discovered_date":"2025-11-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36f5acfcceff3fc463b82513b4b4bb836b982352","impact_type":"unknown","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0079bffe41a","org_name":"Boston Health Care for the Homeless Program","org_type":"unknown","ransomware":null,"records_affected":201260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Boston%20Health%20Care%20for%20the%20Homeless%20Program-2026-09-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-03","discovered_date":"2026-08-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8c6ff377c314a380c13ad24aa33f273cdbd4e09","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"514693c9fefe","org_name":"Axios Industrial Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":576,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005297"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8666369228527d65cec787984d89e9f6f1bc822c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b6a7cac3d1f","org_name":"Abramson, Brown & Dugan","org_type":"other","ransomware":null,"records_affected":71,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Abramson%2C%20Brown%20%26%20Dugan-2026-09-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c5f1b99a709ac083ee5da8ca669895ed708158f6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0328f38ec040","org_name":"Oculus Pathology","org_type":"healthcare","ransomware":null,"records_affected":20040,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-02-oculus-pathology"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005306"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"FulcrumSec","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3f70597060816cc9bab79541d6678797c7e5b4f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2561c3508613","org_name":"Manchester Airports Group","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Manchester Airports Group","type":"hibp","url":"https://haveibeenpwned.com/Breach/ManchesterAirportsGroup"},{"fetched_at":null,"title":"Leak-site claim by fulcrumsec","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWFuY2hlc3RlciBBaXJwb3J0cyBHcm91cEBmdWxjcnVtc2Vj"}],"summary":"Manchester Airports Group disclosed a data breach involving customer information, which FulcrumSec later claimed and published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"fulcrumsec","claim_groups":["fulcrumsec"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d707ef15a345420723de3cbe42d4f3200f8acaa","impact_type":"unknown","incident_date":"2026-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/KRC%20-%20Sample%20Individual%20Notice%20Letter%20-%209.2.2026_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5d5206f79ed","org_name":"Knowledge Research Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629199"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e30d6e469e522321a482dea3ad4c84767b176312","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HumanEdge%20-%20Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"57c2cff7369a","org_name":"HumanEdge, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629213"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HumanEdge%20-%20Sample%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005303"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#HumanEdge%2C%20Inc.-2026-09-02"}],"summary":"HumanEdge reported that files potentially containing personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-09-02","discovered_date":"2026-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80ed3c534255ec914b9d97164cf281be7a3aa59b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DOB%20California%20-%20Breach%20Notification%20260831.docx_.pdf"},"notes":null,"org_country":"SE","org_id":"5e3a4284760b","org_name":"Fishbrain AB","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629190"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DOB%20California%20-%20Breach%20Notification%20260831.docx_.pdf"}],"summary":"Fishbrain reported unauthorized access to an environment hosting user data, including some users’ login credential information.","supporting_quote":null,"technology_involved":["Fishbrain user-data hosting environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52146708abbd383a226d3aebc9778693ac858887","impact_type":"unknown","incident_date":"2026-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Fiesta_Notice_Letter_40024434v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04f68e8aed54","org_name":"Fiesta Insurance Franchise Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629220"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005307"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"00e1a50caef51cc71a1e1d05f853e54e60c20c63","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6aa8f5d8c597","org_name":"Craneware, Inc.","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-09-02-craneware-inc"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Craneware%2C%20Inc.-2026-09-14"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4daa7b79a7f3309a1199876846eecf4b92e511c8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"762eca7481c7","org_name":"Western Maryland Health Care Corporation","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Western%20Maryland%20Health%20Care%20Corporation%20d/b/a%20Mountain%20Laurel%20Medical%20Center-2026-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fdbfdea663754e0b0e10623b12172ea5bf811314","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af97a98d3dfc","org_name":"Wend America Group LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Wend%20America%20Group%20LLC-2026-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-01","discovered_date":"2026-07-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"01a8b2eee421698a3bfc82ad2b1c37586c6c3bb8","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9efe797b19cc","org_name":"Viking Enterprises, Inc.","org_type":"healthcare","ransomware":null,"records_affected":14324,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005296"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdc42078cf010ae43817b4af6879e5ac66e2e3d2","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"eb7484c6ca01","org_name":"Questel","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Questel","type":"hibp","url":"https://haveibeenpwned.com/Breach/Questel"}],"summary":"Questel was targeted by a ShinyHunters extortion campaign, and the group published data it alleged came from the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-09-01","discovered_date":"2026-08-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"307419515c577f97bf26e569e47ca9ddaf189e6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d65ae331d606","org_name":"P & N Machine Co, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005294"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1c031a3b87c6bfe068a4981aa8d4734d20a8d15f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7626fcad9f06","org_name":"Maryville Academy","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Maryville%20Academy-2026-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-09-01","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"157eac6239680d97e57076aa7f2802873fd02e2b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-28001%20KCH%20Ad%20CM%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"4a9620977355","org_name":"Kaniksu Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-28001%20KCH%20Ad%20CM%20r1prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kaniksu%20Community%20Health-2026-09-15"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kaniksu%20Community%20Health-2026-09-05"}],"summary":"Kaniksu Community Health notified patients that their data may have been accessed or acquired following unauthorized access to Aesto’s platform.","supporting_quote":null,"technology_involved":["Aesto electronic health data management platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aesto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"b2d7f8ec94d5","name":"Aesto"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-09-01","discovered_date":"2026-05-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df0a88b893b2495f74b4392f7432ee797a2637cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b76d916f74ec","org_name":"Duval County, Texas","org_type":"government","ransomware":null,"records_affected":492,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005292"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-09-01","discovered_date":"2026-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f2815ae943e5cb17123d0cdd05418e1721d7d71","impact_type":"data_theft","incident_date":"2026-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DDC%20-%20State%20Regulatory%20Notification%20Letter%20-%20CA%2815254651.2%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a5fb81c08708","org_name":"DeMera DeMera Cameron, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DDC%20-%20State%20Regulatory%20Notification%20Letter%20-%20CA%2815254651.2%29_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#DeMera%20Demera%20Cameron.%20LLP-2026-09-01"}],"summary":"DeMera DeMera Cameron, LLP reported that files may have been downloaded from its network without authorization and personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-09-01","discovered_date":"2026-07-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4138389462ae5795e7c2f4841f85b8db92a257a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b88435d47a3f","org_name":"Arena Americas","org_type":"other","ransomware":null,"records_affected":1899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005290"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-31","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ba64961e3a3e44c1a713e9fe791bdc66618beac","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Virta_Adult_SSN_Letter_Revised.pdf"},"notes":null,"org_country":"US","org_id":"4c17a79587d9","org_name":"Virta Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629093"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Virta_Adult_SSN_Letter_Revised.pdf"}],"summary":"Virta Health reported that files in a data repository were potentially accessed and personal information may have been exposed.","supporting_quote":null,"technology_involved":["data repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c86313d21781fda199ef48f564a2eb9a56949195","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a05aca45800","org_name":"The Foot and Ankle Wellness Center of Western Pennsylvania","org_type":"healthcare","ransomware":null,"records_affected":653,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-31-the-foot-and-ankle-wellness-center-of-western-pennsylvania"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2026-08-31","discovered_date":"2026-08-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"beae49e5ee60c8f938c088c9fd51a75740cae441","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'thegentlemen' not in source; cleared","org_country":"US","org_id":"f6b5091d5486","org_name":"Nutex Health Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm"},{"fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TnV0ZXggSGVhbHRoQHRoZWdlbnRsZW1lbg"}],"summary":"Nutex Health reported that an unauthorized third party accessed and exfiltrated information maintained on its servers, including patient, employee, provider, business and financial information.","supporting_quote":null,"technology_involved":["servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["thegentlemen"],"price":{"ticker":"NUTX","base_day":"2026-08-31","returns":{"1":{"day":"2026-09-01","raw":-0.0075,"adj":-0.0007},"5":{"day":"2026-09-08","raw":0.0101,"adj":0.0115},"21":{"day":"2026-09-30","raw":0.1213,"adj":0.1271}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a21ab15117898abca4c8e56c6e92ce0e64cc10dc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"750ae6e35b5e","org_name":"Missouri Military Academy","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Missouri%20Military%20Academy-2026-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3334b1d37c33dcd0df2abb2c906fe68bb2efd4df","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57c0b3dfce94","org_name":"Berkeley Research Group, LLC","org_type":"other","ransomware":null,"records_affected":1314,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Berkeley%20Research%20Group%2C%20LLC-2026-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d292627d2c09367c8e7b0375d658899bb003ebce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d77c7a0316a","org_name":"Alvita Care Holdings","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alvita%20Care%20Holdings-2026-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"803b15ebc3fff7b9fa43cacb13f23a804370b72b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d209fb83936f","org_name":"Vista Del Mar Child and Family Services","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-29-vista-del-mar-child-and-family-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"28a9054fe3f07e6bad82863321199ff1d8a97227","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7dd1a3b22691","org_name":"White River Junction VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1408,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-28-white-river-junction-va-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"082dd616ca99ee11949c2e94a37ec59855e3ebe3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b07e12da18c6","org_name":"Shuttle Meadow County Club, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Shuttle%20Meadow%20County%20Club%2C%20Inc.-2026-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a5bf6372de8068804978d57d1f302cf9f45d839","impact_type":"data_theft","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42591.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"98ce0040d742","org_name":"RB American Group LLC","org_type":"unknown","ransomware":null,"records_affected":974,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RB%20American%20Group%20LLC-2026-08-28"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42591.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42591.pdf"}],"summary":"An unknown actor accessed certain servers and accessed or acquired files containing information related to individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-28","discovered_date":"2026-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f8647369ef233d49ee3140cfc4802802b974cdfe","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2026-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'ShinyHunters' not in source; cleared","org_country":"US","org_id":"ccb4baaa1df6","org_name":"McKesson Corporation","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/927653/000092765326000247/mck-20260825.htm"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWNLZXNzb24gQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz"},{"fetched_at":null,"title":"Have I Been Pwned: McKesson","type":"hibp","url":"https://haveibeenpwned.com/Breach/McKesson"}],"summary":"McKesson disclosed that it discovered a cybersecurity incident affecting its information systems on August 25, 2026; ShinyHunters was reported to have claimed the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["shinyhunters"],"price":{"ticker":"MCK","base_day":"2026-08-28","returns":{"1":{"day":"2026-08-31","raw":-0.009,"adj":-0.006},"5":{"day":"2026-09-04","raw":0.0163,"adj":0.0153},"21":{"day":"2026-09-29","raw":-0.032,"adj":-0.0253}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-08-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36578eb4330bbbe43921a0fc8de0ffe4b035d1c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c74622f9d08c","org_name":"Lovejoy Independent School District","org_type":"education","ransomware":null,"records_affected":2666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005286"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-07-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"080a480cf83d22d336d111647e9b9457120dd259","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"465d45e2ece6","org_name":"Iroquois Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":108151,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005283"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005369"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Iroquois%20Memorial%20Hospital-2026-08-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-08-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c99e5fe2e6c0f68c191ecb908e0d6aac9c85307","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78f53b9e44c8","org_name":"Integrated Specialty Coverages, LLC (“ISC)","org_type":"financial","ransomware":null,"records_affected":12844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005287"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integrated%20Specialty%20Coverages%2C%20LLC%20%28%E2%80%9CISC%E2%80%9D%29-2026-08-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-08-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"000f1658e49c58404444f5746ae5ba84affcc6f9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f81d29ca643f","org_name":"Healthfirst Bluegrass, Inc.","org_type":"healthcare","ransomware":null,"records_affected":139834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005285"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Healthfirst%20Bluegrass%2C%20Inc.-2026-08-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e843151535b647e4c867220fe878a62f88a2ca3f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c211b856eec5","org_name":"Diana Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Diana%20Health%2C%20Inc.-2026-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-28","discovered_date":"2026-02-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aee8d73aecad5b36c97c39ab58dab90d73aeb2ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62c18e977c72","org_name":"Central National Gottesman Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":9126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005288"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Central%20National%20Gottesman%C2%A0Inc.-2026-08-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b1216fa46d7d4262177d922f86a455b3240846b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Bennett%20College%20-%20Exhibit%20A%20%28Adult%2012%20months%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e1ef0554e3b","org_name":"Bennett College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628990"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005293"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1be7a4f0c3c9f98444a3a16c78152f604ba33c4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"112d1f501ebe","org_name":"Psychiatry of Texas PLLC","org_type":"healthcare","ransomware":null,"records_affected":5902,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-27-psychiatry-of-texas-pllc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005291"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"33ee3330852d34efde5bb1cf3fbe4b3c33003eae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e35e62e0627d","org_name":"Kim Knobbe","org_type":"professional_services","ransomware":null,"records_affected":11927,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-27-kim-knobbe"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18fc3806f4a2ce809cdc3d9edbdab6d05d9d55d8","impact_type":"data_theft","incident_date":"2026-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISC-Template%20Notification%20Letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"9240a50cbd7f","org_name":"Integrated Specialty Coverages","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628921"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISC-Template%20Notification%20Letter.pdf"}],"summary":"An unauthorized party accessed an ISC workspace on a third-party cloud platform and downloaded files containing personal information.","supporting_quote":null,"technology_involved":["third-party cloud document execution and management platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96f52cbb4471e7bc37050bb17521329bf4383e2b","impact_type":"data_theft","incident_date":"2026-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42570.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9e9df785ba67","org_name":"Greystar Real Estate Partners","org_type":"professional_services","ransomware":null,"records_affected":905,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42570.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42570.pdf"}],"summary":"An unauthorized third party accessed an employee email account and acquired files containing personal information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"704db46452ddb9a626c02ead80b6c1aa469aac5b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6991f1da8257","org_name":"AnMed Health","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-27-anmed-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"31e490910b05174509454a97c206fd471f008013","impact_type":"data_theft","imported_from":null,"incident_date":"2026-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42560.pdf"},"notes":"records_affected not found in source; cleared","org_country":"GB","org_id":"ef47036907c3","org_name":"News Corp UK & Ireland Limited","org_type":"other","ransomware":null,"records_affected":3304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42560.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42560.pdf"}],"summary":"An unauthorized third party accessed part of News Corp UK & Ireland Limited’s IT network and took customer records from a business application.","supporting_quote":null,"technology_involved":["business application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aafe788ead01d6ed3427507f513624abd470ab2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42565.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e00d777271fe","org_name":"Murfreesboro Medical Clinic  (Aesto, LLC","org_type":"unknown","ransomware":null,"records_affected":845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42565.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e121006dcb7d982840abbfca64a83aeebc21da4","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Full%20Exhibit%20Packet%20-%20FINAL_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a047e0634487","org_name":"Murfreesboro Medical Clinic","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628900"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Murfreesboro%20Medical%20Clinic-2026-08-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f5a23f863cc58c4b9e88d0e0ee68383ba4dfde0e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d11d7e03da34","org_name":"McDermott Will & Schulte LLP","org_type":"professional_services","ransomware":null,"records_affected":5427,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-26-mcdermott-will-schulte-llp"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#McDermott%20Will%20%26%20Schulte%20LLP-2026-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e3404fea02d9cc46159392ac22cdf28c6c75b8aa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b2eb99da5f3","org_name":"Castle Management, LLC","org_type":"other","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Castle%20Management%2C%20LLC-2026-08-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fec37f674e1f03e4f14a197b4f2ceeb5197f1656","impact_type":"data_theft","incident_date":"2026-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42548.pdf"},"notes":null,"org_country":"US","org_id":"05c3752d7b7b","org_name":"Cascade Coffee, LLC","org_type":"other","ransomware":true,"records_affected":610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42548.pdf"},{"fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FzY2FkZSBDb2ZmZWVAYWtpcmE"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42548.pdf"}],"summary":"Cascade Coffee reported that files and folders containing employee information may have been accessed or downloaded without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"claim_groups":["akira"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-26","discovered_date":"2026-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"df35b6417fc531c4d4e0bcdc3214554e507ae2b3","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2026-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"b199f9dbb066","org_name":"Boston Scientific","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/885725/000088572526000056/bsx-20260826.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm"}],"summary":"Boston Scientific reported a cybersecurity incident identified on August 25, 2026, that disrupted access to some information systems and business applications and affected operations, including order processing and shipping.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"BSX","base_day":"2026-08-26","returns":{"1":{"day":"2026-08-27","raw":-0.0311,"adj":-0.0377},"5":{"day":"2026-09-02","raw":0.0042,"adj":0.0054},"21":{"day":"2026-09-25","raw":-0.0882,"adj":-0.0951}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-26","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"15bb661eab967696cbca45c889562c120cacb885","impact_type":"data_theft","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Bell%20American%20Group%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4c12af880b33","org_name":"Bell American Group LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":12810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Bell%20American%20Group%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Bell%20American%20Group%20LLC.pdf"}],"summary":"Bell American Group LLC reported that an unknown actor accessed servers and certain files between April 8 and April 9, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"785e8b1d6e4fde38fd57bde3f3712431613bce8c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29c50ecfc9aa","org_name":"Alan Gordon, CPA","org_type":"financial","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alan%20Gordon%2C%20CPA-2026-08-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e4cfd61a3ee2f5a0ea52e032bb2ea1e05e3fb998","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7dd6119d90ec","org_name":"WellDyneRX, LLC","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-25-welldynerx-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df2cfb038f5e0f1a474b96259f9310eef1ee20b1","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/USBFS4564-TWH-CE-Letter-Aesto-Adult-SSN_v2_Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f27d469f2d00","org_name":"Together Women's Health LLC - Aesto","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628856"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005282"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f768053fab65ac15f06e9d03866c44b89ce9820e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d1556ff6911","org_name":"Shoshone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-25-shoshone-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-25","discovered_date":"2026-05-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ced864d8b579dea668bff57103566c4ca30f9a1c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ee09ebfb25a","org_name":"Rhodes, Young, Black, and Duncan","org_type":"financial","ransomware":null,"records_affected":3650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005279"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ae69bc71f5e34cbce83bf5567ad4c29de8e634d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c17a85ca8468","org_name":"Orthopedics & Sports Medicine Owensboro, P.S.C.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Orthopedics%20%26%20Sports%20Medicine%20Owensboro%2C%20P.S.C.%20d/b/a%20Advanced%20Center%20for%20Orthopedics%20%26%20Sports%20Medicine-2026-08-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3f52773cffe7dfb8e6f487b17022ed6a74495999","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"92a6b3b3f1d1","org_name":"Ocean Edge Resort and Golf Club","org_type":"other","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ocean%20Edge%20Resort%20and%20Golf%20Club-2026-08-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9e972c023a01bf3e482e477ce6149a3e067349d6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b27e5b9ddaae","org_name":"Museum Associates","org_type":"nonprofit","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Museum%20Associates%20d/b/a%20Los%20Angeles%20Museum%20of%20Art%20%28LACMA%29-2026-08-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8958993f89560df362427b4f429b919ce816f3d","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Livara%20Health%20Medical%20Group%20dba%20SpineZone%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2b500c8d5e67","org_name":"Livara Health Medical Group - dba SpineZone","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628844"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b637e2bc66226d44511b6c6df8c2f43354ca3ed7","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"79fb0e1385b9","org_name":"Carhartt","org_type":"retail_ecommerce","ransomware":true,"records_affected":12933413,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Carhartt","type":"hibp","url":"https://haveibeenpwned.com/Breach/Carhartt"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FyaGFydHQsIEluYy5Ac2hpbnlodW50ZXJz"}],"summary":"ShinyHunters targeted Carhartt in a pay-or-leak extortion campaign and published data allegedly obtained from the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-25","discovered_date":"2026-07-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"791a5ebfb94296ea888beecc30e943b6abeedde2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c6680d80489","org_name":"Allied Health MSO Holdco, LLC","org_type":"healthcare","ransomware":null,"records_affected":447304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005281"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"thegentlemen","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e1078c9b78757f6aa3bd8bd666b58588492d14dd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c47865a78932","org_name":"Advantage Home Health Care","org_type":"healthcare","ransomware":true,"records_affected":19851,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-25-advantage-home-health-care"},{"fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWR2YW50YWdlIEhvbWUgSGVhbHRoIENhcmVAdGhlZ2VudGxlbWVu"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thegentlemen","claim_groups":["thegentlemen"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c04717a773bde7427619865fb620a129b34162b1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5664f8a75bcb","org_name":"University Surgical Associates, PLLC","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#University%20Surgical%20Associates%2C%20PLLC-2026-08-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2fa4ecc8a254103e82c085a6b97608200be03021","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d6d97c3d8c2","org_name":"Punch & Associates Investment Management, Inc.","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Punch%20%26%20Associates%20Investment%20Management%2C%20Inc.-2026-08-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-24","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68090edbcaf878f6f69a0f77dbc7a7239d1acf92","impact_type":"data_theft","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pan%20American%20Group%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"97740f58ead4","org_name":"Pan American Group LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628794"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pan%20American%20Group%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42509.pdf"}],"summary":"Pan American Group LLC reported that an unknown actor accessed certain servers and accessed or acquired files containing information related to affected individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-24","discovered_date":"2025-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3373854de91ca7931c765bd0e87485d36f1011e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/August%202026%20LACMA%20Notice%20-%20CM%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"bcb64700b3d1","org_name":"Los Angeles County Museum of Art","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628808"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/August%202026%20LACMA%20Notice%20-%20CM%20Redacted.pdf"}],"summary":"The Los Angeles County Museum of Art reported unauthorized access to files containing some individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd92dae7c439a5819a6481bcca1858a52acb7450","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Allied%20Health%20-%20Aesto%20Consumer%20Notice%20Letter%20Template_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f05f635bd24c","org_name":"Allied Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628809"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d8035781ad01c1e50d83de5d7d63961cb804460","impact_type":"data_theft","imported_from":null,"incident_date":"2025-07-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"DE","org_id":"ed8df917aacc","org_name":"NIUS","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NIUS","type":"hibp","url":"https://haveibeenpwned.com/Breach/NIUS"}],"summary":"NIUS suffered a data breach in July 2025, and the exposed data was subsequently leaked publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"137263f91fed30b51d26b0c5bf635ce444f61208","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c1d4fe3a05e","org_name":"Grafton City Hospital, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-22-grafton-city-hospital-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a608a5d35eab6d2626480e509a2af926be6e38b","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4201d42832a3","org_name":"Golf Canada","org_type":"unknown","ransomware":null,"records_affected":568972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Golf Canada","type":"hibp","url":"https://haveibeenpwned.com/Breach/GolfCanada"}],"summary":"User records allegedly sourced from Golf Canada circulated via Telegram, including email addresses and other personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-21","discovered_date":"2026-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"502ba62973afdc84bae659d467931f7a08478867","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a969da6b455b","org_name":"Williams Brothers Construction Co., Inc.","org_type":"other","ransomware":null,"records_affected":21913,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005269"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-21","discovered_date":"2025-05-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f25e94a1486ada4ddcbf9ae074ee925397e018a8","impact_type":"data_theft","imported_from":null,"incident_date":"2025-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20The%20Health%20Trust%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ef4ff11e1412","org_name":"The Health Trust","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628727"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20The%20Health%20Trust%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Health%20Trust-2026-08-26"}],"summary":"The Health Trust reported that an unknown actor accessed and copied information from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9b61924827277b7352522c95bf18d884ca60b108","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0943ad05648","org_name":"Southfield Rehabilitation Company LLC","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Southfield%20Rehabilitation%20Company%20LLC%20d/b/a%20Surgeons%20Choice%20Medical%20Center-2026-08-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"085134cf85c13db8a6703603a2a7759169e5195c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c45b30376b34","org_name":"Premier Medical Group of the Hudson Valley P.C.","org_type":"healthcare","ransomware":null,"records_affected":282075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-premier-medical-group-of-the-hudson-valley-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4a7934a70899fec272d2f24e90b735a707b4d31","impact_type":"unknown","incident_date":"2025-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/POLAM_-_Redacted_Letter_39912355v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ef4a18fa048d","org_name":"POLAM Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628736"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"141d81cdad8bbdc4bea1b3cc8db49fb7c2bb7622","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbde6dcb8911","org_name":"North Dakota Department of Health and Human Services, Developmental Disabilities Section","org_type":"healthcare","ransomware":null,"records_affected":1750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-north-dakota-department-of-health-and-human-services-developmental-disabilities-"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"773224a07b5afc8739dfdffad818505b21d17731","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"36c50804eb4d","org_name":"LawnStarter, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#LawnStarter%2C%20Inc.-2026-08-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":"2026-06-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d47806c73ab46c015fa4ea2aa57e4d3476bd61ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/drop42_Audits_Genesis-PWC_Letter_final_12%20months_revd1%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"7cf1bdd2822b","org_name":"Kern Psychiatric Health and Wellness Center, Inc","org_type":"healthcare","ransomware":null,"records_affected":51352,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-kern-psychiatric-health-and-wellness-center-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628704"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/drop42_Audits_Genesis-PWC_Letter_final_12%20months_revd1%20%28Redacted%29.pdf"}],"summary":"Kern Psychiatric Health and Wellness Center reported that files containing its data on its management company's network were accessed without authorization.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-21","discovered_date":"2026-07-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1b9925604de7b3fd8e6ca111d6ba359746ddeca4","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cf77b8fdf87","org_name":"HUT American Group LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":135007,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005275"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#HUT%20American%20Group%20LLC-2026-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6fc3f071de91c4e0d8d8dd13ba72392345ca7ee8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7094fe6b8997","org_name":"Hawaii Dental Group, Inc DBA Hawaii Family Dental","org_type":"healthcare","ransomware":null,"records_affected":45853,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-hawaii-dental-group-inc-dba-hawaii-family-dental"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-21","discovered_date":"2026-07-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb25971b7618beca5a04820f17bba6d464407651","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df8e26ae56ba","org_name":"Community First Health Plans, Inc.","org_type":"financial","ransomware":null,"records_affected":7133,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005273"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"943deeb88b93fba843c0d02b186044e7990254d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b9c47663903","org_name":"Carolina Internal Medicine","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Carolina%20Internal%20Medicine-2026-08-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-21","discovered_date":"2026-07-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c77986fe96994183550fcdf33cb40449ab5fba52","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"73ac1f6fbf01","org_name":"Cantex, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3069,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005270"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"badfa73c6d092b9051de2537a4f816684aa6303f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b02922ccbffb","org_name":"Baraga County Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-baraga-county-memorial-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-21","discovered_date":"2026-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2671e82cd74ae7d9ec6e880ba7c521c1911b9fa9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ASOS%20US%20Sales%20LLC%20-%20CA-US%20notification.pdf"},"notes":null,"org_country":"US","org_id":"502636dbf440","org_name":"ASOS US Sales LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The account was accessed using login credentials obtained from a source outside ASOS.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ASOS%20US%20Sales%20LLC%20-%20CA-US%20notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005278"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42451.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ASOS%20US%20Sales%20LLC-2026-08-21"}],"summary":"ASOS US Sales LLC reported unauthorized access to customer accounts using credentials obtained outside ASOS, potentially exposing associated personal and payment information.","supporting_quote":"On Wednesday, July 29, 2026, we confirmed that an unauthorized third party may have gained access to your account using login credentials obtained from a source outside ASOS.","technology_involved":["ASOS account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"ExfilSquad","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-21","discovered_date":"2026-07-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76bdedc1d9925b7a099d5a094c8f8d2da4d8ad2c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7f0f39a6dff5","org_name":"Allstate","org_type":"financial","ransomware":true,"records_affected":2604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005276"},{"date":"2026-07-26","fetched_at":null,"title":"Leak-site claim by ExfilSquad","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWxsc3RhdGVARXhmaWxTcXVhZA"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"exfilsquad","claim_groups":["exfilsquad"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"71cb52536ee624ca720efcbd23dffc7a5b71ab7e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0bc2049358e5","org_name":"Allergic Disease Associates, P.C. dba The Asthma Center","org_type":"healthcare","ransomware":null,"records_affected":5321,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-21-allergic-disease-associates-p-c-dba-the-asthma-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1c07b6b9aee110310058b4e8c709049515e036e2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba38d6d9bc6c","org_name":"Valley Perinatal Services LLC","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Valley%20Perinatal%20Services%20LLC%20d/b/a%20Advanced%20Women%27s%20Care-2026-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cc1f7cbdb2ed872617149d7406b54b5a0a3e2ca","impact_type":"unknown","incident_date":"2025-09-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SIU_-_Redacted_Letter_39895066v1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"794135e34902","org_name":"Southern Illinois University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628638"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005277"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42450.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Southern%20Illinois%20University-2026-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-20","discovered_date":"2026-02-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3319583721ec57b0e57eec2b6cb53a7a6b7a0eab","impact_type":"data_theft","incident_date":"2026-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42441.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"21125f7a2431","org_name":"Rockwood Retirement Communities","org_type":"healthcare","ransomware":null,"records_affected":7136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42441.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42441.pdf"}],"summary":"Rockwood Retirement Communities reported that files associated with employees and residents may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59fb90e72d86d6ea48afb7a5171878c4bfc59f14","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Inyo%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b4073d591d8","org_name":"Northern Inyo Healthcare District d/b/a Northern Inyo Hospital","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628598"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd1adcbdd8bbb045074d385f83832d6293e144f8","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Nebraska%20Orthopaedic%20-%20Notice%20of%20Data%20Event%20-%20California_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e28fa06ed6a9","org_name":"Nebraska Orthopaedic Center, P.C.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628538"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9979e965bc773c8d83998be3d026fab84771060b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db9f392abc04","org_name":"Monmouth University","org_type":"education","ransomware":null,"records_affected":299,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Monmouth%20University-2026-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d3f210e043e1d07c808f3554c3441ec4627e5fc8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea401cd568bd","org_name":"Life Bridges, Inc.","org_type":"healthcare","ransomware":null,"records_affected":5194,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-20-life-bridges-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-20","discovered_date":"2026-08-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ddc5684a1977c1311353aa7848ff1bc50240190","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-06","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01%20Template_CA.pdf"},"notes":null,"org_country":"US","org_id":"b0d878b2d434","org_name":"Apollo Management Holdings, L.P.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628551"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01%20Template_CA.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Apollo%20Management%20Holdings%2C%20L.P.-2026-08-21"}],"summary":"Apollo reported a social engineering incident involving unauthorized access to certain cloud platforms and potential exposure of personal information.","supporting_quote":"Similar to other financial services firms, Apollo recently experienced a social engineering incident.","technology_involved":["cloud platforms"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d7238e65a8b0269e2889856759ceb289d64ca8a2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99aac19c7ebc","org_name":"United Language Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":4649,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-19-united-language-group-llc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005271"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-19","discovered_date":"2026-07-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b664834a120e5f2632073a20d3be5443446a349","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSMC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6562ac6d40db","org_name":"Silver Summit Medical Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSMC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Silver Summit Medical Corporation reported that personal or protected health information in a third-party vendor’s systems was acquired without authorization.","supporting_quote":"Certain data from the vendor’s systems was acquired without authorization between November 27, 2025 and November 30, 2025.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"xpl0itrs","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58a33ff2e61f46a9d51e10b9f00e579524ba4f6e","impact_type":"data_theft","imported_from":null,"incident_date":"2026-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"0b8eccc229de","org_name":"Oz Hair and Beauty","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Oz Hair and Beauty","type":"hibp","url":"https://haveibeenpwned.com/Breach/OzHairAndBeauty"}],"summary":"Oz Hair and Beauty was targeted in an extortion attack, and the group published data allegedly obtained from the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"xpl0itrs"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8016771e5951a352b4fce575e450db2eb85f18bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42412.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ed6c69bc389","org_name":"Nebraska Orthopaedic Center (Aesto, LLC)","org_type":"unknown","ransomware":null,"records_affected":992,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42412.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-19","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"927c71f42608f3ab923c5166f6a988a8b4149887","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98b2b84be692","org_name":"Nebraska Orthopaedic Center","org_type":"unknown","ransomware":null,"records_affected":234239,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nebraska%20Orthopaedic%20Center-2026-08-19"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Nebraska%20Orthopaedic%20Center-2026-08-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68d09f2a3527718680a9c45a5fabc2edd5ef1549","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ded21a81754e","org_name":"Fanlore","org_type":"nonprofit","ransomware":null,"records_affected":144520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fanlore","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fanlore"}],"summary":"Unauthorized access to the Fanlore wiki exposed email addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":["Fanlore wiki"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-18","discovered_date":"2026-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0ba07aae5306f5f07d7e327dd65444fa6aba8f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Turner%20Construction%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"48b43f59c24d","org_name":"Turner Construction Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628438"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Turner%20Construction%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005266"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Turner%20Construction%20Company-2026-08-18"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Turner%20Construction%20Company-2026-08-18"}],"summary":"Turner Construction Company reported unauthorized access to certain systems, and confirmed that files containing personal information had been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-18","discovered_date":"2026-06-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02cb4801731e70e52af3e82776da7c0bc7216d3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a39066648e67","org_name":"Texas Department of Criminal Justice","org_type":"government","ransomware":null,"records_affected":1501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005260"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7cd563a601c987c50cbb5244097d657f6951258b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5621ec8622a7","org_name":"Southwestern Vermont Council on Aging","org_type":"healthcare","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Southwestern%20Vermont%20Council%20on%20Aging-2026-08-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-18","discovered_date":"2026-08-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ff85857e7aabbad8a1f73bef7d8490ca79f1f7d9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9fb5c0d6729a","org_name":"Jasper Newton Electric Cooperative","org_type":"retail_ecommerce","ransomware":null,"records_affected":261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005259"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-18","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07069837670519c0e36f7ba20dced1afa9af4516","impact_type":"data_theft","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Apple%20American%20Group%20LLC%20and%20Apple%20American%20Group%20II%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ff5ea3c47902","org_name":"Apple American Group LLC and Apple American Group II, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Apple%20American%20Group%20LLC%20and%20Apple%20American%20Group%20II%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Apple%20American%20Group%20LLC%20and%20Apple%20American%20Group%20II%2C%20LLC-2026-08-18"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Apple%20American%20Group%20LLC%20and%20Apple%20American%20Group%20II%2C%20LLC-2026-08-18"}],"summary":"An unknown actor accessed certain servers and accessed or acquired files containing information related to individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9c5d54f5b7ae4ae7dd0a0880e7642464b4b3d3b0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a74abe6ae377","org_name":"Advanced Power Services (NA) LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Advanced%20Power%20Services%20%28NA%29%20LLC-2026-08-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-17","discovered_date":"2025-08-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db513beb69c3ee4cccdfb4c8309215f1bb2986dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_Notice_Letter_MUHSD_Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f3043b0010f0","org_name":"Merced Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628399"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_Notice_Letter_MUHSD_Final_Redacted.pdf"}],"summary":"Merced Union High School District identified unauthorized network activity, and files containing personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c887a2a4506f0d0daa75d78935033cbc5687d38","impact_type":"unknown","incident_date":"2026-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Langwasser_Company_CPAs_-_Notice_Letter_39860744v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8760d822e24d","org_name":"Langwasser & Company CPAs","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628389"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5a849d9eb803e1d1f0dc551e19e5af2e84b21f71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bdadd96db64f","org_name":"Hillcrest Medical Research LLC.","org_type":"healthcare","ransomware":null,"records_affected":5785,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-17-hillcrest-medical-research-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8faec8ec52be3eae495e5835ded2dd673f50724e","impact_type":"data_theft","imported_from":null,"incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Forrestall%20CPAs%20-%20CA%20Notification%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"b9a567107c02","org_name":"Forrestall CPAs LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Forrestall%20CPAs%20-%20CA%20Notification%20Letter%20Sample.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005272"}],"summary":"Forrestall CPAs LLC reported that an unauthorized individual viewed and obtained files on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-17","discovered_date":"2026-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6cd9058ff8f66e64a8f5604a5e1bfcd8a5a4855","impact_type":"data_theft","imported_from":null,"incident_date":"2026-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amgen%20Consumer%20Notification%20Letters%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"222e313ddb83","org_name":"Amgen Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amgen%20Consumer%20Notification%20Letters%20%282%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005264"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Amgen%20Inc.-2026-08-17"}],"summary":"Amgen reported that an unauthorized third party accessed systems and cloud-stored data and acquired files containing patient personal and health information.","supporting_quote":null,"technology_involved":["cloud environments"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"65f794338ba11f2a3649cd544210fa62b16ed48b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a49bd24580cd","org_name":"PSI Premier Specialties, Inc. d/b/a Medical Express PSI","org_type":"healthcare","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-16-psi-premier-specialties-inc-d-b-a-medical-express-psi"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e87ac6d2cff336837155c75dc6c099487db06e30","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1b490b91d1a","org_name":"Well Child, Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-well-child-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-06-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"af1d24a16aa490355094e96a7f96ae926a689f7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71c4ae405cf3","org_name":"The Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005243"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-04-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"62183e559ac9556ae7ffa97774361717b4832b19","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3e3f61c6f5e","org_name":"The Law Office of Douglas D. Ketterman, P.L.L.C.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005249"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1f2d22ec6c77c15ff7616ce300cae3fd8cf382bd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6360da0311bd","org_name":"Tange, Mann & Garza, P.C.","org_type":"financial","ransomware":null,"records_affected":1737,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005247"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"adc8a8474e74481c3dcb2f196248add2f7b30d53","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e489342ae79","org_name":"Sunwest Bank","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sunwest%20Bank-2026-08-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2b05759d9a67a26f7c45a106bc5b72b715a4d6dc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1508180728a2","org_name":"Premier Specialties, Inc.","org_type":"healthcare","ransomware":null,"records_affected":267,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Premier%20Specialties%2C%20Inc.%2C%20d/b/a%20Medical%20Express%20PSI-2026-08-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"944f4db8f211c3346d7b85e7713c2c978376d517","impact_type":"data_theft","incident_date":"2026-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Preferred%20Parking%20Service%2C%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c981017f04c5","org_name":"Preferred Parking Service, LLC","org_type":"other","ransomware":null,"records_affected":5176,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Preferred%20Parking%20Service%2C%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Preferred%20Parking%20Service%2C%20LLC.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Preferred%20Parking%20Service%2C%20LLC-2026-08-14"}],"summary":"Preferred Parking Service, LLC reported that an unauthorized actor accessed its database on June 7 and 8, 2026, and took files containing names and credit card numbers.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65eb9d1dd5ba6cfdff34c8ab433acf013e13a4a2","impact_type":"data_theft","incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Paylogix%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"38ac3a7ed9b3","org_name":"Paylogix, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628329"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Paylogix%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Paylogix%2C%20LLC-2026-08-14"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Paylogix%2C%20LLC-2026-08-14"}],"summary":"Paylogix reported a November 2025 cyber incident in which files on its network may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-14","discovered_date":"2025-12-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cce85d8068c824b78d544d0bf07ebf2a84a54e4f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c4593a2885f","org_name":"North Florida Women's Care","org_type":"healthcare","ransomware":null,"records_affected":253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005255"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ef2ec3951c82cddbadbebcdaa8925fcb6825e96f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b39161475238","org_name":"Mountain Rheumatology Professional, LLC","org_type":"healthcare","ransomware":null,"records_affected":5378,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-mountain-rheumatology-professional-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"780256049cb7cbaf7a80dc91a3a1108dd4eee53d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"888b7ac7bb55","org_name":"Lone Star Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":257102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005251"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"070ac7e05e29a4f7e1594cd19d1b1ebab9faeb38","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-26","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lennar%20Mortgage%20-%20California%20-%20Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"5fb956cf167c","org_name":"Lennar Mortgage, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized party used social engineering tactics to access some of the organization's systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628320"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lennar%20Mortgage%20-%20California%20-%20Sample%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005257"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lennar%20Mortgage%2C%20LLC-2026-08-14"}],"summary":"Lennar Mortgage determined that an unauthorized party used social engineering to access some of its systems, potentially affecting sensitive personal information.","supporting_quote":"We then determined that an unauthorized party used sophisticated social engineering tactics to access some of our systems between May 26, 2026 and June 1, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e5fb7243a58752b90c73eaae25287b7f5bf654a1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9fb3f572cd9","org_name":"Integrative Emergency Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":2009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-integrative-emergency-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-14","discovered_date":"2026-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"311c00885eaa20c06467a8308fff28ddc3f46807","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Heights%20Finance%20Holdings%20Company.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9723593fde31","org_name":"Heights Finance Holdings Co.","org_type":"financial","ransomware":null,"records_affected":4132834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005250"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Heights%20Finance%20Holdings%20Company.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Heights%20Finance%20Holdings%20Company.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Heights%20Finance%20Holdings%20Co-2026-08-11"}],"summary":"An unauthorized actor accessed a third-party-hosted cloud platform used by Heights Finance to store customer data, which may have been viewed or copied.","supporting_quote":null,"technology_involved":["cloud-based platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8d0f0404ada0df505c6fbf4230abc858d460ad9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3ab2ed03dfe","org_name":"Gardiner Family Chiropractic, PC","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-gardiner-family-chiropractic-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-14","discovered_date":"2026-06-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2142ef2d6cad984be7c1ca223ac59c98ed38d0bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Baylor%20Genetics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ef4a92058d17","org_name":"Baylor Genetics","org_type":"healthcare","ransomware":null,"records_affected":2810878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-baylor-genetics"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628324"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Baylor%20Genetics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005261"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42352.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Baylor%20Genetics-2026-08-14"}],"summary":"Baylor Genetics reported unauthorized access to portions of its network and stored data between June 11 and June 17, 2026.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-14","discovered_date":"2026-07-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c249bd9d26a5b047c50c9cefcf440a69cfe51a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6914feb8ba79","org_name":"Bahrie Law, PLLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":6765,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005253"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bahrie%20Law%2C%20PLLC-2026-08-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8c32a8bd0f5436a6f70162ea834122a69feeeba4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"331a23be0afc","org_name":"Atrium Centers, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Atrium%20Centers%2C%20Inc.-2026-08-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d90fd520e9f6f0825127b7aec8df0cc9960f1c56","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e7a9a9e9d11","org_name":"Alta Park Capital, LP","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alta%20Park%20Capital%2C%20LP-2026-08-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-14","discovered_date":"2026-06-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"87cc438d6e18c55c2a1bd5296862c09cc54602c4","impact_type":"data_theft","incident_date":"2026-06-05","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AdaptHealth%20-%20Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d0ab6f5d43e2","org_name":"AdaptHealth, LLC","org_type":"healthcare","ransomware":null,"records_affected":4115802,"reviewed":false,"root_cause":"A social engineering attack targeting a company user account enabled access to company systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-14-adapthealth-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628241"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AdaptHealth%20-%20Sample%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005258"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42340.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AdaptHealth%2C%20LLC-2026-08-14"}],"summary":"AdaptHealth reported that a social engineering attack targeting a company user account led to access to company systems and theft of data including patient information.","supporting_quote":"Through this investigation, we learned that the unauthorized third-party gained access to our systems on June 5 through a social engineering attack targeting a single company user account and took with them certain data, including patient information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-13","discovered_date":"2026-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ebc6e227ad5e249816c47b880fa1f6f2dfffee4","impact_type":"data_theft","incident_date":"2025-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dubrow%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1e25a24b90e1","org_name":"Terry J. Dubrow, MD, A Medical Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dubrow%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005256"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Terry%20J.%20Dubrow%2C%20MD%2C%20A%C2%A0Medical%20Corporation-2026-08-13"}],"summary":"An unauthorized actor accessed systems and acquired data, including personal information and medical information in patient charts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0d4326463e6b414b619fc58afc86cc586aa50949","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"52d3ee67c45b","org_name":"TD Bank U.S.","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#TD%20Bank%20U.S.-2026-08-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f49e276f7f836bd64e0a5da430429f845a33c12","impact_type":"data_theft","imported_from":null,"incident_date":"2025-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Corporation%20Service%20Company%20%28CSC%29%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b807809c698b","org_name":"Corporation Service Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628224"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Corporation%20Service%20Company%20%28CSC%29%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005254"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Corporation%20Service%20Company-2026-08-13"}],"summary":"Corporation Service Company reported that an unauthorized actor accessed a third-party hosted database and copied files.","supporting_quote":null,"technology_involved":["third-party hosted database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-13","discovered_date":"2026-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ad45fa3256289518c80fbafa2d0d965cf7058ab","impact_type":"both","incident_date":"2026-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notice%20Letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"46678ce27e1a","org_name":"See’s Candies, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628237"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629221"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005305"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42672.pdf"}],"summary":"See’s Candies reported unauthorized access to portions of its network, during which files were acquired, encrypted, and later made available on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfaaa14b60341e47d1c4275b898ff59e78bbe420","impact_type":"both","imported_from":null,"incident_date":"2026-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d409b685f616","org_name":"RingCentral","org_type":"technology_saas","ransomware":true,"records_affected":1596490,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RingCentral","type":"hibp","url":"https://haveibeenpwned.com/Breach/RingCentral"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmluZ0NlbnRyYWwsIEluYy5Ac2hpbnlodW50ZXJz"}],"summary":"RingCentral said the incident affected a limited portion of its customers, while ShinyHunters claimed to have obtained and published customer data in a pay-or-leak campaign.","supporting_quote":null,"technology_involved":["RingCentral"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-13","discovered_date":"2026-06-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8afe29484460118ca90a9d40f3cd375c969fb283","impact_type":"data_theft","incident_date":"2026-06-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/May%20Trucking%20-%20Regulatory%20Report%20Letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"00b7927229ac","org_name":"May Trucking Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628218"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/May%20Trucking%20-%20Regulatory%20Report%20Letter%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#May%20Trucking%20Company-2026-08-13"}],"summary":"May Trucking Company detected suspicious activity, and its investigation found that files containing some individuals’ personal information were acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"aff87e7bcdfbc3855b0b9054abea89d7c4250aa7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6840bcf85c14","org_name":"BestCare Treatment Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-13-bestcare-treatment-services-inc"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BestCare%20treatment%20Services%2C%20Inc.-2026-09-08"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-12","discovered_date":"2026-06-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e908f37a29d26d49a53626bd826cdde4b046abe","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Universal%20Plant%20Services%20Adult%20CM.pdf"},"notes":null,"org_country":"US","org_id":"6b27ad468177","org_name":"Universal Plant Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628163"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Universal%20Plant%20Services%20Adult%20CM.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005252"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Universal%20Plant%20Services%2C%20LLC-2026-08-12"}],"summary":"Universal Plant Services reported that an unauthorized individual accessed data on its network from June 8 through June 12, 2026, and that the data potentially included personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbcefcb8d2089357772a7056806b9749d6d418ea","impact_type":"data_theft","incident_date":"2026-01-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/07-18-26%20IncidentFollowUpTASSisterhood.pdf"},"notes":null,"org_country":"US","org_id":"adeed2170ecd","org_name":"Temple Adat Shalom Sisterhood","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628187"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/07-18-26%20IncidentFollowUpTASSisterhood.pdf"}],"summary":"A former volunteer accessed and used Temple Adat Shalom Sisterhood tournament registrants’ personal information for advertising campaigns.","supporting_quote":"A former volunteer for the TAS Sisterhood Mah Jongg Tournament accessed and used the information and data, without the knowledge or permission of TAS Sisterhood or Temple Leadership, for personal gain.","technology_involved":["Excel spreadsheets"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"07b84b6a41707c4ac0435339f1ccbb0962a82c84","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"790b2b91a9e6","org_name":"Tapestry 360 Health","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tapestry%20360%20Health-2026-08-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1155c8ed2b7636640343b1c9b101fc7da58ad59a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4090507cdae5","org_name":"Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT","org_type":"healthcare","ransomware":null,"records_affected":99714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-12-oakdale-ear-nose-throat-pa-d-b-a-minnesota-ent"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"041690630ca2a11c7b8dade6180fe46451bb1346","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d7b52b975de1","org_name":"Nipro Medical Corporation","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Nipro%20Medical%20Corporation-2026-08-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2fa3866df677863770a05aed8d2479daf82b88f9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af03881a097b","org_name":"LC Industries, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#LC%20Industries%2C%20Inc.-2026-08-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"89cff466b7b2412ce839a5a1b1349ddc2739aa53","impact_type":"data_theft","incident_date":"2026-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Buist%20Byars%20%26%20Taylor%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"df75affb4c88","org_name":"Buist Byars & Taylor LLC","org_type":"professional_services","ransomware":null,"records_affected":1669,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Buist%20Byars%20%26%20Taylor%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Buist%20Byars%20%26%20Taylor%20LLC.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Buist%20Byars%20%26%20Taylor%20LLC-2026-08-11"}],"summary":"Buist Byars & Taylor LLC reported that files containing personal information were accessed or copied without authorization between February 9 and February 13, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"77819e5c0b0a186b93a03a31a780d98cfe545197","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b81db8c6cf7","org_name":"Shenandoah Valley Medical System, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Shenandoah%20Valley%20Medical%20System%2C%20Inc.-2026-08-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6250591ae1224d6bd6a2707cb8b66d0ea1d07ba7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f54abac61a43","org_name":"Plaxen Adler Muncy, P.A.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Plaxen%20Adler%20Muncy%2C%20P.A.-2026-08-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"228d5c495f39557dacd2da2060b5a3c35d7bcdd6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9d4b1c8a7786","org_name":"Longview ER Operations, LLC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-11-longview-er-operations-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-11","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3cbcd614304745ee365a0364bcab961adc9f1ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-24","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lennar%20Corporation%20-%20Template%20Notification%20Letter%20-%20California.pdf"},"notes":null,"org_country":"US","org_id":"fbfa662fee18","org_name":"Lennar Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628121"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lennar%20Corporation%20-%20Template%20Notification%20Letter%20-%20California.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005246"}],"summary":"Lennar Corporation said an unauthorized party used social engineering to access some of its systems, and sensitive personal information may have been affected.","supporting_quote":"We then determined that an unauthorized party used sophisticated social engineering tactics to access some of our systems between March 24, 2026, and March 30, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"13bcfb4866bbc81ac1dd10cbddc74660842050e3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"befca25eb06f","org_name":"Community Health Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-11-community-health-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2026-08-11","discovered_date":"2026-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"518a628bb40e8790faa41059f74f251ab86c88cd","impact_type":"data_theft","incident_date":"2026-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42288.pdf"},"notes":null,"org_country":"US","org_id":"49ebe8238937","org_name":"Chelan County","org_type":"government","ransomware":null,"records_affected":500001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42288.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42288.pdf"}],"summary":"Chelan County reported that data from certain systems was accessed or acquired without authorization, exposing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f5648d9647b2c18a2c307ad60b01ed132fbf6dd3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d90698ef216","org_name":"ABC Supply Co., Inc.","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ABC%20Supply%20Co.%2C%20Inc.-2026-08-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cc1bbc8552ddee52a9be31ce4cc6ca4d620ab91c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"36aed79b2033","org_name":"Westchester Institute for Human Development, Inc.","org_type":"healthcare","ransomware":null,"records_affected":938,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-10-westchester-institute-for-human-development-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2026-08-10","discovered_date":"2026-07-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f884a97a47c0b612d1066f9d14e7c1cee315e8fa","impact_type":"data_theft","incident_date":"2025-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USA%20DeBusk%20-%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"403c7fca72dc","org_name":"USA DeBusk LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628082"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USA%20DeBusk%20-%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005245"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#USA%20DeBusk%20LLC-2026-08-10"}],"summary":"USA DeBusk LLC reported unauthorized access to certain systems and determined that a third party obtained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"54689bbedd770b2af90dfd831a4eb2c688d4ad10","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25cd613f8b52","org_name":"Simon & Schuster, LLC","org_type":"other","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Simon%20%26%20Schuster%2C%20LLC-2026-08-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-10","discovered_date":"2026-06-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a668f91b689cc0e6f51d92b581146fc8e15a7ccc","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e8ae12a28253","org_name":"Professional Directional Enterprises, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4273,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005230"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b80f10f657ec274ae125891162a9f26906a53ae9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a880394e5705","org_name":"My Doctor, LLC","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#My%20Doctor%2C%20LLC-2026-08-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bb0c1e775065fe2c02a184d818054c9f4ce4b941","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a63a982bf964","org_name":"Midtown Community Health Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Midtown%20Community%20Health%20Center%2C%20Inc.-2026-08-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-10","discovered_date":"2026-07-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"606a648f19d18bad5f4a6f0f81cb53401e5596f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e1c2750ffe2","org_name":"Limestone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005236"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-10","discovered_date":"2025-08-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bd760ee78ba4cdfe62971087a5bf0aa9a9bb3b4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kovack%20Securities%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"afd258cd219a","org_name":"Kovack Financial, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628054"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kovack%20Securities%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA%20AG_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005244"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kovack%20Financial%2C%20LLC-2026-08-10"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kovack%20Financial%2C%20LLC-2026-08-10"}],"summary":"Kovack reported that an unknown actor accessed files within its network between August 8 and August 27, 2025, and that information related to the recipient may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-10","discovered_date":"2026-08-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"019c1f9b89e4fe42af0600345a01210f3c6553a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02f547125470","org_name":"Gila Health Resources, LLC","org_type":"healthcare","ransomware":null,"records_affected":53675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005238"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Gila%20Health%20Resources%2C%20LLC-2026-08-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-10","discovered_date":"2026-03-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98e41d626e8e2e677ffe982adc2687e14cee2f8f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a33abe4cbd83","org_name":"De Colores Child Development Center Weber, LLC","org_type":"education","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005242"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-10","discovered_date":"2026-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6d0096d6dff24d5c154d3bba32470a7f3eb4d5fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BHCHP%20CA%20Reg%20Notice%20Letter.docx__0.pdf"},"notes":null,"org_country":"US","org_id":"d552e021f813","org_name":"Boston Healthcare for the Homeless Program","org_type":"healthcare","ransomware":null,"records_affected":201260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-10-boston-healthcare-for-the-homeless-program"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627990"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BHCHP%20CA%20Reg%20Notice%20Letter.docx__0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005240"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Boston%20Healthcare%20for%20the%20Homeless%20Program-2026-08-08"}],"summary":"Boston Healthcare for the Homeless Program reported that files containing some patients’ or employees’ personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d49d24709ae702a3f8f0eb76be6455838ec28dc","impact_type":"both","imported_from":null,"incident_date":"2026-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d73411000834","org_name":"Alcon","org_type":"healthcare","ransomware":true,"records_affected":218395,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Alcon","type":"hibp","url":"https://haveibeenpwned.com/Breach/Alcon"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWxjb24gSW5jLkBzaGlueWh1bnRlcnM"}],"summary":"ShinyHunters named Alcon in a pay-or-leak campaign and published data allegedly sourced from the company, including contact information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45a8279034ea3b9f90579824924b2b4d118a65f0","impact_type":"both","imported_from":null,"incident_date":"2026-07-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a3f9bedbb85b","org_name":"Brinks Home","org_type":"other","ransomware":true,"records_affected":732162,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Brinks Home","type":"hibp","url":"https://haveibeenpwned.com/Breach/BrinksHome"}],"summary":"Brinks Home acknowledged an incident after ShinyHunters published data it alleged was taken from the company as part of a pay-or-leak extortion campaign.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-07","discovered_date":"2025-03-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"adabf1f3d0da3094d79cd6e8060ef023a4f67676","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4373a242fa13","org_name":"VA Loan Lady","org_type":"financial","ransomware":null,"records_affected":91000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005225"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-07-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b75a7777fa2bec47d5a5297a18861de1464a110","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26e844481a03","org_name":"Travis County WCID # 17","org_type":"government","ransomware":null,"records_affected":428,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005227"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2f4914712b6c2ff45978a529437827096318ed99","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63d1e0da7855","org_name":"Sciencenter Discovery Museum","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sciencenter%20Discovery%20Museum-2026-08-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"dragonforce","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-07-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e968bb2465d568493fcdad15eab7aa4a26a32cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f4036d04e4f","org_name":"RUS Industrial, LLC","org_type":"other","ransomware":true,"records_affected":4812,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005229"},{"date":"2026-07-31","fetched_at":null,"title":"Leak-site claim by dragonforce","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UlVTIEluZHVzdHJpYWxAZHJhZ29uZm9yY2U"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"dragonforce","claim_groups":["dragonforce"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d5496f9be124d567a1285f22a859aa9ac99a6c52","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"396c5be14264","org_name":"Levi Strauss & Co.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Social engineering techniques enabled unauthorized access to three employees’ company-issued computers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K CURRENT REPORT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/94845/000199937126017264/levi-8k_080726.htm"}],"summary":"Levi Strauss & Co. reported that social engineering enabled unauthorized access to three employees’ company-issued computers, and that corporate information was accessed and exfiltrated.","supporting_quote":"Levi Strauss & Co. (the “Company”) recently detected that the Company experienced a cybersecurity incident in which an unauthorized third party gained access to Company files through social engineering techniques that enabled unauthorized access to three employees’ Company-issued computers.","technology_involved":["Company-issued computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"price":{"ticker":"LEVI","base_day":"2026-08-07","returns":{"1":{"day":"2026-08-10","raw":-0.0328,"adj":-0.0325},"5":{"day":"2026-08-14","raw":-0.0762,"adj":-0.0802},"21":{"day":"2026-09-08","raw":-0.1458,"adj":-0.1364}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b3d2197c7cc2248acd407f5078a7d4da2d4e9f64","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_11.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c42a328f179d","org_name":"Indico Data Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":4840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-07-indico-data-solutions-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628947"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005289"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fe44e777053ff2a2950900fe2a071a2c8bef7597","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a26586aa779","org_name":"Independent Solutions Wealth Management, LLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Independent%20Solutions%20Wealth%20Management%2C%20LLC-2026-08-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"948a748b08001730a30a454858d14daa9ebc5135","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a86d351b00e7","org_name":"Horizon Eye Care Laser & Eye Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-07-horizon-eye-care-laser-eye-surgery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-06-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"65afed74c983669bd42e8a1a2a7b9eaaaaf0451d","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42237.pdf"},"notes":null,"org_country":"US","org_id":"da2a53eef695","org_name":"Golden Opportunities And Local Support, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee may have retained unauthorized access to information and resources obtained during their employment and used information without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42237.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42237.pdf"}],"summary":"A former employee allegedly retained unauthorized access to GOALS information and used it to communicate with participants outside the program framework.","supporting_quote":"The individual is alleged to have continued communicating with current and former GOALS participants and using information obtained through their role with GOALS outside of the Washington State Health Care Authority Foundational Community Supports (FCS) program framework and without authorization.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65ffa960787e4c5ee0d8da6e3bff93d9bb868401","impact_type":"data_theft","imported_from":null,"incident_date":"2026-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1553fc40f2db","org_name":"Exact Sciences","org_type":"healthcare","ransomware":true,"records_affected":10869543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Exact Sciences","type":"hibp","url":"https://haveibeenpwned.com/Breach/ExactSciences"}],"summary":"ShinyHunters claimed to have obtained and published data from Exact Sciences in a July 2026 extortion campaign.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"dae6d7263c59d3a9e133e514f9bce9010a267d68","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"557baf9ee395","org_name":"Deseye, PLLC d/b/a Princeton Family Eye Care","org_type":"healthcare","ransomware":null,"records_affected":1050,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-07-deseye-pllc-d-b-a-princeton-family-eye-care"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005233"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c1325f8cf52d10dd0669d3125054005f527e309","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f418d4b9d451","org_name":"Deaconess Health System","org_type":"healthcare","ransomware":null,"records_affected":203874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005228"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-04-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21c2db67fe6d0ed99acb91687eca65027209c55a","impact_type":"data_theft","incident_date":"2026-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_10_0.pdf"},"notes":null,"org_country":"US","org_id":"9e148da05c1a","org_name":"Cushman & Wakefield","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627946"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_10_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cushman%20%26%20Wakefield-2026-08-07"}],"summary":"Cushman & Wakefield reported that an unauthorized third party accessed and exfiltrated files containing personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"84870112e7c35b1131ad1c82c51e69cc4e51b236","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2e9b119099f1","org_name":"Central Arkansas Pediatrics, P.A.","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-07-central-arkansas-pediatrics-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"80895434615378231926e2eca6d2a7198b6cade4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ab6314f9f95","org_name":"Anesthesia Group of Albany, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Anesthesia%20Group%20of%20Albany%2C%20P.C.-2026-08-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-07","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e637402911fb88f8e149570cf9a1b9d4a1c775f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5471e977981e","org_name":"American Addiction Centers","org_type":"professional_services","ransomware":null,"records_affected":327754,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-07-american-addiction-centers"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627976"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAC%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42250.pdf"}],"summary":"An unauthorized third party acquired personal and health-related information from American Addiction Centers' Salesforce instance.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-07","discovered_date":"2026-07-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9f13e4782f17503fbe789053cdeed96938dc442","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa8b426f2bc7","org_name":"Acumen Fiscal Agent","org_type":"healthcare","ransomware":null,"records_affected":16587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005231"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566.002"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","other"],"disclosed_date":"2026-08-06","discovered_date":"2026-08-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cc28c13d00b24b679e81617cb7f39bb5a0789bb4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-08-04","initial_access":"phishing","initial_access_attack_id":"T1566.002","notes":null,"org_country":"US","org_id":"e0362e863475","org_name":"IEH Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing link impersonating a prospective business contact led an employee to enter Microsoft 365 credentials on a fraudulent login page.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/50292/000117494726000761/form8k-36187_iehc.htm"}],"summary":"IEH Corporation reported that phishing led to unauthorized access to an employee’s Microsoft 365 mailbox, where information was accessible but no successful exfiltration was confirmed.","supporting_quote":"The user accessed the link and entered Microsoft 365 credentials into a fraudulent login page, resulting in unauthorized account access.","technology_involved":["Microsoft 365","email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Microsoft"},"veris_action":"social","derived":{"vendors":[{"id":"2204c6a98e58","name":"Microsoft"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8b14d2bd0f61db9c8a10e20ecfe12aa78ff2131a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad8723836fd8","org_name":"Homeless Prevention Center","org_type":"nonprofit","ransomware":null,"records_affected":79,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Homeless%20Prevention%20Center-2026-08-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f1ea1d80d19980b056d02dd88c33a884f4c4fe1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20of%20Data%20Incident%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e9995e9493f","org_name":"Hamill & Kaplan","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627843"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f7c8aed3ffddeabb5b23680702f991290d15257f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90776031351c","org_name":"Guardian Credit Union","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Guardian%20Credit%20Union-2026-08-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f730fe0e15fd5d22ab8ea0096eaa237a5ebe989","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"45570b33159a","org_name":"Abbott Cancer Diagnostics","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Abbott%20Cancer%20Diagnostics-2026-08-06"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Abbott%20Cancer%20Diagnostics-2026-08-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-05","discovered_date":"2026-03-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ec03cf906c2ff0637a929a0a434d77c1b77d5fc","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CMW2_Source.pdf"},"notes":null,"org_country":"US","org_id":"8593776800a8","org_name":"Station Casinos, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627764"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CMW2_Source.pdf"}],"summary":"Station Casinos identified suspicious activity associated with its network, and its investigation found that an unauthorized individual may have accessed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d97a2fda6ae702b009efd62a82d673b982ea6d53","impact_type":"unknown","incident_date":"2026-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Robert%20Arshagouni%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b6f9a5eb9fc9","org_name":"Robert Arshagouni","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627743"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Robert%20Arshagouni%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Robert%20Arshagouni-2026-08-05"}],"summary":"An unauthorized person gained intermittent access to certain systems and stored information; the potentially impacted personal information included names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"833915c6ed4151bb93740e2863308e5df9d14f71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"13afe0941229","org_name":"NFI North, Inc.","org_type":"healthcare","ransomware":null,"records_affected":49540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-05-nfi-north-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"821bc0ac0b5f8b7cbc9b5434a8729ef4365dc2e6","impact_type":"unknown","incident_date":"2026-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/New%20York%20City%20Regional%20Center%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6fa57f5ec26","org_name":"New York City Regional Center, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627755"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc15aa9c3eb6ce9de9a9a70f160a8928e18f3473","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"43ea5e0b2362","org_name":"Inter-Con Security","org_type":"professional_services","ransomware":true,"records_affected":276114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Inter-Con Security","type":"hibp","url":"https://haveibeenpwned.com/Breach/InterConSecurity"}],"summary":"ShinyHunters published data it alleged was taken from Inter-Con Security during a pay-or-leak extortion campaign.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-08-04","discovered_date":"2026-07-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec0978108d10d037eab62e73c43ab93f897be962","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc275f50326b","org_name":"Village Practice Management Company, LLC","org_type":"healthcare","ransomware":null,"records_affected":250821,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005222"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4514be5be6183ab84239dc178cdf5a980da10e83","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_Q1655_UCLE_DBM-5843_L02_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"a737fbc60b3c","org_name":"UCLA Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_Q1655_UCLE_DBM-5843_L02_SAS_1.pdf"}],"summary":"UCLA Health reported that personal and medical information contained in medical records was involved in a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-08-04","discovered_date":"2026-07-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"97dfeb5772d4f33222f47137599e133f07e954d2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"70fda3e9da7f","org_name":"Superb Shifts, Inc.","org_type":"other","ransomware":null,"records_affected":10420,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005219"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Superb%20Shifts%2C%20Inc.-2026-07-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-04","discovered_date":"2025-09-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"211bd70c03f7e1407567a002ee5bbd32f8d241d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2f05964138dc","org_name":"Sullivan Environmental Services, Inc.","org_type":"other","ransomware":null,"records_affected":1231,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005223"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-04","discovered_date":"2026-07-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3fcb203da413d84e0c972b25a09bd7ba78706e9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"560d76ea6686","org_name":"Pathfinder LL&D Insurance Group","org_type":"financial","ransomware":null,"records_affected":7970,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005224"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-08-04","discovered_date":"2026-06-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"896f3bb6f234574b2fec0fb6cc26c46e26615996","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/M%2BG%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2eca570705bc","org_name":"Malin + Goetz, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627640"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/M%2BG%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Malin%20%2B%20Goetz%2C%20Inc.-2026-08-04"}],"summary":"Malin + Goetz found unauthorized code on its website that may have captured customers’ checkout information between May 22 and June 10, 2026.","supporting_quote":null,"technology_involved":["website checkout/payment page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-04","discovered_date":"2026-07-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e0a59630aeac7d03103b8c37c025857cbe2740b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"16137d2422d4","org_name":"CTS Journey Holdings, LLC, a Delaware limited liability company (","org_type":"other","ransomware":null,"records_affected":37682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005226"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CTS%20Journey%20Holdings%2C%20LLC%2C%20a%20Delaware%20limited%20liability%20company%20%28DBA%20Corporate%20Travel%20Service%29-2026-08-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"eed155de0f43f81fb5ec041ff520db27f4555ae2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d020a154e7c","org_name":"CTS Journey Holdings, LLC","org_type":"other","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#CTS%20Journey%20Holdings%2C%20LLC%20d/b/a%20Corporate%20Travel%20Service-2026-08-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53e2e4e041dcf2e61e531f731f4fcdc0072b4378","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42154.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b2d7f8ec94d5","org_name":"Aesto, LLC","org_type":"professional_services","ransomware":null,"records_affected":37253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42154.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42154.pdf"}],"summary":"Aesto reported that sensitive information stored in a limited portion of its AWS infrastructure may have been accessed or acquired by an unauthorized actor.","supporting_quote":null,"technology_involved":["Amazon Web Services (AWS)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"76fe251fe2e02f339c6dbccdc2dc0d70346f1bc2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"475a84f3ebe1","org_name":"PAMCAH-UA Local 675 Health and Welfare Fund","org_type":"healthcare","ransomware":null,"records_affected":8319,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-08-03-pamcah-ua-local-675-health-and-welfare-fund"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3485b5b180a7fd191a8bfa2240b3f8a8793c191","impact_type":"unknown","incident_date":"2025-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CTS_Letter_A_Redacted_39787951v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"35eb3906d052","org_name":"CTS Journey Holdings, LLC, a Delaware limited liability company (DBA Corporate Travel Service)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627620"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0837e9d56d3a777b819d5d124c6051316097a334","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42137.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"482ef188ace5","org_name":"CTS Journey Holdings, LLC, a Delaware limited liability comp","org_type":"unknown","ransomware":null,"records_affected":2226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42137.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2026-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d64d915eb56ef92f79d5adec02e81b59c1d330b1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"0447e1a16379","org_name":"SplitVPN","org_type":"technology_saas","ransomware":null,"records_affected":865336,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SplitVPN","type":"hibp","url":"https://haveibeenpwned.com/Breach/SplitVPN"}],"summary":"A July 2026 data breach at SplitVPN exposed customer records, including email addresses, IP addresses, geographic locations, device information, and partial payment card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-31","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"97a96f5e502215f1dbb5084ba5721aa60cdba73f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"60ed1556f081","org_name":"Travis County Credit Union","org_type":"financial","ransomware":null,"records_affected":3315,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005213"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4da0f372ad1b58466a1bed6a5834290d48a0129c","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SCHSA%20-%20California%20Notification_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f3bf5bfea49","org_name":"Stanislaus County Health Services Agency","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627513"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-31","discovered_date":"2026-05-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7742d9ef69a8393e8d05f8641c0748c486b19f90","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e1586ef509f7","org_name":"MPS Enterprises, Inc. (“MPS”) ","org_type":"retail_ecommerce","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005215"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6c0d40c9c0e4b054852789703722fb66ebe5d373","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"136590e7ef0b","org_name":"Monongalia County General Hospital Company","org_type":"healthcare","ransomware":null,"records_affected":2173,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-monongalia-county-general-hospital-company"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d6aa3c22f7837862a285f27374e4ca23f25f0b06","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aef455670034","org_name":"Miles Partnership, LLLP","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Miles%20Partnership%2C%20LLLP-2026-07-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c7111c645402de72fad50eaeef8457dbfdf74272","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1722b5e0da17","org_name":"Manning Regional Healthcare Center","org_type":"healthcare","ransomware":null,"records_affected":746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-manning-regional-healthcare-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"981a1e5a3df27c5506e92e3a5c0968ff60063be3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e4faaeec08db","org_name":"Maine Course Hospitality Group","org_type":"other","ransomware":null,"records_affected":553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Maine%20Course%20Hospitality%20Group-2026-07-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"17b41efd9e823b043b52c86eb34e4a230b325497","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a2298a4c1bd","org_name":"Interim HealthCare of Oklahoma City, Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-interim-healthcare-of-oklahoma-city-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-31","discovered_date":"2026-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a5421cf1c7193b1e50ecb6552e74ca5bab6e252b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3754aba26eab","org_name":"Goodwin Procter LLP","org_type":"other","ransomware":null,"records_affected":13805,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005216"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3ce5e02a4f1e6faa325ddeba81a159272ec0d14","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42089.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf321ebcbe36","org_name":"Everside Health (Aesto, LLC)","org_type":"unknown","ransomware":null,"records_affected":21308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42089.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17f1aab9a516056b78b718254c35d0e85aeb2b25","impact_type":"unknown","incident_date":"2025-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Everside%20-%20California%20Notification_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2e1fb7bb14ee","org_name":"Everside Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627495"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005220"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Everside%20Health.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2387ec466e1bcc38bf588c5afda3973845997d99","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a5eb1c00f6f","org_name":"Asheville Victoria NC Opco LLC d/b/a Elevate Health & Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":1551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-asheville-victoria-nc-opco-llc-d-b-a-elevate-health-rehabilitation"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d7230885490db9e7a13ab7a0f474b2579a4cb4ea","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8627427f4cc0","org_name":"Asheville US Seventy NC Opco LLC d/b/a Swannanoa Valley Health and Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":1045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-asheville-us-seventy-nc-opco-llc-d-b-a-swannanoa-valley-health-and-rehabilitatio"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"51312e8555780006f41ac65a6a6ffc11398d92be","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a60e1f999921","org_name":"Asheville Beaverdam NC Opco LLC d/b/a Bear Mountain Health and Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":1397,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-asheville-beaverdam-nc-opco-llc-d-b-a-bear-mountain-health-and-rehabilitation"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ce52fe76cd7a84424a94845ba9052289bf5a3470","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46d586294237","org_name":"Aesto Health","org_type":"healthcare","ransomware":null,"records_affected":91,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Aesto%20Health-2026-07-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"218c81e49a004074ace370245a5348ee74b97216","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2d7f8ec94d5","org_name":"Aesto, LLC","org_type":"professional_services","ransomware":null,"records_affected":9540683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-aesto-llc"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aesto%2C%20LLC-2026-08-05"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ee4816087716930a12b8efd47b111b6157a1406d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7da88a7362f7","org_name":"A-O-M-S, P.L.L.C. d/b/a Arkansas Oral & Maxillofacial Surgeons","org_type":"healthcare","ransomware":null,"records_affected":64831,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-31-a-o-m-s-p-l-l-c-d-b-a-arkansas-oral-maxillofacial-surgeons"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"121cd6b9683a19469d6a3559f749c13ab83fe463","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecc7db452ff6","org_name":"The City of New Britain","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20City%20of%20New%20Britain-2026-07-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-30","discovered_date":"2026-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"845ad8c2ee1d8d7346db501c73c831d37b2eeb3d","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_Q2216_SME_DBM-5880_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"72e3681b003f","org_name":"SM Energy Company","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627422"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_Q2216_SME_DBM-5880_L01_SAS_1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005218"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SM%20Energy%20Company-2026-07-30"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#SM%20Energy%20Company-2026-07-31"}],"summary":"SM Energy determined that an unauthorized third party accessed company systems and obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8546f548a00c64d28c775376e02dc2ec0b80d8ed","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d6622eac063","org_name":"Schembre & Gannon, LLC","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Schembre%20%26%20Gannon%2C%20LLC-2026-07-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fe4b236e7b70c9ce0bde299e0f499e99b9d4c6d2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ca47893f6ce","org_name":"Pennsylvanie Dermatology Partners","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-30-pennsylvanie-dermatology-partners"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a1b31416b3966ac040721e0685b96716052e2aee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c4b59e71c12f","org_name":"MPS Enterprises, Inc.","org_type":"healthcare","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-30-mps-enterprises-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a7574b386171585eedd350a6edf70bb5bd7e5d0","impact_type":"disruption_or_ransomware","incident_date":"2026-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42069.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fffeded3927a","org_name":"Microcode, Inc.","org_type":"professional_services","ransomware":true,"records_affected":4096,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42069.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42069.pdf"}],"summary":"Microcode reported a ransomware event involving a server hosting CommonSpirit Health’s tracking database; personal information was found on the affected server, but access or theft of data could not be confirmed.","supporting_quote":null,"technology_involved":["tracking database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Microcode, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"fffeded3927a","name":"Microcode, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-29","discovered_date":"2026-06-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5684a00f160073621ea57f57cd1f72b8e23d9658","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28zHealth%29%2012%20Month%20Proof%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"b4490c6a2af8","org_name":"zHealth, Inc.","org_type":"professional_services","ransomware":null,"records_affected":118563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-29-zhealth-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629559"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28zHealth%29%2012%20Month%20Proof%20-%20CA.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005327"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#zHealth%2C%20Inc.-2026-09-11"}],"summary":"zHealth reported that an unauthorized third party may have copied information from its network environment.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1b3c52ceb41bc872ad3c63db6dc97213ad67cdd6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9784dc311764","org_name":"Wei Wei & Company LLP","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Wei%20Wei%20%26%20Company%20LLP-2026-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a5657cdb0d3c014b0a8be8fb047c617742105f37","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3130384914aa","org_name":"Taft Stettinius & Hollister LLP","org_type":"other","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Taft%20Stettinius%20%26%20Hollister%20LLP-2026-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-07-29","discovered_date":"2026-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"16e25aee9462648e8888ce007d76158ea5034419","impact_type":"both","incident_date":"2026-05-29","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quantum%20-%20California%20Notification.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbe5b83a99af","org_name":"Quantum Health","org_type":"professional_services","ransomware":null,"records_affected":2104,"reviewed":false,"root_cause":"A user responded to a vishing call, which led to unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-29-quantum-health"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-628342"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quantum%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005262"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Quantum%20Health%2C%20Inc.-2026-08-14"}],"summary":"Quantum Health reported that a user responding to a vishing call preceded unauthorized access and acquisition of files, causing a service outage.","supporting_quote":"Our investigation determined that the service outage was related to unauthorized access to our IT network, resulting from a user responding to a vishing call on May 29, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3c0ed7c0b202f27800759a5b435c89f66302662b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f97b2373895","org_name":"Nephrology Associates, M.D., P.A.","org_type":"healthcare","ransomware":null,"records_affected":24088,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-29-nephrology-associates-m-d-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a1916d7c3e47769fa6beb3dd17900753de041f76","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe764cc3c3a2","org_name":"Index Packaging, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Index%20Packaging%2C%20Inc.-2026-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ac8fe2f8e88616981f0192caa53b256d478fb70e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68f51f46d548","org_name":"Herbert Smith Freehills Kramer (US)  LLP","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Herbert%20Smith%20Freehills%20Kramer%20%28US%29%C2%A0%20LLP-2026-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"99695f54fa35a19ae9548b4fdffbdb8b6689eb6d","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"5a875c6ce2b5","org_name":"HealthStream","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1095565/000143774926024890/hstm20260729_8k.htm"}],"summary":"HealthStream reported that an unauthorized third party accessed files on its corporate file servers, including employee, customer and vendor billing, and corporate and legal information.","supporting_quote":null,"technology_involved":["corporate file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"price":{"ticker":"HSTM","base_day":"2026-07-29","returns":{"1":{"day":"2026-07-30","raw":-0.045,"adj":-0.0618},"5":{"day":"2026-08-05","raw":-0.0515,"adj":-0.1068},"21":{"day":"2026-08-27","raw":-0.0237,"adj":-0.0808}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d975c4018f360238f4cedef159e22f920cd14d48","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"80bc0cf9dd34","org_name":"Central Texas Oral Health","org_type":"healthcare","ransomware":null,"records_affected":1389,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-29-central-texas-oral-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cdb07f9d1e72cb58e6597aa1cecca5e1e090a9fe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9aaab536ce4a","org_name":"Associated Endocrinologists","org_type":"healthcare","ransomware":null,"records_affected":4979,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-29-associated-endocrinologists"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e281bf3374f59e230f397fa997f6dac4b8ff996","impact_type":"data_theft","incident_date":"2026-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sunrise%20Company%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7a5a1c2822af","org_name":"Sunrise Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627296"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sunrise%20Company%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005214"}],"summary":"Sunrise Company reported that an unauthorized actor accessed its network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-28","discovered_date":"2026-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a73e9de6a559f6aa0f22e0321e93b86e19d9436","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb7472087f62","org_name":"Jeffrey David Reuben MD","org_type":"healthcare","ransomware":null,"records_affected":17017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005211"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c5f3575aa3169ba4d09c2741f910bac61c078f0","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d021bd210651","org_name":"Houston City College","org_type":"education","ransomware":true,"records_affected":831642,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Houston City College","type":"hibp","url":"https://haveibeenpwned.com/Breach/HoustonCityCollege"}],"summary":"Houston City College data was reportedly obtained during a ShinyHunters extortion campaign and later published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-28","discovered_date":"2026-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c352c18686e155bce68adf7948213306e3dcd5a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/26-0473%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ab3b96590c20","org_name":"Fresno County Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/26-0473%20Notification%20Letter.pdf"}],"summary":"Fresno County Department of Social Services reported that an unauthorized user accessed a data file containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-28","discovered_date":"2026-05-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f466d6ab98618f9d1e0f77ddf10a62039ba7249f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e1e3395fcc6d","org_name":"Azle Smiles","org_type":"healthcare","ransomware":null,"records_affected":9444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005201"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8f598e8bd9b61a4c3369e4c3aeaefa9646a0e649","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d8983dca9ab5","org_name":"Archdiocese of Indianapolis","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Archdiocese%20of%20Indianapolis-2026-07-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-07-27","discovered_date":"2026-06-08","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"123d2cc1453b623499e35f1328763140f3802499","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42002.pdf"},"notes":null,"org_country":"US","org_id":"87edcadbed6f","org_name":"SPay Inc","org_type":"technology_saas","ransomware":null,"records_affected":1190,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42002.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627175"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stack%20Sports%20-%20Consumer%20Notification%20for%20California%20Residents.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42002.pdf"}],"summary":"SPay Inc. reported malicious code on its SportsAffinity Platform that ran in users’ browsers during checkout and may have affected payment information.","supporting_quote":null,"technology_involved":["SportsAffinity Platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0d8c13c09690fd3d8952f122e555abb33691d46b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"119bd7d62139","org_name":"Regional Center of Orange County","org_type":"professional_services","ransomware":null,"records_affected":16545,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-27-regional-center-of-orange-county"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627216"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-27","discovered_date":"2026-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e067791c15559ebd115a2bae7aa670fab2452439","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JRK%20notification.pdf"},"notes":null,"org_country":"US","org_id":"f039e49db02d","org_name":"JRK Property Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627223"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JRK%20notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005210"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20JRK%20Property%20Holdings%2C%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#JRK%20Property%20Holdings%2C%20Inc.-2026-07-28"}],"summary":"JRK Property Holdings identified suspicious activity and later determined an unauthorized individual may have accessed files and folders containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f783ec6c786e3d0b991b3eee73017908e6e11997","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2b36919a188f","org_name":"Jeffrey David Reuben, M.D.","org_type":"healthcare","ransomware":null,"records_affected":17017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-27-jeffrey-david-reuben-m-d"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c9b4509cc5fc9e46c82329e11cab4956150159f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c747bcd493f2","org_name":"Doxa Programs, LLC","org_type":"financial","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Doxa%20Programs%2C%20LLC-2026-07-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5bb86247514da088da2afec4b172c7fc9facfeac","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd5f7b14c308","org_name":"Doxa Insurance Holdings, LLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Doxa%20Insurance%20Holdings%2C%20LLC-2026-07-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"076e4b73b7ede2767af02259aee9e89bb1b95339","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c730cf6e4a22","org_name":"Doxa E&S Solutions, LLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Doxa%20E%26S%20Solutions%2C%20LLC-2026-07-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9799e7dba90a4f1c4494b7b9c969c05d10809247","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"079c1cb7d51f","org_name":"Cornerstone Behavioral Healthcare","org_type":"healthcare","ransomware":null,"records_affected":14830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-27-cornerstone-behavioral-healthcare"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b62436472835968f731e31fe80e34abd2eba3092","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9627ab7089c0","org_name":"AcademyHealth","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AcademyHealth-2026-07-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9c5ff0d15b563f9bd599d4997ed8ed7593af41a5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d3eb07ac056","org_name":"Wilson Dental","org_type":"healthcare","ransomware":null,"records_affected":3476,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-wilson-dental"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005204"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cf21ba63208b9ba4506e1aebc097f376c54a8469","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bb5ecd31ceb","org_name":"Vanderbilt University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3298,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-vanderbilt-university-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-24","discovered_date":"2025-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0fd4906a1597394e51855dbe31d447542b93e2d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAG%20Final%20Notice%20Letter%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9151e37a5b43","org_name":"The LINE Los Angeles","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAG%20Final%20Notice%20Letter%20Redacted.pdf"}],"summary":"The LINE Los Angeles reported unauthorized access to certain systems between September 25 and October 1, 2025, and said affected data may have included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"be284a4b2b9ca7935024e28142d2d38261b086dc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d73ac44c324","org_name":"Mysa Dental","org_type":"healthcare","ransomware":null,"records_affected":3394,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-mysa-dental"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005203"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"13525040b26b4282c12a40c830f506036ead4ed5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f68a87f6a3ba","org_name":"Lifespark Management Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":6611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-lifespark-management-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7d641806cc0187b32b285151f43362c6455ffe4c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8e136c16f307","org_name":"Kashi Dental","org_type":"healthcare","ransomware":null,"records_affected":6027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-kashi-dental"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005206"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"90582e82d6f7a28337a7c8a5dd3260e8260319a0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"502a52830df4","org_name":"Hilldun Corporation","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hilldun%20Corporation-2026-07-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-07-24","discovered_date":"2026-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78babca521d3019ea6f51dbe16bfaa4f0105104b","impact_type":"unknown","incident_date":"2026-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"7df1eee335a7","org_name":"Eyemart Express, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626998"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005190"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41958.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Eyemart%20Express%2C%20LLC-2026-07-24"}],"summary":"Eyemart Express reported unauthorized access to its systems on February 12, 2026, involving files containing employee information, including names and payroll information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":"2026-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"716b1a94b5f8ea7f38e8f022e690ae097c99e5f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CareCloud_-_SSN_39739837v1.pdf"},"notes":null,"org_country":"US","org_id":"5f65776577a7","org_name":"CareCloud, Inc.","org_type":"professional_services","ransomware":null,"records_affected":3756469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-carecloud-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627090"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CareCloud_-_SSN_39739837v1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005263"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM25126.pdf"}],"summary":"CareCloud reported unauthorized access to an AWS environment, where a third party claimed to have exfiltrated data from databases.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":"2026-05-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9885799d1899fa1738186df742651f2753383cdf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AG%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"59ed00c7d740","org_name":"Bridgeway Benefit Technologies LLC","org_type":"professional_services","ransomware":null,"records_affected":9268,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-bridgeway-benefit-technologies-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627081"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AG%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005209"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bridgeway%20Benefit%20Technologies%20LLC-2026-07-24"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bridgeway%20Benefit%20Technologies%20LLC-2026-07-25"}],"summary":"Bridgeway Benefit Technologies reported unauthorized access from March 5 to May 19, 2026, and said personal information may have been involved.","supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d8ee4e9c0793994ed63ae7434780ab352f2b1a8d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53cbae8bb3a7","org_name":"Azle Smiles Dental","org_type":"healthcare","ransomware":null,"records_affected":9444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-azle-smiles-dental"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a24cb8870570c3f8ab53d8fc6c3809742625793b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e1bf603477b3","org_name":"Allwyn Dental","org_type":"healthcare","ransomware":null,"records_affected":4013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-allwyn-dental"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005202"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"82d77ab78a50f1dc54dea4e21a5af5660e63b754","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8f81e85216ef","org_name":"Alabama Symphonic Association Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alabama%20Symphonic%20Association%C2%A0Inc.-2026-07-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"84395b8d1fe82f96fe45a539fd5d6493b69dc34e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8627e82cfc2b","org_name":"Agave Dental-Floresville","org_type":"healthcare","ransomware":null,"records_affected":11790,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-24-agave-dental-floresville"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005200"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2d41d5d615cc7fb1c241b94d94ebd8877b53cb12","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e110675dafc","org_name":"Virginia Transportation Corporation","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Virginia%20Transportation%20Corporation-2026-07-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-23","discovered_date":"2026-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4b7ed9fcdd383c42803c717f46aea7c3e970bfc","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fea0efca3261","org_name":"United States Tennis Association Texas","org_type":"retail_ecommerce","ransomware":null,"records_affected":873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005198"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-23","discovered_date":"2026-06-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7055082514da5a2c9c49f31165d775fb98b8381","impact_type":"data_theft","incident_date":"2026-06-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Template%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"fa7d7c59545d","org_name":"The Moody Bible Institute of Chicago","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Template%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005221"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41947.pdf"}],"summary":"The Moody Bible Institute of Chicago determined that information, including names, was illegally acquired from its system on or about June 12, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-23","discovered_date":"2026-06-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a516a1593e97ffa8766217dcb4fff817bea7f5c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eede26830c29","org_name":"The Devereux Foundation","org_type":"healthcare","ransomware":null,"records_affected":86958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005199"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Devereux%20Foundation-2026-07-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"580a4cf33261dfad0a357c91cf7eabdb593f6244","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22b61d0a0af1","org_name":"Suvida Healthcare, LLC","org_type":"healthcare","ransomware":null,"records_affected":1421,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-23-suvida-healthcare-llc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005265"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"72bed1d89e14b9960c5752898447ead5a2e957d1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e9babe991fd6","org_name":"SunCloud Health","org_type":"healthcare","ransomware":null,"records_affected":2594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-23-suncloud-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aff7a631e4a732bf0e4920c64e0ff9d07fa734fa","impact_type":"unknown","incident_date":"2026-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SafetyFirst%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f81732b38752","org_name":"Safetyfirst Systems, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626972"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005205"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Safetyfirst%20Systems%2C%20LLC-2026-07-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c956852d9aafc92a3b8d36eab4f12329b24974d8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0910844bcf2","org_name":"Risk Program Administrators LLC","org_type":"professional_services","ransomware":null,"records_affected":8309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-23-risk-program-administrators-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-23","discovered_date":"2026-05-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"442218f1a9e69ff35e32d6de1470fd53b5693acd","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfc54096bf29","org_name":"McEwen and Associates, Inc.","org_type":"other","ransomware":null,"records_affected":20106,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005196"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-23","discovered_date":"2025-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23fefd34e976d4d016e6e65278af7a8fb8134723","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Devereux%20Foundation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e3d9b4697b26","org_name":"Devereux Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626965"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Devereux%20Foundation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed Devereux Foundation systems from November 6 to November 9, 2025, and copied files without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-23","discovered_date":"2025-12-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e5226461d86aacfe81c5eee81c0ef0e28cbba086","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5bd0f07092ba","org_name":"Central Texas MHMR","org_type":"healthcare","ransomware":null,"records_affected":26055,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005197"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Central%20Texas%20MHMR%20d/b/a%20Center%20for%20Life%20Resources-2026-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"32789459d15f50acbfd9fbfc35e80666fe751656","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e174a2f852d","org_name":"Casper Orthopedic Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":56197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-23-casper-orthopedic-associates-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-22","discovered_date":"2026-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12ddae48d47e7b8370252fd2347e7dd69a2dffaf","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20CA%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"973b94153215","org_name":"The Lawson Roofing Co Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20CA%20Consumer%20Notice.pdf"}],"summary":"The Lawson Roofing Co Inc. reported that information may have been accessed and copied without authorization between April 23 and April 28, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d94a846e7effa5dc31a9fe5fcedc8b8cbf3fea2a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"269543e236bd","org_name":"Saint Pete MRI","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Saint%20Pete%20MRI-2026-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-22","discovered_date":"2026-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2228586bd19df925e11139308e36f8169cab63a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lasership_Ontrac%20-%20Adult_Letter%20-%20Mailing%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"d9f7cc9c7395","org_name":"LaserShip","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626905"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lasership_Ontrac%20-%20Adult_Letter%20-%20Mailing%20Proof.pdf"}],"summary":"LaserShip reported that files containing personal information may have been accessed without authorization between March 20 and March 22, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"94bd9bfe626b64550e1fc4fece18970a0c13590d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"34c773e2050d","org_name":"Kootenai County, ID","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kootenai%20County%2C%20ID-2026-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-22","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"574e41236e1356fd8d5391f8b2581571180d83db","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41917.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dc3c0aae994d","org_name":"Kootenai County","org_type":"government","ransomware":true,"records_affected":746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41917.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41917.pdf"}],"summary":"Kootenai County detected ransomware on its computer network and learned that cyber criminals had taken certain data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-22","discovered_date":"2026-07-15","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ce43c9c11156a3cd08f8f06204fc4ec4bd7d429e","impact_type":"data_theft","imported_from":null,"incident_date":"2026-07-14","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"51581f772545","org_name":"Five Below, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Social engineering enabled unauthorized access to an employee's Company-issued computer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1177609/000119312526312573/d19155d8k.htm"}],"summary":"Five Below reported that a threat actor used social engineering to access an employee’s company-issued computer and exfiltrate files.","supporting_quote":"The investigation determined that on July 14, 2026, a threat actor used social engineering techniques that enabled unauthorized access to that employee’s Company-issued computer.","technology_involved":["Company-issued computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"price":{"ticker":"FIVE","base_day":"2026-07-22","returns":{"1":{"day":"2026-07-23","raw":-0.0174,"adj":-0.005},"5":{"day":"2026-07-29","raw":0.0226,"adj":0.0466},"21":{"day":"2026-08-20","raw":0.1535,"adj":0.1331}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5d814c975c00835af26c6569d1bbfc6d9401a366","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5058a7049781","org_name":"Any-Time Home Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":11753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-22-any-time-home-care-inc"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Any-Time%20Home%20Care%2C%20Inc.-2026-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-21","discovered_date":"2026-01-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1acd391b81a9f5132233a00edde4e91bfa1c2b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Xsolis_CA_Individual%20Notification%20Exemplar%20%2806.19.26%29_0.pdf"},"notes":null,"org_country":"US","org_id":"98c655c9232d","org_name":"Xsolis, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A targeted phishing attack resulted in unauthorized activity.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626828"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Xsolis_CA_Individual%20Notification%20Exemplar%20%2806.19.26%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005192"}],"summary":"Xsolis reported unauthorized activity resulting from a targeted phishing attack, and said some protected health information may have been accessed.","supporting_quote":"Xsolis became aware of unauthorized activity resulting from a targeted phishing attack on January 22, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-21","discovered_date":"2025-07-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"93bba804588892862b70d0f6b17c7ecbbc1aeccf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f6f02cbcc7c","org_name":"Visiting Nurse Association of Texas","org_type":"healthcare","ransomware":null,"records_affected":28467,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005191"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-21","discovered_date":"2025-10-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b79a36b0fcd2a6f63d588383cae8ea1032669e00","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Unlimited%20-%20Exhibit%20A%20-%20Sample%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"861c2430e78c","org_name":"Unlimited Technology Systems, LLC","org_type":"professional_services","ransomware":null,"records_affected":3803750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-21-unlimited-technology-systems-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Unlimited%20-%20Exhibit%20A%20-%20Sample%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005193"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Unlimited%20Technology%20Systems%2C%20LLC-2026-07-21"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Unlimited%20Technology%20Systems%2C%20LLC-2026-07-21"}],"summary":"Unlimited Technology Systems discovered unauthorized activity in its commercial datacenter and found that an unauthorized actor obtained a copy of some personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"56cc144f0468616e453406ed48015feb0cc54645","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c10ad45c3cf4","org_name":"TransGlobal Insurance Agency","org_type":"financial","ransomware":null,"records_affected":28,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#TransGlobal%20Insurance%20Agency-2026-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"44689055797a3c9bad5a9238a4305bbd9eefc4a8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3b1b3740978","org_name":"Penobscot Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Penobscot%20Valley%20Hospital-2026-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2ea91ae44b687aa2732b7ea35e99b9b87f2e9690","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38f0cddcbabf","org_name":"Harvard Pilgrim Health Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1168,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-21-harvard-pilgrim-health-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-21","discovered_date":"2026-07-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"93eab6d98d4d7ea9473852e7d1df2faef33dd61f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"318ee40d2198","org_name":"Chick-fil-A, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":13322,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005189"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Chick-fil-A%2C%20Inc.-2026-07-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bc42fb84a88fedf566335924dae579a05e56e6cf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2569b5de898c","org_name":"11th Street Commons","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#11th%20Street%20Commons-2026-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50c5b0aadb10fc51414e694e7d6b9c14f711ee7c","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bdf3c29c71d5","org_name":"Suno","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Suno","type":"hibp","url":"https://haveibeenpwned.com/Breach/Suno"}],"summary":"Suno suffered a data breach in November 2025 that exposed over 55 million email addresses and other personal and purchase-related information.","supporting_quote":null,"technology_involved":["Stripe"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a383536c5e70012656b7d60a19973701cfd18f68","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99e63f81e116","org_name":"Family Farm & Home","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Family%20Farm%20%26%20Home-2026-07-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"16fe651646f041528fc43ff9af8939317d41713e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d69b6996982","org_name":"Beltrami County Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":1491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-20-beltrami-county-health-and-human-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2026-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bf405ac861a569924b41186d6dacd823da2711a","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2332464ff87e","org_name":"Paidwork","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Paidwork","type":"hibp","url":"https://haveibeenpwned.com/Breach/Paidwork"}],"summary":"Data allegedly obtained from Paidwork was posted publicly and included personal, banking, payout, and password data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2695f6c9c3d0b69d7a8902d61b787e0c87d447d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b7c674f6438c","org_name":"Minnesota Health Insurance Network","org_type":"professional_services","ransomware":null,"records_affected":3656,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-19-minnesota-health-insurance-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f9e128120cebd93c6c98b9a95aa7e3c5465afbea","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"678e0bfb0f27","org_name":"Open Door Health Center of Illinois","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-18-open-door-health-center-of-illinois"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-17","discovered_date":"2026-02-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bc66735e621b297f77633f786562cbf6ca834fad","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ZenPatient%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"127f1401d0e2","org_name":"ZenPatient, Inc.","org_type":"healthcare","ransomware":null,"records_affected":15749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-17-zenpatient-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ZenPatient%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005188"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41853.pdf"}],"summary":"ZenPatient reported that an unauthorized actor accessed or copied data containing individuals’ names and other unspecified information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-17","discovered_date":"2026-06-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0b1984827aacec02fbcfba3ee08533f9513c1e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57f03a3003cd","org_name":"TPIS Industrial Services, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2359,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005179"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","internal"],"disclosed_date":"2026-07-17","discovered_date":"2026-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eaf60ffd3d758d60210ebe7717507710fc01321c","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41847.pdf"},"notes":null,"org_country":"US","org_id":"ed12bf0785b3","org_name":"The Estée Lauder Companies","org_type":"manufacturing","ransomware":null,"records_affected":2110,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41847.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41847.pdf"}],"summary":"An unauthorized third party accessed The Estée Lauder Companies’ Oracle E-Business Suite system and obtained personal information.","supporting_quote":null,"technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","internal"],"disclosed_date":"2026-07-17","discovered_date":"2026-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4410208905c7c5c4f0b2748910990fdd2978884e","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELC%20-%20U.S.%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ed12bf0785b3","org_name":"The Estée Lauder Companies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELC%20-%20U.S.%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005187"}],"summary":"An unauthorized third party accessed The Estée Lauder Companies' Oracle E-Business Suite system and obtained personal information.","supporting_quote":null,"technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"65ee79eaa1c9376f70339877f3c3f5119450ec87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99ea0071c852","org_name":"The Association for Neurologically Impaired Brain Injured","org_type":"healthcare","ransomware":null,"records_affected":1918,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-17-the-association-for-neurologically-impaired-brain-injured"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-17","discovered_date":"2026-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49e77be93197596bbfb2d024fa5b683a30c521e1","impact_type":"data_theft","incident_date":"2026-05-28","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quontic%20Bank%20Acquisition%20Corp.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c47f4449277e","org_name":"Quontic Bank Acquisition Corp.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626685"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quontic%20Bank%20Acquisition%20Corp.%20-%20Sample%20Notice.pdf"}],"summary":"Quontic Bank reported that two former employees retained customer records after leaving the company.","supporting_quote":"On May 28, 2026, Quontic Bank became aware that two former employees retained certain customer records after departing from the company.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7e5e6b1afd96a6ffa108b4570774420c78985456","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e031362be3a3","org_name":"One Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":153174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-17-one-medical-group-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"79179e9a5771fa21b2779da6d9ca3b850420270d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"003c245b9482","org_name":"James C. Standring, DDS","org_type":"healthcare","ransomware":null,"records_affected":6658,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-17-james-c-standring-dds"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4b98ed2e332d40266d2a6053ed16f94280b5bacf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b17d9d4c5350","org_name":"Community Based Care of Brevard dba Family Partnerships of Central Florida","org_type":"healthcare","ransomware":null,"records_affected":8151,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-17-community-based-care-of-brevard-dba-family-partnerships-of-central-florida"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"87911849a0143fdba4bcf55d8d99247c52d93668","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a51de252ebe","org_name":"Community Based Care Brevard","org_type":"nonprofit","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Community%20Based%20Care%20Brevard%20d/b/a%20Family%20Partnerships%20of%20Central%20Florida-2026-07-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-07-17","discovered_date":"2026-07-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9057d7259fba7f6abaeb0b2f807bae16aa5a89bc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-07-04","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"9c09e2900787","org_name":"Clover Health Investments, Corp.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A threat actor gained access to three employee accounts through social engineering.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1801170/000180117026000181/clov-20260704.htm"}],"summary":"Clover Health reported that a threat actor accessed three employee accounts through social engineering, where accounts could access personally identifiable and protected health information.","supporting_quote":"The investigation subsequently showed that a threat actor gained access to three non-managerial health plan employee accounts through social engineering.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"price":{"ticker":"CLOV","base_day":"2026-07-17","returns":{"1":{"day":"2026-07-20","raw":-0.026,"adj":-0.0244},"5":{"day":"2026-07-24","raw":-0.0649,"adj":-0.0591},"21":{"day":"2026-08-17","raw":-0.0758,"adj":-0.1153},"63":{"day":"2026-10-15","raw":0.013,"adj":-0.0254}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-17","discovered_date":"2026-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19e847b0f4ba98fd55dece930a7dd12e260859d3","impact_type":"data_theft","incident_date":"2026-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bayada%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f4cd6e23c7e6","org_name":"BAYADA Home Health Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626658"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bayada%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005185"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Bayada%20Home%20Health%20Care%2C%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#BAYADA%20Home%20Health%20Care%2C%20Inc.-2026-07-17"}],"summary":"BAYADA reported that an unauthorized actor accessed certain systems and copied data between February 18 and March 2, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"78cd5997a361ab88be803490f4005fc3e470afdd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"848ac325416e","org_name":"ASP Unifrax Holdings, Inc.","org_type":"other","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ASP%20Unifrax%20Holdings%2C%20Inc.-2026-07-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8b9d7929847d6f8fae074af49250636e2f72606","impact_type":"unknown","incident_date":"2025-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ELN-27475_Questo_Ad_CM_Variable_A_r1prf_39626763v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5785053ed0bf","org_name":"Questo","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626601"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005178"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Questo%2C%20Inc.-2026-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"15f30487bcc48ce7f814ae99c2989449c3e66055","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69651b198ff4","org_name":"Pinnacle Financial Partners, Inc.","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Pinnacle%20Financial%20Partners%2C%20Inc.-2026-07-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ef9d52d0def950550bb59c31424c6cd93095b376","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e29a079b5c8","org_name":"Lifespan Physicians Group of Massachusetts, Inc.","org_type":"healthcare","ransomware":null,"records_affected":86,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lifespan%20Physicians%20Group%20of%20Massachusetts%2C%20Inc.%2C%20d/b/a/%20Brown%20Health%20Medical%20Group-MA-2026-07-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"503fb906b560f5c7343afe6825934271b6b01169","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02c0926f7c58","org_name":"Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA","org_type":"healthcare","ransomware":null,"records_affected":311760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-16-lifespan-physician-group-of-massachusetts-inc-d-b-a-brown-health-medical-group-m"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-16","discovered_date":"2026-05-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6859cb151c82380c99cb29eb66a8d6e770d144a7","impact_type":"data_theft","incident_date":"2026-05-21","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fox%20Rothschild%20LLP%20-%20sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"b50d47390380","org_name":"Fox Rothschild LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fox%20Rothschild%20LLP%20-%20sample%20notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005184"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41834.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fox%20Rothschild%20LLP-2026-07-16"}],"summary":"Fox Rothschild reported that an employee was targeted in a vishing attack and files containing personal information were copied and taken.","supporting_quote":"Our investigation determined that on May 21, 2026 the employee was the target of a social engineering attack, commonly referred to as “vishing”, and certain files were copied and taken.","technology_involved":["employee account","device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-16","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4a2f8c0a82d08dec407a2d02d64b896a5758505d","impact_type":"data_theft","incident_date":"2026-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DentaQuest%20-%20Adult%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"6e7575a75869","org_name":"DentaQuest, LLC","org_type":"healthcare","ransomware":null,"records_affected":15000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-16-dentaquest-llc"},{"fetched_at":null,"title":"Have I Been Pwned: DentaQuest","type":"hibp","url":"https://haveibeenpwned.com/Breach/DentaQuest"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DentaQuest%20-%20Adult%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005182"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DentaQuest%20LLC-2026-07-16"}],"summary":"DentaQuest reported unauthorized access to data on its computer network, and determined that personal information was accessed and posted online.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a01e495b6d4683cf29aa8ce8a25e740334830c2d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fde936c2bb2c","org_name":"Bath Fitter Distributing, Inc.","org_type":"other","ransomware":null,"records_affected":44,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bath%20Fitter%20Distributing%2C%20Inc.-2026-07-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-15","discovered_date":"2026-06-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"8d7a81abebfb3e8446d245d05c37b6dc369d9378","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b4bf4da54e74","org_name":"YouLend US LLC","org_type":"financial","ransomware":null,"records_affected":24951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005301"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629202"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20California%20Notice%20Letter%20YouLend%20US%20LLC%20-%20Wave%202.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#YouLend%20US%20LLC-2026-07-15"}],"summary":"YouLend US LLC reported unauthorized access to its network from June 5 to June 9, 2026, and acquisition of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9563c17c2617d70f1c6d169cd153cb86b4d3284d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f1f3bc353fd","org_name":"Resource Center of Dallas, Inc.","org_type":"healthcare","ransomware":null,"records_affected":12490,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-15-resource-center-of-dallas-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005181"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d422532ea195e383d826a488f32a5dce8c8dd14b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0469f971f488","org_name":"Port Harbor Marine","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Port%20Harbor%20Marine-2026-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-15","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e0bc707cc602050a9fc5ece2a9d4ad3868d5e9a5","impact_type":"unknown","incident_date":"2026-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"673f9f3245f9","org_name":"Oaks Park Association","org_type":"unknown","ransomware":null,"records_affected":356,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oaks%20Park%20Association-2026-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20e4599d36535c3392394aec6b46f1116c829f25","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"94faf80029d3","org_name":"North Coast Opportunities, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626543"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter_1.pdf"}],"summary":"An email sent on June 30, 2026, contained personal information that should not have been included.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2ad1a653837a0b10a3ffa025fca59e953466505c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1c1c2ffca5b","org_name":"National Association of Drug Abuse Programs, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#National%20Association%20of%20Drug%20Abuse%20Programs%2C%20Inc.-2026-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c9b8ae0b08c8f7e2f2f3f168e9bbe884a730bf2","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d13f31f69f3b","org_name":"Goose Creek Candle Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":6574121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Goose Creek","type":"hibp","url":"https://haveibeenpwned.com/Breach/GooseCreek"}],"summary":"Data including customer contact details and purchase information was reportedly obtained from Goose Creek Candle Company's Shopify instance.","supporting_quote":null,"technology_involved":["Shopify"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Shopify"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"263a169d1ef4","name":"Shopify"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8aad5b90e081e7d05ad893bb029578758221b2a","impact_type":"data_theft","imported_from":null,"incident_date":"2026-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8de9b02644f8","org_name":"Fluke","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fluke","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fluke"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Rmx1a2UgQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005167"}],"summary":"Fluke was targeted in a ShinyHunters extortion campaign, and data allegedly taken from the company was published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd63fbeac8c461d8e0ea08f84c758ef1b392d1b4","impact_type":"unknown","incident_date":"2026-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EY%20Notice%20Letter%20US%20General.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b252ab975f4d","org_name":"Ernst & Young LLP","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626542"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RXJuc3QgJiBZb3VuZ0BzaGlueWh1bnRlcnM"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005180"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ernst%20%26%20Young%20LLP-2026-07-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"84aff10b88b147411899b6488a630ae8da9309c3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b4050d27ce2e","org_name":"YMCA of Southern Maine","org_type":"nonprofit","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#YMCA%20of%20Southern%20Maine-2026-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-14","discovered_date":"2026-06-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"89cddf4b117952ef9570c4e885d849e010f5c492","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba9699eecb99","org_name":"The Washington Post","org_type":"retail_ecommerce","ransomware":null,"records_affected":36358,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005173"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Washington%20Post-2026-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8b2841ad93f98990a69fb9dd63e1d5074960d1ce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7c8ec02efa3","org_name":"Parkhurst Chiropractic Life Center PLC","org_type":"healthcare","ransomware":null,"records_affected":728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-14-parkhurst-chiropractic-life-center-plc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"ExfilSquad","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-14","discovered_date":"2026-06-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4d4f8f2d8cae3d7936a1e94f632ece7cd04513e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"96364dedacfb","org_name":"Frontier Airlines","org_type":"retail_ecommerce","ransomware":true,"records_affected":11482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005172"},{"date":"2026-07-26","fetched_at":null,"title":"Leak-site claim by ExfilSquad","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RnJvbnRpZXIgQWlybGluZXNARXhmaWxTcXVhZA"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Frontier%20Airlines-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"exfilsquad","claim_groups":["exfilsquad"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-14","discovered_date":"2026-06-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec75521a6d2f2e103a272d0988da53c3f33264c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e02184fe921d","org_name":"Case & Associates Properties","org_type":"retail_ecommerce","ransomware":null,"records_affected":3997,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005171"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c5315895f984adeb134427fe984156df82fbeffe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"436996c896a8","org_name":"Youth Home, Inc.","org_type":"healthcare","ransomware":null,"records_affected":689,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-13-youth-home-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc473e722ae94ad55ae6f763e70a0251fa33493e","impact_type":"data_theft","incident_date":"2025-07-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41741.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ba9699eecb99","org_name":"The Washington Post","org_type":"other","ransomware":null,"records_affected":514,"reviewed":false,"root_cause":"A previously unknown vulnerability in Oracle E-Business Suite permitted unauthorized access to the application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41741.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41741.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Washington%20Post-2026-07-13"}],"summary":"The Washington Post confirmed that attackers exploited a previously unknown Oracle E-Business Suite vulnerability to access and acquire data.","supporting_quote":"During our investigation, we learned that Oracle had identified a previously unknown and widespread vulnerability in its E-Business Suite software that permitted unauthorized actors to access many Oracle customers’ E-Business Suite applications.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f3d66c149098112dfc6109ee7fa060f12572fc","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SLACAL%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5247458cc979","org_name":"Surplus Line Association of California","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SLACAL%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Surplus%20Line%20Association%20of%20California-2026-07-14"}],"summary":"Surplus Line Association of California reported that files containing personal information were accessed and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da36206292c164fdd5b5642af43c606402e818ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3_1.pdf"},"notes":null,"org_country":"US","org_id":"9918527bf5ea","org_name":"McClarty Farms LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3_1.pdf"}],"summary":"McClarty Farms LLC reported that employee personal information may have been accessed or downloaded during unusual computer-network activity on June 5, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-13","discovered_date":"2025-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9ae6894e5ca80ec6df60c1f8283b8e00fe4f2ded","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Madera%20Community%20Hospital%20-%20Notice%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"6f13178acc06","org_name":"Madera Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":150810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-13-madera-community-hospital"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Madera%20Community%20Hospital%20-%20Notice%20Templates.pdf"}],"summary":"Madera Community Hospital detected unauthorized access to its computer network in late May 2025 and later had reason to believe a third party acquired files that may have contained personal or protected health information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"d29af36e51e8b04cbd9502bd159fb23906e02475","impact_type":"data_theft","incident_date":"2025-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20King%20Ocean%20Services%2C%20Ltd..pdf"},"notes":null,"org_country":"US","org_id":"430026f05217","org_name":"King Ocean Services, Ltd.","org_type":"transportation_logistics","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20King%20Ocean%20Services%2C%20Ltd..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20King%20Ocean%20Services%2C%20Ltd..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#King%20Ocean%20Services%20Limited-2026-07-11"}],"summary":"King Ocean Services reported that a third-party IT service provider experienced an incident that allowed an unauthorized party to access and acquire data on King Ocean servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df4f2ffe799c95af382ee9540eb08599abb7982b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-05","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3_0.pdf"},"notes":null,"org_country":"US","org_id":"53dca5efc8bd","org_name":"HMC Fresh Foods, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3_0.pdf"}],"summary":"HMC Fresh Foods reported that employee personal information may have been accessed or downloaded during a security incident involving its computer networks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-13","discovered_date":"2026-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38a30f8b7b9d6382ae72d1bc37c80807b1b85aa5","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"b427a74dfc81","org_name":"Harbor Developmental Disabilities Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626408"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letters.pdf"}],"summary":"Harbor Developmental Disabilities Foundation reported that an unauthorized individual may have accessed information during unusual network activity on March 6 and 7, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4439f2a5b0ff3068477ab12951e85e8be6a21627","impact_type":"unknown","incident_date":"2025-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Fiesta_-_Notice_Letter_39640227v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04f68e8aed54","org_name":"Fiesta Insurance Franchise Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626421"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005174"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fiesta%20Insurance%20Franchise%20Corporation-2026-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"11c03ceedfda3cde3382f76ac5e3e68a01fccdf4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f572f5cd5f83","org_name":"Fargo Park District","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fargo%20Park%20District-2026-07-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-16"},"first_seen":"2026-10-10","id":"a182840981d66a1d7d91bb6b0e3edcd4813bfd93","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-16","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf"},"notes":null,"org_country":"US","org_id":"a0d1bd58b195","org_name":"City of Foster City","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-631363"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626411"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-27469%20Foster%20City%20Adult%20CM%2012%20months%20r4prf_Redacted.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf"}],"summary":"The City of Foster City reported that an unauthorized third party accessed certain City systems and may have viewed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-16","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-13","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e882ed0e01ea92d050ed7b3a26f9bce6ddde9383","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3.pdf"},"notes":null,"org_country":"US","org_id":"1aec8e66c607","org_name":"Cabot Packing LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HMC_%20Adult_CM_Letter_Final_Live_Proof_R3.pdf"}],"summary":"Cabot Packing LLC reported unusual activity involving its computer networks, during which some employee personal information could have been accessed or downloaded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"41747d6d6a1b9ef70aaa523f8da9603b945b085c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df8d566a56c7","org_name":"Alpine Agency of the Midlands, LLC","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-13-alpine-agency-of-the-midlands-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a053ecd6bda53128ae970fabaa815d8f318af10e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5626b677108","org_name":"LIA Insurance Administrators, Inc.","org_type":"financial","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#LIA%20Insurance%20Administrators%2C%20Inc.-2026-07-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e8209386c0542479517eda126ccfcbfa413b41c7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf10651059be","org_name":"Wilmer Cutler Pickering Hale & Dorr LLP","org_type":"other","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Wilmer%20Cutler%20Pickering%20Hale%20%26%20Dorr%20LLP-2026-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e214a8555512108e526f885841fee34bd76e290","impact_type":"data_theft","incident_date":"2026-05-08","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_7.pdf"},"notes":null,"org_country":"US","org_id":"2ea35e6c418b","org_name":"Wilmer Cutler Pickering Hale and Dorr LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A personnel member provided information to an unauthorized third party who misrepresented their identity.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_7.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005268"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41816.pdf"}],"summary":"Wilmer Cutler Pickering Hale and Dorr LLP reported that a personnel member provided personal information to an unauthorized third party who misrepresented their identity.","supporting_quote":"On May 8, 2026, one of our personnel mistakenly provided information to an unauthorized third party who misrepresented their identity.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-10","discovered_date":"2026-06-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2aed086e8f3b0456e437060b23db78eea1195096","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d156abfd630","org_name":"The Law Offices of Rakesh Mehrotra","org_type":"other","ransomware":null,"records_affected":7148,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005168"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Law%20Offices%20of%20Rakesh%20Mehrotra-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5df53846b5506e9ffd5cabe5d81ac95e1e6ead96","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa4087868691","org_name":"The Estee Lauder Companies","org_type":"other","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Estee%20Lauder%20Companies-2026-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bd1b0ea5c0a138589e7f27647ca51dfbe318a5fa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec6a485a6c5c","org_name":"Sunshine Health","org_type":"healthcare","ransomware":null,"records_affected":41569,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-10-sunshine-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Laptop","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-10","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8707a331f54bd1a7ebc2168d47c6350a726b8d0","impact_type":"unknown","incident_date":"2026-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8cd79f3e224","org_name":"Rogue fabrication llc","org_type":"unknown","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rogue%20fabrication%20llc-2026-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-10","discovered_date":"2026-06-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd9715979956779c9f233f7fc5f7bc708602285a","impact_type":"unknown","incident_date":"2026-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9026bdfe8842","org_name":"Robinson Nursery, Inc","org_type":"unknown","ransomware":null,"records_affected":459,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Robinson%20Nursery%2C%20Inc-2026-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b2900ca280e75ef79e6676dbe364a3cd7433bd33","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb689c00af8d","org_name":"Rectory School","org_type":"education","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Rectory%20School-2026-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ca8ed3f388039c55353cce23b70f54a7ac250589","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b59dd4bce5c","org_name":"Heart Care Centers of Illinois","org_type":"healthcare","ransomware":null,"records_affected":52562,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-10-heart-care-centers-of-illinois"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"95950952b3fe78f073ac06a0d7c12ad805b204e6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e912faf1c8c","org_name":"Health Payment Systems, Inc.","org_type":"professional_services","ransomware":null,"records_affected":9380,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-10-health-payment-systems-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-10","discovered_date":"2026-05-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee0db13577146f8a542dc3ba47abe7a7612a1a48","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ec3fab4fedd","org_name":"First National Holdings, LLC","org_type":"financial","ransomware":null,"records_affected":35693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005166"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#First%20National%20Holdings%2C%20LLC-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"39d67906e23c4cce011b3dced52ba7310762285b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6635d751c934","org_name":"Premier Select Sires, Inc.","org_type":"other","ransomware":null,"records_affected":376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Premier%20Select%20Sires%2C%20Inc.-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25d7c486395fc3ec511b7bcad31fc6e53fc19883","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41689.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3c42edcf1ab3","org_name":"Lincoln Technical Institute","org_type":"education","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41689.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41689.pdf"}],"summary":"Lincoln Technical Institute notified individuals that information stored in Canvas may have been involved in unauthorized activity affecting Instructure.","supporting_quote":null,"technology_involved":["Canvas"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Instructure Holdings, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"178b0e9ee966","name":"Instructure"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-07-09","discovered_date":"2026-04-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab3f109b58e2e202e93cfc0657b5b4b61193e855","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lincoln%20Tech%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"3c42edcf1ab3","org_name":"Lincoln Technical Institute","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lincoln%20Tech%20Individual%20Notice.pdf"}],"summary":"Lincoln Technical Institute notified individuals that information stored in Canvas may have been involved in unauthorized activity affecting Instructure’s platform.","supporting_quote":null,"technology_involved":["Canvas"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Instructure"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"178b0e9ee966","name":"Instructure"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"886265065781503eb118a6845e6c6cfa8d6ca3bc","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41687.pdf"},"notes":null,"org_country":"US","org_id":"c457be80ef79","org_name":"Frederick Goldman, Inc","org_type":"manufacturing","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41687.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41687.pdf"}],"summary":"Frederick Goldman, Inc. reported that a third party infiltrated its computer systems and obtained files containing W-2 information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0021317c25b1875597a86736b00fd0fc945f4179","impact_type":"data_theft","incident_date":"2026-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41690.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"80e8fa39386f","org_name":"Columbia Machine, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":1276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41690.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41690.pdf"}],"summary":"Columbia Machine reported that an unauthorized actor accessed its systems and viewed and copied files containing information related to affected individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"40ef8c7aa2ee5b93c93e1ef5910ec94778d8f718","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10774828636f","org_name":"Brooks, Cook & Associates","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Brooks%2C%20Cook%20%26%20Associates-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"893c8172ce368c73944e016b4aa9f5c93f33f5ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08d5a6f12caf","org_name":"ABC Phones of North Carolina, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ABC%20Phones%20of%20North%20Carolina%2C%20Inc.%2C%20d/b/a%20Victra-2026-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-08","discovered_date":"2026-07-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"587c14a8e692ab66aa06078f73616083780293ac","impact_type":"unknown","incident_date":"2026-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29c74ccbcb88","org_name":"Vernier Science Education","org_type":"unknown","ransomware":null,"records_affected":136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vernier%20Science%20Education-2026-07-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"677f6b4554717f16d419da68f5836a9a59281fe9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"790ad6b73ccc","org_name":"Connecticut Wealth Management, LLC","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Connecticut%20Wealth%20Management%2C%20LLC-2026-07-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0172aa1d09bdd18cbab4a727be5580d24e76ec19","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5521d206899","org_name":"Claremedica Viking, LLC","org_type":"healthcare","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-08-claremedica-viking-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d87d7987143e18eb37c857d3f099f0a81e8252f8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d331806bd36d","org_name":"Bob O'Link Golf Course","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bob%20O%27Link%20Golf%20Course-2026-07-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-07","discovered_date":"2026-06-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a51db408691bd70ad7abb77543e5d5e81d925d7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bbe1756ff936","org_name":"YKK AP America Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":368,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005160"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"aec0f6c1231680830868f3e87d958552ceea6ecb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4df524876b29","org_name":"T.A. Solberg Co., Inc","org_type":"healthcare","ransomware":null,"records_affected":1012,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-07-t-a-solberg-co-inc"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#T.A.%20Solberg%20Co.%2C%C2%A0Inc.-2026-07-06"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-07","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3b29ec8da3467e3bd74743670b79b1689a43f1c1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"082834fec8d1","org_name":"SportsMed PT, LLC","org_type":"healthcare","ransomware":null,"records_affected":3400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-07-sportsmed-pt-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"termite","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dd4bc9447917e29bf5f4bb31a77940d673df08ec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d2dd32903e7","org_name":"Roland Machinery Company","org_type":"other","ransomware":true,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Roland%20Machinery%20Company-2026-07-07"},{"date":"2026-06-08","fetched_at":null,"title":"Leak-site claim by termite","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Um9sYW5kIE1hY2hpbmVyeUB0ZXJtaXRl"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"actor_id":"termite","claim_groups":["termite"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-07","discovered_date":"2026-06-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d56c2f6b88639958ab8486d9cc29013b89a440a7","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72e0a293db8b","org_name":"Nacogdoches County, Texas","org_type":"government","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005163"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e9c867fc6268f70f43882dfb679ae2155c38f7e0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3aba242ab83","org_name":"Hudson Valley Medical Billing & Credentialing, LLC","org_type":"professional_services","ransomware":null,"records_affected":5459,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-07-hudson-valley-medical-billing-credentialing-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4a5d067668c82f02fec247ed191097b5425526ae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61050bbc4330","org_name":"Hollister Family Dental & Implant Center","org_type":"healthcare","ransomware":null,"records_affected":3809,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-07-hollister-family-dental-implant-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-07","discovered_date":"2026-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"85323c8e5f4afee8cec50e37577a548899d1a631","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95b393d65630","org_name":"1Life Healthcare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":141075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005165"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4c17822525161d22b0239e8c11fd54880b22d79e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8bd2223a57f","org_name":"The Medical Imaging Partnership dba Precision Imaging Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-06-the-medical-imaging-partnership-dba-precision-imaging-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3ed0d5abb2ac5f3dcfc90869606e33c6b588ccbe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"36451ed4eb88","org_name":"HP Dental","org_type":"healthcare","ransomware":null,"records_affected":548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-06-hp-dental"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"70592c4d540256d7343d6a2266ea1338bed08a17","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a7cffe37091","org_name":"Hancock Regional Hospital","org_type":"healthcare","ransomware":null,"records_affected":1530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-06-hancock-regional-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"80da2c837b29279ca38f80aaf9e4d35443714690","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5381793839f4","org_name":"FHT Advisors","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#FHT%20Advisors-2026-07-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"incransom","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c3b8b8ff0c39559053131ca7086aba0792811bbf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae3af24d87f4","org_name":"Champaign-Urbana Public Health District","org_type":"healthcare","ransomware":true,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-06-champaign-urbana-public-health-district"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2hhbXBhaWduLVVyYmFuYSBQdWJsaWMgSGVhbHRoIERpc3RyaWN0QGluY3JhbnNvbQ"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"incransom","claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-03","discovered_date":"2026-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"00344fbd52a086265879d08743248affc21355e0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa2b2aafbd21","org_name":"RealLedgers Financial, PLLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005156"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-03","discovered_date":"2026-03-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad399c19f1b64ef103c84e1f2c060538fd383505","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a905cceaba59","org_name":"Q2 Artificial Lift Services","org_type":"other","ransomware":null,"records_affected":2462,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005154"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-07-03","discovered_date":"2026-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"550a89f86f2672a3e7d6ce5932e4e63c4fae12c1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41592.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e031362be3a3","org_name":"One Medical","org_type":"healthcare","ransomware":null,"records_affected":16884,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41592.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41592.pdf"}],"summary":"An unauthorized person accessed patient files stored in a third-party file-storage system used for One Medical Seniors archived information.","supporting_quote":null,"technology_involved":["third-party file-storage system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df807622c9a14082c4a55cadac4ca0f15e084709","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bec941ccc3f1","org_name":"Moody Bible Institute","org_type":"education","ransomware":true,"records_affected":2303416,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Moody Bible Institute","type":"hibp","url":"https://haveibeenpwned.com/Breach/MoodyBibleInstitute"}],"summary":"Moody Bible Institute was targeted in a ShinyHunters extortion campaign, and personal data relating to donors, supporters, students and alumni was published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-03","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f1d8d99516d18d156d65e9d86ef737887e026e5a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"378a93b4d88a","org_name":"Lake Region Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":167617,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005157"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-03","discovered_date":"2026-05-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c4d8f800ce066844eb97ca23d225b3b4027d1e99","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2b1b85ee2e9","org_name":"CNO Services, LLC","org_type":"financial","ransomware":null,"records_affected":11786,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005155"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-03","discovered_date":"2026-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"80458d95a274cd1826417cc749b40000db618a79","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alta%20Orthopaedics%20-%20CA%20AG%20Notice%20Letter%20%26%20Exhibits%20_0.pdf"},"notes":null,"org_country":"US","org_id":"76308108d718","org_name":"Alta Orthopaedics Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":24496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-03-alta-orthopaedics-medical-group-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626178"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alta%20Orthopaedics%20-%20CA%20AG%20Notice%20Letter%20%26%20Exhibits%20_0.pdf"}],"summary":"Alta Orthopaedics Medical Group discovered unusual activity on its network and found that information may have been accessed without authorization between February 3 and February 6, 2026.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-07-03","discovered_date":"2026-05-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d9207c8e0d3b9e805803d3a08f3ad38318107714","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6bf76640f035","org_name":"Advantive LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":4977,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005158"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Advantive%20LLC-2026-07-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-07-02","discovered_date":"2026-04-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2f2f335ae22bbc2ba3048dba380522843525728","impact_type":"data_theft","incident_date":"2026-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"0c6f4c7a6451","org_name":"TriWest Healthcare Alliance","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification_2.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005161"}],"summary":"TriWest Healthcare Alliance reported that an unauthorized person accessed and downloaded information, including names, benefit numbers, ZIP codes, and authorization request types.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-02","discovered_date":"2026-04-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2d57d3da35218c108e2c603d9a2ac0aee9f74359","impact_type":"unknown","incident_date":"2026-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d4857e2a1cec","org_name":"The Reserve Vineyards & Golf Club","org_type":"unknown","ransomware":null,"records_affected":1258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Reserve%20Vineyards%20%26%20Golf%20Club-2026-07-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-02","discovered_date":"2026-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9a3c6ab7b458da1c1c5d55baea0666154eabdd30","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"105264d268d9","org_name":"Navient Corporation","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1593538/000114036126027441/ef20077249_8k.htm"}],"summary":"A ransomware attack on a third-party law firm exposed Navient-related borrower information maintained in the firm’s systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"JSM","base_day":"2026-07-02","returns":{"1":{"day":"2026-07-06","raw":-0.0022,"adj":-0.0109},"5":{"day":"2026-07-10","raw":-0.0158,"adj":-0.0295},"21":{"day":"2026-08-03","raw":-0.0222,"adj":-0.0395},"63":{"day":"2026-10-01","raw":-0.0752,"adj":-0.101}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48613711a159aa741365c247cb29c4fa7836f9d0","impact_type":"unknown","incident_date":"2026-03-17","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Sample%20Individual%20Notice%20%2807.02.2026%29.pdf"},"notes":null,"org_country":"US","org_id":"d082b0d4d211","org_name":"Markel Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Social engineering deceived two employees and was used to gain access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Sample%20Individual%20Notice%20%2807.02.2026%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005162"}],"summary":"An unauthorized actor used social engineering to deceive two Markel Insurance employees and access a limited portion of its systems.","supporting_quote":"We recently identified that an unauthorized actor used social engineering to deceive two employees to gain access to a limited portion of Markel’s systems between March 17-18, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-02","discovered_date":"2026-01-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a45331d33af4a3d0ec54e7609aa8823d97f7a60d","impact_type":"unknown","incident_date":"2026-01-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6f1cddc0d2ae","org_name":"Lifeways, Inc.","org_type":"unknown","ransomware":null,"records_affected":343,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lifeways%2C%20Inc.-2026-07-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-07-02","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8888183b3c3137e87598bfacae4eb251b80c6c51","impact_type":"data_theft","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L.A.%20Care%20Breach%20Notification%20Letter%201.pdf"},"notes":null,"org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625951"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L.A.%20Care%20Breach%20Notification%20Letter%201.pdf"}],"summary":"An unauthorized third party accessed Conduent’s environment and obtained files containing L.A. Care Health Plan members’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Conduent Business Services LLC"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fc91e0512bde","name":"Conduent Business Services LLC"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"25082a29f56dba53fe7dea6ee71c009f628680ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89fa9d87a1f5","org_name":"Family Medical Associates of Raleigh, PA","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-02-family-medical-associates-of-raleigh-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-02","discovered_date":"2025-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9801e21631d6ac06d0bae16a0134fb69eb04c2c5","impact_type":"data_theft","incident_date":"2025-11-11","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41560.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0adc462ef243","org_name":"Evergreen Children’s Association","org_type":"unknown","ransomware":null,"records_affected":511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41560.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41560.pdf"}],"summary":"Evergreen Children’s Association reported that an unauthorized actor accessed or acquired certain data between November 11 and November 12, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"48bebf1c3abb9495d07653ec603f9003fb4b43bb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4fe02d208b42","org_name":"Cottage Hospital","org_type":"healthcare","ransomware":null,"records_affected":932,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cottage%20Hospital-2026-07-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b529c6f2392c96e2d7fb562352d2cf8aac1e549","impact_type":"unknown","incident_date":"2016-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Child_Care_Resource_Center_-_Notice_Letter_39453094v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79fa2075de15","org_name":"Child Care Resource Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625925"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"24cc901ad2262c2682104dc74e71e6e095379503","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"75fbf12e47a4","org_name":"Averhealth Holdings","org_type":"healthcare","ransomware":null,"records_affected":9909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-02-averhealth-holdings"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Averhealth%20Holdings-2026-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d6bde848120d4dabbfb3a710c9a11955808cdae8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22bbe838626a","org_name":"The Connecticut Institute for the Blind Inc. d/b/a Oak Hill","org_type":"healthcare","ransomware":null,"records_affected":1556,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-07-01-the-connecticut-institute-for-the-blind-inc-d-b-a-oak-hill"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"58d18133810b429750e4b5ccf3f798857734ce1e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8f0c640c41c","org_name":"Phoenix Environmental Laboratories, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Phoenix%20Environmental%20Laboratories%2C%20Inc.-2026-07-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-07-01","discovered_date":"2026-06-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"257fe0918542fd58a6454df8742a1ac7f8383676","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6762e8920e5c","org_name":"EMA Engineering & Consulting, Inc.","org_type":"other","ransomware":null,"records_affected":510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005152"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-30","discovered_date":"2025-11-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cf359746f7d5e685e9c22bf41419ed3869008cf0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"726a48d89acf","org_name":"Yellow Corporation and its affiliated debtors and debtors-in-possession under their jointly administered chapter 11 cases (Case No. 23-11069 (Bankr. D. Del. (CTG))","org_type":"retail_ecommerce","ransomware":null,"records_affected":258781,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005145"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-30","discovered_date":"2025-03-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4c253b7d881449804f8e9a4a15880e4cb9599f5c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dab2adc4441a","org_name":"Wellpoint","org_type":"financial","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005148"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2a4a47a2cfbb976e32f428a16938a1bfd42c4473","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-23","initial_access":"insider","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41515.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e05edfafdc09","org_name":"Washington State Department of Social and Health Services","org_type":"government","ransomware":null,"records_affected":8600,"reviewed":false,"root_cause":"A DSHS employee accessed personal information in an internal client data system for reasons unrelated to their work.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41515.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41515.pdf"}],"summary":"A DSHS employee accessed personal information in an internal client data system for reasons unrelated to their work.","supporting_quote":"In March 2026, we discovered that a DSHS employee had accessed personal information from a DSHS internal client data system for reasons unrelated to their work.","technology_involved":["DSHS internal client data system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"03f145e2000c4957630809f0ab8d3b19dd5a6fa4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1afdddbbc654","org_name":"Washington Department of Social and Health Services","org_type":"healthcare","ransomware":null,"records_affected":8600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-30-washington-department-of-social-and-health-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"871c766e1f75b72b3ec905eb9845ce83df0a8fec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c17a79587d9","org_name":"Virta Health","org_type":"professional_services","ransomware":null,"records_affected":602,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-30-virta-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fe6fd6ca490841b5e964e5c94a59a0deb92b1505","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfd0b67c193f","org_name":"North Los Angeles County Regional Center","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#North%20Los%20Angeles%20County%20Regional%20Center-2026-06-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-30","discovered_date":"2026-05-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"e0b7416074302ed6a139cd2bba91cb94b668276f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db9f392abc04","org_name":"Monmouth University","org_type":"education","ransomware":null,"records_affected":399600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005274"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monmouth%20-%20Adult%201%20Year%20CM%20Proof%20%28FINAL%29.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Monmouth%20University-2026-06-30"}],"summary":"An unauthorized third party acquired files from Monmouth University’s network, which could contain personal, financial, medical, and login information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0124f54b289201fc542e534720e8e1f380a81a80","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84cdacc74b68","org_name":"Kubota Tractor Corporation Employee Welfare Benefit Plan","org_type":"healthcare","ransomware":null,"records_affected":5891,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-30-kubota-tractor-corporation-employee-welfare-benefit-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-06-30","discovered_date":"2026-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"719a8d4c4eb3f39a27807c0d811fca712a7e2e58","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kubota_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"a3b6357bd4fd","org_name":"Kubota North America Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625723"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kubota_CA%20Sample.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005150"}],"summary":"Kubota North America Corporation reported unauthorized access to network systems, during which files maintained by its human resources team were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b60da993c457d71d9fcfd932b685a459c3680bc","impact_type":"data_theft","incident_date":"2026-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reframe%20-%20Sample%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"919f97b6aa2a","org_name":"Glucobit Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reframe%20-%20Sample%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005151"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Glucobit%2C%20Inc.-2026-06-30"}],"summary":"Personal information uploaded to Reframe was downloaded without authorization from a system accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2489347583d0b8419ad36f924084f7907d8aa088","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2e1154f20a20","org_name":"Travala Pte. Ltd.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Travala%20Pte.%20Ltd.-2026-06-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a6f2d861d408b0c4202f332fa7843754a2293c63","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"459768c78b13","org_name":"Optalis Management Solutions","org_type":"healthcare","ransomware":null,"records_affected":13723,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-29-optalis-management-solutions"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-29","discovered_date":"2026-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"819ad939a8b29bf9fe35c9c1bc8feeb69e529719","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20-%20Exhibit%20A%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"fabc5edce44d","org_name":"Medtronic","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20-%20Exhibit%20A%20%281%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005149"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medtronic%20Inc.-2026-06-29"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Medtronic%20Inc.-2026-06-28"}],"summary":"Medtronic reported that an unauthorized actor accessed certain corporate IT systems, and personal and health-related information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ca3371387f998cc4c8d6e234cab5df35314758c1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf6b0dfc3cb4","org_name":"Center for Hearing and Speech dba Texas Hearing Institute","org_type":"healthcare","ransomware":null,"records_affected":29774,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-29-center-for-hearing-and-speech-dba-texas-hearing-institute"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005147"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8d0f17994a89f4ddc28bdb7a1a11693cffe9d5c","impact_type":"both","imported_from":null,"incident_date":"2026-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"edd90876e6bb","org_name":"Sysco","org_type":"other","ransomware":true,"records_affected":2691852,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sysco","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sysco"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3lzY28gQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sysco%20Corporation-2026-07-28"}],"summary":"Sysco was targeted in a ShinyHunters pay-or-leak extortion campaign, and data containing contact information and customer feedback was published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"695d71d4807de50f32b743ede2c6bbc47d2df8ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1acaebc65f9","org_name":"Yellow Corporation and affiliated debtors","org_type":"other","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Yellow%20Corporation%20and%20affiliated%20debtors-2026-06-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad9f8a0dc8bb8825987f7a882bb7ea1fed7a626d","impact_type":"data_theft","incident_date":"2025-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41494.pdf"},"notes":null,"org_country":"US","org_id":"3653d130a5fd","org_name":"Yellow Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41494.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41494.pdf"}],"summary":"Yellow Corporation reported that files containing personal, financial, and medical information were accessed and exfiltrated without permission on March 27, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-06-26","discovered_date":"2025-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed86c194d4eefdc4829b482f83256a33f76e0a90","impact_type":"data_theft","incident_date":"2025-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yellow%20Corporation%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"3653d130a5fd","org_name":"Yellow Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625494"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yellow%20Corporation%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Yellow%20Corporation.pdf"}],"summary":"Yellow Corporation reported that files containing personal, financial, and medical information were accessed and exfiltrated without permission on March 27, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fc12697ad9bcddce421673f93af8ca45e0f11ef1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"30d21a36fed6","org_name":"Women’s Center for Radiology","org_type":"healthcare","ransomware":null,"records_affected":66422,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-26-women-s-center-for-radiology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-05-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6752492740a6c6a079fd10b1c91bf30a81a475f7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d372a8ab06c0","org_name":"Texas Parks and Wildlife","org_type":"government","ransomware":null,"records_affected":3187000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005135"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-02-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3e10cb1e1e78fe354eee1fd76abc9c3e2b5f5598","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6db1b597ae0","org_name":"Takeda Pharmaceuticals USA, Inc.","org_type":"other","ransomware":null,"records_affected":2435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005136"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-06-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fab5a5146c8905cb3bf878ca766b742d1d42bbde","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc63aed280b2","org_name":"Spencer & Associates Therapeutic Alliance,  PLLC","org_type":"healthcare","ransomware":null,"records_affected":405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005137"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"649b937ac33107971e12ed2732a4b8253b6ca88f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb5a67881352","org_name":"SKR Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1718,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-26-skr-group-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"12c6e11f06e2fcd448591f205de611415a23f9b5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1744e93aadf9","org_name":"Perruzi Buick GMC, Inc.","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Perruzi%20Buick%20GMC%2C%20Inc.-2026-06-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68013404829ca41a420056dbd2fe4cc66a87f807","impact_type":"data_theft","incident_date":"2026-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/June%2025%202026%20Former%20Employee%20Communication%20Cybersecurity%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"a6a0ebe0b8ff","org_name":"Nissan North America Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625558"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/June%2025%202026%20Former%20Employee%20Communication%20Cybersecurity%20Incident.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005144"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Nissan%20North%20America%2C%20Inc.-2026-06-27"}],"summary":"Nissan North America reported that personal information in employee records managed with Oracle PeopleSoft was accessed in a cyber event.","supporting_quote":null,"technology_involved":["Oracle PeopleSoft"],"third_party":{"archetype":null,"involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"195cb33c28a73054431feb2bd8569990522f75b5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"80b66a1410c8","org_name":"New Apostolic Church USA","org_type":"nonprofit","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#New%20Apostolic%20Church%20USA-2026-06-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-03-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1b702a73ae9b8e8e22a90e74be2098c10840c644","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d66c004114a","org_name":"Mercor.io Corporation","org_type":"other","ransomware":null,"records_affected":21677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005138"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Mercor.io%20Corporation-2026-06-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"158a894c7ffdd08efecc83cf29b0772bbd57bddb","impact_type":"data_theft","incident_date":"2026-03-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24486.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"865a928cee8c","org_name":"Mercor","org_type":"technology_saas","ransomware":null,"records_affected":633,"reviewed":false,"root_cause":"An unauthorized actor inserted malware into certain versions of the code scanning tool Mercor used.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24486.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24486.pdf"}],"summary":"Malware inserted into a code scanning tool used by Mercor enabled an unauthorized actor to access its systems and download data.","supporting_quote":"Unfortunately, Mercor was one of the companies that used this tool, and the malware enabled the unauthorized actor to access some of our systems between March 24-30, 2026.","technology_involved":["LiteLLM code scanning tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"LiteLLM"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"2081ee3bcfd3","name":"LiteLLM"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"66e4eef4fb5cca0f7413981aead67e57ef04491f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MCBS%20L1%20Adult%20CM%20Redacted%20for%20State%20AG%20Notice%2838517914.1%29%2839005181.2%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e431a516258b","org_name":"MCBS, LLC","org_type":"professional_services","ransomware":null,"records_affected":1261464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-26-mcbs-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625528"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005146"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20MCBS%2C%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"692b89b0667919fccbf9ffa98cf15ac1e5c84677","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5043a75228d3","org_name":"Gilman Brothers Company","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Gilman%20Brothers%20Company-2026-06-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-03-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df02edee27072eed642dec2f5dac90eb6917ac19","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b17eb75b5e8","org_name":"Congregate Care Outreach Management LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005140"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-05-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"131c392d8d5c86bef972ec9ee39fb049d4b36d2c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d4e20ffd2949","org_name":"Challenge Mfg. Company, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":24211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005143"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Challenge%20Mfg%2C%20Company%2C%20LLC-2026-06-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-06-26","discovered_date":"2026-05-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48f7df0d3b9e15da4d1749ec997f1d69df7053f9","impact_type":"data_theft","incident_date":"2026-05-21","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blank%20Rome%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"b59e1dc5ef10","org_name":"Blank Rome LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party impersonated the organization's IT department and deceived an attorney into uploading files to an external Google Drive account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625527"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blank%20Rome%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005142"}],"summary":"Blank Rome LLP reported that an unauthorized caller impersonating IT deceived an attorney into uploading files containing personal information to an external Google Drive account.","supporting_quote":"On May 21, 2026, we experienced an incident in which an unauthorized third party called one of our attorneys, posed as our IT department, and misled the attorney into uploading files to an external Google Drive account .","technology_involved":["Google Drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":"2026-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbb6a13a4a715c6d747b88d42acbb139dbf8339c","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_36.pdf"},"notes":null,"org_country":"US","org_id":"ca33c58fbbe2","org_name":"AssetMark","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625610"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_36.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005113"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AssetMark%2C%20Inc.-2026-06-11"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AssetMark%2C%20Inc.-2026-06-11"}],"summary":"An unauthorized user accessed and downloaded files containing AssetMark customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8df033d9a5232335b8d0330d73231fe366a8f083","impact_type":"both","imported_from":null,"incident_date":"2026-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"70fb0b6a0e3c","org_name":"American Tower","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: American Tower","type":"hibp","url":"https://haveibeenpwned.com/Breach/AmericanTower"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QW1lcmljYW4gVG93ZXIgQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz"}],"summary":"American Tower was targeted in a ShinyHunters extortion campaign, and data allegedly taken from the company was published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-25","discovered_date":"2026-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02291741cccc59bce9d4f4e9f6b2470ce357169c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tower_Individual%20letter%20example.pdf"},"notes":null,"org_country":"US","org_id":"65f89cfded47","org_name":"Tower Administrative Services, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625462"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tower_Individual%20letter%20example.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005141"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Tower%20Administrative%20Services%2C%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tower%20Administrative%20Services%2C%20Inc.-2026-06-26"}],"summary":"Tower Administrative Services identified unauthorized access or acquisition of information in its systems on or around February 3, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-25","discovered_date":"2026-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f157adad39f5d16bf3ef8022b94b6b88768b8f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Santa%20Monica%20Community%20College%20-%20Exhibit%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"0950750f5033","org_name":"Santa Monica Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625455"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Santa%20Monica%20Community%20College%20-%20Exhibit%20A_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Santa%20Monica%20Community%20College-2026-06-25"}],"summary":"Santa Monica Community College reported that employee W-2s were emailed to two former student workers and that the information was subject to unauthorized access.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"40419699f4b82627e8f1d88073c8343c11fa9c49","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a70fef8825af","org_name":"Operation PAR, Inc.","org_type":"professional_services","ransomware":null,"records_affected":145714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-25-operation-par-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"lapsus$","variety":"organized_crime"},"attack_techniques":["T1041","T1195","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd44831bf7575daf6ab4bca9d5fec4c7e36eeb15","impact_type":"data_theft","incident_date":"2026-03-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mercor%20-%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"865a928cee8c","org_name":"Mercor","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"Malware inserted into versions of LiteLLM's code scanning tool enabled an unauthorized actor to access Mercor's systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625431"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mercor%20-%20Consumer%20Notice.pdf"},{"date":"2026-05-31","fetched_at":null,"title":"Leak-site claim by lapsus$","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TUVSQ09SQGxhcHN1cyQ"}],"summary":"Malware in a code scanning tool used by Mercor enabled an unauthorized actor to access its systems and download data.","supporting_quote":"Unfortunately, Mercor was one of the companies that used this tool, and the malware enabled the unauthorized actor to access some of our systems between March 24-30, 2026.","technology_involved":["LiteLLM","code scanning tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"LiteLLM"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"2081ee3bcfd3","name":"LiteLLM"}],"actor_id":"lapsus$","claim_groups":["lapsus$"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-06-25","discovered_date":"2025-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d65f2d402a5bb96e6e6678dcbcc18c04f701ff","impact_type":"data_theft","incident_date":"2025-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hausfeld%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"22cd7cfe9f50","org_name":"Hausfeld LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625436"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hausfeld%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown unauthorized actor accessed Hausfeld computer systems and accessed and/or acquired files stored on them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-25","discovered_date":"2025-09-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0c41e41a3618f5f2daee264232a801e81c94b5b0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"30283df10b4a","org_name":"Central Kansas Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":37610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005134"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89bc70f629cf837f4e52ff5bf82a5b8c8454d104","impact_type":"data_theft","imported_from":null,"incident_date":"2026-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bd2f1eb7a1bd","org_name":"Madison Square Garden Sports","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Madison Square Garden Sports","type":"hibp","url":"https://haveibeenpwned.com/Breach/MadisonSquareGardenSports"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWFkaXNvbiBTcXVhcmUgR2FyZGVuIFNwb3J0cyBDb3JwLkBzaGlueWh1bnRlcnM"}],"summary":"Madison Square Garden Sports was targeted in a ShinyHunters extortion campaign, and the group later published alleged data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12404d767f10c2cec91457240772359b43f697ec","impact_type":"data_theft","incident_date":"2025-12-12","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eisen%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a71e5c8ae90b","org_name":"Eisen, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee provided the file after believing a fraudulent government inquiry was legitimate.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eisen%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Eisen, Inc. provided a file containing personal and unclaimed property balance information to an attacker impersonating the California State Controller's Office.","supporting_quote":"Believing the request t o be a legitimate government inquiry, an employee provided the file.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"06ba12be1630a874eed963b815fa848fa771122d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d33d0e3d699d","org_name":"CG Black Financial Services","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#CG%20Black%20Financial%20Services-2026-06-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-24","discovered_date":"2026-04-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"990b96d1fde1e8c4cbb5eabe846eaf5340e2c28a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AgelessRx%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b1a47a5fabea","org_name":"AgelessRx","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625334"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AgelessRx%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AgelessRx-2026-06-24"}],"summary":"AgelessRx reported that an unauthorized actor accessed certain help-desk tickets containing personal and health information.","supporting_quote":null,"technology_involved":["help-desk ticketing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-23","discovered_date":"2026-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6a50a2f2b72a8c121d5a9b3134eecc60587b434","impact_type":"data_theft","incident_date":"2026-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41440.pdf"},"notes":null,"org_country":"US","org_id":"0b885f146219","org_name":"Schmiidt & Battaglino Tax & Accounitng Inc.","org_type":"professional_services","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41440.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41440.pdf"}],"summary":"An unauthorized party accessed the firm's system, and fraudulent tax returns were filed using Social Security numbers of affected clients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","other"],"disclosed_date":"2026-06-23","discovered_date":"2026-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a76c004a2e31a6178b5351d7986f2f7d37c66d14","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG_Glendale_Website%20notice.pdf"},"notes":null,"org_country":"US","org_id":"4181c287d033","org_name":"Glendale Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625293"},{"fetched_at":null,"title":"Have I Been Pwned: Glendale Community College","type":"hibp","url":"https://haveibeenpwned.com/Breach/GlendaleCommunityCollege"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG_Glendale_Website%20notice.pdf"}],"summary":"Glendale Community College reported that data related to student educational records was potentially copied without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-23","discovered_date":"2025-11-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfc3c700680b6dee45687da50c765c0da268dc85","impact_type":"data_theft","incident_date":"2025-11-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/First%20Advantage%20Corporation%20-%20Individual%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"a5cc727f8ad2","org_name":"First Advantage Corporation","org_type":"professional_services","ransomware":null,"records_affected":51472,"reviewed":false,"root_cause":"Phishing gave an unauthorized third party access to an employee’s account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625323"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/First%20Advantage%20Corporation%20-%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005298"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#First%20Advantage%20Corporation-2026-06-24"}],"summary":"An unauthorized third party used phishing to access a First Advantage employee’s account and download the contents of the employee’s email inbox.","supporting_quote":"On November 17, 2025, First Advantage became aware that an unauthorized third party obtained access through sophisticated phishing to a single First Advantage Drug & Occupational Health Screening Unit employee’s account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f021cb196312c3c7ab2da2a54c6d880592af64c0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b15556ea1496","org_name":"Elara Caring","org_type":"healthcare","ransomware":null,"records_affected":22172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-23-elara-caring"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005033"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005132"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ef1b76079fb886ecf9f5b80c62ab43084c994ee8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4361e072e7fd","org_name":"Cure Dental","org_type":"healthcare","ransomware":null,"records_affected":878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-23-cure-dental"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005176"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e53246afcd37d9471ba674692739519bdff9c7c2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78b6e35830cc","org_name":"City of La Vergne, Tennessee","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#City%20of%20La%20Vergne%2C%20Tennessee-2026-06-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"cf6c141c33a472c5364c953c80ae314d70278957","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5562aa45b0a4","org_name":"AssuranceAmerica General Managing Agency, LLC","org_type":"financial","ransomware":null,"records_affected":272,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#AssuranceAmerica%20General%20Managing%20Agency%2C%20LLC-2026-06-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2985fb8a380e3057d8dfd6590ced2547b19dad30","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e02da38f0d1","org_name":"Anatomic and Clinical Laboratory Associates, P.C.","org_type":"healthcare","ransomware":null,"records_affected":169626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-23-anatomic-and-clinical-laboratory-associates-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d7022f32f23730722c6f228d35cc44ae9550983c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b6d3c6e5591","org_name":"Advocate Warriors LLC","org_type":"healthcare","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-23-advocate-warriors-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"cbe9477cc9a9283115157453a336528728f47251","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e4031cb597c0","org_name":"The Fedcap Group, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Fedcap%20Group%2C%20Inc.-2026-06-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-22","discovered_date":"2026-05-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02aa105ec41204f494a7a2889ad58f6b70ff1767","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"03642aff9ad3","org_name":"Ray Riding Motors, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005125"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"e4b0c2a1b40e4949b57bad51dfc929cb9ebc4de0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8cfd08b99805","org_name":"O'Leary-Guth Law Office, S.C.","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#O%27Leary-Guth%20Law%20Office%2C%20S.C.-2026-06-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7ae2df839a3d3006b493dc551da4fc10111ef37e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55afefd21248","org_name":"Northeast Professional Caregivers","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-22-northeast-professional-caregivers"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-22","discovered_date":"2026-04-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2666cdebc769ae5c8a0bcdf2a074b9e3336b60eb","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90c05641d3d6","org_name":"Ludlum Measurements, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005128"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-22","discovered_date":"2026-06-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e471ca6367dee70542423d968cb3614daec383b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6fb1d51acf14","org_name":"Finch CPA Firm PLLC","org_type":"financial","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005123"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"95ebde6a209f1ab6eed75abe85c0dce65b30af0b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9fa30977cd0b","org_name":"Essex Westford School District","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Essex%20Westford%20School%20District-2026-06-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"927a77d7afd23825e0883530ff16e41fe6feb787","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1fe87ca54f3f","org_name":"Chicago Family Health Center","org_type":"healthcare","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-22-chicago-family-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-22","discovered_date":"2026-05-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a395e0d772e574573cf74e148d3277905570eaec","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1a1f19eaa71","org_name":"Alamo Heights Independent School District","org_type":"education","ransomware":null,"records_affected":30165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005126"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8719971ff42c7246bab374414962be2f43e2e4ea","impact_type":"both","imported_from":null,"incident_date":"2026-06-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"adfa80565db3","org_name":"JCPenney","org_type":"retail_ecommerce","ransomware":true,"records_affected":368418,"reviewed":false,"root_cause":"Attackers exploited a critical zero-day vulnerability in Oracle PeopleSoft.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JCPenney","type":"hibp","url":"https://haveibeenpwned.com/Breach/JCPenney"}],"summary":"JCPenney data associated with internal HR systems was reportedly obtained by exploiting a zero-day vulnerability in Oracle PeopleSoft and published during a ShinyHunters extortion campaign.","supporting_quote":"Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly.","technology_involved":["Oracle PeopleSoft"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}],"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-19","discovered_date":"2026-01-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b25d0aeb1ea82872708bab34437271472da398b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41395.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"98c655c9232d","org_name":"Xsolis, Inc.","org_type":"professional_services","ransomware":null,"records_affected":26203,"reviewed":false,"root_cause":"A targeted phishing attack resulted in unauthorized activity in Xsolis's environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41395.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41395.pdf"}],"summary":"Xsolis reported unauthorized activity following a targeted phishing attack, and some information may have been accessed.","supporting_quote":"Xsolis became aware of unauthorized activity resulting from a targeted phishing attack on January 22, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2a8e5863e2f63068abc42dd6a49dd0b269563616","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99a134972b59","org_name":"Texas Medicaid and Healthcare Partnership","org_type":"professional_services","ransomware":null,"records_affected":2045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-19-texas-medicaid-and-healthcare-partnership"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005127"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0ce8562788ebbd07d4e49e9da31b5b5d05f19a21","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a211f19f726","org_name":"Kentucky Mountain Health Alliance","org_type":"healthcare","ransomware":null,"records_affected":30830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-19-kentucky-mountain-health-alliance"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f167c8e2094a406111de5e3589e6e5ed26d0304a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7e36384a4c4","org_name":"Community Health Center of Buffalo Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-19-community-health-center-of-buffalo-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b424e8599301ef47b4aab2dfa50eaa127e6edeec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dcce857dd4b5","org_name":"Colorado Health Network Inc.","org_type":"healthcare","ransomware":null,"records_affected":68212,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-19-colorado-health-network-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005130"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Colorado%20Health%20Network%20Inc.-2026-06-22"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-05-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"20e4e1250c423839df78e0b3fd69f4fd6fcfbb82","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d8b6cbc89b4c","org_name":"UBEO Midco LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":3845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005116"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#UBEO%20Midco%20LLC-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-01-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b082d06f74664408c147c81b16a47db3348ad031","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7191c8552efc","org_name":"The Carlson Law Firm","org_type":"retail_ecommerce","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005112"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9e2a3fc75c98d1eae7f2a68c0ab9fcfb6cb7fe90","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08a3fcd2c12b","org_name":"Suntree Internal Medicine","org_type":"healthcare","ransomware":null,"records_affected":9810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-18-suntree-internal-medicine"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-05-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed8110a71150ab0cbb6bf67b2202089e8928ebf6","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b7d0724844c","org_name":"SunSource Borrower LLC (“SunSource”)","org_type":"retail_ecommerce","ransomware":null,"records_affected":12463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005121"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":"2024-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f28a80ddb89de5933c6fd3ab3881eb7c8087138","impact_type":"data_theft","incident_date":"2024-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jones%20Mayer%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"3b8c5063b073","org_name":"Richard D. Jones, A Professional Law Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625089"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jones%20Mayer%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed Jones Mayer systems and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef846888e59893f9d5e94a8add282227cf5355f9","impact_type":"both","imported_from":null,"incident_date":"2026-06-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0e01e574cec3","org_name":"Ralph Lauren","org_type":"retail_ecommerce","ransomware":true,"records_affected":139903,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ralph Lauren","type":"hibp","url":"https://haveibeenpwned.com/Breach/RalphLauren"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmFscGggTGF1cmVuIENvcnBvcmF0aW9uQHNoaW55aHVudGVycw"}],"summary":"Ralph Lauren was targeted in a ShinyHunters extortion campaign, and the group published data it claimed came from the company's Salesforce instance.","supporting_quote":null,"technology_involved":["Salesforce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-05-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8218bfba2fd058096a6eac874c575db189d2e2ec","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4752498f4f45","org_name":"Passco Companies, LLC","org_type":"other","ransomware":null,"records_affected":8335,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005114"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Passco%20Companies%2C%20LLC-2026-06-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-01-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9dc65d8062115666681a8fd24595ae62d34865bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c0f49997441","org_name":"Oak View Group, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":10075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005117"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-04-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c08d461f763d59bf4edae5e90ab9c2adfb37840e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f331fdceae2","org_name":"Louisiana Machinery Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":921,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005106"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-05-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"10a4946d8fa77e07efa377812e2c2ae044ebc4cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae514a3c1287","org_name":"Landstar System Holdings, Inc.","org_type":"other","ransomware":null,"records_affected":726,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005111"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Landstar%20System%20Holdings%2C%20Inc.-2026-06-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2025-04-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec8cf957046d7258f0f9fae902d90085b6817505","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"financial","ransomware":null,"records_affected":15624,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005115"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Humana%20Inc.-2026-07-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5d5a6f78b7e0838fe74ee062ff7c01bc1a786960","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"32c3ac727969","org_name":"High Mowing Organic Seeds","org_type":"other","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#High%20Mowing%20Organic%20Seeds-2026-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"79b854720355ddea5ae0175ab174c690265f2f2c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5993cf4f8299","org_name":"Family Health Centers of Southern Indiana","org_type":"healthcare","ransomware":null,"records_affected":7117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-18-family-health-centers-of-southern-indiana"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-05-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3c042fd24f381ca24206a3376444dd983dbd1a02","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06027e1d8fa0","org_name":"Ed Bell Investments, Inc.","org_type":"other","ransomware":null,"records_affected":5518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005108"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5156de222d96e71d5c507d44f0b9f9d52c183d68","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51c6ef9fb299","org_name":"Columbia Orthopaedic Group","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-18-columbia-orthopaedic-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"89e803ef96eca320b1ef269bb2612ac70b97beef","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a8218ad649b","org_name":"Cherry Street Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-18-cherry-street-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25bc082ec7ef708de40742bf57f7e795bb4fc672","impact_type":"both","incident_date":"2026-03-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3752fd6288e0","org_name":"CFGI","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CFGI","type":"hibp","url":"https://haveibeenpwned.com/Breach/CFGI"}],"summary":"CFGI was targeted in a ShinyHunters pay-or-leak extortion campaign, and the group publicized corporate contact information allegedly obtained from the firm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"893c8de500b670a6d7f4a15e27cbabb7f2fe704c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f9ee9b308f7b","org_name":"Centers Lab NJ LLC","org_type":"healthcare","ransomware":null,"records_affected":542377,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-18-centers-lab-nj-llc"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Centers%20Lab%20NJ%20LLC-2026-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"66ede0018d88bd1037791cb0567fa876837ce158","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2fe8d0c0533c","org_name":"Casino, LLC","org_type":"other","ransomware":null,"records_affected":672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005107"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Casino%20LLC%C2%A0%20dba%20Larry%20Flynt%27s%20Lucky%20Lady%20Casino-2026-06-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-18","discovered_date":"2026-02-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc23bb6ce1f94e25a8f12e5658197ef97ba5c452","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"96a31ed7f019","org_name":"Aransas County, Texas","org_type":"government","ransomware":null,"records_affected":1162,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005119"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6d1105d8b42210a7d67048b0b12ab9cd34c29fa0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a300e614a3c","org_name":"SunSource Borrower LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#SunSource%20Borrower%20LLC-2026-06-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a25f67ec88d99722776e50de429aba99f04a5844","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b284280a6c7e","org_name":"Fresenius Kabi USA, LLC","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fresenius%20Kabi%20USA%2C%20LLC-2026-06-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8aee517cd9a6d260d47395a8e3f43e3c167991d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4efd2b55fed5","org_name":"Blue Fish Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":62150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-17-blue-fish-pediatrics"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005122"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"15bf2de771eb7bcfd728df4e86dc74e6ea1a853e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c925b154fc33","org_name":"BCGL LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#BCGL%20LLC-2026-06-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-17","discovered_date":"2026-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d4cfe9016e4ca7b645864b4914576d21aabc4cd","impact_type":"data_theft","incident_date":"2026-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AA%20-%20Individual%20Notice%20Letter%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"95be2bf89df9","org_name":"AssuranceAmerica Managing General Agency, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625034"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AA%20-%20Individual%20Notice%20Letter%20-%20CA.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005139"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41355.pdf"}],"summary":"An unauthorized third party accessed AssuranceAmerica’s IT systems and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88f9d4f3fb536ac1f67ed2e001fc0b2693092dc0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Alcott_Notification%20Letter_Final_revd3_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"704a6b956726","org_name":"Alcott HR","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Alcott_Notification%20Letter_Final_revd3_Redacted.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alcott%20HR-2026-06-17"}],"summary":"Alcott reported that an unauthorized user accessed systems storing personal information, including Social Security numbers and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2b50d0dfbb61d0e2d23e968973c07410db8fa8dd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fef27431eec3","org_name":"Aitkin County Health and Human Services","org_type":"professional_services","ransomware":null,"records_affected":83114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-17-aitkin-county-health-and-human-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a14b8cf14b78bc85e24c774b81554e7785a85e25","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5207a3b60e20","org_name":"Decatur Diagnostic Laboratory Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-16-decatur-diagnostic-laboratory-inc"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Decatur%20Diagnostic%20Laboratory%20Inc.-2026-07-13"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cdfa969f23000b91947cd0525a5ed32cb522df9","impact_type":"unknown","incident_date":"2025-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Nelson%20General%20Letter%20Redacted%20%281%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e95efaaad727","org_name":"Nelson University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624948"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005120"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41330.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Nelson%20University-2026-06-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a1a1e97d912ded8bbd7634f04f39174a78f2bc","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9666ced24ef4","org_name":"Infinite Campus","org_type":"technology_saas","ransomware":true,"records_affected":137123,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Infinite Campus","type":"hibp","url":"https://haveibeenpwned.com/Breach/InfiniteCampus"}],"summary":"ShinyHunters claimed to have taken and published data from Infinite Campus in a pay-or-leak extortion campaign.","supporting_quote":null,"technology_involved":["student information system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2026-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"38868a6f21caeb7ebd387247ce4bfe075b37b58a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41325.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2acf1bbc0a97","org_name":"Grandview School District","org_type":"unknown","ransomware":null,"records_affected":9414,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41325.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aed9763953ebe61010de4f4c8cb364645f2672c2","impact_type":"both","imported_from":null,"incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"15f7059acb61","org_name":"Berkadia","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Berkadia","type":"hibp","url":"https://haveibeenpwned.com/Breach/Berkadia"}],"summary":"ShinyHunters published data it alleged was taken from Berkadia's Salesforce instance during a pay-or-leak extortion campaign.","supporting_quote":null,"technology_involved":["Salesforce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1d55fe6b6722f3b16c05b45d69641628e6f9b94b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ad0665c8837","org_name":"Bally's Interactive, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bally%27s%20Interactive%2C%20LLC-2026-06-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"cc1dbcaae2fb95f7e926fe58dbdc10644e61a08d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20-%2006.12.2026%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"a40b8b07beea","org_name":"The West Series of Lockton Companies, LLC","org_type":"professional_services","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":"An Excel file sent to RFP participants inadvertently included employee personal information that was not intended for them.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20West%20Series%20of%20Lockton%20Companies%2C%20LLC-2026-06-12"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624765"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20-%2006.12.2026%20%281%29.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20-%2006.12.2026%20%281%29.pdf"}],"summary":"Lockton inadvertently sent RFP participants an Excel file containing employee personal information, including Social Security numbers, names, dates of birth, and possibly benefits election information.","supporting_quote":"That file inadvertently included additional employee personal information not intended for the RFP participants.","technology_involved":["Excel"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9f078a5ea2fbdcbb09ff7be817108c495d122620","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85039e51778a","org_name":"Orthopaedic Specialists of Massachusetts","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Orthopaedic%20Specialists%20of%20Massachusetts-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2be821d32ea0dabfeea99453ea158c886907de5f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19a852451aa0","org_name":"Orrstown Bank","org_type":"financial","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Orrstown%20Bank-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"749e1481e4575e6353b49be3d1f49fc6a93d4209","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd257cab9855","org_name":"Ohio Living","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-12-ohio-living"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"892a6ac31101029cefa673c66e5ba528083303ba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f85f3576d21","org_name":"Normandin, Cheney & O'Neil PLLC","org_type":"other","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Normandin%2C%20Cheney%20%26%20O%27Neil%20PLLC-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-12","discovered_date":"2025-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2af93b0238ae0f426904837f786417f14b11ef6e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-02","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AC%202025-22829%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"702b45d85d69","org_name":"Los Angeles County Department of Public Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A County employee accessed personal information in the County's electronic systems without a legitimate business reason.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624859"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AC%202025-22829%20Notification%20Letter%20Template.pdf"}],"summary":"A County employee accessed personal information in Los Angeles County Department of Public Social Services electronic systems without a legitimate business reason.","supporting_quote":"A County employee accessed your personal information contained in our electronic systems without a legitimate business reason.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0f9c6b95e919127ecbf0d723a9b52134bf8e6ded","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0654ccb85c5b","org_name":"Legal Services of Long Island","org_type":"nonprofit","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Legal%20Services%20of%20Long%20Island-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d5afcc3ea07b2c2b00c31e7fd194599ab96c4b3f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41309.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"99514185765a","org_name":"Columbia Pacific Advisors, LLC","org_type":"financial","ransomware":null,"records_affected":1585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41309.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41309.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Columbia%20Pacific%20Advisors%2C%20LLC-2026-06-12"}],"summary":"Columbia Pacific Advisors reported that an unauthorized third party accessed certain systems and information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-12","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"018a21dfca6a9b663ea804eba9764b6207c230f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CRS%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9b4fead4ecc8","org_name":"Clinical Registry Solutions","org_type":"professional_services","ransomware":null,"records_affected":8545,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-12-clinical-registry-solutions"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624728"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CRS%20-%20Sample%20Notice.pdf"}],"summary":"Clinical Registry Solutions discovered unauthorized access to its network, and files containing patient information were acquired.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5a32403678e4f2734021c351c3514f51ec37585f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"be2bd7bb5e13","org_name":"Caldwell Sutter Capital, Inc.","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Caldwell%20Sutter%20Capital%2C%20Inc.-2026-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-12","discovered_date":"2026-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce82cc2c8d52c0b7550dd66f934b8567edde9cec","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bellflower%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"4177dcd019e3","org_name":"Bellflower Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624831"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bellflower%20Notice%20Template.pdf"}],"summary":"Bellflower Unified School District reported unauthorized activity in its computer systems and said personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-06-12","discovered_date":"2025-06-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf224c44f39ce32d645840a843715f9f57dace0e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-06-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/iBUYPOWER%20Notice%20Letter%206.5.26.pdf"},"notes":null,"org_country":"US","org_id":"b08ae2f28d35","org_name":"American Future Technology Corporation d/b/a iBUYPOWER","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624771"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/iBUYPOWER%20Notice%20Letter%206.5.26.pdf"}],"summary":"American Future Technology Corporation d/b/a iBUYPOWER reported unauthorized access to personal information during a security incident discovered on June 21, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"12b5515dd405355eb87dd23c5c200de5a0400689","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"143665712c56","org_name":"Open Arms Care Corporation","org_type":"healthcare","ransomware":null,"records_affected":893,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-11-open-arms-care-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"250c5cb86ada056f385d0af7d981f1bd540fcada","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df7f91cc4ac2","org_name":"Marsicovetere & Levin Law Group, P.C.","org_type":"other","ransomware":null,"records_affected":859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Marsicovetere%20%26%20Levin%20Law%20Group%2C%20P.C.-2026-06-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ea16b93cf1185dda6e2531150a5284186b3472ee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06e4feb753dd","org_name":"Chickasaw Nation Department of Health","org_type":"healthcare","ransomware":null,"records_affected":1607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-11-chickasaw-nation-department-of-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b67050f006a63e16d96ab7bd8166153c2a6613","impact_type":"both","imported_from":null,"incident_date":"2026-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fdc8e7dc0d7f","org_name":"University of Nottingham","org_type":"education","ransomware":true,"records_affected":454635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: University of Nottingham","type":"hibp","url":"https://haveibeenpwned.com/Breach/UniversityOfNottingham"}],"summary":"The University of Nottingham suffered a cyber attack linked to a ShinyHunters extortion campaign, and data including personal information was published online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-10","discovered_date":"2026-04-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"acc8d76e679a83eb33a5b3db73e46e158d40f113","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9569fcbf2990","org_name":"Project Consulting Services, Inc.","org_type":"other","ransomware":null,"records_affected":1572,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005102"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Project%20Consulting%20Services%2C%20Inc.-2026-06-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dfd834c47811a98146d49d9d2841b50aa1a80eab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac34a643e3d5","org_name":"Palacio, Palacio, & Zimmerman, LLC","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Palacio%2C%20Palacio%2C%20%26%20Zimmerman%2C%20LLC-2026-06-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0c02c005b18d8046f553502d708fefa897bad5ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6db8be81d868","org_name":"McCoyd, Parkas, & Ronan LLP","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#McCoyd%2C%20Parkas%2C%20%26%20Ronan%20LLP-2026-06-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"The Gentlemen (Storm-2697)","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10f71d1d57b310497c51300b4e954517edea8b8e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49E476BC-7B08-41C7-9864-B14A6B0D64AD"},"incident_date":"2026-06-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"333efbadad89","org_name":"Mackay Sugar Limited","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/ransomware-attack-shuts-down-mills-of-australias-second-largest-sugar-producer/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mkysugar.com.au/news-updates-circulars/mackay-sugar-cyber-security-incident;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.rescana.com/post/ransomware-attack-on-mackay-sugar-disrupts-australian-mills-cybersecurity-incident-analysis-and-lessons-learned;"},{"fetched_at":null,"title":null,"type":"press","url":"https://therecord.media/mackay-sugar-cyberattack-claimed-gentlemen;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.teiss.co.uk/news/ransomware-attack-halts-operations-at-australias-second-largest-sugar-producer-17670;"},{"fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWFja2F5IFN1Z2FyQHRoZWdlbnRsZW1lbg"}],"summary":"Mackay Sugar Limited, Australia's second-largest raw sugar producer, suffered a ransomware attack by The Gentlemen (Microsoft: Storm-2697) that surfaced on 2026-06-10 and forced two of its three Queensland mills (Farleigh and Racecourse) offline during the crushing season. The gr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"thegentlemen","claim_groups":["thegentlemen"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c57ebe0f9adea67aaf58453ac0a8ce5961f8d8e0","impact_type":"data_theft","incident_date":"2025-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Casino%2C%20LLC%20dba%20Larry%20Flynt%27s%20Lucky%20Lady%20Casino%20-%20Notice%20of%20Data%20Event_%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"a10457c03f7c","org_name":"Larry Flynt's Lucky Lady Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624697"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Casino%2C%20LLC%20dba%20Larry%20Flynt%27s%20Lucky%20Lady%20Casino%20-%20Notice%20of%20Data%20Event_%20-%20CA.pdf"}],"summary":"Casino, LLC reported that an unauthorized actor accessed systems and servers from May 14 to May 18, 2025, and removed information that included individuals' names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"243c3215ea58c3b5a759faba98d81f74368ea687","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a2e3de924ae","org_name":"Elmwood Home Care","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Elmwood%20Home%20Care-2026-06-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d58096887ea3e625588e7c8747199c32d36a3fab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3ad161e374b","org_name":"Dr. Erick Perroud","org_type":"healthcare","ransomware":null,"records_affected":7692,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-10-dr-erick-perroud"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-10","discovered_date":"2026-03-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb8c9ef46bb6ada791ee8df1a0a42031f5a6546c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"049bced17a3a","org_name":"Cowley County Community College","org_type":"education","ransomware":null,"records_affected":31077,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005104"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cowley%20County%20Community%20College-2026-05-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-10","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e9bfe11018044fdcec2f4261e187407cda0dc4b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc6c6b0aac83","org_name":"Beusa Energy, LLC","org_type":"other","ransomware":null,"records_affected":7174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005105"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-09","discovered_date":"2026-05-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8889beeb5987fe27e2cb7ac70017866788896e64","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"abce1935002b","org_name":"Tarter Krinsky & Drogin LLP","org_type":"other","ransomware":null,"records_affected":49374,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005095"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tarter%20Krinsky%20%26%20Drogin%20LLP-2026-06-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-09","discovered_date":"2026-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f244aa7f66ecd0582c047333672578699c3ec83e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"PR","org_id":"b5bd60078590","org_name":"Popular, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/763901/000119312526263044/d46942d8k.htm"}],"summary":"Popular reported that a cybersecurity incident at its third-party provider Evertec compromised personal information, including debit card numbers, of certain Banco Popular de Puerto Rico customers.","supporting_quote":"Subsequent to its initial notification, Evertec notified the Corporation that it had identified additional data from BPPR that had been compromised.","technology_involved":["Evertec"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Evertec"},"veris_action":"unknown","derived":{"vendors":[{"id":"885f4b626efd","name":"Evertec"}],"price":{"ticker":"BPOPM","base_day":"2026-06-09","returns":{"1":{"day":"2026-06-10","raw":0.0044,"adj":0.0201},"5":{"day":"2026-06-16","raw":0.0004,"adj":-0.0176},"21":{"day":"2026-07-10","raw":-0.0024,"adj":-0.0267},"63":{"day":"2026-09-09","raw":-0.0043,"adj":-0.0387}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-09","discovered_date":"2026-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32b3615110dd6bcaf49ea0a930734c0c8aac7e13","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/drop11_audits_Letter_Adult-PBW_final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7ec1a1a86d6e","org_name":"Pearlman, Brown & Wax LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624599"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/drop11_audits_Letter_Adult-PBW_final_Redacted.pdf"}],"summary":"Pearlman, Brown & Wax LLP discovered suspicious activity in its network, and an investigation found that an unauthorized individual accessed the network and may have accessed files containing personal and workers’ compensation medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-09","discovered_date":"2026-04-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4bcb8dc546c437e85c473d66edba266d3004bee5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f4303b45eaa","org_name":"OEConnection LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1617,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005100"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a3d3e7c93cc1583cfdf8a05db7efe9a02e5ef579","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa0ad8cf445c","org_name":"Monaco & Associates Incorporated","org_type":"healthcare","ransomware":null,"records_affected":534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-09-monaco-associates-incorporated"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ae10d8ecddb764e6b9227d10cdf6b078d203aacb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97d12205fd20","org_name":"Michigan Surgical Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":7578,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-09-michigan-surgical-center-llc"},{"fetched_at":null,"title":"Leak-site claim by thegentlemen","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWljaGlnYW4gU3VyZ2ljYWwgQ2VudGVyQHRoZWdlbnRsZW1lbg"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["thegentlemen"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-09","discovered_date":"2026-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"f41d0b591320c2e088a824014cef466bb8da3f65","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20MasTec.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"26bec3eb487e","org_name":"MasTec, Inc.","org_type":"professional_services","ransomware":null,"records_affected":25220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005098"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20MasTec.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20MasTec.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#MasTec%2C%20Inc.-2026-06-05"}],"summary":"MasTec reported that an unauthorized third party accessed part of its computer network for a few days in August 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"47e03953ab50add5ce166afe138971ea0834ac43","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bc1c9b71ca8","org_name":"Joseph A. Cannova CPA CFP","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Joseph%20A.%20Cannova%20CPA%20CFP-2026-06-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-09","discovered_date":"2026-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b1811c1f95eebdcbb4c76eb45fb741fa161b67bc","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"PR","org_id":"885f4b626efd","org_name":"EVERTEC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1559865/000155986526000039/evtc-20260609.htm"}],"summary":"EVERTEC reported that an unauthorized party obtained financial institution clients’ transaction records and some customers’ payment card and contact information through a third-party support platform.","supporting_quote":null,"technology_involved":["third-party support platform"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"hacking","derived":{"price":{"ticker":"EVTC","base_day":"2026-06-09","returns":{"1":{"day":"2026-06-10","raw":0.0284,"adj":0.0441},"5":{"day":"2026-06-16","raw":0.1692,"adj":0.1512},"21":{"day":"2026-07-10","raw":0.2564,"adj":0.2322},"63":{"day":"2026-09-09","raw":0.2771,"adj":0.2427}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-09","discovered_date":"2026-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"70ada110cfcb5e3d2fec7cdef089a60c967fa247","impact_type":"data_theft","incident_date":"2026-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Delaware%20North.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"49f9bdbbbd70","org_name":"Delaware North","org_type":"other","ransomware":null,"records_affected":66352,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005097"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Delaware%20North.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Delaware%20North.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Delaware%20North-2026-06-05"}],"summary":"Delaware North reported that an unauthorized actor copied files from an employee’s Microsoft account containing some individuals’ names and driver’s license or state identification numbers.","supporting_quote":null,"technology_involved":["Microsoft account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a6125a38056d04192db8c0a438a7d215a0f07ac0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8487376205c","org_name":"Bloomington Roots Foundation, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bloomington%20Roots%20Foundation%2C%20Inc.-2026-06-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"551e3a9b17e22cb3dab7d0ba98ad91498899ed95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07874a56d163","org_name":"Lutheran Home for the Aged","org_type":"healthcare","ransomware":null,"records_affected":2311,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-08-lutheran-home-for-the-aged"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5b31dc8273e2f3ee4c3146377bb9d65ca109101b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7c06b282c2e7","org_name":"Alexes Hazen, MD PLLC","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alexes%20Hazen%2C%20MD%20PLLC-2026-06-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"22f7c9037e0960b4d82a6c0b7af2463cf3db1180","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sierra%20Management%20Group%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5605fadac92a","org_name":"Sierra Management Group","org_type":"professional_services","ransomware":null,"records_affected":1279,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-07-sierra-management-group"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sierra%20Management%20Group%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized third party accessed certain Sierra Management Group systems and may have accessed and copied files containing personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fd0a4bece28c07058fa74d83cd01501a3227507","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fa1ad13b83e9","org_name":"Baker Distributing","org_type":"other","ransomware":true,"records_affected":102935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Baker Distributing","type":"hibp","url":"https://haveibeenpwned.com/Breach/BakerDistributing"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QmFrZXIgRGlzdHJpYnV0aW5nIENvbXBhbnlAc2hpbnlodW50ZXJz"}],"summary":"ShinyHunters claimed data from Baker Distributing's SharePoint and Salesforce infrastructure and published contact and support information.","supporting_quote":null,"technology_involved":["SharePoint","Salesforce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-05","discovered_date":"2026-01-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"b3a3fe3076e1b4418842a5b96cf1f631b2a1abe1","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Xsolis_CA_Individual%20Notification%20Exemplar%20%2806.19.26%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"98c655c9232d","org_name":"Xsolis, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1396519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-xsolis-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625166"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Xsolis_CA_Individual%20Notification%20Exemplar%20%2806.19.26%29.pdf"}],"summary":"Xsolis reported unauthorized activity following a targeted phishing attack, and some protected health information may have been accessed.","supporting_quote":"Xsolis became aware of unauthorized activity resulting from a targeted phishing attack on January 22, 2026.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6de45dd43acb5be233fc501d269e3cda07a1b421","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d7239121a3c8","org_name":"UnitedHealth Care Services, Inc. Single Affiliated Covered Entity","org_type":"healthcare","ransomware":null,"records_affected":34574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-unitedhealth-care-services-inc-single-affiliated-covered-entity"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45dd123bee53477390c824787c80553449e93503","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/security-notice.pdf"},"notes":null,"org_country":"US","org_id":"6f59fb82b08e","org_name":"Ultrahuman Healthcare Private Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/security-notice.pdf"}],"summary":"An unauthorized third party gained read-only access to an internal analytics system containing contact, account, transaction, and fitness-related data.","supporting_quote":null,"technology_involved":["internal analytics system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-05","discovered_date":"2026-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae009925c9db7c000b2b784a71b3aab8a80f85e5","impact_type":"data_theft","incident_date":"2026-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Towerpoint%20-%20Minor%20Notice%20Template_Final_Proof_VDP%28337010685.1%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b8a76691c5d9","org_name":"Towerpoint Wealth, LLC","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624427"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VE9XRVJQT0lOVCBXRUFMVEgsIExMQ0BzaGlueWh1bnRlcnM"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Towerpoint%20-%20Minor%20Notice%20Template_Final_Proof_VDP%28337010685.1%29_Redacted.pdf"}],"summary":"Towerpoint Wealth, LLC reported that an unauthorized party accessed and copied files containing minors’ personal and potentially financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"dfceaf3bf48799f6ebb53cb7b70578a61fcae36f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a2638efc451","org_name":"The E.W. Scripps Company","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20E.W.%20Scripps%20Company-2026-06-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f47effd5d54fb8bd2d3057f9167ad1a8451e7809","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e80d16ddfcd","org_name":"Sturdy Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1006,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-sturdy-health-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"49ecd25ed1d6f661d44e74f05f4420ca66430a1d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc062128b71c","org_name":"Signature Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-signature-healthcare-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3f5f0a5ad84e29c2c54baec0196ad4876b042e8e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83a5db469d70","org_name":"Power & Telephone Supply Company","org_type":"other","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Power%20%26%C2%A0Telephone%20Supply%20Company-2026-06-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-05","discovered_date":"2026-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84e4c0a2a87d7d60cd5a41cb6d6f0a12be87c126","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Form%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f017a63d6f19","org_name":"Plaza Home Mortgage, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624434"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Form%20Notice_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005096"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Plaza%20Home%20Mortgage%2C%20Inc.-2026-06-05"}],"summary":"Plaza Home Mortgage reported unauthorized access to one employee’s computer and said personal information may have been obtained.","supporting_quote":null,"technology_involved":["employee computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-05","discovered_date":"2026-05-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"30b35b957f186471c9f955bd17021d08f832e61b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd340fc61bc0","org_name":"Othon, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005093"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"46fa412c84b6b0ab412ae549a6d7bd2e1b07cfd4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9c038eeb0e59","org_name":"MVP VIP Holdco dba Heart of America Eye Care","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-mvp-vip-holdco-dba-heart-of-america-eye-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"778e080df3258d9d206c7c28d1672c14c0897fd8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"544ec6e5abc2","org_name":"Minnesota Epilepsy Group, P.A.","org_type":"healthcare","ransomware":null,"records_affected":80061,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-minnesota-epilepsy-group-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d906fe0321e60c310dd15c6b9dbcf36160c7a2a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Meta%20AI%20Support%20Tool%20Incident%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9a1f82607305","org_name":"Meta Platforms, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A bug in Meta's account recovery system may have enabled an unauthorized party to initiate password resets and access Instagram accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Meta%20AI%20Support%20Tool%20Incident%20Sample%20Notice.pdf"}],"summary":"A bug in Meta's account recovery system may have enabled an unauthorized party to reset passwords and access Instagram accounts and associated information.","supporting_quote":"Following an investigation, Meta determined that between April 17, 2026, and May 31, 2026, a bug in our account recovery system may have enabled an unauthorized party to initiate a password reset and access your Instagram account.","technology_involved":["Instagram","account recovery system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":"2025-02-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2a178ca724112de68562de4233bde161fd4c8bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7ed8b9a963bc","org_name":"Lansing Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20Individual%20Notice.pdf"}],"summary":"Lansing Community College reported unauthorized access to certain systems through credential compromise, and personal information may have been involved.","supporting_quote":"After discovering the issue, LCC promptly worked with third-party specialists to secure its systems, launched an investigation and determined that an unauthorized actor had gained access through credential compromise on approximately February 12, 2025.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b5343f0e258f6d76c2ab77e64a8f5c731008b1ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8936321f123c","org_name":"Informa Canada Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Informa%20Canada%20Inc.%20dba%20Shop%20FAN%20EXPO-2026-06-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a5e858b5cfb97511db5946444e3c70ac4ec73181","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/GLCC_L1_Adult_CM_38117178v1_Final%2838387305.1%29_Redacted_38388980v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d92e2cb5d202","org_name":"Gay & Lesbian Community Services Center of Orange County, Inc.","org_type":"healthcare","ransomware":null,"records_affected":75532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-05-gay-lesbian-community-services-center-of-orange-county-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624395"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41222.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-05","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5ab5d87567b1339355e03da71d106e7564c28fea","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cce7923b7e37","org_name":"Evelyn Rubenstein Jewish Community Center of Houston","org_type":"nonprofit","ransomware":null,"records_affected":3278,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005090"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":"2026-05-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b0f2bf0a52fcad40ca178f7f7a8879390409737","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"75a335c0fd98","org_name":"Cleburne ISD","org_type":"education","ransomware":null,"records_affected":5260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005092"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-05","discovered_date":"2025-11-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ce98d9fab897e0378c203f40c387e4de386dfab","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb7bca48a0a9","org_name":"Centerwell","org_type":"financial","ransomware":null,"records_affected":7972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005091"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34aa9ee0c8d8a90ae16d8530fbba48d154cb3902","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0066fb73293c","org_name":"BCD Travel","org_type":"professional_services","ransomware":true,"records_affected":396313,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BCD Travel","type":"hibp","url":"https://haveibeenpwned.com/Breach/BCDTravel"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QkNEIFRyYXZlbEBzaGlueWh1bnRlcnM"}],"summary":"BCD Travel was claimed as a victim of a ShinyHunters extortion campaign, and data allegedly obtained from the company was published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-06-05","discovered_date":"2026-05-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"06da42fcab040457c22521730b4d2cdc6af4a899","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe7f8bb9fa5a","org_name":"Allred Tax Advisors, PLLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005094"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"blackwater","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ebddb584179563ad2eecbce576674edfde74d970","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9593b83430a6","org_name":"Minidoka Memorial Hospital","org_type":"healthcare","ransomware":true,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-04-minidoka-memorial-hospital"},{"fetched_at":null,"title":"Leak-site claim by blackwater","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWluaWRva2EgTWVtb3JpYWwgSG9zcGl0YWxAYmxhY2t3YXRlcg"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"blackwater","claim_groups":["blackwater"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-04","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-09","id":"0748f316e1689dd6361418e0560ff403b46099ec","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20McLeod%20Physician%20Associates%20II.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8aca68f038e0","org_name":"McLeod Physician Associates II","org_type":"healthcare","ransomware":null,"records_affected":19553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-04-mcleod-physician-associates-ii"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20McLeod%20Physician%20Associates%20II.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20McLeod%20Physician%20Associates%20II.pdf"}],"summary":"An unauthorized party accessed a server containing Dillon Family Medicine patient information in October 2025.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4664c7c1f1be697c5afdcedb503f44717b496aaf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3663355023a1","org_name":"Asplundh Engineering Services LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Asplundh%20Engineering%20Services%20LLC-2026-06-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"34b979c8faedec6ac1391b9c2da35e3bf728c578","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d19dda7d76f6","org_name":"ECBM, LP","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ECBM%2C%20LP-2026-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"86ad5d0ddfed9f6e20cffea3c4cb0b21e9084882","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbfc06d3e65b","org_name":"Clarinda Regional Health Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Clarinda%20Regional%20Health%20Center-2026-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4e0139fc04d08928b22fa2da1c0e92557c36b712","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3d7fffaf9e5","org_name":"City of Middletown","org_type":"healthcare","ransomware":null,"records_affected":20608,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-03-city-of-middletown"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fe5c49d7766e58af95e5d822594a29d4f3c438e4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51339675e10a","org_name":"Bozeman School District #7","org_type":"education","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bozeman%20School%20District%20%237-2026-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a1cdda589e79277607010a4305c3f30fa90b52bd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"974523e53e19","org_name":"Amicus Solutions, Inc. (additional related entities may be impacted, the names of which are available upon request)","org_type":"professional_services","ransomware":null,"records_affected":1137,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-03-amicus-solutions-inc-additional-related-entities-may-be-impacted-the-names-of-wh"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"438490bb334f1fdda77a306f3bd1645afa266e18","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48a0006813b2","org_name":"All About Women's Care","org_type":"healthcare","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-03-all-about-women-s-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5babe505aa842018a1411a189110f73ae0d9177c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ad5df642096","org_name":"Yorozu Automotive Tennessee, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Yorozu%20Automotive%20Tennessee%2C%20Inc.-2026-06-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-02","discovered_date":"2026-04-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7332039f10677a5e196da8c9e2a6d5f2b77244c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24184.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dab2adc4441a","org_name":"WellPoint","org_type":"healthcare","ransomware":null,"records_affected":12017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24184.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24184.pdf"}],"summary":"A phishing incident at Clinics of Washington resulted in unauthorized access to an email account and may have affected WellPoint information.","supporting_quote":"On 3/2/2026, Clinics of Washington (ICW), a business associate of Wellpoint Washington, Inc. notified Wellpoint that they experienced a phishing incident.","technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Clinics of Washington"},"updated_at":"2026-10-12","veris_action":"social","derived":{"vendors":[{"id":"76c4180e8de4","name":"Clinics of Washington"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b56e6226998539f0dd78e8986fc43af5e5c3e6e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ecca5afb94b","org_name":"Waveny LifeCare Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":27113,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-02-waveny-lifecare-network-inc"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Waveny%20Lifecare%20Network-2026-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-02","discovered_date":"2025-11-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a79a83c5a9fae4fd32bdf2d037bfea4d97c51b62","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e4d63693e63","org_name":"TriZetto Provider Solutions","org_type":"other","ransomware":null,"records_affected":6974232,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005084"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-06-02","discovered_date":"2025-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"e5b18c01bb1eae3b0a8b601393285d7cc61a7ff4","impact_type":"both","incident_date":"2025-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letters%20-%20Sandhills%20Medical%20Foundation%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f9d0cd433f7","org_name":"Sandhills Medical Foundation","org_type":"healthcare","ransomware":true,"records_affected":169017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005087"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letters%20-%20Sandhills%20Medical%20Foundation%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letters%20-%20Sandhills%20Medical%20Foundation%2C%20Inc..pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sandhills%20Medical%20Foundation%2C%20Inc.-2026-04-29"}],"summary":"Sandhills Medical Foundation discovered a ransomware attack in which an unauthorized third party accessed a server and obtained some patients’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-02","discovered_date":"2026-02-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"315e82c4f9d3c3fcaec80d62d6426a99c94aff84","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed40f1a3a267","org_name":"Riddle & Butts","org_type":"other","ransomware":null,"records_affected":6946,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005089"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-02","discovered_date":"2026-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33fd6528f46b7e72766c3272dfc373c745aa4d4c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"70c68e4fa014","org_name":"Mister Guns","org_type":"retail_ecommerce","ransomware":null,"records_affected":21225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005085"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-06-02","discovered_date":"2025-11-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"23883b4945c62a5e1f67ce030ba65657805967db","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ecab9b160e3","org_name":"Liberty Bankers Life Ins Co","org_type":"financial","ransomware":null,"records_affected":20202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005088"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"688525364c6274e476b49f5ff09e27968208bf29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da5aa5fa26e9","org_name":"Henry Rossi & Company, LLP","org_type":"professional_services","ransomware":null,"records_affected":2720,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-02-henry-rossi-company-llp"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3988a3dda7daba070b035e7616115233ff8b8109","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0609986f9121","org_name":"D.B. Root & Company, LLC","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#D.B.%20Root%20%26%20Company%2C%20LLC-2026-06-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"703ea43952dfa72075329a521d9480755bfdebcb","impact_type":"data_theft","incident_date":"2026-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SEI%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"60d84b58d48e","org_name":"Strategic Education Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SEI%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005086"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Strategic%20Education%20Inc.-2026-06-01"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Strategic%20Education%20Inc.-2026-06-01"}],"summary":"Strategic Education Inc. reported that an unauthorized actor accessed its computer servers and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-06-01","discovered_date":"2025-07-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33b7a6951699413e823e81a8717285b8d96a9229","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"401073b28ca4","org_name":"Modjarrad & Associates, PC","org_type":"other","ransomware":null,"records_affected":17964,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005080"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6994446f1c39d2a75ac45c3a60c7dd7b49df6ad7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ce5055d8f54","org_name":"Medenet Inc.","org_type":"professional_services","ransomware":null,"records_affected":1387,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-06-01-medenet-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-06-01","discovered_date":"2025-11-24","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4395dadb14899ceae09f98b60772f06c8b9ec92","impact_type":"data_theft","incident_date":"2025-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CONFIDENTIAL%20-%20Mariner%20-%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"2111cd9a229c","org_name":"Mariner Wealth Advisors, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624233"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CONFIDENTIAL%20-%20Mariner%20-%20Sample%20Notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41161.pdf"}],"summary":"A criminal third party accessed Mariner Wealth Advisors users’ cloud application accounts and downloaded files containing personal and account information.","supporting_quote":null,"technology_involved":["cloud applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-06-01","discovered_date":"2025-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"061ca03305d9928215ec777ed34494cafcca567f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-02","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fong%20Ko%20%26%20Associates%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f99a1798d605","org_name":"Fong, Ko & Associates LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624228"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fong%20Ko%20%26%20Associates%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Fong, Ko & Associates LLP reported that files were accessed and may have contained names and Social Security or tax identification numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2026-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d71659ef3095b7e71cb97f9fa36e816fb43fbbc7","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5ed332818466","org_name":"Edmunds","org_type":"retail_ecommerce","ransomware":null,"records_affected":177860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Edmunds","type":"hibp","url":"https://haveibeenpwned.com/Breach/Edmunds"}],"summary":"ShinyHunters listed Edmunds as breached, and data purportedly obtained in the incident was later published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2917c0cb624340d189a512f838298fc37ad7a49e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ae3e774d8f8","org_name":"Chief River Nursery","org_type":"other","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Chief%20River%20Nursery-2026-06-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-31","discovered_date":"2026-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1544fef246c53d140cf1c771b369694be33d6b17","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Morning%20Star%20Tours%20-%20Notification%20Letter%20-%20Credit%20Monitoring__Static_Proof_R3%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"bfe01dbced14","org_name":"Morning Star Tours","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624200"},{"fetched_at":null,"title":"Leak-site claim by pear","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TW9ybmluZyBTdGFyIFRvdXJzQHBlYXI"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Morning%20Star%20Tours%20-%20Notification%20Letter%20-%20Credit%20Monitoring__Static_Proof_R3%20%281%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005083"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morning%20Star%20Tours-2026-05-31"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Morning%20Star%20Tours-2026-06-01"}],"summary":"Morning Star Tours reported that a security incident involving infrastructure managed by a third-party technology provider may have exposed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["pear"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"05f54510494553e6a5723c5ca703a34b46b80d70","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"026db6627330","org_name":"Joyal Capital Management, LLC","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Joyal%20Capital%20Management%2C%20LLC-2026-05-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2026-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69cd8c6a91289039f894bc305a67626dc01ee17a","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5d57bc668973","org_name":"Atlas Menu","org_type":"technology_saas","ransomware":null,"records_affected":63926,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Atlas Menu","type":"hibp","url":"https://haveibeenpwned.com/Breach/AtlasMenu"}],"summary":"Atlas Menu’s database was published to a public GitHub repository, exposing email addresses, usernames, IP addresses, support tickets and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":["Atlas Menu database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-29","discovered_date":"2026-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ab18f87617f3cfa035ccef2d697405779025424","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41113.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"500001ee4409","org_name":"Zalaznik & Associates, PLLC","org_type":"professional_services","ransomware":null,"records_affected":685,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41113.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41113.pdf"}],"summary":"An unauthorized actor accessed files in Zalaznik & Associates' virtual office tax e-file system containing personal and financial information.","supporting_quote":null,"technology_involved":["virtual office tax e-file system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-05-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6381d19db89e5ebf1ec4c1f26f811ac16617fcae","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d174a58a530","org_name":"University of Dallas","org_type":"education","ransomware":null,"records_affected":10975,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005077"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#University%20of%20Dallas-2026-05-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bbb5fdc6cdb854951ce0781e260137a2a324a298","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bff4133b1799","org_name":"United Medical Doctors","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-29-united-medical-doctors"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afb3fc470749f324c7f70711b2316439c328ff87","impact_type":"data_theft","imported_from":null,"incident_date":"2026-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Texollini%2C%20Inc.%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"fc8889dc28cb","org_name":"Texollini, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Texollini%2C%20Inc.%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"}],"summary":"Texollini determined that an unauthorized actor accessed files containing personal and financial information between February 16 and February 18, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"6820966897c6a942a0605671797ef47aed91d70f","impact_type":"data_theft","incident_date":"2026-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-RXNT.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cf8d677e0462","org_name":"RXNT","org_type":"technology_saas","ransomware":null,"records_affected":11442,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-RXNT.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-RXNT.pdf"}],"summary":"RXNT reported that an unauthorized actor obtained data stored on one of its solutions between March 1 and March 3, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"024bd2e4f83bbbb5fa6553daadd7571e1052a24f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d001071e21d9","org_name":"Rochester Philharmonic Orchestra","org_type":"nonprofit","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Rochester%20Philharmonic%20Orchestra-2026-05-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b34a606d9ac3835aa8f1e05c46cfea958832094e","impact_type":"data_theft","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RCI%20Internet%20Services%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"9281d9034f2b","org_name":"RCI Internet Services","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RCI%20Internet%20Services%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005081"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#RCI%20Internet%20Services%2C%20Inc.-2026-06-12"}],"summary":"RCI Internet Services determined that files containing personal information were accessed and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-29","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"afe0551d0062233ec2a3fa5d55f9ec5fd2db662b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RXNT%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"df80ccce0619","org_name":"Networking Technology, Inc.","org_type":"professional_services","ransomware":null,"records_affected":353844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-29-networking-technology-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624113"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RXNT%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005076"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Networking%20Technology%2C%20Inc.-2026-05-29"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Networking%20Technology%2C%20Inc.-2026-05-29"}],"summary":"An unauthorized actor obtained personal data stored in an RXNT solution between March 1 and March 3, 2026.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82ea98885617e1ae3ecfefccd8db5082133c99f4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Manager%20on%20Call%2C%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"32eab12cb602","org_name":"Manager on Call, LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Manager%20on%20Call%2C%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-05-29","discovered_date":"2026-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fd58b9acbe737e0024fa32608ed7e75dd0b9c15a","impact_type":"data_theft","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41103.pdf"},"notes":null,"org_country":"US","org_id":"2c6b061da547","org_name":"Lakewood School District","org_type":"education","ransomware":null,"records_affected":2184,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41103.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41103.pdf"}],"summary":"An unauthorized actor accessed Lakewood School District systems and copied files containing personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bdb1671f50e6e90f6f79243d230089fb72469e77","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cedd6ba1be6d","org_name":"KerberRose S.C.","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#KerberRose%20S.C.-2026-05-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":"2025-12-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48de5b885c3d7eeec223c0109a5d8fb86847f806","impact_type":"data_theft","incident_date":"2025-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMA%20Diligence%20Services%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"1d05e7f72df4","org_name":"IMA Diligence Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624137"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMA%20Diligence%20Services%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005078"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#IMA%20Diligence%20Services%2C%20LLC-2026-05-29"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#IMA%20Diligence%20Services%2C%20LLC-2026-05-29"}],"summary":"An unauthorized actor accessed a third-party-managed legacy file server and acquired files containing individuals’ names.","supporting_quote":null,"technology_involved":["legacy file server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-03-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a68708659b3dd8b38b7c343e7c8636ff7e63c62d","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24323.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"6cd8876b1665","org_name":"Fulcrum Real Estate Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24323.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM24323.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fulcrum%20Real%20Estate%20Services%2C%20Inc.-2026-06-05"}],"summary":"Fulcrum Real Estate Services reported that files on its Egnyte platform may have been accessed or acquired without authorization on March 9, 2026.","supporting_quote":null,"technology_involved":["Egnyte"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-29","discovered_date":"2025-12-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ab867d6f3579f4498146f6e22af5e1e74aa10da","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EECU_Sample_Notice_Letter_38379368v1.pdf"},"notes":null,"org_country":"US","org_id":"ac03e2c830d5","org_name":"Educational Employees Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624147"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EECU_Sample_Notice_Letter_38379368v1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005079"}],"summary":"Educational Employees Credit Union reported that an unauthorized individual accessed an employee email account and may have accessed or removed certain emails.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other"],"disclosed_date":"2026-05-29","discovered_date":"2026-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"afa71364f96db1c93031d0adba5eb48fc8228187","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41106.pdf"},"notes":null,"org_country":"US","org_id":"e3cf9c3a19cf","org_name":"Eastern Washington University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41106.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41106.pdf"}],"summary":"Eastern Washington University reported that its vendor Instructure notified it of breaches of the Canvas learning management platform containing student education records.","supporting_quote":"We have been notified by one of our vendors, Instructure, that the learning management platform called Canvas was breached on April 29, 2026, and again on May 7, 2026.","technology_involved":["Canvas"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Instructure"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"178b0e9ee966","name":"Instructure"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ea999ccca1f6e0daa442b92fb857931fbda63dad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e02f95500d9","org_name":"DTG Consulting Solutions, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#DTG%20Consulting%20Solutions%2C%20Inc.-2026-05-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-04-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"782c420786af8c519888d50492f5a9d3d9243315","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87eef99e716e","org_name":"Corient Services LLC","org_type":"financial","ransomware":null,"records_affected":1646,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005070"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-29","discovered_date":"2026-04-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"510035280abcf8386332ec7bb7f6eb19daf3f97a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df8e26ae56ba","org_name":"Community First Health Plans, Inc.","org_type":"financial","ransomware":null,"records_affected":1579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005075"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5417f753e1aab716cbca8d50e1a1fdc975297b5f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c27f49961bf5","org_name":"Campbell University","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-29-campbell-university"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-28","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d36a4cb94c5a3438d20d55125e5e2adf8a27c9e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2fe73478e30","org_name":"University of St. Thomas","org_type":"education","ransomware":null,"records_affected":26644,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005066"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcf30bbef9a8f9cd68b357ca1a9d64d4fcb04522","impact_type":"unknown","incident_date":"2026-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Master%20Template%20Notification%20Letter%205.28.26.pdf"},"notes":null,"org_country":"US","org_id":"b75029cdaf6d","org_name":"Texas Capital","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624059"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Master%20Template%20Notification%20Letter%205.28.26.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005071"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41097.pdf"}],"summary":"Texas Capital’s notification letter offers recipients Experian identity protection following an incident dated April 26, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-28","discovered_date":"2025-01-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b4390be6c811bb597d82ddc3e3c24f6414f2153","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dad79d59a272","org_name":"Steel Warehouse Company LLC","org_type":"other","ransomware":null,"records_affected":13285,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005060"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Steel%20Warehouse%20Company%20LLC-2026-04-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-05-28","discovered_date":"2026-03-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0694fcbd11a5d99e37101807ae7488983143faf","impact_type":"data_theft","incident_date":"2026-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Smith%20%26%20James%2C%20CPAs%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7150d6da4965","org_name":"Smith & James, CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624055"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Smith%20%26%20James%2C%20CPAs%20-%20Sample%20Notice.pdf"}],"summary":"Smith & James, CPAs reported that an unknown actor accessed and acquired data from its email environment, including personal and medical information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-28","discovered_date":"2025-03-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2ea61f032686b0cb03a5ff8eecdcaff2cec8b3ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2083db6f7d38","org_name":"National Center for Construction Education and  Research Ltd.","org_type":"other","ransomware":null,"records_affected":15193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005063"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"interlock","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-28","discovered_date":"2026-05-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"72e799c9ef7f80dcade14ea792c7d70d8d8d5d4f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"566143885f11","org_name":"LoneStar Truck Group/TAG Truck Center","org_type":"retail_ecommerce","ransomware":true,"records_affected":3719,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005068"},{"date":"2026-05-04","fetched_at":null,"title":"Leak-site claim by interlock","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TG9uZXN0YXIgVHJ1Y2sgR3JvdXAgJiBUYWcgVHJ1Y2sgQ2VudGVyQGludGVybG9jaw"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"interlock","claim_groups":["interlock"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-28","discovered_date":"2025-07-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"547b1228dc81b336d71e487513651cd34a7fe09e","impact_type":"data_theft","incident_date":"2025-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/La%20Perouse%20-%20Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"499f0bc0ec13","org_name":"La Perouse LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624047"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/La%20Perouse%20-%20Sample%20Notice%20Letter.pdf"}],"summary":"An unauthorized party accessed an account on La Perouse LLC’s third-party billing platform and copied files stored there.","supporting_quote":null,"technology_involved":["third-party billing platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26456242b9dd87e69241b1f08a9cefc778652142","impact_type":"both","imported_from":null,"incident_date":"2026-04-15","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f4bb86d9b20b","org_name":"Kemper","org_type":"financial","ransomware":true,"records_affected":269299,"reviewed":false,"root_cause":"Attackers accessed Kemper's Salesforce environment via social engineering.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kemper","type":"hibp","url":"https://haveibeenpwned.com/Breach/Kemper"}],"summary":"ShinyHunters allegedly accessed Kemper's Salesforce environment via social engineering and published data they claimed to have taken as part of an extortion campaign.","supporting_quote":"The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method.","technology_involved":["Salesforce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"social","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2bf3a0676218d4da40ffb2d70c9e59372d718def","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1e6ab29e781","org_name":"Kannarr Eye Care","org_type":"healthcare","ransomware":null,"records_affected":14003,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-28-kannarr-eye-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-28","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20c02d38bfec354407e07dda8428b46564aa2b6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Johnson-Peltier%20Electric%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"28d8035c6a8b","org_name":"Johnson-Peltier Electric, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624043"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Johnson-Peltier%20Electric%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Johnson-Peltier Electric reported unauthorized access to its computer network and said files containing personal and financial information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4531412d1e9df311ea5981d7f986e8c9325bffc9","impact_type":"data_theft","incident_date":"2025-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Industrial%20Acceptance%20Corp.pdf"},"notes":null,"org_country":"US","org_id":"5e95e74ebef7","org_name":"Industrial Acceptance Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Industrial%20Acceptance%20Corp.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005074"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41141.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Industrial%20Acceptance%20Corporation-2026-06-01"}],"summary":"Industrial Acceptance Corporation reported unauthorized network activity, followed by discovery that files had been taken from its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bfefdd34328a506f000450d256e4fc23db4bfebb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5be3547257b7","org_name":"Homestead Gardens, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Homestead%20Gardens%2C%20Inc.-2026-05-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-28","discovered_date":"2026-05-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b7e43d9c7effe4523572ad6abe229c990ea9737","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbbdfc8504d7","org_name":"Dykema Gossett PLLC","org_type":"other","ransomware":null,"records_affected":7259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005062"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf7db5e6bf075b82005076ce1b763ed01ec8b7ae","impact_type":"both","imported_from":null,"incident_date":"2026-05-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"4e95e896a453","org_name":"Charter","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Charter","type":"hibp","url":"https://haveibeenpwned.com/Breach/Charter"}],"summary":"Charter confirmed that data including email addresses, names, phone numbers, physical addresses, and some job titles was exposed after an extortion campaign.","supporting_quote":null,"technology_involved":["employee directory"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"521d96c0e9c18d45d0e612bcdc7ca5582b99aa43","impact_type":"unknown","incident_date":"2025-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult_With_Credit_Monitoring_12_R1_Client_%28Redacted%29_38347446v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d175c2e1f8ae","org_name":"Blue Teal Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624052"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005073"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Blue%20Teal%20Holdings%2C%20LLC-2026-06-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7962e59cc3e19346369b355a5302fef170cb1c23","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa6b7033c30f","org_name":"NetLine Corporation","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#NetLine%20Corporation-2026-05-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"504a95b347706c95f5efc1cb8d6202be51ae5781","impact_type":"data_theft","incident_date":"2026-04-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4dc8a9456b8e","org_name":"Mytheresa","org_type":"retail_ecommerce","ransomware":true,"records_affected":84108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mytheresa","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mytheresa"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TXl0aGVyZXNhQHNoaW55aHVudGVycw"}],"summary":"ShinyHunters listed Mytheresa as a victim of pay-or-leak extortion and publicly released data including contact details, purchase information and partial credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"06f307c45ee3033ef7139fdd2a8d6c3ebeacbc93","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0d926d72401","org_name":"Carlyle Senior Care Management Company, Inc.","org_type":"professional_services","ransomware":null,"records_affected":4060,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-27-carlyle-senior-care-management-company-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-27","discovered_date":"2025-06-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea3e0238ee633a7ea87413678551619b401698fe","impact_type":"unknown","incident_date":"2025-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07fe14490f3d","org_name":"Cardinal Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":128551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cardinal%20Services%2C%20Inc.-2026-05-27"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cardinal%20Services%2C%20Inc.%2C%20dba%20Cardinal-2026-05-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-27","discovered_date":"2026-03-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78c5800ee3f7741d754bd5b776340d778bda9ef6","impact_type":"disruption_or_ransomware","incident_date":"2026-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ampex%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a33f366f4534","org_name":"Ampex Data Systems Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ampex%20Notification%20Letter.pdf"}],"summary":"Ampex Data Systems Corporation reported that a threat actor accessed and encrypted a network at one office location, and personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-26","discovered_date":"2025-08-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2cd1d56a81be91d95ba61baaefebe0fe5daaf10e","impact_type":"data_theft","incident_date":"2025-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41059.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f0ac7ba0923a","org_name":"University of St. Thomas-Houston","org_type":"education","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41059.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41059.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#University%20of%20St.%20Thomas-%20Houston-2026-05-26"}],"summary":"University of St. Thomas-Houston reported unauthorized access to certain systems and files containing personal information between July 25 and August 12, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bf32f0266e6d8109f0ed79cefb1eb94c2a270af4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e75406d1352c","org_name":"Sprague and Jackson","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Sprague%20and%20Jackson-2026-05-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-26","discovered_date":"2026-03-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c1ce4bba66eb9ae5bda849ae8b44194ba2779a7","impact_type":"data_theft","incident_date":"2026-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nickey%20Kehoe%20Security%20Incident%20Individual%20Notice%20Letter%20.docx%20%281%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"bb7b0d824462","org_name":"Nickey Kehoe","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623979"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nickey%20Kehoe%20Security%20Incident%20Individual%20Notice%20Letter%20.docx%20%281%29.pdf"}],"summary":"Nickey Kehoe reported an export event involving customer information stored in Klaviyo’s system, including names, email addresses, phone numbers, and postal addresses.","supporting_quote":null,"technology_involved":["Klaviyo"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Klaviyo"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"a558148ac9c9","name":"Klaviyo"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f05a2ad7c8997872ba67db763240497d41035500","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0cda1cd7a74f","org_name":"Metropolitan Marine Maintenance Contractors' Association","org_type":"other","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Metropolitan%20Marine%20Maintenance%20Contractors%27%20Association-2026-05-26"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Metropolitan%20Marine%20Maintenance%20Contractors%27%20Association-2026-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-26","discovered_date":"2026-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75ddf5983f4a9615c6913009b9c57d98647fe5e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Interstate%20Management%20Company%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"301cef405f68","org_name":"Interstate Management Company, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Interstate%20Management%20Company%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005065"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Interstate%20Management%20Company%2C%20LLC-2026-05-26"}],"summary":"Interstate Management Company reported that personal information may have been accessed or taken from certain hotel systems between November 19 and November 22, 2025.","supporting_quote":null,"technology_involved":["hotel systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-26","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b80fd3b8639f130e840a4b3f76f935df215745e7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_-_L1_Adult_CM_ERMI_final_v3_38336796v1_.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dd7b05d85cc4","org_name":"ERMI LLC","org_type":"healthcare","ransomware":null,"records_affected":74074,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-26-ermi-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623952"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005064"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20ERMI%2C%20LLC.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#ERMI%20LLC-2026-05-26"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-26","discovered_date":"2026-03-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"127169d1f1ea51f2ca88580e3bab097be4a377ba","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ameriprise%20-%20Individual%20Notification%20Letter%20-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"dccd69a8ebe4","org_name":"Ameriprise Financial","org_type":"financial","ransomware":true,"records_affected":47876,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ameriprise","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ameriprise"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621953"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ameriprise%20-%20Individual%20Notification%20Letter%20-%20Sample.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004987"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ameriprise%20Financial%2C%20Inc.-2026-04-17"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Ameriprise%20Financial%2C%20Inc.-2026-04-17"}],"summary":"ShinyHunters claimed to have exfiltrated and published data from Ameriprise Financial's Salesforce environment and internal SharePoint infrastructure after an extortion campaign.","supporting_quote":null,"technology_involved":["Salesforce","SharePoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"4c96f30d809e1070d7e0742e8f1fd970af34042b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-08","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40850.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":true,"records_affected":185256,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 7-Eleven","type":"hibp","url":"https://haveibeenpwned.com/Breach/7-Eleven"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40850.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40850.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#7-Eleven%2C%20Inc.-2026-05-16"}],"summary":"7-Eleven reported that an unauthorized third party accessed systems used to store franchisee documents containing personal information.","supporting_quote":null,"technology_involved":["franchisee document storage systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-23","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1fdfefd74846c39a5acbe46aad75f58476d25401","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/drop26_audits_L01_Virta_Adult_SSN_Letter_Final_12_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"6e90110b135f","org_name":"Virta Medical PC","org_type":"healthcare","ransomware":null,"records_affected":14636,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-23-virta-medical-pc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624890"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/drop26_audits_L01_Virta_Adult_SSN_Letter_Final_12_Redacted_0.pdf"}],"summary":"Virta Medical PC reported that files in a separate data repository may have been accessed, exposing personal and medical information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-22","discovered_date":"2026-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7eed63f0ca8e014b8d5d703291fc4c6609ccbe6c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"23b8a9f277d8","org_name":"The Oncology Institute, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1799191/000107997326000721/toi_8k.htm"},{"fetched_at":null,"title":"8-K EXHIBIT 99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1799191/000107997326000611/ex99x1.htm"}],"summary":"The Oncology Institute reported unauthorized access to certain company information systems, including systems affecting patient data, in an incident involving a software service provider.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"STLNW","base_day":"2026-05-22","returns":{"1":{"day":"2026-05-26","raw":0.1132,"adj":0.1066},"5":{"day":"2026-06-01","raw":-0.0755,"adj":-0.0928},"21":{"day":"2026-06-24","raw":-0.1981,"adj":-0.1815},"63":{"day":"2026-08-24","raw":0.0962,"adj":0.0723}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8d8db9eebaaf718ad47ca91bea51b4292eb6995a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c15e3c38620","org_name":"Southern Illinois Ob-Gyn Associates, S.C.","org_type":"healthcare","ransomware":null,"records_affected":38700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-southern-illinois-ob-gyn-associates-s-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"kairos","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3c9f17ed1c88d2c597bd37525d95b3cac2e52c3c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3f0003b5134","org_name":"South Florida Injury Centers, Inc.","org_type":"healthcare","ransomware":true,"records_affected":1525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-south-florida-injury-centers-inc"},{"fetched_at":null,"title":"Leak-site claim by kairos","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U291dGggRmxvcmlkYSBJbmp1cnkgQ2VudGVyc0BrYWlyb3M"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"kairos","claim_groups":["kairos"]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-22","discovered_date":"2025-10-29","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4061a3ca5c8815dc1f5cc3e3f61077dc0363479b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20NW%20-Final.pdf"},"notes":null,"org_country":"US","org_id":"3ab2ef422b63","org_name":"Sacramento County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623920"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20NW%20-Final.pdf"}],"summary":"A County employee forwarded work-related emails containing confidential client information from their County account to a personal email account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2c445e7c8b5879a564c9b3689c73aca034989788","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Pinnacle%20Holdings%2C%20LTD.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b38e5eb1e2c7","org_name":"Pinnacle Holdings, LTD","org_type":"unknown","ransomware":null,"records_affected":57,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Pinnacle%20Holdings%2C%20LTD.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-22","discovered_date":"2025-11-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e7de264122e0b47a74f25f8d9db6faac9e3e098","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9df6a60b8bc3","org_name":"Phillip Galyen P.C.","org_type":"other","ransomware":null,"records_affected":12225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005056"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Phillip%20Galyen%20P.C.%20dba%20Bailey%20%26%20Galyen-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"208f8066c150002b26f358af01d048722bbb750f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8883d7e36fee","org_name":"Oakwood Lutheran Senior Ministries, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-oakwood-lutheran-senior-ministries-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"869b1fde7bcb1aed325e07e161da64e8e87a1ef6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50ea1f53e408","org_name":"Nottingham Village","org_type":"healthcare","ransomware":null,"records_affected":5240,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-nottingham-village"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-05-22","discovered_date":"2026-02-25","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"4af8b3bea04e795f5f96b060df70f0c3892e6c5e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41006.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"01759891866e","org_name":"Gastro Health","org_type":"healthcare","ransomware":null,"records_affected":1628,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-gastro-health"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41006.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41006.pdf"}],"summary":"Gastro Health reported that a phishing incident involving personnel led to unauthorized access to files and systems containing some individuals’ personal and medical information.","supporting_quote":"On February 25, 2026, Gastro Health (“we” or “Gastro Health”) became aware of a phishing incident involving some of its personnel that resulted in unauthorized access to certain files and systems accessible to those personnel.","technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-22","discovered_date":"2026-05-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a96ae4bcefeb0c16e15251a2323e007cb65b0f07","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a28f09c7734b","org_name":"Barnhart Crane & Rigging Company, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":22822,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005058"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Barnhart%20Crane%20%26%20Rigging%20Company%2C%20Inc.-2026-05-21"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Barnhart%20Crane%20%26%20Rigging%20Company%2C%20Inc-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e6d5f6b2476c00543197562cc8b5e617c3727733","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8e7dbfccf2e4","org_name":"AUTOAPS LLC","org_type":"professional_services","ransomware":null,"records_affected":1591,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-22-autoaps-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08701158387659f7fd1014a391ef774b8c111b3e","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"3f8d311b1f9f","org_name":"Windows93","org_type":"other","ransomware":null,"records_affected":46105,"reviewed":false,"root_cause":"A beta application was exploited to download server files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Windows93 / Myspace93","type":"hibp","url":"https://haveibeenpwned.com/Breach/Windows93"}],"summary":"Windows93’s Myspace93 sub-site was breached after a beta application was exploited to download server files, exposing account data.","supporting_quote":"In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files.","technology_involved":["beta application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"f84698ba470e12819ef15e5b24001127a1c192bd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8593776800a8","org_name":"Station Casinos LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Station%20Casinos%20LLC-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4885510efc1fad7f645b7593fa1c639bb9a50f22","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1884000ab9e","org_name":"Regence","org_type":"healthcare","ransomware":null,"records_affected":2856,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-21-regence"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"98af1aad14a15b686e3665d07333525624b57bd2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5df9ab348081","org_name":"Radiology Associates of Richmond","org_type":"healthcare","ransomware":null,"records_affected":266183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-21-radiology-associates-of-richmond"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005057"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Radiology%20Associates%20of%20Richmond%2C%20Inc.-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d98904a7683ca276f819b2d8a483af3dae505dcd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7a593af5c28e","org_name":"Legal Aid Service of Broward County","org_type":"nonprofit","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Legal%20Aid%20Service%20of%20Broward%20County-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8d23c43ade50b09e56d4a4c66877014b6700a485","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b0411c78af4","org_name":"Ira L. Savetsky, MD PLLC","org_type":"healthcare","ransomware":null,"records_affected":564,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-21-ira-l-savetsky-md-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b86c7e9ba8e99387851e8144aceb4fd06b2d4433","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"abc480b0e9d6","org_name":"Eversource Energy","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Eversource%20Energy-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"926a62ac73d3256c3baa5d47a8ddb3dc63bc663a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-12-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a9dea45974ea","org_name":"Dragonica Lunaris","org_type":"technology_saas","ransomware":null,"records_affected":126293,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dragonica Lunaris","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dragonica"}],"summary":"A breach of Dragonica Lunaris exposed user email addresses, usernames, dates of birth, and bcrypt password hashes.","supporting_quote":null,"technology_involved":["Dragonica Lunaris"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4eea1943f9d0fd80b33848325fd4b964c86b9806","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Coastal%20Carolina%20Centers.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0722fecb3a08","org_name":"Coastal Carolina Centers of Urology and Surgery, LLC","org_type":"healthcare","ransomware":null,"records_affected":2886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-21-coastal-carolina-centers-of-urology-and-surgery-llc"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Coastal%20Carolina%20Centers.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Coastal%20Carolina%20Centers%20of%20Urology%20and%20Surgery%2C%20LLC-2026-05-22"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"akira","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"46640d9fd993139ad07c8ec2804b4e39513ae46b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d212aba3635","org_name":"CMD Outsourcing Solutions","org_type":"other","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#CMD%20Outsourcing%20Solutions-2026-05-21"},{"date":"2026-04-07","fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q01EIE91dHNvdXJjaW5nIFNvbHV0aW9uc0Bha2lyYQ"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"actor_id":"akira","claim_groups":["akira"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-21","discovered_date":"2026-04-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"49a6e688c341b93be82f3027d64ae6289bc54fa2","impact_type":"unknown","incident_date":"2026-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"422d80efe6d1","org_name":"Cambia Health Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":2856,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cambia%20Health%20Solutions%2C%20Inc.-2026-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"929cf98beec7399bd702f525b1dc2514e9df8050","impact_type":"data_theft","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40948.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5046c34c277a","org_name":"VacPartsWarehouse.com LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40948.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40948.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#VacPartsWarehouse.com%20LLC-2026-05-20"}],"summary":"An unauthorized actor accessed PartsWarehouse.com’s online shopping platform and may have acquired data related to payment transactions.","supporting_quote":null,"technology_involved":["online shopping platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"196a535cc47b2b03b0560f5067d12add81be3e3f","impact_type":"data_theft","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VacPartsWarehouse.com%20LLC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5046c34c277a","org_name":"VacPartsWarehouse.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623719"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VacPartsWarehouse.com%20LLC%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005054"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#VacPartsWarehouse.com%20LLC-2026-05-20"}],"summary":"An unauthorized actor accessed VacPartsWarehouse.com's online shopping platform and may have acquired customer and payment-card data.","supporting_quote":null,"technology_involved":["online shopping platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ac209456b593b12d75d5ac9a570b2427863c5af7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Vacation%20Myrtle%20Beach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"850d944c58bc","org_name":"Vacation Myrtle Beach","org_type":"unknown","ransomware":null,"records_affected":7738,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Vacation%20Myrtle%20Beach.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Vacation%20Myrtle%20Beach-2026-05-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-20","discovered_date":"2024-07-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"997c669ddae9154463592104356b3c326b2aac98","impact_type":"both","incident_date":"2024-07-09","initial_access":"unknown","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20The%20Phia%20Group.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"462776c37c4a","org_name":"The Phia Group","org_type":"professional_services","ransomware":null,"records_affected":3057,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20The%20Phia%20Group.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20The%20Phia%20Group.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Phia%20Group%2C%20LLC-2026-07-04"}],"summary":"The Phia Group reported a July 2024 incident that temporarily disrupted its computer network, during which some personal information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-20","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bf3e3258fecbab4358d2afb66aed667b8a9cc7b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6081ba22e21c","org_name":"Spring Independent School District","org_type":"education","ransomware":null,"records_affected":5690,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005049"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b0ad8799097677b6ad9c7664ef9060d3f055118","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5130a9832b2","org_name":"Southwest Behavioral Health Services.org","org_type":"healthcare","ransomware":null,"records_affected":2316,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-20-southwest-behavioral-health-services-org"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a0ec08830aca624b9ca2a9e5012e625d62a24d6f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bdf46e1851e4","org_name":"Pease Mountain Law PLLC","org_type":"other","ransomware":null,"records_affected":785,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Pease%20Mountain%20Law%20PLLC-2026-05-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"everest","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf6a186fd37ebc299943061ceceabd3856314548","impact_type":"unknown","incident_date":"2025-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice%20-%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"192f36d8caec","org_name":"Frost Bank","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623688"},{"fetched_at":null,"title":"Leak-site claim by everest","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RnJvc3QgQmFua0BldmVyZXN0"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005051"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Frost%20Bank-2026-05-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"everest","claim_groups":["everest"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-20","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a81793bbd1091c11c5e36c3c69af5a87f41e494","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"512e80885b29","org_name":"Conduent Business Services, LLC  (revised submission)","org_type":"other","ransomware":null,"records_affected":62486662,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005045"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df5ff35ee9987b75d6d897bcaf3157c6ac81e05e","impact_type":"unknown","incident_date":"2025-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CS1_%2B_CS2_Letter_G_-_Adult_CM_rev1%2838267072.1%29_Redacted_38325515v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b6dc0cfe643d","org_name":"Cardinal Services, Inc, Cardinal Employer Organization, and Preferred Employer Solutions, collectively (“Cardinal”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623713"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005053"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"00d9aa271b70339a90fe603c81e3b1d2f24bf936","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40945.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"529c3fdefa0c","org_name":"Cardinal Services, Inc, Cardinal Employer Organization, and","org_type":"unknown","ransomware":null,"records_affected":2066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40945.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-19","discovered_date":"2026-02-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f412a9c6e4a100057e285d36e2228965d12baeb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4397b6889bb9","org_name":"The North Carolina Board of Examiners for Engineers and Surveyors","org_type":"government","ransomware":null,"records_affected":4395,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005048"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-19","discovered_date":"2026-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44cd212346b5c238f0c6ec09d084f272cc49ed34","impact_type":"data_theft","incident_date":"2026-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Southern%20California%20University%20of%20Health%20Sciences%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"1b92196bdfd7","org_name":"Southern California University of Health Sciences","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623665"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Southern%20California%20University%20of%20Health%20Sciences%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Southern California University of Health Sciences reported that an unauthorized actor viewed and copied files stored within its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"71927ec9ce4c903d902369c0ec430c8051ee3993","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d76f4aceb23","org_name":"Singing River Health System","org_type":"healthcare","ransomware":null,"records_affected":53888,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-19-singing-river-health-system"},{"fetched_at":null,"title":"Leak-site claim by anubis","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U2luZ2luZyBSaXZlciBIZWFsdGggU3lzdGVtQGFudWJpcw"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["anubis"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b6dc225679a1d8964a287308d48a5d00eccad88f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a85a5a5e1ff4","org_name":"North Carolina Board of Examiners for Engineers and Surveyors","org_type":"unknown","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#North%20Carolina%20Board%20of%20Examiners%20for%20Engineers%20and%20Surveyors-2026-05-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"3f52f42d0f425a94d3ed83d9323b7a5bbd7c5674","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"685586a9cad5","org_name":"Global Consulting Services & Software Development","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Global%20Consulting%20Services%20%26%20Software%20Development-2026-05-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b92d981aac21db476f62460332eae459d83296","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"PT","org_id":"78646bfb0c8b","org_name":"CTT","org_type":"transportation_logistics","ransomware":null,"records_affected":468124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CTT","type":"hibp","url":"https://haveibeenpwned.com/Breach/CTT"}],"summary":"Data allegedly obtained from CTT was posted to a public hacking forum, including email addresses, names, phone numbers, and parcel tracking numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-19","discovered_date":"2025-12-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f6e4c9872e081bafc152ca4c80bc35097f547af","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1326671bfa9c","org_name":"Clarity Telecom, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":18121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005047"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7dd8cab003a3b867801be183b8b535b7184ab9ee","impact_type":"unknown","incident_date":"2026-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40910.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dcdd5cd64a5d","org_name":"Caesars Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":44023,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40910.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40910.pdf"}],"summary":"Caesars Entertainment identified suspicious activity in cloud-hosted platforms used to store data on February 23, 2026.","supporting_quote":null,"technology_involved":["cloud-hosted platforms"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"578251fff8a2d29ecc8df84f863ede07ffe2210a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0557016e116f","org_name":"Beyond Measure Design & Construction","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Beyond%20Measure%20Design%20%26%20Construction-2026-05-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-19","discovered_date":"2026-02-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"27c792c75b18deb1f1e8ececffb467af3b5cba4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cf226198d95","org_name":"ACME Truck Line, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":21799,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005046"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-18","discovered_date":"2026-01-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0adc6b040dabe5ceda4e543fc503ae83eaac4f74","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Beacon%20Mutual%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"73cf87d3818a","org_name":"The Beacon Mutual Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Beacon%20Mutual%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005044"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#The%20Beacon%20Mutual%20Insurance%20Company-2026-05-18"}],"summary":"The Beacon Mutual Insurance Company reported that an unauthorized person accessed some systems and acquired copies of certain files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f77507e1c78289185e482e1dd0fcbc8a900952e4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40887.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"292aab7f0771","org_name":"REIC Rentals, LLC","org_type":"other","ransomware":null,"records_affected":586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#REIC%20Rentals%2C%20LLC-2026-05-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40887.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40887.pdf"}],"summary":"REIC Rentals, LLC reported that unauthorized access to systems resulted in certain files being accessed or copied, and an impacted file may have contained individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bb106b7735d8b3e0bc3fd5be1633193ba54a3eb9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c0df1d5e358f","org_name":"Perrigo Company","org_type":"other","ransomware":null,"records_affected":54,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Perrigo%20Company-2026-05-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a226da81d4fc5a6e2b74d893a55cc9c0fdb7197c","impact_type":"unknown","incident_date":"2026-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lusamerica_-_Redacted_Letter_38309432v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"793fbf8af256","org_name":"Lusamerica Foods","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623614"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40888.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-18","discovered_date":"2026-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"077d58a8b71423a707036daf925851b0eae9e377","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ae9b62cc324","org_name":"Hank’s Furniture, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1315,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005041"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4664ed861cc27504d3f85f48b03c07acffb8d59a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29dd78c85e0c","org_name":"Greenbaum Rowe Smith & Davis LLP","org_type":"professional_services","ransomware":null,"records_affected":12801,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-18-greenbaum-rowe-smith-davis-llp"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"df9ff3a84cda5349dda7257286ec19eaebea8b01","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7df1eee335a7","org_name":"Eyemart Express, LLC","org_type":"healthcare","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-18-eyemart-express-llc"},{"fetched_at":null,"title":"Leak-site claim by payoutsking","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RXllbWFydCBFeHByZXNzQHBheW91dHNraW5n"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eyemart%20Express%2C%20LLC-2026-05-12"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["payoutsking"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"incransom","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fb389856e86dd56314e22adb09f8baf80f0155f6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89fff9c41c73","org_name":"Community Connections","org_type":"healthcare","ransomware":true,"records_affected":18943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-18-community-connections"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q29tbXVuaXR5IENvbm5lY3Rpb25zQGluY3JhbnNvbQ"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"incransom","claim_groups":["incransom"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-18","discovered_date":"2026-02-12","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"838e7f68e96412f359d03dd40fcfe0f25afb214f","impact_type":"data_theft","incident_date":"2026-01-16","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Boston%20Capital%20LP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a01075a9e04b","org_name":"Boston Capital Holdings LP","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The actor used other companies’ cloud systems to circumvent the organization’s cybersecurity tools and permissions.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623610"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Boston%20Capital%20LP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Boston%20Capital%20Holdings%20LP-2026-05-18"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Boston%20Capital%20Holdings%20LP-2026-05-18"}],"summary":"Boston Capital Holdings LP reported that a cyber actor used other companies’ cloud systems to gain access and copy files containing personal information.","supporting_quote":"While investigating this matter, we determined that a sophisticated cyber actor made use of other legitimate companies’ cloud systems attempting to circumvent our strict cybersecurity tools and permissions, and gained access to our systems.","technology_involved":["cloud systems"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"bd3d711db00f6d7e6af5afcff04f13bdd1ddf917","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"de362b986355","org_name":"Bomco, Inc.","org_type":"other","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bomco%2C%20Inc.-2026-05-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6c856e2fa6aedf71ed33478321cd04d69654040","impact_type":"both","imported_from":null,"incident_date":"2026-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CO","org_id":"f29545dcf51a","org_name":"Addi","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Addi","type":"hibp","url":"https://haveibeenpwned.com/Breach/ADDI"}],"summary":"Addi reported unauthorized activity on its platform, and ShinyHunters claimed responsibility and published data allegedly obtained from the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"eff4e1072c1056b2c39f21d42f9c5ec60b132eb8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac164fa3904c","org_name":"Retail Services WIS Corporation","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Retail%20Services%20WIS%20Corporation-2026-05-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-15","discovered_date":"2025-07-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"3e35d50980fe4c315f367cc6c068f26ff96296a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82828626266c","org_name":"US Tiger Securities Inc. (“US Tiger”)  ","org_type":"financial","ransomware":null,"records_affected":26985,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005040"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USTiger_Individual%20Letter%20Sample.pdf"}],"summary":"US Tiger Securities reported that files in its virtual back-office environment were encrypted and that an unauthorized third party copied some files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-15","discovered_date":"2025-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce0fe35f4601976a76c265d26c02ce7b4575f67a","impact_type":"both","incident_date":"2025-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40765.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9d66580b9a21","org_name":"US Tiger Securities Inc.","org_type":"financial","ransomware":null,"records_affected":885,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40765.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40765.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#US%20Tiger%20Securities%20Inc.-2026-05-15"}],"summary":"US Tiger Securities reported that files in its virtual back-office environment were encrypted and some files were copied by an unauthorized third party.","supporting_quote":null,"technology_involved":["virtual back-office environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"5b4a7f95e849d3f3f88e99e7155c5eb023d9077e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0dd1d7134dcd","org_name":"United Seating and Mobility LLC","org_type":"other","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#United%20Seating%20and%20Mobility%20LLC%20dba%20Numotion-2026-05-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"a8c2ce59f3cb1776310fbfa4bd69eddad92121b6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ebe79eab7e93","org_name":"Terra Holdings, LLC","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Terra%20Holdings%2C%20LLC-2026-05-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-05-15","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"044daf4679672be50bd6e2bbb63a555751ff31c1","impact_type":"data_theft","incident_date":"2026-03-31","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lumexa%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"6c235b040861","org_name":"Lumexa Imaging","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623542"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lumexa%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005042"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lumexa%20Imaging-2026-05-15"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lumexa%20Imaging-2026-06-12"}],"summary":"Lumexa Imaging reported that patient documents may have been obtained from a vendor’s system.","supporting_quote":"On April 15, 2026, we learned that an unauthorized person may have viewed or obtained copies of documents containing our affiliated radiology practices and imaging centers’ patient information from the vendor’s system.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f6cb07ad6bcdabd3d7957a788cbb03c507799330","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22ecfc6989e2","org_name":"Liberty Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":7329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-15-liberty-solutions-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3318aee13e4a7856bb9733e2ec06efb22a5a8baf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7eb4575bfbf6","org_name":"Insurance ACE/Humana Inc.","org_type":"healthcare","ransomware":null,"records_affected":1761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-15-insurance-ace-humana-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"48cbbcae30bb8f22a7e9a279a4caec3308151904","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"982366e69156","org_name":"FMC Group Holdings LP","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#FMC%20Group%20Holdings%C2%A0LP-2026-05-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-15","discovered_date":"2025-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c890471a110c8143041c7471c1b534c521891d46","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"8de9b02644f8","org_name":"Fluke Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A criminal actor exploited a vulnerability in a third-party application used by Fluke.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623465"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Notification.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Fluke%20Corporation-2026-05-13"}],"summary":"Fluke Corporation reported that a criminal actor exploited a vulnerability in a third-party application to access part of its network, where personal information was involved.","supporting_quote":"On September 29, 2025, we learned that a criminal actor exploited a vulnerability in a third-party application used by us and was able to access a limited segment of our network.","technology_involved":["third-party application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-15","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61460d9093468263a19809b84d78a202461bba7f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Port%20Hueneme_Sample%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"38130f73e0fd","org_name":"City of Port Hueneme","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Port%20Hueneme_Sample%20Consumer%20Notice%20Letter.pdf"}],"summary":"The City of Port Hueneme reported that data was acquired without authorization in an incident on or about February 23, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-15","discovered_date":"2026-04-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef7863dfb9a1f9409004a16bc50836f3f4284189","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"28ccae56a2fa","org_name":"City of Bedford, Texas","org_type":"government","ransomware":null,"records_affected":14331,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005039"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"30e99d151e64964e894a7501edb283a350404846","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Charlie%20Condon%20Law%20Firm%2C%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40cf9adfb937","org_name":"Charlie Condon Law Firm, LLC","org_type":"unknown","ransomware":null,"records_affected":2320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Charlie%20Condon%20Law%20Firm%2C%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"91eaeaf1dc68179338252002b50fe48b165cb0d0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98e0aec444cb","org_name":"Centers for Dialysis Care","org_type":"healthcare","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-15-centers-for-dialysis-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-15","discovered_date":"2026-04-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b97ce9099aacc6d3ec7132d049b04698a00841f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"262961b831c3","org_name":"Bonick Landscaping Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005038"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0cb72c5e561a2ecb16f8b152101026201c08b813","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69df756cbcef","org_name":"NJ Pain Care Specialists, LLC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-14-nj-pain-care-specialists-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-14","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed58306a72a7ee2a4cc139bc251b86fbb669d94c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"112fc6666201","org_name":"Newton County, Texas","org_type":"government","ransomware":null,"records_affected":1362,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005032"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-14","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"eb71ac69de3530d4e2da9e9e29c5619d4d36920b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7464ac6c2fdd","org_name":"Cresset Capital Management","org_type":"financial","ransomware":null,"records_affected":9884,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005235"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623359"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-26920%20Cresset%20-%20Adult%20CM%2024M%20%5BA%5D%20Client%20r2prf.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cresset%20Capital%20Management-2026-05-14"}],"summary":"Cresset Capital Management identified suspicious activity in its computer network, and an investigation found that personal and financial information had been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"af863cf91faae4f2a56bf471032c6f2682530665","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0594d8197d93","org_name":"Bridle Trails Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":20976,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-14-bridle-trails-family-dentistry"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c2b82879a0fe6ff6333ade0924d2f9dd5f22eb8","impact_type":"both","imported_from":null,"incident_date":"2026-04-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"65e87e34a7c4","org_name":"Abrigo","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Abrigo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Abrigo"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWJyaWdvLCBJbmMuQHNoaW55aHVudGVycw"}],"summary":"Abrigo data allegedly taken from its Salesforce instance was published after a ShinyHunters extortion attempt.","supporting_quote":null,"technology_involved":["Salesforce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bfb04f1200f2a9b8bfe4d62c2aa8725ba273483d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba8aab0f21e8","org_name":"Pivot Health","org_type":"professional_services","ransomware":null,"records_affected":5864,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-13-pivot-health"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005035"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-13","discovered_date":"2026-04-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"605bad6f516f2da2dd59fc2ee4646349d34c672f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40703.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"add2bebc4660","org_name":"Patient Accounting Service Center, LLC","org_type":"professional_services","ransomware":null,"records_affected":430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40703.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40703.pdf"}],"summary":"A spreadsheet formatting error misaligned employee information, and letters containing some employees’ information were mailed to other employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"Prudential"},"updated_at":"2026-10-12","veris_action":"error","derived":{"vendors":[{"id":"b607ea1ede38","name":"Prudential"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"67e672aa7b01233c262e31d2c8fdf5425506b668","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46df6ce7cc7f","org_name":"Hawaii Mutual Insurance Company, Inc.","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hawaii%20Mutual%20Insurance%20Company%2C%20Inc.-2026-05-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6489dbe40d184458d24baa718e52c89363806f1e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"afd8fd89ae3b","org_name":"Dental Studies Institute","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Dental%20Studies%20Institute-2026-05-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"be951d354abd3747b3f70e9394e3417814007e8e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac0fd2ff98d4","org_name":"Curry Management Corporation","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Curry%20Management%20Corporation-2026-05-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ad5c64f3d7644281e3a71efca8cf258ee69a249","impact_type":"both","incident_date":"2026-04-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a750134e0419","org_name":"Canada Life","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Canada Life","type":"hibp","url":"https://haveibeenpwned.com/Breach/CanadaLife"}],"summary":"Canada Life data, including contact details and some customer support tickets, was published after a ShinyHunters extortion campaign.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"850378b466a69fc2393c05ab44e4b3160ffe3894","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb304a30f09d","org_name":"Bishop Lifting","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Bishop%20Lifting-2026-05-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-12","discovered_date":"2026-03-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2850e7e84704f60fe22c9b1b8638eec1ff226a4","impact_type":"data_theft","incident_date":"2025-08-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tulane%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"92775925ace7","org_name":"Tulane University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day vulnerability in Oracle’s E-Business Suite application allowed unauthorized parties to access files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623281"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tulane%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005030"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tulane%20University-2026-05-12"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tulane%20University-2026-05-12"}],"summary":"Tulane University reported that attackers exploited a zero-day vulnerability in Oracle E-Business Suite to access and acquire files containing personal and banking information.","supporting_quote":"The investigation determined that, on August 10, 2025, the vulnerability in Oracle’s E-Business Suite application allowed unauthorized parties to access and acquire files stored in the application.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e1493e27b5b58dc39961b01a7422d0bb2d992d87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c41701041b6","org_name":"Ocelot Ventures, LLC dba Excelas","org_type":"professional_services","ransomware":null,"records_affected":2275,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-12-ocelot-ventures-llc-dba-excelas"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"634f2d28ba6ea53b5234f1eb2c560d1cfce25f88","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-15","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HIPPA%20letter%202026.04.23%20English.pdf"},"notes":null,"org_country":"US","org_id":"5601425deee7","org_name":"Family Health Centers of San Diego","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623313"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HIPPA%20letter%202026.04.23%20English.pdf"}],"summary":"A Family Health Centers of San Diego physician sent personal health information to a personal email address.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1e7926ddadd594738f2dd649c04757d481b9b7a2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e87d79af0ed7","org_name":"Erie Family Health Centers","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Erie%20Family%20Health%20Centers-2026-05-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c312cc21d20040d60f25a65fd8f28b834800b769","impact_type":"data_theft","imported_from":null,"incident_date":"2026-05-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9e148da05c1a","org_name":"Cushman & Wakefield","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cushman & Wakefield","type":"hibp","url":"https://haveibeenpwned.com/Breach/CushmanWakefield"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q3VzaG1hbiAmIFdha2VmaWVsZCBJbmMuQHNoaW55aHVudGVycw"}],"summary":"ShinyHunters threatened Cushman & Wakefield with extortion and published data it alleged came from the firm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-11","discovered_date":"2026-05-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f13a22bfe0a5b28102cc6fb60d45fff24c809abc","impact_type":"both","incident_date":"2026-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"80855c7dbbe7","org_name":"West Pharmaceutical Services","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/105770/000010577026000068/wst-20260507.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/105770/000010577026000077/wst-20260507.htm"}],"summary":"West Pharmaceutical Services reported that an unauthorized party exfiltrated data and encrypted certain systems, disrupting business operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"WST","base_day":"2026-05-11","returns":{"1":{"day":"2026-05-12","raw":-0.0317,"adj":-0.0302},"5":{"day":"2026-05-18","raw":-0.0555,"adj":-0.0546},"21":{"day":"2026-06-10","raw":0.0267,"adj":0.0455},"63":{"day":"2026-08-11","raw":0.0902,"adj":0.0479}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"38e01cf34d786e6877f0b14fc2bb9aabbff1258c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e78c4febe617","org_name":"U.S. 1031 Exchange Services, Inc.","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#U.S.%201031%20Exchange%20Services%2C%20Inc.-2026-05-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"886f113b95904dd11f3fd002efa2ed36ce393c86","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4de59ca43680","org_name":"Saurabh N. Patel, M.D – Florida Retina Center","org_type":"healthcare","ransomware":null,"records_affected":13652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-11-saurabh-n-patel-m-d-florida-retina-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-11","discovered_date":"2025-12-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4d097c230f1af77fd3b2e41eee4aad9daf318284","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05134183f56d","org_name":"New York Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":704,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005024"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4049bac4e9cbe98bee6d8e85fb4c27e5fa9fe05","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Instructure%20Breach%20Notifications.pdf"},"notes":null,"org_country":"US","org_id":"caf5ebcd6e50","org_name":"Las Lomitas Elementary School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623195"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Instructure%20Breach%20Notifications.pdf"}],"summary":"A criminal threat actor gained access to Las Lomitas Elementary School District information on Instructure’s Canvas platform, including names, email addresses, and class enrollments.","supporting_quote":null,"technology_involved":["Canvas LMS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Instructure"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"178b0e9ee966","name":"Instructure"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-11","discovered_date":"2026-01-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0873b283ae4920bf45fdd1a1a96e035fffe0b81c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"999f72162593","org_name":"Lamb-Star Engineering, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":459,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005029"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-11","discovered_date":"2026-04-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3482d8e7454f2518ad6d8d8f75d749ae81fd9149","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9b5f64424186","org_name":"Hill Country Bible Church","org_type":"nonprofit","ransomware":null,"records_affected":1937,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005023"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-11","discovered_date":"2026-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"29dbc23bb7dae454218abae79ac26f720f5f5b85","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb236c9b7ea4","org_name":"Gulfstream Services, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005025"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-11","discovered_date":"2026-03-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"11a05d5401a08376f7731c3f302bb2fdc2a1685c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5d2582b7229","org_name":"Blue Enterprises, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":45854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005027"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Blue%20Enterprises%2C%20Inc.-%20dba%20Hogan%20Transports%2C%20Inc.-2026-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b71505de415974e689c6931c8bb0efe53de853b4","impact_type":"disruption_or_ransomware","incident_date":"2025-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Lending-%20Notification%20Letter%20-%20U.S.%20Adult%20Residents%28175903957.1%29.%20pdf.pdf"},"notes":null,"org_country":"US","org_id":"d92b43a93da5","org_name":"American Lending Center","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623190"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Lending-%20Notification%20Letter%20-%20U.S.%20Adult%20Residents%28175903957.1%29.%20pdf.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005034"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Lending%20Center-2026-05-12"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#American%20Lending%20Center-2026-05-13"}],"summary":"American Lending Center reported that a threat actor compromised its internal network, executed a ransomware attack, and accessed files that may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"18ca1ded832a9e59ddb45e60d093fb88c2b76a36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e70cb52b2c2f","org_name":"Richard S. Miller, Inc.","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Richard%20S.%20Miller%2C%20Inc.-2026-05-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7e710dbc719bf38d9ea06d13fafc4e4abd593118","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd8673032dd3","org_name":"Plaid, Inc.","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Plaid%2C%20Inc.-2026-05-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5215440507db760188f826d6c2992a40057c1424","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-15","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"unknown","org_id":"4bf403f4304c","org_name":"Zara","org_type":"retail_ecommerce","ransomware":true,"records_affected":197376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zara","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zara"}],"summary":"ShinyHunters claimed Zara data was exposed after a compromise of the Anodot analytics platform.","supporting_quote":"The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records.","technology_involved":["Anodot analytics platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anodot"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"d2e9e6619d29","name":"Anodot"}],"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1cf1bcfa256e2dc35b381a5e7c2b267b2ce7611","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3b576a3b844","org_name":"ViaQuest Psychiatric & Behavioral Solutions, LLC","org_type":"healthcare","ransomware":null,"records_affected":6420,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-08-viaquest-psychiatric-behavioral-solutions-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2978de361ee2cf3f55e43844220652672f4a18b0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4bc9b5a8d71f","org_name":"Verber Dental Group PC","org_type":"healthcare","ransomware":null,"records_affected":8598,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-08-verber-dental-group-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"91f3b10948834b2c430084139da9a94d3f82bccf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6dde084313b2","org_name":"Palomar Health Medical Group","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-08-palomar-health-medical-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"34955549678f006a6927f5d20e8ffae02dc74c5a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65993f96e961","org_name":"New Congol LLC","org_type":"other","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#New%20Congol%20LLC%20-%20dba%20New%20Congoleum-2026-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30dbe02b0f31b0fee6e159aab207a1e922e93a13","impact_type":"unknown","incident_date":"2025-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MSCU%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"291f855a682e","org_name":"MemberSource Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623105"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MSCU%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005026"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#MemberSource%20Credit%20Union-2026-05-08"}],"summary":"MemberSource Credit Union filed a consumer notification letter about a data event, but the provided text does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"155a0e73dd2753081f657efc0b6a5b25dc6d33de","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55f97f001a8b","org_name":"Lautrec, Ltd.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lautrec%2C%20Ltd.-2026-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-08","discovered_date":"2025-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47f35606e2ffa50e5058bdba275709719d5f463b","impact_type":"data_theft","incident_date":"2025-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"92aedbf192fb","org_name":"Hogan Transports, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20CA_0.pdf"}],"summary":"Hogan Transports reported unauthorized access to its systems between October 25 and November 29, 2025, during which certain files were accessed or copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81961583de122f47edb730666fd0f0e28002a6f7","impact_type":"unknown","incident_date":"2026-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Canvas%20Security%20Incident.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbb26243ef35","org_name":"Chaffey Joint Union High School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623157"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b82f814979176f2c4fe7d29a817acc2de993fd3f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ebde5ccdb6d","org_name":"Cape Fear Country Club","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Cape%20Fear%20Country%20Club-2026-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7e32d5113ece347b45e0cca6782e074d9c1bc7a6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d14f7b36c52","org_name":"Bronsky Orthodontics","org_type":"healthcare","ransomware":null,"records_affected":3183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-08-bronsky-orthodontics"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-08","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f492a1de9063a74d514d2768a16d1eeb811cb287","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"786aba737d66","org_name":"AssetMark Trust Company","org_type":"financial","ransomware":null,"records_affected":9158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005022"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"46b126a05aaef77cbc987bcaa97f7c4186b16059","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29aa6892fcdb","org_name":"54 Below Inc.","org_type":"nonprofit","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#54%20Below%20Inc.-2026-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f313d5a84f473fd3d4868bf31b22be2012e4ba8","impact_type":"both","imported_from":null,"incident_date":"2026-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"aa2f0017abe4","org_name":"Woflow","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Woflow","type":"hibp","url":"https://haveibeenpwned.com/Breach/Woflow"}],"summary":"Woflow was named by ShinyHunters, which published files allegedly obtained from the company containing customer contact information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-07","discovered_date":"2026-04-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"efa3eab9951aaddb37b2042f58113c32a1a6cd6c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cornerstone_Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8977c1ea82f3","org_name":"Sanger Skilled Care, LLC dba Cornerstone Care Center","org_type":"healthcare","ransomware":null,"records_affected":1510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-07-sanger-skilled-care-llc-dba-cornerstone-care-center"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623043"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cornerstone_Sample%20Notice.pdf"}],"summary":"Cornerstone Care Center reported that an unauthorized third party may have accessed a limited amount of protected health information associated with one user account.","supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"c3c661117d9c2590058baf592522451bc5393a99","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"73439cfba09d","org_name":"Johnson, Webbert, & Beard LLP","org_type":"other","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Johnson%2C%20Webbert%2C%20%26%20Beard%20LLP-2026-05-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-05-07","discovered_date":"2026-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ea7760638ef70e647c004854573f1e4cea9bd5ee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Darlington%20County%20School%20District.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"64b98f74a89a","org_name":"Darlington County School District","org_type":"education","ransomware":null,"records_affected":1958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Darlington%20County%20School%20District.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Darlington%20County%20School%20District.pdf"}],"summary":"Darlington County School District reported that a file containing 2025 employee W-2 forms was inadvertently sent to an unauthorized external recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-07","discovered_date":"2025-10-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fae21def3cca9305523243f4940b7018fc14f713","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alliance_Roofing_Adult_Letter_Final_Live_Proof_R1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b3aa4e28184e","org_name":"Alliance Roofing Company, Inc.","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622966"},{"fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWxsaWFuY2UgUm9vZmluZ0Bha2lyYQ"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alliance_Roofing_Adult_Letter_Final_Live_Proof_R1_Redacted.pdf"}],"summary":"Alliance Roofing Company, Inc. reported unauthorized network access on October 6, 2025, and said personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["akira"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"559332af996ff1705aced6520d6052ebb6836b27","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ffaee3809d51","org_name":"Vermont Veterans Home","org_type":"unknown","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Vermont%20Veterans%20Home-2026-05-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-06","discovered_date":"2026-02-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"39feff3001505191546813a07a1fc2b9face7bff","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0829def7bb70","org_name":"Texas Department of State Health Services","org_type":"government","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005020"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-06","discovered_date":"2025-09-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69b2276e65d9feffae3dbdd863bdcaa10d9de843","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"842d6c42f627","org_name":"PeopleGuru Holdings, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":88909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005019"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fb47be257256e900241f16cf78578032184bcbc4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8de2ee3c65f2","org_name":"Midland Care Connection, Inc","org_type":"healthcare","ransomware":null,"records_affected":4457,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-06-midland-care-connection-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0af96007e1d3c155547b9bc0030bd4ce6bedbd7","impact_type":"unknown","incident_date":"2026-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"fab8a9433458","org_name":"LegionProxy","org_type":"unknown","ransomware":null,"records_affected":10144,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LegionProxy","type":"hibp","url":"https://haveibeenpwned.com/Breach/LegionProxy"}],"summary":"In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach . The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-06","discovered_date":"2026-01-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e1cabc5f5d3f038aa4597d2d0fcbb9686b3fb56","impact_type":"data_theft","incident_date":"2026-01-09","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Horizon%20Media%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"d2ae8d5c175b","org_name":"Horizon Media","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor gained access through a social engineering event.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622892"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Horizon%20Media%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Horizon%20Media-2026-05-06"}],"summary":"Horizon Media reported that an unauthorized actor accessed file shares through a social engineering event and copied files containing personal information.","supporting_quote":"On January 9, 2026, Horizon learned that an unauthorized actor gained access to a limited portion of our systems through a sophisticated social engineering event.","technology_involved":["file shares"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"32244be698421d7a9e220b4c5a79aaecc32d2c53","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38fe27676d8a","org_name":"First Rate Financial","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#First%20Rate%20Financial-2026-05-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b97c4e56f779f4449f822244c7eada949dba669f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78ff53352384","org_name":"First Harvest Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#First%20Harvest%20Federal%20Credit%20Union-2026-05-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"8502bb07c1d561775ad0014a66870c2701edf663","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa2b096182eb","org_name":"Financial Foundations, Inc.","org_type":"financial","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Financial%20Foundations%2C%20Inc.-2026-05-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-06","discovered_date":"2026-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a509d16e401129795398a70ce3be3782c4cfcfd7","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e2c5dc7e8d12","org_name":"Empire Express, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":5438,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005017"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0d0435a5d893deb10d0a7cc23ac6a77d8cdd00c","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"unknown","org_id":"5b05980e705f","org_name":"Vimeo","org_type":"technology_saas","ransomware":true,"records_affected":119167,"reviewed":false,"root_cause":"Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vimeo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vimeo"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VmltZW8sIEluYy5Ac2hpbnlodW50ZXJz"}],"summary":"ShinyHunters listed Vimeo in an extortion campaign and published data that Vimeo attributed to a breach of its analytics vendor Anodot.","supporting_quote":"Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include \"Vimeo video content, valid user login credentials, or payment card information\".","technology_involved":["Anodot"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anodot"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"d2e9e6619d29","name":"Anodot"}],"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-05","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0595135b43e9e989cf39888de2fbf27d36148a2c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a46be1e742c","org_name":"Sprouse Shrader Smith PLLC","org_type":"other","ransomware":null,"records_affected":17666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005008"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"409ceb54eb96d58b74dacf527adf41526e731669","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9c362a83b702","org_name":"Passaic County, New Jersey","org_type":"professional_services","ransomware":null,"records_affected":1109,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-05-passaic-county-new-jersey"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-05-05","discovered_date":"2026-04-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6a83627a68c3932a0e79bb0cf39c6c4b04f13c76","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4cd3f496dfc3","org_name":"NCH Corporation","org_type":"other","ransomware":null,"records_affected":4732,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005010"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#NCH%20Corporation-2026-05-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-05","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa5d3991b7b22566311c1d344030cdef86151eef","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4900b2c29949","org_name":"Martin & Cukjati, LLP","org_type":"other","ransomware":null,"records_affected":925,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005014"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"331e35fc6c50dba76383e4d30f6918d2b66918a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10655458108c","org_name":"Hy LaBonne & Sons, Inc.","org_type":"other","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hy%20LaBonne%20%26%20Sons%2C%20Inc.-2026-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-05","discovered_date":"2026-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"39d01bc10593f9cfddb860b1d0b0b04dd9d3a3b4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"652142b42357","org_name":"Helix Energy Solutions Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":11676,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005012"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-05","discovered_date":"2025-12-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a5f087cd4402fa1c26ab9ddcb34f0e7a8af818fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53b5020bcc93","org_name":"Goodwin University, Inc.","org_type":"education","ransomware":null,"records_affected":531,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005013"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"0403400a1541b49f9705fbfac4b0d9132de537f0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"35781e597777","org_name":"Diamond Chemical Co., LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Diamond%20Chemical%20Co.%2C%20LLC-2026-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"1298a0ca92838c2d3925fae9a2681c8436f38c6e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e333176ff3d9","org_name":"D'Ambrosio Dodge","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#D%27Ambrosio%20Dodge-2026-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e1d8382c37ba0258f469d25a98e3dcf8165f787","impact_type":"unknown","incident_date":"2025-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter_A_Adult_SSN_Final_v3_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"866bec9cf9ae","org_name":"Berger & Williams, LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622810"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005018"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Berger%20%26%20Williams-2026-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"38234e8eb1c012edc7615e3c19a3e1a45e0b30d0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4bfe08a8baf5","org_name":"Aroostook Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-05-aroostook-mental-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38c3b1d3b0584e6ac0d3e0ab5a2bbb8028501fc5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"80ad06460c26","org_name":"Reborn Gaming","org_type":"other","ransomware":null,"records_affected":126,"reviewed":false,"root_cause":"A vulnerability in cPanel and WebHost Manager (WHM) led to the data breach.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Reborn Gaming","type":"hibp","url":"https://haveibeenpwned.com/Breach/RebornGaming"}],"summary":"Reborn Gaming reported a breach involving a vulnerability in cPanel and WebHost Manager (WHM), exposing email addresses, IP addresses, and Steam IDs.","supporting_quote":"In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM) .","technology_involved":["cPanel","WebHost Manager (WHM)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"cPanel"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"a7e89c59d38b","name":"cPanel"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b84a0b854a853cac5114373a179a50a5e4165ed7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Massachusetts%20Mutual%20Life%20Insurance%20Company-2026-05-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0e85f11ab28d3e9bf27bf03d7b6ef0e1d7451fbe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46d217964566","org_name":"IKRON Corporation","org_type":"healthcare","ransomware":null,"records_affected":11845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-04-ikron-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8c1ee891bbdaa6dad81940844e73596e751234ae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f4cd6e23c7e6","org_name":"BAYADA Home Health Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-04-bayada-home-health-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-03","discovered_date":"2026-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"a848faac698033aab7c48175e5df19989d12adf8","impact_type":"both","incident_date":"2026-04-07","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40752.pdf"},"notes":null,"org_country":"US","org_id":"8e6401a00a00","org_name":"Marcus & Millichap","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"A threat actor impersonated support personnel and compromised an employee account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Marcus & Millichap","type":"hibp","url":"https://haveibeenpwned.com/Breach/MarcusMillichap"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWFyY3VzICYgTWlsbGljaGFwLCBJbmMuQHNoaW55aHVudGVycw"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40752.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40752.pdf"}],"summary":"A threat actor impersonating support personnel compromised a Marcus & Millichap employee account, accessed and removed data, and later sent extortion messages.","supporting_quote":"On April 7, 2026, a threat actor, impersonating support personnel, compromised the account of a Marcus & Millichap employee and accessed and removed data.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc514f694e8d8d19a11db8d8d140c7e71d558857","impact_type":"both","imported_from":null,"incident_date":"2026-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c685a21919a3","org_name":"ZenBusiness","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ZenBusiness","type":"hibp","url":"https://haveibeenpwned.com/Breach/ZenBusiness"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/WmVuQnVzaW5lc3MsIEluYy5Ac2hpbnlodW50ZXJz"}],"summary":"ShinyHunters claimed to have obtained and later released ZenBusiness data from Snowflake, Mixpanel, Salesforce, and other systems after demanding a ransom.","supporting_quote":null,"technology_involved":["Snowflake","Mixpanel","Salesforce"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Snowflake, Mixpanel, and Salesforce"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"871cb14cb964","name":"Snowflake"},{"id":"48fe772082e0","name":"Mixpanel"},{"id":"76cfb15636bf","name":"Salesforce"}],"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"879027ca84630183f3b41842e7d21c0c233e444d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5bf6787341d","org_name":"Western Orthopaedics, P.C.","org_type":"healthcare","ransomware":null,"records_affected":113330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-western-orthopaedics-p-c"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005011"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-01","discovered_date":"2026-04-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fcbf4e4cc62e3247ccf290e011773a4fb0a95447","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a4202dd7107","org_name":"Valley View ISD","org_type":"education","ransomware":null,"records_affected":3806,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005007"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bff97d3e2e5e2bb47132d59a025bbdbe5dd742fe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d4642f4f4ae2","org_name":"University of Michigan/Michigan Medicine","org_type":"healthcare","ransomware":null,"records_affected":551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-university-of-michigan-michigan-medicine"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"67adeaac62f101dd2b418003a9bc986b7d3740a8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0fa5a43ba015","org_name":"NCH Corporation Employee Benefits Plan","org_type":"healthcare","ransomware":null,"records_affected":4055,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-nch-corporation-employee-benefits-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bf4632ef4cbb41e3e5e3cc44f3310261702228ba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f511a4fbe67","org_name":"Mid Florida Dermatology & Plastic Surgery","org_type":"healthcare","ransomware":null,"records_affected":85585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-mid-florida-dermatology-plastic-surgery"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWlkIEZsb3JpZGEgRGVybWF0b2xvZ3kgJiBQbGFzdGljIFN1cmdlcnlAcWlsaW4"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"56c9eea9921674e6a52a13967cfa2372a9d56d67","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5cceb90191a","org_name":"Integrated Pain Associates","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-integrated-pain-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"03df9f7b1c076b6cc6b48b1f51d156c53ed48113","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90e448b7d922","org_name":"Gainesville-Alachua County Regional Airport Authority","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Gainesville-Alachua%C2%A0County%20Regional%20Airport%20Authority-2026-05-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"703310d2579c04c519fcc1d653eba4b8f94b0ade","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1c8db689df0","org_name":"CUNNINGHAM PROSTHETIC CARE LLC","org_type":"healthcare","ransomware":null,"records_affected":2523,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-cunningham-prosthetic-care-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1c11da51ddc10126a5ba50c9c8c2d055d4a5ace","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"856a065885e9","org_name":"Capitol Pain Institute","org_type":"healthcare","ransomware":null,"records_affected":695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-05-01-capitol-pain-institute"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09ca640572f3037b5e899d142191ffff79f37c64","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6776e4c54c2a","org_name":"Aman","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aman","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aman"}],"summary":"ShinyHunters named Aman in a pay-or-leak extortion campaign involving data allegedly obtained from its Salesforce CRM and later leaked publicly.","supporting_quote":null,"technology_involved":["Salesforce"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Salesforce"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"76cfb15636bf","name":"Salesforce"}],"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f4bdec9c757194ce8f3416f6bec028719e044040","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99a8e0853a7c","org_name":"Totem Lake Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":3464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-30-totem-lake-family-dentistry"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"ea9736e62797983d4036670c611f57cb82ea1ac3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0feee93ab4df","org_name":"PIH Health","org_type":"healthcare","ransomware":null,"records_affected":138,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#PIH%20Health-2026-04-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4d2e9bd9e0a4d5c0189778c9e27cea4bf5671f43","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40273.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e4981bce994","org_name":"Mt. Spokane Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":32021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-30-mt-spokane-pediatrics"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40273.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e73ca9b2a9cdbfddfbec8102be21214c8ee41327","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07646c38daf1","org_name":"Tri-Cities Gastroenterology","org_type":"healthcare","ransomware":null,"records_affected":67115,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-29-tri-cities-gastroenterology"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Tri-Cities%20Gastroenterology-2026-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-29","discovered_date":"2026-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"a8aadf4dc5e303849fd2eb3bc770c45dc2780b03","impact_type":"unknown","incident_date":"2026-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter_7.pdf"},"notes":null,"org_country":"US","org_id":"c10ad45c3cf4","org_name":"TransGlobal Insurance Agency","org_type":"financial","ransomware":null,"records_affected":71597,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TransGlobal%20Insurance%20Agency-2026-07-29"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626782"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_7.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005016"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TransGlobal%20Insurance%20Agency-2026-05-05"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_7.pdf"}],"summary":"TransGlobal Insurance Agency reported that unauthorized actors may have accessed or acquired personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d85ab489d3de81939546b0057228f27718824129","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1208e80cb9b5","org_name":"Smith Hawks, P.L.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Smith%20Hawks%2C%20P.L.-2026-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8d708e50f76cdc74140fdba6ba1a83c26e7a8c07","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"151ecb33c113","org_name":"Northwoods Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":5385,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-29-northwoods-surgery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"20005b9b084a411da5ddfdc13ee0d11803c1b919","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2da595c7373f","org_name":"L&S Mechanical","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#L%26S%20Mechanical-2026-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d6914bf60d6640c37f14718197e3675782577a08","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f7b4564b0003","org_name":"Farrell Fritz, P.C.","org_type":"other","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Farrell%20Fritz%2C%20P.C.-2026-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a0d4edd6ee4e5bf4079b9e7e8966da2f0f24e79","impact_type":"data_theft","incident_date":"2026-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JC%20Resorts%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"135763225842","org_name":"JC Resorts LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622428"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JC%20Resorts%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"JC Resorts reported that an unauthorized actor viewed and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-28","discovered_date":"2025-10-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"47de11378c9110139d75ef4a17bfd1f0345a8997","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"347847f14bfb","org_name":"Higginbotham Insurance Agency, Inc.","org_type":"financial","ransomware":null,"records_affected":16188,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005005"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-28","discovered_date":"2026-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d6a3cd725ce15a770743ee9ac2c902c0e5e94fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FCU%20Alkami%20Data%20Breach%20Letter%20FINAL%2004.24.26.pdf"},"notes":null,"org_country":"US","org_id":"0f1f4333f699","org_name":"Frontwave Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622466"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FCU%20Alkami%20Data%20Breach%20Letter%20FINAL%2004.24.26.pdf"}],"summary":"Frontwave Credit Union reported that a service provider notified it of an inadvertent disclosure of customers’ names and Social Security numbers to another credit union.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8cba07cf526ac644c8d72c6919ff1c0e937f223","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"531cc0fcc639","org_name":"FMRS Health Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-28-fmrs-health-systems-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-28","discovered_date":"2026-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50fe4f13d0b9e12a2cb65015a6adf5475dd3b44c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9024f7a7cb3","org_name":"Curtis Steel Company LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":793,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004972"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"de75f2d78c5f4c29a5cfeab2b4a93c0790199299","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1630c2e55f0c","org_name":"Churchill Claims Services, Inc.","org_type":"financial","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Churchill%20Claims%20Services%2C%20Inc.-2026-04-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"2451ab2c2da18b324ddf9858e61f468d8984811a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0682856766a","org_name":"Castiglia, LLP","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Castiglia%2C%20LLP-2026-04-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7474bc4497c9466cc52b5f7d1f2434c1a81d15c3","impact_type":"unknown","incident_date":"2025-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/L01%20-%20Access_Corp_Sample_Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"18d001a89f4e","org_name":"Access Information Management Shared Services, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622486"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94d8b338c0b8f2d32d3daeef10627ca4b53e826b","impact_type":"data_theft","incident_date":"2026-04-20","initial_access":"unknown","notes":"records_affected not found in source; cleared","org_id":"de4da88645d7","org_name":"Pitney Bowes","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pitney Bowes","type":"hibp","url":"https://haveibeenpwned.com/Breach/PitneyBowes"}],"summary":"ShinyHunters claimed to have obtained and publicly released Pitney Bowes data, including email addresses, names, phone numbers, physical addresses, and some employee job titles.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0c3f32ceb3f302475573a71b4a86e4e22043f850","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IE","org_id":"fabc5edce44d","org_name":"Medtronic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1613103/000162828026027272/mdt-20260424.htm"}],"summary":"Medtronic reported that an unauthorized third party accessed data in certain of its IT systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"MDT","base_day":"2026-04-27","returns":{"1":{"day":"2026-04-28","raw":-0.0123,"adj":-0.0074},"5":{"day":"2026-05-04","raw":-0.0557,"adj":-0.0597},"21":{"day":"2026-05-27","raw":-0.0837,"adj":-0.133},"63":{"day":"2026-07-28","raw":0.0478,"adj":0.0118}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4c9f980875519ded601d4d883370b9df320d546f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b42108d9239","org_name":"Lincoln Holdings LLC","org_type":"other","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Lincoln%20Holdings%20LLC-2026-04-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab2829a4f74ee4e2a55254a5a30d564f12de7206","impact_type":"unknown","incident_date":"2026-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LA%20Care%20Sample%20Breach%20Notification%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622400"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-27","discovered_date":"2026-02-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c0dac0f1b552077f23763b06fa6d3e714d13195","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b66a7baeca2e","org_name":"Green Imaging LLC","org_type":"healthcare","ransomware":null,"records_affected":7628,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005001"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-27","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b768ae0b6fbdb2ad13d946005dc8854022793a5b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e3366e1591e","org_name":"Eanes Independent School District","org_type":"education","ransomware":null,"records_affected":10158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005004"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"425023f2297ed11c792c3f7e89dad1cd136798df","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb15a55098ce","org_name":"Credit Technologies, Inc.","org_type":"other","ransomware":null,"records_affected":54,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Credit%20Technologies%2C%20Inc.-2026-04-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-27","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3ce083a7eb20851584022954732d231d20ea1a9","impact_type":"data_theft","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Conduent%20Business%20Services%20LLC%20Sample%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"1f4ef2795543","org_name":"Conduent Business Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Conduent%20Business%20Services%20LLC%20Sample%20Notice_2.pdf"}],"summary":"Conduent Business Services reported that an unauthorized third party accessed its environment from October 21, 2024, to January 13, 2025, and obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5ac7b3b43fb32a6a37ec564b21356e98d980c8fa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eff392c3c25e","org_name":"C2N Diagnostics, LLC","org_type":"healthcare","ransomware":null,"records_affected":2027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-27-c2n-diagnostics-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-27","discovered_date":"2026-04-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"a7c270db0483b38b9a4edc620152a8b2390b764f","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42014.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"60ff75db493c","org_name":"ADT","org_type":"other","ransomware":true,"records_affected":5129,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ADT%2C%20Inc.-2026-07-28"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42014.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005212"},{"fetched_at":null,"title":"Have I Been Pwned: ADT","type":"hibp","url":"https://haveibeenpwned.com/Breach/ADT"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42014.pdf"}],"summary":"ADT reported unauthorized access to a limited set of customer and prospective customer data, including names, contact details, and in some cases dates of birth and the last four digits of Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b8b1fd31c9e8f325961c8e72d1ddfcef332dd8a","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"728a39fbcb2c","org_name":"Udemy","org_type":"technology_saas","ransomware":true,"records_affected":1401259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Udemy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Udemy"}],"summary":"ShinyHunters made a pay-or-leak extortion attempt against Udemy, and data containing customer and instructor information was subsequently leaked publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9b096f85529610e107e0ad525e5cd74cf99ab65f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b0e76e634d5","org_name":"Transport Workers Union Local 100","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Transport%20Workers%20Union%20Local%20100-2026-04-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"9ee58a7a4eab789ee632a2cdf9f7eac3a0e1c957","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"efc6f6e66962","org_name":"Texas Tech University Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":29,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Texas%20Tech%20University%20Health%20Sciences%20Center-2026-04-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-03-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"17d1d90723a5c88df8c880e5abcc5c881bf2098f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5eb58b97da5","org_name":"Rodenburg Law Firm","org_type":"other","ransomware":null,"records_affected":81307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004995"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625864"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01%20-%20Rodenburg%20General%20Adult%20Notification%20letter.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Rodenburg%20Law%20Firm-2026-04-24"}],"summary":"Rodenburg Law Firm reported unauthorized access to its environment, with files containing personal, financial, and medical information exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-03-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"94960a5b551cabd7acfccdb68ec3029736329876","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a9c3874c9da","org_name":"Precipio, Inc.","org_type":"healthcare","ransomware":null,"records_affected":22739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004994"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Precipio%2C%20Inc-2026-04-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d2e2a8c1d152a08062e9180d90c3b70607073ff4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0573480b72d","org_name":"Lubbock Hospice","org_type":"healthcare","ransomware":null,"records_affected":259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004998"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-03-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"18f94be7f06efa3dcbd2023e4e04e5e2472ebb68","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b23fae4ed03d","org_name":"Interim Healthcare of West Texas LLC (Lubbock, Amarillo, and Pampa)","org_type":"healthcare","ransomware":null,"records_affected":3059,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004997"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-02-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab83565d62b6dfadf5c112767aec6956208856aa","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cbe20ad5a38f","org_name":"HUMANA INC","org_type":"financial","ransomware":null,"records_affected":15624,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004993"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"55224403ae6fa5dd447ddd09be3bc034f78a7107","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48e7e7660217","org_name":"Hematology Oncology Consultants","org_type":"healthcare","ransomware":null,"records_affected":62972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-24-hematology-oncology-consultants"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"7e225af1c9acf3019f370ca3182ba53ef3ca5fd0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0129a240e662","org_name":"GreyRobinson, P.A.","org_type":"other","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#GreyRobinson%2C%20P.A.-2026-04-24"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#GreyRobinson%2C%20P.A.-2026-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"49afcbfb2649b8102403cba251001682d7def9ba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/GrayRobinson_-_Adult_SSN_REDACTED_38083141v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbc776f0b8e7","org_name":"GrayRobinson, P.A.","org_type":"professional_services","ransomware":null,"records_affected":54131,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-24-grayrobinson-p-a"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622314"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005015"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter-%20GrayRobinson%20P.A..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"075f6b84cdff2eeb52a7175922e1506f3c08a004","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d23dfa0a94eb","org_name":"Florida Physician Specialists","org_type":"healthcare","ransomware":null,"records_affected":276498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-24-florida-physician-specialists"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005003"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c674d73c0980f27b45077b6cbc41bcba6756e13e","impact_type":"both","incident_date":"2026-04-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":null,"org_country":"unknown","org_id":"3d56a7bc2932","org_name":"Carnival","org_type":"transportation_logistics","ransomware":true,"records_affected":8700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Carnival","type":"hibp","url":"https://haveibeenpwned.com/Breach/Carnival"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624003"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005069"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carnival%20Corporation-2026-05-27"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Carnival%20Corporation-2026-05-28"}],"summary":"ShinyHunters claimed data belonging to Carnival, including Mariner Society loyalty program records, and attempted to extort the company before publishing the data.","supporting_quote":"Carnival acknowledged a phishing incident involving a single user account and advised they were working to better understand the scope of the unauthorised activity.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-24","discovered_date":"2026-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2f1ec90fde691c8f861265f2f89c37c0121187ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e493cc126d18","org_name":"Bayou Homecare, LP","org_type":"healthcare","ransomware":null,"records_affected":288,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004999"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-04-24","discovered_date":"2026-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f0db7be5af20e8e2ecf6b71a9fb4aee17191a301","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37904.pdf"},"notes":null,"org_country":"US","org_id":"ddafb4e26fe2","org_name":"Axosoft LLC","org_type":"technology_saas","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37904.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37904.pdf"}],"summary":"Axosoft LLC employee personal and compensation information was inadvertently routed through a third-party integration into internal telemetry systems and stored in its Snowflake data warehouse and cloud storage; the company reported no unauthorized access.","supporting_quote":null,"technology_involved":["Claude Office 365 Excel integration","Snowflake data warehouse","cloud storage"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-24","discovered_date":"2026-04-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"72bb3482e6103e6b9c9036b8181f8b86a909c64f","impact_type":"unknown","incident_date":"2026-04-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1f8cd3cce44","org_name":"Amare Global Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Amare%20Global%20Holdings%2C%20Inc.-2026-04-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f84ce81c63dca55388bcaac8cc9564f084a9583b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1e91374c976","org_name":"Aldrich Pediatric Dentistry","org_type":"healthcare","ransomware":null,"records_affected":5900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-24-aldrich-pediatric-dentistry"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"548da2a7c3a4ec0dd2318e4b20520a07a1e0ef84","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab9a5d4bbf83","org_name":"Stewart Home & School","org_type":"healthcare","ransomware":null,"records_affected":3677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-23-stewart-home-school"}],"summary":null,"supporting_quote":null,"technology_involved":["Email","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-23","discovered_date":"2025-12-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"875b843503252c55358bbb73d851fdb4a5cd2bbe","impact_type":"data_theft","incident_date":"2025-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marin%20Cancer%20Care%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"74ebf2ad5c62","org_name":"Marin Cancer Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622211"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marin%20Cancer%20Care%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Marin%20Cancer%20Care-2026-04-23"}],"summary":"Marin Cancer Care found unauthorized access to its network and signs that files may have been copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"576c12e9599a98d54e87d92cb8dbf11ae9f522b7","impact_type":"unknown","incident_date":"2026-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA-%20HB_sample%20notice%20letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bdf4511974dd","org_name":"Heritage Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622220"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004996"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37893.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d0b292530519906e66f22df0410cad61514d2777","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e4d850565837","org_name":"Belmont Aesthetic and Reconstructive Plastic Surgery","org_type":"healthcare","ransomware":null,"records_affected":528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-23-belmont-aesthetic-and-reconstructive-plastic-surgery"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-22","discovered_date":"2025-08-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"acef049eb4b1562d2564c5e188dc1df6a3e3977b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e87e40210107","org_name":"Universal Pure, LLC","org_type":"other","ransomware":null,"records_affected":9946,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004991"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Universal%20Pure%2C%20LLC-2026-04-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-22","discovered_date":"2026-03-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb03579a62e6d5fc543e8ac8648f7cb6dbdb1951","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a13493e43d91","org_name":"Restaurant Management Company of Wichita, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":120426,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004989"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Restaurant%20Management%20Co.%20of%20Wichita%2C%20Inc.-2026-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"fa8875a5c24538acab15b2a5d13201d41fe3496b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3555aad54e58","org_name":"Law Offices of Alan M. Cohen & Associates, LLC","org_type":"other","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Law%20Offices%20of%20Alan%20M.%20Cohen%20%26%20Associates%2C%20LLC-2026-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0647f54cb1f6d78adc4070b937d1a2b3e523821c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa626b8f25ba","org_name":"Laurel Eye Clinic","org_type":"healthcare","ransomware":null,"records_affected":145221,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-22-laurel-eye-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"6fa753b0785ceefb8f2f12b186920b606c1b4acc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c0e293aecce1","org_name":"Kucera International, Inc","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Kucera%20International%2C%20Inc-2026-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"b91c411e323e51d42bc98f564f44a268b8df967e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78cb7f41c40c","org_name":"InteleXual Software, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#InteleXual%20Software%2C%20LLC-2026-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-22","discovered_date":"2026-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"50d508887459a7051bb6c96bc1bfed17e24b80f9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"0b28535e84b8","org_name":"Harbor Developmental Disabilities Foundation (d/b/a Harbor Regional Center)","org_type":"professional_services","ransomware":null,"records_affected":2287,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-22-harbor-developmental-disabilities-foundation-d-b-a-harbor-regional-center"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622150"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-624044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice_1.pdf"}],"summary":"Harbor Developmental Disabilities Foundation reported unauthorized activity on March 6–7, 2026, during which information may have been accessed.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-22","discovered_date":"2025-02-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b1021437adc0165114b96e9f27e284af8b5e7f9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Georgia%20Heritage%20Federal%20Credit%20Union.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ef4514b84a8","org_name":"Georgia Heritage Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":43077,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004983"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Georgia%20Heritage%20Federal%20Credit%20Union.pdf"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Georgia%20Heritage%20Federal%20Credit%20Union-2026-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-22","discovered_date":"2026-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8d1b048ffd25a8f4e2f9672df3e999cbb77e156","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d4922959a44","org_name":"City of Suffolk, Virginia","org_type":"government","ransomware":null,"records_affected":157725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004992"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"df4e8f96b13649e7bf858c25ded673d45b43b89f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57404d4a441c","org_name":"Beach Properties","org_type":"other","ransomware":null,"records_affected":1757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Beach%20Properties-2026-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-21","discovered_date":"2025-10-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac4a70db7e94839ad546861a1ab751b37072e3c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WHH-Security-Incident-Notification-Letter-04062026F.pdf"},"notes":null,"org_country":"US","org_id":"6b7babb86a06","org_name":"Web Hosting Hub, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WHH-Security-Incident-Notification-Letter-04062026F.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004990"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37833.pdf"}],"summary":"Web Hosting Hub reported that an unauthorized actor temporarily accessed a limited portion of its Help Center, where email addresses, IP addresses, and linked public social media information may have been accessed.","supporting_quote":null,"technology_involved":["Help Center"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-21","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"487ef95371c7e0e3769c309d572e7900a4fc486e","impact_type":"unknown","incident_date":"2025-09-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38d15307b48c","org_name":"Sorenson, Ransom & Ferguson, LLP","org_type":"unknown","ransomware":null,"records_affected":1085,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sorenson%2C%20Ransom%20%26%20Ferguson%2C%20LLP-2026-04-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe9533da11fac892dd306fba45ceaa082d5e4843","impact_type":"unknown","incident_date":"2026-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/cig%20breach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5e4e6fbb5d8","org_name":"Cloud Imperium Games","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622116"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d7e691ee2fed6031d8322bc3eefbefd3da81c90a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5de6b7898c3","org_name":"Child & Family Services of the Upper Peninsula, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Child%20%26%20Family%20Services%20of%20the%20Upper%20Peninsula%2C%20Inc.-2026-04-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-20","discovered_date":"2026-02-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"4a11007796e0fdc0405c311737b38f31b7b72576","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41058.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a8b1559e989e","org_name":"Spokane Digestive Disease Center, P.S.","org_type":"healthcare","ransomware":null,"records_affected":2157,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-20-spokane-digestive-disease-center-p-s"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41058.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41058.pdf"}],"summary":"An unauthorized actor accessed an employee email account between January 22 and February 18, 2026, and the organization found the recipient’s information in reviewed emails.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-20","discovered_date":"2026-04-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"695196c65d13d16117cfba062b8f158a4b8dce67","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"1c62f30ee868","org_name":"Solari Accountancy, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622024"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Letter.pdf"}],"summary":"Solari Accountancy, Inc. discovered unauthorized access to its tax software system, and said clients’ personal information may have been exposed.","supporting_quote":null,"technology_involved":["tax software system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8e4b0cc4742f00d32087b3f49613b30c767c7ec6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db7274e95dc7","org_name":"Prime Care 12 Priority Health","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-20-prime-care-12-priority-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-20","discovered_date":"2025-10-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"21ce54d160d18c4c47469fe422ed458c65522ddd","impact_type":"unknown","incident_date":"2025-10-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"27d732cab84c","org_name":"Oregon Food Bank","org_type":"unknown","ransomware":null,"records_affected":1254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Food%20Bank-2026-04-20"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Oregon%20Food%20Bank-2026-04-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"18a7190f14e3a0713438f9a7d7b63ac5ea331e28","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"988bb5384bbb","org_name":"Rev Up Brands, LLC","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Rev%20Up%20Brands%2C%20LLC-2026-04-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"92adf5e75100f80b522e77d5a814385fb2f9db40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8961de7afc88","org_name":"Hallisey & D'Agostino, LLP","org_type":"other","ransomware":null,"records_affected":182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Hallisey%20%26%20D%27Agostino%2C%20LLP-2026-04-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9c72d81e00f944f42a89fa27adebbc2909da8a1f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d5f0dee8ffe","org_name":"University of Nebraska Medical Center","org_type":"healthcare","ransomware":null,"records_affected":26937,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-17-university-of-nebraska-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-04-17","discovered_date":"2025-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"5528366c61cce1ea247872df25a91131e60a3bd6","impact_type":"data_theft","incident_date":"2025-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37809.pdf"},"notes":null,"org_country":"US","org_id":"921c4cc256d8","org_name":"TELUS International AI, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#TELUS%20International%20AI%2C%20Inc.%2C%20d/b/a/%20TELUS%20Digital-2026-07-31"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37809.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005217"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37809.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37809.pdf"}],"summary":"An unauthorized third party obtained documents containing personal information from a limited number of TELUS International AI systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"4b16ee0ea60fd55ebc769a0e813621afad0e01a6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4752498f4f45","org_name":"Passco Companies, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Passco%20Companies%2C%20LLC-2026-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"889dbb9eb97b555eeefe888be895c4018c693631","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nobu%20Restaurant%20Group%20Holding%20Company%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a9580733ea9f","org_name":"Nobu Restaurant Group Holding Company, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621924"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nobu%20Restaurant%20Group%20Holding%20Company%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004982"}],"summary":"Nobu reported that an unauthorized third party accessed certain systems and that personal information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e4716561d8b079c16377931aaa0d8d4df0945de8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eee5068ad3c7","org_name":"NJ Division of Developmental Disabilities - Hunterdon Developmental Center","org_type":"healthcare","ransomware":null,"records_affected":807,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-17-nj-division-of-developmental-disabilities-hunterdon-developmental-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-17","discovered_date":"2026-03-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4d0316fe366837184c645b5d30691ec82ecbd62c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01d69d4c6179","org_name":"Mary Lee Foundation","org_type":"nonprofit","ransomware":null,"records_affected":145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004981"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"27e3c9e435364da20f41c1f2dc8f3067e9218aaf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Innovative%20Scientific%20Solutions%2C%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98a8ef4aaa57","org_name":"Innovative Scientific Solutions, LLC","org_type":"healthcare","ransomware":null,"records_affected":143842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-17-innovative-scientific-solutions-llc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004985"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Innovative%20Scientific%20Solutions%2C%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b9d30f6b7377aa9f72261198c65107d2804b0ac","impact_type":"data_theft","incident_date":"2025-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Informa-Template%20Notifications.pdf"},"notes":null,"org_country":"US","org_id":"9762ecc15a70","org_name":"Informa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621942"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Informa-Template%20Notifications.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004988"}],"summary":"An unauthorized party accessed and copied personal and historical employment-related records held on an Informa Oracle system.","supporting_quote":null,"technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-17","discovered_date":"2024-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b41371c4a0d39a2e1d6e7f3899148b75e01de73","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Impac%20Mortage%20Holdings%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"bd4d449705e7","org_name":"Impac Mortgage Holdings, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621934"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Impac%20Mortage%20Holdings%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004984"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Impac%20Mortgage%20Holdings%2C%20Inc.-2026-04-17"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Impac%20Mortgage%20Holdings%2C%20Inc.-2026-04-17"}],"summary":"Impac Mortgage Holdings identified potential unauthorized access to its systems, and an unknown actor may have accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-17","discovered_date":"2026-03-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"78e5ce0b46d149728aabba510162bf2b6188d96d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a83c79077a6a","org_name":"Hays County Emergency Services District No. 3","org_type":"other","ransomware":null,"records_affected":1098,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004974"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-17","discovered_date":"2026-03-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c414dbb05f2edd353a9fa90e3ac5c44ec2013cf8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0802feffc2b","org_name":"Cookeville Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":337917,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004978"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-13","id":"d131829c6a24361a34b493d85eea840c3dfb5f4d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d92fed2e95d","org_name":"Connected Credit Union","org_type":"financial","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Connected%20Credit%20Union-2026-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f1c47c008a710833daeeffe044e7c88faee117c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Columbia%20-%20Letter%201%20Year%20Credit%20Monitoring.pdf"},"notes":null,"org_country":"US","org_id":"d5aa511a6142","org_name":"Columbia Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Columbia%20-%20Letter%201%20Year%20Credit%20Monitoring.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37811.pdf"}],"summary":"An unauthorized third party accessed Columbia Bank applications and information between October 2 and December 22, 2025, and the bank later determined that the data contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-17","discovered_date":"2025-12-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"391c588d4a44e41e50355c9741d23ab484277cdc","impact_type":"unknown","incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"11c2937d6161","org_name":"Colombia Bank","org_type":"unknown","ransomware":null,"records_affected":7067,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colombia%20Bank-2026-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"851dd9699d65dbe102c2a7f0abe5699918e92621","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37808.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b9ac94fdfb1f","org_name":"Bayside Dental","org_type":"healthcare","ransomware":null,"records_affected":10216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-17-bayside-dental"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37808.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-17","discovered_date":"2026-02-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"63289d88cf322680a5b88ee62b8a6cfaecf28b88","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"361eea8ff958","org_name":"Bank3","org_type":"financial","ransomware":null,"records_affected":11512,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004979"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e1464fccd2d29d8765b946bf4d6df4b46e30ebbf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"09ba9978a6f0","org_name":"ASC Ortho Management Company, LLC  d/b/a Aligned Orthopedic Partners","org_type":"healthcare","ransomware":null,"records_affected":7213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-17-asc-ortho-management-company-llc-d-b-a-aligned-orthopedic-partners"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3774f6ea4f443818d3f53779f4df33f4f8247912","impact_type":"data_theft","imported_from":null,"incident_date":"2026-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3aae7798f2bf","org_name":"Amtrak","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Amtrak","type":"hibp","url":"https://haveibeenpwned.com/Breach/Amtrak"}],"summary":"ShinyHunters claimed to have breached Amtrak and later published alleged data containing email addresses, names, physical addresses, and customer support records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc6b8f684fad7bcf3575498012762881ed15bfd3","impact_type":"data_theft","incident_date":"2026-03-05","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAGCU%20-%20Notice%20of%20Data%20Incident%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"e01b5368d134","org_name":"Alaska Air Group Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621928"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAGCU%20-%20Notice%20of%20Data%20Incident%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alaska%20Air%20Group%20Federal%20Credit%20Union-2026-04-17"},{"fetched_at":null,"title":"Vermont AG security breach notice","type":"state_ag","url":"https://ago.vermont.gov/categories/security-breach-notices#Alaska%20Air%20Group%20Federal%20Credit%20Union-2026-04-17"}],"summary":"Unauthorized actors used a third-party IT service provider’s system to access Alaska Air Group Federal Credit Union systems and may have copied files containing personal and financial information.","supporting_quote":"On or about March 5, 2026, our third-party information technology (IT) service provider experienced a cybersecurity inci dent, allowing unauthorized actors to use its system to access AAGCU IT systems.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cd53ba9662b6276eea7ae44b101cbad8ad8760ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46b36b1f9337","org_name":"Spokane United Methodist Homes d/b/a Rockwood Retirement Communities","org_type":"healthcare","ransomware":null,"records_affected":3811,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-16-spokane-united-methodist-homes-d-b-a-rockwood-retirement-communities"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-04-16","discovered_date":"2026-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed74b03cea0fb4a86823131a62176d63eaf65a9f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23732.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c93022afa4b8","org_name":"Providence","org_type":"healthcare","ransomware":null,"records_affected":838,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23732.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23732.pdf"}],"summary":"Providence reported that some patient information may have been accessed or shared by HIE participants without a defined business need, with no indication that records were hacked or stolen.","supporting_quote":null,"technology_involved":["Health Gorilla","Epic","HIE"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Health Gorilla"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"23646ad77654","name":"Health Gorilla"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-04-16","discovered_date":"2026-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c3e035a93412210ade43c98fc79d91cbaeca71a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/final%20Providence%20Breach%20Notice%20Letter%20V.2%20%28Print%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"c93022afa4b8","org_name":"Providence","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/final%20Providence%20Breach%20Notice%20Letter%20V.2%20%28Print%20Proof%29.pdf"}],"summary":"Providence reported that some patient information may have been accessed or shared by health information exchange participants without a defined business need.","supporting_quote":null,"technology_involved":["Health Gorilla","Epic","health information exchange"],"third_party":{"archetype":null,"involved":true,"vendor":"Health Gorilla"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"23646ad77654","name":"Health Gorilla"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f53a8c0e1e70058fd7c25e07daa225e3b886593","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-05","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37787.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3937f1b23635","org_name":"Panera, LLC","org_type":"other","ransomware":null,"records_affected":1564,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37787.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37787.pdf"}],"summary":"A person used social engineering to access a Panera application containing catering-order records, including personal information.","supporting_quote":"A skilled person used social engineering to gain access on January 5, 2026, to an application that contained records regarding certain catering orders.","technology_involved":["application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfaa3474608990661da698a194d48e51fb3807e5","impact_type":"both","imported_from":null,"incident_date":"2026-04-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"58dd2f10cbb0","org_name":"McGraw Hill","org_type":"education","ransomware":true,"records_affected":13500136,"reviewed":false,"root_cause":"A Salesforce misconfiguration exposed data from a webpage hosted on Salesforce.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: McGraw Hill","type":"hibp","url":"https://haveibeenpwned.com/Breach/McGrawHill"}],"summary":"McGraw Hill reported that a Salesforce misconfiguration exposed data from a Salesforce-hosted webpage, followed by an extortion attempt and public distribution of data.","supporting_quote":"Attributed to a Salesforce misconfiguration, the company stated the incident exposed \"a limited set of data from a webpage hosted by Salesforce on its platform\".","technology_involved":["Salesforce"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Salesforce"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"76cfb15636bf","name":"Salesforce"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-04-15","discovered_date":"2025-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2bc4d48910867fc406a42baa955563be7d9deb21","impact_type":"data_theft","incident_date":"2025-10-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37706.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"db0207fa2c08","org_name":"The Trustees of the University of Pennsylvania","org_type":"education","ransomware":null,"records_affected":5878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37706.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37706.pdf"}],"summary":"The University of Pennsylvania reported unauthorized access to certain University systems through a user account, with files downloaded during the activity.","supporting_quote":"On October 31, 2025, Penn became aware of unauthorized access to certain University systems through a user account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6abffcb079a1bd4974f0af57daf95ae6cac4eb01","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f32792cbe469","org_name":"Mazzola Mardon, P.C.","org_type":"professional_services","ransomware":null,"records_affected":2123,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-15-mazzola-mardon-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-15","discovered_date":"2024-12-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f86ec1717b2ef367c9259003591b624b17e08fc","impact_type":"unknown","incident_date":"2024-12-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c96bfea22c8f","org_name":"Income Property Management Co.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Income%20Property%20Management%20Co.-2026-04-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-04-15","discovered_date":"2026-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0d816494684d9a778982e96a790b9c082283535","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Douglas%20-%20Adult%20-%20Affected.pdf"},"notes":null,"org_country":"US","org_id":"43b27c1e1e12","org_name":"DOUGLAS M SMITH & CO CPAS","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621806"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Douglas%20-%20Adult%20-%20Affected.pdf"}],"summary":"DOUGLAS M SMITH & CO CPAS reported that an unauthorized user accessed third-party tax filing software and that sensitive personal information was likely accessible.","supporting_quote":null,"technology_involved":["third-party tax filing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-04-14","discovered_date":"2026-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad2a1525546d84382afe87197d68cbfa57e9dad3","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Pediatric%20Products_0.pdf"},"notes":null,"org_country":"US","org_id":"7c7e396414e2","org_name":"Pediatric Products, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621730"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Pediatric%20Products_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004977"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37686.pdf"}],"summary":"Pediatric Products discovered unauthorized access to its network and said files may have included customers’ personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"172cf596d16037dc762768a7a1eba91ce52f7c5e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1cd468d0b1e","org_name":"Defense Health Agency","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-14-defense-health-agency"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45ed7a73fc679f469f7d2f41377ea2ef800f2e80","impact_type":"unknown","incident_date":"2024-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pinnacle%20-%20Sample%20Notice%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd903b96089b","org_name":"Community Psychiatry Management, LLC d/b/a Mindpath Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621736"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-04-14","discovered_date":"2026-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d535d01546f7fe5c01b8e0b3a91d4d4ec9a5742","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/official-notice.pdf"},"notes":null,"org_country":"US","org_id":"d819d06a3232","org_name":"City Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621745"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/official-notice.pdf"}],"summary":"An unauthorized party accessed a City Health server and accessed records containing names, insurance company names, and procedure codes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-13","discovered_date":"2026-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6ef2973b145fdbc5779728359fcb4e2ca004fdab","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"544167e3886a","org_name":"RCI Hospitality Holdings, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/935419/000162828026024806/rick-20260407.htm"}],"summary":"RCI Hospitality Holdings reported unauthorized access to personal information held by its subsidiary, RCI Internet Services, after a cybersecurity incident that began March 19, 2026.","supporting_quote":null,"technology_involved":["IIS web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"RICK","base_day":"2026-04-13","returns":{"1":{"day":"2026-04-14","raw":0.0086,"adj":-0.0036},"5":{"day":"2026-04-20","raw":0.0759,"adj":0.0408},"21":{"day":"2026-05-12","raw":-0.0273,"adj":-0.1032},"63":{"day":"2026-07-14","raw":0.0726,"adj":-0.0232},"126":{"day":"2026-10-12","raw":0.0779,"adj":-0.0562}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-13","discovered_date":"2026-03-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7eba74c12788ebaa04ccf57eeb89c9783461935","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc9692fe0c67","org_name":"Legend Senior Living, LLC","org_type":"other","ransomware":null,"records_affected":37805,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004970"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-04-13","discovered_date":"2026-03-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56b15d617bb09db60e14c7c371288f6ecec88660","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba5f2cdb9909","org_name":"Law Office of Michael R. De La Paz","org_type":"retail_ecommerce","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004971"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa7c8e5b2dd05671b4818a633576903be691e1a0","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fd5ae0cd1bd5","org_name":"Hallmark","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hallmark","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hallmark"}],"summary":"Attackers accessed data stored in Salesforce for Hallmark, and the data was later published after an extortion deadline passed.","supporting_quote":null,"technology_involved":["Salesforce"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Salesforce"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"76cfb15636bf","name":"Salesforce"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-10","discovered_date":"2025-12-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28607a93d18c69e989e111e099d2313d8d7c26bf","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"3d5ff603f41b","org_name":"Windward Life Care","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621585"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice_0.pdf"}],"summary":"Windward Life Care reported that an unauthorized individual may have viewed or copied information during unusual activity in its network environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"28c115ba06aa16aa14b04662198cebd20e366cc2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"440a57a29a63","org_name":"Springfield Hospital","org_type":"healthcare","ransomware":null,"records_affected":5892,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-10-springfield-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"157559dbc612bef387e63ee00665edf5f024b256","impact_type":"unknown","incident_date":"2026-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Kloeckner_CA%20App%20%26%20Sample_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2a5e524611a","org_name":"Kloeckner Metals Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621616"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004969"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"90bea8861571ac953424e0056b64fdaad9be73ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71e7fc33a689","org_name":"Joseph J Chappell, Jr., MD, PA dba Tupelo Eye Clinic","org_type":"healthcare","ransomware":null,"records_affected":6245,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-10-joseph-j-chappell-jr-md-pa-dba-tupelo-eye-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-10","discovered_date":"2026-04-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"38ede4f0c9c01b126057bb3e55a576c660dd6704","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0deeff91fa49","org_name":"Good Faith Energy, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":46,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004964"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53b1aabb3296edec13d73d5ca6d4276f4518d1f0","impact_type":"unknown","incident_date":"2026-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DEEI%20-%20Exhibit%20A%20-%20Notice%20Letter%20%2812mos%29.pdf"},"notes":null,"org_country":"US","org_id":"7d8f7bfe082b","org_name":"David Evans Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621578"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DEEI%20-%20Exhibit%20A%20-%20Notice%20Letter%20%2812mos%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#David%20Evans%20Enterprises%2C%20Inc.-2026-04-10"}],"summary":"David Evans Enterprises, Inc. issued a notice concerning an incident dated 2026-02-26, but the provided text does not describe what occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"929a1245740b1b336831ffcc091f22ad3e7a966e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bbd5e4d77a59","org_name":"CARE Clinic","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-10-care-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-04-09","discovered_date":"2026-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1229ecc81a05956e83abcf4b42acde6676039ed","impact_type":"both","incident_date":"2026-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CRS%20-%20Sample%20Notice%20Letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"9b4fead4ecc8","org_name":"Clinical Registry Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627300"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-627299"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/clinical-registry-solutions-jason-r-egbert-od-pc-vnc-health-data-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.dexpose.io/akira-ransomware-attack-strikes-clinical-registry-solutions/"},{"fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2xpbmljYWwgUmVnaXN0cnkgU29sdXRpb25zQGFraXJh"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CRS%20-%20Sample%20Notice%20Letter%20%28CA%29_0.pdf"}],"summary":"Clinical Registry Solutions reported unauthorized network access and said files containing patient information may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["akira"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-04-09","discovered_date":"2026-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"498ae5ff662b5609f591d48d19749b1d22fb444b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4.10.26%20CardioFit%20Patient%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"86fad723e0ac","org_name":"CardioFit Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621561"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4.10.26%20CardioFit%20Patient%20Notification%20Letter.pdf"}],"summary":"CardioFit Medical Group reported that patient information was sent by email without encryption in January and/or February 2026.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-08","discovered_date":"2026-01-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"06834cdaeed746f863ad8e480411d531412529d1","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37617.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"02b0cd84ca52","org_name":"Wonderland Child and Family Services","org_type":"nonprofit","ransomware":null,"records_affected":1282,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37617.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37617.pdf"}],"summary":"Wonderland Child and Family Services reported that an individual viewed and copied information without authorization in activity occurring around May 31, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-08","discovered_date":"2026-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cfe5bdd9f729b45a4396c45fa4c14e4f02d7f04","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TruView%20BSI%2C%20LLC%20-%20Exhibit%20A%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ae06712b95d3","org_name":"TruView BSI, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621494"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TruView%20BSI%2C%20LLC%20-%20Exhibit%20A%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004965"}],"summary":"TruView reported that a cybercriminal may have accessed personal information in its environment between July 18 and August 15, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8d5074743e28b07cbf5591ef43addbb30a4a032","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%204.8.26.pdf"},"notes":null,"org_country":"US","org_id":"92786c0f0384","org_name":"TEXCAZ Insurance Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621501"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%204.8.26.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004973"}],"summary":"TEXCAZ Insurance Services reported that an unauthorized person may have temporarily accessed personal information, including driver names, license numbers, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-08","discovered_date":"2026-03-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6dc930e817778dd0d744a82a29a63cdf3a7c67cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"625d29efefe8","org_name":"OuterBox LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":323,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004962"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-08","discovered_date":"2025-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcd8bb084147d6c499ef40298064346ca351e316","impact_type":"data_theft","incident_date":"2025-08-12","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OneDigital%20Investment%20Advisors%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"217ef5d822a9","org_name":"OneDigital Investment Advisors LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OneDigital%20Investment%20Advisors%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004967"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37623.pdf"}],"summary":"OneDigital data stored in Salesforce was potentially accessed and copied by an unauthorized actor due to a compromise of the Drift application.","supporting_quote":"The investigation found that between August 12 - August 18, 2025, certain data of OneDigital’s stored in Salesforce was potentially accessed and copied by an unauthorized actor due to a compromise of the Drift application.","technology_involved":["Salesforce","Drift"],"third_party":{"archetype":null,"involved":true,"vendor":"Salesloft"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fd7637f7c61c","name":"Salesloft"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56e2622539bfa73ef8bfdfe6e7ca3a734300b11e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3f2d57901ad4","org_name":"My Lovely AI","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: My Lovely AI","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyLovelyAI"}],"summary":"My Lovely AI suffered a breach that exposed user-created prompts, links to AI-generated images, email addresses, and some Discord and X usernames.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2026-04-08","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"1cd1f3d20a23ccd3d188c2dcca199eef7041a57f","impact_type":"both","incident_date":"2025-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Dillon%20County.pdf"},"notes":null,"org_country":"US","org_id":"d810b4f56060","org_name":"Dillon County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Dillon%20County.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Dillon%20County.pdf"}],"summary":"Dillon County reported unauthorized access to certain systems, disruptions, and files copied and potentially viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-04-08","discovered_date":"2025-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"156fb4ffa031adf1ae315edf833decd47c700639","impact_type":"data_theft","incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dermcare%20Topco%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f8a1b260c711","org_name":"DermCare Management","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621485"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dermcare%20Topco%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004963"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37618.pdf"}],"summary":"DermCare reported that files containing patient information were accessed or taken without authorization between February 14 and February 26, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-08","discovered_date":"2026-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1f03b858133a4a599a0dcd95ba4c56f48997f88","impact_type":"unknown","incident_date":"2026-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"660146c430bf","org_name":"Bitcoin Depot Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm"}],"summary":"Bitcoin Depot reported that an unauthorized actor accessed company systems and transferred approximately 50.903 Bitcoin from company-controlled wallets.","supporting_quote":null,"technology_involved":["digital asset settlement accounts","Company-controlled wallets"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2026-04-06","discovered_date":"2026-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"aa8c5356a8f398b6a5dc3f8cc6780c89c7c95145","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Walker%20Accounting%20%26%20Tax%20Service.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4cf7df0e280b","org_name":"Walker Accounting & Tax Service","org_type":"professional_services","ransomware":null,"records_affected":3304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Walker%20Accounting%20%26%20Tax%20Service.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Consumer%20Letter%20-%20Walker%20Accounting%20%26%20Tax%20Service.pdf"}],"summary":"Walker Accounting & Tax Service reported suspicious activity, unauthorized connections, and potentially affected personal, financial, and medical information.","supporting_quote":null,"technology_involved":["cloud-based tax preparation software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d08a44f49a620f6a84bf52a1cde013340c3400c2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3bf25763153","org_name":"Shore Gardens Rehabilitation and Nursing Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":755,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-06-shore-gardens-rehabilitation-and-nursing-center-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-06","discovered_date":"2025-12-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad4ef712db53f9289cdcdc61cf5ea3724b3d921e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e7099fafa04","org_name":"My485, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":19101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004961"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-06","discovered_date":"2025-11-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36c4cd9656ed2bc86baa409326ff82b612fb951c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bbbb3cad1299","org_name":"Maritz Holdings Inc. (“Maritz”)","org_type":"retail_ecommerce","ransomware":null,"records_affected":4906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004958"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"db6ba6ca3a29ebc7821538e59128b3173deeacfb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"facca25c91f4","org_name":"Hospital Caribbean Medical Center","org_type":"healthcare","ransomware":null,"records_affected":92000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-06-hospital-caribbean-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d425055fa79fd683b9800fa8edab3bc4752510b4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a28d187ed3b4","org_name":"Heart South Cardiovascular Group","org_type":"healthcare","ransomware":null,"records_affected":46666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-06-heart-south-cardiovascular-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1d5dc9e9d4dcd389bd955dbc03a2f66c4b9f3dd7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a2a9497a5d3","org_name":"Grandview Family Medicine","org_type":"healthcare","ransomware":null,"records_affected":13310,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-06-grandview-family-medicine"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-04-06","discovered_date":"2026-02-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c2899c4ca152d04d5e51c53d9df842e124b39a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97a6417ac13c","org_name":"Five States Energy Company, L.L.C.","org_type":"financial","ransomware":null,"records_affected":2251,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004956"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"962c35dd7fa60862243cabd392b991ee4f6d2d4c","impact_type":"data_theft","incident_date":"2026-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"05dd4706a132","org_name":"SongTrivia2","org_type":"technology_saas","ransomware":null,"records_affected":291739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SongTrivia2","type":"hibp","url":"https://haveibeenpwned.com/Breach/SongTrivia2"}],"summary":"SongTrivia2 suffered a data breach involving email addresses, password hashes, names, usernames, and avatars, and the data was published on a public hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18e32411fa762e8206858fe608948645b06e238f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d66e96e11eec","org_name":"Crunchyroll","org_type":"technology_saas","ransomware":null,"records_affected":6800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Crunchyroll","type":"hibp","url":"https://haveibeenpwned.com/Breach/Crunchyroll"}],"summary":"Crunchyroll reportedly suffered a data breach involving information from its Zendesk support system, allegedly affecting 6.8 million users.","supporting_quote":null,"technology_involved":["Zendesk support system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-03","discovered_date":"2026-02-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ebd6424162a90278ae08eb84b6fbf7561980218","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wynn%20-%20Appendix%20A%20-%20Sample%20Notice%20Letter%20-%20All%20Personnel_0.pdf"},"notes":null,"org_country":"US","org_id":"a52d7ed003c9","org_name":"Wynn Resorts, Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621283"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wynn%20-%20Appendix%20A%20-%20Sample%20Notice%20Letter%20-%20All%20Personnel_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004959"}],"summary":"Wynn Resorts reported that an unauthorized party accessed and obtained records from certain human resource systems.","supporting_quote":null,"technology_involved":["human resource systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b47c1f504c0b46989c2aef350afdb51774c18161","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84ea68c21969","org_name":"Village Heart Seller, PC d/b/a Village Heart & Vein Center","org_type":"healthcare","ransomware":null,"records_affected":687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-03-village-heart-seller-pc-d-b-a-village-heart-vein-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e0d62215f9e7ba720f50d7abcc1bd706a690bb06","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"148c129a924f","org_name":"Rocky Mountain Associated Physicians, P.C.","org_type":"healthcare","ransomware":null,"records_affected":50640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-03-rocky-mountain-associated-physicians-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-03","discovered_date":"2026-01-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82005f63bec2dc824895046c38cd8c2ccf53e0d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-15","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37589.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fffead8f37f7","org_name":"Rainier Clinical Research Center","org_type":"healthcare","ransomware":true,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37589.pdf"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmFpbmllciBDbGluaWNhbCBSZXNlYXJjaCBDZW50ZXJAaW5jcmFuc29t"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37589.pdf"}],"summary":"Rainier Clinical Research Center reported unauthorized access to its systems following a security incident at its IT managed service provider, with personal information potentially acquired.","supporting_quote":"On January 18, 2026, we learned of unauthorized activity in our system resulting from a data security incident suffered by our IT managed service provider.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1213"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"865a7ebfa0224ed89fe99ae42a29c40d606d2606","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DocketWise%20-%20California%20AG%20Notice%20and%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"4617ba662f2c","org_name":"DocketWise","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621361"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622723"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DocketWise%20-%20California%20AG%20Notice%20and%20Consumer%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37590.pdf"}],"summary":"DocketWise reported that an unauthorized actor used valid credentials to clone third-party partner repositories, and that some personal information was subject to unauthorized acquisition.","supporting_quote":"In October 2025, DocketWise suspected that the credentials to one of its third-party partner repositories may have been accessed.","technology_involved":["third-party partner repositories","DocketWise application"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-02","discovered_date":"2025-04-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e09430772b09be8620aca746f71cf08d7b3fce1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIMEC%20Oil%20%26%20Gas%2C%20Inc%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"a28e018480c2","org_name":"TIMEC Oil & Gas, Inc.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIMEC%20Oil%20%26%20Gas%2C%20Inc%20Sample.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004955"}],"summary":"An unknown actor accessed a TIMEC employee’s email account, which may have contained emails or attachments with individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"47cf379125646230bd8141c01249723669802d4b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eba613d18122","org_name":"Southern Illinois Dermatology","org_type":"healthcare","ransomware":null,"records_affected":160312,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-02-southern-illinois-dermatology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-02","discovered_date":"2026-02-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c2ebe4f5ddf4f76f6e3b615a6f9712749af20ffe","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90885c8c2d2c","org_name":"LHC Group","org_type":"healthcare","ransomware":null,"records_affected":8644,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004952"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-04-02","discovered_date":"2026-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a98598e21d3724cccb1d113c5693b11a238323fa","impact_type":"data_theft","incident_date":"2026-02-04","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hims%20%26%20Hers%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7b32c9a18956","org_name":"Hims & Hers, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621205"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hims%20%26%20Hers%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004954"}],"summary":"Hims & Hers reported that certain customer service tickets on its third-party platform were accessed or acquired without authorization.","supporting_quote":null,"technology_involved":["third-party customer service platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-04-02","discovered_date":"2026-02-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce67b2433bbd34ce3dcf6f56cf1d3f263a2d81a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2669b05fdd1e","org_name":"Amedisys","org_type":"healthcare","ransomware":null,"records_affected":9111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004953"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2026-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a2e2f300f75091cbc51f3a6bbe007326435081b","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"08cc98cd89e2","org_name":"SUCCESS","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SUCCESS","type":"hibp","url":"https://haveibeenpwned.com/Breach/SUCCESS"}],"summary":"SUCCESS reported a breach exposing personal information, staff password hashes, and purchase data, and its system was abused to send offensive newsletters.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-04-01","discovered_date":"2026-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8c2f9348815b84e787bcb93d3f833999d5830a9","impact_type":"unknown","imported_from":null,"incident_date":"2026-03-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"84d9809725d9","org_name":"Hasbro, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/46080/000004608026000013/has-20260401.htm"}],"summary":"Hasbro identified unauthorized access to its network on March 28, 2026, and took certain systems offline while investigating.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"HAS","base_day":"2026-04-01","returns":{"1":{"day":"2026-04-02","raw":0.0087,"adj":0.0078},"5":{"day":"2026-04-09","raw":0.0412,"adj":0.0035},"21":{"day":"2026-05-01","raw":0.0659,"adj":-0.0339},"63":{"day":"2026-07-02","raw":-0.1033,"adj":-0.2399},"126":{"day":"2026-10-01","raw":0.0067,"adj":-0.1593}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-31","discovered_date":"2026-03-24","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cfcb2c32188e8a9170fbe560dd209c38355ec4d","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-24","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/March%202026%20Credential%20Stuffing%20-%20Security%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9a74ed1f297e","org_name":"Whitepages","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers tried credentials stolen from other websites, and accounts using the same username and password may have been accessed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621108"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/March%202026%20Credential%20Stuffing%20-%20Security%20Notice.pdf"}],"summary":"Whitepages detected credential-stuffing attempts using credentials stolen from other websites, and some accounts may have been accessed.","supporting_quote":"We determined that these attempts were part of a “credential stuffing” attack, in which someone used lists of usernames and passwords stolen from other, unrelated websites to try to log in to accounts on our site.","technology_involved":["Whitepages website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-31","discovered_date":"2026-03-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8408d47786abd5b3e7d96a808b66bacc75a5dfbf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bab10b70dce4","org_name":"Palacios Marine & Industrial Coatings, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":15215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004947"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-31","discovered_date":"2026-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d54596784d5ded0b917c620f6d6c6908ea6959c","impact_type":"data_theft","incident_date":"2026-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mercer%20-%20Sample%20Individual%20Notice%20%2803%2031%2026%29%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"286bd9e2b5c4","org_name":"Mercer Advisors","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621099"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWVyY2VyIEFkdmlzb3JzQHNoaW55aHVudGVycw"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mercer%20-%20Sample%20Individual%20Notice%20%2803%2031%2026%29%20%28CA%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004950"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37544.pdf"}],"summary":"Mercer Advisors reported that an unauthorized third party obtained certain individuals’ personal information after accessing systems used to store client data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1ec57987620bbb0697f4c3e771418a3806901eb7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1f58da041a5","org_name":"Interventional Pain Center, PLLC","org_type":"healthcare","ransomware":null,"records_affected":3171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-31-interventional-pain-center-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-31","discovered_date":"2026-02-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"26fd758e41fc22aa85ab54458ba337d4d0085439","impact_type":"unknown","incident_date":"2026-01-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d726abea709","org_name":"Elephants Food Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":2963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Elephants%20Food%20Group%2C%20Inc.-2026-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0488ebce7df37b597af6bdff9f79cb8f6b4cdd32","impact_type":"data_theft","imported_from":null,"incident_date":"2025-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"567163c20224","org_name":"Cuties AI","org_type":"technology_saas","ransomware":null,"records_affected":144250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cuties AI","type":"hibp","url":"https://haveibeenpwned.com/Breach/CutiesAI"}],"summary":"A breach of Cuties AI exposed 144,250 unique email addresses and other account and generated-content data, which was later published on a public hacking forum.","supporting_quote":null,"technology_involved":["Cuties AI platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"456f1813b0ffbf89804b064946aea1155d309e39","impact_type":"data_theft","incident_date":"2025-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AMS%20Notification%20Letter%20SAMPLE.pdf"},"notes":null,"org_country":"US","org_id":"803a2697f142","org_name":"Advantage Media Services LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621086"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AMS%20Notification%20Letter%20SAMPLE.pdf"}],"summary":"An unauthorized actor accessed Advantage Media Services LLC’s server environment in September 2025 and copied certain data that may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"44807b613657294e11ef3a6dc6eb3a29e278cd97","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd9264efc82e","org_name":"Waterford Surgical Center","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-30-waterford-surgical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-30","discovered_date":"2026-02-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f27be6c61036cdc6a7d01774925943b3ae66208","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7351bf2c6a2a","org_name":"ONE Gas, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004943"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"56ec7533730742d753c6fd2f8bbac1cfcf1c1e16","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"754403555c69","org_name":"Nacogdoches Memorial Hospital n","org_type":"healthcare","ransomware":null,"records_affected":2507073,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-30-nacogdoches-memorial-hospital-n"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-30","discovered_date":"2026-02-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d6d0577e4d52912f5ee97c2bedbfe954ff597d9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e159c0e7f10","org_name":"Master Mobilelink LLC and Mobily LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":40174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004944"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c7244f9bab5ace546340c46c60227b9d495058e6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1a04615acac","org_name":"J. Arthur Trudeau Memorial Center","org_type":"healthcare","ransomware":null,"records_affected":5630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-30-j-arthur-trudeau-memorial-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a41e0bfd7c85c3bb8ed747dac3c532c79a549dee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"171b413dca83","org_name":"Austin Plastic and Reconstructive Surgery","org_type":"healthcare","ransomware":null,"records_affected":4266,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-30-austin-plastic-and-reconstructive-surgery"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004948"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3ea7f146dc13dcc82b54855058d81d7110d207fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c25efd3c2957","org_name":"Lumio Dental","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-29-lumio-dental"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-29","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b6312f7e2b48fb44641130cf997ca7d07657e8f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-05","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Advantage%20Gold%20Data%20Breach%20Notice_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"93f7e46599e9","org_name":"Advantage Gold","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in third-party firewall software was exploited before the vendor informed the organization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621025"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Advantage%20Gold%20Data%20Breach%20Notice_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004945"}],"summary":"Advantage Gold reported unauthorized access to systems containing personal information after a vulnerability in third-party firewall software was exploited.","supporting_quote":"Prior to the vendor informing us of that vulnerability, it was exploited to allow unauthorized persons to get past our firewall and gain access to our networks and systems including those that contained certain personal information.","technology_involved":["firewall software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e47e261c43dde96029fa1294840e28921ff617c1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d63f2b02033","org_name":"University Medical Center of Southern Nevada","org_type":"healthcare","ransomware":null,"records_affected":1221,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-28-university-medical-center-of-southern-nevada"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1152101bccb7fb020f22b79eceb3b4104a0a8695","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3b1b3740978","org_name":"Penobscot Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":33107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-28-penobscot-valley-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"qilin","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"76396294ca2315a2143d9ec0a92118d8f7eb3313","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"793b80f7264f","org_name":"Rocky Mountain Care","org_type":"professional_services","ransomware":true,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-27-rocky-mountain-care"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Um9ja3kgTW91bnRhaW4gQ2FyZUBxaWxpbg"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"qilin","claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c8a701b470be0c2169a776403af91bcc79b6ec4f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8f9e58131f1d","org_name":"Proxycare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":45196,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-27-proxycare-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1e0da8efae33ccee96ec70b77ec2c34272e495e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Oklahoma%20Tax%20Commission%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f6d267b687f0","org_name":"Oklahoma Tax Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Oklahoma%20Tax%20Commission%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004940"}],"summary":"The Oklahoma Tax Commission reported unauthorized access to W-2 and 1099 files in its OkTAP system containing names and Social Security numbers.","supporting_quote":null,"technology_involved":["OkTAP"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1b8448001ad55db636e5d37e34e6cd0c0866e956","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a69e18a7adf","org_name":"Glendora Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-27-glendora-surgery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9271711f3a311ea850cdecc6bf7a312934ceb1a2","impact_type":"data_theft","incident_date":"2025-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eurail_%20CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"a49e23442b80","org_name":"Eurail B.V.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620972"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eurail_%20CA%20App%20%26%20Sample_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004942"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eurail%20B.V.-2026-03-27"}],"summary":"Eurail B.V. reported that an unauthorized actor transferred files from its network, including files containing names and passport numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93d4be3c9d3a268c74b077f2b960834ed1def69a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e87d79af0ed7","org_name":"Erie Family Health Centers","org_type":"healthcare","ransomware":null,"records_affected":570000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-27-erie-family-health-centers"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-27","discovered_date":"2026-01-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f63237623a74963ef5fde1325a5ed187da35577f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d94cd7777424","org_name":"Empowerment Schools","org_type":"education","ransomware":null,"records_affected":70823,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004939"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-27","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9309d2dbe3280886632973dec7544ccb312fd926","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f193fc64a963","org_name":"Dana Lee CPA LLC","org_type":"financial","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004938"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"968797d351049a40a53f36f2b713fa6de233830e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"563329c64d87","org_name":"BreachForums Version 5","org_type":"other","ransomware":true,"records_affected":339778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BreachForums Version 5","type":"hibp","url":"https://haveibeenpwned.com/Breach/BreachForumsV5"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QnJlYWNoRm9ydW1zIHZlcnNpb24gNUBzaGlueWh1bnRlcnM"}],"summary":"A March 2026 breach of BreachForums Version 5 exposed email addresses, usernames, and Argon2 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f16932e16bd7e311e24eb15625e880db3fcf975a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"965f3c5f6247","org_name":"Atlantic Brain and Spine, PA","org_type":"healthcare","ransomware":null,"records_affected":1372,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-27-atlantic-brain-and-spine-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0eb35350176d1826d66e79b7690f257db875535","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fbf15ce4f713","org_name":"Sound Radix","org_type":"technology_saas","ransomware":null,"records_affected":292993,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sound Radix","type":"hibp","url":"https://haveibeenpwned.com/Breach/SoundRadix"}],"summary":"Sound Radix disclosed a data breach affecting email addresses and names, with hashed passwords possibly exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0738683926746483fbb746d2242c4d1a819bcbf5","impact_type":"data_theft","imported_from":null,"incident_date":"2015-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c8c6a0498ed6","org_name":"Scuf Gaming","org_type":"manufacturing","ransomware":null,"records_affected":128683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Scuf Gaming","type":"hibp","url":"https://haveibeenpwned.com/Breach/ScufGaming"}],"summary":"Scuf Gaming suffered a data breach in June 2015 that exposed email addresses, usernames, display names, IP addresses and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-26","discovered_date":"2025-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"945945636b2268d5bf875662a9878a2eea13433a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Battery%20-%20Adult%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"4ad7d0c15e3a","org_name":"MXB Battery Operations LP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620848"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Battery%20-%20Adult%20Notice%20Letter%20Template.pdf"}],"summary":"MXB Battery Operations LP reported that information stored on its network was subject to unauthorized access between November 11 and November 15, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-26","discovered_date":"2026-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"68c59c386407fae1cc5df849d59413ba9e56a5f6","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Kaaj%20Technologies%20Inc.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"48050c3dd908","org_name":"Kaaj Technologies Inc.","org_type":"unknown","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Kaaj%20Technologies%20Inc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Kaaj%20Technologies%20Inc.pdf"}],"summary":"Kaaj Technologies reported unauthorized access to its environment on January 13, 2026, and said some data was copied from a database it maintained for Wheel Equipment Leasing.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"518f8b123a7adc58b748e9d8ae7c2cc538439b28","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c34a49a7fcc","org_name":"CORPORACION DE SERVICIOS MEDICOS PRIMARIOS Y PREVENCION DE HATILLO","org_type":"healthcare","ransomware":null,"records_affected":24236,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-26-corporacion-de-servicios-medicos-primarios-y-prevencion-de-hatillo"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-26","discovered_date":"2025-11-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da3f5f48e2a20ab54da889abb9d7d7a2bee34775","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20AG%20Submission.pdf"},"notes":null,"org_country":"US","org_id":"89e62390d011","org_name":"California Online Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20AG%20Submission.pdf"}],"summary":"California Online Public Schools disclosed that publicly posted Board meeting agenda packets included students’ and parents’ personal information and disability-related information.","supporting_quote":"Upon becoming aware of the possible disclosure of PII, CalOPS immediately removed the agenda packets posted on its website and conducted a careful review of each agenda packet to determine the nature and scope of the potential disclosure.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-26","discovered_date":"2025-12-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1ae4b8556f298587933ba6886bc68224734fa2d","impact_type":"data_theft","incident_date":"2025-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20-%20AIRS.pdf"},"notes":null,"org_country":"US","org_id":"8a2979495ee9","org_name":"Alliance Industrial Refrigeration Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620890"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20-%20AIRS.pdf"}],"summary":"Alliance Industrial Refrigeration Services discovered suspicious activity on December 25, 2025, and determined that an unauthorized actor accessed and acquired data including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-25","discovered_date":"2026-01-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e4359d07788ce1784203657575d3c885fe251b79","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10c316ff1cc9","org_name":"TSU One Holdings, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":3137,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004934"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-25","discovered_date":"2025-05-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fbff3bd4693e150f751bfbf8bc2d60439283b146","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff90bc19718d","org_name":"Tricon Energy Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":503,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004930"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-25","discovered_date":"2026-03-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64360616409eb734aaba869d05fef8a7c7c7dbc9","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"11b3a482a048","org_name":"Hightower Holding, LLC","org_type":"financial","ransomware":null,"records_affected":131483,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004931"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-25","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c4c03ed0f3579ab59501605e969e2e2347cd5a1e","impact_type":"unknown","incident_date":"2025-12-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c198660d242","org_name":"Deschutes Public Library","org_type":"unknown","ransomware":null,"records_affected":830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Deschutes%20Public%20Library-2026-03-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a6c78f7d7923c5a8b90d3339a5c459c0cac8616a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbfc06d3e65b","org_name":"Clarinda Regional Health Center","org_type":"healthcare","ransomware":null,"records_affected":24341,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-25-clarinda-regional-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-25","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"944b3004a3983a48a449cb510c2c8228757fec58","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d29e21231c2","org_name":"Chemical Services Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004933"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9f337aa3655c8ff3ebed6eec200661a4f25274f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cetera%20Financial%20Group%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6d3a581190d4","org_name":"Cetera Financial Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620788"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cetera%20Financial%20Group%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004936"}],"summary":"Cetera Financial Group reported unauthorized access to a single employee email account, and its review identified personal information involved.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c2d9c280c71870950d69b0ad8c7303247d0e6aec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8963a35872b1","org_name":"New York City Health and Hospitals Corporation","org_type":"healthcare","ransomware":null,"records_affected":1800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-24-new-york-city-health-and-hospitals-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9750ed03efbbd240c4218e499c08c80c2e8e1d31","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7f7071f95c9","org_name":"Coastal Carolina Health Care, PA","org_type":"healthcare","ransomware":null,"records_affected":110304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-24-coastal-carolina-health-care-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"91b999a053b8fa00f2c95e880ebc1705e0d92dcc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0ceebb2660f1","org_name":"Secure Health Plans of Georgia, LLC","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-23-secure-health-plans-of-georgia-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b3af7a6be4887c2ac39b508bae0af247346eaa7","impact_type":"data_theft","incident_date":"2011-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cf87d27566c5","org_name":"RuneScape Boards","org_type":"other","ransomware":null,"records_affected":222762,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RuneScape Boards","type":"hibp","url":"https://haveibeenpwned.com/Breach/RSBoards"}],"summary":"RuneScape Boards suffered a data breach that exposed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93f555263d8123effe1af02a5f1392159c6f3aee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"461bd5b92c86","org_name":"Rosch Visionary Systems, Inc.","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-23-rosch-visionary-systems-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"51560fca016ee781e6ced52d9c64dd7b9d69b6ed","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"14e65608a108","org_name":"Pennyroyal Healthcare Services","org_type":"healthcare","ransomware":null,"records_affected":24122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-23-pennyroyal-healthcare-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-23","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"611d14f87bd9d92262b6157b1bc46cdd595056c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e66651c0fbb2","org_name":"Pan-American Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":5809,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004925"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-23","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cedd3c8f9e458b565c272f41a7e13cbf5f25acea","impact_type":"data_theft","incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37348.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9d9cf8cc9df7","org_name":"Navia Benefits Solutions Inc","org_type":"professional_services","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37348.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37348.pdf"}],"summary":"Navia Benefits Solutions Inc reported that an unauthorized actor accessed and acquired certain information between December 22, 2025, and January 15, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2026-03-23","discovered_date":"2026-01-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"32bcaa45b578f8e77b75028b7236975f0f14b81e","impact_type":"data_theft","incident_date":"2026-01-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer_Letter_Hightower_Holding_LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"55633422532d","org_name":"Hightown Holding, LLC","org_type":"unknown","ransomware":null,"records_affected":1087,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer_Letter_Hightower_Holding_LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer_Letter_Hightower_Holding_LLC.pdf"}],"summary":"Hightown Holding, LLC reported unauthorized access through compromised user accounts and unauthorized downloads of files in January 2026.","supporting_quote":"On January 9, 2026, the Company became aware of a compromised user account resulting in unauthorized access to our environment.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-23","discovered_date":"2026-01-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e843e274ebca650ef5d0c1cfd6faea8d153a1873","impact_type":"data_theft","incident_date":"2026-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37362.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"11b3a482a048","org_name":"Hightower Holding, LLC","org_type":"financial","ransomware":null,"records_affected":7528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37362.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37362.pdf"}],"summary":"Two compromised user accounts were used to access Hightower’s environment, and files were downloaded without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-23","discovered_date":"2026-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6c1e70ab6c1452e95ab7c5f309e922ef1d9b4d6e","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"80a32e4d1e6c","org_name":"Heritage Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1046025/000162828026020261/hfwa-20260320.htm"}],"summary":"Heritage Financial Corporation detected unauthorized activity involving an internal file share server and the exfiltration of files that may contain personal information.","supporting_quote":null,"technology_involved":["internal file share server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"HFWA","base_day":"2026-03-23","returns":{"1":{"day":"2026-03-24","raw":0.0071,"adj":0.0105},"5":{"day":"2026-03-30","raw":0.0103,"adj":0.046},"21":{"day":"2026-04-22","raw":0.0813,"adj":-0.0039},"63":{"day":"2026-06-23","raw":0.1365,"adj":0.0172},"126":{"day":"2026-09-22","raw":0.1163,"adj":-0.0638}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-23","discovered_date":"2025-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70d79cf1289f7297cace4c9261e4a7ddd428fe15","impact_type":"data_theft","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Expert%20MRI%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7587fa92d4d1","org_name":"Expert MRI","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620694"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Expert%20MRI%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Expert MRI reported that an unknown actor accessed and copied files containing protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-23","discovered_date":"2026-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"07312b46a6a5f3ae05f68ac3e549fcc033a3a204","impact_type":"both","incident_date":"2026-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37357.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c886e0dea297","org_name":"Chapel Hill Presbyterian Church","org_type":"nonprofit","ransomware":null,"records_affected":879,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37357.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37357.pdf"}],"summary":"Chapel Hill Presbyterian Church reported unauthorized acquisition of information after unusual activity disrupted access to certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-23","discovered_date":"2026-02-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0be18794cf23aa2a4d21d05a2b27e24f25e075bd","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb67f8d95a91","org_name":"Austin Cosmetic Surgery, PLLC","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004924"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-03-20","discovered_date":"2026-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e0fedfa5aac9aa7f46d3308935d1add05ae2a6e2","impact_type":"both","imported_from":null,"incident_date":"2026-03-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"SG","org_id":"d320ee95bf24","org_name":"TRIO-TECH INTERNATIONAL","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/732026/000143774926009193/trt20260320_8k.htm"}],"summary":"TRIO-TECH INTERNATIONAL reported that ransomware encrypted certain files at a Singapore subsidiary and that company data was later disclosed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"TRT","base_day":"2026-03-20","returns":{"1":{"day":"2026-03-23","raw":0.0412,"adj":0.0307},"5":{"day":"2026-03-27","raw":0.0206,"adj":0.0429},"21":{"day":"2026-04-21","raw":0.2113,"adj":0.1258},"63":{"day":"2026-06-22","raw":1.4914,"adj":1.3437},"126":{"day":"2026-09-21","raw":0.8935,"adj":0.7008}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1110"],"confidence":"high","control_failure":"unknown","credential_source":"brute_force","cve":[],"data_types":[],"disclosed_date":"2026-03-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ad1a0787d2a1dfc0b4ccf0a0335fbd1a7d521a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1110","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Shubert%20Organization%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"95f9ac9f2709","org_name":"The Shubert Organization, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Shubert%20Organization%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown cyber actor used a brute force attack to access certain accounts on Shubert’s Telecharge ticketing website.","supporting_quote":"On January 19, 2026, an unknown cyber actor performed a brute force attack and accessed certain accounts on Shubert’s ticketing website, Telecharge.","technology_involved":["Telecharge","ticketing website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-20","discovered_date":"2025-03-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"40402225716b552f6a307db5a4e7b282755ce822","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62ca3d3a1e49","org_name":"Harper Executive Group, Inc.","org_type":"other","ransomware":null,"records_affected":8663,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004921"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-20","discovered_date":"2026-02-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1a8a8d4f7bfc81068e0f1907e17007537b97293","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"373bf81b0ed4","org_name":"BeyondFaith Homecare & Rehab, LLC","org_type":"healthcare","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004923"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64994a9e30fe8d1b662297467c6ff261ece0916e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAKJP_EmployeeNotice_5%20Mar%202026.pdf"},"notes":null,"org_country":"US","org_id":"4c27cc6b7154","org_name":"Senior Operations LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620501"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAKJP_EmployeeNotice_5%20Mar%202026.pdf"}],"summary":"Senior Operations LLC reported that an attacker accessed files containing personal information in the Senior Aerospace Jet Products/Ketema environment during an attempted ransomware incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3aa14edbfb022341ccb7495ab6faea3b424e1fff","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05dd8484a663","org_name":"Complete Eye Care dba Orem Eye Clinic","org_type":"healthcare","ransomware":null,"records_affected":5800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-19-complete-eye-care-dba-orem-eye-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6cf61597fc7b694108a476e350b91dfc272a9cac","impact_type":"unknown","incident_date":"2025-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37279.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"498b1f03eb6e","org_name":"Check City","org_type":"financial","ransomware":null,"records_affected":716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37279.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37279.pdf"}],"summary":"Check City filed a breach notice affecting 716 people, but the provided text does not describe the incident details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75b59b00c447bbabf8af5ad61087b0b0acb53498","impact_type":"unknown","incident_date":"2025-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Check_City_Supplemental_Notice_Sample_Letter_CA_37713056v1.pdf"},"notes":null,"org_country":"US","org_id":"498b1f03eb6e","org_name":"Check City","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620455"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Check_City_Supplemental_Notice_Sample_Letter_CA_37713056v1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004922"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Check%20City-2026-03-19"}],"summary":"Check City filed a breach notification concerning an incident dated 2025-04-03; the provided text does not describe the access method or impact.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-18","discovered_date":"2026-01-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d1b2944d167ec9a490de6f43e30b514e750059ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3fb0a6e4614b","org_name":"Williams Hart & Boundas, LLP","org_type":"retail_ecommerce","ransomware":null,"records_affected":9336,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004915"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-18","discovered_date":"2026-02-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b194c8e2800a199ee8d81926eb0f5c815699fcb","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37260.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f9885b55420","org_name":"Unibail-Rodamco-Westfield","org_type":"other","ransomware":null,"records_affected":5723,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37260.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37260.pdf"}],"summary":"Unibail-Rodamco-Westfield reported unauthorized access to a database containing loyalty-program and newsletter-subscriber information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"61c9a5099f9419a676f3b5a8b823805d3c5fd94a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b680f38c8100","org_name":"The South Alabama Regional Planning Commission","org_type":"professional_services","ransomware":null,"records_affected":3043,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-18-the-south-alabama-regional-planning-commission"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-18","discovered_date":"2026-01-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab542571cc1a9122cf819a06f0916b72346d4bbd","impact_type":"unknown","incident_date":"2026-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c208f3449cc6","org_name":"The Michael Larson Co., PC","org_type":"unknown","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Michael%20Larson%20Co.%2C%20PC-2026-03-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-18","discovered_date":"2026-01-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"41b4abe8ab4df55c50480d28dabaa1558ab0a20e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"37fa20be731a","org_name":"Stockton Cardiology Medical Group","org_type":"healthcare","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-18-stockton-cardiology-medical-group"},{"fetched_at":null,"title":"Leak-site claim by genesis","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3RvY2t0b24gQ2FyZGlvbG9neSBNZWRpY2FsIEdyb3VwQGdlbmVzaXM"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620623"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice.pdf"}],"summary":"Stockton Cardiology Medical Group reported that an unauthorized individual accessed and removed files containing potentially personal, medical, and business information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["genesis"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e7a6ba38f8d0695da4a64425a3174184d220cc36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6cb450d8903f","org_name":"New Horizons Behavioral Health","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-18-new-horizons-behavioral-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-18","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0bcc0217c320d74d7a5d699cb076605f492ccec","impact_type":"data_theft","incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37247.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9a390066dc26","org_name":"Navia Benefit Solutions","org_type":"professional_services","ransomware":null,"records_affected":319208,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37247.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37247.pdf"}],"summary":"Navia Benefit Solutions reported that an unauthorized actor accessed and acquired personal and health-plan-related information between December 22, 2025, and January 15, 2026.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-18","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3735e167f7c3098fe5077e71dd9bf511be797ac0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Navia%20Benefit%20Solutions%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9a390066dc26","org_name":"Navia Benefit Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":2151330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-18-navia-benefit-solutions-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620409"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Navia%20Benefit%20Solutions%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004920"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Navia%20Benefit%20Solutions%2C%20Inc.-2026-03-18"}],"summary":"Navia Benefit Solutions reported that an unauthorized actor accessed and acquired information, including names and potentially health-plan participation details.","supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-18","discovered_date":"2026-03-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8bd320ec8993128079bee77b4af073e21a6bb359","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6aba4180fc5","org_name":"Capital Star Oil & Gas, Inc.","org_type":"other","ransomware":null,"records_affected":3307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004919"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"736cdf3bc4c0d70f0c282c75e280646d18831494","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-03-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2e0f53f70f56","org_name":"Aura","org_type":"technology_saas","ransomware":true,"records_affected":903080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aura","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aura"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QXVyYSBHcm91cCwgSW5jQHNoaW55aHVudGVycw"}],"summary":"Aura disclosed a breach involving data associated with a marketing tool, exposing email addresses and other personal information.","supporting_quote":null,"technology_involved":["marketing tool"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-17","discovered_date":"2026-03-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58722f1bde1aa537a494c4f4cd434d8ee0508713","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7a9760eba0a","org_name":"Robert L Hensley PC","org_type":"financial","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004914"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-17","discovered_date":"2026-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b09697fa0ae4a0db0bbe0dc2c465dea51dc28b48","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OpenLoop%20-%20Reg.%20Letter%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"3ad3e6b8f5ae","org_name":"OpenLoop Health, Inc.","org_type":"professional_services","ransomware":null,"records_affected":716000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-17-openloop-health-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620380"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OpenLoop%20-%20Reg.%20Letter%20-%20California_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004918"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23589.pdf"}],"summary":"OpenLoop Health reported that an unauthorized third party accessed certain systems and removed information between January 7 and January 8, 2026.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44857e0f7e461f68e7f933f280ed9c864664af7d","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kaplan%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"bce507b13786","org_name":"Kaplan North America, LLC","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620355"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kaplan%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004916"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kaplan%20North%20America%2C%20LLC-2026-03-17"}],"summary":"An unauthorized actor accessed Kaplan North America, LLC's computer servers and took files containing names, Social Security numbers, and/or driver’s license numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-17","discovered_date":"2026-02-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ead5a094b9d729aa788c0dfaf94ce503537c364","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9ea58bb1bb5","org_name":"Gearhiser, Peters, Elliott & Cannon, PLLC","org_type":"other","ransomware":null,"records_affected":26951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004913"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-17","discovered_date":"2026-01-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9268c8ea1967476d547d98f312b934c784a1ec22","impact_type":"unknown","incident_date":"2026-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bdee1ce35e70","org_name":"Cascade Eyecare Center, PC","org_type":"unknown","ransomware":null,"records_affected":410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cascade%20Eyecare%20Center%2C%20PC-2026-03-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-16","discovered_date":"2025-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d45a0e6e559d7e40dbc076c2659503adeb6527","impact_type":"data_theft","incident_date":"2025-12-06","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b1eff6b1142c","org_name":"Wound Technology Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620273"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004912"}],"summary":"Woundtech reported that an unauthorized individual may have copied information during unusual activity from December 6 to December 9, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-16","discovered_date":"2026-02-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c8156434808c3173091aba59877c5e6901b98fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fdb5abfe045e","org_name":"West Texas Health PLLC","org_type":"healthcare","ransomware":null,"records_affected":75858,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004853"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a14ce25ae5c23150ac7cc1cc4fdd73084af4f1d","impact_type":"unknown","incident_date":"2025-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2296975a8a7a","org_name":"Retail Merchandising Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620250"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004911"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8d330e70ba81608558b6cf576156e6e7b08c89c4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4afc73a90705","org_name":"Renovo Chiropractic & Wellness","org_type":"healthcare","ransomware":null,"records_affected":538,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-16-renovo-chiropractic-wellness"}],"summary":null,"supporting_quote":null,"technology_involved":["Other","Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-16","discovered_date":"2025-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"069ff4c2f98a499bc234134f95552e972d4bb587","impact_type":"data_theft","imported_from":null,"incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enclosure%20-%20Example%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"377f3cfa4162","org_name":"Marquis Software Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620333"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enclosure%20-%20Example%20Individual%20Notice%20Letter.pdf"}],"summary":"Marquis Software Solutions identified suspicious activity on its network and determined that an unauthorized third party accessed it and may have copied files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-16","discovered_date":"2026-02-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2259e33a5100942313c96aa827235551a055d55a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f28eb137d238","org_name":"Hypertherm, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4228,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004908"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-16","discovered_date":"2025-09-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"424e7d7785ae9277d0ff345fe79af615e4ce5a9a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ff33c01e5e7","org_name":"Gulshan Management Services, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":377082,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004910"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5fcb18b3960c26a546005912fa784fa1379f827b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae2d55637b61","org_name":"Good Samaritan Health Center","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-16-good-samaritan-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-16","discovered_date":"2026-03-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4ae23b22442b60918a3e094227db56233d198217","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c295c0ca69fe","org_name":"Earthbound Holding LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":6766,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004904"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc450681dba0690b2fb6c5cc784e7bda3fe9dd67","impact_type":"unknown","incident_date":"2025-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RDC13T_Sample_Letter_Redacted_37712052v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"406b5d299d8e","org_name":"Chapter 13 Trustee Office of Rod Danielson","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620248"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38b0615be842fd4f65fd156b09146b6d2aeac39f","impact_type":"both","imported_from":null,"incident_date":"2026-03-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"10c43618def9","org_name":"Divine Skins","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Divine Skins","type":"hibp","url":"https://haveibeenpwned.com/Breach/DivineSkins"}],"summary":"Divine Skins said an unauthorised third party accessed part of its systems, deleted database skins, and exposed email addresses, usernames, and purchase history.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2026-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5077049a7df011e1848fde02e963f1a9c1b0feec","impact_type":"data_theft","imported_from":null,"incident_date":"2026-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"TR","org_id":"38be6ddeb8b3","org_name":"Baydöner","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Baydöner","type":"hibp","url":"https://haveibeenpwned.com/Breach/Baydoner"}],"summary":"Baydöner’s breach exposed personal information and plaintext passwords, and the data was subsequently published to a public hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a1940d365e215e26e9a78bcd97ce32c542269085","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c42e65e0717","org_name":"UPMC","org_type":"healthcare","ransomware":null,"records_affected":687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-14-upmc"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3ac3fa02bdfd1b0b3b9f1afb198584dade8796f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"16deec0cd0a2","org_name":"Trinity Health","org_type":"professional_services","ransomware":null,"records_affected":2740,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-13-trinity-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ca0c7e6e0d1923b840468385db751605e0383d9b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87483a2bdc22","org_name":"MedPeds Associates of Sarasota","org_type":"healthcare","ransomware":null,"records_affected":22017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-13-medpeds-associates-of-sarasota"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-13","discovered_date":"2026-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7fde7bb4ea764d9d5b3c6a7bb52c5c869db32a56","impact_type":"unknown","incident_date":"2026-01-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e343c6137b62","org_name":"Grayback Forestry, Inc.","org_type":"unknown","ransomware":null,"records_affected":5026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Grayback%20Forestry%2C%20Inc.-2026-03-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d4371ac71c3956e9401c9e46d535138819a36c4f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"43bc8c6f5dca","org_name":"Georgia Vascual Specialists PC","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-13-georgia-vascual-specialists-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"337b790f0db72cec22e2bfeb5c98dc8629765a71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97b350b1112c","org_name":"Bloom Circle, Inc. d/b/a Lena Health","org_type":"professional_services","ransomware":null,"records_affected":3651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-13-bloom-circle-inc-d-b-a-lena-health"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004907"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-12","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7afe5923ea6d8472771cada32f36374a8b927b1c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8308bc303834","org_name":"El Centro de Corazón","org_type":"healthcare","ransomware":null,"records_affected":1165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004901"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"20a2daf009102affdc27970b196f8a0e90d81b36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ab771f75447","org_name":"East Carolina Anesthesia Associates","org_type":"healthcare","ransomware":null,"records_affected":19408,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-12-east-carolina-anesthesia-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-12","discovered_date":"2025-05-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6a154d2f96e35a1fadbef2bf93390a3390dc3a4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9282df16cb61","org_name":"Business or Organization Name*\tCierant Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":390472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004899"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-11","discovered_date":"2026-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"dc6476e390b51bb68542c42705ccce69866ee5f3","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2026-03-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'Handala' not in source; cleared","org_country":"US","org_id":"b0905f623c23","org_name":"Stryker Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526102460/d76279d8k.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526104431/d101097d8k.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526118634/d94012d8k.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526149607/d112875d8ka.htm"},{"fetched_at":null,"title":"Leak-site claim by handala","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3RyeWtlciBDb3Jwb3JhdGlvbkBoYW5kYWxh"}],"summary":"Stryker identified a cybersecurity incident affecting certain information technology systems and disrupting access to its Microsoft environment; the company said the incident was contained and reported no indication of ransomware or malware.","supporting_quote":null,"technology_involved":["Microsoft environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["handala"],"price":{"ticker":"SYK","base_day":"2026-03-11","returns":{"1":{"day":"2026-03-12","raw":-0.0248,"adj":-0.0096},"5":{"day":"2026-03-18","raw":0.0001,"adj":0.0221},"21":{"day":"2026-04-10","raw":-0.0192,"adj":-0.0238},"63":{"day":"2026-06-10","raw":-0.1068,"adj":-0.1794},"126":{"day":"2026-09-10","raw":-0.2191,"adj":-0.3396}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d57b7496e38b052670a35affb0dd8b5d4c3949","impact_type":"unknown","incident_date":"2025-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OSI%20Systems%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fd057a48c089","org_name":"OSI Systems, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619986"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OSI%20Systems%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004902"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37027.pdf"}],"summary":"OSI Systems reported that certain files on its network may have been accessed without authorization and contained individuals’ names and other unspecified information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-10","discovered_date":"2025-11-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7feb43271b915a62871420da503c5e58fab60ba4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/illumifin_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"170c6604a8d9","org_name":"illumifin Corporation","org_type":"professional_services","ransomware":null,"records_affected":5385,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-10-illumifin-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621109"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/illumifin_CA%20Sample.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004951"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20illumifin%20Corporation.pdf"}],"summary":"An unauthorized person accessed illumifin Corporation's network and acquired copies of certain files.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2d164525a598d8eed28e154b71d8fedd5ccf06d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"00e287e7e9be","org_name":"Delta Medical Systems","org_type":"professional_services","ransomware":null,"records_affected":1574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-10-delta-medical-systems"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-09","discovered_date":"2025-10-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f9c24db38cf3d045174201eecac41ff412d84061","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f2cea0e554c","org_name":"Wilbarger General Hospital","org_type":"healthcare","ransomware":null,"records_affected":738,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004889"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-09","discovered_date":"2025-11-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e48b70c3f6b36d1113cf6db5410c628abfc50fa7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22b97b596f6f","org_name":"Washington Prime Group Holdings L.P.","org_type":"other","ransomware":null,"records_affected":7497,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004886"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-09","discovered_date":"2025-09-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9019dad2e000018779f310ce1bf3f9c3554319b6","impact_type":"unknown","incident_date":"2025-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ea89ecb9aef","org_name":"Rogue Valley Door","org_type":"unknown","ransomware":null,"records_affected":472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rogue%20Valley%20Door-2026-03-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-09","discovered_date":"2026-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd972d4353f98b6e648c35fdf240c763d738cc91","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Resident%20Notfication_3548_FNL%20-%202.pdf"},"notes":null,"org_country":"US","org_id":"188bacab9582","org_name":"Metropolitan Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619822"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Resident%20Notfication_3548_FNL%20-%202.pdf"}],"summary":"A MetLife associate inadvertently emailed a file containing personal data to a human resource administrator at another MetLife group customer, who confirmed deletion.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"348130de1c058595b29a35a3a7238739dec63727","impact_type":"unknown","incident_date":"2026-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Melvin%20Mora%20Inc%20breach%20letter%20final.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"41afe42c939b","org_name":"melvin mora inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619884"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-09","discovered_date":"2025-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac4ac0894a8df12f9257ddbf4bc4e5daab6a9254","impact_type":"data_theft","incident_date":"2025-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28CA%29%20Ericsson%20Regulatory%20Notice%20Letter%2814260474.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"849f31184d0c","org_name":"Ericsson","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28CA%29%20Ericsson%20Regulatory%20Notice%20Letter%2814260474.1%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004894"}],"summary":"Ericsson’s service provider reported that files containing some personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c1cf06cfc739f29b87deb73ea1e561148f192f9f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c794f8b060d","org_name":"Community Health Action of Staten Island","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-09-community-health-action-of-staten-island"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-09","discovered_date":"2025-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65ee83399a8d233c99346e174ed5c07c8b7e265a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACSC_CA%20App%20%26%20Sample_1_0.pdf"},"notes":null,"org_country":"US","org_id":"32c07cec1973","org_name":"Automobile Club of Southern California","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623158"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACSC_CA%20App%20%26%20Sample_1_0.pdf"}],"summary":"Unauthorized access to records in Driving School Solutions’ systems potentially involved information belonging to Automobile Club of Southern California members.","supporting_quote":null,"technology_involved":["Driving School Solutions management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"DanubeNet, Inc. aka Driving School Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"765d6a238fcd","name":"DanubeNet, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7a64fc4e2ffc3069441a2ec5c28617051cdc65fc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"674dfc964a1e","org_name":"Tampa Bay Dental Implants & Periodontics","org_type":"healthcare","ransomware":null,"records_affected":6400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-08-tampa-bay-dental-implants-periodontics"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-06","discovered_date":"2025-06-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"22b90f12f038fd886c15a373c174c98a0edce225","impact_type":"unknown","incident_date":"2025-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"464086820045","org_name":"Tyree Oil Inc","org_type":"unknown","ransomware":null,"records_affected":4821,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tyree%20Oil%20Inc-2026-03-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"02728960a2e3aefb08396d55737a24dac5e8ed4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8295074b65e9","org_name":"Saint Anthony Hospital","org_type":"healthcare","ransomware":null,"records_affected":146108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-saint-anthony-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-06","discovered_date":"2025-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffd0f45778ef00af315858d3da3d9b9986e0a8d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"30c05b3ad89a","org_name":"Reisz Siderman Eisenberg, APC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619795"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice%20Letter%20Sample.pdf"}],"summary":"Reisz Siderman Eisenberg, APC reported unauthorized access to a portion of its network, and a review found files that may have contained individuals' information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"216c898050d233fbefc7cb9f55cd1416ac800def","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5bd1e0a0f0fb","org_name":"North Texas Behavioral Health Authority","org_type":"healthcare","ransomware":null,"records_affected":285086,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-north-texas-behavioral-health-authority"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004888"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-03-06","discovered_date":"2026-03-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"729463a3cb9167fbf9bb035b85b7079787f002c3","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a5c46149a9e","org_name":"Nobel Services & Taxes LLC","org_type":"financial","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004881"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-06","discovered_date":"2026-02-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0274c5e082e2f7b616584e9a0050784f32098f9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2da595c7373f","org_name":"L&S Mechanical","org_type":"other","ransomware":null,"records_affected":7030,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004883"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-03-06","discovered_date":"2026-03-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7931aa7ad6a6deaa3375987c19692511cae4894","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a42ac134e970","org_name":"kilmers contracting","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004884"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"270eac4e892ef5e1df210a4e58d16a1439101089","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"167b7be61fea","org_name":"Exclusive Physicians PLLC","org_type":"healthcare","ransomware":null,"records_affected":58000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-exclusive-physicians-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"237d2a1d9b0c0dcb3d3897459a5fbc30c62b6b1d","impact_type":"unknown","incident_date":"2026-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ce820a4e6dd","org_name":"EP Wealth Advisors, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619759"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004928"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#EP%20Wealth%20Advisors%2C%20LLC-2026-03-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2ca5fc36e5aa93dc3880cfff195ce571a0486ef8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1bc09074881b","org_name":"County of Murray dba Murray County Medical Center","org_type":"healthcare","ransomware":null,"records_affected":5073,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-county-of-murray-dba-murray-county-medical-center"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004891"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bf68fdb2de69beb208cd7946c59f1e83a9ebdd38","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e9520ed9186","org_name":"Cedar Valley Hospice","org_type":"healthcare","ransomware":null,"records_affected":10666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-cedar-valley-hospice"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4e2d432d492468040e16a4260fba230d07f567b7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"59ca68fb77bf","org_name":"Barrio Comprehensive Family Health Care Center","org_type":"healthcare","ransomware":null,"records_affected":19971,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-06-barrio-comprehensive-family-health-care-center"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004890"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0373151869cd032eebb83829fcfa347467912981","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter%20A%20-%20Adult%20SSN_R2%2837636183.1%29_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d198181fa84","org_name":"Tieu Dental Corporation","org_type":"healthcare","ransomware":null,"records_affected":8918,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-05-tieu-dental-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619669"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2026-03-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35338dc59888c15c7a5c9b5223e97590809939ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Service_Lighting_-_Notification_%28Redacted%29_37638884v1.pdf"},"notes":null,"org_country":"US","org_id":"c2b1ab550e05","org_name":"Service Lighting, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619710"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Service_Lighting_-_Notification_%28Redacted%29_37638884v1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004882"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Service%20Lighting%2C%20Inc.-2026-03-05"}],"summary":"Service Lighting, Inc. reported that malicious code on its e-commerce website may have captured payment card information entered between March 12 and September 16, 2025.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-05","discovered_date":"2025-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb349473b150fdfefc03547eaedcdfc4a981b7a8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Adult%20-%20NMH.pdf"},"notes":null,"org_country":"US","org_id":"c8e1f68c9a96","org_name":"Northwest Medical Homes, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619695"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Adult%20-%20NMH.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Medical%20Homes%2C%20LLC-2026-03-05"}],"summary":"Northwest Medical Homes detected unauthorized access to its computer network, and personal or health information could have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-05","discovered_date":"2025-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b7ee5a47b14d720b60bafb628fbf3897109a4de","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36936.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9a7d37f77cc5","org_name":"Insightin Health, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":11740,"reviewed":false,"root_cause":"A design flaw in GoAnywhere’s software allowed an unauthorized party to access the file-transfer tool.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36936.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36936.pdf"}],"summary":"Insightin Health reported that an unauthorized party accessed its GoAnywhere file-transfer tool through a software design flaw, potentially exposing files containing personal information.","supporting_quote":"Upon investigation, it was found that an unauthorized party gained access to GoAnywhere’s file-transfer tool using an unknown design flaw in GoAnywhere’s software.","technology_involved":["GoAnywhere"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-05","discovered_date":"2025-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"461959be9693157533868f548a1a8ce53b31aec6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Insightin%20Health%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9a7d37f77cc5","org_name":"Insightin Health, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized party gained access to GoAnywhere’s file-transfer tool using an unknown design flaw in GoAnywhere’s software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619662"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621162"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Insightin%20Health%2C%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004895"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Insightin%20Health%2C%20Inc.-2026-03-05"}],"summary":"An unauthorized party used a design flaw in GoAnywhere’s file-transfer tool to potentially access Insightin Health files containing personal information.","supporting_quote":"Upon investigation, it was found that an unauthorized party gained access to GoAnywhere’s file-transfer tool using an unknown design flaw in GoAnywhere’s software.","technology_involved":["GoAnywhere file-transfer tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"GoAnywhere"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-04","discovered_date":"2025-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cad2eb406453c548ed58166778d9f569d6669309","impact_type":"data_theft","incident_date":"2025-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CM_Rev1.pdf"},"notes":null,"org_country":"US","org_id":"d93e119b1214","org_name":"Williams Accountancy Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CM_Rev1.pdf"}],"summary":"Williams Accountancy Corporation reported that an unauthorized third party accessed systems and acquired files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-03-03","discovered_date":"2025-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ddc6863f5a8bc0ba9765c4939f77c0e2cacf1805","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ff88d34d334","org_name":"Sonora Independent School District","org_type":"education","ransomware":null,"records_affected":871,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004875"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fad10d786f9c90b35ce6dc915830652484a9906f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ff156e1e9123","org_name":"Provecho","org_type":"technology_saas","ransomware":null,"records_affected":712904,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Provecho","type":"hibp","url":"https://haveibeenpwned.com/Breach/Provecho"}],"summary":"Data purportedly sourced from Provecho was alleged to include email addresses and usernames.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-03-03","discovered_date":"2026-01-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"079258bb8858bf9b1014ed2f9e3936082034d675","impact_type":"unknown","incident_date":"2025-04-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"568f5e46c4ec","org_name":"Clement Manor","org_type":"unknown","ransomware":null,"records_affected":16046,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clement%20Manor-2026-03-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8011bff00f9d847f698b5be257551f66c3110bd4","impact_type":"both","incident_date":"2025-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCSF%20-%20Notification%20Letter.doc_final_Live_Proof_R1%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"2bae1a4a04e6","org_name":"Children’s Council of San Francisco","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619614"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCSF%20-%20Notification%20Letter.doc_final_Live_Proof_R1%20%282%29.pdf"}],"summary":"Children’s Council of San Francisco reported unauthorized access to and acquisition of data that included names and Social Security numbers, following a network disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-03","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"848c673e046899add3e95b0def76ca15d066f16e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%5BAG%20Sample%5D.pdf"},"notes":null,"org_country":"US","org_id":"8c45a38acae3","org_name":"California FAIR Plan Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619592"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%5BAG%20Sample%5D.pdf"}],"summary":"The California FAIR Plan Association reported that broker personal information, including names, addresses, and Social Security numbers, was inadvertently disclosed to an unknown third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-03-03","discovered_date":"2026-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8edb35344fade005c6216e72a9a789955089699e","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36893.pdf"},"notes":null,"org_country":"US","org_id":"a3355e9d74c1","org_name":"Brown Advisory LLC","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36893.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36893.pdf"}],"summary":"Brown Advisory reported that an unauthorized threat actor accessed personal data through a limited number of applications.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-02","discovered_date":"2025-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44dbd5f44c92d199c2377f547decbb40c3b50d3d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20-%20March%202_0.pdf"},"notes":null,"org_country":"US","org_id":"abf977b84077","org_name":"Valley Radiology Consultants Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619521"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20-%20March%202_0.pdf"}],"summary":"Valley Radiology Consultants Medical Group found that an unauthorized actor accessed files, including patient files, on its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12c00af82c02e26b933161e9c062f7f206596d1e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"714a80f1a51b","org_name":"Quitbro","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Quitbro","type":"hibp","url":"https://haveibeenpwned.com/Breach/Quitbro"}],"summary":"Quitbro's breach exposed email addresses, years of birth, app responses, and users’ last recorded relapse times.","supporting_quote":null,"technology_involved":["Quitbro app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4582379471bcd79b1b349f516dca8324a69570f4","impact_type":"data_theft","imported_from":null,"incident_date":"2026-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6e53025cd40e","org_name":"Lovora","org_type":"technology_saas","ransomware":null,"records_affected":495556,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lovora","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lovora"}],"summary":"Lovora allegedly suffered a breach that exposed users’ email addresses, display names, profile photos, and other personal information.","supporting_quote":null,"technology_involved":["Lovora app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4685240b586e6397d32f1ac801a3bb71874ed7df","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7445412dea39","org_name":"KomikoAI","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KomikoAI","type":"hibp","url":"https://haveibeenpwned.com/Breach/KomikoAI"}],"summary":"A breach exposed email addresses, names, user posts, and AI prompts associated with KomikoAI accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d4e6ce1eab18c4c87300e96ce6ab891ad4e9c38b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5deb16ddf16","org_name":"Kin Counseling Services PLLC","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-02-kin-counseling-services-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1e6786d86ae5bda8bf547dea7ad2cd74c51b5fc5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3068c0272302","org_name":"Houston Dermatology Specialists","org_type":"professional_services","ransomware":null,"records_affected":648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-03-02-houston-dermatology-specialists"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"FulcrumSec","variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["medical","personal","secrets"],"disclosed_date":"2026-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f827c5fc20f241de30ef4412e75edbd84511f90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE704346-BF9A-4435-927B-16A7ECF24C43"},"incident_date":"2026-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"38f9d561d2b7","org_name":"Novo Nordisk","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/ozempic-maker-novo-nordisk-says-hackers-breached-it-systems/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.novonordisk.com/news-and-media/latest-news/incident-update.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/pharmaceutical-giant-novo-nordisk-discloses-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/security/2026/06/12/novo-nordisk_says_hackers_stole_clinical_trial_data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.techrepublic.com/article/news-novo-nordisk-1-3tb-theft-25m-demand-emea/;"}],"summary":"Danish pharmaceutical giant Novo Nordisk (maker of Ozempic and Wegovy) disclosed that attackers gained unauthorized access to internal IT systems and copied non-public data, including pseudonymized clinical-trial patient data (patient IDs, trial participation, sex, birth year, bi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"fulcrumsec"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f85c47e2c5e75bcf397aed096114965a89b87ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94733B5A-B002-43E7-885B-5C2913582D22"},"incident_date":"2026-03-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23e82193c913","org_name":"Networking Technology Inc (RXNT)","org_type":"technology_saas","ransomware":null,"records_affected":5671,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/clinical-registry-solutions-jason-r-egbert-od-pc-vnc-health-data-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2026/05/rxnt-healthcare-software-breach-exposes-patient-data-across-multiple-provider-clients/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/rxnt-data-breach/"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41120.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41108.pdf"}],"summary":"Networking Technology Inc, doing business as RXNT — a cloud-based electronic prescribing, practice-management, and EHR SaaS vendor — suffered a hacking breach in which an external actor gained unauthorized access to its systems between March 1 and March 3, 2026 and obtained a cop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"eef54610347508af13d164ea2be2eaaf66281796","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"18d001a89f4e","org_name":"Access Information Management Shared Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":1522,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-28-access-information-management-shared-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-27","discovered_date":"2024-12-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"454890e5d81e65ac177d6d62d4f3d7a7717b0139","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%20CA%2814234556.3%29%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"0feee93ab4df","org_name":"PIH Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%20CA%2814234556.3%29%20%281%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004873"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23172.pdf"}],"summary":"PIH Health reported that an unauthorized actor accessed information in its digital environment during a December 2024 incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd6aae0dd931abf18ca383f708bcdd93209d2a05","impact_type":"data_theft","incident_date":"2026-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DOB%20%26%20SSN%20Consumer%20Notification%20Drafts%20.pdf"},"notes":null,"org_country":"US","org_id":"9a5ad2916b82","org_name":"New American Funding, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619492"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DOB%20%26%20SSN%20Consumer%20Notification%20Drafts%20.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004872"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20American%20Funding-2026-03-01"}],"summary":"New American Funding reported unauthorized activity and said personal information was obtained through queries on company databases storing loan and loan inquiry data.","supporting_quote":null,"technology_involved":["company databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-27","discovered_date":"2025-05-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b755357f6834d6dba5778a7b212227a4cc67a9ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-26254%20Nephrology%20Ad%20CM%20SSN%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"d2e59a35b3c7","org_name":"Nephrology Associates Medical Group, Inc","org_type":"healthcare","ransomware":null,"records_affected":4631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-27-nephrology-associates-medical-group-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-26254%20Nephrology%20Ad%20CM%20SSN%20r2prf.pdf"}],"summary":"Nephrology Associates Medical Group discovered suspicious activity in its email system, and an unauthorized individual may have accessed personal information in an employee’s account.","supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1750c6393bddb3cf680a80c87ef0b0ea31971033","impact_type":"data_theft","incident_date":"2025-08-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Maritz%20Individual%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"5ebfabb3f84f","org_name":"Maritz Holdings Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown vulnerability in Oracle E-Business Suite was exploited before it was publicly disclosed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619475"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Maritz%20Individual%20Notice%20Letter%20Template.pdf"}],"summary":"Maritz Holdings Inc. reported that an attacker exploited an unknown Oracle E-Business Suite vulnerability and obtained files containing personal information.","supporting_quote":"The investigation confirmed that an unauthorized third-party gained access to, and obtained files from Maritz’s Oracle EBS environment between August 10, 2025, and August 13, 2025, before the software vulnerab ility had been publicly disclosed.","technology_involved":["Oracle E-Business Suite (EBS)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-02-27","discovered_date":"2025-11-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce528e28e85e270da757a447ba6a11b3e95c2570","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/M%26Y%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"e5ee17ebff79","org_name":"M&Y Personal Injury Lawyers","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/M%26Y%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"M&Y Personal Injury Lawyers reported that an unknown actor viewed and downloaded files from a server used for historical record keeping, which may have contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"incransom","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-27","discovered_date":"2026-02-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"735f7afb041d447268aa5de59ddb6b7d8b6de27d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d621bf0541b8","org_name":"Lymphedema Therapy Specialists, Inc.","org_type":"other","ransomware":true,"records_affected":379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004870"},{"date":"2026-02-27","fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/THltcGhlZGVtYSBUaGVyYXB5IFNwZWNpYWxpc3RzQGluY3JhbnNvbQ"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"incransom","claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ba732c0780d6d7b9c9841fdd3a32dbf695e00f03","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36848.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe684201d2bd","org_name":"Lakeside Pediatrics & Adolescent Medicine, PLLC","org_type":"healthcare","ransomware":null,"records_affected":34154,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-27-lakeside-pediatrics-adolescent-medicine-pllc"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36848.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"aa291136bf86e387b714368ed0f7155a60661286","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3c7e986bae8","org_name":"IPPC Inc., IPPC of New York LLC, and Innovative Pharmacy LLC (collectively “IPPC”)","org_type":"healthcare","ransomware":null,"records_affected":133862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-27-ippc-inc-ippc-of-new-york-llc-and-innovative-pharmacy-llc-collectively-ippc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-27","discovered_date":"2026-01-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"822a84843db6d7f4f2750066d7cee29981b8a490","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eca91353afe1","org_name":"Home Care Patient Services; Bridgeway Health Services; Kamcare Home Health Services LLC; Agape Home Care Services LLC","org_type":"healthcare","ransomware":null,"records_affected":3600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004868"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-27","discovered_date":"2026-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fabd9be92a3e2a36c6e0b5e031b0a8c8b1c0396d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ef8f58bfbde","org_name":"Flash Charm, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2015,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004869"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3c587e1fed8c65131be339df3ccd3683fcb161f","impact_type":"data_theft","incident_date":"2026-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36850.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dcd19eb49a85","org_name":"Figure Lending, LLC","org_type":"financial","ransomware":null,"records_affected":699,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36850.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36850.pdf"}],"summary":"Figure Lending reported that personal information was obtained through queries on company databases on January 28, 2026.","supporting_quote":null,"technology_involved":["company databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-27","discovered_date":"2025-09-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"028d5753d53a0e4c0d8a26679fa12418d1934599","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e86117d86c93","org_name":"Data Systems Analysts, Inc.","org_type":"other","ransomware":null,"records_affected":3239,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004866"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"qilin","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8dd74e84b8e245f2c484e9fbf8a08cca056f5eaf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85039e51778a","org_name":"Orthopaedic Specialists of Massachusetts, PC","org_type":"healthcare","ransomware":true,"records_affected":20659,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-26-orthopaedic-specialists-of-massachusetts-pc"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/T3J0aG9wYWVkaWMgU3BlY2lhbGlzdHMgb2YgTWFzc2FjaHVzZXR0c0BxaWxpbg"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"qilin","claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b44fd0173eabfb39ab6c013b4248bd439b178c7e","impact_type":"both","imported_from":null,"incident_date":"2026-02-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"NL","org_id":"88b7cac3d5c5","org_name":"Odido","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Odido","type":"hibp","url":"https://haveibeenpwned.com/Breach/Odido"}],"summary":"Odido suffered a data breach followed by an extortion attempt, and exposed customer information was published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d3d79382b6f50c43fd4fd16789f83588b4a3b27d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a1001fd3f85","org_name":"Manhattan Retirement Foundation d/b/a Meadowlark Hills","org_type":"healthcare","ransomware":null,"records_affected":14442,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-26-manhattan-retirement-foundation-d-b-a-meadowlark-hills"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e944ff4ca4755bd9b8caafca39fc94c85aa1d010","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MSG%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0ec0b67d8fa9","org_name":"Madison Square Garden Entertainment Corp.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously undisclosed condition in the hosted Oracle eBusiness Suite application was exploited to access application data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619390"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MSG%20-%20California%20Notification.pdf"}],"summary":"Madison Square Garden Entertainment Corp. reported that an unauthorized person accessed data in its vendor-hosted Oracle eBusiness Suite application after exploiting a previously undisclosed condition.","supporting_quote":"Oracle notified its customers that a previously undisclosed condition in the application had been exploited by an unauthorized person to gain access to data from the application.","technology_involved":["Oracle eBusiness Suite"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"coinbasecartel","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-26","discovered_date":"2025-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"978252fb6f5a62d59fddde63d1fbe1829f05a023","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Idera_Individual%20Notification%20Letter%20Template%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"4e6d1ca57005","org_name":"Idera","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619397"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Idera_Individual%20Notification%20Letter%20Template%20%28US%29.pdf"},{"date":"2026-04-08","fetched_at":null,"title":"Leak-site claim by coinbasecartel","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SWRlcmEgLUBjb2luYmFzZWNhcnRlbA"}],"summary":"An unauthorized party accessed a third-party file-hosting system containing information related to Idera’s affected individuals.","supporting_quote":null,"technology_involved":["third-party file-hosting system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"coinbasecartel","claim_groups":["coinbasecartel"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70391b5d0caedf03385d69cb1eada1141378efb0","impact_type":"unknown","incident_date":"2026-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dde64a4d5abb","org_name":"DC Professional Tax Service","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619348"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-26","discovered_date":"2026-01-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"071a4189c6bb77483ff5bd4e03c8618ff7bf0d2a","impact_type":"data_theft","incident_date":"2025-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36826.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7f0ee5ddc8f7","org_name":"Bolt Solutions Inc.","org_type":"professional_services","ransomware":null,"records_affected":140249,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36826.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36826.pdf"}],"summary":"Bolt Solutions Inc. reported that an unauthorized party accessed parts of its network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"39667f096dedc93bd0da9db86918624892f6bd06","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55e2f2104d02","org_name":"BMG of Kansas, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1327,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-26-bmg-of-kansas-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"309a2725ae46b2633dcc04fce6f8bb1fcad9e721","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SampleNotice_1.pdf"},"notes":null,"org_country":"US","org_id":"6e4ad28bac69","org_name":"AltaMed Health Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-26-altamed-health-services-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618676"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SampleNotice_1.pdf"}],"summary":"AltaMed reported a cybersecurity incident that limited access to certain computer systems, and an unauthorized individual may have accessed personal employment information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"16f7d3e60e8066092b23261c6c6da77d736189ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36808.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bac7650fc37","org_name":"Pyramid Global Hospitality (Pyramid Advisors Limited Partnership)","org_type":"unknown","ransomware":null,"records_affected":3434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36808.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e0d52bb1c45d66b0f5ca04fa37a3791677726ec4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter-%20Pyramid%20Global%20Hospitality.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee8f0f915201","org_name":"Pyramid Global Hospitality","org_type":"unknown","ransomware":null,"records_affected":2855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter-%20Pyramid%20Global%20Hospitality.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b96f232f17ef439d945d9129db989c051c35cde6","impact_type":"unknown","incident_date":"2025-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pyramid%20Notice%20Letter%2012%20months.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f740b5b3c6a4","org_name":"Pyramid Advisors Limited Partnership d/b/a Pyramid Global Hospitality","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619291"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004865"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pyramid%20Advisors%20Limited%20Partnership%20d/b/a%20Pyramid%20Global%20Hospitality-2026-02-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36aa82f2c91685d916a5a8f5ff1a78a3e7c301b5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36806.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e56a210ca159","org_name":"CommonSpirit Health (Pinnacle Holdings, LTD)","org_type":"unknown","ransomware":null,"records_affected":19027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36806.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-25","discovered_date":"2026-02-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d95e6701aedf205f99e0ea08a7a44bc668174250","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d62fc038e01a","org_name":"Clarksville Independent School District","org_type":"education","ransomware":null,"records_affected":3027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004859"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-25","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee8c1c9f6e9daa1a34bb68b89da1a4c614cbc11f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ead63ce8135","org_name":"City of Houston Health Department","org_type":"government","ransomware":null,"records_affected":7745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004861"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2026-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d205ca0491876c7935dabe4d8713ee4c7497e2d","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3fad72e258c2","org_name":"Canadian Tire","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Canadian Tire","type":"hibp","url":"https://haveibeenpwned.com/Breach/CanadianTire"}],"summary":"Canadian Tire reported a breach involving records that included contact details, hashed passwords, and, for some records, dates of birth and partial credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2026-02-24","discovered_date":"2026-02-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"04129f24ac8ad5ca945181b8f8d0898ec2443b72","impact_type":"both","incident_date":"2026-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"af4e7ac35214","org_name":"UFP Technologies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/914156/000162828026011152/ufpt-20260219.htm"}],"summary":"UFP Technologies detected unauthorized activity affecting IT systems, with files exfiltrated and some business functions disrupted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"UFPT","base_day":"2026-02-24","returns":{"1":{"day":"2026-02-25","raw":-0.0017,"adj":-0.0101},"5":{"day":"2026-03-03","raw":-0.1565,"adj":-0.1463},"21":{"day":"2026-03-25","raw":-0.2099,"adj":-0.1655},"63":{"day":"2026-05-26","raw":-0.0478,"adj":-0.1399},"126":{"day":"2026-08-25","raw":0.2645,"adj":0.1502}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-24","discovered_date":"2025-06-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7416543d71296425adb0df90cea126c7d222f249","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68824e644488","org_name":"The Texas Access to Justice Foundation","org_type":"nonprofit","ransomware":null,"records_affected":2647,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004851"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-02-24","discovered_date":"2025-11-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"65fde8277a6d909b3958148911bb14c9a31afb2c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Mercadien%20PC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6ae4e16be3b8","org_name":"Mercadien PC Certified Public Accountants","org_type":"professional_services","ransomware":null,"records_affected":402741,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004857"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Mercadien%20PC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Mercadien%20PC.pdf"}],"summary":"Mercadien PC Certified Public Accountants notified affected people about a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-24","discovered_date":"2025-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cb5259cc394ab77a0481b70d022f95db90a3087","impact_type":"data_theft","incident_date":"2025-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hennessy%20Advisors%20-%20Consumer%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"76b16ba98740","org_name":"Hennessy Advisors, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619204"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hennessy%20Advisors%20-%20Consumer%20Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004860"}],"summary":"Hennessy Advisors reported that personal information was accessed and released without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f4f50f2cd3567f205d255a5c2d15f07d5da978d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Couve%20Healthcare%20Consulting%20LLC%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9a3f3d680a9","org_name":"Couve Healthcare Consulting, LLC DBA Evergreen Healthcare Group","org_type":"professional_services","ransomware":null,"records_affected":11795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-24-couve-healthcare-consulting-llc-dba-evergreen-healthcare-group"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619214"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-24","discovered_date":"2026-01-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fe865a00b70a011f44c7cf5cf81b426a99004906","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1bb62a22adc","org_name":"City of Carthage, Texas","org_type":"government","ransomware":null,"records_affected":8517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004858"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-24","discovered_date":"2001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d34acb7616681121dd4c6a0ee15612cf7a9a00eb","impact_type":"unknown","incident_date":"2001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"44c9a0ab90c4","org_name":"Adapt Oregon Health Care","org_type":"unknown","ransomware":null,"records_affected":2908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Adapt%20Oregon%20Health%20Care-2026-02-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7fba05aad2143f6d67bb2aead964fc8fb537637","impact_type":"unknown","incident_date":"2025-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36797.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a1051e5ec8d9","org_name":"360training.com, Inc.","org_type":"professional_services","ransomware":null,"records_affected":642,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36797.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36797.pdf"}],"summary":"360training.com, Inc. filed a consumer notification concerning a security incident affecting 642 records; the provided text does not describe how access occurred or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ef4db61c6c8acdd15c2e32aac8a33692c30e134","impact_type":"unknown","imported_from":null,"incident_date":"2025-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_MEC%20II%20_Individual%20Notice%20Draft_TU_Final_Live_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"a1051e5ec8d9","org_name":"360training.com","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619235"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_MEC%20II%20_Individual%20Notice%20Draft_TU_Final_Live_Proof_R1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004862"}],"summary":"360training.com filed a consumer notification concerning a security incident; the available text does not describe how it occurred or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e654185538589dd7fb71413193ade0771f6ef5a","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L03_Figure%20Invididual%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"624e6050d164","org_name":"Figure Technology Solutions","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619176"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L03_Figure%20Invididual%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004856"},{"date":"2026-02-24","fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RmlndXJlIFRlY2hub2xvZ3kgU29sdXRpb25zLCBJbmMuQHNoaW55aHVudGVycw"}],"summary":"Figure Technology Solutions reported that personal and financial information was obtained through queries on company databases storing loan and loan inquiry data.","supporting_quote":null,"technology_involved":["company databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-22","discovered_date":"2025-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"01b8dfbb8d0dcc105fe327d78e7f9827991cd0fc","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/QualDerm%20Partners%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4184d5555ea3","org_name":"QualDerm Partners, LLC","org_type":"healthcare","ransomware":null,"records_affected":2951318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-22-qualderm-partners-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619170"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/QualDerm%20Partners%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004855"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#QualDerm%20Partners%2C%20LLC-2026-02-23"}],"summary":"QualDerm Partners detected unauthorized activity on certain systems, and an investigation determined that an unauthorized actor accessed systems and removed information that included patients’ names.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4ffe1e8d8887f923b135a6c19f9390b54711e48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0418FC68-9D79-4D42-8E9E-4CEB9ECBCBEA"},"incident_date":"2026-02-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"851eaf5ca649","org_name":"Lifepoint Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.claimdepot.com/data-breach/lifepoint-health-2026;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/data-breach-lifepoint-health-southwest-behavioral-nottingham-village/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreachclassaction.io/cases/lifepoint-health-data-breach-class-action-investigation;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bhnet.org/64040/lifepoint-health-southwest-behavioral-nottingham-village-report-data-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://straussborrelli.com/data-breach-blog/"}],"summary":"Lifepoint Health, Inc. disclosed that on Feb 22, 2026 an unauthorized third party used a compromised (stolen) user account to gain access to its internal environment and certain internal databases. The activity was detected the next day and contained within 24 hours. The exposed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b07f2d55d6c8d9e0c72544c7f7c748cf54691b4","impact_type":"both","imported_from":null,"incident_date":"2026-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f8ac1c8743be","org_name":"CarGurus","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CarGurus","type":"hibp","url":"https://haveibeenpwned.com/Breach/CarGurus"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FyR3VydXMsIEluYy5Ac2hpbnlodW50ZXJz"}],"summary":"CarGurus data, including personal and auto finance information, was published publicly following an attempted extortion attributed to ShinyHunters.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-02-20","discovered_date":"2025-11-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"721416992b0b200ed4837b3136df314df6120ea3","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9b713bf54d85","org_name":"WoodRock & Co.","org_type":"financial","ransomware":null,"records_affected":722,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004841"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c11d8e7867d5842ff65bf4a86ac2fe4edcd1b61","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36741.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0cf3f5e8dfb2","org_name":"Wellcare of Washington, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2485,"reviewed":false,"root_cause":"A new, unknown problem in the vendor’s software was used to gain access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36741.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36741.pdf"}],"summary":"An unauthorized person used a new, unknown problem in a vendor’s software to access Wellcare of Washington files that may have contained personal information.","supporting_quote":"An unauthorized person got into our network by using a new, unknown problem in our vendor’s software.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6331a49dea2a39752c2ccfc881607ae74292b519","impact_type":"data_theft","incident_date":"2025-09-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36743.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2f9c803a25c9","org_name":"Wellcare Health Insurance Company of Washington, Inc.","org_type":"healthcare","ransomware":null,"records_affected":843,"reviewed":false,"root_cause":"The attacker exploited a new, unknown problem in the vendor’s software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36743.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36743.pdf"}],"summary":"An unauthorized person exploited a new, unknown problem in vendor software and may have accessed or copied files containing personal information.","supporting_quote":"An unauthorized person got into our network by using a new, unknown problem in our vendor’s software.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a3d0ff7ffe64c6807db186b16d94236f6c64c6e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36745.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co.","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36745.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":"2026-02-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7f922eb3913761a5a4f841beac3d718a966b938","impact_type":"data_theft","incident_date":"2025-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T01A_General%20US%20Individual%20Data%20Breach%20Notification%20Template-r4.pdf"},"notes":null,"org_country":"US","org_id":"8ffb9975b23d","org_name":"Too Lost LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619060"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T01A_General%20US%20Individual%20Data%20Breach%20Notification%20Template-r4.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004905"}],"summary":"Too Lost identified unauthorized access to and transfer of data involving a web application, potentially affecting customers’ personal information.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cc577839bca0975b2347b706aa69f1945f31c77d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f3f38eaab70","org_name":"The Center for Advanced Eye Care","org_type":"healthcare","ransomware":null,"records_affected":9300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-20-the-center-for-advanced-eye-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bb653272a247d76bd06e10b9d62e772bc3ce60d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f691964a997","org_name":"Perseus House, Inc.","org_type":"healthcare","ransomware":null,"records_affected":969,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-20-perseus-house-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-20","discovered_date":"2026-02-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0c989d2d723a051cecec86e397d481c4516454ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Option%20Care%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"80fb23b673f4","org_name":"Option Care Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2086,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-20-option-care-health-inc"},{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-04-06-option-care-health-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621411"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Option%20Care%20Notification%20Letter.pdf"}],"summary":"An unauthorized party accessed an Option Care Health employee’s email account, where protected health information may have been present.","supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f32cb96adc22dd7b171ab5db11823f1b05df50f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36740.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fe6403ec0699","org_name":"Coordinated Care of Washington, Inc.","org_type":"healthcare","ransomware":null,"records_affected":29,"reviewed":false,"root_cause":"The intrusion used a new, unknown problem in the vendor’s software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36740.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36740.pdf"}],"summary":"Coordinated Care of Washington reported that an unauthorized person used a new, unknown problem in vendor software to access files that may have contained personal information.","supporting_quote":"An unauthorized person got into our network by using a new, unknown problem in our vendor’s software.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3512fd223f498b7f8ed5bbe0096d5bdb4dbbc94f","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36738.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"26a4f7cb717c","org_name":"Condé Nast","org_type":"other","ransomware":null,"records_affected":1392,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36738.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36738.pdf"}],"summary":"Information from a WIRED subscriber list, including names and dates of birth, was posted online without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"799edd32116555e8ae2d8d22c191efbd43c29949","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"c80962ca5bb3","org_name":"CarMax","org_type":"retail_ecommerce","ransomware":true,"records_affected":431371,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CarMax","type":"hibp","url":"https://haveibeenpwned.com/Breach/CarMax"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FyTWF4LCBJbmMuQHNoaW55aHVudGVycw"}],"summary":"Data allegedly sourced from CarMax was published online after a failed extortion attempt, and included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-20","discovered_date":"2025-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76e962cc7d7a5ddaa2bd90ffe10c0a546cb1a195","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb2c75ad5d7e","org_name":"Alert Medical Alarms","org_type":"other","ransomware":null,"records_affected":39218,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004845"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-19","discovered_date":"2025-08-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e629ea1f2b9cf68e68d3d85db91859f717aefaf","impact_type":"data_theft","incident_date":"2025-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TAK%20Broadband%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0c904a77032c","org_name":"TAK Broadband LLC","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TAK%20Broadband%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004848"}],"summary":"TAK Broadband reported that an unauthorized third party accessed certain systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-19","discovered_date":"2026-01-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bacf66ae49355feb1854f8883f8975a3ea1c7a1a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-14","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Choice%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e4dfc2c27036","org_name":"Choice Hotels International, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Choice%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004849"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Choice%20Hotels%20International%2C%20Inc.-2026-02-19"}],"summary":"A person used social engineering to access an application containing franchisee and applicant records, including names and Social Security numbers.","supporting_quote":"A skilled person used social engineering to gain access on January 14, 2026 to an application that contained records regarding franchisees and franchise applicants.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"79c93c59c93c7763b4dedfb1029b55ce9e0815e7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"382fbf2b7169","org_name":"VNS Behavioral Health Inc. (“VNS Health”)","org_type":"healthcare","ransomware":null,"records_affected":739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-18-vns-behavioral-health-inc-vns-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-18","discovered_date":"2025-10-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d195a19e7199c7b25f1a5cf98fafcb5b33413d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NEMS%20-%20Notice%20Letter%20-%2012182025_Revd.pdf"},"notes":null,"org_country":"US","org_id":"61e9b9d4ff39","org_name":"North East Medical Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618957"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NEMS%20-%20Notice%20Letter%20-%2012182025_Revd.pdf"}],"summary":"North East Medical Services reported that potentially affected personal information was accessed by an unauthorized individual on United Layer’s hosted network.","supporting_quote":null,"technology_involved":["United Layer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"United Layer"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"d687eed4a37a","name":"United Layer"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62daaa28ee56620f050dd41c72bbdc87bfdd3d5f","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-28","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"52a591aa2607","org_name":"Figure","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee was tricked through social engineering into providing access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Figure","type":"hibp","url":"https://haveibeenpwned.com/Breach/Figure"}],"summary":"Figure confirmed that an employee was tricked through social engineering into providing access, and personal data was publicly posted online.","supporting_quote":"Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"25d7f8e30a66c89c941cdcf073da601a3017dde4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"595b7cefd4c1","org_name":"Builders FirstSource Flex Plan","org_type":"healthcare","ransomware":null,"records_affected":1514,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-18-builders-firstsource-flex-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3e1eb2680a2e757653643134b8c9725713eeb85f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e18ffe546279","org_name":"Emanuel Medical Center","org_type":"healthcare","ransomware":null,"records_affected":28963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-17-emanuel-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-17","discovered_date":"2026-01-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"be11fea6d0856b6831197560c92a2650d0be8fea","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae10c03143a3","org_name":"City of Mission","org_type":"government","ransomware":null,"records_affected":12443,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004835"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"coinbasecartel","variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6df6774598d8206ac25598462ee4b2d3f41cf2a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"unknown","org_id":"3e5241604193","org_name":"Canada Goose","org_type":"retail_ecommerce","ransomware":true,"records_affected":920000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Canada Goose","type":"hibp","url":"https://haveibeenpwned.com/Breach/CanadaGoose"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FuYWRhIEdvb3NlQHNoaW55aHVudGVycw"}],"summary":"Data relating to Canada Goose customers was published publicly after a breach at a third party.","supporting_quote":"Canada Goose advised that the data \"appears to relate to past customer transactions\" and stated that it originated from a breach at a third party in August 2025.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"coinbasecartel","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-02-17","discovered_date":"2026-02-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5feb24e691039a320c54d3bd7dd9437244086cab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b978b5077a7","org_name":"Ace Mart Restaurant Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":1537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004839"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36afc5b2ca8dc78fad8db0ff21e40eb12f990edd","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"473aa2db02b4","org_name":"University of Pennsylvania","org_type":"education","ransomware":true,"records_affected":623750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: University of Pennsylvania","type":"hibp","url":"https://haveibeenpwned.com/Breach/UniversityOfPennsylvania"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBQZW5uc3lsdmFuaWFAc2hpbnlodW50ZXJz"}],"summary":"The University of Pennsylvania experienced a breach affecting its donor database, followed by a ransom demand and online publication of data.","supporting_quote":null,"technology_involved":["donor database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0ad6fd8dddae4956b219e6e8d9ba955ad790b89f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc054e6be6fb","org_name":"Easterseals Northeast Indiana","org_type":"healthcare","ransomware":null,"records_affected":3158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-16-easterseals-northeast-indiana"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"739ddfb10736451056bd50338afa51006780d915","impact_type":"data_theft","incident_date":"2025-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BR","org_id":"5bea3b0216b3","org_name":"APOIA.se","org_type":"financial","ransomware":null,"records_affected":450764,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: APOIA.se","type":"hibp","url":"https://haveibeenpwned.com/Breach/APOIAse"}],"summary":"APOIA.se confirmed a data breach that exposed email addresses, names, and physical addresses.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"adb2a90a0ab45194c6bb1bd2bf8841b5efe4ef39","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"970b86d47478","org_name":"44North","org_type":"professional_services","ransomware":null,"records_affected":2158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-16-44north"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"383f77e3408a41f2c49ce196be7f67d5001a72d6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22afbfc035d0","org_name":"Wee Care Pediatrics, LLC","org_type":"healthcare","ransomware":null,"records_affected":2127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-14-wee-care-pediatrics-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ded63e4114aad546d9ecd90e0a2897420fcbeb5c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ea22ce4e917","org_name":"VPS Medical PLLC","org_type":"healthcare","ransomware":null,"records_affected":4600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-13-vps-medical-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-13","discovered_date":"2026-01-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59dbf35cda5487e829d639a9f7f7cb98b5ebf812","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ca82b8c5d455","org_name":"UT Southwestern Medical Center","org_type":"healthcare","ransomware":null,"records_affected":433,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004827"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2026-02-13","discovered_date":"2026-02-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f14dacbe86241d304cb7d6c4e5b4830535004c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%5Bindividuals%5D%20NOTICE%20OF%20DATA%20BREACH.pdf"},"notes":null,"org_country":"US","org_id":"bd1d55ae21d0","org_name":"TENGA USA INC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618775"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%5Bindividuals%5D%20NOTICE%20OF%20DATA%20BREACH.pdf"}],"summary":"An unauthorized party accessed an employee’s professional email account, sent unsolicited emails, and may have viewed or acquired inbox contents.","supporting_quote":null,"technology_involved":["professional email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-13","discovered_date":"2024-10-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"26102301a32aeb7edf40f431ff534ed95c4c919f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24777013219a","org_name":"TABB Inc. (\"TABB\")","org_type":"retail_ecommerce","ransomware":null,"records_affected":5309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004831"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TABB%20Inc.%20%28%22TABB%22%29-2026-02-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"medusa","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f32e9e98375b7ba92493afd35a2ce681adbcf87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"973b048de642","org_name":"Resource Corporation of America","org_type":"professional_services","ransomware":true,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-13-resource-corporation-of-america"},{"fetched_at":null,"title":"Leak-site claim by medusa","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmVzb3VyY2UgQ29ycG9yYXRpb24gb2YgQW1lcmljYUBtZWR1c2E"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"medusa","claim_groups":["medusa"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-13","discovered_date":"2026-01-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e4de40573a8ee6f686db01e26d4d2c8722b1235f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fac07bf2c247","org_name":"North Atlantic States Carpenters Benefit Funds","org_type":"financial","ransomware":null,"records_affected":110435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004828"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"258bf87d299d165e97cb532186809b7a77612005","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"681e6aab7613","org_name":"National Association on Drug Abuse Problems","org_type":"healthcare","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-13-national-association-on-drug-abuse-problems"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"795a3df0b65ed716ce25d1ec3217925e5312e1dd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98b03f98b0af","org_name":"Cedar Valley Services","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-13-cedar-valley-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cb875901cfacbc16dc69dc80be959c0a486caab8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65208bdd356e","org_name":"Academic Urology & Urogynecology of Arizona","org_type":"healthcare","ransomware":null,"records_affected":73281,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-13-academic-urology-urogynecology-of-arizona"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bed04ce0430dd3827c1ec0df1a3492281207a82b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36561.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"185a060946cc","org_name":"The Brooklyn Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":"A database miscalibration made the database publicly discoverable.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36561.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36561.pdf"}],"summary":"The Brooklyn Hospital Center reported that a database containing background-check files was publicly discoverable, and it could not rule out that the files had been accessed.","supporting_quote":"On August 14, 2024, we were alerted that a database where we stored data related to background checks we conducted on our clients’ behalf was publicly discoverable to people who were able to identify where it was located.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-12","discovered_date":"2024-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d6570ae7e08df9b9d798d39fc46228591b4e123","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-26227%20TABB%20Brooklyn%20Hospital%20Ad%20CM%201y%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"0e8f25ed265d","org_name":"TABB Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A miscalibration left the database publicly discoverable.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618619"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-26227%20TABB%20Brooklyn%20Hospital%20Ad%20CM%201y%20r1prf.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter-%20TABB%2C%20Inc..pdf"}],"summary":"TABB reported that a miscalibrated database containing background-check files was publicly discoverable, though it could not rule out access to the files.","supporting_quote":"On August 14, 2024, we were alerted that a database where we stored data related to background checks we conducted on our clients’ behalf was publicly discoverable to people who were able to identify where it was located.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41a9981bb937842f3736c40117f66c34a3561653","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Progress%20Foundation%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"16f1206bdb71","org_name":"Progress Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618600"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Progress%20Foundation%20-%20Sample%20Notice.pdf"}],"summary":"Progress Foundation reported that employees’ W-2 files, containing names and Social Security numbers, were inadvertently disclosed to an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6310f02b94bfde2e47bdc7502abad6635ddb96","impact_type":"data_theft","incident_date":"2024-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OOGP%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"97c2091a6e18","org_name":"Nassau OOGP Vision Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OOGP%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004830"}],"summary":"An unauthorized third party accessed Nassau OOGP Vision Group’s network and acquired files containing names, shipping addresses, and prescription information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-12","discovered_date":"2025-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cb8c896124010f549c491c2d67a257b56da5846","impact_type":"both","imported_from":null,"incident_date":"2025-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FLC%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"1f4a42efe591","org_name":"Fishman, Larsen & Callister, P.C.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FLC%20Sample%20Notification%20Letter.pdf"}],"summary":"Fishman, Larsen & Callister, P.C. reported unauthorized acquisition of data during an incident involving a network disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4b2636a2cae00c4330b98ba61f57eb9e695a2cba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5431ed1b64b8","org_name":"Cedar Point Health, LLC","org_type":"healthcare","ransomware":null,"records_affected":23114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-12-cedar-point-health-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aacdc065c06aa7813f0af6e84ad8a5d1b5311ffa","impact_type":"data_theft","incident_date":"2025-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jeff%20Anderson%20%26%20Associates%20PA%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"faeb27d4b1c1","org_name":"Jeff Anderson & Associates PA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618535"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619384"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jeff%20Anderson%20%26%20Associates%20PA%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Jeff Anderson & Associates PA reported that an unauthorized party accessed parts of its computer environment on September 18, 2025, and copied certain data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2026-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"107b00d5cf0a6186cedf6890bfbd34553f62a682","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7eea98a16082","org_name":"Toy Battles","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Toy Battles","type":"hibp","url":"https://haveibeenpwned.com/Breach/ToyBattles"}],"summary":"Toy Battles self-submitted data exposed in a February 2026 breach, including email addresses, usernames, IP addresses, and chat logs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"645d43a685f962e445fb0d4ec5ab19cf9b9165c9","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"ffdbaa4354ea","org_name":"Association Nationale des Premiers Secours","org_type":"nonprofit","ransomware":null,"records_affected":5600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Association Nationale des Premiers Secours","type":"hibp","url":"https://haveibeenpwned.com/Breach/ANPS"}],"summary":"Association Nationale des Premiers Secours reported that a breach traced to a legacy system exposed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c512ab212b01eabe72fd3166087c22b1c200e254","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ef2bf53f0646","org_name":"Wendy Foster OD","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-09-wendy-foster-od"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-09","discovered_date":"2026-01-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3ba3e5a9504118ca6bde117a95960d9e321f767","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"34abf56fb0a7","org_name":"Lone Star Pain Relief","org_type":"other","ransomware":null,"records_affected":496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004824"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-09","discovered_date":"2025-09-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0c96703e5ceebaa6c0cc82ca437a716c37e4fd1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f79cb96fe4bf","org_name":"Karnes Electric Cooperative, Inc.","org_type":"other","ransomware":null,"records_affected":607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004820"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ed3b17d52be159267d184e13775bd118fad9c9b9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2b03344c9c04","org_name":"Counseling Center of Wayne & Holmes Counties","org_type":"healthcare","ransomware":null,"records_affected":83354,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-09-counseling-center-of-wayne-holmes-counties"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-09","discovered_date":"2026-01-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d373172f00dbb0e21ba1605ae10b2d14418a1bea","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2026-01-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20San%20Jose%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"47dfc5c607a8","org_name":"City of San Jose","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A workforce member lost a USB drive containing information about current and former City employees.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20San%20Jose%20-%20California%20Notification.pdf"}],"summary":"A City of San Jose workforce member lost a USB drive that may contain current and former employees’ names and Social Security numbers.","supporting_quote":"On January 12, 2026, we learned that a workforce member lost a USB / thumb drive on January 9, 2026 that contains information regarding current and former employees of the City of San Jos é.","technology_involved":["USB/thumb drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6ddfebdf831069325103f94b8d7c79f32e27ff36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e8781c43692","org_name":"Carolina Foot & Ankle Associates","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-09-carolina-foot-ankle-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-07","discovered_date":"2001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"759df245731134553e9cf6dc256ce64dd39ce7a8","impact_type":"unknown","incident_date":"2001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"03b296eb2137","org_name":"Benton County Health Services","org_type":"unknown","ransomware":null,"records_affected":1464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Benton%20County%20Health%20Services-2026-02-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-06","discovered_date":"2026-01-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1042f440c603c97463e51f75ed98ba79bb9d6013","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6f70738e1cd","org_name":"Weekley Homes LLC","org_type":"other","ransomware":null,"records_affected":1779,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004818"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-02-06","discovered_date":"2025-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab9d4b1fc9e126b7e48f03b98108187f4540166a","impact_type":"data_theft","incident_date":"2025-11-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36497.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"07f06ccea6a8","org_name":"Vikor Scientific, LLC","org_type":"professional_services","ransomware":null,"records_affected":1456,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36497.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36497.pdf"}],"summary":"An authorized login and password were used to access a server in Catalyst's secure file management system and copy files containing explanation of benefits letters.","supporting_quote":"Our investigation subsequently determined that an authorized login and password to our system were used to access one server between November 8, 2025, and November 9, 2025, and copied data without permission creating an unauthorized use of the data.","technology_involved":["secure file management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2026-02-06","discovered_date":"2025-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"706d28344add26fb453e7dbb71dca720373a0763","impact_type":"data_theft","incident_date":"2025-11-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vikor%20Scientific%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"07f06ccea6a8","org_name":"Vikor Scientific, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618350"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vikor%20Scientific%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vikor%20Scientific%2C%20LLC-2026-02-06"}],"summary":"Vikor Scientific data was accessed using an authorized login and password, and files were copied from a server.","supporting_quote":"Our investigation subsequently determined that an authorized login and password to our system were used to access one server between November 8, 2025, and November 9, 2025, and copied data without permission creating an unauthorized use of the data.","technology_involved":["secure file management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-06","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33e593e8ca5829b8770a4408c1db659225d47ea0","impact_type":"data_theft","incident_date":"2024-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JATC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"8a45ae70a00c","org_name":"UA Sprinkler Fitters Local 669 Joint Apprenticeship and Training Committee","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JATC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004821"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UA%20Sprinkler%20Fitters%20Local%20669%20Joint%20Apprenticeship%20and%20Training%20Committee-2026-02-06"}],"summary":"JATC reported that an unauthorized actor copied certain files from its computer systems between May 17 and May 23, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-06","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d923ee1994dea01d228612afcb62f7d66c59362","impact_type":"data_theft","incident_date":"2024-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36494.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5d818310a19c","org_name":"UA Sprinkler Fitters Local 669 JATC","org_type":"education","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36494.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36494.pdf"}],"summary":"An unauthorized actor copied files from certain JATC computer systems between May 17 and May 23, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a1a6f9795fdbe8749f92343e5890ec6e5d85cee7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ELN-25764%20Sample%20TPS%20Adult%20Notification%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e4d63693e63","org_name":"TriZetto Provider Solutions","org_type":"professional_services","ransomware":null,"records_affected":3433965,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-06-trizetto-provider-solutions"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618547"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36496.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6c1d909b1c92c932e61e5d4043e3be9b1cfe89e3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d5aa9e20c58","org_name":"Triad Radiology Associates","org_type":"healthcare","ransomware":null,"records_affected":11011,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-06-triad-radiology-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a5a82fa485b30af969ba9005f436359c8aa7296","impact_type":"unknown","incident_date":"2025-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Towne_Mortgage_-_Redacted_Proof_for_CA_DFPI_37393364v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"418711a766c5","org_name":"Towne Mortgage Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618343"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-06","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b60ce75aa5ec006e142ac12bf43d05ffd96b46d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f113f43dfbc0","org_name":"The Gladney Center for Adoption","org_type":"other","ransomware":null,"records_affected":3693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004819"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9de6a3541fafdc51ec80345c93456fb5ac830d17","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a4079291eebf","org_name":"Substack","org_type":"technology_saas","ransomware":null,"records_affected":663121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Substack","type":"hibp","url":"https://haveibeenpwned.com/Breach/Substack"}],"summary":"A breach of Substack exposed account-holder records containing email addresses, publicly visible profile information, and phone numbers for some users.","supporting_quote":null,"technology_involved":["Substack"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-02-06","discovered_date":"2025-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09851f4633781bff50df27fd74e648c5d81bf8d3","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"af2ff54e2b24","org_name":"Phreesia, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown third party exploited a previously unknown vulnerability in the Salesloft Drift software tool.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618283"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004817"}],"summary":"A third party exploited a vulnerability in Salesloft Drift and accessed Phreesia’s Salesforce service tickets, which in some cases contained limited patient information.","supporting_quote":"An unknown third party exploited a previously unknown vulnerability in that software tool and accessed the Salesforce environments of hundreds of organizations, including ours.","technology_involved":["Salesloft Drift","Salesforce"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Salesloft Drift"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fd7637f7c61c","name":"Salesloft"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1f368d54c3c7146050ec208ea0ed06622935fd5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4fe02d208b42","org_name":"Cottage Hospital","org_type":"healthcare","ransomware":null,"records_affected":37796,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-06-cottage-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ad2b0eecfa6ed4a80a0a40002b1146cd280ff053","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"516a1acd1f5f","org_name":"Apex Spine & Neurosurgery, LLC","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-06-apex-spine-neurosurgery-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-06","discovered_date":"2025-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e495ba9e100353c5711ed6ba030ddbee204e252","impact_type":"data_theft","incident_date":"2025-11-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter_L01.pdf"},"notes":null,"org_country":"US","org_id":"d93ef4055929","org_name":"Anywhere Real Estate Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a then-unknown Oracle software vulnerability to access Anywhere’s Oracle EBS environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618362"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter_L01.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004809"}],"summary":"An unauthorized third party exploited a zero-day Oracle software vulnerability to access Anywhere Real Estate’s Oracle EBS environment and export information, including personal information.","supporting_quote":"Upon investigation, we found that an unauthorized third party had exploited a then-unknown ‘zero day’ Oracle software vulnerability to gain access to Anywhere’s Oracle EBS environment, in order to download and export information, including certain information about franchisees and brokers.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2c458778d14a19208d8ff120e8d4da721150cbdd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a7c1e531f36","org_name":"WIRX Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":20047,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-05-wirx-pharmacy"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004829"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bbbd3f4390f346cf96b48323f3e336fdc104d3e","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-09","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"707da2e3d72f","org_name":"Betterment","org_type":"financial","ransomware":true,"records_affected":2750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Betterment","type":"hibp","url":"https://haveibeenpwned.com/Breach/Betterment"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QmV0dGVybWVudCwgTExDLkBzaGlueWh1bnRlcnM"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37496.pdf"}],"summary":"Betterment disclosed a data breach attributed to social engineering that exposed customer contact and other personal information.","supporting_quote":"In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-05","discovered_date":"2026-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3844527906c2fba1a56caef63f02a2191d127f4d","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20Feb%205th.pdf"},"notes":null,"org_country":"US","org_id":"94cf76fbc5a4","org_name":"Awes.me, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618261"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20Feb%205th.pdf"}],"summary":"Awes.me reported that a vulnerability in an email service provider's system may have allowed access to Flickr member information.","supporting_quote":null,"technology_involved":["Flickr","email service provider system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-04","discovered_date":"2026-01-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"586657e0cf0d3faad34654f010bd2030e3913552","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae1d07944c25","org_name":"Powerhouse Retail Services","org_type":"retail_ecommerce","ransomware":null,"records_affected":7856,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004812"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f612a4be78bb47b7b983ed02ce6fe484c7904fd4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1608b5051f50","org_name":"Personalis, Inc.","org_type":"healthcare","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-04-personalis-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fb6ae6d79557640b4598b323950ff0f183795c77","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f6de00d854a","org_name":"Issaqueena Pediatric Dentistry PA","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-04-issaqueena-pediatric-dentistry-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-04","discovered_date":"2025-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d07fe258eb815e43523ff1c92d17207782078bb6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-12","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36461.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"925dcb601a07","org_name":"Gravity Payments","org_type":"financial","ransomware":null,"records_affected":677,"reviewed":false,"root_cause":"A vulnerability in the third-party service provider's software allowed an unknown actor to access Gravity files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36461.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36461.pdf"}],"summary":"An unknown actor accessed Gravity files stored in a third-party service provider's customer relationship management software through a vulnerability in the provider's software.","supporting_quote":"On or around August 22, 2025, a third-party service provider informed us that due to a vulnerability in their software an unknown actor gained access to certain files belonging to Gravity stored in its customer relationship management software.","technology_involved":["customer relationship management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-04","discovered_date":"2025-10-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fe2d510e0e981f7c81c78ede07a963ff3fe9ee7","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4%20GainFCUlettrnotice.pdf"},"notes":null,"org_country":"US","org_id":"67edd883e40d","org_name":"Gain Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4%20GainFCUlettrnotice.pdf"}],"summary":"Gain Federal Credit Union reported unauthorized access to a user’s email account, where personal and financial information may have been involved.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-04","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d8d0b779704932c0ea51c894829acd49dc2f7c6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40713.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3a53024aebde","org_name":"Evolve Mortgage Services","org_type":"professional_services","ransomware":null,"records_affected":507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40713.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004937"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618182"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Evolve%20-%20Exhibit%20A%20-%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40713.pdf"}],"summary":"Evolve Mortgage Services reported that information provided in the ordinary course of business was subject to unauthorized access between September 17 and September 24, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52418c81ced0f10c0474587704c56bc197fbec7a","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Edelman%20Financial%20Engines%20Individual%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d4f44cc793ac","org_name":"Edelman Financial Engines","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618190"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Edelman%20Financial%20Engines%20Individual%20Sample%20Letter.pdf"}],"summary":"Edelman Financial Engines reported that an unauthorized third party accessed personal information, including financial planning information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-04","discovered_date":"2026-01-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"471970c2f7e317e8c5752109b8a82e7c66bea82f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8225deaf3fe2","org_name":"Barnhart Group, Inc.","org_type":"other","ransomware":null,"records_affected":1435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004814"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-02-04","discovered_date":"2025-12-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8fac96ebd643fa6bd4e7bd76397b1f36216b1844","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ba4713116ae","org_name":"Athena Manufacturing LP","org_type":"retail_ecommerce","ransomware":null,"records_affected":1465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004811"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ea63fd1380dc6d29958f9235b42bb3a41853c749","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"483017315bd3","org_name":"About Women Ob/Gyn, PC","org_type":"healthcare","ransomware":null,"records_affected":23018,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-04-about-women-ob-gyn-pc"},{"fetched_at":null,"title":"Leak-site claim by anubis","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWJvdXQgV29tZW4gT2ItR3luQGFudWJpcw"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["anubis"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2026-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a9825df3d613222f921df9396eb37e6fd8a29b6","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20-%20USBFS2300-MedRevenu-Adult-Patient-SSN_v2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"8de5a6e8488a","org_name":"MedRevenu, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618117"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20-%20USBFS2300-MedRevenu-Adult-Patient-SSN_v2_Redacted.pdf"}],"summary":"MedRevenu reported a December 2024 network disruption and said files containing personal information may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-03","discovered_date":"2025-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c64a200cd740d5b529f9028cec6b98c9d22d961","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Notification%20Letter%20Sample%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"165bc5c72080","org_name":"Bayou Media Development, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618088"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Notification%20Letter%20Sample%20-%20Redacted.pdf"}],"summary":"Bayou Media Development reported potentially unauthorized access to a web-hosting service where data related to its product offerings was stored.","supporting_quote":null,"technology_involved":["web-hosting service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-02-02","discovered_date":"2026-01-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3603abfc7fb4f435297c90e45fb1368fc79d0519","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"587a2d9f7fcf","org_name":"White Rock Medical Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":446,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004805"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"631ba58020825cf88be6954a40ac318051b17874","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e2a1a8de6e8","org_name":"MCS, P.C.","org_type":"professional_services","ransomware":null,"records_affected":3478,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-02-mcs-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-02-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8319dbc94261b6c6b65fefc5aa97fb103b4b21b6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97b27582d01f","org_name":"Fair Oaks Ortho P.C.","org_type":"healthcare","ransomware":null,"records_affected":1544,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-02-02-fair-oaks-ortho-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-02-02","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"429cbaf764e1d5818287f48bf8e31e0c39e34236","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a31322cd09f","org_name":"Continental Casualty Company and its affiliates (CNA)","org_type":"financial","ransomware":null,"records_affected":5875,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004808"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-02-02","discovered_date":"2025-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fd94aef4c48282290e69b935443455c1746db524","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2660f924466a","org_name":"1st MidAmerica Credit Union","org_type":"financial","ransomware":null,"records_affected":131070,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004810"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-02-01","discovered_date":"2025-12-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1420f78599aee717ef5aea04078c8df90457ea21","impact_type":"unknown","incident_date":"2025-11-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4903307b32b6","org_name":"Sause Bros. Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sause%20Bros.%20Services%2C%20Inc.-2026-02-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0537d7e251b8c9aba91cbee94d6a39bb7d8325e9","impact_type":"both","imported_from":null,"incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d22b237bafe6","org_name":"Panera Bread","org_type":"retail_ecommerce","ransomware":true,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Panera Bread","type":"hibp","url":"https://haveibeenpwned.com/Breach/PaneraBread"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UGFuZXJhIEJyZWFkQHNoaW55aHVudGVycw"}],"summary":"Panera Bread reported a data breach in January 2026 after which attackers published exposed contact information following an unsuccessful extortion attempt.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-30","discovered_date":"2025-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9e6f442e969f8c29c24210610fcbc6f7fe6a0b4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wakefield%20and%20Associates%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"720693fae153","org_name":"Wakefield & Associates, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617957"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wakefield%20and%20Associates%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Renkim detected suspicious activity and reported that Wakefield information was among files that an unauthorized third party may have obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Renkim"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"ebeb4ac2ff7a","name":"Renkim"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-30","discovered_date":"2024-07-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"969836e492b3fb3672dce4207b05e66582f7f6ad","impact_type":"both","imported_from":null,"incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36404.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"462776c37c4a","org_name":"The Phia Group","org_type":"professional_services","ransomware":null,"records_affected":2802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36404.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36404.pdf"}],"summary":"The Phia Group reported that a security incident disrupted its computer network and that personal information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-01-30","discovered_date":"2025-12-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"f76f518c0facd6424556056b03f83ddf2d573051","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"462776c37c4a","org_name":"The Phia Group, LLC","org_type":"other","ransomware":null,"records_affected":1512742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005059"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-623392"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24024%20Phia%20Group%20KNN%20Imp%20Ind%20Ad%20CM%20r4prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Phia%20Group%2C%20LLC-2026-02-07"}],"summary":"The Phia Group reported that a July 2024 incident disrupted its computer network and may have resulted in personal information being acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"sinobi","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-01-30","discovered_date":"2025-12-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5792d98aae8a83081771d4534b6405d0acb99732","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b74083598dd","org_name":"Pecan Tree Dental, PLLC","org_type":"healthcare","ransomware":true,"records_affected":13300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004798"},{"date":"2026-01-11","fetched_at":null,"title":"Leak-site claim by sinobi","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UGVjYW4gVHJlZSBEZW50YWxAc2lub2Jp"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"sinobi","claim_groups":["sinobi"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4261f6fe4b848b794e264c81118dd4de5a131c95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62c2667ad3a6","org_name":"High Point Treatment Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":25832,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-30-high-point-treatment-center-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-30","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4869cf656b96b60afe9c380425f99955ba2b9f57","impact_type":"data_theft","incident_date":"2025-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fried%2C%20Frank%2C%20Harris%2C%20Shriver%20%26%20Jacobson%20LLP%20-%20Sample%20Individual%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"e5df1ad46fcd","org_name":"Fried, Frank, Harris, Shriver & Jacobson LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617981"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619798"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fried%2C%20Frank%2C%20Harris%2C%20Shriver%20%26%20Jacobson%20LLP%20-%20Sample%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004892"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fried%2C%20Frank%2C%20Harris%2C%20Shriver%20%26%20Jacobson%20LLP-2026-01-30"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Fried%2C%20Frank%2C%20Harris%2C%20Shriver%20%26%20Jacobson%20LLP.pdf"}],"summary":"An unauthorized third party used a compromised Fried Frank user account to copy files, including files containing personal information, from a shared network drive.","supporting_quote":null,"technology_involved":["shared network drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-30","discovered_date":"2025-12-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1458939806c59afdcffcb5e392660b65cee05f01","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3ca48ab855a","org_name":"CFD Investments, Inc. (“CFD”)","org_type":"financial","ransomware":null,"records_affected":31731,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004801"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a16c01081c4800e841ff21e5b5379a23bdd026b9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1eff6b1142c","org_name":"Wound Technology Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":139830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-28-wound-technology-network-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-28","discovered_date":"2026-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"847ee6fa0b9768c3f1db86ea2f3463e90fd8b6d7","impact_type":"data_theft","incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/SitusAMC%20-%20Individual%20Notification%20Template.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d2a3f9711190","org_name":"SitusAMC Holdings Corporation","org_type":"professional_services","ransomware":null,"records_affected":658333,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SitusAMC%20Holdings%20Corporation-2026-03-23"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004960"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617785"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619090"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619936"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SitusAMC%20-%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SitusAMC%20Holdings%20Corporation-2026-02-20"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SitusAMC%20-%20Individual%20Notification%20Template.pdf"}],"summary":"SitusAMC reported unauthorized access to certain systems and determined that an unauthorized third party acquired data, potentially including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"46312ecd46c108ec11451b331bbde56715e06faa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6bb3dba9bff","org_name":"Clinic Service Corporation","org_type":"professional_services","ransomware":null,"records_affected":82331,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-28-clinic-service-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-28","discovered_date":"2025-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fff8fc49da721272b27d7b4b42240860102928e2","impact_type":"data_theft","incident_date":"2025-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Marina%20-%20Sample%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"bf6c9dbaa4c0","org_name":"City of Marina","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617777"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Marina%20-%20Sample%20Consumer%20Notice.pdf"}],"summary":"An unauthorized person accessed some City of Marina systems and acquired copies of files maintained on its servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"569c14d4c3ff4b194eacb8a89a712b7e609f056e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CFD_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"c7700c7e4865","org_name":"CFD Investments, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617793"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CFD_CA%20App%20%26%20Sample_0.pdf"}],"summary":"CFD Investments reported unauthorized access to an employee’s email account from March 15 to May 9, 2025.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-28","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6c1679ebedc88b5f9c95583831017f24368a537","impact_type":"unknown","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6840bcf85c14","org_name":"BestCare Treatment Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":1668,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BestCare%20Treatment%20Services%2C%20Inc.-2026-01-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"67bd2d156d27d2bbb3774c709498040abfdff621","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3959e18c693f","org_name":"WindRose Health Network","org_type":"healthcare","ransomware":null,"records_affected":9087,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-27-windrose-health-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-27","discovered_date":"2025-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ff6525bff63d48b48913e3c87b156ee0c37a726","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36360.pdf"},"notes":null,"org_country":"US","org_id":"43b09e6dfc1c","org_name":"Title Guaranty Company of Lewis County","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36360.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36360.pdf"}],"summary":"An unauthorized party accessed some internal systems, and the company said personal information may have been involved but it had no indication customer data was accessed or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-27","discovered_date":"2025-12-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36447f61bb36f74301fcac6c9c7774c882235322","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd411b575985","org_name":"The Reecer Law Firm PLLC","org_type":"other","ransomware":null,"records_affected":994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004794"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2026-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6eaf47cdac71cedfa45bf5a231a9dd03f909a4b","impact_type":"disruption_or_ransomware","incident_date":"2026-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Take%20One%20Systems%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"59120edca8c1","org_name":"Take One Systems","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617733"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Take%20One%20Systems%20Sample%20Notice.pdf"}],"summary":"Take One Systems reported a ransomware incident involving its file server, where passwords and setup records were stored.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":"shinyhunters","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"723e730f7973669842f5026e706abfbdc1d9b334","impact_type":"both","incident_date":"2025-12-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"33bd0d72eb2e","org_name":"SoundCloud","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SoundCloud","type":"hibp","url":"https://haveibeenpwned.com/Breach/SoundCloud"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U291bmRDbG91ZEBzaGlueWh1bnRlcnM"}],"summary":"An attacker mapped SoundCloud profile data to email addresses, and the attackers later attempted extortion before publicly releasing the data.","supporting_quote":null,"technology_involved":["SoundCloud platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"shinyhunters","claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-27","discovered_date":"2025-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"981e8052793db48a6dba83b984bdbfcff47baed1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult-Redacted-DH_Smith_Redacted_Final_37447972v1.pdf"},"notes":null,"org_country":"US","org_id":"e1afc02e84ae","org_name":"DH Smith Company, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617707"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult-Redacted-DH_Smith_Redacted_Final_37447972v1.pdf"}],"summary":"DH Smith Company, Inc learned that an unauthorized actor accessed its systems, and files may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-01-27","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed6bcfc75f4f159833fddf5c6cb9d4312c300ab2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4abc051a1cc5","org_name":"AA CPA Tax Strategies LLC","org_type":"financial","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004796"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-26","discovered_date":"2026-01-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b473990c86d92d688052da3422ed72bdeab4f29","impact_type":"data_theft","incident_date":"2025-12-29","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36344.pdf"},"notes":null,"org_country":"US","org_id":"eb57886eee12","org_name":"SoFi Technologies, Inc.","org_type":"financial","ransomware":null,"records_affected":38049,"reviewed":false,"root_cause":"Unauthorized access occurred as a result of social engineering.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36344.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36344.pdf"}],"summary":"SoFi reported that social engineering led to unauthorized access to internal systems and the acquisition of personal information belonging to approximately 38,049 state residents.","supporting_quote":"On or around January 2, 2026, SoFi discovered unauthorized activity in its systems, which occurred as a result of social engineering.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-26","discovered_date":"2024-11-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0df3d917f09587008e71a3a3d55e8d8121f5075c","impact_type":"unknown","incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf574e6e3f5d","org_name":"Lincoln County Public Health","org_type":"unknown","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lincoln%20County%20Public%20Health-2026-01-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"087c4a60ec74877950352a20ff4f96cd406dade3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e5d7819b8b19","org_name":"Central States Dermatology Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":4626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-26-central-states-dermatology-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83a49f02599b950e5a1377b316e4efa41ffc6b50","impact_type":"unknown","incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Episource%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f891914c437","org_name":"Brown & Toland Physicians","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617645"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"LockBit5","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38209c4913146479e0ed63e0d73d658fb5756626","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"032C9EBE-C5A4-4BAA-B096-5C7C7855E0AA"},"incident_date":"2026-01-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a2e3de924ae","org_name":"Elmwood Home Care","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/data-breaches-open-arms-care-elmwood-home-care/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.dexpose.io/lockbit5-targets-elmwood-healthcare-in-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.classaction.org/data-breach-lawsuits/elmwood-healthcare-april-2026;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.claimdepot.com/investigations/elmwood-home-care-data-breach-2026"}],"summary":"Elmwood Home Care, a home healthcare provider serving Rhode Island and Massachusetts, disclosed a cybersecurity incident involving unauthorized access to its systems between 2026-01-24 and 2026-02-13. Forensic investigation determined a threat group viewed or acquired patient fil","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"lockbit5"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e690e66fa0f400a9251f17f6f08cb37dae4e8165","impact_type":"unknown","incident_date":"2025-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Wisner%20Baum%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff3aa1e214af","org_name":"Wisner Baum LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617547"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004795"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wisner%20Baum%20LLP-2026-01-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-23","discovered_date":"2025-10-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed6f78ddd3ea9c825ce35ab7a5646d803f462dab","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3b6aa7c89e8","org_name":"Texas Management Division, Inc.","org_type":"other","ransomware":null,"records_affected":3563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004793"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"001aecb51b7b5d5a81ad5b728a888bb33ca6810c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15f034e07c06","org_name":"Surgery Center of Oak Ridge, LLC dba Advanced Family Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":10320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-23-surgery-center-of-oak-ridge-llc-dba-advanced-family-surgery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-23","discovered_date":"2025-03-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"73ebd3c84065aeb39509e447641a26f8be319e61","impact_type":"unknown","incident_date":"2025-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36335.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0afd66d96a8a","org_name":"Sound Window & Door, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":3024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36335.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36335.pdf"}],"summary":"Sound Window & Door, Inc. found that an unauthorized actor accessed files that may have been copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3657add6c3a5093f27478caa9a420968fecf9afd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a9c3874c9da","org_name":"Precipio, Inc.","org_type":"healthcare","ransomware":null,"records_affected":22739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-23-precipio-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Dragonforce","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"315aca8c64a5df3e5fc6702093fc6f2cb7cde044","impact_type":"both","incident_date":"2025-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36331.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"217aeb09dc46","org_name":"Neurological Associates of Washington","org_type":"healthcare","ransomware":true,"records_affected":13500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36331.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36331.pdf"}],"summary":"Neurological Associates of Washington reported that a Dragonforce ransomware attack resulted in theft of patients’ medical records, which were released on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"dragonforce"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6476c97d8560660894423eef6dbcf48aa740dbb0","impact_type":"disruption_or_ransomware","incident_date":"2025-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MACT%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"998ac97bd6c6","org_name":"MACT Health Board Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617506"},{"fetched_at":null,"title":"Leak-site claim by rhysida","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TUFDVCBIZWFsdGggQm9hcmRAcmh5c2lkYQ"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MACT%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party accessed files on MACT Health Board Inc.'s systems during an incident that disrupted IT operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["rhysida"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4794dff433ca7da023a3929ce01373e8f4aad919","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85f3b4a1470d","org_name":"Jefferson-Blount-St. Clair Mental Health Authority","org_type":"healthcare","ransomware":null,"records_affected":30434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-23-jefferson-blount-st-clair-mental-health-authority"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-01-23","discovered_date":"2025-11-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aadc75a2ccb5064d0d575a59bc0efda0fe4f280f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4486aa92deb5","org_name":"FullBeauty Brands, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004791"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-01-23","discovered_date":"2025-09-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d23a05fbe1d892d5c4e8f1810750b2a01d222502","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-16","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20-%20Credit%20Monitoring%2012%20mth_%20California%20Kroll%20VERSION%201.pdf"},"notes":null,"org_country":"US","org_id":"9f01b16da8a8","org_name":"CHP 11-99 Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The external service provider incorrectly advised that the suspicious email link was clean, leading the staff member to open it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-621146"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20-%20Credit%20Monitoring%2012%20mth_%20California%20Kroll%20VERSION%201.pdf"}],"summary":"A staff member clicked a link in a suspicious email after the Foundation’s external service provider said it was clean, leading to a compromise that gave the attacker access to the staff member’s email account.","supporting_quote":"Having had the email supposedly cleared as trustworthy by the service provider, the staff member executed the link, which led to the network compromise as the Help Desk guidance proved to have been wrong.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Everest","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9f83fcbbd0c26c6737678f9bea1959770afc7e0","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9a22b03e156d","org_name":"Under Armour","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Under Armour","type":"hibp","url":"https://haveibeenpwned.com/Breach/UnderArmour"}],"summary":"Customer data from Under Armour was published publicly after the Everest ransomware group claimed access and attempted to extort a ransom.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"everest"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-01-21","discovered_date":"2025-09-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f3d6e65f50cc0aaa269f1f488b764c423be69878","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82c2c5d24920","org_name":"Genan Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":219,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004790"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-21","discovered_date":"2025-08-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93d27c6707186cbdbb2b7a95bb15da46e839543a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Diversified%20Benefit%20Services%20-%20Notice%20of%20Data%20Security%20Incident_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"bb01c2b833eb","org_name":"Diversified Benefit Services Insurance Marketing, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Diversified%20Benefit%20Services%20-%20Notice%20of%20Data%20Security%20Incident_CA_0.pdf"}],"summary":"Diversified Benefit Services Insurance Marketing, Inc. reported unauthorized access to its email system and said emails and files may have been downloaded.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-21","discovered_date":"2025-02-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aa1f8711de3f849d8cb1e945346d08c77ec5229","impact_type":"data_theft","incident_date":"2025-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clawson%20Honda%20of%20Fresno%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"4bf84e2f00be","org_name":"Clawson Honda of Fresno","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clawson%20Honda%20of%20Fresno%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Clawson Honda of Fresno reported that files in its network environment may have been accessed or copied without authorization, potentially affecting personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-01-20","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd3ecdfac59a88f04f6eb2262438d73ec0c4f7da","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WINTERSFINALNOTICE.pdf"},"notes":null,"org_country":"US","org_id":"09abbdf88f8c","org_name":"Winters Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617318"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WINTERSFINALNOTICE.pdf"}],"summary":"Winters Healthcare patients’ personal, health-related, and insurance information may have been affected after unauthorized access to a TriZetto system.","supporting_quote":null,"technology_involved":["TriZetto system","OCHIN electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4558d8da4430ccf8cc26b5ba8edf87f3dd47a170","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"212610d34f77","org_name":"True RCM, a Rapid Care Transcription, Inc., Company","org_type":"professional_services","ransomware":null,"records_affected":1247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-20-true-rcm-a-rapid-care-transcription-inc-company"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-20","discovered_date":"2025-12-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d4bf5d241e4f91c253c778eebd6c8631450e743","impact_type":"unknown","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d9f799c6803c","org_name":"Trizetto (business associated of Columbia River Health)","org_type":"unknown","ransomware":null,"records_affected":304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trizetto%20%28business%20associated%20of%20Columbia%20River%20Health%29-2026-01-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2026-01-20","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c206ae2596970bad482c78c937918b58c04219d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PetalumaHC%20-%20Notice%20to%20Impacted%20Patients%20-%20TPS%20Breach%20%28template%29%2869176348.4%29.pdf"},"notes":null,"org_country":"US","org_id":"533ea7844239","org_name":"Petaluma Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617350"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PetalumaHC%20-%20Notice%20to%20Impacted%20Patients%20-%20TPS%20Breach%20%28template%29%2869176348.4%29.pdf"}],"summary":"Petaluma Health Center reported that unauthorized access to a TriZetto system may have exposed some patients’ personal, health-related, or insurance information.","supporting_quote":"This security incident occurred at a third-party company (“TriZetto”) that works with our electronic medical record system (“OCHIN”).","technology_involved":["TriZetto system","OCHIN electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f5d398e9d7536f9da8af8a29d82ea32b543a1bd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d5edd871d6b","org_name":"Middlesex Sheriff's Office","org_type":"healthcare","ransomware":null,"records_affected":19080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-20-middlesex-sheriff-s-office"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd3b6c05423b004a9bd26ca25db2c6320c49963a","impact_type":"data_theft","imported_from":null,"incident_date":"2025-12-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"f1b8f81fa5c9","org_name":"Raaga","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Raaga","type":"hibp","url":"https://haveibeenpwned.com/Breach/Raaga"}],"summary":"Data allegedly breached from Raaga was posted for sale on a hacking forum, including personal information and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a44b32f0277d92290a450f79937f565226d10b82","impact_type":"data_theft","imported_from":null,"incident_date":"2025-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"ed38b3a5695a","org_name":"Pass'Sport","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pass'Sport","type":"hibp","url":"https://haveibeenpwned.com/Breach/PassSport"}],"summary":"Data from France's Pass'Sport program was posted to a hacking forum and included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-17","discovered_date":"2025-11-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b3f815e91cdabf124c5a1197f1e4dab4bcf8021","impact_type":"unknown","incident_date":"2001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d061a7898da","org_name":"Southern Oregon Neurosurgery","org_type":"unknown","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Southern%20Oregon%20Neurosurgery-2026-01-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"231096129f4f9a9d8e34557b12b63b54fdb53277","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"56b9752a4133","org_name":"Superior Care Plus LLC d/b/a Supportive Home Health LLC","org_type":"healthcare","ransomware":null,"records_affected":1415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-16-superior-care-plus-llc-d-b-a-supportive-home-health-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cef6316e944c692ed769fdf25973c7d33e5fcba5","impact_type":"unknown","incident_date":"2025-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SPC_Notice_Proof_A_-_Adult_CM%2837397904.1%29_Redacted_37408032v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c037bf5c567a","org_name":"SPCorp Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617240"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"008f273f66653fa4549367eee8cabc1c9e22e76c","impact_type":"unknown","incident_date":"2025-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Email%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"088899625709","org_name":"Sonoma County Department of Emergency Management","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617155"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-12-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"257ac92259bda7cad36aeac4d66a0b0f469c72fa","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter%20-%20English.pdf"},"notes":null,"org_country":"US","org_id":"cfd063f1d044","org_name":"Santa Cruz Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter%20-%20English.pdf"}],"summary":"Santa Cruz Community Health reported that unauthorized access to a TriZetto Provider Solutions website exposed files that may have included patients’ personal and health information, with no confirmed information theft.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-16","discovered_date":"2025-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f64cbef2beb9244419f1e2d872c8300a035f3ce","impact_type":"data_theft","incident_date":"2025-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36252.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"efc94029ea4d","org_name":"PROVAIL","org_type":"nonprofit","ransomware":null,"records_affected":4391,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36252.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36252.pdf"}],"summary":"PROVAIL determined that personal information in certain files on its systems was accessed or acquired without authorization between June 7 and June 9, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-16","discovered_date":"2001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea51dd6cdfdac150144a84b5f0e99777b7f3134c","impact_type":"unknown","incident_date":"2001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50d5d6b95146","org_name":"Pillsbury Winthrop Shaw Pitman LLP","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pillsbury%20Winthrop%20Shaw%20Pitman%20LLP-2026-01-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"704f0311ebc5df7fbb81946249f58127a2a38cce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCOLEFINALNOTICE.pdf"},"notes":null,"org_country":"US","org_id":"daa873e1f551","org_name":"OLE Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCOLEFINALNOTICE.pdf"}],"summary":"OLE Health reported that an unauthorized individual accessed a TriZetto system, potentially involving some patients’ personal and health-related information.","supporting_quote":"This security incident occurred at a third-party company (“TriZetto”) that works with our electronic medical record system (“OCHIN”).","technology_involved":["TriZetto"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-16","discovered_date":"2025-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c9285e6b2de771c342b2f27b8a229ce7d795904","impact_type":"data_theft","incident_date":"2025-06-25","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IOA%20-%20Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"68dba3172b16","org_name":"Insurance Office of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized party gained access as a result of a phishing email attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IOA%20-%20Sample%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004788"}],"summary":"Insurance Office of America reported that a phishing email attack led to unauthorized access to internal systems, where personal information may have been accessed or acquired.","supporting_quote":"Based on this investigation, we determined that an unauthorized party gained access to our network as a result of a phishing email attack.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e696151babb8ffad1cd9f9f760b44191b56aca5a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a7d37f77cc5","org_name":"Insightin Health, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1949534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-16-insightin-health-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10cc441c3319944f15e2fb16c55067b32447bbbe","impact_type":"unknown","incident_date":"2025-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_Job48255d28_IMHC%20US_VERSION%20G_DBM-5470_SAS_1_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac3b434b2c5c","org_name":"Ingram Micro, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617241"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004789"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fa814d6ada3203d09a693426e2351543e6ba983","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2026.01.05%20-%20Letter%20to%20Patients%20Re%20Trizetto%20Breach%20-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"c4db4fafde0b","org_name":"Indian Health Center of Santa Clara Valley","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2026.01.05%20-%20Letter%20to%20Patients%20Re%20Trizetto%20Breach%20-%20Sample.pdf"}],"summary":"An unauthorized actor accessed historical eligibility transaction reports containing patient information in TriZetto Provider Solutions’ web portal.","supporting_quote":null,"technology_involved":["web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"67a80bbb6681a0fc34078c3cc0e0224eeb005e0b","impact_type":"disruption_or_ransomware","incident_date":"2025-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21377.pdf"},"notes":null,"org_country":"US","org_id":"2349bcb43efb","org_name":"Guardian Pharmacy of Washington, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21377.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21377.pdf"}],"summary":"An unauthorized actor accessed a limited area of Mercury’s computer network, deleted information, and may have copied files; potentially affected information included names, addresses, and prescription information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-16","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"873dfa723ce76de8be0cf52f9368efd0a9d748e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36241.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"04c83d1f0870","org_name":"FirstFruits Farms, LLC","org_type":"other","ransomware":null,"records_affected":6335,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FirstFruits%20Farms%2C%20LLC-2026-01-16"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36241.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36241.pdf"}],"summary":"FirstFruits Farms identified unusual activity, and its investigation found that personal information including names and Social Security numbers may have been viewed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"50f4f4c4460a9d93b42efc658425c4941b31ad0e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"842994e8fb35","org_name":"Benton County Health","org_type":"healthcare","ransomware":null,"records_affected":1476,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-16-benton-county-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"059a635d3fb4ee0ef00f369b4553540f7f802c74","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Sample_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"709176ff1297","org_name":"Bay Area Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617255"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Sample_Redacted.pdf"}],"summary":"Bay Area Community Health reported that an unauthorized individual accessed a TriZetto system and that patient personal and health-related information may have been involved.","supporting_quote":null,"technology_involved":["TriZetto system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ed10f567208b6302eb7edf3c6fc421a198381be","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2026.01.05%20-%20TZ%20Breach%20-%20Patient%20Letter%20-%20English%20-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"e804a38c3eca","org_name":"Axis Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617146"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2026.01.05%20-%20TZ%20Breach%20-%20Patient%20Letter%20-%20English%20-%20Sample.pdf"}],"summary":"A breach involving Trizetto Provider Solutions’ web portal potentially affected Axis Community Health patient information.","supporting_quote":null,"technology_involved":["Trizetto Provider Solutions web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Trizetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-16","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"091d6477e9ad88a138df1ee1905d32c8ce4e3f83","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.12.24%20-%20Letter%20to%20Patients%20Re%20TPS%20Breach_Lettehead%20-%20Sample.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"a734f0e7bf3e","org_name":"Asian Americans for Community Involvement","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617142"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.12.24%20-%20Letter%20to%20Patients%20Re%20TPS%20Breach_Lettehead%20-%20Sample.pdf"}],"summary":"Asian Americans for Community Involvement reported that patients were affected by unauthorized access to eligibility transaction reports stored in TriZetto Provider Solutions’ web portal, with no evidence that information was downloaded.","supporting_quote":null,"technology_involved":["TriZetto web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-16","discovered_date":"2025-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c557c00fa1343aa5c3119af9bb1ce0598a6e73cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-11","initial_access":"insider","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36248.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"89feaf4e4ca0","org_name":"Advantage Dirt Contractors, Inc.","org_type":"other","ransomware":null,"records_affected":546,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36248.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36248.pdf"}],"summary":"A former employee accessed Advantage Dirt Contractors’ accounting software, potentially exposing personal information.","supporting_quote":"On December 17, 2025, we learned of an una uthorized access to our accounting software by a former employee which likely occurred on or around December 11, 2025.","technology_involved":["accounting software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f6d8a806ab4ea2feead0cbf1662ae833e0e01043","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ec0a8d4be75","org_name":"Southern Immediate Care, LLC","org_type":"healthcare","ransomware":null,"records_affected":7447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-15-southern-immediate-care-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f50407f2d49298e25afb3cce2d22419c38dd3b22","impact_type":"unknown","incident_date":"2024-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted%20English%20and%20Spanish%20TriZetto%20Patient%20Breach%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf841bf2c797","org_name":"La Clinica de La Raza, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617081"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e0e5cd78fc1544650858724135e0bbbe577e5f15","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5b4b391f66b","org_name":"360 Dental PC","org_type":"healthcare","ransomware":null,"records_affected":11273,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-15-360-dental-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"akira","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-14","discovered_date":"2026-01-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1e5be02103874c7fbd01b09e83fbe6862b4c4e0f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d4a78da4d5fd","org_name":"Posillico, Inc.","org_type":"retail_ecommerce","ransomware":true,"records_affected":9876,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004787"},{"date":"2026-01-05","fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UG9zaWxsaWNvQGFraXJh"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"actor_id":"akira","claim_groups":["akira"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-14","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d4fd821c8f96b9694ebf916c07d0f4097c8608c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LifeLong%20TriZetto%20Patient%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2f314bd7eeaa","org_name":"LifeLong Medical Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LifeLong%20TriZetto%20Patient%20Breach%20Notification.pdf"}],"summary":"An unauthorized actor accessed records related to insurance eligibility verification transactions through a TriZetto Provider Solutions web portal.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-14","discovered_date":"2025-03-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-09","id":"8cfe0fba3c10c681c6e9c97e10284824e5ea74f4","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Circle%20Park.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8b78130765e2","org_name":"Circle Park Behavioral Health Services","org_type":"healthcare","ransomware":null,"records_affected":7020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-14-florence-county-commission-on-alcohol-drug-abuse-dba-circle-park-behavioral-heal"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Circle%20Park.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Circle%20Park.pdf"}],"summary":"Circle Park reported that an unknown actor may have accessed and acquired personal and personal health information without authorization.","supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2026-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f636a503bd1d3881d20697e2c4bebb8c66cd114","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification_Sample%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"56b0f1d23116","org_name":"SAFE Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616985"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification_Sample%20Notification.pdf"}],"summary":"SAFE Credit Union reported an incident that led to the unintended disclosure of certain member information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7519fb139047c199427097e7e9ab3dea2b59a9d8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b38e5eb1e2c7","org_name":"Pinnacle Holdings, LTD","org_type":"professional_services","ransomware":null,"records_affected":18313,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-13-pinnacle-holdings-ltd"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07877a872bb0955b6a6e131185fabfd9d22c7c6e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Monroe%20-%20Template%20A%20-%20Adult%201%20YR%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"79ee4ac5484a","org_name":"Monroe University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monroe%20-%20Template%20A%20-%20Adult%201%20YR%20-%20Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004786"}],"summary":"An unauthorized third party accessed certain Monroe systems from December 9 to December 23, 2024, and acquired copies of some files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a655fd042cff049f0c992221d8a24d76937057c","impact_type":"unknown","imported_from":null,"incident_date":"2025-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20GMS%20Adult%20Notice%20Letter%20Sample%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"c19a01c9e075","org_name":"Gym Management Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616994"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20GMS%20Adult%20Notice%20Letter%20Sample%20-%20Redacted.pdf"}],"summary":"Gym Management Services, Inc. notified affected people of an incident dated July 25, 2025, but the provided text does not describe how it occurred or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"90141d2205310f57db035eee4d345c95e19cdb21","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae660354b0c3","org_name":"FullBeauty Brands, Inc. Associate Benefits Plan","org_type":"healthcare","ransomware":null,"records_affected":4725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-13-fullbeauty-brands-inc-associate-benefits-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-13","discovered_date":"2025-12-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc4881435857c1e5346233f2287a2653ef33d894","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c2aacb0b0f5","org_name":"Carranco & Lawson, P.C.","org_type":"financial","ransomware":null,"records_affected":474,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004785"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-13","discovered_date":"2026-01-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"117e393fdd7b301ce96675963d7616a6c0f5409d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6f1dea909a2d","org_name":"Amtech Software, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":7993,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004783"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0a4c33217559fca412f42a335b042f94cb8adb27","impact_type":"data_theft","incident_date":"2025-04-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36195.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"3acfaac58cd0","org_name":"GSPlatformCo Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":798,"reviewed":false,"root_cause":"An Elasticsearch index on DigitalOcean was misconfigured and publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36195.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36195.pdf"}],"summary":"An unauthorized third party downloaded a publicly accessible Elasticsearch snapshot hosted on DigitalOcean that contained customer profile information.","supporting_quote":"An Elasticsearch index on DigitalOcean, containing a snapshot from April  2025, was misconfigured leaving this dataset publicly accessible.","technology_involved":["Elasticsearch","DigitalOcean"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"DigitalOcean"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"9b19f5f83e47","name":"DigitalOcean"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87ac9159631b7a95bb8a2c5e5334d13f62b5fc32","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/01.12.25%20Security%20Incident%20Customer%20Notice.docx_.pdf"},"notes":null,"org_country":"US","org_id":"3acfaac58cd0","org_name":"GSPlatformCo Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616922"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/01.12.25%20Security%20Incident%20Customer%20Notice.docx_.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GSPlatformCo%20Inc.-2026-01-31"}],"summary":"GSPlatformCo Inc reported unauthorized access to a system holding customer profile details, account status, and transaction history.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-12","discovered_date":"2025-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bf28ec73f231d6983623e81ed424fe5a9bb1c47","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Communication%2020260112%20-%20AG%20-%20Final.pdf"},"notes":null,"org_country":"US","org_id":"94bae90babca","org_name":"County of Santa Barbara Health Department","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Communication%2020260112%20-%20AG%20-%20Final.pdf"}],"summary":"The County of Santa Barbara Health Department reported that a cybersecurity incident at TriZetto Provider Solutions affected patients’ protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-12","discovered_date":"2025-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ac6f3a1fa747f8f0fbffdcbf1d2681afc5296e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chapman-Individual_final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"59d4ace2dd2c","org_name":"Chapman and Associates PC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616934"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chapman-Individual_final_Redacted.pdf"}],"summary":"Chapman and Associates PC reported that an unauthorized third party may have accessed individuals’ personal information during a network security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-11","discovered_date":null,"entry_asset":"api_or_integration_token","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ae3ed0ff4e40daaa55e22c36f08d9271d9ac433","impact_type":"data_theft","imported_from":null,"incident_date":"2026-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4b84c5746478","org_name":"Instagram","org_type":"technology_saas","ransomware":null,"records_affected":17000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Instagram","type":"hibp","url":"https://haveibeenpwned.com/Breach/Instagram"}],"summary":"Data allegedly scraped via the Instagram API was posted to a hacking forum; the dataset contained 17 million rows of public Instagram information.","supporting_quote":null,"technology_involved":["Instagram API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2026-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84483ce33cb5c8e74f5433987bc2d3ac3620ab76","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"640cde254fdf","org_name":"BreachForums","org_type":"other","ransomware":null,"records_affected":672247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BreachForums (2025)","type":"hibp","url":"https://haveibeenpwned.com/Breach/BreachForums2025"}],"summary":"A breach of BreachForums exposed email addresses, forum posts, private messages, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"23b200f3f5f2c419a2b172230f4fecab07933863","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8fb212d78850","org_name":"Avosina Healthcare Solutions","org_type":"professional_services","ransomware":null,"records_affected":44425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-10-avosina-healthcare-solutions"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-09","discovered_date":"2025-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf3a1f9de5a439a625ab4156e0258931eecf2a6c","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job48255d18_VER_L01_DBM-5461_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"7b820be49ab6","org_name":"Total Wireless","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job48255d18_VER_L01_DBM-5461_SAS_1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004784"}],"summary":"An unauthorized party obtained Total Wireless customers’ personal information from Veriff’s systems, including government-issued ID images and potentially postal addresses and dates of birth.","supporting_quote":null,"technology_involved":["Veriff systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Veriff"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"07a51a18f454","name":"Veriff"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7450d9641765cde1ec5b5b755a9a03218520b2a3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ace447e0bba7","org_name":"The Center for Neuropsychology and Learning, PC","org_type":"healthcare","ransomware":null,"records_affected":3722,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-09-the-center-for-neuropsychology-and-learning-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-09","discovered_date":"2025-12-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"60569c1445c1476888e2b2f86d94714e37038424","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e5b6dcd6923f","org_name":"Standard Sales Company, LP","org_type":"retail_ecommerce","ransomware":null,"records_affected":4321,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004780"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-09","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a47deca5a77f16790dd8c44ad7d307fdd15c31a1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SFCHC%20Patient%20Notice-FINAL-on%20Letterhead%20%28English%29.pdf"},"notes":null,"org_country":"US","org_id":"33c3b5eca422","org_name":"San Francisco Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616848"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SFCHC%20Patient%20Notice-FINAL-on%20Letterhead%20%28English%29.pdf"}],"summary":"An unauthorized actor accessed historical eligibility reports containing San Francisco Community Health Center patients’ protected health information on TriZetto’s web portal.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions","eligibility verification web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8ebd4b53067b5d6ecd0b928d662893df2968964a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a0c9acb4a14","org_name":"Home, Hope and Healing, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-09-home-hope-and-healing-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5b6464a077d1be192c569a9836dfdb87abc51bd","impact_type":"unknown","incident_date":"2025-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Money%20Mart_CA%20App%20%26%20Sample_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"73a3fee66771","org_name":"Dollar Financial Group, Inc. dba Money Mart","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616765"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d9c5f70aa91af0a3845afe05953f08125cb6003c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5a4979c8f3c","org_name":"Central Ozarks Medical Center","org_type":"healthcare","ransomware":null,"records_affected":11818,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-09-central-ozarks-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-08","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"079ac0432adae5d147e77a5dfe227c3b0dbf8c0e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jan%202026_Patient%20Letter-%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"840181dbb136","org_name":"Open Door Community Health Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616697"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jan%202026_Patient%20Letter-%20FINAL.pdf"}],"summary":"Unauthorized access to TriZetto’s network resulted in potential access to information involving some Open Door Community Health Centers patients.","supporting_quote":null,"technology_involved":["TriZetto"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-08","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad90b0127dcc7448880d556d9b0f23e9c4cfa868","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PATIENT%20LETTER%20-AG.pdf"},"notes":null,"org_country":"US","org_id":"ccf100da13b2","org_name":"One Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PATIENT%20LETTER%20-AG.pdf"}],"summary":"One Community Health reported that an unauthorized individual accessed historical eligibility transaction reports stored on TriZetto Provider Solutions' system.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions","web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-08","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fed961b502dc959ba0e208cc397f69d95c39416","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPS%20PT%20LETTER%20TEMPLATE%201-08-2026.pdf"},"notes":null,"org_country":"US","org_id":"4d70cf57b016","org_name":"Harmony Health Medical Clinic and Family Resource Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPS%20PT%20LETTER%20TEMPLATE%201-08-2026.pdf"}],"summary":"Harmony Health notified patients that an unauthorized actor accessed records in TriZetto Provider Solutions systems, potentially exposing personal information.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions","web portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c7499aa303bfd70388561edd67112286b92d24e6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3d9b4697b26","org_name":"Devereux Foundation","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-08-devereux-foundation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-08","discovered_date":"2025-10-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"602c92abd2673d014b94eb68c6cc7c2054740966","impact_type":"unknown","incident_date":"2025-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a18d9a49822c","org_name":"Clackamas Community College","org_type":"unknown","ransomware":null,"records_affected":33381,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clackamas%20Community%20College-2026-01-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-08","discovered_date":"2025-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22e3a1eb1dd9e5794bad883716b792bc35254ad7","impact_type":"data_theft","incident_date":"2025-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bridgewater%20Law%20Group%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8ee8d2ec625e","org_name":"Bridgewater Law Group, APC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bridgewater%20Law%20Group%20Sample%20Notice.pdf"}],"summary":"Bridgewater Law Group reported that an unauthorized third party may have accessed or acquired data stored in its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3cb83396d433198a3f74248d587567d6ee298adb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4dcbdcf78fca","org_name":"ABKSW PREFERRED HEALTH PARTNERS, PLLC d/b/a NORTH TEXAS PREFERRED HEALTH PARTNERS","org_type":"healthcare","ransomware":null,"records_affected":2074,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-08-abksw-preferred-health-partners-pllc-d-b-a-north-texas-preferred-health-partners"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004842"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-07","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f838615e2c3b3f4017329df220841f96492d20f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notice-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"f8451adeff63","org_name":"Mission Neighborhood Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice-%20Sample.pdf"}],"summary":"Mission Neighborhood Health Center notified patients that information may have been involved in unauthorized access to TriZetto systems.","supporting_quote":null,"technology_involved":["TriZetto systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-07","discovered_date":"2025-11-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"11ee6507db0864dae3e348b680a0c28a04b75dca","impact_type":"unknown","incident_date":"2025-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c5828f57191","org_name":"Houston Wealth Advisers, LLC","org_type":"financial","ransomware":null,"records_affected":710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004776"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-07","discovered_date":"2025-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"65429513f58136433453666d572f53ca86e641fe","impact_type":"data_theft","incident_date":"2025-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36090.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c5877fd308f9","org_name":"Healthcare Interactive, Inc.","org_type":"professional_services","ransomware":null,"records_affected":46840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36090.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36090.pdf"}],"summary":"An unauthorized actor copied files from Healthcare Interactive's computer network, and personal information was potentially included.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-07","discovered_date":"2025-08-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef14b19995a89def5ce3800f2f5427e7f4e50d86","impact_type":"unknown","incident_date":"2025-08-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22aec57cf147","org_name":"Garten Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":2634,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Garten%20Services%2C%20Inc.-2026-01-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26341e40bdff112954081471cd2b0b4341f9d595","impact_type":"unknown","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f4734af0470","org_name":"CE-Edinger Medical Group BA - TriZetto TPS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616644"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2026-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0919f648a2fd8e7445b13add2e93fc153dd7552d","impact_type":"data_theft","imported_from":null,"incident_date":"2025-12-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"25edc1479a76","org_name":"WhiteDate","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WhiteDate","type":"hibp","url":"https://haveibeenpwned.com/Breach/WhiteDate"}],"summary":"WhiteDate suffered a data breach in December 2025, and a later dataset provided to HIBP included personal information and phpBB password hashes.","supporting_quote":null,"technology_involved":["phpBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9b013d85eff9c9569c064c5cc5c66b204a2d1111","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d503109686f","org_name":"Pit River Health Service Inc.","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-06-pit-river-health-service-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-06","discovered_date":"2025-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb7838961b53b74be1463133f14a3e4e1575245d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ex.%20C%20-%20Template%20-%20Notice%20to%20Impacted%20Patients%20-%20TPS%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"ddb49c6e027c","org_name":"Native American Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616621"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617754"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ex.%20C%20-%20Template%20-%20Notice%20to%20Impacted%20Patients%20-%20TPS%20Breach.pdf"}],"summary":"Native American Health Center reported that an unauthorized individual accessed a TriZetto system, potentially involving some patients’ personal and health-related information.","supporting_quote":null,"technology_involved":["TriZetto system","OCHIN electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c247c5ed976ff7eef199de2e970c3f5bcfe00604","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fdeaf1fa7f5e","org_name":"Methodist Homes of Alabama and Northwest Florida","org_type":"healthcare","ransomware":null,"records_affected":1406,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-06-methodist-homes-of-alabama-and-northwest-florida"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d6f2f2310d250d1edd88dab3e7c261a1274b6b49","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8295eee29b16","org_name":"Iowa Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":3340,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-06-iowa-health-and-human-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-06","discovered_date":"2025-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b194091af89d5e244a468938e26a5ef09d677e87","impact_type":"data_theft","incident_date":"2025-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f5b2968bfe6c","org_name":"Imperial Beach Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616618"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter.pdf"}],"summary":"Imperial Beach Community Clinic reported that information may have been copied without authorization from its email environment.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-06","discovered_date":"2025-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2db837c29cb4e639676fd9ca637445f5a9bc1ba1","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-09-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Gulshan%20Management%20Services%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6ff33c01e5e7","org_name":"Gulshan Management Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1414,"reviewed":false,"root_cause":"A successful phishing attack enabled the third party to gain access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Gulshan%20Management%20Services%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Gulshan%20Management%20Services%2C%20Inc..pdf"}],"summary":"Gulshan Management Services, Inc. discovered unauthorized access following a phishing attack that encrypted portions of its network and may have exposed personal information.","supporting_quote":"Subsequent investigation determined this unauthorized access came from a successful phishing attack on September 17, 2025.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f8356d9f43ee8ebbd98dc9e561927fc3ef20229d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64863aa73a87","org_name":"Texas Health and Human Services Commission","org_type":"healthcare","ransomware":null,"records_affected":68066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-05-texas-health-and-human-services-commission"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-01-05","discovered_date":"2025-12-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"30c095a8516bc07006ad8909cbd28ec5e08d2619","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"75c5c42561dd","org_name":"SSL and ACL and their current and former affiliates","org_type":"financial","ransomware":null,"records_affected":57253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004765"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SSL%20and%20ACL%20and%20their%20current%20and%20former%20affiliates-2025-12-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c7c565832473158053d6fa9f7c48eb6ef28655a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Letter_6.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40f7600c607a","org_name":"Santa Rosa Community Health Centers","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616605"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2026-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d4c6b86f69ff119642f12b3e5c8779bdd8f369c5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa726f2b8903","org_name":"Mid Michigan Medical Billing Service, Inc.","org_type":"professional_services","ransomware":null,"records_affected":28185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2026-01-05-mid-michigan-medical-billing-service-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-01-05","discovered_date":"2024-12-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bb3fb176d0c88ab694ed0518d7a0c065e89a5212","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c86bf8fa919d","org_name":"Lewis-Watkins-Farmer Agency Inc.","org_type":"financial","ransomware":null,"records_affected":5050,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004771"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2026-01-05","discovered_date":"2024-10-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56ffe442feaa7db3c6752b0b6c4700e888f9d976","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"12df2af082e7","org_name":"Heavy Construction Systems Specialists, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1022,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004763"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2026-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"112bee1077117b8a3f5e9602d168039f73b6e4ec","impact_type":"unknown","incident_date":"2025-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_Proof_-_FFSLA_37343639v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50f8278fec14","org_name":"First Federal Savings & Loan Association of Pascagoula Moss Point","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616579"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004775"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2026-01-05","discovered_date":"2025-12-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2c7df3213aa33a83a8f55128e8e1d990c70b413e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"659dafa35891","org_name":"Energy Capital Credit Union","org_type":"financial","ransomware":null,"records_affected":55777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004768"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2026-01-05","discovered_date":"2025-10-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95ec5d337eb4df40235423882f7ab02f2cf4b088","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a8f155b4d9ee","org_name":"Denton County MHMR Center, My Health, My Resources","org_type":"healthcare","ransomware":null,"records_affected":300728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004766"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"918d2ecf85902d55e6f4ce0137df5bc5b7438b7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2026-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36033.pdf"},"notes":null,"org_country":"US","org_id":"115924458cf5","org_name":"Tillett Agency Inc","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36033.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36033.pdf"}],"summary":"Tillett Agency Inc accidentally emailed a Medicare application containing personal information to an unintended recipient.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2026-01-02","discovered_date":"2025-05-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39a103c59f6941726d34d8a25b19edf17a52b4e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"1a61937fe0c3","org_name":"Covenant Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616528"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004772"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Covenant%20Health%2C%20Inc..pdf"}],"summary":"Covenant Health reported that an unauthorized party accessed its IT environment and some patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-02","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6acfee196af552260e01ed528a967f81f9271dca","impact_type":"data_theft","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Conduent%20Business%20Services%20LLC%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"1f4ef2795543","org_name":"Conduent Business Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620757"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616545"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-617969"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Conduent%20Business%20Services%20LLC%20Sample%20Notice_1.pdf"}],"summary":"Conduent Business Services reported that an unauthorized third party accessed its environment and obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2026-01-02","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeda0fe34d5a530cf1467d9c2258b690d1adf312","impact_type":"data_theft","incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cerenade-%20Notification%20Letter%20-%20Adult_v5%20%28print%20proof%20rev3%29.pdf"},"notes":null,"org_country":"US","org_id":"7cf38d98d376","org_name":"Cerenade","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616522"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cerenade-%20Notification%20Letter%20-%20Adult_v5%20%28print%20proof%20rev3%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004823"}],"summary":"Cerenade determined that an unauthorized intruder downloaded documents from its system containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2026-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3366b6a62ac4d034ec8e202472b55851df9eaf66","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAEFD515-974F-4153-BCDD-6B4179F1846E"},"incident_date":"2026-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a64b3870f2a","org_name":"Eastman Kodak Company","org_type":"manufacturing","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/kodak-confirms-data-breach-claimed-by-shinyhunters-extortion-gang/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2026/06/kodak-confirms-data-breach-claimed-by-shinyhunters-extortion-gang/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.computing.co.uk/news/2026/security/kodak-confirms-data-breach-shinyhunters;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securitymagazine.com/articles/102379-kodak-confirms-breach-following-claims-22m-records-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.teiss.co.uk/news/kodak-confirms-a-major-data-breach-following-shinyhunters-hacking-claim-17694;"}],"summary":"Eastman Kodak Company confirmed a June 2026 data breach after the ShinyHunters extortion gang claimed on its dark-web leak site to have stolen over 2.2 million records of customer PII and internal corporate data, threatening to publish the data unless Kodak made contact by 18 Jun","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"efaff97577487fdfc39304dabf4b99dee2f1073b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3df36573b0f","org_name":"Steel Encounters, Inc.","org_type":"healthcare","ransomware":null,"records_affected":959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-31-steel-encounters-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4595e8bc622517980153d23696044e1745183259","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf072a1a3da3","org_name":"Standards Home Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":6847,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-31-standards-home-health-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004769"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f576cd87116fc6b7ff460c6166284d63dfe287f4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2c6fe75d6f6","org_name":"Pines of Sarasota Healthcare, LLC","org_type":"healthcare","ransomware":null,"records_affected":1258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-31-pines-of-sarasota-healthcare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"facd9eeb11891cea829c32a9d98192b1c9567bcd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"77fb15979674","org_name":"Andover Eye Associates","org_type":"healthcare","ransomware":null,"records_affected":1638,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-31-andover-eye-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-30","discovered_date":"2025-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77ed1bb976b01aa1d68107757bdaf54ebc9b41f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSL%20ACL%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"8732bbf8c79c","org_name":"SSL and ACL","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616403"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSL%20ACL%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"SSL and ACL reported that an unauthorized actor accessed certain computer systems between April 7 and April 15, 2025, and potentially accessed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-30","discovered_date":"2025-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d428162175178aadac0668e3a8f33b541bae8577","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%5BREADY%20TO%20PRINT%5D%20Patient%20Notification%20Letter%2012.23.25.pdf"},"notes":null,"org_country":"US","org_id":"aadf13893618","org_name":"Planned Parenthood Northern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%5BREADY%20TO%20PRINT%5D%20Patient%20Notification%20Letter%2012.23.25.pdf"}],"summary":"Planned Parenthood Northern California reported that an unauthorized party accessed Trizetto Provider Solutions’ systems containing patient insurance eligibility and related information.","supporting_quote":null,"technology_involved":["Trizetto Provider Solutions"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Trizetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"77845ed9f141ef3cc124edc99d209faead52275e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d0926b15be3","org_name":"Mid-South Pulmonary & Sleep Specialists P.C.","org_type":"healthcare","ransomware":null,"records_affected":70211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-30-mid-south-pulmonary-sleep-specialists-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"56f71862b68024d8411c0acb34d3c88b1586d5bb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Daniel%20Island%20Club.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1eb7458bf5d4","org_name":"Daniel Island Club","org_type":"other","ransomware":null,"records_affected":2119,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Daniel%20Island%20Club.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Daniel%20Island%20Club.pdf"}],"summary":"Daniel Island Club reported that an unknown actor accessed its network and viewed or copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-30","discovered_date":"2025-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe88f67e658bbde1e99c72e7ca489621ba6686f2","impact_type":"both","incident_date":"2025-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cabinets%202000%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1486","org_country":"US","org_id":"94316a2d5ad7","org_name":"Cabinets 2000, LLC","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616428"},{"fetched_at":null,"title":"Leak-site claim by blackshrantac","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2FiaW5ldHMgMjAwMCBJbmNAYmxhY2tzaHJhbnRhYw"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cabinets%202000%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Cabinets 2000, LLC reported that a computer virus locked files and that some files were copied without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["blackshrantac"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"297be16811aea726fa50f6135f33baead75ff8c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35982.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65dd846c9d85","org_name":"Abri Credit Union","org_type":"unknown","ransomware":null,"records_affected":629,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35982.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7501d56d65b6a5a52ce9a60f9c6dd5b6aa1ddc9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dc4205c8aae1","org_name":"VeraBank, Inc.","org_type":"financial","ransomware":null,"records_affected":37318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004760"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-09-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9f56894065aeda41132ef90a45ea98932b35a40","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d23ef57132c","org_name":"Unity Hunt, Inc.","org_type":"other","ransomware":null,"records_affected":5333,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004761"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-10-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8204ab231e43b2f5102f69f8cdc9f478b0dd2530","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Adult%20Notice%20Letter%2813942321.1%29.pdf"},"notes":null,"org_country":"US","org_id":"7af0f2c1fc59","org_name":"Soapy Joe’s Car Wash","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Adult%20Notice%20Letter%2813942321.1%29.pdf"}],"summary":"Soapy Joe’s reported that an unauthorized actor may have obtained data containing personal information after unusual activity involving part of its corporate network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":"2024-12-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1aa119d77cdea2ff36c9b727a7f2620700b03fc","impact_type":"data_theft","incident_date":"2024-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rio%20Farms%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"c1e0d90e45bf","org_name":"Rio Farms, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rio%20Farms%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Rio Farms reported that files containing individuals’ information were downloaded without authorization between November 28 and December 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92afec512f4851f165e91a6136e1b98e7b193e01","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-12-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/12.29.2025...pdf"},"notes":null,"org_country":"US","org_id":"416e0a00e57e","org_name":"Oakland Smile Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616362"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/12.29.2025...pdf"}],"summary":"Oakland Smile Dental accidentally sent an email attachment containing a list of active patients and potentially exposed personal information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-10-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"8932297ba7b8395fc746217b93e9b3246219ef7f","impact_type":"data_theft","imported_from":null,"incident_date":"2025-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Microf%2C%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0f67e3524bef","org_name":"Microf, LLC","org_type":"financial","ransomware":null,"records_affected":38650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004758"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Microf%2C%20LLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Microf%2C%20LLC.pdf"}],"summary":"Microf reported that an unauthorized actor may have viewed or copied files containing individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9f43f1aea5baced70506896acbb4eef82903bdb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35969.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a635b4e805c","org_name":"Harnish Group Inc.","org_type":"unknown","ransomware":null,"records_affected":1435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35969.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-12-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"633a9b11e291865b68338e19e6a93ef28c94c21b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"157a21d6e119","org_name":"Foley & Lardner LLP","org_type":"other","ransomware":null,"records_affected":1934,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004759"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e074cfbd76795e7b95afb46340feb7c6352accfe","impact_type":"data_theft","incident_date":"2025-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35951.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"834fff7ec2c8","org_name":"Butler Tax & Accounting","org_type":"professional_services","ransomware":null,"records_affected":216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004755"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35951.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35951.pdf"}],"summary":"An unknown individual accessed a third-party software provider portal and downloaded information relating to Butler Tax clients.","supporting_quote":null,"technology_involved":["third-party software provider portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e21a6f17b3ba4317817ca85f2a01ecc18d046fcf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b33ef8c0ab70","org_name":"Associated Radiologists of the Finger Lakes, P.C.","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-29-associated-radiologists-of-the-finger-lakes-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-29","discovered_date":"2025-03-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"144c4c018045e37fa6454ee9f9469968ea78f8cc","impact_type":"unknown","incident_date":"2025-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e18d7a8e1cb9","org_name":"Apro, LLC d/","org_type":"unknown","ransomware":null,"records_affected":5860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Apro%2C%20LLC%20d/-2025-12-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-11-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a026ec47a12a0679637d08d7e14506449b14dd6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc05b9004dae","org_name":"Ameriprise Financial Services, LLC","org_type":"financial","ransomware":null,"records_affected":702,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004753"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-29","discovered_date":"2025-11-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"10e3faa9bc51cab2caa5b070b64c63b87d2fa9d4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fcb4eb16685f","org_name":"ABC Pest Control of Houston, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":442,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004762"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-28","discovered_date":"2025-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c666ec64ed4dc64881316a033358b69dbf60373c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pulse%20Urgent%20Care%20-%20Regulatory%20Notification%20Letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a0d7c2a57253","org_name":"Docs Medical Group, Inc. dba Pulse Urgent Care","org_type":"healthcare","ransomware":null,"records_affected":4035,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-28-docs-medical-group-inc-dba-pulse-urgent-care"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pulse%20Urgent%20Care%20-%20Regulatory%20Notification%20Letter%20%28CA%29_0.pdf"}],"summary":"Pulse Urgent Care reported suspicious activity in its network and said patient information may have been accessed.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6375b65c4e13312aca663f182644a5e7fc9e635f","impact_type":"data_theft","imported_from":null,"incident_date":"2025-09-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6ac9ac7aefaa","org_name":"WIRED","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WIRED","type":"hibp","url":"https://haveibeenpwned.com/Breach/WIRED"}],"summary":"WIRED user records were allegedly obtained from parent company Condé Nast and published online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"881ad5924be14d8f5b420033526851883a587fe4","impact_type":"data_theft","imported_from":null,"incident_date":"2019-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"c003f30bfa50","org_name":"Utair","org_type":"transportation_logistics","ransomware":null,"records_affected":401400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Utair","type":"hibp","url":"https://haveibeenpwned.com/Breach/Utair"}],"summary":"A breach of Utair exposed personal information, including email addresses, names, addresses, dates of birth, passport numbers, and loyalty program details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-26","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dce25fee44589479c58024e797e9da6d53512ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SO%20Patient%20Notification%20Letter%20-%20Front%20and%20Back.pdf"},"notes":null,"org_country":"US","org_id":"0c35114e70ca","org_name":"Share Ourselves","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616318"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SO%20Patient%20Notification%20Letter%20-%20Front%20and%20Back.pdf"}],"summary":"Share Ourselves notified patients that a cybersecurity incident at TriZetto Provider Solutions may have affected their personal and health information.","supporting_quote":null,"technology_involved":["TriZetto Provider Solutions"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4bb5be5625f82e3d537baacd084fc73fb602f0a1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"114e6a8accd1","org_name":"CareOregon","org_type":"healthcare","ransomware":null,"records_affected":6988,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-26-careoregon"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CareOregon-2025-12-26"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1598417313e83d644c275d7f5339f95d9d3ccd1","impact_type":"unknown","incident_date":"2025-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Galine%2C%20Frye%2C%20Fitting%20%26%20Frangos%2C%20LLP%20%20Notifies%20Affected%20Individuals%20of%20Information%20Security%20Incident%2837110714.1%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0684bd47f589","org_name":"Galine, Frye, Fitting & Frangos, LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616306"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2f7a7d351f7819cef3a1e8335dbb28dccc28cf3c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"03b98c549dfa","org_name":"Glendale Obstetrics & Gynecology PCA","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-24-glendale-obstetrics-gynecology-pca"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be398cca46f271186296a36b5518f94d3a37aabb","impact_type":"data_theft","imported_from":null,"incident_date":"2022-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"1a88964f045a","org_name":"Gemotest","org_type":"healthcare","ransomware":null,"records_affected":31000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Медицинская лаборатория Гемотест (Gemotest)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gemotest"}],"summary":"A data breach at Gemotest exposed patient information, including email addresses, names, addresses, dates of birth, passport numbers, and insurance numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-24","discovered_date":"2025-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"d771cba7756a6f8da0a5e1097fe8d6746335c950","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Coalesce%2C%20LLC%20dba%20Benefitelect%20%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"deffcdb8ad82","org_name":"Coalesce, LLC","org_type":"professional_services","ransomware":null,"records_affected":1396,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Coalesce%2C%20LLC%20dba%20Benefitelect-2025-12-24"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004929"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coalesce%2C%20LLC%20dba%20Benefitelect%20%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coalesce%2C%20LLC%20dba%20Benefitelect%20%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Coalesce, LLC reported unauthorized access to or possible exfiltration of files containing personal information between March 30 and March 31, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-23","discovered_date":"2025-08-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a2d315d1bc1c8b7d68c2b08dbb2004f62de0a386","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Spartanburg%20County%2C%20SC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2d700a511a2a","org_name":"Spartanburg County","org_type":"government","ransomware":null,"records_affected":9756,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Spartanburg%20County%2C%20SC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Spartanburg%20County%2C%20SC.pdf"}],"summary":"Spartanburg County identified unauthorized access on August 6, 2025, and later found that files had been copied without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-23","discovered_date":"2025-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eed244dc68b8485ffaad8fda6439797e0d791153","impact_type":"data_theft","incident_date":"2025-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21024.pdf"},"notes":null,"org_country":"US","org_id":"c40e0c854d9a","org_name":"Smith Fire Systems, Inc.","org_type":"other","ransomware":true,"records_affected":785,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21024.pdf"},{"fetched_at":null,"title":"Leak-site claim by anubis","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U21pdGggRmlyZSBTeXN0ZW1zQGFudWJpcw"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21024.pdf"}],"summary":"Smith Fire Systems, Inc. reported that an unauthorized actor accessed its systems and copied files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"claim_groups":["anubis"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce8571d2d82ee37be81180475e6ebf6c7a482848","impact_type":"unknown","incident_date":"2025-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PAC_-_Redacted_AG_Notice_37321123v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89bcbb670249","org_name":"Premier Auto Credit","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616215"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"713bf65db2a10108417d7003c25c6e3c857991e9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TriZetto%20Data%20Breach%20Notification%20Letter%2012.22.2025%20-%20scanned.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1bc721032f4e","org_name":"Gardner Health Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616228"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"60466d54764983803bbf71905152137975c16e40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c88cd0987be4","org_name":"AllerVie Health","org_type":"healthcare","ransomware":null,"records_affected":80521,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-23-allervie-health"},{"fetched_at":null,"title":"Leak-site claim by anubis","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWxsZXJWaWUgSGVhbHRoQGFudWJpcw"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["anubis"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-22","discovered_date":"2025-12-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c16935181a6c11eac10863250bc92b5dba1b99e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6166a3c1018b","org_name":"Topstep LLC","org_type":"other","ransomware":null,"records_affected":1920,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004752"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-22","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90c82a02fc0ed9fd0809eee85e98d2eb4f47fde0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-06","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tapestry%20-%20Individual%20Notice%20Letter%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"5842b56956b6","org_name":"TapestryHealth","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A contracted employee may have allowed an unidentified individual to perform some job duties and see patients’ personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tapestry%20-%20Individual%20Notice%20Letter%20-%20CA.pdf"}],"summary":"TapestryHealth reported that a contracted employee may have allowed an unidentified individual to perform job duties and view patients’ personal and medical information.","supporting_quote":"This means that the employee may have allowed an unidentified individual to do some of their job duties and see certain patients’ personal information between November 6, 2024 and November 3, 2025 .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-22","discovered_date":"2024-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2962e5f81221281d02cd2b4678ef07c6217ee1f6","impact_type":"data_theft","incident_date":"2024-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sax_%20Reg%20Notice%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"988977c39199","org_name":"Sax LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616199"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sax_%20Reg%20Notice%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004754"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Sax%2C%20LLP.pdf"}],"summary":"Sax LLP reported that personal information may have been viewed or acquired without authorization after suspicious activity was detected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-12-22","discovered_date":"2025-11-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56ba27c01589058897562687cc59705b13f95228","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad1315fb59e4","org_name":"Herrman & Herrman PLLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":14124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004749"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-12-22","discovered_date":"2025-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f65e7e2fda616f15c5bcbb06012a3720d6ab47c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f9a8b8028aa","org_name":"Heart of Texas Behavioral Health Network","org_type":"healthcare","ransomware":null,"records_affected":1309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004751"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-22","discovered_date":"2025-11-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d43b21d69c881dd0c2632cd02b4a5f23b929b207","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"957b0cdddd00","org_name":"Garland ISD","org_type":"education","ransomware":null,"records_affected":33126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004745"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-22","discovered_date":"2025-11-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"09f919c4f2f7a6e51f48fd0e895b3c7f8b38c9fa","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9350a27ad3b","org_name":"Fyzical Acquisition Holdings, LLC","org_type":"other","ransomware":null,"records_affected":43045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004748"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-22","discovered_date":"2024-10-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"adfbcf0f068e3f4ca78fa61e6504eddf045e5c21","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15789057d72f","org_name":"Event Rental Systems","org_type":"unknown","ransomware":null,"records_affected":311,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Event%20Rental%20Systems-2025-12-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-21","discovered_date":"2025-11-21","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9068ee8893a127f52009884dc01e4115195f57c4","impact_type":"data_theft","incident_date":"2025-08-13","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/University%20of%20Phoenix%20-%20Regulatory%20Notice%20Letter%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e2a4d3213264","org_name":"University of Phoenix, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a previously unknown software vulnerability in Oracle EBS.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/University%20of%20Phoenix%20-%20Regulatory%20Notice%20Letter%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004750"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20of%20Phoenix%2C%20Inc.-2025-12-21"}],"summary":"An unauthorized third party exploited a previously unknown Oracle EBS vulnerability to exfiltrate data from the University’s Oracle EBS environment.","supporting_quote":"We determined that, like many other organizations, including other colleges and universities, an unauthorized third- party exploited a previously unknown software vulnerability in Oracle EBS to exfiltrate certain data from within the University’s Oracle EBS environment.","technology_involved":["Oracle E-Business Suite (Oracle EBS)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-19","discovered_date":"2025-07-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3020b077ad4b919435aae3fe6fac2582a38277c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd855b4fdf7b","org_name":"Wright Titus Agency","org_type":"financial","ransomware":null,"records_affected":1941,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004738"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"776487a08d1e5ae32e159c0ae1489d226804b161","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d919cb695629","org_name":"Reproductive Medicine Associates of Michigan","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-19-reproductive-medicine-associates-of-michigan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-12-19","discovered_date":"2025-12-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"75fa192d4971ed60d29888356338645ba1a07539","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8fc366ed4bf5","org_name":"People's Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004898"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004742"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-19","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0d1ead68f750751ae719e1a7d86aecd97e06bb06","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35926.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0331446b37b6","org_name":"Outdoor Smart","org_type":"retail_ecommerce","ransomware":null,"records_affected":652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35926.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35926.pdf"}],"summary":"Outdoor Smart identified unauthorized code on the Campfire Collective website that may have captured customers’ payment card information.","supporting_quote":null,"technology_involved":["Campfire Collective website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-19","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50b839d7a37fb17a292b20c51b6ce8771523a1da","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OutdoorSmart%20-%20California%20Regulator%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"0331446b37b6","org_name":"Outdoor Smart! Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616038"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OutdoorSmart%20-%20California%20Regulator%20Notification%20Letter_1.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004777"}],"summary":"Outdoor Smart identified unauthorized code on its Campfire Collective website that may have captured customers’ names and payment card information.","supporting_quote":null,"technology_involved":["Campfire Collective website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"902c78e5512734629a0fd3f40cef552a4ac1dfbd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3635909b1f8c","org_name":"Mitchell County Department of Social Services","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-19-mitchell-county-department-of-social-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e3b53aa92038844e9605efbac20baeb3e6d3bdd4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79c844379406","org_name":"Medical Center, LLP","org_type":"healthcare","ransomware":null,"records_affected":32090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-19-medical-center-llp"},{"fetched_at":null,"title":"Leak-site claim by pear","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWVkaWNhbCBDZW50ZXIsIExMUEBwZWFy"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["pear"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-19","discovered_date":"2025-11-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3c93167e83e8f878b9521d5e838f0ce63df263e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"309a4a779238","org_name":"Eckerd Youth Alternatives Inc.","org_type":"nonprofit","ransomware":null,"records_affected":68585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004737"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-19","discovered_date":"2024-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d39a3f350792c18b3777e24464946481a3566e56","impact_type":"data_theft","incident_date":"2024-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36840.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0c0280f86ca4","org_name":"Drivestream, Inc.","org_type":"professional_services","ransomware":null,"records_affected":91108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Drivestream%2C%20Inc.-2026-03-31"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36840.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616043"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Drivestream%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36840.pdf"}],"summary":"An unauthorized actor accessed certain systems in Drivestream’s data center and downloaded files; the method of access was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8fcc347cff0b681f7e0827700bc9cadc453e611","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Baker%20University%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"5818a0ea5edb","org_name":"Baker University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616031"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Baker%20University%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004746"}],"summary":"Baker University reported unauthorized access to files and folders, with a resulting network outage and possible exposure of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a109484661408e69a19f5304229a9cf275cfab09","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adamson%20Ahdoot%2C%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e0c98597aeeb","org_name":"Adamson Ahdoot LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adamson%20Ahdoot%2C%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"A third-party vendor may have permitted unauthorized access to Adamson Ahdoot LLP cloud-hosted firm documents.","supporting_quote":"In November 2025, we learned that a third-party vendor with authorized access to certain cloud-hosted firm resources may have unintentionally permitted, directly or indirectly, unauthorized access to cloud-hosted firm documents.","technology_involved":["cloud-hosted firm documents"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a83b5b0467308581e74af1c246a5c3f39ebd219a","impact_type":"unknown","incident_date":"2024-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Veradigm%20Notice%20Letter_9.22.25_Redacted_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d706c963ff3","org_name":"Veradigm LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615974"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004743"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Veradigm%20LLC-2025-12-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ea778c36481abbbfab8f9281831d83f97ce5856","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"db4798362ae9","org_name":"The Botting Network","org_type":"other","ransomware":null,"records_affected":96320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Botting Network","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheBottingNetwork"}],"summary":"The Botting Network forum suffered a data breach that exposed user email addresses, usernames, dates of birth, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"59aab52a0266a31f42a8e7af82d6cd9992fca221","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61e9b9d4ff39","org_name":"North East Medical Services","org_type":"healthcare","ransomware":null,"records_affected":91513,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-18-north-east-medical-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-18","discovered_date":"2025-08-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa2868427371f4a34d574414d53b3e1e6773ac75","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Conifer%20-%20Individual%20Notice%20Letters%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"22b3b0a0612f","org_name":"Conifer Value-Based Care, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615985"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Conifer%20-%20Individual%20Notice%20Letters%20-%20CA.pdf"}],"summary":"An unauthorized third party accessed an employee’s Microsoft Office 365-hosted business email account on August 28 and 29, 2025, and personal information may have been involved.","supporting_quote":null,"technology_involved":["Microsoft Office 365","business email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af6d4b155110851faddfd3584300cf3af2473c2a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-03-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"04031f671b03","org_name":"AUTOSUR","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AUTOSUR","type":"hibp","url":"https://haveibeenpwned.com/Breach/AUTOSUR"}],"summary":"AUTOSUR disclosed a breach involving customer contact and vehicle information in March 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-18","discovered_date":"2025-07-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a204ad51657361cac3dc8421982eb7f434ae2cca","impact_type":"data_theft","incident_date":"2025-07-14","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35900.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e409e7fe7472","org_name":"Albertsons Companies","org_type":"retail_ecommerce","ransomware":null,"records_affected":515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35900.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35900.pdf"}],"summary":"Albertsons detected unauthorized access to its customer relationship management application and determined that personal data may have been obtained.","supporting_quote":null,"technology_involved":["customer relationship management application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ae7c23224b44420c98ca2ad6c71788799a1e01c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4a45c117412a","org_name":"Web Hosting Talk","org_type":"other","ransomware":null,"records_affected":515149,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Web Hosting Talk","type":"hibp","url":"https://haveibeenpwned.com/Breach/WebHostingTalk"}],"summary":"A breach of the Web Hosting Talk vBulletin forum exposed user records that were subsequently listed for sale.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-12-17","discovered_date":"2025-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8772c8b8108765e95ad9cc71e5909b825bafe91b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b6816fdd23ae","org_name":"Parexel International, LLC (“Parexel”)","org_type":"other","ransomware":null,"records_affected":65587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004736"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-17","discovered_date":"2025-10-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b756f3ebf0f6fffb9333e78bd846d0af02dcc853","impact_type":"unknown","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Parexel%20International%202%20YR%20CM%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"41093a7c20d8","org_name":"Parexel International, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day exploit impacting Oracle's cloud infrastructure affected Parexel's Oracle OCI E-Business Suite environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Parexel%20International%202%20YR%20CM%20Proof.pdf"}],"summary":"Parexel detected suspicious activity in its Oracle OCI E-Business Suite environment hosted by Oracle, which its investigation attributed to a zero-day exploit affecting Oracle cloud infrastructure.","supporting_quote":"Our investigation has confirmed the activity stemmed from a zero-day exploit impacting Oracle’s cloud infrastructure that was announced by Oracle on October 5, 2025.","technology_involved":["Oracle OCI E-Business Suite","Oracle cloud infrastructure"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deaf0bd54f33868da31c75de92b640f7d38e20c9","impact_type":"unknown","incident_date":"2025-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/News-Press_%26_Gazette_Company_Notice_Letter_%5Bredacted%5D_37294684v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe22882b5688","org_name":"News-Press & Gazette Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615906"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004735"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#News-Press%20%26%20Gazette%20Company-2025-12-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-17","discovered_date":"2025-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9f91d78fc25a0c8e696b70c04247ad31d4d591a","impact_type":"both","incident_date":"2025-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McIntosh%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"fe3de91b7d74","org_name":"McIntosh Laboratory, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615917"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McIntosh%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"}],"summary":"McIntosh detected suspicious activity and a disruption to access to some digital systems, and determined that an attacker acquired data including names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-17","discovered_date":"2025-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"919b17616cb65796b8d85c4c87f564776c1f46cc","impact_type":"data_theft","incident_date":"2025-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Important%20Notice%20of%20Data%20Breach%20%20Lonich%20Patton%20Ehrlich%20Policastri%20PC.pdf"},"notes":null,"org_country":"US","org_id":"308e270896f4","org_name":"Lonich Patton Ehrlich Policastri","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615913"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TG9uaWNoIFBhdHRvbiBFaHJsaWNoIFBvbGljYXN0cmlAcWlsaW4"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Important%20Notice%20of%20Data%20Breach%20%20Lonich%20Patton%20Ehrlich%20Policastri%20PC.pdf"}],"summary":"Lonich Patton Ehrlich Policastri discovered unauthorized access to firm systems containing client information, which may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-16","discovered_date":"2025-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a71365c2d6ef20fe0fb2ca4049b3a7073b2baeb5","impact_type":"unknown","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPS%20Letter%20to%20Affected%20Business%20Partners.pdf"},"notes":null,"org_country":"US","org_id":"95358c06c20e","org_name":"Friends of Family Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPS%20Letter%20to%20Affected%20Business%20Partners.pdf"}],"summary":"Friends of Family Health Center was among the providers affected by a security incident at TriZetto Provider Solutions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TriZetto Provider Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7e4d63693e63","name":"TriZetto Provider Solutions"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-16","discovered_date":"2025-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8929348472dcb701a5092e46713af8390da98883","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-18","initial_access":"insider","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0699a9f572f9","org_name":"Coupang, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1834584/000183458425000196/cpng-20251215.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1834584/000183458425000202/cpng-20251215.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1834584/000183458425000202/a8-kamendmenttoitem105ex991.htm"}],"summary":"Coupang disclosed that a former employee may have obtained personal data associated with up to 33 million customer accounts.","supporting_quote":"Based on investigative findings, Coupang has determined that a former employee may have obtained the name, phone number, delivery address, and email address associated with up to 33 million customer accounts, and certain order histories for a subset of the impacted accounts.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"price":{"ticker":"CPNG","base_day":"2025-12-16","returns":{"1":{"day":"2025-12-17","raw":-0.0203,"adj":-0.0093},"5":{"day":"2025-12-23","raw":-0.0328,"adj":-0.0462},"21":{"day":"2026-01-16","raw":-0.0888,"adj":-0.1077},"63":{"day":"2026-03-19","raw":-0.1686,"adj":-0.1405},"126":{"day":"2026-06-18","raw":-0.2238,"adj":-0.3238}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-15","discovered_date":"2025-05-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f96280c400697c302e4108873a0de3c0ae98ce2f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TorHoerman%20Sample%2024%20month%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"3a0441a1580a","org_name":"TorHoerman Law, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615821"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TorHoerman%20Sample%2024%20month%20Consumer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004739"}],"summary":"TorHoerman Law reported unauthorized access to an employee email account containing files with personal information, with no indication that the information was viewed, acquired, or misused.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-15","discovered_date":"2025-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"052ffe6d1dc53b237707996bad89cac9af21d475","impact_type":"data_theft","incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35874.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"44421d37dfad","org_name":"NAHGA Claim Services","org_type":"professional_services","ransomware":null,"records_affected":1621,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35874.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35874.pdf"}],"summary":"NAHGA Claim Services reported that files containing some individuals' information may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-15","discovered_date":"2025-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c5280f3bbadd5b67c7c1f3369359969ca6fc576","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LKQ%20-%20Sample%20Individual%20Notice%20%2812%2015%2025%29_0.pdf"},"notes":null,"org_country":"US","org_id":"996b7dd908c3","org_name":"LKQ Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third party exploited a previously unknown vulnerability in Oracle E-Business Suite.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615804"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LKQ%20-%20Sample%20Individual%20Notice%20%2812%2015%2025%29_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004733"}],"summary":"A third party exploited vulnerabilities in LKQ's Oracle E-Business Suite environment, affecting supplier personal information.","supporting_quote":"In early October, our security team became aware of a third party exploiting these vulnerabilities.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b01d82e54a6e4897af45518ec82f48aab3fc673","impact_type":"data_theft","imported_from":null,"incident_date":"2025-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ERS%20-%20Sample%20Individual%20Notice%20%2812%2015%2025%29.pdf"},"notes":null,"org_country":"US","org_id":"8be1bd98ac8c","org_name":"Fullsteam Software Holdings LLC d/b/a Event Rental Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ERS%20-%20Sample%20Individual%20Notice%20%2812%2015%2025%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004732"}],"summary":"Event Rental Systems reported that unauthorized code on some customer websites collected names, contact information, and payment card details.","supporting_quote":null,"technology_involved":["customer websites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"809334ce94ca5072c0002fcdc0c97ef674e13a74","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"913cd5d46e72","org_name":"FPMCM LLC","org_type":"professional_services","ransomware":null,"records_affected":2072,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-15-fpmcm-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-11-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"998b776a958da067c501189e88ecb812d32c3e3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3336e412f2df","org_name":"Wharton Independent School District","org_type":"education","ransomware":null,"records_affected":1302,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004727"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-12","discovered_date":"2025-07-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eda024f393eb2f3da1191db5ebfeac33944801ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wedbush%20Securities%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2ff70fdb83b8","org_name":"Wedbush Securities Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A web-facing internal application was misconfigured, making unauthorized access possible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615706"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wedbush%20Securities%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"}],"summary":"Wedbush Securities reported that a misconfigured web-facing internal application may have allowed unauthorized access to client data containing personal and financial information.","supporting_quote":"On or around July 11, 2025, Wedbush Securities discovered that one of its web facing internal applications was misconfigured making un authorized access possible.","technology_involved":["web-facing internal application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf5927bff479793a339a067437fbdfe09db8a19a","impact_type":"data_theft","incident_date":"2025-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RR_Redacted%20US%20letter.pdf"},"notes":null,"org_country":"US","org_id":"3241ea1fe9f8","org_name":"Rockrose Development L.L.C.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RR_Redacted%20US%20letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004728"}],"summary":"Rockrose Development reported unauthorized access to its systems and said the individuals claimed to have acquired confidential information that may have included personal, financial, medical, and account-credential data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"52d22876b2e3f9c698034b283672d02a8f19ece7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8dcb7b48346","org_name":"OCAT, LLC dba Evoke Wellness at Hilliard","org_type":"healthcare","ransomware":null,"records_affected":1629,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-12-ocat-llc-dba-evoke-wellness-at-hilliard"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-06-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a26ac947ffc118f87a19de9aa9f95d8879e1e0e5","impact_type":"data_theft","incident_date":"2025-06-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35863.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d892a22790a4","org_name":"Lydig Construction, Inc.","org_type":"other","ransomware":null,"records_affected":2397,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35863.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35863.pdf"}],"summary":"Lydig Construction, Inc. discovered suspicious activity and determined an unauthorized actor acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-12","discovered_date":"2025-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2833a9e2122f1973c81275ae58ea0bac50f465f3","impact_type":"data_theft","incident_date":"2025-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b0431048c101","org_name":"James J. Lynch, MD Ltd. Dba Swift Institute","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615654"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20Consumer%20Notice.pdf"}],"summary":"Swift Institute reported that files containing personal or protected health information may have been copied by an unauthorized individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e1a076c0d342fc94e95e1bc6f77dc48b833d0be5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"45cb2e165a2b","org_name":"Heywood Healthcare Inc. including Henry Heywood Memorial Hospital, Athol Memorial Hospital, and Heywood Medical Group, Inc. (“Heywood”)","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-12-heywood-healthcare-inc-including-henry-heywood-memorial-hospital-athol-memorial-"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-07-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"87adfff581dfc4879a71f9d4efe67a0214c2bd6d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2772fdf7e386","org_name":"Fort Worth Club of Fort Worth Texas","org_type":"retail_ecommerce","ransomware":null,"records_affected":842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004726"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6981e2ec494e56a419f35f1b9b9128c9f10cd8ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_5.pdf"},"notes":null,"org_country":"US","org_id":"a34da691f0ec","org_name":"Donaghy Sales LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_5.pdf"}],"summary":"Donaghy Sales reported unauthorized access to its email environment and said files potentially containing personal information may have been acquired.","supporting_quote":null,"technology_involved":["corporate email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-09-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eeb3bf87eb2dc40b517f3e2af8f84bc4600177d8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a092b44cd019","org_name":"City of Houston","org_type":"government","ransomware":null,"records_affected":7525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004725"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddb85654e4d91250b5ee372d64f59752f3d920ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_16_0.pdf"},"notes":null,"org_country":"US","org_id":"09bee3e70bbe","org_name":"Catwig LLC d/b/a Victory Disability","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_16_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004730"}],"summary":"An unknown party accessed part of Victory's environment and may have viewed or copied personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-03-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82867e8152149be33f20b14d84466e8643f30388","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bdfa085ca397","org_name":"CareNexa, LLC","org_type":"healthcare","ransomware":null,"records_affected":258874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004723"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b469fc539b6fad88de907dea0704bd777b30f896","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a22660e58772","org_name":"Baltimore Medical System, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-12-baltimore-medical-system-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6236161a5cc4b1268712b8314c0e8bd7d996eed5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"331a23be0afc","org_name":"Atrium Centers Inc.","org_type":"healthcare","ransomware":null,"records_affected":4943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-12-atrium-centers-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-12","discovered_date":"2025-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4439ba0550046946d176cf5902a8f5686c4ed42","impact_type":"data_theft","incident_date":"2025-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/700Credit%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"},"notes":null,"org_country":"US","org_id":"6e532a030584","org_name":"700Credit, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/700Credit%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004729"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#700Credit%2C%20LLC-2025-12-12"}],"summary":"700Credit reported that records in its web application containing personal information were copied without authorization.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-12-11","discovered_date":"2024-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f7ab7a573ace68d68ae8f6a156656c5a7f9083c","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/12M%20Sample%20Notice%20-%20WCC.pdf"},"notes":null,"org_country":"US","org_id":"203343125a60","org_name":"Wilmington Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615600"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/12M%20Sample%20Notice%20-%20WCC.pdf"}],"summary":"Wilmington Community Clinic reported that an unauthorized actor may have acquired personal information during a systems compromise discovered on August 13, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bccfa8e2457773c40c049fa99a4b8344624fadc","impact_type":"unknown","incident_date":"2025-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Rain%20Bird%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5dcb8c6c36ec","org_name":"Rain Bird Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615594"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004724"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rain%20Bird%20Corporation-2025-12-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-11","discovered_date":"2025-06-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e77f0deee27232cb44e8c23fca59c4ae573567b2","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35851.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e0ec44afdc73","org_name":"Morningside","org_type":"unknown","ransomware":null,"records_affected":1534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35851.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35851.pdf"}],"summary":"Morningside reported that certain personal information may have been accessed and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-10","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a2eb1e3bba00ba9e37a743cd5de537508437f23","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"361dc54d383b","org_name":"Wheels Up Partners LLC","org_type":"other","ransomware":null,"records_affected":5710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004720"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-10","discovered_date":"2025-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f5cbc5fab84fa4d6eab90b53428f0eb86429c12","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MTL%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"21b44342448a","org_name":"Molecular Testing Labs","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615546"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MTL%20Notice%20Letter.pdf"}],"summary":"A data hosting and security vendor retained by Molecular Testing Labs experienced a cybersecurity incident that impacted MTL systems and data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-10","discovered_date":"2025-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22e9b7b31876c6be9e9e5db7fa389011baeaabad","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-02","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cerenade%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7abcb791780a","org_name":"Jewish Family and Community Services- East Bay","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615566"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cerenade%20Breach%20Letter.pdf"}],"summary":"Jewish Family and Community Services- East Bay reported that client immigration case information stored with Cerenade was involved in a breach of the vendor's service platforms.","supporting_quote":"On Oct 9, 2025 we were noƟfied by Cerenade that their service plaƞorms had been breached.","technology_involved":["Cerenade"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cerenade"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7cf38d98d376","name":"Cerenade"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31741f1786d4a1bb21aa63f61e21d11389fcd24","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-18","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-25775_East_Bay_Ad_CM_Letter_A_r2prf_-_redacted_37261331v1.pdf"},"notes":null,"org_country":"US","org_id":"e86f893463fb","org_name":"East Bay Regional Park District","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615558"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-25775_East_Bay_Ad_CM_Letter_A_r2prf_-_redacted_37261331v1.pdf"}],"summary":"An employee emailed an attachment containing personal information to their personal email account, resulting in an unauthorized disclosure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-10","discovered_date":"2025-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8723ff58a6130dbc4b75142f47694448c6c73d50","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35838.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ead7a61f7ea9","org_name":"City of Puyallup","org_type":"government","ransomware":null,"records_affected":2620,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35838.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35838.pdf"}],"summary":"The City of Puyallup notified subscribers that a cybersecurity incident at CodeRed may have exposed their personal information.","supporting_quote":null,"technology_involved":["CodeRed"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CodeRed"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"fecb6c22df7e","name":"CodeRed"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8ebf25521002d462d7e166da8c7d63ad0f43254e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"262e82496e9e","org_name":"Centric Health","org_type":"healthcare","ransomware":null,"records_affected":6855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-10-centric-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8c1789e84e0cc71822b02573ea2f748ebc17e172","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0bbea139bf8","org_name":"Southern Oregon Neurosurgical and Spine Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-09-southern-oregon-neurosurgical-and-spine-associates-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-09","discovered_date":"2025-09-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"171e8096a226a8e5494a79db502935210caf5498","impact_type":"data_theft","incident_date":"2025-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%2812%2009%2025%29.pdf"},"notes":null,"org_country":"US","org_id":"3104b05861e9","org_name":"Prosper Marketplace","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615331"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%2812%2009%2025%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004717"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Prosper%20Marketplace%2C%20Inc.-2025-12-09"}],"summary":"Prosper Marketplace reported that personal information was obtained through queries on company databases between June and August 2025.","supporting_quote":null,"technology_involved":["company databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ccdda7dfc3e4ae074d9c6028a9c60ff6e71de76a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f96612c13d2a","org_name":"Ochsner LSU Health – Regional Urology","org_type":"healthcare","ransomware":null,"records_affected":4519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-09-ochsner-lsu-health-regional-urology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-09","discovered_date":"2025-11-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b95283bea07dfc558a665896af03b389cac2710b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4cd3f496dfc3","org_name":"NCH Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":3912,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004713"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1a652013631420c9a88d0ca0c25e445ce2057def","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b66a7baeca2e","org_name":"Green Imaging, LLC","org_type":"healthcare","ransomware":null,"records_affected":29517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-09-green-imaging-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-09","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c984c84fb38835d252ac3e2d2f5b0264cb74b40c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbd5cdb19030","org_name":"Farmers Insurance Exchange, Farmers Group, Inc. (its attorney-in fact), and their subsidiaries and affiliates","org_type":"financial","ransomware":null,"records_affected":1071300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004712"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-09","discovered_date":"2025-12-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46013ea3f8543fe51c234683ec15da3c248c7186","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-12-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bcc965cfe087","org_name":"Alvin Community College","org_type":"education","ransomware":null,"records_affected":329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004716"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-12-09","discovered_date":"2025-11-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9bdaaec567522282ade8b1f322db2d792410de39","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a232685a8493","org_name":"Advanced Healthcare Professionals","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004715"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fb3f63e37770481dd769e3768eccf7331d8fcc5c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"47340d9ef6c1","org_name":"Vida Y Salud-Health Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":35236,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-08-vida-y-salud-health-systems-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004770"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5cf86c37e0ed0cd1ee6d4badca177d1b4290ce5a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bae20c854172","org_name":"TriCity Family Services","org_type":"healthcare","ransomware":null,"records_affected":2511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-08-tricity-family-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-08","discovered_date":"2025-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"e96fec9c50e4e797c01042a2d5d3e26ae31c8007","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Evolve%20Mortgage%20Services%2C%20LLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3a53024aebde","org_name":"Evolve Mortgage Services, LLC","org_type":"financial","ransomware":true,"records_affected":175,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Evolve%20Mortgage%20Services%2C%20LLC.pdf"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RXZvbHZlIE1vcnRnYWdlIFNlcnZpY2VzQGluY3JhbnNvbQ"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Evolve%20Mortgage%20Services%2C%20LLC.pdf"}],"summary":"Evolve Mortgage Services identified suspicious activity and determined that information was subject to unauthorized access between September 17 and September 24, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03a37cda5f4a64ce17b739a43fd60ca4d3dbf0c0","impact_type":"data_theft","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CNHI%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"55804865a683","org_name":"CNHI, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615267"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CNHI%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004714"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20CNHI%2C%20LLC.pdf"}],"summary":"CNHI, LLC reported unauthorized access to its computer network and the theft of files containing names paired with Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f01c9e370673f8834405ed916af4a8193ae235b5","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"7f1d3517f5b9","org_name":"KinoKong","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KinoKong","type":"hibp","url":"https://haveibeenpwned.com/Breach/KinoKong"}],"summary":"KinoKong suffered a data breach that exposed email addresses, names, usernames, IP addresses, and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-12-05","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"43b4020dc004a8f1a11630437529a9dea6a1bf5c","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b48964b69dc","org_name":"Petco Animal Supplies Stores, Inc. (“Petco”)","org_type":"other","ransomware":null,"records_affected":2159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004707"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-05","discovered_date":"2025-08-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e4cc6c9a299d396521ba95471b55eddede8d9ff3","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4af92f172994","org_name":"MAG DS Corp.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4280,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004710"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-12-05","discovered_date":"2024-10-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cfeea9ce1e8ec6e476f2a25a386066ab68911c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Email%20-%20Finalpdf_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"c4578a9fd490","org_name":"Housing Authority of the City of Los Angeles","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Email%20-%20Finalpdf_Redacted.pdf"}],"summary":"The Housing Authority of the City of Los Angeles identified unauthorized access to its systems in October 2024, and personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-05","discovered_date":"2025-11-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cde15101d10143ff039da4bd1999999a2f5e91c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3ebdf268a13","org_name":"Drury Southwest, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1201,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004708"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1dfddd8c2ae95fce052238d21706784a33c18ae6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8f03e7aba6b1","org_name":"Columbia Medical Practice","org_type":"healthcare","ransomware":null,"records_affected":94131,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-05-columbia-medical-practice"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q29sdW1iaWEgTWVkaWNhbCBQcmFjdGljZUBxaWxpbg"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-05","discovered_date":"2025-12-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0deb46bd90bf28b7cd0caff04b03becd4a55124","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c3694f65897","org_name":"Bleyl Interests Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":314,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004711"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"1830a5e569bd42b1d80199dec2a6b407fcd73a03","impact_type":"data_theft","incident_date":"2025-08-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20%20Anderson%20Bancshares%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1c0ec37582de","org_name":"Anderson Bancshares, Inc.","org_type":"financial","ransomware":null,"records_affected":3079,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20%20Anderson%20Bancshares%2C%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20%20Anderson%20Bancshares%2C%20Inc..pdf"}],"summary":"An unauthorized third party accessed and obtained personal information maintained by Marquis that may have affected Anderson Brothers Bank customers.","supporting_quote":"Anderson Brothers Bank recently learned that an unauthorized third party gained access to and obtained data that was maintained by a vendor, Marquis.","technology_involved":["Marquis"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Marquis"},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"bcd290cbe0a6","name":"Marquis"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"eb22259370621ff05a61f8660ac06b50a2de54e7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d2d3f1acf260","org_name":"AgeRight Clinical Services","org_type":"healthcare","ransomware":null,"records_affected":4859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-05-ageright-clinical-services"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AgeRight%20Clinical%20Services-2025-11-21"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-04","discovered_date":"2025-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d07c5bb0847f656cfe6c3172d6b28046fddacc5a","impact_type":"data_theft","incident_date":"2025-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Healthcare%20Interactive%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"c5877fd308f9","org_name":"Healthcare Interactive, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Healthcare%20Interactive%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004709"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Healthcare%20Interactive%2C%20Inc.-2026-01-07"}],"summary":"An unauthorized actor copied files from Healthcare Interactive, Inc.'s computer network between July 8 and July 12, 2025, and personal information was potentially acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"49e65b11cdde1b366b790afa1f8f2ba8cc42d769","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31e74562e1b0","org_name":"Greater St. Louis Oral & Maxillofacial Surgery PC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-04-greater-st-louis-oral-maxillofacial-surgery-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1b3c50409c95ecccb0ea7fb7840daaa88c4f0b03","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35772.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d9d8e1bfb2c","org_name":"Anchor Computer  (MacKenzie-Childs)","org_type":"unknown","ransomware":null,"records_affected":3275,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35772.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-12-03","discovered_date":"2025-11-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5849af8304fc2cd973c4086170e098c0062c467a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20The%20University%20of%20Pennsylvania.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53cb51196f94","org_name":"The University of Pennsylvania","org_type":"education","ransomware":null,"records_affected":442500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004699"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20The%20University%20of%20Pennsylvania.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8ea1fa24a4797c73c8d0231e9e509a4bb4c4f1f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Petco%20PetPass_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"061763e75904","org_name":"Petco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A setting within one software application inadvertently allowed certain files to be accessible online.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Petco%20PetPass_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Petco discovered that a setting in a software application allowed certain files to be accessible online and corrected the issue.","supporting_quote":"We recently identified and took measures to address a setting within one of our software applications that inadvertently allowed certain files to be accessible online .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"95440712bac577b76a6758038f671014b953f285","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"059b16ac87f9","org_name":"MedStar Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":64332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-03-medstar-health-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-03","discovered_date":"2025-10-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9ab67f0e5f36a035f194a5df78866fa39f763ef4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f9ff60146a4","org_name":"Dallas County MHMR","org_type":"healthcare","ransomware":null,"records_affected":8599,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004702"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"25600aed457b83a36b27f55939b596a46ec8a862","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fdb5abfe045e","org_name":"West Texas Health, PLLC","org_type":"professional_services","ransomware":null,"records_affected":73720,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-02-west-texas-health-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-02","discovered_date":"2025-11-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d60b5cda012dae4d285fe31e96beea4b23f9992","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc985151eb14","org_name":"Theology of the Body Evangelization Team","org_type":"nonprofit","ransomware":null,"records_affected":4472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004695"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-12-02","discovered_date":"2025-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ca03d613f5e840f95818218d02710596da6ffb5c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"US","org_id":"69747ab6c211","org_name":"Phoenix Education Partners, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a previously unknown software vulnerability in Oracle EBS to copy data from the Company's Oracle EBS environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1600222/000095014225003098/eh250711375_8k.htm"}],"summary":"Phoenix Education Partners reported that an unauthorized third party exploited a previously unknown Oracle EBS vulnerability to copy data containing personal and financial information.","supporting_quote":"The Company is one of a number of organizations, including other academic institutions, from which an unauthorized third-party exfiltrated data by exploiting a previously unknown software vulnerability in Oracle EBS.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}],"price":{"ticker":"PXED","base_day":"2025-12-02","returns":{"1":{"day":"2025-12-03","raw":-0.0289,"adj":-0.0324},"5":{"day":"2025-12-09","raw":-0.0618,"adj":-0.0641},"21":{"day":"2026-01-02","raw":-0.1583,"adj":-0.1607},"63":{"day":"2026-03-05","raw":-0.1353,"adj":-0.135},"126":{"day":"2026-06-04","raw":-0.1152,"adj":-0.226}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-02","discovered_date":"2025-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e56b8dee769a8477a8a80a94f0f34355ed60139","impact_type":"data_theft","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Consumer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"377f3cfa4162","org_name":"Marquis Software Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618568"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614933"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Consumer%20Notification_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004697"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Marquis%20Software%20Solutions.pdf"}],"summary":"Marquis Software Solutions reported that an unauthorized third party accessed its environment and may have acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-12-02","discovered_date":"2025-09-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02db8d0b7782db458720a1767627ac80957c115c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9d288a75fb99","org_name":"Madison Partners LLC","org_type":"other","ransomware":null,"records_affected":424,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004698"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93fec8403ecf8ba807b25074bcfec0b2d0ca9e9a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1ae48cf7e8e","org_name":"Madison Healthcare Services","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-02-madison-healthcare-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-12-02","discovered_date":"2025-09-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2704806091027d85cb586648578898686d2c5355","impact_type":"unknown","incident_date":"2025-09-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20b3356d4899","org_name":"Kayali & CO., P.A.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kayali%20%26%20CO.%2C%20P.A.-2025-12-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-12-02","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a490497642a19f9336b180396c532aeef5381b52","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e672de5337d","org_name":"CoVantage Credit Union","org_type":"financial","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004696"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a850fe223cedc3cb9a5b4ef52fc5cad8d4de4bf","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5637be833413","org_name":"Zilvia.net","org_type":"other","ransomware":null,"records_affected":287863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zilvia.net","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zilvia"}],"summary":"Data from Zilvia.net’s vBulletin-based car forum was leaked, exposing email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-01","discovered_date":"2025-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd4652a832ba2657757da7759b9b608326082f4e","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Penn%20-%20CA%20Notice%20Template%20Proof%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"473aa2db02b4","org_name":"University of Pennsylvania","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614893"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Penn%20-%20CA%20Notice%20Template%20Proof%20%28Redacted%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20of%20Pennsylvania-2025-12-22"}],"summary":"The University of Pennsylvania reported that personal information was obtained without authorization from its Oracle E-Business Suite.","supporting_quote":null,"technology_involved":["Oracle E-Business Suite","Oracle EBS"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f3373e9b16768ad5e2525a5c9a7ebbc81582f0db","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35728.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"473aa2db02b4","org_name":"University of Pennsylvania","org_type":"education","ransomware":null,"records_affected":6413,"reviewed":false,"root_cause":"An unknown security vulnerability in Oracle E-Business Suite could allow unauthorized access to the application and its data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35728.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35728.pdf"}],"summary":"The University of Pennsylvania reported that personal information was obtained without authorization from its Oracle E-Business Suite.","supporting_quote":"Oracle recently announced a previously unknown security vulnerability that could allow unauthorized access to Oracle EBS and data stored in it.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8532ee7f666893d70d3d6cb77edb4ad8f82dcdf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ba782b20277","org_name":"FedEx Corporation Group Health Plan","org_type":"healthcare","ransomware":null,"records_affected":1066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-01-fedex-corporation-group-health-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1a93877cee647c80ed0ed774d307f64b7eb448ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1dcd3d0085b","org_name":"Spindletop Center","org_type":"healthcare","ransomware":null,"records_affected":88863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-28-spindletop-center"},{"fetched_at":null,"title":"Leak-site claim by rhysida","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3BpbmRsZXRvcCBDZW50ZXJAcmh5c2lkYQ"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["rhysida"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"qilin","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7c11759f8c67b357d49fee933c84386d04944595","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"459ba4b1ac05","org_name":"Richmond Behavioral Health Authority","org_type":"healthcare","ransomware":true,"records_affected":113232,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-28-richmond-behavioral-health-authority"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmljaG1vbmQgQmVoYXZpb3JhbCBIZWFsdGggQXV0aG9yaXR5QHFpbGlu"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"qilin","claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2025-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9a4ae98ac6986edb0b7594ba32196aea8b6f3a7","impact_type":"unknown","incident_date":"2011-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"eebf5b788eb8","org_name":"China Software Developer Network","org_type":"unknown","ransomware":null,"records_affected":6414990,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: China Software Developer Network","type":"hibp","url":"https://haveibeenpwned.com/Breach/CSDN"}],"summary":"In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records . The data included email addresses alongside usernames and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce26006f7954d756902100bae839ce87315f3154","impact_type":"data_theft","incident_date":"2025-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tami%20J.%20Dunham%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7f6b77fd8ba2","org_name":"Tami J. Dunham, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614832"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tami%20J.%20Dunham%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown actor viewed and downloaded files from Tami J. Dunham, CPA’s systems between May 24 and May 26, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"682e57ecbd6dc2dff6a2e1030295f7fbf7476505","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e352b6f71f2b","org_name":"Persante Health Care","org_type":"professional_services","ransomware":null,"records_affected":111815,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-26-persante-health-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-26","discovered_date":"2025-11-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bfaa943ee48a12126b7490253c913394c93d662d","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0fa71935d1d1","org_name":"National University of Natural Medicine","org_type":"unknown","ransomware":null,"records_affected":2189,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20University%20of%20Natural%20Medicine-2025-11-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"108eee52628d970c7e3f60c3c4e0d2d12c592361","impact_type":"data_theft","incident_date":"2025-08-14","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35684.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"377f3cfa4162","org_name":"Marquis Software Solutions","org_type":"technology_saas","ransomware":null,"records_affected":269773,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35684.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35684.pdf"}],"summary":"Marquis Software Solutions reported that an unauthorized third party accessed its environment and may have acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c898d31960c7c3c0e6ccadc44a7b6f4dcaafe45a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4e60963e1e6b","org_name":"Keystone Alliance, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-26-keystone-alliance-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"897a9a0ff70665bbbb07ae5e2a9735e96724e155","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35680.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7b53e1e1850b","org_name":"Industrial Credit Union","org_type":"financial","ransomware":null,"records_affected":24526,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35680.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35680.pdf"}],"summary":"A breach of a communication delivery partner’s systems exposed Industrial Credit Union member information, including names, dates of birth, Social Security numbers, and account references.","supporting_quote":"We are writing to notify you about a data security breach at one of our communication delivery partners, which resulted in unauthorized access to member information.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"550ffea1e957be8a91ea64a6cee6aa47278bf7c2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf97ca94be8b","org_name":"Henry Ford Health","org_type":"healthcare","ransomware":null,"records_affected":1984,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-26-henry-ford-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-26","discovered_date":"2025-09-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee03fd4fa6c6b5bb0a107c59314a9f06a28c7510","impact_type":"unknown","incident_date":"2025-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted_PII%2837814076.1%29_Redacted_37814121v1.pdf"},"notes":null,"org_country":"US","org_id":"e6c20e3e7a49","org_name":"Dubroff, Easley, & Lovell, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-620783"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614837"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted_PII%2837814076.1%29_Redacted_37814121v1.pdf"}],"summary":"Dubroff, Easley, & Lovell, LLP learned that an unauthorized actor accessed its systems, and files may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-11-26","discovered_date":"2025-09-25","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e6919b742a24cc25e64086d632482148d53f159","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-20","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1199","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L07_Multistate%20Letter%20Notice%20of%20Data%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"57634af0e113","org_name":"Discord Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614835"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L07_Multistate%20Letter%20Notice%20of%20Data%20Incident.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004706"}],"summary":"A third party accessed Discord’s customer service platform through a compromised vendor device, potentially accessing customer personal and limited payment information.","supporting_quote":"Discord Inc. ( We or the Company) discovered that your data was impacted when a third party obtained unauthorized access to our customer service platform through a compromised vendor device.","technology_involved":["customer service platform"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"customer support provider"},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0ef497e2aa40c2328ff50c5c49cb69ddc7aa9bee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8788ba50c0e","org_name":"Center for Urologic Care of Berks CO","org_type":"healthcare","ransomware":null,"records_affected":543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-26-center-for-urologic-care-of-berks-co"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"271e81857e830d6b739c511d043439b8d2e126ea","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"23ededdf1039","org_name":"Tanner Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-25-tanner-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"443e2c980e8316361ec5f85b2f5c227023af7914","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"30283df10b4a","org_name":"Central Kansas Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":80860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-25-central-kansas-mental-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-25","discovered_date":"2025-11-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9e4b2a88f5394ea4743547050950dfca054c82e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-11-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c886b4d5c162","org_name":"Blue Cross and Blue Shield of Texas","org_type":"financial","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004691"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078","T1199"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-24","discovered_date":"2025-10-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"390d3d8675c63ec4054f358f82d8c07de0537457","impact_type":"data_theft","incident_date":"2025-09-21","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1199","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vitas%20Notice%20of%20Breach%20Sample%20Letters.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9237d18db981","org_name":"VITAS Hospice Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":319177,"reviewed":false,"root_cause":"An unauthorized party compromised a vendor's account and used it to access VITAS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-24-vitas-hospice-services-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vitas%20Notice%20of%20Breach%20Sample%20Letters.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004683"}],"summary":"VITAS reported that an unauthorized party used a compromised vendor account to access its systems and download patients' and former patients' personal information.","supporting_quote":"On October 24, 2025, VITAS discovered that an unauthorized party had compromised the account of one of our vendors and used that account to gain access to some of our systems.","technology_involved":["Network Server"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-24","discovered_date":"2024-12-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab76aeff031d80c6a01b930c40c48ccbcc6e6613","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UFCW%20-%20Sample%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8271f1374ae1","org_name":"United Food & Commercial Workers Local No. 7","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614746"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UFCW%20-%20Sample%20Individual%20Notification%20Letter.pdf"}],"summary":"United Food & Commercial Workers Local No. 7 reported that an unauthorized actor may have accessed or acquired files containing individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d784fa32bafd56dc1708b460d35ededc54f29c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual_Notice_TSA_Final_Live_Proof_R1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7372446c5d80","org_name":"Thomas Safran and Associates","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614738"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual_Notice_TSA_Final_Live_Proof_R1_Redacted.pdf"}],"summary":"Thomas Safran and Associates reported that an unauthorized party accessed a server containing documents with personal information.","supporting_quote":null,"technology_involved":["computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f100623025c280d703301c48b2086e44594a9a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kern%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fa61e7ee163c","org_name":"Kern Energy","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kern%20Sample%20Notice.pdf"}],"summary":"Kern Energy reported unauthorized access to systems that may have contained personal information, with no evidence that the information was accessed, stolen, disclosed, or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bb1d8e78a2b9a60d4ecb26e7042af5d5e831acc2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31761961c08e","org_name":"Greater Meridian Health Clinic, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-24-greater-meridian-health-clinic-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7dc2d193ef6968e5b6b191bd338391a8617d5ed4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3eb2e74ba44","org_name":"Davies, McFarland & Carroll LLC","org_type":"professional_services","ransomware":null,"records_affected":54712,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-24-davies-mcfarland-carroll-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e19aa17e96b6492d77da311e79026448e3c769fb","impact_type":"data_theft","incident_date":"2025-08-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dartmouth%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0a8a0ffeae0e","org_name":"Dartmouth College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day vulnerability in Oracle EBS allowed an unauthorized actor to take data from Dartmouth’s environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614718"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dartmouth%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004692"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dartmouth%20College-2025-11-24"}],"summary":"An unauthorized actor exploited a zero-day vulnerability in Oracle EBS to take files from Dartmouth’s environment.","supporting_quote":"The Oracle EBS software experienced a “zero-day” vulnerability, which is an unknown vulnerability, that allowed an unauthorized actor to take data, from many of Oracle’s EBS customers’ environments, including Dartmouth’s.","technology_involved":["Oracle EBS"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c1bb7d267e627436a680010c7dffa5778ec18ed","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"296a6d4cbc04","org_name":"CodeStepByStep","org_type":"technology_saas","ransomware":null,"records_affected":103077,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CodeStepByStep","type":"hibp","url":"https://haveibeenpwned.com/Breach/CodeStepByStep"}],"summary":"A breach of CodeStepByStep exposed names, usernames, and email addresses that were subsequently published online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d89c32e5b7f38a6a0f3727945291e2ae10cf0bf","impact_type":"data_theft","imported_from":null,"incident_date":"2025-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6947051360ef","org_name":"ADDA","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ADDA","type":"hibp","url":"https://haveibeenpwned.com/Breach/ADDA"}],"summary":"Data allegedly breached from ADDA was posted to a public hacking forum, including email addresses, names, phone numbers and password hashes.","supporting_quote":null,"technology_involved":["ADDA"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df0f6402ac7a6073db43ff73a58e8b9d16cc8e45","impact_type":"unknown","incident_date":"2025-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ACTIVE_164954586_1_The%20TEAM%20Companies%20%20-%20US%20Notification%20Sample_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62ecf61cba58","org_name":"The TEAM Companies, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614620"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004690"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20TEAM%20Companies%2C%20LLC-2025-11-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b8641631898c4359a19cc5396d246e646c73bac","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b856e320b4a","org_name":"Nura PLLC","org_type":"healthcare","ransomware":null,"records_affected":5207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-21-nura-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"642ab4950690b793d456e973ee2004cc977ee9f4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51fa2d98eb51","org_name":"Millcreek Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":14095,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-21-millcreek-pediatrics"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-21","discovered_date":"2025-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1065f96b1570fa17ec27ff8812eb94c1fc75bf59","impact_type":"unknown","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42b10d3bed8f","org_name":"Marquis Companies","org_type":"unknown","ransomware":null,"records_affected":801,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marquis%20Companies-2025-11-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-21","discovered_date":"2025-09-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50352f0297f9c038770e6da6399ccc3ae989792a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d07fedc08047","org_name":"Liberty Resources","org_type":"healthcare","ransomware":null,"records_affected":103711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004685"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-21","discovered_date":"2025-04-23","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12359d0a59a3391a195d5ae9de0f9bbeb4e9b9ce","impact_type":"data_theft","incident_date":"2025-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28CA%29%20DDVA%20notice.pdf"},"notes":null,"org_country":"US","org_id":"f4ee404ea506","org_name":"Delta Dental of Virginia","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614577"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28CA%29%20DDVA%20notice.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004688"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Delta%20Dental%20of%20Virginia.pdf"}],"summary":"Delta Dental of Virginia reported that emails and attachments associated with one email account may have been accessed and acquired without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-21","discovered_date":"2025-10-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"359cf701fd9bdfe87c9c6e07b2d7594a8c317e64","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8636e4d97ca","org_name":"Ahtna, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":8631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004847"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619000"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ahtna%2C%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized third party accessed certain Ahtna systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ef499a4f390025cc8e553774e366710804df1bde","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf7c27259d46","org_name":"Wyandot Behavioral Health Network","org_type":"healthcare","ransomware":null,"records_affected":27174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-20-wyandot-behavioral-health-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ff67208633919ca96d7d9951af2a835418ae334","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"unknown","org_id":"296f073de713","org_name":"Vultr","org_type":"technology_saas","ransomware":null,"records_affected":187872,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vultr","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vultr"}],"summary":"A security incident at ActiveCampaign exposed Vultr-related email addresses and a small number of names, IP addresses, and countries of origin.","supporting_quote":"In March 2023, the \"AI-first global cloud platform\" Vultr disclosed a security incident at a third-party vendor .","technology_involved":["ActiveCampaign"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ActiveCampaign"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"357145d4b705","name":"ActiveCampaign"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b2e49281ff0e3feff7f5a268f3cf62e35c17001","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"963c8b3c3fa2","org_name":"International Kiteboarding Organization","org_type":"unknown","ransomware":null,"records_affected":340349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: International Kiteboarding Organization","type":"hibp","url":"https://haveibeenpwned.com/Breach/IKO"}],"summary":"The International Kiteboarding Organization suffered a data breach exposing 340,349 user records, which were subsequently listed for sale on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-20","discovered_date":"2025-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77a2face289ce9259f7fe976ba9e9ccb28c24ffc","impact_type":"unknown","incident_date":"2025-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36279.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a820856055ec","org_name":"Housing Authority of the City of Vancouver","org_type":"government","ransomware":null,"records_affected":736,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36279.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36279.pdf"}],"summary":"The Housing Authority of the City of Vancouver detected unauthorized activity associated with an employee’s email address.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-20","discovered_date":"2025-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-09","id":"579769f20cc0dd74fe7168699eeb34e6bfd7dfed","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Filedex%20Products%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0d7893084df0","org_name":"Fieldtex Products, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":104071,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-20-fieldtex-products-inc"},{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-03-fieldtex-products-inc"},{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-12-12-fieldtex-products-inc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004734"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Filedex%20Products%20Inc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Filedex%20Products%20Inc..pdf"}],"summary":"Fieldtex Products reported unauthorized activity in its computer systems that may have affected files containing individuals’ personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb12d028733f612e473a7e1a83eca206f640dd08","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"4d46c32db0ad","org_name":"Eurofiber","org_type":"telecom","ransomware":null,"records_affected":10003,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Eurofiber","type":"hibp","url":"https://haveibeenpwned.com/Breach/Eurofiber"}],"summary":"Eurofiber France disclosed a breach of its ticket management platform, after which data including email addresses, names, and phone numbers was leaked.","supporting_quote":null,"technology_involved":["ticket management platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bae47496d8c74a59f1e629a03758791b13defb84","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8e433fa98fd6","org_name":"Dr. Michael Kaplan DO PC DBA Long Island Weight Loss Institute","org_type":"healthcare","ransomware":null,"records_affected":3426,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-20-dr-michael-kaplan-do-pc-dba-long-island-weight-loss-institute"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa913f6a7e33c0f8be50d7e31f28b06ecf619da5","impact_type":"data_theft","imported_from":null,"incident_date":"2025-11-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"41e09642b2ce","org_name":"Beckett Collectibles","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Beckett Collectibles","type":"hibp","url":"https://haveibeenpwned.com/Breach/Beckett"}],"summary":"Beckett Collectibles experienced a data breach and website defacement, with customer information later advertised for sale and released publicly.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89df34b93bc0e5338d91ab92fa1478dad32278c1","impact_type":"data_theft","incident_date":"2025-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-25515%20WEL%20Companies%20Adult%20CM%201BM%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"ee0cb3cde6da","org_name":"WEL Companies, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614447"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-25515%20WEL%20Companies%20Adult%20CM%201BM%20r1prf.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004693"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#WEL%20Companies%2C%20Inc.-2025-11-19"}],"summary":"WEL Companies, Inc. reported that files were acquired without authorization and some personal information was contained in the potentially affected data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-11-19","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c108d4df23ebc642a24f8865eb19c9b55e754a8d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35593.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"17c82003c100","org_name":"Sound Community Bank","org_type":"financial","ransomware":null,"records_affected":5503,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35593.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35593.pdf"}],"summary":"A third-party advertising and mailing vendor experienced a cybersecurity incident in which personal and financial information related to Sound Community Bank customers was accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5b93f66dd393a4c19220d03441a37188a0c3dd9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35600.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a509a505c453","org_name":"Revenley LLC","org_type":"unknown","ransomware":null,"records_affected":223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35600.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ebac71d33afff6361b4b92869f88200481db2254","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d11daf065ecf","org_name":"Personic Management Company LLC","org_type":"professional_services","ransomware":null,"records_affected":10929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-19-personic-management-company-llc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004677"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a2743ea903f7891dde863862f7e569cf0d1e1bce","impact_type":"data_theft","imported_from":null,"incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20NAHGA%20Claim%20Services.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b34d6bbf53b1","org_name":"NAHGA Claims Services","org_type":"professional_services","ransomware":null,"records_affected":5072,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004674"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20NAHGA%20Claim%20Services.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20NAHGA%20Claim%20Services.pdf"}],"summary":"NAHGA Claims Services reported that files may have been acquired without authorization between April 8 and April 11, 2025, and that affected files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"44020b39703a0893c58b1818d9a1ccb45ba029f0","impact_type":"data_theft","incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NAHGA_CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"44421d37dfad","org_name":"NAHGA Claim Services","org_type":"professional_services","ransomware":null,"records_affected":21834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-19-nahga-claim-services"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615796"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NAHGA_CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004731"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NAHGA%20Claim%20Services-2025-12-15"}],"summary":"NAHGA Claim Services reported that files may have been acquired without authorization between April 8 and April 11, 2025, and that affected files included personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-05-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e2b067fdd81d043f05d464a6f93a604dc1d07d5","impact_type":"data_theft","incident_date":"2024-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mehri%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"3eccf54e90ec","org_name":"Mehri & Skalet, PLLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mehri%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004631"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35598.pdf"}],"summary":"An unauthorized actor accessed an employee email account and downloaded information belonging to Mehri & Skalet, PLLC.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-10-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b908302d03af9152799c2877dbfa4178382ee313","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"384ed12cd955","org_name":"Kaufman County, Texas","org_type":"government","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004678"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-03-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f4a2daf51e524c7bd01a7e15ba6d714105bcfca","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e9baac2f08cd","org_name":"Doctors Hospital at Renaissance, Ltd.","org_type":"healthcare","ransomware":null,"records_affected":34060,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004676"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"55825d217a8ae0fa4698d35337a2094b0dc3e272","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab7e40f45ed5","org_name":"County of Catawba","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-19-county-of-catawba"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"b39a392e1f7f14df8662ca7bf5ab6b659b777e20","impact_type":"data_theft","imported_from":null,"incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/South%20Carolina%20Attorney%20General%20Notification%20Letter%20to%20Consumer.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a219faaed637","org_name":"Conduent State & Local Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":34423,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/South%20Carolina%20Attorney%20General%20Notification%20Letter%20to%20Consumer.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/South%20Carolina%20Attorney%20General%20Notification%20Letter%20to%20Consumer.pdf"}],"summary":"Conduent State & Local Solutions reported that an unauthorized third party accessed its environment and obtained files associated with SC-SDU.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a05641d883e3b72e985cf7b085338bbf76908353","impact_type":"data_theft","incident_date":"2025-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Cas%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5572c79a4ef4","org_name":"California Casualty Indemnity Exchange","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614461"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Cas%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#California%20Casualty%20Indemnity%20Exchange-2025-11-19"}],"summary":"An unauthorized person accessed California Casualty Indemnity Exchange's IT network and copied some files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-19","discovered_date":"2025-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60ac07ec8d8c7ab6f56aea0542c7c555edf39cad","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Byzfunder%20-%20Regulatory%20Notice%20Letter%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"df3676d68dcb","org_name":"Byzfunder NY LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Byzfunder%20-%20Regulatory%20Notice%20Letter%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004682"}],"summary":"Byzfunder reported that files in one of its software solutions may have been accessed or acquired without authorization, potentially exposing names and Social Security numbers.","supporting_quote":null,"technology_involved":["Byzfunder software solution"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"9519dad2f7e3562990d6fe072155f2de9907cd40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ANHC%20-%20Individual%20Notice%20%28Multi-State%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d73113f84240","org_name":"Anchorage Neighborhood Health Center","org_type":"healthcare","ransomware":null,"records_affected":70555,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-19-anchorage-neighborhood-health-center"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ANHC%20-%20Individual%20Notice%20%28Multi-State%29.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004681"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Anchorage%20Neighborhood%20Health%20Center-2025-11-19"}],"summary":"Anchorage Neighborhood Health Center notified affected people that personal and medical information may have been impacted.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-18","discovered_date":"2025-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e239489362fad7d8a9247def427b79d8f6eed48","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MPBF%20CA%20Reg%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"e9be85f6ccb6","org_name":"Murphy, Pearson, Bradley & Feeney, APC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614423"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MPBF%20CA%20Reg%20Notice%20Letter_0.pdf"}],"summary":"Murphy, Pearson, Bradley & Feeney, APC discovered suspicious activity, and its investigation found that files may have been accessed or acquired without authorization and may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9cc8ed58989c9a9d6dd6417a6deddffb8b2bd006","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"30060a23ebdb","org_name":"Marrs Ear, Nose & Throat, PA","org_type":"healthcare","ransomware":null,"records_affected":6376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-18-marrs-ear-nose-throat-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"262b3a2ee6863031c50d10ffb38bc3d1d30da6a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ba4cc0b587a","org_name":"Dermatology Associates of Concord","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-18-dermatology-associates-of-concord"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"37e892da637c37971949d1783c2f985243db3955","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0f22d49e64f","org_name":"Capitol Premier Dental Group","org_type":"healthcare","ransomware":null,"records_affected":1559,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-18-capitol-premier-dental-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-11-18","discovered_date":"2025-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b091d35d37a760013f1062afdb661d69e2af7b19","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SS%20--%20Exhibit%20A%20-%20Adult_Letter%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"e0ec38fdc79d","org_name":"American Soccer Company Inc. DBA Score Sports","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614415"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SS%20--%20Exhibit%20A%20-%20Adult_Letter%20Redacted.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004679"}],"summary":"Score Sports reported that information stored on its website was subject to unauthorized access, including names and payment card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-17","discovered_date":"2025-09-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"04c1f099ae4050bfd12f258883d11b4817bfca78","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff1bffc4cc0e","org_name":"CDS in Texas","org_type":"other","ransomware":null,"records_affected":7295,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004671"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"00450b8b5bca45aa52151163d28ed979f31dac3a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ca7b9f9d50b9","org_name":"Cary Pediatric Center, PA","org_type":"healthcare","ransomware":null,"records_affected":25784,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-17-cary-pediatric-center-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f1ce2caaa672386e450c80fd050827161a4c2d43","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35535.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"588700a10f40","org_name":"Consero Global Solutions, LLC (Propeller Industries)","org_type":"unknown","ransomware":null,"records_affected":1007,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35535.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fca0e8b5bb430507518851cd672deddac5a8886d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35523.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"653f65ea499c","org_name":"University of the People","org_type":"unknown","ransomware":null,"records_affected":1650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35523.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-14","discovered_date":"2025-10-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b437dd80c1169943950744bdd04d8fe089fb4d6f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a583caba2d76","org_name":"Riceland Healthcare","org_type":"healthcare","ransomware":null,"records_affected":721,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004670"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a9c423c9840995ecfc56db6d0ef1b27899d96e13","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":null,"org_country":"CH","org_id":"17549e180212","org_name":"Logitech International S.A.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party used a zero-day vulnerability in a third-party software platform to access Logitech's internal IT system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1032975/000103297525000085/logi-20251114.htm"}],"summary":"Logitech reported that an unauthorized third party exploited a zero-day vulnerability in a third-party software platform to copy data from its internal IT system.","supporting_quote":"While the investigation is ongoing, at this time, Logitech believes that the unauthorized third party used a zero-day vulnerability in a third-party software platform and copied certain data from the internal IT system.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"veris_action":"hacking","derived":{"price":{"ticker":"LOGI","base_day":"2025-11-14","returns":{"1":{"day":"2025-11-17","raw":-0.0402,"adj":-0.0309},"5":{"day":"2025-11-21","raw":-0.0686,"adj":-0.0494},"21":{"day":"2025-12-16","raw":-0.0486,"adj":-0.059},"63":{"day":"2026-02-18","raw":-0.2464,"adj":-0.2678},"126":{"day":"2026-05-19","raw":-0.1217,"adj":-0.2136}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0303701543edb945b660236b4de6462e1c4c7b50","impact_type":"unknown","incident_date":"2025-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lawyers%27%20Mutual%20Insurance%20Company%20of%20California%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10c87ce37915","org_name":"Lawyers’ Mutual Insurance Company of California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614293"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-14","discovered_date":"2025-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"f68b94aa5d43146285d48ddbd6e5bd37c1560cbc","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Greer%20Commission%20of%20Public%20Works.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5b4f43a7b98c","org_name":"Greer Commission of Public Works","org_type":"energy_utilities","ransomware":null,"records_affected":14146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Greer%20Commission%20of%20Public%20Works.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Greer%20Commission%20of%20Public%20Works.pdf"}],"summary":"Greer Commission of Public Works reported that an unauthorized individual may have copied information during activity on June 19, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-11-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"92749bf5c98e095ad9214b8c99927de55e45ff79","impact_type":"unknown","incident_date":"2022-10-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35533.pdf"},"notes":null,"org_country":"US","org_id":"16550bee17b1","org_name":"Greenroads Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35533.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35533.pdf"}],"summary":"Greenroads Foundation reported an intrusion involving a user account on the Sustainable Transport Council website that was used to alter and redirect a publicly available image file.","supporting_quote":"We detected an intrusion from a specific user account that was used to change the name of a publicly available image file and redirect it to another folder.","technology_involved":["Sustainable Transport Council website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a65c7ce625ebf29e8ff0a8c3144652a0de61701","impact_type":"unknown","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consero%20-%20Proof_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6bba68974a3d","org_name":"Consero Global Solutions, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614282"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004672"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-14","discovered_date":"2025-10-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a2eff00bcfbe226f1943a5e8276e9f943dfc279","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8f908c8e8722","org_name":"Benson Enterprises, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004668"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"135e4f347c352b7c853d5c3a71b1306e643cb13d","impact_type":"data_theft","incident_date":"2025-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSA%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f6c5ed3fd53b","org_name":"SSA Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614211"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSA%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004669"}],"summary":"An unauthorized person accessed some of SSA Holdings, LLC’s systems and acquired copies of files on September 15, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"c97c976a54d175c861f6190d11fb401a73e28fc9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-17","initial_access":"unknown","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Wakefield%20%26%20Associates%2C%20Inc..pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"720693fae153","org_name":"Wakefield & Associates, LLC","org_type":"professional_services","ransomware":null,"records_affected":371577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004657"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Wakefield%20%26%20Associates%2C%20Inc..pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wakefield%20%26%20Associates%20LLC-2025-12-18"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Wakefield%20%26%20Associates%2C%20Inc..pdf"}],"summary":"Wakefield & Associates reported unauthorized access and/or acquisition of files containing personal information on or before January 17, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d290dd03acf1d590a40baba30802d0e629fe3009","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02dde3096711","org_name":"USA Emergency Centers – Spring, LLC","org_type":"healthcare","ransomware":null,"records_affected":266,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004665"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f66e5ac8e3ab71da97b0eb85f41c375921d1b13e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97a37b118fa1","org_name":"USA Emergency Centers – South Austin, LLC","org_type":"healthcare","ransomware":null,"records_affected":272,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004664"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0040a60fd5eda3ac8b652262fa08f074d697a092","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"061e5a2e6b48","org_name":"USA Emergency Centers – Round Rock, LLC","org_type":"healthcare","ransomware":null,"records_affected":433,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004663"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"428cd515e8d7881829f5f7db144736646f59e5a0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3345a090da78","org_name":"USA Emergency Centers – Clear Lake, LLC","org_type":"healthcare","ransomware":null,"records_affected":269,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004662"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56d0c5b12124132a3112e13426a884dfddfa74ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c6887d21d833","org_name":"USA Emergency Centers – Bastrop, LLC","org_type":"healthcare","ransomware":null,"records_affected":408,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004661"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2d82e8a6e15038da01267fdc4ce5a96bf60dae4","impact_type":"data_theft","incident_date":"2025-07-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WaPo%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ba9699eecb99","org_name":"The Washington Post","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously unknown vulnerability in Oracle E-Business Suite permitted unauthorized actors to access the applications.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-626404"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WaPo%20Sample%20Notice.pdf"}],"summary":"The Washington Post confirmed that attackers exploited a previously unknown vulnerability in Oracle E-Business Suite and accessed and acquired personal information.","supporting_quote":"During our investigation, we learned that Oracle had identified a previously unknown and widespread vulnerability in its E-Business Suite software that permitted unauthorized actors to access many Oracle customers’ E-Business Suite applications.","technology_involved":["Oracle E-Business Suite"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Oracle"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"4d65847107aa","name":"Oracle"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7be1c0f850b01c99094bca9c2397c5004d7b0ed6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_W2.pdf"},"notes":null,"org_country":"US","org_id":"e9def865f55e","org_name":"Roebbelen Contracting, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616569"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614158"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_W2.pdf"}],"summary":"Roebbelen Contracting identified unauthorized network activity and later determined that accessed documents included names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-07-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a56017d165fe8bd191323f1db08dd5d0ea94f866","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Sample%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f57ea0342222","org_name":"Oakland Museum of California","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614162"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample%20Consumer%20Notification%20Letter.pdf"}],"summary":"Oakland Museum of California reported that an unauthorized actor accessed its network and could access files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"23a31c63aded0200b64bc0b2a0a3b1da7d2e3b42","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35496.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f85b34ebace0","org_name":"Hamilton Construction Company","org_type":"other","ransomware":null,"records_affected":610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35496.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hamilton%20Construction%20Company-2025-12-15"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35496.pdf"}],"summary":"Hamilton Construction Company reported unauthorized access to its network on June 19, 2025, and said an impacted file may have contained an affected individual's name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-10-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"108291ae3f8d613d508f5d693028454d38e2aad6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20768bbfc00a","org_name":"Graebel Companies, Inc.","org_type":"other","ransomware":null,"records_affected":5573,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004660"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6357f0fa2e82229d34534063a475e897a423c1e","impact_type":"both","incident_date":"2025-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GL%20Veneer%20Individual%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"0c6b26979339","org_name":"GL Veneer, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614178"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GL%20Veneer%20Individual%20Proof.pdf"}],"summary":"GL Veneer reported a network disruption and unauthorized access or acquisition of systems data that may have included individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-10-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb712ad661d850474a191ebaae6300de5f92d109","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d69e783c966e","org_name":"Central One Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":66554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004659"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-11-12","discovered_date":"2025-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfcbe5d1baa5bc9ce66327e6365c328479887f73","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job47813d23_AMA_L01_DBM-5371_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"5fbd3f39dc24","org_name":"CareTracker, Inc. d/b/a Amazing Charts","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614140"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job47813d23_AMA_L01_DBM-5371_SAS_0.pdf"}],"summary":"Unauthorized access to a third-party service provider’s network may have involved CareTracker customers’ personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":"2024-10-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95c3d3551fcb4aff0f2556357609f6e989ec7941","impact_type":"both","imported_from":null,"incident_date":"2024-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAP%20Adult%20Notice%20Ltr.pdf"},"notes":null,"org_country":"US","org_id":"e2800fbe2814","org_name":"American Associated Pharmacies","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAP%20Adult%20Notice%20Ltr.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35484.pdf"}],"summary":"American Associated Pharmacies detected ransomware activity, and its investigation found that an unauthorized actor accessed its systems and downloaded data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-12","discovered_date":"2025-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1a08fcbdf2774869670fe6f27e93ffa718f6c61","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35487.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"da61416c9a35","org_name":"Activehours, Inc.","org_type":"financial","ransomware":null,"records_affected":202480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004666"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35487.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35487.pdf"}],"summary":"Activehours disclosed that its system sent encrypted personal information of Lead Bank customers to another partner bank, with no evidence of misuse reported.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2fcb9b222361ef95726df5916f8513a52e6643d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECCBC87E-4B5C-E2FE-2830-8FD9F2A7BAF3"},"incident_date":"2025-11-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"473aa2db02b4","org_name":"University of Pennsylvania","org_type":"education","ransomware":null,"records_affected":1488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/university-of-pennsylvania-confirms-data-theft-after-oracle-ebs-hack/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6de24e56-1806-4f42-853e-6c505ee1427f.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cyberscoop.com/university-pennsylvania-oracle-e-business-suite-clop-attacks/"}],"summary":"\"The University of Pennsylvania (Penn) has announced a new data breach after attackers stole documents containing personal information from its Oracle E-Business Suite servers in August.\n\nIn a breach notification letter filed with the office of Maine's Attorney General this week,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ead524fa761fa19d558127c21580bfb40f9534f7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Security%20Alert_%20Phishing%20Attempt%20Targeting%20Our%20Community.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1bc377e3dc6b","org_name":"The INC","org_type":"professional_services","ransomware":null,"records_affected":1632,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Security%20Alert_%20Phishing%20Attempt%20Targeting%20Our%20Community.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Security%20Alert_%20Phishing%20Attempt%20Targeting%20Our%20Community.pdf"}],"summary":"The INC reported a phishing attempt targeting members of its educational network that was intended to steal login credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e38f6b1c9e6e50069079b97d3a1eb673a1e7ccc8","impact_type":"unknown","incident_date":"2025-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pacific%20Symphony%20-%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"e9d05fa94301","org_name":"Pacific Symphony","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pacific%20Symphony%20-%20Notice%20Letter.pdf"}],"summary":"Pacific Symphony reported unauthorized third-party access to part of its IT network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c992bcafe84be645af236bbd3bdca808246d481a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72bbea076fa7","org_name":"Morton Drug Company","org_type":"healthcare","ransomware":null,"records_affected":40051,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-10-morton-drug-company"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3d89430e6ee0e05530c6375f82b3e09e113c73d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPM_TRM%20-%20Sample%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"014188472b56","org_name":"TELACU Property Management and TELACU Residential Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614049"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPM_TRM%20-%20Sample%20Notification%20Letter_Redacted.pdf"}],"summary":"TELACU Property Management and TELACU Residential Management reported a data security incident in which personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"915f5f95c9cd5c5fe6451fe5e002ff38d1a40b38","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"HU","org_id":"d2d9bb4dc858","org_name":"TISZA Világ","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TISZA Világ","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tisza"}],"summary":"A compromise of the TISZA Világ service exposed personal data, which was published online and redistributed.","supporting_quote":null,"technology_involved":["TISZA Világ"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c2dcc0a0cb04f9111c00c24dbe718a618ce0286","impact_type":"data_theft","incident_date":"2024-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCSJ%20-%20Substitute%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"54a5389657a8","org_name":"Superior Court of California, County of San Joaquin","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614007"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCSJ%20-%20Substitute%20Notice.pdf"}],"summary":"An unauthorized person accessed some Superior Court systems and acquired copies of files containing individuals’ personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-09-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f3a855d1f96444687062c34f0cc5d98cf34e369","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0aaff61a0185","org_name":"River Oaks Hospital & Clinics, LLC","org_type":"healthcare","ransomware":null,"records_affected":2742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004656"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"d3f8ccf9c77fcee668c4d5b0c17953f2de500fa9","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Pillbury%20Winthrop%20Shaw%20Pitman%20LLP.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"50d5d6b95146","org_name":"Pillsbury Winthrop Shaw Pitman LLP","org_type":"professional_services","ransomware":null,"records_affected":43412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004652"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Pillbury%20Winthrop%20Shaw%20Pitman%20LLP.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Pillbury%20Winthrop%20Shaw%20Pitman%20LLP.pdf"}],"summary":"Pillsbury Winthrop Shaw Pitman LLP reported that an unauthorized actor downloaded firm documents during a short window in late April.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-07","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e941ce4a69fba0920a3724ffeb188f7013312768","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a825b1848da","org_name":"Marshfield Clinic Health System","org_type":"healthcare","ransomware":null,"records_affected":35952,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-07-marshfield-clinic-health-system"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-10-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14218516da51f46821ae97f2a4794cbbd86531dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"86f13308047e","org_name":"Mack Energy Corporation","org_type":"other","ransomware":null,"records_affected":1058,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004650"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c541aec60871ff96955ad5f9df63dee347d79437","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4582a578acbc","org_name":"Loving and Living Center, PC dba Awakenings Center","org_type":"healthcare","ransomware":null,"records_affected":17800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-07-loving-and-living-center-pc-dba-awakenings-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3246c869081645ecd2420c1a1ded968f8f4140fd","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LGAA%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"5e3d8610a747","org_name":"LGAA LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LGAA%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown cyber actor accessed a limited segment of LGAA LLC’s computer network used for data migrations, and may have copied files containing individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"LGAA LLC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5e3d8610a747","name":"LGAA LLC"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"128d74e96b50f873abc3e714fdaa222c4089c071","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CM_Source%20%281%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"2f6c1a9141a7","org_name":"Integrated Silicon Solution, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613980"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CM_Source%20%281%29.pdf"}],"summary":"Integrated Silicon Solution, Inc. reported unauthorized access to certain files in a limited number of server environments, including a file server.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-10-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"786d2e0527c94e104742b26ab096dc3e95682888","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"27053b7b8082","org_name":"Chase Affiliated Companies","org_type":"other","ransomware":null,"records_affected":5328,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004651"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-10-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"215e210f0bbd04174df6109b2ca7d18f8e251cf1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8fc45486c433","org_name":"Bentley, Bratcher & Associates","org_type":"financial","ransomware":null,"records_affected":2697,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004653"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-07","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0a7e4ec23e873df2b6336434b0e4c75ea9934666","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e03fd93340bc","org_name":"Bell County Texas","org_type":"government","ransomware":null,"records_affected":290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004654"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d8f9929a2e8b0c6d2ab88adb6b2f67793256b55","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9593f01389a9","org_name":"Alera Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alera%20Group-2025-12-18"}],"summary":"Alera Group reported that personal information may have been removed from its technology environment following unauthorized access between July 19 and August 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-06","discovered_date":"2025-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"79543acb33a859a38dd0bb8992d6e13413541eed","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"23b8a9f277d8","org_name":"The Oncology Institute, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1799191/000107997325001666/toi_8k.htm"},{"fetched_at":null,"title":"8-K EXHIBIT 99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1799191/000107997325001707/ex99x1.htm"}],"summary":"A cybersecurity incident affecting an unnamed information technology software provider was expected to briefly delay some of The Oncology Institute's fee-for-service collections.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"STLNW","base_day":"2025-11-06","returns":{"1":{"day":"2025-11-07","raw":-0.2852,"adj":-0.2862},"5":{"day":"2025-11-13","raw":-0.2029,"adj":-0.2054},"21":{"day":"2025-12-08","raw":-0.4286,"adj":-0.4484},"63":{"day":"2026-02-09","raw":-0.4286,"adj":-0.4638},"126":{"day":"2026-05-11","raw":-0.7824,"adj":-0.8853}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e4b38e5ca2437beeef1b273f88e5669f86515672","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"505771949ee3","org_name":"The Chase Group Employee Benefit Plan","org_type":"healthcare","ransomware":null,"records_affected":817,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-06-the-chase-group-employee-benefit-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2025-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f862714971c9692e4cb8f9e443cebc0ce6b49db","impact_type":"data_theft","incident_date":"2025-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"fcb5be9324e2","org_name":"Synthient Credential Stuffing Threat Data","org_type":"unknown","ransomware":null,"records_affected":1957476021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Synthient Credential Stuffing Threat Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/SynthientCredentialStuffingThreatData"}],"summary":"During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources . Comprised of email addresses and passwords from previous data breaches, these lists are used b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"017fb81f0fc80641efd4fd9926616b64e0db8953","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ce52246bb2c3","org_name":"Archer Health","org_type":"healthcare","ransomware":null,"records_affected":4285,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-06-archer-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7a991a5e87de8363db7a924ebc1cb761dce49a6","impact_type":"disruption_or_ransomware","incident_date":"2023-12-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AOW_Notice_Letter_Adults_CM_Proof.pdf"},"notes":null,"org_country":"US","org_id":"6be1fa9c5004","org_name":"Alpha Omega Winery, LLC","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613934"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AOW_Notice_Letter_Adults_CM_Proof.pdf"}],"summary":"Alpha Omega Winery reported a ransomware incident that may have affected personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"59c7169c1b9569f4e3c9618f831d881ac978f1bf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"302a8652817b","org_name":"Tampa Bay Treatment Associates","org_type":"healthcare","ransomware":null,"records_affected":3682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-05-tampa-bay-treatment-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-05","discovered_date":"2024-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d12d9f8eef09ef40b93b45787d56cef0c5207f00","impact_type":"data_theft","incident_date":"2024-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Silverado%20Individual%20Notice%20%28Revise%29%20-%20SCI%20letterhead_v2%20%28Print%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"02d384eb19d9","org_name":"Silverado Contractors, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613851"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Silverado%20Individual%20Notice%20%28Revise%29%20-%20SCI%20letterhead_v2%20%28Print%20Proof%29.pdf"}],"summary":"Silverado Contractors, Inc. reported that an unauthorized actor accessed its systems and acquired personal identifiable information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"78902ec2f94cdc6c653566e4a5e2645fb7b0fead","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e0aa5899a47","org_name":"Denton MHMR Center","org_type":"healthcare","ransomware":null,"records_affected":108967,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-11-05-denton-mhmr-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b155138572c43767fde9b44f0074e718dd617c0a","impact_type":"unknown","incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%20Letter_0_0.pdf"},"notes":null,"org_country":"US","org_id":"37fdf8a445b7","org_name":"Cole Huber, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613883"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%20Letter_0_0.pdf"}],"summary":"Cole Huber, LLP’s notification letter lists personal information involved in the incident, including Social Security numbers, dates of birth, addresses, and identification documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-04","discovered_date":"2025-10-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f98d053755d34c633cf7c7d1c5c799d5ee099f76","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec7c3fa3cb08","org_name":"Shelby County Texas","org_type":"government","ransomware":null,"records_affected":2375,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004645"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-11-04","discovered_date":"2025-06-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"542c842f07a6facb248d9eabcc3904aeffe58906","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8124d54cd04","org_name":"Oglethorpe, Inc.","org_type":"healthcare","ransomware":null,"records_affected":92332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004646"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"93aeeb107fd6b5d5dedb8fc9554609c6a82d224e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Murphy%20and%20Grantland%2C%20PA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"936956dc78c9","org_name":"Murphy and Grantland, PA","org_type":"unknown","ransomware":null,"records_affected":4701,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Murphy%20and%20Grantland%2C%20PA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-04","discovered_date":"2025-10-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b700e10827eeb122fae5ea4e915624f3396a7b40","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bf8f0ce6928","org_name":"Lovejoy ISD","org_type":"education","ransomware":null,"records_affected":120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004640"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-04","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9d097309418cf083aa41f939e092014e1a496f3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe79a5fb6947","org_name":"J-Kraft, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004647"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-04","discovered_date":"2025-10-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76cfbb9a85ff2288595359a99d3216b4f9872086","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0371b8b7a2df","org_name":"Hudson River Partners I L. P.","org_type":"retail_ecommerce","ransomware":null,"records_affected":33053,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004648"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d94ac0c5d756f44112180837156229021183298d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Thayer%20Hotel%20Data%20Breach%20Website%20Notice%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"c71e864b1088","org_name":"The Thayer Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Thayer%20Hotel%20Data%20Breach%20Website%20Notice%20FINAL.pdf"}],"summary":"The Thayer Hotel reported unauthorized access to its computer systems, with exposed information including individuals’ names and personal identification details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-03","discovered_date":"2025-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"8545bc2417caf07da4af458518f65fe18d1ef59d","impact_type":"data_theft","imported_from":null,"incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Philadelphia%20Indemnity%20Insurance%20Company.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"28052d760312","org_name":"Philadelphia Indemnity Insurance Company","org_type":"financial","ransomware":null,"records_affected":430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Philadelphia%20Indemnity%20Insurance%20Company.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Philadelphia%20Indemnity%20Insurance%20Company.pdf"}],"summary":"Files on NAHGA network systems may have been acquired without authorization, and some Philadelphia Indemnity Insurance Company information was among the potentially affected data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"NAHGA"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"de1f9ed490aa","name":"NAHGA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-11-03","discovered_date":"2025-03-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d2cfd1f4bf70c4b27d4915886a4b5c425ea394e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HAEA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d7767d82a1e0","org_name":"Hyundai AutoEver America, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613730"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HAEA%20Sample%20Notice.pdf"}],"summary":"Hyundai AutoEver America reported unauthorized activity in its information technology environment, and names may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fe8c60e339a5e640dbdec98e0413617b027cc38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1679091C-5A88-0FAF-6FB5-E6087EB1B2DC"},"incident_date":"2025-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9603198ef4f","org_name":"Logitech","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techradar.com/pro/security/logitech-confirms-data-breach-but-says-it-isnt-sure-exactly-what-information-was-lost;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.computing.co.uk/news/2025/security/logitech-admits-data-breach-zero-day-exploit;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.tomshardware.com/tech-industry/hackers-steal-1-8tb-of-data-from-pc-peripheral-vendor-logitech-firm-says-zero-day-vulnerability-to-blame-no-sensitive-information-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.teiss.co.uk/news/logitech-hit-by-data-security-breach-linked-to-oracle-e-business-vulnerability-16738"}],"summary":"\"Hackers steal 1.8 terabytes of data from PC peripheral vendor Logitech — firm says zero-day vulnerability to blame, no sensitive information stolen. Logitech says a third-party platform was breached, through which the perpetrators gained access to Logitech's internal systems, st","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"424298e36c361d1e3e61aece566e6481f8d06d64","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C81E728D-9D4C-2F63-6F06-7F89CC14862C"},"incident_date":"2025-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"45f5421cc56d","org_name":"Canon","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/canon-says-subsidiary-impacted-by-oracle-ebs-hack/"}],"summary":"\"Imaging and optical technology giant Canon has confirmed being targeted in the recent Oracle E-Business Suite (EBS) hacking campaign. \n\nHowever, its investigation has shown that the incident is limited to a subsidiary of Canon U.S.A., Inc., the company told SecurityWeek in an em","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"pear","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"930454c22e46acb6b7fa607d65faf23547dc6eab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d236fadceb6","org_name":"Tri Century Eye Care PC","org_type":"healthcare","ransomware":true,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-31-tri-century-eye-care-pc"},{"fetched_at":null,"title":"Leak-site claim by pear","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VHJpLUNlbnR1cnkgRXllIENhcmVAcGVhcg"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pear","claim_groups":["pear"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0a2cc6e91bfe7e10c8bc451a6d0dd202eca1c262","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1da38cbfb585","org_name":"Judson Center","org_type":"healthcare","ransomware":null,"records_affected":976,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-31-judson-center"},{"fetched_at":null,"title":"Leak-site claim by sinobi","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SnVkc29uIENlbnRlckBzaW5vYmk"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["sinobi"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5f0711c79927956be80c696119a5f7a1c1063f95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7587fa92d4d1","org_name":"Expert MRI","org_type":"healthcare","ransomware":null,"records_affected":209560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-31-expert-mri"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f7503b58d518010d949ca706cc4a7322df493f1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Standard_Rev1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b36282849b2","org_name":"Beverly Hills Oncology Medical Group","org_type":"healthcare","ransomware":null,"records_affected":57655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-31-beverly-hills-oncology-medical-group"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613601"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5b21d12010a136c61dcd32b85b3763258c4890b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6b7f526ac00a","org_name":"Thompson & Horton LLP","org_type":"other","ransomware":null,"records_affected":148884,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004638"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-10-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd3c9d8a5519625682c6e8419954b3461647608c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2caf85932ecd","org_name":"Sachse Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004635"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-08-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b269a384c456180fd4d7e2ba5ef2ff77e31833e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7cb58abc51b5","org_name":"Newk's Holding Company, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":2664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004634"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10422c315a6d0aa5a727825b8a5a408029aeaa77","impact_type":"data_theft","incident_date":"2024-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/G-Plans%20FuturHealth%20Incident%20-%20California%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"ad62c6c4e8d5","org_name":"Goglia Nutrition LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/G-Plans%20FuturHealth%20Incident%20-%20California%20Notification_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004641"}],"summary":"Goglia Nutrition LLC reported that an unknown actor acquired personal and medical information held by its data-hosting provider, FuturHealth.","supporting_quote":"The investigation determined that an unknown actor acquired certain data without authorization on or before October 16, 2024.","technology_involved":["FuturHealth data hosting services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FuturHealth"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"33d2b0a98fe5","name":"FuturHealth"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"87c7ff1e7606f945107a8b61eef66afe73f10f96","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Fundamental%20Administrative%20Services%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad487a374676","org_name":"Fundamental Administrative Services LLC","org_type":"unknown","ransomware":null,"records_affected":11595,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Fundamental%20Administrative%20Services%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-10-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"671e1da9b98106129aad6c525bb4584d033d18cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24613403a821","org_name":"Blazer Real Estate Services, LLC","org_type":"other","ransomware":null,"records_affected":444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004637"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-03-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"a6e1685badbc08d5671e873c9b8876c02429f0be","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57c0b3dfce94","org_name":"Berkeley Research Group, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1185755,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005295"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-629096"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613595"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BRG%20Adult%20CM%202Y.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Berkeley%20Research%20Group%2C%20LLC-2025-10-30"}],"summary":"Berkeley Research Group detected suspicious activity, found that an unauthorized actor accessed its systems, and determined that some information was copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-30","discovered_date":"2025-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e9fcd05571a8bbc9de6a395105f6e0231f94e7e1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"738544771e29","org_name":"BayFirst Financial Corp.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1649739/000164973925000246/bafn-20251028.htm"}],"summary":"A third-party marketing services provider incident exposed some BayFirst customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"BAFN","base_day":"2025-10-30","returns":{"1":{"day":"2025-10-31","raw":-0.0225,"adj":-0.0258},"5":{"day":"2025-11-06","raw":-0.0807,"adj":-0.0667},"21":{"day":"2025-12-01","raw":-0.1323,"adj":-0.133},"63":{"day":"2026-02-02","raw":-0.2663,"adj":-0.2893},"126":{"day":"2026-05-04","raw":-0.2521,"adj":-0.3082}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"db5456b5c4fe8cedc2b21499b6040cf9e6c483e8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Orangeburg-Calhoun%20Technical%20College.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d6918488dc1d","org_name":"Orangeburg-Calhoun Technical College","org_type":"education","ransomware":null,"records_affected":16886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Orangeburg-Calhoun%20Technical%20College.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Orangeburg-Calhoun%20Technical%20College.pdf"}],"summary":"Orangeburg-Calhoun Technical College reported unauthorized access to a system containing student contact information, but did not state how access occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-10-29","discovered_date":"2025-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46c4f9277bf2fbd48508ad81d0df78ca78725376","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-20","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NW%20--%20Exhibit%20A%20--%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f28cc0fed6ea","org_name":"Northwest Radiologists and Mt. Baker Imaging","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NW%20--%20Exhibit%20A%20--%20Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Radiologists%20and%20Mt.%20Baker%20Imaging-2025-10-29"}],"summary":"Mt. Baker Imaging reported unauthorized access to information stored on its network from January 20 to January 25, 2025, during a network disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4fea342e17dbc68df06233e2714f5e704ce20643","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1183bb264a7","org_name":"Northwest Radiologists, Inc./Mount Baker Imaging","org_type":"healthcare","ransomware":null,"records_affected":362713,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-28-northwest-radiologists-inc-mount-baker-imaging"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdcf32ea89cc54a7b1e9d38c5c6d286e209f0ffb","impact_type":"unknown","incident_date":"2025-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Form%20Energy%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"93e4d9f0b3ef","org_name":"Form Energy, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613519"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614295"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7dd881259eb54fcdfd77ee956d5838b3665bebd1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f35fa007f41","org_name":"Better Vision Eyecare, LLC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-28-better-vision-eyecare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-27","discovered_date":"2025-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e878bdf2773199634f13700e3dc22b346de1c68","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20-%20RKA_Live_Proof_R1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9f3b7fac62e9","org_name":"RKA Consulting Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20-%20RKA_Live_Proof_R1_Redacted.pdf"}],"summary":"RKA Consulting Group reported that an unauthorized individual accessed its systems and may have accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b4cc0e4c805aabde5cd80edff1468e7d6c2e8337","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bffbc4f7046b","org_name":"REACH, Inc","org_type":"healthcare","ransomware":null,"records_affected":1195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-27-reach-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c66cec9a42095fdf9034ffbe72744ae94ca9d9f","impact_type":"data_theft","imported_from":null,"incident_date":"2025-10-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5bddc6817ca4","org_name":"MyVidster","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyVidster (2025)","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyVidster2025"}],"summary":"Data associated with 3,864,364 MyVidster users, including usernames, email addresses and some profile photos, was posted to a public hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"965c31a840905c08ba603c865fa540017a1b5ba1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"877435c8f4f5","org_name":"Health Management Systems of America","org_type":"healthcare","ransomware":null,"records_affected":4213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-27-health-management-systems-of-america"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"pear","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f163596f6370c2f23775963a0e88b14055e39dd9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4881fd9d1dd5","org_name":"VirMedice, LLC","org_type":"professional_services","ransomware":true,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-25-virmedice-llc"},{"fetched_at":null,"title":"Leak-site claim by pear","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VmlyTWVkaWNlQHBlYXI"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pear","claim_groups":["pear"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ff7846d30c9424e064a6eff68e8303aef5be165","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Incident%20Notification%20Letter%2010.20.25.pdf"},"notes":null,"org_country":"US","org_id":"ec61d2eac1d4","org_name":"Alight Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The inadvertent disclosure resulted from human error.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613379"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Incident%20Notification%20Letter%2010.20.25.pdf"}],"summary":"Alight Solutions said a report containing personal information was inadvertently disclosed to another client due to human error.","supporting_quote":"Alight determined that the inadvertent disclosure was the result of a human error, not any malicious action.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-24","discovered_date":"2025-03-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11071107bf759c159e1bac9acf26b2e1ebeb7df6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vibra%20_CA%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"670f2a358575","org_name":"Vibra Hospital of Sacramento","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613309"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vibra%20_CA%20Notice%20Letter.pdf"}],"summary":"Six employee email accounts were accessed without authorization, and personal information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-24","discovered_date":"2025-10-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"318f9e37da7bd985a629ca84849ab05b6a72cae2","impact_type":"unknown","incident_date":"2025-10-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f1a4f144ecf","org_name":"The Heights Treatment LLC","org_type":"other","ransomware":null,"records_affected":370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004627"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4b1fac61c3d18bc6b18ba9f2332373098313a7b4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1543e964443d","org_name":"Southwest Urology","org_type":"healthcare","ransomware":null,"records_affected":1310,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-24-southwest-urology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4a38b051ca6996e5eb4aa88af3799c103a45b87d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d96402ecea9","org_name":"Physicians to Children & Adolescents","org_type":"healthcare","ransomware":null,"records_affected":9536,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-24-physicians-to-children-adolescents"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-10-24","discovered_date":"2025-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbe73c7bad33260659a88ec63fa14b44a20f823e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20MCCN_0.pdf"},"notes":null,"org_country":"US","org_id":"107053d8527c","org_name":"Mission City Community Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20MCCN_0.pdf"}],"summary":"Mission City Community Network discovered unauthorized access to files and folders in its environment that may have contained patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-10-24","discovered_date":"2025-09-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3372f9a2a189b48cca98ad1f43fc4f8d1819c723","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"de53badd251a","org_name":"FUJIFILM Biotechnologies","org_type":"other","ransomware":null,"records_affected":3608,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004622"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","other"],"disclosed_date":"2025-10-24","discovered_date":"2025-08-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97c57581ef10b28ff160d5bc1c5451b15214189b","impact_type":"data_theft","incident_date":"2025-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BATTA_1-ADT-ID-CM_06_Redacted%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"0e1703ea0c62","org_name":"Batta Fulkerson Law Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613361"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BATTA_1-ADT-ID-CM_06_Redacted%20%281%29.pdf"}],"summary":"Batta Fulkerson Law Group reported that an unauthorized third party accessed its network and accessed or acquired files containing personal and potentially medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-24","discovered_date":"2025-10-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa6470ab05559a9953341676541f15faf985a988","impact_type":"unknown","incident_date":"2025-06-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f5c3c7c1262","org_name":"Alpha Auto Group","org_type":"unknown","ransomware":null,"records_affected":392,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alpha%20Auto%20Group-2025-10-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-23","discovered_date":"2025-08-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8d1f7127836e00816d8df4df88fd7207d68351e","impact_type":"unknown","incident_date":"2025-08-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19d54ae960bd","org_name":"Yamhill Community Care (YCCO)","org_type":"unknown","ransomware":null,"records_affected":1251,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Yamhill%20Community%20Care%20%28YCCO%29-2025-10-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1133"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-10-23","discovered_date":"2025-08-25","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae8b8f79e3beff3f563f68b05b0ecb81458d672e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-20","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Final%20Notice%2010-23-25.pdf"},"notes":null,"org_country":"US","org_id":"ce912907bd95","org_name":"Michael R. Schwartz, MD, FACS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613288"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Final%20Notice%2010-23-25.pdf"}],"summary":"An unauthorized party remotely accessed a computer containing patients’ personal and health information.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"55cab798b9dd5f8dbd390a208f12291567dc65fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c0bf56afece","org_name":"Michael R. Schwartz, MD Inc.","org_type":"healthcare","ransomware":null,"records_affected":9809,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-23-michael-r-schwartz-md-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ac503b10d072c6c348a8adf30771d0de481db551","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6f5460ee37bd","org_name":"Legacy Health, LLC","org_type":"professional_services","ransomware":null,"records_affected":6547,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-23-legacy-health-llc"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004624"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-23","discovered_date":"2025-06-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98caf82661edbf237fe56d502310c123f7190c5f","impact_type":"unknown","incident_date":"2024-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"86a855c66200","org_name":"Interlaken, Inc.","org_type":"unknown","ransomware":null,"records_affected":372,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Interlaken%2C%20Inc.-2025-10-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-21","discovered_date":"2024-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63cfb90cc3105a398fce6db4f3378b3fda9f201e","impact_type":"data_theft","incident_date":"2024-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20LU%20-%20Sample%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"59e9813b13d4","org_name":"Lincoln University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613159"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20LU%20-%20Sample%20Individual%20Notification%20Letter.pdf"}],"summary":"Lincoln University reported that an unauthorized actor likely took data from its network, and files in the data set contained names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","financial"],"disclosed_date":"2025-10-21","discovered_date":"2025-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d0f43f72952bda4e46273bff3047584531a88ee9","impact_type":"both","imported_from":null,"incident_date":"2025-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f9e6b7b08abb","org_name":"Jewett-Cameron Trading Company","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/885307/000107997325001631/jctc_8k.htm"}],"summary":"Jewett-Cameron Trading Company reported unauthorized access to its internal IT systems, data exfiltration, encryption software deployment, operational disruption, and an extortion threat.","supporting_quote":null,"technology_involved":["internal corporate IT systems","business applications","computer devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"JCTC","base_day":"2025-10-21","returns":{"1":{"day":"2025-10-22","raw":-0.0209,"adj":-0.0157},"5":{"day":"2025-10-28","raw":-0.0418,"adj":-0.0653},"21":{"day":"2025-11-19","raw":-0.2537,"adj":-0.2408},"63":{"day":"2026-01-22","raw":-0.3821,"adj":-0.4084},"126":{"day":"2026-04-23","raw":-0.4299,"adj":-0.4852}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-21","discovered_date":"2025-10-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ff36fe18c8c4d37a96d1feefc797d3501179cc93","impact_type":"unknown","incident_date":"2025-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"daef354613e8","org_name":"C&C Dental Family, PLLC","org_type":"healthcare","ransomware":null,"records_affected":421,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004621"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-21","discovered_date":"2025-08-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a71d10deebe2d8c195a50a52c88de6946fb31c10","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5cdf47ebc079","org_name":"Aries Freight Systems, LP","org_type":"other","ransomware":null,"records_affected":409,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004620"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2025-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f46c8e23e489c31be9f0e55f5ca5071758cadb7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBEE2583-64CE-4A0F-9F8B-EC2114385094"},"incident_date":"2025-10-20","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KP","org_id":"08225b99e5e2","org_name":"SK shieldus","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://biz.chosun.com/en/en-it/2025/10/27/TBFOICOBIJABJPHSYEGEWLDB6Q/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.chosun.com/english/industry-en/2025/10/20/ESYGLX26P5A3BFJQMMJJSX2YMU/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theitplus.kr/news/articleView.html?idxno=1392"},{"fetched_at":null,"title":"Leak-site claim by blackshrantac","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U0sgc2hpZWxkdXNAYmxhY2tzaHJhbnRhYw"}],"summary":"\"According to the SK shieldus breach investigation underway by the Ministry of Science and ICT, about 15GB of data was leaked through the personal email accounts of two internal employees. The leaked data is understood to include information on a total of 120 private companies—15","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["blackshrantac"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"79d999860db995b57c6c164217191dab34b94d31","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"347b5dbdd64b","org_name":"Express Canna Cards, LLC","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-20-express-canna-cards-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7e1660f10ebf172360ae5ffebf97a327d83a0bbf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34990.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b140e6817da7","org_name":"The Evergreen State College","org_type":"education","ransomware":null,"records_affected":7727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34990.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34990.pdf"}],"summary":"The Evergreen State College reported unauthorized access to a legacy file share system, where files containing personal information may have been accessed.","supporting_quote":null,"technology_involved":["legacy file share system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-17","discovered_date":"2025-06-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb6fb08e3bf76518cc8f8bf80a4fe6414d2de9ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d99e198571b6","org_name":"Southern Methodist University","org_type":"education","ransomware":null,"records_affected":303,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004619"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3fda2017a9bb11aa8530641cb2ccfe483db5f032","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b06cc82b4f13","org_name":"Modernizing Medicine, Inc.","org_type":"professional_services","ransomware":null,"records_affected":198795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-17-modernizing-medicine-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-10-17","discovered_date":"2025-07-16","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"925afecc0e182e2ff7b22cac36a75840a540278a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-09","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Khan%20and%20Associates%2C%20CPA%20Breach%20Notice_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"645fe3ab92e0","org_name":"Khan and Associates CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613034"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Khan%20and%20Associates%2C%20CPA%20Breach%20Notice_Redacted.pdf"}],"summary":"An unauthorized user accessed Khan and Associates CPA’s Intuit tax filing software, filed fraudulent tax returns, and accessed sensitive information on tax forms.","supporting_quote":"On July 16, 2025, we discovered that an unauthorized user gained access to our third-party tax filing software, Intuit, and filed a federal tax return and state tax return on your behalf.","technology_involved":["Intuit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Intuit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"71b813da9532","name":"Intuit"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"82fc25a6564f55f3123ba9f0046e0cc490081d04","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bde6f780c88e","org_name":"Heartland Health Center","org_type":"healthcare","ransomware":null,"records_affected":43728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-17-heartland-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0031f61501b22243e66783cf4087fd78390489fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a8f066668af1","org_name":"Firetree, Ltd","org_type":"healthcare","ransomware":null,"records_affected":17979,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-17-firetree-ltd"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-16","discovered_date":"2024-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85ea624b04b194bd245d051a627c178274a518e5","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_15_0.pdf"},"notes":null,"org_country":"US","org_id":"a712e9f8c56a","org_name":"Watsonville Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_15_0.pdf"}],"summary":"Watsonville Community Hospital reported unauthorized access to a limited subset of its network and files accessed or downloaded without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-16","discovered_date":"2025-08-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2acaf222e86a732d98e56923eb1dd76dd66fb320","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa766bafd636","org_name":"Verita Global, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":462,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004613"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"949e90a147decb3663785410b3c10d31ca2c54c8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94332c4489f7","org_name":"River City Eye Care, LLC","org_type":"healthcare","ransomware":null,"records_affected":6588,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-16-river-city-eye-care-llc"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#River%20City%20Eye%20Care%2C%20LLC-2025-10-16"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"700e5434214fe111a283a61da348d0a6829ad8e0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"865b29db4ee2","org_name":"Prosper","org_type":"financial","ransomware":null,"records_affected":17605276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Prosper","type":"hibp","url":"https://haveibeenpwned.com/Breach/Prosper"}],"summary":"Prosper reported unauthorized access to its systems in September 2025, exposing customer and applicant information affecting 17,605,276 unique email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb26691362b1c1284cad5cfc65ddbb4169db6a59","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PeopleGuru%20Holdings%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"842d6c42f627","org_name":"PeopleGuru Holdings, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PeopleGuru%20Holdings%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PeopleGuru%20Holdings%2C%20Inc.-2025-10-16"}],"summary":"PeopleGuru reported that an unauthorized third party accessed certain systems and that personal, financial, and medical information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-16","discovered_date":"2025-08-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f7e658f11e710271d0e5c763a862cf27a3974a14","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79a98d2e8b98","org_name":"NPK International Inc.","org_type":"other","ransomware":null,"records_affected":6044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004617"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcdeadfea6f03557deff8f0b7a5e3c69ebcf8e4a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4DA3B7F-BBCE-2345-D777-2B0674A318D5"},"incident_date":"2025-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VN","org_id":"03a5371989ca","org_name":"Vietnam Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/salesforce-extortion-group-leaks-data-after-fbi-disruption-a-29710;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vietnamnet.vn/en/hackers-leak-data-of-23-million-vietnam-airlines-passengers-2452041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://e.vnexpress.net/news/news/23-million-records-leaked-in-vietnam-airlines-linked-data-breach-4951251.html"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VmlldG5hbSBBaXJsaW5lc0BzaGlueWh1bnRlcnM"},{"fetched_at":null,"title":"Have I Been Pwned: Vietnam Airlines","type":"hibp","url":"https://haveibeenpwned.com/Breach/VietnamAirlines"}],"summary":"\"Scattered Lapsus$ Hunters said Saturday it leaked data stolen from six victims: grocery giant Albertsons, global energy and services firm Engie Resources, Japanese camera maker Fuji Film, clothing retailer Gap, the Australian airline Qantas and Vietnam Airlines.\n\nCompromised dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a996244859e85dbc0a650b3ed41ccb20295cd71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A87FF679-A2F3-E71D-9181-A67B7542122C"},"incident_date":"2025-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49483b3209f0","org_name":"The Gap","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/salesforce-extortion-group-leaks-data-after-fbi-disruption-a-29710;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vietnamnet.vn/en/hackers-leak-data-of-23-million-vietnam-airlines-passengers-2452041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://e.vnexpress.net/news/news/23-million-records-leaked-in-vietnam-airlines-linked-data-breach-4951251.html"}],"summary":"\"Scattered Lapsus$ Hunters said Saturday it leaked data stolen from six victims: grocery giant Albertsons, global energy and services firm Engie Resources, Japanese camera maker Fuji Film, clothing retailer Gap, the Australian airline Qantas and Vietnam Airlines.\n\nCompromised dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-15","discovered_date":"2024-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f38e689285b37fcca47857c306cfc76db2edfd2","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Palamor%20Health%20Medical%20Group%20-%20CA%20-%20Exhibit%20A-B_0.pdf"},"notes":null,"org_country":"US","org_id":"6dde084313b2","org_name":"Palomar Health Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612839"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Palamor%20Health%20Medical%20Group%20-%20CA%20-%20Exhibit%20A-B_0.pdf"}],"summary":"Palomar Health Medical Group found that an unauthorized actor accessed files from April 23 to May 5, 2024, and may have copied them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-15","discovered_date":"2025-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f0c596dd78db2747dc4c07be3b775fd13a6bddf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-19","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34956.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5c7df2c70e4a","org_name":"Kadlec Clinic","org_type":"healthcare","ransomware":null,"records_affected":992,"reviewed":false,"root_cause":"A technical error during printing mixed up patient names and addresses.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34956.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34956.pdf"}],"summary":"A printing configuration error caused some Kadlec Clinic patients to receive mailers bearing another patient's name.","supporting_quote":"During the printing process, a technical error occurred when configuring information resulting in a mix-up of patient names and addresses.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":"2025-09-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f4f5b91d7e7acf8f387a59c337e92ad267633c9","impact_type":"unknown","incident_date":"2025-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ad455025bfe","org_name":"International Grand Investment Corp.","org_type":"unknown","ransomware":null,"records_affected":1128,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Grand%20Investment%20Corp.-2026-05-27"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Grand%20Investment%20Corp.-2025-10-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"196d6230c6d129fdbca3139274d1479e471d504c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECCBC87E-4B5C-E2FE-2830-8FD9F2A7BAF3"},"incident_date":"2025-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"564635140f9a","org_name":"Fuji Film","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/salesforce-extortion-group-leaks-data-after-fbi-disruption-a-29710;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vietnamnet.vn/en/hackers-leak-data-of-23-million-vietnam-airlines-passengers-2452041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://e.vnexpress.net/news/news/23-million-records-leaked-in-vietnam-airlines-linked-data-breach-4951251.html"}],"summary":"\"Scattered Lapsus$ Hunters said Saturday it leaked data stolen from six victims: grocery giant Albertsons, global energy and services firm Engie Resources, Japanese camera maker Fuji Film, clothing retailer Gap, the Australian airline Qantas and Vietnam Airlines.\n\nCompromised dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2025-10-15","discovered_date":"2025-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"34730a9144d7621ef8817f73986a8a0fd7b872ea","impact_type":"data_theft","imported_from":null,"incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f11c014cb20a","org_name":"F5, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1048695/000104869525000149/ffiv-20251015.htm"}],"summary":"F5 reported that a nation-state threat actor accessed company systems and exfiltrated files containing portions of BIG-IP source code and information about undisclosed vulnerabilities.","supporting_quote":null,"technology_involved":["BIG-IP","engineering knowledge management platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"FFIV","base_day":"2025-10-15","returns":{"1":{"day":"2025-10-16","raw":-0.107,"adj":-0.1002},"5":{"day":"2025-10-22","raw":-0.0995,"adj":-0.1035},"21":{"day":"2025-11-13","raw":-0.2778,"adj":-0.2881},"63":{"day":"2026-01-15","raw":-0.1716,"adj":-0.2123},"126":{"day":"2026-04-17","raw":-0.0601,"adj":-0.1277},"250":{"day":"2026-10-14","raw":0.3825,"adj":0.2255}}}}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d992f192713d4ecb599fe0c73a2c6d34960a190","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C81E728D-9D4C-2F63-6F06-7F89CC14862C"},"incident_date":"2025-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00d8a5a86567","org_name":"Engie Resources","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/salesforce-extortion-group-leaks-data-after-fbi-disruption-a-29710;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vietnamnet.vn/en/hackers-leak-data-of-23-million-vietnam-airlines-passengers-2452041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://e.vnexpress.net/news/news/23-million-records-leaked-in-vietnam-airlines-linked-data-breach-4951251.html"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RW5naWUgUmVzb3VyY2VzQHNoaW55aHVudGVycw"}],"summary":"\"Scattered Lapsus$ Hunters said Saturday it leaked data stolen from six victims: grocery giant Albertsons, global energy and services firm Engie Resources, Japanese camera maker Fuji Film, clothing retailer Gap, the Australian airline Qantas and Vietnam Airlines.\n\nCompromised dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-15","discovered_date":"2025-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"e1d969db9dbd459289f30c2b347cf857f6f30abf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Coalesce%2C%20LLC%20dba%20Benefitelect%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7b7a54fb2009","org_name":"Benefitelect","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-15-coalesce-llc-dba-benefitelect"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612847"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coalesce%2C%20LLC%20dba%20Benefitelect%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Benefitelect reported that files containing personal information were accessed and/or exfiltrated without authorization.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c7af974016bf291ac174078afd8c780e8382bd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4CA4238-A0B9-2382-0DCC-509A6F75849B"},"incident_date":"2025-10-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"137b4e898f5c","org_name":"Albertsons","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/salesforce-extortion-group-leaks-data-after-fbi-disruption-a-29710;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vietnamnet.vn/en/hackers-leak-data-of-23-million-vietnam-airlines-passengers-2452041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://e.vnexpress.net/news/news/23-million-records-leaked-in-vietnam-airlines-linked-data-breach-4951251.html"}],"summary":"\"Scattered Lapsus$ Hunters said Saturday it leaked data stolen from six victims: grocery giant Albertsons, global energy and services firm Engie Resources, Japanese camera maker Fuji Film, clothing retailer Gap, the Australian airline Qantas and Vietnam Airlines.\n\nCompromised dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-14","discovered_date":"2025-09-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1959992fe8b0c52838d0998033e72be8dd5c5b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07962a07980d","org_name":"Roofstock, Inc.","org_type":"other","ransomware":null,"records_affected":1595,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004607"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-10-14","discovered_date":"2025-01-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b0e9ff318285b4747e4af35f3f6956ba6e96e3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf4ce333c1e5","org_name":"Neighbors Credit Union","org_type":"financial","ransomware":null,"records_affected":297152,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004606"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01195a1952645c4838c07825d30ee437e08f3f57","impact_type":"unknown","incident_date":"2024-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_Adult_SSN_Letter_36954629v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a711ad8c6a7","org_name":"Dulcich, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612821"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004614"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dulcich%2C%20Inc.-2025-10-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-13","discovered_date":"2025-07-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac607d38d49096486406939657e2ceeb7f6f9775","impact_type":"data_theft","incident_date":"2025-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notification%20WCIRB%20Phase%204_r1.pdf"},"notes":null,"org_country":"US","org_id":"1e9d7f6c37c0","org_name":"Workers Compensation Insurance Rating Bureau of California","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619136"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615576"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612771"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notification%20WCIRB%20Phase%204_r1.pdf"}],"summary":"An unauthorized third party accessed a Box.com system and acquired personal information.","supporting_quote":null,"technology_involved":["Box.com"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Box.com"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ae606b792498","name":"Box.com"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6acb6580e590e5b3b3075a01f14ccbc24fb11f1c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53448ee99f41","org_name":"Aunt Martha’s Health & Wellness, Inc.","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-13-aunt-martha-s-health-wellness-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-11","discovered_date":"2025-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"ddf4ea57f91b5e9d6a3309da52d01c602ac544ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a07cad4dad9","org_name":"Payactiv, Inc.","org_type":"financial","ransomware":null,"records_affected":202194,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004778"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612706"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Payactiv%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Payactiv%2C%20Inc.-2025-10-11"}],"summary":"Payactiv reported that an unauthorized actor viewed information stored in its systems between April 3 and August 20, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5e8d1adb5ce65386bd66d982de26e2f20f6eabf1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f6f02cbcc7c","org_name":"Visiting Nurse Association of Texas, LLC","org_type":"healthcare","ransomware":null,"records_affected":28515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-10-visiting-nurse-association-of-texas-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-10","discovered_date":"2025-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e7a42079a2421ee8cbfad1060a1b45eba3abaf","impact_type":"data_theft","incident_date":"2025-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SimonMed%20Individual%20Letter-%20SAMPLE.pdf"},"notes":null,"org_country":"US","org_id":"fe52c4e47c31","org_name":"SimonMed Imaging","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612578"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SimonMed%20Individual%20Letter-%20SAMPLE.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004609"}],"summary":"SimonMed Imaging reported unauthorized access to its systems between January 21 and February 5, 2025, during which files containing personal information were obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-10-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d07b720a9b40fe0502df0ad92a5e02584c42508c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Open%20Practice%20Solutions%2C%20LTD%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a72b2bf22291","org_name":"Open Practice Solutions, LTD","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfiguration in a software update allowed another OPS customer to access some billing information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612590"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Open%20Practice%20Solutions%2C%20LTD%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004608"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34904.pdf"}],"summary":"A software-update misconfiguration in Open Practice Solutions' billing portal may have allowed another customer to access billing information.","supporting_quote":"We immediately launched an investigation and determined that due to a misconfiguration in a software update deployed that morning, another OPS customer may have had access to some of your billing information.","technology_involved":["billing portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-10","discovered_date":"2025-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0552f7c326ddf509c3e89e4bf78ec58e06181011","impact_type":"data_theft","incident_date":"2025-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Goosehead%20Insurance%20Agency%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0b985ef930d7","org_name":"Goosehead Insurance Agency, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Goosehead%20Insurance%20Agency%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004610"}],"summary":"Goosehead reported that an unauthorized actor accessed systems and copied files between March 6 and March 13, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22ea538c5607c7db808f8c7001411c01b680326","impact_type":"unknown","incident_date":"2025-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79d27a8e0d3d","org_name":"Diversity Connected","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612689"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9046b696caed0d8b1167aa1e6d05b6d25dd1ad73","impact_type":"unknown","incident_date":"2025-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/1%20-%20APM%20-%20Adult%20SSN_v3_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f94933dba9e5","org_name":"Action Property Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612612"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"16473a7f94f888c7ba6207ca2e188f17700e51ce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58969597c9d4","org_name":"Bay Medical LLC","org_type":"healthcare","ransomware":null,"records_affected":1483,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-09-bay-medical-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-08","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"fe68d0f2fcac5125463eb35840b52dac5611f6c0","impact_type":"data_theft","incident_date":"2024-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification%20Letter_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1f4ef2795543","org_name":"Conduent Business Services LLC","org_type":"professional_services","ransomware":null,"records_affected":62224658,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-08-conduent-business-services-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612430"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Conduent%20Business%20Services%2C%20LLC-2025-10-24"}],"summary":"Conduent reported that an unauthorized third party accessed its environment and obtained files containing personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"11587d7129fba30200ad74f81004a1ff76edf329","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dab2adc4441a","org_name":"Wellpoint, Inc.","org_type":"professional_services","ransomware":null,"records_affected":579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-07-wellpoint-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad7a7c0d9e429a26519e643b0f7cd0208934b9af","impact_type":"data_theft","incident_date":"2025-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Institute%20of%20Culinary%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6297d54707d4","org_name":"The Institute of Culinary Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Institute%20of%20Culinary%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"The Institute of Culinary Education reported that an unauthorized actor accessed Institute systems and copied files around May 5, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-10-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e893a48814e69c5930d4c952446310838ca12ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6512BD43-D9CA-A6E0-2C99-0B0A82652DCA"},"incident_date":"2025-10-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"228dcc6677aa","org_name":"Stellantis","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.foxnews.com/tech/jeep-chrysler-parent-stellantis-confirms-data-breach"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3RlbGxhbnRpc0BzaGlueWh1bnRlcnM"}],"summary":"\"Automotive giant Stellantis has just revealed that it suffered a data breach, exposing customer contact details, after attackers infiltrated a third-party platform used for North American customer services. The announcement comes at a time when large-scale attacks on cloud CRM s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e28e6f6aaedcb4e29247417d061e9780facfe4c3","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6417c8300df7","org_name":"Adpost","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adpost","type":"hibp","url":"https://haveibeenpwned.com/Breach/Adpost"}],"summary":"Data from an earlier Adpost breach surfaced in February 2025, including email addresses, usernames, and display names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-06","discovered_date":"2025-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea95f19aeac873708989b6bf05c9f8f437f2479f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34850.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cf6749ac6aa9","org_name":"Spokane Produce, Inc.","org_type":"unknown","ransomware":null,"records_affected":788,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34850.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34850.pdf"}],"summary":"Spokane Produce reported that files potentially acquired without authorization contained some individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c128daf206dacff1eb8962897cb17ac262ff4355","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b7c388fd247","org_name":"Space Coast Vascular","org_type":"healthcare","ransomware":null,"records_affected":18819,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-06-space-coast-vascular"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e08cc0df5736072529da72ab2aa468324522eec0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79627c517f4f","org_name":"Sierra Vista Hospital & Clinics","org_type":"healthcare","ransomware":null,"records_affected":75054,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-06-sierra-vista-hospital-clinics"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-10-06","discovered_date":"2025-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"c9e24e6c28513bed3167a77c175a9393adcfc309","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OB-GYN-IndividualLetter_Wave%202_final_v2_Redacted.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6f298e78ccf2","org_name":"OB-GYN Associates, Ltd.","org_type":"healthcare","ransomware":true,"records_affected":62238,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-06-ob-gyn-associates-ltd-dba-obgyn-associates"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/T0IgR1lOIEFzc29jaWF0ZXNAaW5jcmFuc29t"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613544"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OB-GYN-IndividualLetter_Wave%202_final_v2_Redacted.pdf"}],"summary":"OB-GYN Associates detected unauthorized access to its network environment and determined that personal and medical information was acquired.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"56422cc5b5550af6abc5f6fcc3021f2ba45ec688","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dfbd5ea45fe9","org_name":"Cardiovascular Medicine Associates (doing business as MyCardiologist)","org_type":"healthcare","ransomware":null,"records_affected":2248,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-06-cardiovascular-medicine-associates-doing-business-as-mycardiologist"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-10-06","discovered_date":"2025-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fbb4e3afb1ce1d54394821fc57fd0a21c2d10718","impact_type":"both","imported_from":null,"incident_date":"2025-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'Akira' not in source; cleared","org_country":"US","org_id":"482ad349242a","org_name":"BK Technologies Corporation","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/2186/000143774925030540/bkti20251006_8k.htm"},{"fetched_at":null,"title":"Leak-site claim by akira","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QksgVGVjaG5vbG9naWVzQGFraXJh"}],"summary":"BK Technologies detected suspicious activity in its IT systems and reported disruption to some systems and possible acquisition of non-public information, including records pertaining to current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["akira"],"price":{"ticker":"BKTI","base_day":"2025-10-06","returns":{"1":{"day":"2025-10-07","raw":-0.0024,"adj":0.0013},"5":{"day":"2025-10-13","raw":-0.1153,"adj":-0.1025},"21":{"day":"2025-11-04","raw":-0.0805,"adj":-0.0859},"63":{"day":"2026-01-06","raw":-0.0029,"adj":-0.033},"126":{"day":"2026-04-08","raw":0.1026,"adj":0.096},"250":{"day":"2026-10-05","raw":-0.0453,"adj":-0.199}}}}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8920e2ae6246763777a35486c7b1a024a23216e","impact_type":"both","imported_from":null,"incident_date":"2025-08-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4abe66d0d747","org_name":"Artists&Clients","org_type":"technology_saas","ransomware":true,"records_affected":95351,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Artists&Clients","type":"hibp","url":"https://haveibeenpwned.com/Breach/ArtistsNClients"}],"summary":"Artists&Clients suffered a data breach followed by a $50,000 ransom demand, and leaked data included email addresses, usernames, IP addresses and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7854b38ba3188dede1b59fd3e326fed1874dbe8a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Sunnyvale_0.pdf"},"notes":null,"org_country":"US","org_id":"52d3d996c019","org_name":"Sunnyvale Elementary School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612238"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613199"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Sunnyvale_0.pdf"}],"summary":"Sunnyvale Elementary School District identified suspicious activity in its email environment and determined that a limited number of employee email accounts had been accessed without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b3b344345475724d2d0e6d7ba4c0005e7909b1f6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81ebdbdf3868","org_name":"Southwest C.A.R.E. Center","org_type":"healthcare","ransomware":null,"records_affected":21866,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-03-southwest-c-a-r-e-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5866206e485743e7442a70178447a632f53ea34c","impact_type":"data_theft","imported_from":null,"incident_date":"2022-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ac31c54fd4d7","org_name":"Latest Pilot Jobs","org_type":"unknown","ransomware":null,"records_affected":118864,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Latest Pilot Jobs","type":"hibp","url":"https://haveibeenpwned.com/Breach/LatestPilotJobs"}],"summary":"Latest Pilot Jobs suffered a data breach in August 2022 involving email addresses, names, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f99d2b685dd624f98892a3c7e471f9573c8950f0","impact_type":"data_theft","imported_from":null,"incident_date":"2020-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BR","org_id":"8492adbe9919","org_name":"HomeRefill","org_type":"retail_ecommerce","ransomware":null,"records_affected":187457,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HomeRefill","type":"hibp","url":"https://haveibeenpwned.com/Breach/HomeRefill"}],"summary":"HomeRefill suffered a data breach in April 2020 that exposed email addresses, names, phone numbers, dates of birth, and salted password hashes.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1b74629c9272af92c3c60c08f9f57e4efdc3f1bc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c419755e8d10","org_name":"Harris County Hospital District d/b/a Harris Health","org_type":"healthcare","ransomware":null,"records_affected":5357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-03-harris-county-hospital-district-d-b-a-harris-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-10-03","discovered_date":"2024-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"807ae5ce2be1cd210ee6ff5a4a122fa8bc1f13c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34826.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4792f0088d76","org_name":"Brightstar Global Solutions Corporation","org_type":"technology_saas","ransomware":null,"records_affected":1796,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34826.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34826.pdf"}],"summary":"Brightstar Global Solutions Corporation reported unauthorized access to internal corporate systems, where personal information was available; it said it was not aware of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-10-03","discovered_date":"2024-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"86bf1a98a2d8a07153524d996bac1d248eb767d1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_5.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4792f0088d76","org_name":"Brightstar Global Solutions Corporation","org_type":"other","ransomware":null,"records_affected":103879,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-03-brightstar-global-solutions-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612203"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_5.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004655"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brightstar%20Global%20Solutions%20Corporation-2025-10-03"}],"summary":"Brightstar Global Solutions Corporation reported that an unauthorized third party accessed internal corporate systems, exposing personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9d6d368e4501c9e011d22f3ad891bc06094d2669","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6321aa580b3a","org_name":"Arizona Health Care Cost Containment System- State Medicaid Agency","org_type":"healthcare","ransomware":null,"records_affected":3177,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-10-03-arizona-health-care-cost-containment-system-state-medicaid-agency"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-10-02","discovered_date":"2024-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"610619e36d2751779494c9b8f1724110884a8a7f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/V1%20-%20Adult%20CM.pdf"},"notes":null,"org_country":"US","org_id":"d2eb288ba877","org_name":"City of Pittsburg","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/V1%20-%20Adult%20CM.pdf"}],"summary":"The City of Pittsburg reported a security incident in which individuals’ names and other unspecified information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9e044ff0ee3518759a5bc164aec313a5190cfa4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Sheheen%2C%20Hancock%20%26%20Godwin%2C%20LLP.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d54a796c9e8","org_name":"Sheheen, Hancock & Godwin, LLP","org_type":"unknown","ransomware":null,"records_affected":34059,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Sheheen%2C%20Hancock%20%26%20Godwin%2C%20LLP.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e66c5e2b67d38bc9ce00da7591e016eb0b30b823","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6512BD43-D9CA-A6E0-2C99-0B0A82652DCA"},"incident_date":"2025-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e1f0921081b","org_name":"Envoy Air","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.technewshub.co.uk/post/envoy-air-confirms-data-breach-linked-to-extortion-campaign-targeting-oracle-software;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/american-airlines-subsidiary-envoy-air-hit-by-oracle-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://nationalcioreview.com/articles-insights/extra-bytes/american-airlines-subsidiary-breached-via-oracle-zero-day-exploit/"}],"summary":"\"Envoy Air, the largest regional carrier and a wholly owned subsidiary of American Airlines, has confirmed that it fell victim to a recent data theft campaign orchestrated by the notorious cybercriminal group Clop. The attack exploited vulnerabilities within the company's Oracle ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"930cbe2a5f0aba9b93f5a18dfeeb528b641bb9b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A_-_Adult_SSN_CA_Source_Redacted_36897966v1.pdf"},"notes":null,"org_country":"US","org_id":"7b66dbd312fd","org_name":"County of Stanislaus","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A_-_Adult_SSN_CA_Source_Redacted_36897966v1.pdf"}],"summary":"A Stanislaus County employee inadvertently disclosed by email a file containing sensitive information related to a limited number of individuals.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba56b603c0348b49762ce95ec0e0113de5055138","impact_type":"data_theft","incident_date":"2025-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Loyalty%20A%20-%20Template%20Notice%28700087788.1%29.pdf"},"notes":null,"org_country":"US","org_id":"0152e62434d3","org_name":"WestJet","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612023"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Loyalty%20A%20-%20Template%20Notice%28700087788.1%29.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20WestJet.pdf"}],"summary":"WestJet reported that an unauthorized third party obtained data from its systems, including personal and travel-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"55eb53e0cd5bb9e53a08ba6ea2cc34d2a5fdb946","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"193554b2d9d1","org_name":"Harbor","org_type":"healthcare","ransomware":null,"records_affected":216000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-30-harbor"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1021.001"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-29","discovered_date":"2025-08-14","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"068ae0267907fd02adbfc8ec4c6c4ff57aca18b7","impact_type":"data_theft","incident_date":"2025-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Job%20Shop%20Notice%20to%20CA%20Residents.pdf"},"notes":null,"org_country":"US","org_id":"16176647c45d","org_name":"The Job Shop","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610827"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Job%20Shop%20Notice%20to%20CA%20Residents.pdf"}],"summary":"The Job Shop reported that an unknown threat actor accessed a vendor-managed remote desktop server containing W-2 forms, which may have been exfiltrated.","supporting_quote":null,"technology_involved":["remote desktop server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-29","discovered_date":"2025-07-11","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcc17077f2d22fbe49225c6fe23bcd56f80f148a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-09","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_12.pdf"},"notes":null,"org_country":"US","org_id":"532bcdfaa784","org_name":"Superior Vision Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack targeted a Superior Vision employee.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610774"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_12.pdf"}],"summary":"A phishing attack targeting a Superior Vision employee may have enabled unauthorized access to emails containing customer personal information.","supporting_quote":"On July 9, 2025, a Superior Vision employee was the victim of a sophisticated phishing attack.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-29","discovered_date":"2025-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"046487128c38ecc1768171a908cf20b2b62ea431","impact_type":"both","incident_date":"2025-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%201-Year%20Letter-PDF.pdf"},"notes":null,"org_country":"US","org_id":"51bdb5d34d40","org_name":"Motility Software Solutions, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610795"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%201-Year%20Letter-PDF.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Motility%20Software%20Solutions%2C%20Inc.-2025-09-30"}],"summary":"Motility Software Solutions detected malware that encrypted part of its systems, and forensic evidence suggested that limited files containing customers’ personal data may have been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-29","discovered_date":"2025-04-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e019a47d9754ca7b3eb548f2c111cd71497df05b","impact_type":"data_theft","incident_date":"2025-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Belkorp%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"98a5e0e87385","org_name":"Belkorp Ag, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610801"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Belkorp%20Letter%20Sample.pdf"}],"summary":"Belkorp Ag, LLC reported that an unauthorized actor accessed and copied data from its network between April 18 and April 26, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-26","discovered_date":"2025-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b876d53ac3dd01a59b5f6edf6f1a9d42ac8fb02a","impact_type":"disruption_or_ransomware","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34760.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0c47c905a9ea","org_name":"T.R.A. Industries Inc.","org_type":"unknown","ransomware":true,"records_affected":9612,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34760.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34760.pdf"}],"summary":"T.R.A. Industries detected unusual traffic and later an unauthorized intruder activated ransomware; files containing personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-26","discovered_date":"2025-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f1567913daa9947d14335dab28b3ac7d154b5a3","impact_type":"data_theft","incident_date":"2025-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34771.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"88c438efc88a","org_name":"Georgetown Brewing Company","org_type":"manufacturing","ransomware":null,"records_affected":19143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34771.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34771.pdf"}],"summary":"Georgetown Brewing Company reported unauthorized access to its servers and exfiltration of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-26","discovered_date":"2025-07-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8748b370140e9a46c4b8717963aea5a17ca50dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EMPIRE_Individual%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"0b4c106b3109","org_name":"EMPIRE Distribution Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EMPIRE_Individual%20Notice%20Letter_0.pdf"}],"summary":"EMPIRE Distribution Inc. reported that an unknown third party accessed certain internal systems and data, which may have included personal and bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-26","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5d56405c4490ca224b8de2c7fbe6cf2afadfcd91","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34758.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"17e3dfd8fdb2","org_name":"Emergency Responders Health Center","org_type":"healthcare","ransomware":null,"records_affected":1528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-26-emergency-responders-health-center"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34758.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2dcf639a15009740197817b7e0738abbc3c78509","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d054ed5ff24a","org_name":"Valley Radiology","org_type":"healthcare","ransomware":null,"records_affected":1166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-25-valley-radiology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"28e6b06de4e75ecde4442cd81ee2ccb7a2f211f6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e7d04a2ef2dc","org_name":"Susan B. Allen Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":11866,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-25-susan-b-allen-memorial-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"14c21280b71521418acc099c269854a3f443ebe9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9bc852d09882","org_name":"Rockhill Women’s Care","org_type":"healthcare","ransomware":null,"records_affected":70129,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-25-rockhill-women-s-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-25","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"09aef413cc174e262d8b5cf3f1cf2b98e069c943","impact_type":"unknown","incident_date":"2025-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6f0b436472d0","org_name":"RF Associates llc","org_type":"unknown","ransomware":null,"records_affected":1551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RF%20Associates%20llc-2025-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a1a062274f7f99f34b3b70875a6ba17d4bfdf7d","impact_type":"data_theft","imported_from":null,"incident_date":"2024-09-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"134bbe5e7c64","org_name":"Cultura","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cultura","type":"hibp","url":"https://haveibeenpwned.com/Breach/Cultura"}],"summary":"Cultura reported a data breach attributed to an external IT service provider that exposed customer contact, address, and purchase information.","supporting_quote":"In September 2024, French retailer Cultura was the victim of a cyber attack they attributed to an external IT service provider .","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-24","discovered_date":"2024-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c7327a8c0b5a22fda0784ab77c09e1e31c50c85","impact_type":"data_theft","incident_date":"2024-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34742.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0ed0cdc02e27","org_name":"Tekni-Plex, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34742.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34742.pdf"}],"summary":"TekniPlex reported that an unauthorized actor accessed its network and accessed and/or copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-24","discovered_date":"2025-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"da59fd3b94d4a9367b8a25f449d1c191b2859d56","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-09-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"aaf3ac891782","org_name":"RTX Corporation","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/101829/000010182925000036/rtx-20250919.htm"}],"summary":"RTX reported a ransomware incident affecting systems supporting its MUSE passenger processing software, leading customers to use backup or manual processes and experience flight delays and cancellations.","supporting_quote":null,"technology_involved":["MUSE passenger processing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"price":{"ticker":"RTX","base_day":"2025-09-24","returns":{"1":{"day":"2025-09-25","raw":-0.0054,"adj":-0.0008},"5":{"day":"2025-10-01","raw":0.0361,"adj":0.0249},"21":{"day":"2025-10-23","raw":0.1119,"adj":0.0958},"63":{"day":"2025-12-23","raw":0.1511,"adj":0.1104},"126":{"day":"2026-03-26","raw":0.195,"adj":0.2192},"250":{"day":"2026-09-23","raw":0.1909,"adj":0.0295}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-24","discovered_date":"2025-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f4b0122d1f55b0122ee330403535f5edc71e0d0","impact_type":"data_theft","imported_from":null,"incident_date":"2025-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Braun%20Electric%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"54f9c81451ec","org_name":"Braun Electric Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Braun%20Electric%20-%20Sample%20Notice.pdf"}],"summary":"Braun Electric reported that files containing personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f7d9dc36881b4602126fea41147fa8db5beae7","impact_type":"data_theft","imported_from":null,"incident_date":"2025-08-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"eaa8991af076","org_name":"Bouygues Telecom","org_type":"telecom","ransomware":null,"records_affected":5685771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bouygues Telecom","type":"hibp","url":"https://haveibeenpwned.com/Breach/BouyguesTelecom"}],"summary":"Bouygues Telecom detected a cyber attack in August 2025 that exposed customer records, including personal details and IBANs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"275dc28d3530fd1160acf5f89f586a7be5573f90","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a18a3721f8d","org_name":"Philadelphia Corporation for Aging (PCA)","org_type":"professional_services","ransomware":null,"records_affected":410491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-23-philadelphia-corporation-for-aging-pca"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-09-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f22be951d7058031e258a89d14756d70acae6a4a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34728.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fa68f7a6980a","org_name":"Outcomes One, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34728.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34728.pdf"}],"summary":"Outcomes One reported that an employee email account was accessed during a phishing incident, exposing files and emails that may have contained personal, medical, and health insurance information.","supporting_quote":"We recently completed an investigation related to an email phishing incident that occurred on July 1, 2025.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-09-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d8358ba9f78b719266296b2f75e8a3dc56d4cfe","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Outcomes%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"fa68f7a6980a","org_name":"Outcomes One, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610436"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Outcomes%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004623"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Outcomes%20One%2C%20Inc.-2025-09-23"}],"summary":"An email phishing incident involved unauthorized access to an Outcomes employee’s email account, where files and emails containing personal and medical information may have been accessed.","supporting_quote":"We recently completed an investigation related to an email phishing incident that occurred on July 1, 2025.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8fefa3f1617edda27e73bd6782b3656da2896ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CBBC409-EC99-0F19-C78C-75BD1E06F215"},"incident_date":"2025-09-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"153d33d322bb","org_name":"Dior","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/tiffany-dior-suffer-south-korean-customer-data-breaches-a-28548;"},{"fetched_at":null,"title":null,"type":"press","url":"https://caseygerry.com/blog/dior-data-breach-lawsuit/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://jingdaily.com/posts/dior-china-data-breach-tests-brand-trust;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.globaltimes.cn/page/202505/1333930.shtml"}],"summary":"\"Christian Dior Couture, one of the world’s leading luxury fashion brands, has been named among the companies impacted by the recent Dior Data Breach linked to Salesforce. The breach exploited vulnerabilities in Salesforce-connected systems, potentially exposing personal informat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-23","discovered_date":"2025-09-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"a352a64ce8cf588bd80752ee14cf521a6846cd73","impact_type":"data_theft","incident_date":"2025-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BGC%20_%20Reg.%20Notice%20Letter%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"d487fe68463d","org_name":"Boyd Gaming Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/906553/000119312525213546/d20726d8k.htm"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612086"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BGC%20_%20Reg.%20Notice%20Letter%20-%20California_0.pdf"}],"summary":"Boyd Gaming Corporation reported unauthorized removal of information from its systems beginning September 5, 2025, and said the information involved included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"price":{"ticker":"BYD","base_day":"2025-09-23","returns":{"1":{"day":"2025-09-24","raw":-0.0081,"adj":-0.0049},"5":{"day":"2025-09-30","raw":0.0159,"adj":0.0114},"21":{"day":"2025-10-22","raw":-0.0248,"adj":-0.0317},"63":{"day":"2025-12-22","raw":0.0188,"adj":-0.0138},"126":{"day":"2026-03-25","raw":-0.0027,"adj":0.0069},"250":{"day":"2026-09-22","raw":-0.153,"adj":-0.3191}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-09-22","discovered_date":"2025-08-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f275c95ece2f40263b17dbba4c85a10672b11665","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3fb0a6e4614b","org_name":"Williams Hart & Boundas, LLP","org_type":"retail_ecommerce","ransomware":null,"records_affected":3944,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004568"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fe7f390a4afd7802ad0fad1b64d7558d3cddbff8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Veradigm%20Notice%20Letter_9.22.25_Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d706c963ff3","org_name":"Veradigm LLC","org_type":"professional_services","ransomware":null,"records_affected":2672036,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-22-veradigm-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610390"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Veradigm%20LLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"48145a26362fe35b8cca606a5f499f2f3b738c63","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5877fd308f9","org_name":"Healthcare Interactive","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-22-healthcare-interactive"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0c8bbcaf649e27f863c16b4e369459f37016cdb2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"27090b5c121e","org_name":"City of St. Joseph, MO Health Department","org_type":"healthcare","ransomware":null,"records_affected":11538,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-22-city-of-st-joseph-mo-health-department"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3aa150b8b6e99caeb4fe1e4b750a92a00cbc16d7","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"452f8eb10fac","org_name":"Animeify","org_type":"other","ransomware":null,"records_affected":808034,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Animeify","type":"hibp","url":"https://haveibeenpwned.com/Breach/Animeify"}],"summary":"Animeify suffered a data breach in October 2021, and the data later circulated included email addresses, names, usernames, genders, and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"029579b41832e65546ca242db7115b2bad2ff4ae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2afa3da1b338","org_name":"People Encouraging People","org_type":"healthcare","ransomware":null,"records_affected":13083,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-19-people-encouraging-people"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-09-19","discovered_date":"2025-08-22","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ace429d5361c81beb07aae1e32d540dca85af38","impact_type":"data_theft","incident_date":"2025-07-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hello%20Cake%20-%20Notification%20Email%20%28250919%29.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"00b99d1eb24c","org_name":"Hello Cake","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"During a platform migration, one file inherited an incorrect access setting.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610317"},{"fetched_at":null,"title":"Have I Been Pwned: Hello Cake","type":"hibp","url":"https://haveibeenpwned.com/Breach/HelloCake"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hello%20Cake%20-%20Notification%20Email%20%28250919%29.pdf"}],"summary":"Hello Cake reported that an incorrectly configured cloud-storage file was accessed and copied by an unauthorized third party.","supporting_quote":"We recently identified a potential security issue involving a single file stored in one of our cloud-based storage systems that, following a routine migration, temporarily had an incorrect access setting.","technology_involved":["cloud-based storage system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50559151d8199edc57f2270fbd651fe765f22ffa","impact_type":"unknown","incident_date":"2024-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California_International_Bank__N.A._Sample_Notice_36837535v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b031b7fbaef7","org_name":"California International Bank, N.A.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610269"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00e8ef18820646e896d4ffed9d903905fa8e4d59","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/State%20of%20California%2C%20Department%20of%20Industrial%20Relations%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"a3be4113b353","org_name":"California Department of Industrial Relations","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610325"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/State%20of%20California%2C%20Department%20of%20Industrial%20Relations%20Notice%20of%20Data%20Breach.pdf"}],"summary":"A computer malfunction caused misprinted workers’ compensation mailers to include some recipients’ Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c996b51a82b56c03356e689975b378e370a02bef","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d666d2ef8829","org_name":"Sun Valley Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":27001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-18-sun-valley-surgery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f5005d215256d3ea29e17edcbcf3df61e6a8070","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MM%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4e65d871baaf","org_name":"Monterey Mushrooms, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610226"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MM%20-%20California%20Notification.pdf"}],"summary":"Monterey Mushrooms, LLC reported that an unauthorized actor accessed files on its computer servers between August 2 and August 7, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-09-18","discovered_date":"2025-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"dabc50e419282b28f745e72b1838873627b5dcfa","impact_type":"data_theft","incident_date":"2025-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Goshen%20Medical%20Center.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3eb3d70945a3","org_name":"Goshen Medical Center","org_type":"healthcare","ransomware":null,"records_affected":5234,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Goshen%20Medical%20Center.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Goshen%20Medical%20Center.pdf"}],"summary":"Goshen Medical Center determined that files containing personal and medical information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d6a518765360083a7156405e75842304e42f1fa","impact_type":"data_theft","imported_from":null,"incident_date":"2017-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c5087517947b","org_name":"FreeOnes","org_type":"other","ransomware":null,"records_affected":960213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FreeOnes","type":"hibp","url":"https://haveibeenpwned.com/Breach/FreeOnes"}],"summary":"A breach of the FreeOnes forum exposed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"55d6fb5b641e9e743573ffc3e48d368cfd6e30e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1548e0bd35b7","org_name":"Ennoble Care & Circa Health, LLC","org_type":"healthcare","ransomware":null,"records_affected":36332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-18-ennoble-care-circa-health-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"918e1642bf5b95395f090d0b15fd5696b95ba9dd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Broad%20River%20-%20South%20Carolina%20-%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"724675ccd050","org_name":"Broad River Physicians Group, LLC","org_type":"unknown","ransomware":null,"records_affected":3171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Broad%20River%20-%20South%20Carolina%20-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"033eef5c7a40ad02b2fe3c7fba9921103d1e7f1b","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34694.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"493ea9d427b8","org_name":"Weinstein Beverage Company","org_type":"manufacturing","ransomware":true,"records_affected":943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34694.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34694.pdf"}],"summary":"Weinstein Beverage Company reported a ransomware incident that may have affected employees’ and dependents’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-09-17","discovered_date":"2025-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7293bfeed0ff565da787a2038243c04cf32921c","impact_type":"data_theft","incident_date":"2025-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sher%20Tremonte%20-%20Regulatory%20Notice%20Letter%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"851d6cce36ea","org_name":"Sher Tremonte LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610196"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sher%20Tremonte%20-%20Regulatory%20Notice%20Letter%20CA_0.pdf"}],"summary":"Sher Tremonte LLP identified unusual activity in its email environment, and its investigation found that personal information may have been viewed or acquired without authorization.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"98c224b67a7bf30964f5b24db5583ff2d45472ed","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91bfdfde6ec0","org_name":"Navesink Rehab","org_type":"healthcare","ransomware":null,"records_affected":1428,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-17-navesink-rehab"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-17","discovered_date":"2024-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b1768b8c880dfde28217371c018fd426f296a27","impact_type":"disruption_or_ransomware","incident_date":"2024-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hacienda%20-%20General%20Adult%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"86f53399524f","org_name":"Hacienda La Puente Unified School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610217"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hacienda%20-%20General%20Adult%20Notice%20Letter%20Template.pdf"}],"summary":"Hacienda La Puente Unified School District reported a ransomware attack discovered on April 12, 2024, during which certain files may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-17","discovered_date":"2024-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95b8167e5138ad3a00a631f0bd5ee3a9e1f22983","impact_type":"data_theft","incident_date":"2024-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GITSIT%20Solutions%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"92870e59a9b6","org_name":"GITSIT Solutions, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610204"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GITSIT%20Solutions%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"GITSIT Solutions reported that an unauthorized actor accessed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-17","discovered_date":"2025-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c9aed3e629a3d642ca55d8d97992560aba1e42f","impact_type":"data_theft","incident_date":"2025-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34688.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"27fb5d217997","org_name":"Bastyr University","org_type":"education","ransomware":null,"records_affected":2676,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34688.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34688.pdf"}],"summary":"Bastyr University determined that files containing limited personal information were accessed or taken without authorization between April 23 and April 30, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-16","discovered_date":"2025-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c979dcc6f7e95ce36ad63af77c9278de662b92e0","impact_type":"data_theft","incident_date":"2025-05-18","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Benworth%20Capital%20-%20Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"75f19dde67c3","org_name":"Benworth Capital Partners","org_type":"financial","ransomware":null,"records_affected":275000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610012"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-613667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Benworth%20Capital%20-%20Sample%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004643"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34084.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Benworth%20Capital%20Partners-2025-09-16"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Benworth%20Capital%20Partners-2025-11-04"}],"summary":"Benworth Capital Partners reported that a criminal actor accessed system components through a third-party service provider and stole files containing loan-related information.","supporting_quote":"We believe that the incident occurred when a criminal actor accessed certain components of our systems through a third-party service provider.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2a207b8bb222bec6296d3e2dcd742a058ff47913","impact_type":"data_theft","incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34672.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e3d5de35e187","org_name":"Trusteed Plans Services Corporation","org_type":"professional_services","ransomware":null,"records_affected":13659,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trusteed%20Plans%20Services%20Corporation-2025-09-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34672.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34672.pdf"}],"summary":"Trusteed Plans Services Corporation detected unusual activity in its computer environment, and an investigation found that an unauthorized user accessed and obtained information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"302a50c8efd13b55ed2b0ef4fb7f83a0be589bee","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPSC%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"779da6ae8ecf","org_name":"Trusteed Plans Service Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPSC%20Sample%20Notice.pdf"}],"summary":"Trusteed Plans Service Corporation reported that an unauthorized user accessed its environment and obtained information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1866c694caf5b2eb0796733b8160cb8cec844f3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2c8dad52b76","org_name":"Survival Flight, Inc.","org_type":"healthcare","ransomware":null,"records_affected":97217,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-15-survival-flight-inc"},{"fetched_at":null,"title":"Leak-site claim by worldleaks","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/U3Vydml2YWwgRmxpZ2h0IEluY0B3b3JsZGxlYWtz"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["worldleaks"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"675d8593bc75c4a4b332984c3bb476144a6c0d95","impact_type":"data_theft","incident_date":"2024-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Statewide%20Enterprises%20-%20Sample%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d9861931941c","org_name":"Statewide Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609971"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Statewide%20Enterprises%20-%20Sample%20Individual%20Notification%20Letter.pdf"}],"summary":"Statewide Enterprises reported that an unauthorized actor took data from its network, including files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5680d45e5c7c08fb4d559dc59eee4ad9010f15ab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"27ede643b89c","org_name":"Millennium Health Systems, LLC","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-15-millennium-health-systems-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-15","discovered_date":"2025-01-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aeaf3f142abe3f23256a42dc957400496fa0074","impact_type":"both","incident_date":"2024-10-25","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Insight%20-%20Template%20Notification%20-%20CA.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"e75c790c71ba","org_name":"Insight Partners","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A threat actor gained access to affected servers through a social engineering attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Insight%20-%20Template%20Notification%20-%20CA.pdf"}],"summary":"A threat actor accessed Insight Partners systems through social engineering, exfiltrated data, and encrypted servers.","supporting_quote":"Insight Partners’ investigation into the incident determined that, on or around October 25, 2024, a threat actor successfully used a sophisticated social engineering attack to gain access to the affected servers.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17af5276a9eceb8c01bcc3986753b156bc7b707b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-25034%20Burlingame%20School%20District%20Adult%20CM%201yr%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"610940224ff0","org_name":"Burlingame School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609981"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-25034%20Burlingame%20School%20District%20Adult%20CM%201yr%20r1prf.pdf"}],"summary":"Burlingame School District reported that an unknown party may have accessed certain computer systems, and personal information was present in potentially affected files, with no evidence that data was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"003782ec3a87a5cd341dfe9044f5e1b3fbbce01d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f9d0cd433f7","org_name":"Sandhills Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":169017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-14-sandhills-medical-foundation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b4500b18af3361fc37c9a30053df7be8e93c0b5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20SAH.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8295074b65e9","org_name":"Saint Anthony Hospital","org_type":"healthcare","ransomware":null,"records_affected":6679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-12-saint-anthony-hospital"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20SAH.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-12","discovered_date":"2025-08-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cbdd36d596525fe9d3aff5928761aacf99dbac8e","impact_type":"unknown","incident_date":"2025-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81112da333f2","org_name":"Roush Fenway Keselowski Racing, LLC","org_type":"unknown","ransomware":null,"records_affected":13632,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Roush%20Fenway%20Keselowski%20Racing%2C%20LLC-2025-09-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5647072d22fff12d77cc3c19f7207be7c74f3c22","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"404a0608ada4","org_name":"North Penn Comprehensive Health Services d.b.a Laurel Health Centers","org_type":"healthcare","ransomware":null,"records_affected":991,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-12-north-penn-comprehensive-health-services-d-b-a-laurel-health-centers"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57edc9962c8b907468582e18f66cdcfd13a2240f","impact_type":"data_theft","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.09.12%20-%20L01%20-%20Individual%20Notice%20-%20Adult%20-%20MES_final_v2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2ea90b3df55b","org_name":"Main Electric Supply Company, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609849"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.09.12%20-%20L01%20-%20Individual%20Notice%20-%20Adult%20-%20MES_final_v2_Redacted.pdf"}],"summary":"MES reported that an unauthorized individual may have acquired information during suspicious activity in its network environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"100c2d33f0277d6e2c1c843ef0c2456cb39755c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-06-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Hampton%20Regional%20Medical%20Center.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3387b6bad351","org_name":"Hampton Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":27609,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Hampton%20Regional%20Medical%20Center.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Hampton%20Regional%20Medical%20Center.pdf"}],"summary":"Hampton Regional Medical Center reported that an unauthorized actor accessed certain systems and may have accessed or copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-12","discovered_date":"2023-01-31","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"153748f3f8eaf206209d9c53968dc1e79f6eb95d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-31","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notice_R2.pdf"},"notes":null,"org_country":"US","org_id":"208728f09c89","org_name":"County of Orange Office of Care Coordination","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The employee's email account was compromised due to a suspected phishing attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609898"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notice_R2.pdf"}],"summary":"The County of Orange Office of Care Coordination reported that an employee’s email account was compromised in a suspected phishing attack, potentially exposing personal information.","supporting_quote":"The County immediately initiated an investigation and learned that the account had been compromised due to a suspected phishing attack.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-12","discovered_date":"2025-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b88a9941a9a40c35a566e41f834d327dffcfbbe6","impact_type":"data_theft","incident_date":"2025-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MoneyBlock%20-%20Adult%201-year.pdf"},"notes":null,"org_country":"US","org_id":"92a207ce4ce9","org_name":"AOS, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609842"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MoneyBlock%20-%20Adult%201-year.pdf"}],"summary":"An unauthorized third party accessed AOS, Inc.’s computer network and likely acquired files that may have contained personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"618b01bd984c5c3c45eaeb32ae65a469f75ab8c3","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-31","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34650.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7f947270d8bc","org_name":"American First Finance LLC","org_type":"financial","ransomware":null,"records_affected":4333,"reviewed":false,"root_cause":"A former employee accessed FinWise data after their employment ended.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34650.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34650.pdf"}],"summary":"A former FinWise employee accessed FinWise data that included American First Finance data after their employment ended.","supporting_quote":"On May 31, 2024, FinWise experienced a data security incident involving a former employee who accessed FinWise data after the end of their employment.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FinWise"},"updated_at":"2026-10-12","veris_action":"misuse","derived":{"vendors":[{"id":"45f7d3d7d503","name":"FinWise"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5734ab89ffbc4e2ada499e425b23339f9633003a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-31","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20PII%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"7f947270d8bc","org_name":"American First Finance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former FinWise employee accessed FinWise data after their employment ended.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-609846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20PII%20Breach.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20First%20Finance-2025-09-12"}],"summary":"A former FinWise employee accessed FinWise data after employment ended, affecting data associated with American First Finance.","supporting_quote":"On May 31, 2024, FinWise experienced a data security incident involving a former employee who accessed FinWise data after the end of their employment.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FinWise"},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"vendors":[{"id":"45f7d3d7d503","name":"FinWise"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-11","discovered_date":"2025-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"b31ee50c9c3df73e874e9cf80d298f59f1c1d251","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20(SC)%20UHM.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"06894c2e1339","org_name":"Union Home Mortgage Corp.","org_type":"financial","ransomware":null,"records_affected":1650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Union%20Home%20Mortgage%20Corp.-2025-09-11"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20(SC)%20UHM.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34645.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20PROOF_Redacted_0.pdf"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004703"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20(SC)%20UHM.pdf"}],"summary":"Union Home Mortgage reported that personal information may have been accessed without authorization, with no evidence of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-11","discovered_date":"2025-09-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5a05d6bd3be1285c9cb9e819f630d0184c0923f3","impact_type":"unknown","incident_date":"2025-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db8d8e4d0e9a","org_name":"Rose & Clove Integrative Wellness","org_type":"unknown","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rose%20%26%20Clove%20Integrative%20Wellness-2025-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-09-11","discovered_date":"2025-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9021cc8a816584bf117d98ea7a198e00c6df7f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34635.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e7ba29a79962","org_name":"Langabeer McKernan Burnett & Co.","org_type":"professional_services","ransomware":null,"records_affected":1364,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34635.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34635.pdf"}],"summary":"Langabeer McKernan Burnett & Co. reported that an unauthorized actor accessed its systems and some files containing personal, financial, and health insurance information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b28cbdedc9244ab6593fb1581e1095f289396f4","impact_type":"unknown","incident_date":"2023-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FFCU%20Redacted%20Adult%20SSN.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d5958c934b7","org_name":"Fairmont Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608460"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-09-11","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"853d385c64be976ea7305bf6973e2985ca1fe1ad","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.09.12%20CVRC%20Letter%20to%20Impacted%20Individuals%20Served.pdf"},"notes":null,"org_country":"US","org_id":"c6ba76f4e3a7","org_name":"Central Valley Regional Center, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A contracted janitorial service improperly disposed of confidential documents that had been set aside for shredding.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608462"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.09.12%20CVRC%20Letter%20to%20Impacted%20Individuals%20Served.pdf"}],"summary":"Central Valley Regional Center reported that a contracted janitorial service improperly disposed of confidential documents, potentially exposing personal, medical, and financial information.","supporting_quote":"The improper disposal of these documents took place at one CVRC facility between March 2025 and July 2025, when we became aware of the incident.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"new janitorial service"},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9da0283bc8716439895206cdd53fd0db7b50e57a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98ab91096b25","org_name":"Texas Center for Infectious Disease Associates","org_type":"healthcare","ransomware":null,"records_affected":1236,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-10-texas-center-for-infectious-disease-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-10","discovered_date":"2025-05-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a2c1558ffb6f40112b129776df258a86140954a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Print%20Media%20Association%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2210dfbeb181","org_name":"Print Media Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608387"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Print%20Media%20Association%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized third party accessed certain Print Media Association email accounts, and affected documents contained personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f9e81c15194a33c9e65c307fd4aedd84033c4119","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7967245d3308","org_name":"PGA Development, Inc.","org_type":"healthcare","ransomware":null,"records_affected":23899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-10-pga-development-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-09-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d29047d4284ae4c647ab082f7aff529143aead61","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34630.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6150e6daed35","org_name":"Medicare CompareUSA","org_type":"financial","ransomware":null,"records_affected":808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34630.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34630.pdf"}],"summary":"Medicare CompareUSA reported unauthorized access to certain email accounts and files containing personal, financial, and medical information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"dbcb742f303b5fac6ca7cb395ca67aded5c58033","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-08-16","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"US","org_id":"d062113f3ec0","org_name":"Data I/O Corporation","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"The incident originated as a vulnerability of a commercially available third-party firewall service provider.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/351998/000165495425010613/daio_8k.htm"},{"fetched_at":null,"title":"8-K PRESS RELEASE","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/351998/000165495425010613/daio_ex990.htm"}],"summary":"Data I/O Corporation experienced a ransomware incident on internal IT systems that originated as a vulnerability of a third-party firewall service provider and temporarily disrupted operations.","supporting_quote":"Through ongoing discovery and investigation efforts, the Company has determined that the Incident was not targeted but originated as a vulnerability of a commercially available third-party firewall service provider.","technology_involved":["third-party firewall service"],"third_party":{"archetype":null,"involved":true,"vendor":null},"veris_action":"hacking","derived":{"price":{"ticker":"DAIO","base_day":"2025-09-10","returns":{"1":{"day":"2025-09-11","raw":-0.0143,"adj":-0.0226},"5":{"day":"2025-09-17","raw":-0.0486,"adj":-0.0593},"21":{"day":"2025-10-09","raw":-0.0486,"adj":-0.0776},"63":{"day":"2025-12-09","raw":-0.1514,"adj":-0.1987},"126":{"day":"2026-03-12","raw":-0.2343,"adj":-0.2555},"250":{"day":"2026-09-09","raw":-0.2057,"adj":-0.3747}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a749c2567df6b9ee9b0009c90ca201c153478edd","impact_type":"unknown","incident_date":"2025-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Check_City-CCI_Financial_Sample_Notice_Letter_CA_Residents_36795586v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b51136c8d2e4","org_name":"CCI Financial, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608412"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ba221852531e497469e24a262ee6b4b56f72ce3f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4102e9ac5210","org_name":"R.F.M.S. Inc.","org_type":"professional_services","ransomware":null,"records_affected":43009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-09-r-f-m-s-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-09","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e428a136b6f951a00a15bf5ca7cf97b8b844493","impact_type":"both","imported_from":null,"incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Horace%20Mann%20-%20Template%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5cc1aa1a2935","org_name":"Horace Mann Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Horace%20Mann%20-%20Template%20Notice.pdf"}],"summary":"IMS reported that ransomware encrypted certain systems and an investigation found personal information subject to unauthorized access and acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-09","discovered_date":"2025-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f7b440215a9b314bcb2d1a23dc425a4d2899c5b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Farmer%20Brothers%20Company%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ec3b61ec9fde","org_name":"Farmer Brothers Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608356"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Farmer%20Brothers%20Company%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Farmer%20Brothers%20Company-2025-09-09"}],"summary":"Farmer Brothers Company reported that an unknown actor accessed archived files and folders containing potentially affected personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"74faaaab1c244a6fe57e3d24cb9bba5d4e8b19ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34600.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82e600b116e4","org_name":"Skagit County, WA (Trusted Plans Service Corporation)","org_type":"unknown","ransomware":null,"records_affected":1099,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34600.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7417d9989af5429c55af6db6b0c8be3ae7f386f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"735B90B4-5681-25ED-6C3F-678819B6E058"},"incident_date":"2025-09-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"80eb8771c5f9","org_name":"IKEA","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SUtFQUBzaGlueWh1bnRlcnM"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-08","discovered_date":"2024-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dab3097c1888b5db91dcb0735480f768cd6dbc5e","impact_type":"unknown","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cornwell%20-%20Regulatory%20Letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"edc31ea7cb66","org_name":"Cornwell Quality Tools","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cornwell%20-%20Regulatory%20Letter%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34579.pdf"}],"summary":"Cornwell Quality Tools reported that an unknown actor accessed its network and potentially acquired files containing individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc157c091bafec82985905da20514ddea96fdb20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"642E92EF-B794-2173-4881-B53E1E1B18B6"},"incident_date":"2025-09-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04ecd7eb87bb","org_name":"Home Depot","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"},{"fetched_at":null,"title":"Leak-site claim by shinyhunters","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SG9tZSBEZXBvdEBzaGlueWh1bnRlcnM"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["shinyhunters"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"644f6e5c6e27c79c27f861f6d264b7913266a1d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C74D97B0-1EAE-257E-44AA-9D5BADE97BAF"},"incident_date":"2025-09-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5bf7e5ba0262","org_name":"Qualys","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blog.qualys.com/misc/2025/09/06/salesloft-drift-supply-chain-incident"}],"summary":"\"Qualys was made aware of a campaign targeting Salesloft Drift (a marketing software-as-a-service) that impacted a large number of Salesloft customers, including Qualys. The incident involved the theft of OAuth tokens connected to Salesloft Drift, a third-party application used t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-05","discovered_date":"2025-01-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c1e1a03a390904ec493eebff7c10c5801c26e49","impact_type":"data_theft","incident_date":"2025-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NYBCe%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2c712db1817c","org_name":"New York Blood Center Enterprises","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608189"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NYBCe%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20York%20Blood%20Center%20Enterprises-2025-09-05"}],"summary":"An unauthorized party accessed New York Blood Center Enterprises' network and acquired copies of files containing employment-related personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"31f2e730014a8b483b1c0a0f0ffb0ba9d19092d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f4151ffacbd","org_name":"Medical Associates of Brevard, LLC","org_type":"healthcare","ransomware":null,"records_affected":246711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-05-medical-associates-of-brevard-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"86b46fac4bd9595ecbe2c029b5ac1e421fbcf0d4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fedac0896b79","org_name":"Coos County Family Health Services","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-05-coos-county-family-health-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8593a8517ab0102c0cff178a993eff07373427ca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25ebf8c894ce","org_name":"Twin Cities Pain Clinic","org_type":"healthcare","ransomware":null,"records_affected":3572,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-04-twin-cities-pain-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92083c004a50b9f8dc10dfb1e764f0124f0e23c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20W%20Credit%20Monitoring%20US_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"d972469b1b33","org_name":"Zions Bancorporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20W%20Credit%20Monitoring%20US_Redacted.pdf"}],"summary":"An employee emailed an internal document containing customer names and deposit account numbers to an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f18ee316bd9fe591fcdbf7fea52ab68075a3bd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5BFC9E0-7964-F8DD-DEB9-5FC584CD965D"},"incident_date":"2025-09-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6341da9294c3","org_name":"Workiva","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/saas-giant-workiva-discloses-data-breach-after-salesforce-attack/"}],"summary":"\"Workiva, a leading cloud-based SaaS (Software as a Service) provider, notified its customers that attackers who gained access to a third-party customer relationship management (CRM) system stole some of their data.\n\nThe company's cloud software helps collect, connect, and share ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5a69df42dc63080170c61bb528c1f72bdeb8283","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34173CB3-8F07-F89D-DBEB-C2AC9128303F"},"incident_date":"2025-09-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b00c0c5cabce","org_name":"Tenable","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tenable.com/blog/tenable-response-to-salesforce-and-salesloft-drift-incident"}],"summary":"\"Our ongoing investigation found evidence that an unauthorized user had access to a portion of some of our customers’ information stored in our Salesforce instance, including subject lines and initial descriptions provided by our customers when opening a Tenable support case, and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c1acbd60e3f7de8eff65a5b9a77d339daff58bc2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"782e1db8724e","org_name":"Teamsters Union 25 Health Services & Insurance Plan","org_type":"healthcare","ransomware":null,"records_affected":19231,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-03-teamsters-union-25-health-services-insurance-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-09-03","discovered_date":"2025-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"1528c5ebb9e5a374c6c2482c74c90cc11cf2d438","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20School%20District%20Five%20Lex-Rich.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f43b19619274","org_name":"School District Five of Lexington & Richland Counties","org_type":"education","ransomware":null,"records_affected":30944,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20School%20District%20Five%20Lex-Rich.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20School%20District%20Five%20Lex-Rich.pdf"}],"summary":"School District Five of Lexington & Richland Counties discovered that an external unauthorized individual had taken files from its network, which may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b87ad8941cce87becc9026581201b89fd1501904","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c91de03342b8","org_name":"Retina Group of Florida","org_type":"healthcare","ransomware":null,"records_affected":152691,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-03-retina-group-of-florida"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ef84f3dd9e3c1145224c22c42003730bce7b207","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BF31C7F-F062-936A-96D3-C8BD1F8F2FF3"},"incident_date":"2025-09-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"146ec15b5007","org_name":"Nutanix","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nutanix.com/blog/third-party-salesloft-drift-application-incident-response-our-impact-and-action"}],"summary":"\"To date, our investigation has indicated that: (1) The impacted data was limited to customer support case records within our Salesforce environment that contained certain fields that primarily included business contacts and/or information relating to the case such as the Subject","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f599b10939e163f28f2f4b44bdef7c6ad55815d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E296A06-7A37-5633-70DE-D05F5A3BF3EC"},"incident_date":"2025-09-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"976de98f2d90","org_name":"CyberArk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberark.com/resources/blog/salesloft-drift-incident-overview-and-cyberarks-response"}],"summary":"\"It was recently reported that Salesloft’s Drift application was breached, allowing unauthorized access to its customers’ Salesforce data and affecting hundreds of organizations, including CyberArk.\n\nUpon learning of this incident, we quickly deployed threat containment measures,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"39b9a123d3415c15b5d15b0c0beb6b0e22c2b476","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Cherokee.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3d0d1496d5bd","org_name":"Cherokee County School District","org_type":"education","ransomware":null,"records_affected":46119,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Cherokee.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Cherokee.pdf"}],"summary":"Cherokee County School District reported unauthorized access to files and records containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb3e6552bca0595e9c32a0185b2606ce86fa34ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D645920E-395F-EDAD-7BBB-ED0ECA3FE2E0"},"incident_date":"2025-09-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f276ae5e4e8","org_name":"Zscaler","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techzine.eu/news/security/134278/hackers-steal-customer-data-from-zscaler-via-salesloft-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/salesloft-drift-attacks-exposed-zscaler-customer-data-a-29344"}],"summary":"\"Following a previous series of victims, Zscaler has also been affected by a hacked Salesforce Drift instance. This resulted in the theft of customer data and information about support cases.\n\nZscaler warns that hackers stole sensitive customer data after gaining access to their ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba14d422a03a579ea1618f0fd25ef6f0b325b7f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C383CD3-0B7C-298A-B502-93ADFECB7B18"},"incident_date":"2025-09-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6159a56c7a0","org_name":"Proofpoint","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.proofpoint.com/us/blog/corporate-news/salesloft-drift-supply-chain-incident-response"}],"summary":"\"Current findings confirm that an unauthorized actor accessed Proofpoint’s Salesforce tenant through the compromised Drift integration and viewed certain information stored in our Salesforce instance.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4f6f06a717fde539b65ece60e70e64891173571","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D67D8AB4-F4C1-0BF2-2AA3-53E27879133C"},"incident_date":"2025-09-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29dfdebfacb1","org_name":"Palo Alto Networks","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.paloaltonetworks.com/blog/2025/09/salesforce-third-party-application-incident-response/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/palo-alto-networks-data-breach-exposes-customer-info-support-cases/\""}],"summary":"\"Palo Alto Networks hit by Drift-linked supply-chain attack, exposing Salesforce customer data and support cases via stolen OAuth tokens.\n\nPalo Alto Networks is another victim of the Salesloft Drift incident, which allowed attackers to access its Salesforce account, as per Bleepi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"959285d132e53811e0536d2d08338f36408a0e2f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"300f28c5d957","org_name":"North Oaks Health System","org_type":"healthcare","ransomware":null,"records_affected":6243,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-02-north-oaks-health-system"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8ec8291ce945129560d4594daf45de1c6b24495","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"499f0bc0ec13","org_name":"La Perouse, LLC","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-09-02-la-perouse-llc"},{"fetched_at":null,"title":"Leak-site claim by everest","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TGEgUGVyb3VzZUBldmVyZXN0"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["everest"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7339f33f0008cb54460c73369f63fc8c22e959d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34538.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7abea42a77d2","org_name":"FIVE STAR TAX SERVICE INC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34538.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15e460ab1c858dacf964623e2d590dcdfdd8b21e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ewald-%20Notification%20Letter%20-%20Adult.pdf"},"notes":null,"org_country":"US","org_id":"21bc527c43e5","org_name":"Ewald Consulting","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ewald-%20Notification%20Letter%20-%20Adult.pdf"}],"summary":"Ewald Consulting investigated suspicious activity on a server used to store archived data, and names and dates of birth may have been involved.","supporting_quote":null,"technology_involved":["server used to store archived data"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2025-09-02","discovered_date":"2025-08-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"186b9bac7a9fda305b3c4e30f566e8475ed6f4c8","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-08-29","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"PR","org_id":"885f4b626efd","org_name":"EVERTEC, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized transactions were introduced into Sinqia’s Pix environment by exploiting legitimate Sinqia IT vendors’ credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1559865/000155986525000043/evtc-20250829.htm"}],"summary":"Evertec reported that vendor credentials were used to introduce unauthorized transactions into Sinqia’s Pix environment, after which transaction processing was halted.","supporting_quote":"Preliminary results of the Company’s forensics analysis indicate that the unauthorized transactions were introduced into Sinqia’s Pix environment by exploiting legitimate Sinqia IT vendors’ credentials.","technology_involved":["Pix"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"price":{"ticker":"EVTC","base_day":"2025-09-02","returns":{"1":{"day":"2025-09-03","raw":-0.0152,"adj":-0.0206},"5":{"day":"2025-09-09","raw":-0.0215,"adj":-0.0372},"21":{"day":"2025-10-01","raw":-0.0361,"adj":-0.0801},"63":{"day":"2025-12-01","raw":-0.1746,"adj":-0.2371},"126":{"day":"2026-03-04","raw":-0.1583,"adj":-0.2283},"250":{"day":"2026-08-31","raw":-0.1505,"adj":-0.3485}}}}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab32263f697acdcb608560ee151f7c49e61e409a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5771BCE-93E2-00C3-6F7C-D9DFD0E5DEAA"},"incident_date":"2025-09-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03abf7c61723","org_name":"Cloudflare","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/cloudflare-hit-by-data-breach-in-salesloft-drift-supply-chain-attack/"}],"summary":"\"Cloudflare is the latest company impacted in a recent string of Salesloft Drift breaches, part of a supply-chain attack disclosed last week.\n\nThe internet giant revealed on Tuesday that the attackers gained access to a Salesforce instance it uses for internal customer case manag","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7eaf4a4e9db1e541b6079d306aa585626a7fa7bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E369853D-F766-FA44-E1ED-0FF613F563BD"},"incident_date":"2025-09-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af3916b607a4","org_name":"SpyCloud","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://spycloud.com/newsroom/salesloft-drift-incident-spycloud-response/"}],"summary":"\"We were notified of a security incident involving a third-party application that potentially resulted in unauthorized access to data from Salesforce, our customer relationship management system.\n\nAs reported by Google’s threat intelligence team, an actor allegedly targeted Sales","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c1f4bb6f0cdfa27fb46a4355c7453f2e8587beb","impact_type":"data_theft","imported_from":null,"incident_date":"2025-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IT","org_id":"4f2e4fc4f10a","org_name":"Giglio","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Giglio","type":"hibp","url":"https://haveibeenpwned.com/Breach/Giglio"}],"summary":"A breach allegedly obtained from Giglio included email addresses, names, phone numbers and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"005b9b592a8d28ab1df76f039a9adf8d8b53e769","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17E62166-FC85-86DF-A4D1-BC0E1742C08B"},"incident_date":"2025-08-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c18beccf8755","org_name":"Federal Express","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a203573c3808389db0c693aa16fff9de72f3a92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3D94468-02A4-4259-755D-38E6D163E820"},"incident_date":"2025-08-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0282ed2eb1a1","org_name":"AgilityPR","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.agilitypr.com/pr-news/agility-news-reports/statement-on-the-salesloft-drift-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.driftbreach.com/"}],"summary":"\"Agility PR confirmed it was impacted by the Salesloft Drift OAuth compromise that targeted Salesforce customers. An unauthorized party accessed Agility’s Salesforce instance via a third-party integration, leading to the limited exposure of organizational data. The investigation ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-29","discovered_date":"2025-08-25","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"300d0100c94ad180d062fb7bf6ba6dc0d798738f","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"59968fc1150b","org_name":"Wytec International","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K AMENDMENT 1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1560143/000168316826000732/wytec_8ka1.htm"},{"fetched_at":null,"title":"8-K CURRENT REPORT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1560143/000168316825006583/wytec_8k.htm"}],"summary":"Wytec International reported that a bad actor defaced its website, which the company took offline while reviewing the web platform and later restored.","supporting_quote":null,"technology_involved":["website (wytecintl.com)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-08-29","discovered_date":"2025-07-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"0f8243f9b0fda4dfe1c5b06a41550b761d70d302","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a06211c9acb","org_name":"Southern Graphics Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":31480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004639"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607966"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24922%20Southern%20Graphics%20Ad%20CM%202y%20L01%20US%20r2prf.pdf"}],"summary":"Southern Graphics Inc. reported that an unauthorized party accessed certain IT systems and obtained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-29","discovered_date":"2025-07-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e747bbf574d0097f6c442b6d146ba0324b577345","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/S.V.D.P.%20Management%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b937053e9ecc","org_name":"S.V.D.P. Management Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607951"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/S.V.D.P.%20Management%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#S.V.D.P.%20Management%20Inc.-2025-08-29"}],"summary":"S.V.D.P. Management Inc. reported that personal information may have been accessed or acquired between September 26 and October 12, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fbc694d5208b0c701058cbdabc90eea706ca0852","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"672dff1b36ee","org_name":"Reimagine Network","org_type":"healthcare","ransomware":null,"records_affected":4799,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-29-reimagine-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-29","discovered_date":"2025-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"064d776b081c9aef693e41d6150dde9e779cc7e1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Carter%20-%20Final%20Adult%201%20Year%20CM.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fe6684afce6b","org_name":"Carter Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":105185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carter%20Federal%20Credit%20Union-2026-02-05"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004816"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607903"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carter%20-%20Final%20Adult%201%20Year%20CM.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carter%20-%20Final%20Adult%201%20Year%20CM.pdf"}],"summary":"Carter Federal Credit Union reported that an unauthorized third party accessed files on its network that may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"11b4a27df7e464904a9e8fedbbddb1f9c71523d2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2e7834af188f","org_name":"Carrollton Ear, Nose and Throat, PC","org_type":"healthcare","ransomware":null,"records_affected":3569,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-29-carrollton-ear-nose-and-throat-pc"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Q2Fycm9sbHRvbiBFYXIgTm9zZSBhbmQgVGhyb2F0QGluY3JhbnNvbQ"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-29","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"acd6a2df730b1c9f29a2f2328d45e523892fabae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"37b063bdd218","org_name":"Anthony L. Jordan Health Corporation","org_type":"healthcare","ransomware":null,"records_affected":2974,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-29-anthony-l-jordan-health-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-08-29","discovered_date":"2025-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd582a8d51d5d5168ad87b82a43aece57481519e","impact_type":"data_theft","incident_date":"2025-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AACN%20-%20Template%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"83729c48bfef","org_name":"American Association of Critical-Care Nurses","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AACN%20-%20Template%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Association%20of%20Critical-Care%20Nurses-2025-08-29"}],"summary":"The American Association of Critical-Care Nurses reported that an unauthorized party accessed payment card and associated contact information through its website payment system.","supporting_quote":null,"technology_involved":["website payment system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-28","discovered_date":"2025-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0b01b8178461a9bab15883cd78d572c0094187f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tea%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"06c8fb110f2a","org_name":"Tea Dating Advice","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607816"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tea%20-%20California%20Notification.pdf"}],"summary":"Tea Dating Advice reported unauthorized access to a file storage location containing identity-verification records, including personal information.","supporting_quote":null,"technology_involved":["file storage location"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26a1ae74052f6d21e4c489494ae499e1ed8ba21f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"182BE0C5-CDCD-5072-BB18-64CDEE4D3D6E"},"incident_date":"2025-08-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"310946066999","org_name":"Tanium","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tanium.com/blog/salesloft-drift-data-breach-what-we-know-and-what-were-doing/"}],"summary":"\"We want to let you know about a recent social engineering campaign targeting Salesforce customers, including attackers stealing OAuth tokens from the third-party Salesloft Drift application. Salesloft Drift is used for automating sales processes, and it integrates with Salesforc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-28","discovered_date":"2025-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba23295bc2a84505d0a5cc486842cc3a71107664","impact_type":"data_theft","incident_date":"2025-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34502.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f6732ed47c71","org_name":"Northwest Medical Specialties PLLC","org_type":"healthcare","ransomware":null,"records_affected":3846,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34502.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34502.pdf"}],"summary":"Northwest Medical Specialties determined that data may have been copied without authorization on August 15, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce535b659eaa658db822f66c8b9df8cce0523a8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B6D767D2-F8ED-5D21-A44B-0E5886680CB9"},"incident_date":"2025-08-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aba01b2e6174","org_name":"Lucid","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://lucid.co/blog/response-to-drift-supply-chain-incident"}],"summary":"\"At Lucid, protecting your data and maintaining transparency are core to our business, and as such, we are committed to keeping you informed about developments that may impact your organization. Lucid was made aware of a campaign targeted at the Salesloft Drift application, which","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fac5e8cf4fa1b9d47f1c5da42ae102d79e63f5f8","impact_type":"both","imported_from":null,"incident_date":"2025-08-27","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%2025_08_28%20Blenders.pdf"},"notes":null,"org_country":"US","org_id":"5cf715eb4ea0","org_name":"Blenders in the Grass","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607872"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%2025_08_28%20Blenders.pdf"}],"summary":"Blenders in the Grass reported that ransomware entered its system via a clicked link and encrypted and stole some files, which may have included personnel and financial information.","supporting_quote":"Via a link that was clicked, they were able to tunnel into our system and encrypt (steal) some of our files.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6accfaeb2f19706d9fef67d5031e1b3d4696c671","impact_type":"unknown","incident_date":"2025-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Awes.me%2C%20Inc.%20Data%20Security%20Breach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94cf76fbc5a4","org_name":"Awes.me, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607857"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a4311b940f7778998364ccf7e77abec1c2d825bd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34488.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8b5c42925ae8","org_name":"Trans Union LLC","org_type":"financial","ransomware":null,"records_affected":88689,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34488.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34488.pdf"}],"summary":"Trans Union LLC reported unauthorized access involving a third-party application used for U.S. consumer support operations and limited personal information.","supporting_quote":null,"technology_involved":["third-party application"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7420025ca796c3201f41f89519b23917abbe6232","impact_type":"data_theft","imported_from":null,"incident_date":"2025-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9184613da733","org_name":"TheSqua.re","org_type":"other","ransomware":null,"records_affected":107041,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TheSqua.re","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheSquare"}],"summary":"Customer data including email addresses, names, phone numbers, and cities associated with TheSqua.re was allegedly obtained and posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"84e756e1995ae9a15e71b280196765a541cc9600","impact_type":"unknown","incident_date":"2025-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34494.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d9f7cc9c7395","org_name":"Lasership Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":3267,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lasership%20Inc.%20dba%20OnTrac%20Final%20Mile%20%28%E2%80%9COnTrac%E2%80%9D%29-2025-08-27"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34494.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607780"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lasership%20Ontrac%20-%20Adult%20Letter_FINALTU_v3_Redacted.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34494.pdf"}],"summary":"Lasership Inc. filed a notification concerning an incident dated April 13, 2025, affecting 3,267 people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9a6a28e40cf33b13fbb4b6fcdcf6ce30dfa342e0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a248eefc01e0","org_name":"Greater Pittsburgh Orthopaedics Associates","org_type":"healthcare","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-27-greater-pittsburgh-orthopaedics-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fcf1cc97695de831c1d9d5f25a92012c92d8a70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02E74F10-E032-7AD8-68D1-38F2B4FDD6F0"},"incident_date":"2025-08-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68205b77bf76","org_name":"Bugcrowd","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bugcrowd.com/blog/bugcrowd-response-to-salesforce-linked-third-party-drift-application-security-event/"}],"summary":"\"While our investigation continues, we have identified evidence that certain information stored within our Salesforce instance was accessed by an unauthorized user through illegitimate access to the Drift application.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d062cbdc4c44ae9f78d19af59d21693283ddb5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9F0F895-FB98-AB91-59F5-1FD0297E236D"},"incident_date":"2025-08-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44fa9a1893ea","org_name":"Avalara","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.avalara.com/blog/en/north-america/2025/09/security-update-regarding-salesloft-drift.html"}],"summary":"\"On August 27, 2025, we identified a security issue involving Salesloft Drift, the application we use to provide chat functionality on our website that integrates with Salesforce CRM. We disconnected the application and began an investigation, engaging with both Salesloft and Sal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"565ece4f068cf1be6c1d488ecd9b35f8b17f4ce5","impact_type":"unknown","incident_date":"2025-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sun%20Pacific%20Solar%20Electric%20Breach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63cf6ace9ec3","org_name":"Sun Pacific Solar Electric Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607730"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3cc41584c7d0d6c31b64f67122879cbbc2bce21","impact_type":"unknown","incident_date":"2025-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"748838bc4a56","org_name":"Method Schools","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607752"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0241c7c9e666077f6b59ab009dbe1757c5684e5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAB32389-22BC-C25A-6F60-6EB525FFDC56"},"incident_date":"2025-08-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8e62417c78a","org_name":"Elastic","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.elastic.co/blog/elastic-update-salesloft-drift-security-incident"}],"summary":"\"On August 26, 2025, Salesloft Drift publicly disclosed a security incident impacting its platform. Shortly after, Google’s Threat Intelligence Group released an in-depth report detailing the threat actor’s activity. Although Elastic did not receive notification of impact, since ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"908aa16da5268e0f0f9647853116ac53b9fdef39","impact_type":"unknown","incident_date":"2025-02-19","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Absolute%20Dental%20-%20Individual%20Notice%20Example.pdf"},"notes":null,"org_country":"US","org_id":"2529e877e8d9","org_name":"Absolute Dental Group, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607708"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Absolute%20Dental%20-%20Individual%20Notice%20Example.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Absolute%20Dental%20Group%2C%20LLC-2025-08-26"}],"summary":"Absolute Dental Group, LLC filed a consumer notification letter concerning a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3f18d4783dc99b9fc97e4388a4465e7fbab67040","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e518c4db7ca1","org_name":"Prime Therapeutics LLC","org_type":"professional_services","ransomware":null,"records_affected":2266,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-25-prime-therapeutics-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Laptop"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-25","discovered_date":"2025-03-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"d7f72e0eea6a76d568a525aa5de21a74ef559c77","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RASLO%20-%20Mailing%20Proof%20-%20adult%20letter.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e69dd46f49dd","org_name":"Pacific Imaging Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":13158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-25-pacific-imaging-management-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608403"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RASLO%20-%20Mailing%20Proof%20-%20adult%20letter.pdf"}],"summary":"Pacific Imaging Management reported unauthorized access to certain employee email accounts between February 3 and March 17, 2025, and reviewed their contents for personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-25","discovered_date":"2024-09-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd8bf01cfe409e5a58e471a1bfeb81f4c9440ef6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JHC%20-%20Adult%201%20YR%20CM_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"8dafe6109b36","org_name":"James H Cunningham Insurance Agency Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607659"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JHC%20-%20Adult%201%20YR%20CM_Redacted.pdf"}],"summary":"An unauthorized party accessed Cunningham Group's network and may have acquired files containing customers' personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-08-25","discovered_date":"2025-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2af059abef67956c6e6aafd5c3955f9f01eb77fe","impact_type":"both","incident_date":"2024-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Falcon%20Hiller%20-%20Regulatory%20Notice%20Letter%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"6b835e27fa61","org_name":"Hiller Companies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Falcon%20Hiller%20-%20Regulatory%20Notice%20Letter%20-%20California_0.pdf"}],"summary":"Hiller reported that files were copied without authorization and maliciously encrypted, potentially exposing personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-25","discovered_date":"2024-10-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c95e207bf3ce8a887c33124790aba8d5a1739d42","impact_type":"data_theft","incident_date":"2024-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Healthcare%20Services%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"384a167db473","org_name":"Healthcare Services Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Healthcare%20Services%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Healthcare%20Services%20Group%2C%20Inc-2025-08-25"}],"summary":"Healthcare Services Group, Inc. reported that an unauthorized actor may have accessed and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"258db105c536988440352e2daf4f42b12d4b9933","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C20AD4D7-6FE9-7759-AA27-A0C99BFF6710"},"incident_date":"2025-08-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"7a5a52568bbe","org_name":"Esker","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.esker.com/blog/esker-news-and-culture/salesloft-and-drift-oauth-incident-affecting-salesforce-data-what/"}],"summary":"\"On August 25, 2025, Esker became aware of a security incident targeting Salesloft and Drift, marketing applications used by many Salesforce customers to automate sales workflows. In this incident, attackers obtained OAuth credentials associated with Esker’s Salesloft and Drift i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84120c5e042f86f7bf24976fa0be887e44c38dd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70EFDF2E-C9B0-8607-9795-C442636B55FB"},"incident_date":"2025-08-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ad4a467536d","org_name":"Dynatrace","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dynatrace.com/news/blog/salesloft-drift-incident-dynatraces-response/"}],"summary":"\"In August 2025, a cyberattack on Salesloft’s Drift application resulted in unauthorized access to Salesforce CRM data from companies using the third-party app. Salesloft and Salesforce have since taken steps to disable the compromised connections and notify their affected custom","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d172554e5ae1ffa88c76a8e4bdf83c20d093a81d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bee7581ea0c7","org_name":"College Parkside Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":5736,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-25-college-parkside-pharmacy"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"aceba0b582755e8d9da98aaf46228ea01d787a7b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c013166af115","org_name":"College Hometown Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":9742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-25-college-hometown-pharmacy"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"166d36c108be44e3d610788eb7cf4b7b370c680f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac390d497855","org_name":"Assisted Living Pharmacy Service, LLC","org_type":"healthcare","ransomware":null,"records_affected":5590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-25-assisted-living-pharmacy-service-llc"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QXNzaXN0ZWQgTGl2aW5nIFBoYXJtYWN5IFNlcnZpY2UgTExDQHFpbGlu"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bc7eeb015d29f8954c3381192733eea355901ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Petrusha%20-%20%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d79bfe186002","org_name":"Petrusha Enterprises, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Petrusha%20-%20%20Sample%20Notification%20Letter.pdf"}],"summary":"Petrusha Enterprises detected an attempted intrusion into its computer network and said some personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"739695f906511da661b2d62aae5733dad8c657d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4CA4238-A0B9-2382-0DCC-509A6F75849B"},"incident_date":"2025-08-23","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7491ec76f60c","org_name":"Workday","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2025/08/18/hr-giant-workday-says-hackers-stole-personal-data-in-recent-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.darkreading.com/application-security/workday-breach-shinyhunters-salesforce-attacks;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.livemint.com/technology/tech-news/data-breach-alert-workday-confirms-personal-data-stolen-hackers-could-access-names-emails-and-phone-numbers-11755528200642.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cyberpress.org/workday-confirms-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html"}],"summary":"\"On August 23, 2025, Workday became aware of a security issue in Salesloft’s Drift application, a third-party app that connects to Salesforce. Upon learning of the issue, we disconnected the app, invalidated Drift’s tokens, and began removing any related integrations. We simultan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29c96a4a76b656e01e73288bfc660fd9e781c536","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F4922F4-5568-161A-8CDF-4AD2299F6D23"},"incident_date":"2025-08-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b11e9b46aed","org_name":"PowerSchool","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/04/powerschool-hit-by-by-salesloft-drift-campaign-but-hackers-claim-that-there-is-no-risk-or-harm-or-ransom/"}],"summary":"\"On August 23rd, PowerSchool was notified that we were affected by a security incident involving the Drift app, published by Salesloft. As a result of this incident, a threat actor gained unauthorized access to the Salesforce database, which we use for customer support and intern","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78638726de79e53cf7eb56d1b3526c769c5d6425","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"675C7B02-772E-4828-96B9-ED5494249740"},"incident_date":"2025-08-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"f3484af83e85","org_name":"Miljödata","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/08/28/sweden_council_ransomware/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.blt.se/karlskrona/cyberattack-mot-karlskronaforetag-utpressas-pa-pengar/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://topclassactions.com/lawsuit-settlements/lawsuit-news/volvo-group-discloses-data-breach-after-hr-supplier-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://gotland.se/arkiv/nyheter/allmant/2025-08-26-region-gotlands-leverantor-av-arbetsmiljosystem-ar-utsatta-for-cyberangrepp;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.oru.se/english/news/miljodata-no-evidence-of-personal-data-leaks-after-cyberattack/;"},{"fetched_at":null,"title":"Leak-site claim by datacarry","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWlsasO2ZGF0YUBkYXRhY2Fycnk"},{"fetched_at":null,"title":"Have I Been Pwned: Miljödata","type":"hibp","url":"https://haveibeenpwned.com/Breach/Miljodata"}],"summary":"\"Sweden's municipal governments have been knocked offline after ransomware crooks hit IT supplier Miljödata, reportedly demanding the bargain-basement sum of $168,000.\n\nMiljödata runs HR, sick leave, and incident reporting systems for approximately 80 percent of Sweden's municipa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware","derived":{"claim_groups":["datacarry"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e50811a87595c1a26d13e2c93d982964f54d72b2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E732CED-3463-D06D-E0CA-9A15B6153677"},"incident_date":"2025-08-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"588f9e88b22b","org_name":"Jfrog","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://jfrog.com/help/r/salesforce-data-incident-identified-linked-to-third-party-salesloft-drift/salesforce-data-incident-identified-linked-to-third-party-salesloft-drift"}],"summary":"\"As previously shared, Salesforce informed relevant customers of potential unauthorized access to our Salesforce instance via the Drift (Salesloft) application. Based on our current assessment, any information that a customer may have shared with JFrog in our support system - inc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbdf130325363defb51c7b88c5fec567d08c4667","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Whitepages%20Security%20Notice%202025-8-22%20Template.pdf"},"notes":null,"org_country":"US","org_id":"9a74ed1f297e","org_name":"Whitepages","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers used credentials stolen from other websites to access Whitepages accounts when users reused the same username and password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607557"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Whitepages%20Security%20Notice%202025-8-22%20Template.pdf"}],"summary":"Whitepages detected credential-stuffing attempts using credentials stolen from other websites, and some accounts may have been accessed.","supporting_quote":"We determined that these attempts were part of a “credential stuffing” attack, in which someone used lists of usernames and passwords stolen from other, unrelated websites to try to log in to accounts on our site.","technology_involved":["Whitepages website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f975861f43ac2e47a22dbbdf0dae2d9eb8515c2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f2f4fd62edb2","org_name":"Vance County Department of Social Services","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-22-vance-county-department-of-social-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05faeac8d1887b9d481fb294572557ef6d86ce3a","impact_type":"unknown","incident_date":"2025-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_Job47197d17_TAC_L01_DBM-5236_SAS_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aa5fe19d25eb","org_name":"Tungsten Automation Corporation (f/k/a Kofax, Inc.)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607551"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6fbb783fc0e3b518adc612bab9696ac1f7ae2ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6364D3F0-F495-B6AB-9DCF-8D3B5C6E0B01"},"incident_date":"2025-08-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34fdf92ca28a","org_name":"Rubrik","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rubrik.com/blog/company/25/salesforce-connected-third-party-drift-application-supply-chain-incident-response"}],"summary":"\"On Friday, August 22, Rubrik was notified by Salesforce that they had detected unusual activity with the third-party Drift application published by Salesloft, suggesting potential unauthorized access to Rubrik’s Salesforce instance.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-22","discovered_date":"2025-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64ac414b5dc34325302a067d0abfd28fa55ffa61","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Client%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"d9b37314ea72","org_name":"Louis Vuitton North America, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607576"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Client%20Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Louis%20Vuitton%20North%20America%2C%20Inc.-2025-08-22"}],"summary":"Louis Vuitton reported that an unauthorized party accessed a database containing client personal information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fd7b7782e163994acbd57562518f0b15b5c21857","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"728446f07ce7","org_name":"Independent Health Association, Inc.","org_type":"healthcare","ransomware":null,"records_affected":637,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-22-independent-health-association-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c401c17ef5b40ffb1591100f35878cd1b414f7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98F13708-2101-94C4-7568-7BE6106A3B84"},"incident_date":"2025-08-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61e0a396c03d","org_name":"HackerOne","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackerone.com/blog/salesforce-drift-incident-response-update"}],"summary":"\"HackerOne confirms that this matter is now fully resolved. The connector involved in this incident remains disabled, all credentials have been rotated, and remediation is complete. Accordingly, this incident is considered closed. \n\nSummary\nPlatform functionality remains unaffect","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-22","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e77b04e6c378d8fbf96f889d631157c8a815c6a","impact_type":"data_theft","incident_date":"2025-05-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FNWL%20Sample%20Notification%20Letter_All%20States.pdf"},"notes":null,"org_country":"US","org_id":"a6ccb17a2792","org_name":"Farmers New World Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FNWL%20Sample%20Notification%20Letter_All%20States.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34433.pdf"}],"summary":"An unauthorized actor accessed a third-party vendor database containing Farmers New World Life Insurance Company customer information and acquired data.","supporting_quote":"On May 30, 2025, FNWL’s parent company was alerted that a third-party vendor identified suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing FNWL customer information (the “Incident”).","technology_involved":["vendor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-22","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35143b8829076d7c6f678373a725a06beb2bfa3a","impact_type":"data_theft","incident_date":"2025-05-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FIE%20Sample%20Notification%20Letter_All%20States_0_0.pdf"},"notes":null,"org_country":"US","org_id":"c3d771086dd8","org_name":"Farmers Insurance Exchange","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615004"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607524"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FIE%20Sample%20Notification%20Letter_All%20States_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Farmers%20Insurance%20Exchange-2025-08-25"}],"summary":"An unauthorized actor accessed and acquired personal information from a third-party vendor database containing Farmers customer information.","supporting_quote":"On May 30, 2025, one of Farmers’ third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information (the “Incident”).","technology_involved":["vendor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-08-22","discovered_date":"2025-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"f65c91d45bb2840f6352f642468dea5f78462ae6","impact_type":"data_theft","incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Episource%20-%20Individual%20Notice%20Letter%20Template_0.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"278504f30c49","org_name":"Episource, LLC","org_type":"professional_services","ransomware":null,"records_affected":6584876,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Episource%2C%20LLC-2025-12-11"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004825"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-618409"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614134"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607574"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608441"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Episource%20-%20Individual%20Notice%20Letter%20Template_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Episource%20-%20Individual%20Notice%20Letter%20Template_0.pdf"}],"summary":"Episource reported that a criminal accessed and copied data from its computer systems between January 27 and February 6, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"01227ba90bfa9e7a280007f06c09e198d1847b87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a33c9ed4d055","org_name":"C. B. King Memorial School","org_type":"healthcare","ransomware":null,"records_affected":838,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-22-c-b-king-memorial-school"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d2c6d63bae099c6ae000e96e8dab5f1e71460ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C16A5320-FA47-5530-D958-3C34FD356EF5"},"incident_date":"2025-08-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e5524a438bc","org_name":"BeyondTrust","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beyondtrust.com/trust-center/security-advisories/salesforce-salesloft-drift-security-incident"}],"summary":"\"On Friday, August 22, BeyondTrust was notified by Salesforce of a security event involving the Salesloft Drift application and the use of credentials to access information from Salesloft customer Salesforce instances. More information is available here. Upon detection, Salesforc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"83ec550bfb4d5a6fe1c60b4633cf48f2e5be3de7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"696a19e01e95","org_name":"Beech Acres Parenting Center","org_type":"healthcare","ransomware":null,"records_affected":19315,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-22-beech-acres-parenting-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2dc3bb7339827734d7fcc8122ef5fce8933e88c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1679091C-5A88-0FAF-6FB5-E6087EB1B2DC"},"incident_date":"2025-08-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee7e819743e5","org_name":"\"AppFolio, Inc.\"","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://natlawreview.com/press-releases/appfolio-data-breach-exposes-personal-information-murphy-law-firm#google_vignette"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612354"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AppFolio%2C%20Inc.-2025-10-06"}],"summary":"\"On or around August 22, 2025, AppFolio, Inc. (“AppFolio”) became aware of a security incident affecting Salesloft, a provider of sales enablement software and one of AppFolio’s vendors. Based on a subsequent forensic investigation, AppFolio determined that cybercriminals infiltr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f74821a0d9f6c241bfe0f502d2cb7d75b09b7ccc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6cab0bc2c5e","org_name":"Vital Imaging Medical Diagnostic Centers, LLC","org_type":"healthcare","ransomware":null,"records_affected":111509,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-21-vital-imaging-medical-diagnostic-centers-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b23edcf21feb5005347370f2f1ca0301549d419b","impact_type":"data_theft","incident_date":"2024-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Computer%20Merchant%20-%20Individual%20Template%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ec0e7b6541cf","org_name":"The Computer Merchant","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607506"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Computer%20Merchant%20-%20Individual%20Template%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34421.pdf"}],"summary":"The Computer Merchant said files from a July 2024 cyberattack were later found publicly available and contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11e3da02cecd886cf7d757c054225dc1145c1395","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C51CE410-C124-A10E-0DB5-E4B97FC2AF39"},"incident_date":"2025-08-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ef6d42350ce","org_name":"Sigma Computing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://security.sigmacomputing.com/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.driftbreach.com/"}],"summary":"\"Sigma Computing disclosed that it was impacted by the Salesloft Drift OAuth token compromise campaign targeting Salesforce customers. Unauthorized actors accessed Salesforce credentials linked to the Drift integration, granting them limited access to Sigma’s Salesforce environme","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cd72e8e3fcf19ba2479b49ee46834bc53dfdd43","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20-%20Generic.pdf"},"notes":null,"org_country":"US","org_id":"c5fc2cc834df","org_name":"Mutual of America Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20-%20Generic.pdf"}],"summary":"Mutual of America unintentionally disclosed a data file containing personal account information to another client via secure email.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37437150e3fe66787f2bc94c182f547f770f3cff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6EA9AB1B-AA0E-FB9E-1909-4440C317E21B"},"incident_date":"2025-08-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2feb10ee047e","org_name":"Megaport","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://trust.megaport.com/?tcuUid=f3ee3f57-2b3c-4b77-96b2-aad93acd0c47;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.driftbreach.com/"}],"summary":"\"Megaport confirmed it was impacted by the Salesloft Drift supply chain incident, which allowed unauthorized access to a subset of its Salesforce data. The exposed information was limited to customer contact details, including names, titles, business email addresses, and business","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"29fc5169e9f2d73475e8f5bf06b96befc5dcd321","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"28688ecde6c2","org_name":"McEwen & Associates","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-21-mcewen-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44adc7f97dd84b676ea2655143e4ac84cdf1c50e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33E75FF0-9DD6-01BB-E69F-351039152189"},"incident_date":"2025-08-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"950942213d07","org_name":"Heap","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.driftbreach.com/"}],"summary":"\"Heap disclosed that it was impacted by the widespread Salesloft Drift incident, which targeted Salesforce customers using Drift's integration. Salesforce notified Heap of unusual activity tied to the Drift application, indicating potential unauthorized access to Heap's Salesforc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b54bced4e04ed18a639c4cd153f0dce8a956f754","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19CA14E7-EA63-28A4-2E0E-B13D585E4C22"},"incident_date":"2025-08-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"81c6cd4303c6","org_name":"Pagerduty","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pagerduty.com/blog/news-announcements/salesloft-drift-data-breach-update-to-our-customers/"}],"summary":"\"On August 20, 2025 we were notified by Salesloft, a third-party vendor, of a potential security issue in Salesloft’s Drift application. On August 23, Salesloft informed us that its Drift OAuth integration flow with Salesforce had been compromised, exposing some PagerDuty custome","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b20fe697ad0d5b0321df9df799a19fac729de0b4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"60ab19659e12","org_name":"Arkansas Primary Care Clinic","org_type":"healthcare","ransomware":null,"records_affected":2491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-20-arkansas-primary-care-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ec6af543c272a0bb8b6488eedad8af007f9b3eba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"297eaa703480","org_name":"Revere Health PC","org_type":"healthcare","ransomware":null,"records_affected":605,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-19-revere-health-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5d33bb2719bab6ac3a5931062ed9e8833989b6e9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ce5ba700a3a9","org_name":"MRI Associates of St. Pete, Inc. d/b/a Saint Pete MRI","org_type":"healthcare","ransomware":null,"records_affected":138209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-19-mri-associates-of-st-pete-inc-d-b-a-saint-pete-mri"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"116bb6deeb7b0fb704886d501323895ec424c957","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34402.pdf"},"notes":null,"org_country":"US","org_id":"68628b712a64","org_name":"Hulberg and Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34402.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34402.pdf"}],"summary":"An unknown third party gained unauthorized access to a server storing Hulberg and Associates’ human resources files, and personal information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-19","discovered_date":"2024-08-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a28da6d149724ed817df9dc1bd59e228830ce458","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FRC%20Notice%20Letter%20-%20Adults%20-%20TransUnion%20-%20SSN.pdf"},"notes":null,"org_country":"US","org_id":"83f104677a11","org_name":"Farmers Rice Cooperative","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607393"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FRC%20Notice%20Letter%20-%20Adults%20-%20TransUnion%20-%20SSN.pdf"}],"summary":"Farmers Rice Cooperative reported a cybersecurity incident that may have affected personal information, including names, addresses, dates of birth, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"35d9a14c91821ced2bd865438985cef5fad938f4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a8cb351fb9fb","org_name":"Pediatric Otolaryngology Head & Neck Surgery Associates, P.A.","org_type":"healthcare","ransomware":null,"records_affected":43446,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-18-pediatric-otolaryngology-head-neck-surgery-associates-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-08-18","discovered_date":"2025-12-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"7e693abb2f07112523ec656a316ea6453694027f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"038fe86f3edf","org_name":"Inotiv, Inc.","org_type":"other","ransomware":true,"records_affected":10482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004756"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/720154/000162828025040658/notv-20250808.htm"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/SW5vdGl2LCBJbmNAcWlsaW4"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614954"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616212"}],"summary":"Inotiv reported that a threat actor gained unauthorized access to and encrypted certain company systems, disrupting business operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2eb9f7704296d6cdba24005ace063c8172e2115e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5fbd3f39dc24","org_name":"CareTracker, Inc.","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-18-caretracker-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"56a4270e971e4b2987da4b30cf80752196f94c29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a7d9b335210a","org_name":"Bevel Health Medical Group","org_type":"healthcare","ransomware":null,"records_affected":510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-18-bevel-health-medical-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-18","discovered_date":"2025-07-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4ed61912ec35a4f0d4e716cc5c59675a48613fc","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Apex%20-%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b740565ba56b","org_name":"Apex Class Action, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Apex%20-%20Notification%20Letter.pdf"}],"summary":"Apex Class Action reported that unauthorized access to IMDataCenter’s environment exposed data that may have included individuals’ Social Security numbers.","supporting_quote":null,"technology_involved":["IMDataCenter"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IMDataCenter"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"a5ea92284c18","name":"IMDataCenter"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a69c883e8e320ed9dd41affc118a61c5fc48783d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F457C545-A9DE-D88F-18EC-EE47145A72C0"},"incident_date":"2025-08-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87b477d03739","org_name":"Marriott","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe5fe307567b984d0a5d06eb2818811f4ee5724e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA5D2F1C-4608-232E-07D3-AA3D998E5135"},"incident_date":"2025-08-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2eb38e8468fd","org_name":"1-800Accountant","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-16","discovered_date":"2025-08-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bbcb4fe2265e10374e54c608d1c042a658813b53","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34364.pdf"},"notes":null,"org_country":"US","org_id":"025baa33747d","org_name":"North American Company for Life and Health Insurance","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34364.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34364.pdf"}],"summary":"North American Company for Life and Health Insurance reported that an attacker may have viewed personal information through an agent-used web portal.","supporting_quote":null,"technology_involved":["web portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7d3ba7e834e0ecb8bb6fd0f75251a1e77f30b486","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f9cae2c22cc2","org_name":"Welcome Dentistry-Anaheim","org_type":"healthcare","ransomware":null,"records_affected":1001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-15-welcome-dentistry-anaheim"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-08-15","discovered_date":"2025-10-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"cfe62bd5d2594da1da72ffde67dcfe310d4b6821","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ce5d34ee7543","org_name":"Optima Tax Relief, LLC","org_type":"financial","ransomware":null,"records_affected":19732,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004675"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614410"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Optima%20-%20California%20Notification_0.pdf"}],"summary":"An unauthorized person accessed Optima Tax Relief’s network and downloaded copies of certain files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5041d572b5e2d942d5a08fa32a7e4edc70e81418","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81a5b22d7584","org_name":"Mower County Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-15-mower-county-health-and-human-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c6af579bfbdafa3c98df31c0e2fef52b0f57f5e5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63bc4550c3c2","org_name":"Lake City Cancer Care, LLC","org_type":"healthcare","ransomware":null,"records_affected":9980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-15-lake-city-cancer-care-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f984fcf9414fc5b3d3fb065d5269a27f5ca70b4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/REDACTED_CPAP_-_Letter_%28A%29_-_CPAP_Medical_36666258v1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dfee1b85a3aa","org_name":"CPAP Medical Supplies and Services Inc.","org_type":"healthcare","ransomware":null,"records_affected":90133,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-15-cpap-medical-supplies-and-services-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607248"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34355.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-15","discovered_date":"2025-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"debd6aaac86d4e9c4da3d6dd5ab6cb9de2a5dafc","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Christian%20Brothers%20Academy.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e98aa7589e18","org_name":"Christian Brothers Academy","org_type":"education","ransomware":true,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Christian%20Brothers%20Academy.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Christian%20Brothers%20Academy.pdf"}],"summary":"Christian Brothers Academy reported that criminal actors may have accessed files through a potential phishing attack and launched a ransomware attack.","supporting_quote":"After completing our investigation in late June of 2025, we determined that the criminals may have accessed our network through a potential phishing attack, in which the threat actor exploited trusted systems to infiltrate our computer systems and launch a ransomware attack.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":"qilin","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b2c2d96cfbfb2200244187805655e2ee60b7cd29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb2c75ad5d7e","org_name":"Alert Medical Alarms","org_type":"healthcare","ransomware":true,"records_affected":39218,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-15-alert-medical-alarms"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QWxlcnQgTWVkaWNhbCBBbGFybXNAcWlsaW4"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"qilin","claim_groups":["qilin"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72553ce412b99b8c30d859b7fd9aacf4c4db1108","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F14E45F-CEEA-167A-5A36-DEDD4BEA2543"},"incident_date":"2025-08-14","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"088bf9632882","org_name":"Rectangle Health","org_type":"financial","ransomware":null,"records_affected":2095,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/florida-radiology-practice-data-breach/"}],"summary":"\"Rectangle Health, a Valhalla, NY-based software company that provides practice management software to healthcare providers, has recently notified the Maine Attorney General about a breach affecting 2,095 individuals, including 11 Maine residents. The incident involved unauthoriz","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-14","discovered_date":"2025-10-31","entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee27461111ed715f60802b3086fb30b1a15213de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4DA3B7F-BBCE-2345-D777-2B0674A318D5"},"incident_date":"2025-08-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"893a36d8c259","org_name":"Cox Enterprises","org_type":"technology_saas","ransomware":null,"records_affected":9479,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rescana.com/post/cox-enterprises-data-breach-cl0p-ransomware-exploits-oracle-e-business-suite-zero-day-vulnerability;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/cox-enterprises-discloses-oracle-e-business-suite-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.emeryreddy.com/blog/data-breach/cox-enterprises-inc-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.paubox.com/blog/cl0p-ransomware-gang-names-29-oracle-ebs-breach-victims;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/cox-confirms-oracle-ebs-hack-as-cybercriminals-name-100-alleged-victims/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614528"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004687"}],"summary":"\"Cox Enterprises, a major U.S. conglomerate operating in telecommunications and automotive services, experienced a data breach after cybercriminals exploited a zero-day vulnerability in the Oracle E-Business Suite (Oracle EBS). The breach occurred between August 9 and August 14, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"023b0d9f31a20effc37581d7b54300d59fc74b5d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2f590adc6a9","org_name":"Welcome Dentistry-Los Angeles","org_type":"healthcare","ransomware":null,"records_affected":1001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-13-welcome-dentistry-los-angeles"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bce9f9aabf1c09fd412c738010ad4223863e4fa2","impact_type":"unknown","incident_date":"2025-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee2189fd27ce","org_name":"Welcome Dentistry","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607036"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607158"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-13","discovered_date":"2025-07-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c184cae85d3ce7d38760b089a72049f4e668fb74","impact_type":"unknown","incident_date":"2025-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84641e198733","org_name":"Morrow Equipment Company","org_type":"unknown","ransomware":null,"records_affected":1660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morrow%20Equipment%20Company-2025-08-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e05bb5723bd2712c0b4409ed0297833d69853d7e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19915.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a76534fbb7ff","org_name":"Health Services Seattle, LLC (Miracle Ear)","org_type":"unknown","ransomware":null,"records_affected":7389,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19915.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50c22edd649b465d03cf98a730fab2f1926606fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F0E3DAD-9990-8345-F743-9F8FFABDFFC4"},"incident_date":"2025-08-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66dd04a2f689","org_name":"Fastly","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fastlystatus.com/incident/377884"}],"summary":"\"Fastly was impacted by the recent security incident involving Salesloft's Drift application. We have investigated and notified all Fastly customers affected. This incident was isolated to our Salesforce instance and did not impact any Fastly services, infrastructure, or products","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-13","discovered_date":"2025-04-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"7eb4ddd9913a666c2464e4e9ec100630c7618c0c","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b00eec2df46","org_name":"Commonwealth Business Bank","org_type":"financial","ransomware":null,"records_affected":23978,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004719"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615471"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607062"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Commonwealth%20Business%20Bank%20-%20Supplemental%20Notice%20-%20CA_0.pdf"}],"summary":"Commonwealth Business Bank reported unauthorized access to its environment and said certain files and folders may have been viewed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a18c486c31435fe3fac8762ed93887401d3fbe5","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20United%20Domestic%20Workers_Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7209804deaaf","org_name":"United Domestic Workers of America","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607023"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20United%20Domestic%20Workers_Final_Redacted.pdf"}],"summary":"United Domestic Workers of America reported an attempted unauthorized access to its servers and said internal HR data may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8a9b606622fd16ecd1d5284beb94b57d7a006e8f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"864bb5989fb8","org_name":"Tombigbee Healthcare Authority dba Whitfield Regional Hospital","org_type":"healthcare","ransomware":null,"records_affected":58081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-12-tombigbee-healthcare-authority-dba-whitfield-regional-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c9036934a961b62ce09b57d15b36d8d42500fe8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45C48CCE-2E2D-7FBD-EA1A-FC51C7C6AD26"},"incident_date":"2025-08-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e938bd814f2","org_name":"Toast","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://updates.toasttab.com/announcements/toast-s-security-update-regarding-the-salesloft-drift-incident"}],"summary":"\"On August 26, 2025, Toast was made aware of a security issue in Salesloft’s Drift application, a third-party chat support tool that connects to Salesforce, Toast’s customer relationship management system. Upon learning of the issue, we disconnected the app and invalidated Drift’","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3073a29fe8703e6d63c6dfc568d26b4bf3abf5f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C59DC04-8E88-5024-3BE8-079A5C74D079"},"incident_date":"2025-08-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d65fb904edf3","org_name":"Pantheon","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://status.pantheon.io/incidents/6t3wt1qpqh6f"}],"summary":"\"Our investigation has confirmed that a threat actor exploited a vulnerability in the Salesloft Drift application’s OAuth integration with Salesforce to gain unauthorized access to CRM data. Pantheon was notified on August 28, 2025 of this compromise that occurred between August ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5aa905b3da85ae1e5848d0f205cce79cc30dc42e","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34295.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"80b2c861e190","org_name":"Health Services LLC (Miracle Ear)","org_type":"unknown","ransomware":null,"records_affected":11088,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34295.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c89c06bd8d4cf128ff8eb7e4e68ab97e5e61ff4c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C81E728D-9D4C-2F63-6F06-7F89CC14862C"},"incident_date":"2025-08-12","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e9f335c7c68","org_name":"Google","org_type":"technology_saas","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/google-hackers-target-salesforce-accounts-in-data-extortion-attacks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://gbhackers.com/google-hacked/;"}],"summary":"\"However, it was actually voice phishing (vishing), one of the more traditional tools in the hacker arsenal, that was Google’s undoing.\n\nVishing is tried and tested for a reason. Rather than trying to navigate robust software defenses, the phone scam targets human vulnerabilities","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"394429e9504c4dc4d1c0aa549bc336cb785ba18e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4DA3B7F-BBCE-2345-D777-2B0674A318D5"},"incident_date":"2025-08-12","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"384ea2baa507","org_name":"Allianz Life","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cyberinsider.com/allianz-life-breach-exposes-personal-data-of-1-4-million-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/allianz-life-says-july-data-breach-impacts-15-million-people/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://insurancenewsnet.com/oarticle/allianz-life-confirms-data-breach-affecting-majority-of-1-4m-us-customers;"},{"fetched_at":null,"title":null,"type":"press","url":"https://economictimes.indiatimes.com/news/international/global-trends/insurance-giant-allianz-life-hit-by-data-breach-hackers-fooled-the-system-not-the-servers-and-nearly-1-4-million-affected/articleshow/122932918.cms?from=mdr;"},{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/data-breach-allianz-life-insurance-113523666.html;"},{"fetched_at":null,"title":"Have I Been Pwned: Allianz Life","type":"hibp","url":"https://haveibeenpwned.com/Breach/AllianzLife"}],"summary":"\"Luxury fashion brand Chanel has suffered a data breach linked to a broader cyberattack campaign targeting customers of Salesforce, a popular cloud-based customer relationship management (CRM) platform.\n\nChanel says it first detected the breach on July 25th, after attackers acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"49b040067e87fd8023ff9380f6f58c56f954ad39","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34284.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a45d48d187c0","org_name":"East Adams Rural Healthcare","org_type":"unknown","ransomware":null,"records_affected":8896,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34284.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"173ffb51de25357fcbae9d2b0eaa9b210c53aedf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f97bc17af4d","org_name":"Dr. Doug's Pediatric Dentistry","org_type":"healthcare","ransomware":null,"records_affected":3590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-11-dr-doug-s-pediatric-dentistry"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d028e494198096ef1725deb09ecd651de43f78fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F14E45F-CEEA-167A-5A36-DEDD4BEA2543"},"incident_date":"2025-08-10","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"d309717bf1a6","org_name":"Qantas","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/airlines-klm-air-france-detail-customer-data-breach-a-29143;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dailygalaxy.com/2025/08/this-airline-hit-by-cyberattack-your-names-emails-and-account-numbers-have-leaked-and-thats-not-all/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/air-france-klm-group-confirms-data-breach-from-a-third-party-customer-service-system/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/air-france-klm-group-confirms-data-breach-from-a-third-party-customer-service-system/"}],"summary":"\"A data breach stemming from a third-party customer service database has affected European airlines Air France and KLM Royal Dutch Airlines. Air France-KLM Group said it learned of the cyber intrusion after detecting “unusual activity on an external platform” it uses for customer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2283dee8df6a0b56d8ef286a985c43d367f675fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"107053d8527c","org_name":"Mission City Community Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":11016,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-09-mission-city-community-network-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be69e7ee5c7045eb982dda417f30fd392837fea2","impact_type":"data_theft","imported_from":null,"incident_date":"2019-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f6626d539049","org_name":"Unigame","org_type":"technology_saas","ransomware":null,"records_affected":843696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Unigame","type":"hibp","url":"https://haveibeenpwned.com/Breach/Unigame"}],"summary":"Unigame suffered a data breach in December 2019 involving email addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e9a0f544067a40b6dec365d68082b5bd31eac1f1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d11067c84a04","org_name":"Center for Disability Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3343,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-08-center-for-disability-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed9a791444c19c1a9ba34f099732e952bf61e34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FF1DE77-4005-F8DA-13F4-2943881C655F"},"incident_date":"2025-08-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"97fb22b0768b","org_name":"Cato Networks","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.catonetworks.com/blog/cato-networks-statement-on-salesforce-salesloft-drift-incident/"}],"summary":"\"The issue centers on the misuse of OAuth tokens associated with the Drift app. Salesforce and other vendors identified unauthorized access between August 8 and 18, 2025. The incident has impacted hundreds of Salesforce customers. The Cato SASE Cloud Platform,  services and infra","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c1fc35d8b08224bd61ba0265bca57721a23564f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0a17ca6508e","org_name":"Aflac Incorporated (“Aflac”)","org_type":"healthcare","ransomware":null,"records_affected":13924906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-08-aflac-incorporated-aflac"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbe511e1a57ca3db141efd324b4ccb080790a156","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A684ECEE-E76F-C522-7732-86A895BC8436"},"incident_date":"2025-08-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38634f166f61","org_name":"Houghton Mifflin Harcourt (HMH)","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-07","discovered_date":"2025-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13772c7eb8cb38268dee99b3b757089417bbc9e6","impact_type":"data_theft","incident_date":"2025-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Connex%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8b286d4db367","org_name":"Connex Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Connex%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Connex%20-%20Consumer%20Letter.pdf"}],"summary":"Connex Credit Union reported that files containing some members’ personal information may have been accessed or downloaded without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-08-07","discovered_date":"2025-07-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"36da44f4a8f6f1c3787c27b403537d305c3dd177","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"21517348bb1b","org_name":"Columbia University","org_type":"education","ransomware":null,"records_affected":3067242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005050"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606745"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sample_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20University-2025-08-07"}],"summary":"Columbia University experienced an IT outage and determined that an unauthorized third party had accessed its network and taken files containing personal, financial, and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-06","discovered_date":"2024-03-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"459b686bed117de428f87b91d1a8957ae344dd77","impact_type":"unknown","incident_date":"2023-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c8decebb1a6e","org_name":"Sirva, Inc. filing on its own and","org_type":"unknown","ransomware":null,"records_affected":1418,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sirva%2C%20Inc.%20filing%20on%20its%20own%20and%20on%20behalf%20of%20the%20impacted%20data%20owners%20%28Sirva%2C%20Inc.%20clients%29.-2025-08-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef37f8b74df7e54c68556432c69a0c9db4dbe5a8","impact_type":"unknown","incident_date":"2025-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Livingston%20-General-Final_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"394297071333","org_name":"Ralph S Livingston, CPA An Accountancy Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606701"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-06","discovered_date":"2025-01-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a115240d3351a8bca2217938e4662e560b5b64f","impact_type":"unknown","incident_date":"2024-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DTiQ%20-%20CA%20notice%20letter%20-%20Mailing%20Proof_0.pdf"},"notes":null,"org_country":"US","org_id":"84be366c1d4e","org_name":"DTiQ Technologies Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DTiQ%20-%20CA%20notice%20letter%20-%20Mailing%20Proof_0.pdf"}],"summary":"DTiQ Technologies Inc identified unauthorized access to a portion of its network between December 31, 2024 and January 12, 2025, and its review identified information that included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-08-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fad010ed7de3e51b8a959e67775a643f928831ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Unauth%20Access%20OAG.pdf"},"notes":null,"org_country":"US","org_id":"ee40832e682f","org_name":"California Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Unauth%20Access%20OAG.pdf"}],"summary":"During a burglary at the California Department of Child Support Services, a locked drawer containing documents with personal information was forcibly accessed, but the documents were not removed.","supporting_quote":"During a burglary at our premises, a locked drawer containing documents – including one with your personal information – was forcibly accessed.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-08-05","discovered_date":"2025-06-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"348cdf6e5b40b656da31d4a07925b581e3abaa42","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/South%20Coast%20Pediatrics%20HIPAA%20Breach%20Notification-%20Sample%20No%20PHI.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2ca93bd3fe07","org_name":"South Coast Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-05-south-coast-pediatrics"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/South%20Coast%20Pediatrics%20HIPAA%20Breach%20Notification-%20Sample%20No%20PHI.pdf"}],"summary":"South Coast Pediatrics reported that a cyberattack was identified on June 12, 2025, and that personal and medical information may have been involved.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cbb81f7b1b3fdeda7b39960f33a8f55d2e988e1a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8124d54cd04","org_name":"Oglethorpe, Inc.","org_type":"healthcare","ransomware":null,"records_affected":92332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-05-oglethorpe-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-05","discovered_date":"2024-12-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e767f598224e29d54bc5ce8725877b5351f371b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-24784%20Kokomo%20Solutions%20Ad%20CM%201y%20r2prf_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b060d86c45a8","org_name":"Kokomo Solutions, Inc. dba Kokomo24/7","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24784%20Kokomo%20Solutions%20Ad%20CM%201y%20r2prf_Redacted.pdf"}],"summary":"Kokomo Solutions reported that an unauthorized third party accessed files on its network on December 11, 2024, which may have included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"99d17aec7236200c57939510e42c22aa58554e60","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a22184f375c1","org_name":"Westminster Village Greenwood, Inc.","org_type":"healthcare","ransomware":null,"records_affected":14386,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-04-westminster-village-greenwood-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-04","discovered_date":"2024-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"18ebbace17703b35a55b66293e0b4f82b9864a73","impact_type":"unknown","incident_date":"2024-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7fb706b6dbcd","org_name":"Seasons Management LLC","org_type":"unknown","ransomware":null,"records_affected":622,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Seasons%20Management%20LLC-2025-08-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9322b73edc0d4a8a90d193beff40560fc4007b95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ba77767306c","org_name":"MDLand International Corporation","org_type":"professional_services","ransomware":null,"records_affected":22586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-04-mdland-international-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c988f283b3edee1db4ddb7c810e76297d5e8319","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82B3AACE-704E-4C86-8001-19FB985C4E6A"},"incident_date":"2025-08-04","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2c3021595b18","org_name":"Intradev","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/08/22/apcs_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/09/05/uk_schools_intradev_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.churchtimes.co.uk/articles/2025/29-august/news/uk/cyber-attack-leaves-hundreds-of-parishioners-at-risk-of-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/articles/cqjykl2zpyeo;"},{"fetched_at":null,"title":null,"type":"press","url":"https://channeleye.media/need-to-be-alert-as-dbs-personal-checking-service-is-cyber-attacked/;"}],"summary":"\"A CYBER attack on software used by APCS, the company used by many dioceses to carry out Disclosure and Barring Service (DBS) checks, has left hundreds of parishioners at risk of identity theft.\n\nThe Church Times has confirmed that at least ten dioceses are affected: Derby, Ely, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42b7c52eccba69578a0e518e4149e178b84b98ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4CA4238-A0B9-2382-0DCC-509A6F75849B"},"incident_date":"2025-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2a4d3213264","org_name":"University of Phoenix","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://therecord.media/university-of-phoenix-data-breach"}],"summary":"\"The University of Phoenix became the latest U.S. educational institution to warn employees of a data breach involving a popular line of business software from Oracle.\n\nThe university’s parent company filed a notice with the Securities and Exchange Commission (SEC) on Tuesday eve","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b45e7d84118431889d6349b98cc4c3b57180aa6","impact_type":"unknown","incident_date":"2025-04-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ad1947e3a53","org_name":"Oregon Department of Environmental Quality","org_type":"unknown","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Department%20of%20Environmental%20Quality-2025-08-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8a6bd0263f5d57b694ef69e4b795261499ac760","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_DBM-5198_SAS_1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9a488037b96f","org_name":"Lanterman Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606492"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_DBM-5198_SAS_1_Redacted.pdf"}],"summary":"Unauthorized access to certain Lanterman email accounts between August and December 2024 led to a review of information in those accounts.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e972cb3f1bfc4de58e071c16e8ea8aa2593c12ba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42e1f96c4b21","org_name":"Langdon & Company, LLP Certified Public Accountants","org_type":"professional_services","ransomware":null,"records_affected":46061,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-01-langdon-company-llp-certified-public-accountants"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0d43c7324463a8eb4ad64006e28464eeb8bd9988","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68f370dbda36","org_name":"Highlands Oncology Group PA","org_type":"healthcare","ransomware":null,"records_affected":111766,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-08-01-highlands-oncology-group-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2025-08-01","discovered_date":"2025-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"aca58e790e35851f1cc86c28375ff1368d2406db","impact_type":"data_theft","incident_date":"2025-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ACTIVE_161128427_1_SC%20AG%20Consumer%20Letter.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"044380ce652e","org_name":"DaVita Inc.","org_type":"healthcare","ransomware":null,"records_affected":13404,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DaVita%20Inc.-2025-08-01"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ACTIVE_161128427_1_SC%20AG%20Consumer%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34207.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ACTIVE_161128427_1_SC%20AG%20Consumer%20Letter.pdf"}],"summary":"DaVita reported unauthorized access to its dialysis labs database, with personal and clinical information accessed and removed.","supporting_quote":null,"technology_involved":["dialysis labs database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"490654a5da8161730eed9805662eff1e32e18365","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37693CFC-7480-49E4-5D87-B8C7D8B9AACD"},"incident_date":"2025-08-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"e67210575a6f","org_name":"ContentSquare","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://trust.contentsquare.com/?tcuUid=2c81adf8-1e70-4130-9d1d-94966df59058"}],"summary":"Document no longer available","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-08-01","discovered_date":"2025-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cbcb2bbf00dbcee01fab5e2cf5fc4ea05ef18be","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PHI%20SSN%20CM_Source.pdf"},"notes":null,"org_country":"US","org_id":"0adf7048ec21","org_name":"Altos, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The internal system containing personal and health information was exposed to the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PHI%20SSN%20CM_Source.pdf"}],"summary":"Altos, Inc. reported that an internal system containing personal and health information was exposed to the Internet, and that an unauthorized third party may have removed data.","supporting_quote":"On June 17, 2025, we became aware that one of our internal systems that contained personal and health information was exposed to the Internet.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a2050d6c7d151c7c31095c83161a1d286f6b4361","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c32bb527e273","org_name":"Vail Summit Orthopaedics","org_type":"healthcare","ransomware":null,"records_affected":5044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-31-vail-summit-orthopaedics"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2025-07-31","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"670e1c2fcf1303c0803dbfd0420573446bed5d23","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notification_July%202025%20Skimming%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"56b0f1d23116","org_name":"SAFE CREDIT UNION","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A skimming device was placed at the ATM.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606373"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notification_July%202025%20Skimming%20Incident.pdf"}],"summary":"SAFE CREDIT UNION reported that a skimming device was placed at an ATM and card information may have been exposed.","supporting_quote":"SAFE detected that a skimming device was placed at our ATM located at 7475 Madison Ave, Citrus Heights, CA 95610.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cb5c333b69c954a014d5aec948cdcf809a731e6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-07-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"d5e8f17dea57","org_name":"Pi-hole","org_type":"technology_saas","ransomware":null,"records_affected":29926,"reviewed":false,"root_cause":"A vulnerability in the GiveWP WordPress plugin exposed donor information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pi-hole","type":"hibp","url":"https://haveibeenpwned.com/Breach/ThePi-Hole"}],"summary":"A vulnerability in the GiveWP WordPress plugin exposed names and email addresses of Pi-hole donors.","supporting_quote":"In July 2025, a vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of approximately 30k donors to the Pi-hole network-wide ad blocking project .","technology_involved":["GiveWP WordPress plugin"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"GiveWP"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"67fb9d910a69","name":"GiveWP"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-31","discovered_date":"2024-12-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d1013086df15cc39d712d3ba32d510496f0f7c7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HHG%20-%20Adult%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"eee4ce7ecc70","org_name":"Huntington Hospitality Financial Corp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606393"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HHG%20-%20Adult%20Notification%20Letter.pdf"}],"summary":"Huntington Hospitality Financial Corp reported unusual network activity and said files containing personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2025-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"084e53cb8a9b6ace41c9f8c303e664a4d5ac7709","impact_type":"data_theft","incident_date":"2024-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Barrett-Jackson%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7666902a2a18","org_name":"Barrett-Jackson Holdings, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606379"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Barrett-Jackson%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Barrett-Jackson%20Holdings%2C%20LLC-2025-07-31"}],"summary":"Barrett-Jackson reported that files containing personal, financial, medical, and authentication information were copied from a system during a cyber incident on or around November 25, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa0e41200e434e385f8f86b3680793f664b8b72d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibt%20A_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a28e018480c2","org_name":"TIMEC Oil & Gas, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606336"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5667b432f29c24ed56cfc14f51378584caa53b0c","impact_type":"unknown","incident_date":"2024-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Allied_Services_-_Adult_No_SSN_Redacted_36903884v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da292900b4ba","org_name":"Allied Services Division Welfare Fund","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612137"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606339"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"970d2b0178533a5f736563445e6d30791e567aec","impact_type":"data_theft","incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vest%20Tube%20-%20Ex.%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"6fe0299507e6","org_name":"Vest Tube, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606270"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vest%20Tube%20-%20Ex.%20A_0.pdf"}],"summary":"Vest Tube determined that an unknown actor accessed some of its systems and took files containing information that may have included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93c81f5182b4cc266be205234a25fbc9781f0644","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3251fba01d8","org_name":"PhyNet Dermatology, LLC","org_type":"professional_services","ransomware":null,"records_affected":1308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-29-phynet-dermatology-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-29","discovered_date":"2025-05-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"896f5656d59219a3793afbeedfe8c4932a603b8c","impact_type":"unknown","incident_date":"2025-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ec1d428b043","org_name":"North Bend Medical Center Day Surgery","org_type":"unknown","ransomware":null,"records_affected":587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Bend%20Medical%20Center%20Day%20Surgery-2025-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-29","discovered_date":"2025-05-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"996e1eba9e7997b2bf9c40d510f1b8fa64f4a436","impact_type":"unknown","incident_date":"2025-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25563598ed5c","org_name":"Michael Bilikas DDS","org_type":"unknown","ransomware":null,"records_affected":23517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Michael%20Bilikas%20DDS-2025-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e2507fb2fe60e48ad7262a611292bcf5724d5494","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6350b3acb7b","org_name":"Compass Counseling Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":5440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-29-compass-counseling-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1097188940cd985149d922b935fc530b3ea1c47","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clymene%20Management%20Services%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"26b19b4e6566","org_name":"Clymene Management Services, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606287"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clymene%20Management%20Services%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Clymene Management Services reported that an unauthorized actor accessed its network and may have viewed or copied information in affected files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73623141a75bed23dd2f667f71caea0b466e4ee6","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9593f01389a9","org_name":"Alera Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606284"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Alera%20Group%2C%20Inc.%20-%20Consumer%20Notice.pdf"}],"summary":"Alera Group reported that personal information may have been removed following unauthorized access to its technology environment between July 19 and August 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68c8cbe99beba53a9b04593cf2a6ee3f26383fa1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECCBC87E-4B5C-E2FE-2830-8FD9F2A7BAF3"},"incident_date":"2025-07-29","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"afe5622292b5","org_name":"Air France/KLM","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/airlines-klm-air-france-detail-customer-data-breach-a-29143?rf=2025-08-08_ENEWS_SUB_GIS__Slot8_ART29143;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dailygalaxy.com/2025/08/this-airline-hit-by-cyberattack-your-names-emails-and-account-numbers-have-leaked-and-thats-not-all/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/air-france-klm-group-confirms-data-breach-from-a-third-party-customer-service-system/"}],"summary":"\"European airlines Air France and KLM are in the salvage phase of a data breach incident that has the hallmarks of the cybercrime group that calls itself ShinyHunters, which specializes in gaining access to Salesforce customers' data.\n\nThe airlines \"detected unusual activity on a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-07-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83ca5b4456a46cf69de21bff675b9a48519fd364","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3416A75F-4CEA-9109-507C-ACD8E2F2AEFC"},"incident_date":"2025-07-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a98e5590f7b6","org_name":"TransUnion","org_type":"other","ransomware":null,"records_affected":4400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607772"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TransUnion%20LLC-2025-09-02"}],"summary":"\"Credit reporting giant TransUnion has disclosed a data breach affecting more than 4.4 million customers’ personal information.\n\nIn a filing with Maine’s attorney general’s office on Thursday, TransUnion attributed the July 28 breach to unauthorized access of a third-party applic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-28","discovered_date":"2025-05-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7290caf1f903f6dc45e18e210de2e04bc45a0fa","impact_type":"unknown","incident_date":"2025-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cbb7d409681","org_name":"Alten Sakai & Co. LLP","org_type":"unknown","ransomware":null,"records_affected":2737,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alten%20Sakai%20%26%20Co.%20LLP-2025-07-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63ec84ba508689e42521dd1a0d39c506d71c72eb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valley%20Mountain%20Notificaition%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"fd6c2af821e1","org_name":"Valley Mountain Regional Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606042"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valley%20Mountain%20Notificaition%20Letter.pdf"}],"summary":"Valley Mountain Regional Center disclosed that its public vendor list included individual consumers’ names, addresses, phone numbers, and service descriptions.","supporting_quote":null,"technology_involved":["VMRC Website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c84a6dcbc21824b74aa202de52595351a4332c84","impact_type":"data_theft","incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Interpool%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0f0c7b78328b","org_name":"TRAC Intermodal","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606150"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Interpool%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"TRAC Intermodal reported that an unknown cyber actor accessed part of its computer network and copied files containing names and other unspecified information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-07-25","discovered_date":"2025-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eaadb4441d25696cd6f07a0137f38e5b066775f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Southern%20Tire%20Mart%20Data%20Breach%20Notification%20-%20California%2007.2025.pdf"},"notes":null,"org_country":"US","org_id":"54f5acf0d7ad","org_name":"Southern Tire Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Southern%20Tire%20Mart%20Data%20Breach%20Notification%20-%20California%2007.2025.pdf"}],"summary":"Southern Tire Mart reported unauthorized access to a limited portion of its internal network, where files containing sensitive information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-25","discovered_date":"2025-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"6bd1fb82d70ef740fd72b412d79d2eb33ac9d1cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34126.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1a3761df8ca1","org_name":"Northwest Denture Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":19419,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-25-northwest-denture-center-inc"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34126.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34126.pdf"}],"summary":"Northwest Denture Center reported unauthorized access to its systems on May 27, 2025, and identified files containing personal information, including names.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-25","discovered_date":"2025-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"4e1e2b69c9a62af78865159135337cd2514365f7","impact_type":"data_theft","incident_date":"2025-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_SampleIndividual%20Letter_1_Redacted.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f3404eaa4c93","org_name":"Cerner Corporation","org_type":"healthcare","ransomware":null,"records_affected":8329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cerner%20Corporation-2026-07-06"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005382"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606163"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_SampleIndividual%20Letter_1_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cerner%20Corporation-2025-07-25"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_SampleIndividual%20Letter_1_Redacted.pdf"}],"summary":"An unauthorized third party accessed and obtained personal health information maintained by a vendor on legacy Cerner systems.","supporting_quote":null,"technology_involved":["legacy Cerner systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-25","discovered_date":"2025-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fdfc0445c3d32061ef6b2303592766b1f0625df8","impact_type":"data_theft","imported_from":null,"incident_date":"2025-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34127.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f8819bbe36d4","org_name":"Baptist Health South Florida","org_type":"healthcare","ransomware":null,"records_affected":69238,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34127.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34127.pdf"}],"summary":"An unauthorized third party accessed and obtained personal health information maintained on legacy Cerner systems for Baptist Health South Florida.","supporting_quote":null,"technology_involved":["legacy Cerner systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cerner Corporation"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"f3404eaa4c93","name":"Cerner Corporation"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b81d6a1b4acb7d2d40c2f06ab943bbae627074f","impact_type":"data_theft","incident_date":"2025-07-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-24798%20Allianz%20Life%20Ins%20Adult%20CM%2024M%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"5ee6cf7d1843","org_name":"Allianz Life Insurance Company of North America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612078"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24798%20Allianz%20Life%20Ins%20Adult%20CM%2024M%20CA%20r2prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Allianz%20Life%20Insurance%20Company%20of%20North%20America-2025-07-25"}],"summary":"A malicious threat actor accessed a cloud-based system used by Allianz Life and obtained personal information related to customers, financial professionals, and select employees.","supporting_quote":null,"technology_involved":["cloud-based system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cc8d951d65ffad4718450ecb875ee82c8496d8de","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0ce70c608fd","org_name":"Nova Recovery Center, LLC d/b/a Nova Recovery Center","org_type":"healthcare","ransomware":null,"records_affected":6242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-24-nova-recovery-center-llc-d-b-a-nova-recovery-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"15cc81f1a5ca56bbfe23723a1037024352ccea62","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"921113a3a853","org_name":"McKenzie Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":58839,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-24-mckenzie-memorial-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-24","discovered_date":"2025-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a5e1298776563e750f82977d2c9114b58b3f74c7","impact_type":"data_theft","incident_date":"2025-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34103.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"621e42a9523a","org_name":"Franklin Pierce School District","org_type":"education","ransomware":null,"records_affected":1478,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34103.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34103.pdf"}],"summary":"Franklin Pierce School District reported unauthorized access to systems between June 7 and June 9, 2025, during which information was viewed or copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-23","discovered_date":"2025-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea4e6a392ad8996fd2b6b53838bd8f616a6bafd9","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Moreno%20ValleyUSD%20-adult%20notice%20-%20final%20mailing%20proof.pdf"},"notes":null,"org_country":"US","org_id":"5ed699ef3d49","org_name":"Moreno Valley Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Moreno%20ValleyUSD%20-adult%20notice%20-%20final%20mailing%20proof.pdf"}],"summary":"Moreno Valley Unified School District reported that an electronic folder containing personal information was accidentally made available to members of its organization.","supporting_quote":"On June 4, 2025, we learned that an electronic folder containing certain information was accidentally made available to members of our organization.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd653a140c888400fb5a32f26cc7970d880dce14","impact_type":"data_theft","imported_from":null,"incident_date":"2025-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"2b605d5f3213","org_name":"Creams Cafe","org_type":"retail_ecommerce","ransomware":null,"records_affected":159652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Creams Cafe","type":"hibp","url":"https://haveibeenpwned.com/Breach/CreamsCafe"}],"summary":"Customer records containing names, email and physical addresses, and phone numbers were reportedly obtained from Creams Cafe in May 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-07-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5c7890e967cba9bf47e011d58c2c1e6ca4db675","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC490CA4-5C00-B124-9BBE-3554A4FDF6FB"},"incident_date":"2025-07-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a3cf2de977f","org_name":"Cisco","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-22","discovered_date":"2025-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfb223896443483914615951d3aa0637045a3ffc","impact_type":"data_theft","incident_date":"2025-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prestige%20-%20Consumer%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"66ad6cbfed9f","org_name":"Prestige Maintenance USA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605911"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prestige%20-%20Consumer%20Notification%20Letter%20Template.pdf"}],"summary":"Prestige Maintenance USA reported unauthorized access to files that may have contained personal information, with no evidence of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77af0356f0dd82c5781bd3937e8cfae2e534db07","impact_type":"unknown","incident_date":"2023-12-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SSN.REV5%20%282%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98d4532e022a","org_name":"Pond North LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605901"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff96bf7d25a1258d3d570a7ab34dda106778231d","impact_type":"data_theft","incident_date":"2025-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PIIC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"28052d760312","org_name":"Philadelphia Indemnity Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605906"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PIIC%20-%20California%20Notification.pdf"}],"summary":"Philadelphia Indemnity Insurance Company reported that an unauthorized party acquired a file containing personal information during unauthorized network activity.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1904624cd50225ec1c3e4f6342d84873500914f8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"470243da08d1","org_name":"Gastroenterology Consultants of South Texas","org_type":"healthcare","ransomware":null,"records_affected":44579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-22-gastroenterology-consultants-of-south-texas"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"531633dbace6c13bc4451ac9d681d7f91228722e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d26d5f54778","org_name":"Kettering Adventist Healthcare","org_type":"healthcare","ransomware":null,"records_affected":1695382,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-21-kettering-adventist-healthcare"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cb599542a6e10228ea1e4f15f15f8221bba80491","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83c5b4d62e18","org_name":"Dr. Michael Bilikas and Associates d.b.a. 32 Pearls","org_type":"healthcare","ransomware":null,"records_affected":23517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-21-dr-michael-bilikas-and-associates-d-b-a-32-pearls"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-21","discovered_date":"2024-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0886a7d2584ebbe61ba33b1bb5b48a4693fada","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crestwood%20-%20Patient%20Letter_W4%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"3a5f1c26a889","org_name":"Boutin Jones","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-615030"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crestwood%20-%20Patient%20Letter_W4%20%281%29.pdf"}],"summary":"Boutin Jones reported that an unknown individual accessed its systems and that certain files were accessed and/or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d97ff43aeb4a3463e594407c6a3dc55503407e9e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0c95bae5291","org_name":"Equilibria Mental Health Services","org_type":"healthcare","ransomware":null,"records_affected":3232,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-20-equilibria-mental-health-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b997ab54ee71527f3b05c4eb03aca4747d63fc75","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9646f3856dbf","org_name":"Keys Pathology Associates, PA","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-19-keys-pathology-associates-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e9ddbc998f07b6ac73870dec23863fcc6156d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A87FF679-A2F3-E71D-9181-A67B7542122C"},"incident_date":"2025-07-19","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a8a0ffeae0e","org_name":"Dartmouth College","org_type":"education","ransomware":null,"records_affected":10471,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/dartmouth-college-confirms-data-breach-after-clop-extortion-attack/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a69e0001-a0f8-46d9-a49d-cb01159afec2.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nhpr.org/nh-news/2025-12-02/dartmouth-college-data-breach-exposes-personal-info"}],"summary":"\"Dartmouth College has disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from the school's Oracle E-Business Suite servers on its dark web leak site.\n\nIn a breach notification letter filed with the office of Maine's Attorney General, Dartmouth say","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-18","discovered_date":"2025-03-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b954f4f5c651a7b22d93052eceb0dff05d7d348","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34051.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"524ec848bb78","org_name":"Solix, Inc.","org_type":"unknown","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34051.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34051.pdf"}],"summary":"An unauthorized actor accessed the email accounts of several Solix employees, and information related to affected individuals could have been impacted.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d50e8dcd5fcb0ef4ac091b8053fdd35cee573e4","impact_type":"unknown","incident_date":"2025-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A_14_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"def7f13f0adf","org_name":"Skirball Cultural Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605680"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-18","discovered_date":"2025-07-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0ab384573e3ffd651ced053408a5a5334ed4e64","impact_type":"unknown","incident_date":"2025-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df0b0fe08480","org_name":"Oregon Specialty Group","org_type":"unknown","ransomware":null,"records_affected":3337,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Specialty%20Group-2025-07-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c195deb5562d05fd8c8e27a9a26cdbd0c5a1eddb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a01de6f4bac1","org_name":"Human Development Services of Westchester","org_type":"healthcare","ransomware":null,"records_affected":607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-18-human-development-services-of-westchester"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-18","discovered_date":"2025-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7e3cfe327e251f49a91323acda48b8db1d62e4f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20Template_0_0.pdf"},"notes":null,"org_country":"US","org_id":"90e4f1adabba","org_name":"Christian Dior Couture SAS","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605648"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20Template_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Christian%20Dior%20Couture%20SAS-2025-07-18"}],"summary":"Christian Dior Couture SAS reported that an unauthorized party accessed a Dior database containing clients’ personal information on January 26, 2025.","supporting_quote":null,"technology_involved":["Dior database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-18","discovered_date":"2025-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05649a2f10bbe33df447e75e05b94ed642bf1742","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-17","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025%2007%2014%20US%20Student%20Notification%20Preview%20-%20BYU-Idaho_0.pdf"},"notes":null,"org_country":"US","org_id":"93cf8fd7b401","org_name":"BYU-Pathway Worldwide","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor’s account was compromised by an unknown third party, allowing unauthorized access to certain systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605664"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025%2007%2014%20US%20Student%20Notification%20Preview%20-%20BYU-Idaho_0.pdf"}],"summary":"BYU-Pathway Worldwide reported that an unknown third party compromised a vendor’s account, enabling unauthorized access to certain systems and personal information.","supporting_quote":"Upon investigation, evidence indicated the vendor’s account was compromised by an unknown third party, which allowed unauthorized access to certain systems.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-17","discovered_date":"2024-11-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ff15e9b0389e753d1cef4856e7b2f37c8e71c5b","impact_type":"data_theft","incident_date":"2024-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Benefits%20Management%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7b6aaac58049","org_name":"Benefits Management Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605620"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Benefits%20Management%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Benefits%20Management%20Group%2C%20Inc.-2025-07-17"}],"summary":"Benefits Management Group, Inc. determined that an unauthorized actor copied files from its computer systems containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-16","discovered_date":"2025-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7521685e84bfb1f95bfb7c4ae3b7890b699d158c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34021.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"69ebc14ea4f2","org_name":"Teamsters Local Union No. 174","org_type":"nonprofit","ransomware":null,"records_affected":37828,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34021.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34021.pdf"}],"summary":"Teamsters Local Union No. 174 reported that an unauthorized third party accessed files stored on its server after the organization became aware of a cyber incident on June 16, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-16","discovered_date":"2024-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c74bebf30c0665f11d739d5dfb869d0b5e55a235","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Steadfast%20Companies%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e27f8f28c614","org_name":"Steadfast Companies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Steadfast%20Companies%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"}],"summary":"Steadfast Companies identified unauthorized access to archived files and folders between November 27 and December 11, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9f2042e0ac9810a064667674a59385d809c365","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45C48CCE-2E2D-7FBD-EA1A-FC51C7C6AD26"},"incident_date":"2025-07-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf0991007dcb","org_name":"Allianze UK","org_type":"financial","ransomware":null,"records_affected":1497036,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/11/10/allianz_uk_joins_growing_list/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2487e6eb-7f07-4b52-94cf-dc553d410fdb.html"}],"summary":"\"Allianz UK confirms it was one of the many companies that fell victim to the Clop gang's Oracle E-Business Suite (EBS) attack after crims reported that they had attacked a subsidiary.\n\nThe criminal crew behind the wave of zero-day data raids claimed to have attacked Allianz-owne","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-15","discovered_date":"2025-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2cac84aa009a8f08781e5e52f38f5ee750d70e98","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34000.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"37b05e236d34","org_name":"Teamsters Local Union No. 763","org_type":"nonprofit","ransomware":null,"records_affected":1713,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34000.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34000.pdf"}],"summary":"Teamsters Local Union No. 763 reported that an unauthorized third party accessed files stored on its server after a cyber incident disrupted certain computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-15","discovered_date":"2025-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fda5d8116b16a41a32b1bc74976f189ebfe7ec61","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33999.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cca618a3de53","org_name":"Teamsters Local Union No. 117","org_type":"nonprofit","ransomware":null,"records_affected":86122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33999.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33999.pdf"}],"summary":"Teamsters Local Union No. 117 reported that an unauthorized third party accessed files stored on its server during a cyber incident that disrupted certain computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61befbc024acb36136768eb38ccdd79a5287ca30","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Synergy%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5f039f6ebe8","org_name":"Synergy Radiation Oncology Medical Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605515"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aee1a9dee3516532ddabaf987ff06d91b893bf84","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RONSC%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe2bbe5cb017","org_name":"Radiation Oncology Network of Southern California, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605514"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7db6b2cb62f5f62427ba1f5504c4828ca0cb9eb2","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Orange%20County%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ccd0fd6d71ba","org_name":"Orange County Radiation Oncology Medical Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605500"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e01c79198f8eb597e8d7840ac7667e18e582351","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Mojave%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5f34f5c4db8","org_name":"Mojave Radiation Oncology Medical Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605498"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48538e039f700e2634723b10589d727b1fd06b3f","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Memorial%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2173b341e098","org_name":"Memorial Radiation Oncology Medical Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605497"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45b991a7ee324d57d7646eab35fb00477cb3c6d6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d49600d69d78","org_name":"MaReads","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MaReads","type":"hibp","url":"https://haveibeenpwned.com/Breach/MaReads"}],"summary":"MaReads suffered a data breach in June 2025 that exposed usernames, email addresses, phone numbers, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c2a846b38255273f5036ad374361e071d39ab9f","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Golden%20State%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55d11544a46b","org_name":"Golden State Radiation Oncology","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605493"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62a4f7430c50a5cd5547cc4bd1a1ef4fc1093122","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCARE%20-%20San%20Diego%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06b89fff7b35","org_name":"California Cancer Associates for Research and Excellence - San Diego","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605490"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b85a3b99d8430089071d376dfc1fd01938463ab8","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCARE%20-%20High%20Desert%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9aa8096fb284","org_name":"California Cancer Associates for Research and Excellence - High Desert","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605489"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"f3372ee7e904334ecc58b178dc4bb3e87ed85614","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34003.pdf"},"notes":null,"org_country":"US","org_id":"013f686af968","org_name":"American Consumer Credit Counseling","org_type":"financial","ransomware":null,"records_affected":1579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Consumer%20Credit%20Counseling%2C%20Inc.%20%28%E2%80%9CACCC%E2%80%9D%29-2025-07-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34003.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACCC_CA%20App%20%26%20Sample_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34003.pdf"}],"summary":"American Consumer Credit Counseling reported a security incident involving files containing personal and financial information of 1,579 Washington residents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02dca287eae74642fdc43993afbd04a623275ebc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0C7C76D-30BD-3DCA-EFC9-6F40275BDC0A"},"incident_date":"2025-07-14","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c69bcb0a64bc","org_name":"Walgreens","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"958389112f313712d55691ba289cf0329da2393d","impact_type":"unknown","incident_date":"2024-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Vero%20Foods%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4981476ba68d","org_name":"Vero Foods","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605407"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8240f05d80792fb14a65fcb0c287a89c69b0851","impact_type":"unknown","incident_date":"2024-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification%20-%20Next%20Level%20Finance.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"49cad06f8aa9","org_name":"Next Level Finance Partners, LLC d/b/a Century Support Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605455"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Next%20Level%20-%20Consumer%20Letter%206-27-25.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1419f46b2eac448d6e234365de2981b27e82276b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc2964bc26f9","org_name":"Clinica Family Health Services","org_type":"healthcare","ransomware":null,"records_affected":47593,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-14-clinica-family-health-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-14","discovered_date":"2025-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82726a346e3e85457868832c27d9270126538d1f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-17","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1199","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33991.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"da85ef91bd28","org_name":"BYU-Pathway","org_type":"education","ransomware":null,"records_affected":826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33991.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33991.pdf"}],"summary":"BYU-Pathway reported unauthorized access to certain systems through a compromised vendor account, potentially exposing personal information.","supporting_quote":"Upon investigation, evidence indicated the vendor’s account was compromised by an unknown third party, which allowed unauthorized access to certain systems.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"326e1ba66b21da099af4279f40416847c676e02e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b941f82b7748","org_name":"Williamsburg Area Medical Assistance Corporation d/b/a Olde Towne Medical and Dental Center (OTMDC)","org_type":"healthcare","ransomware":null,"records_affected":2567,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-13-williamsburg-area-medical-assistance-corporation-d-b-a-olde-towne-medical-and-de"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42ed999d59698bb57a6b6ad2352e08c568c5a68c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"3581136c706b","org_name":"Omnicuris","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Omnicuris","type":"hibp","url":"https://haveibeenpwned.com/Breach/Omnicuris"}],"summary":"Omnicuris had a data breach that exposed records containing healthcare professionals’ personal and professional information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c65a5895ff95ac098b25b012f6778077f796b649","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c12b02db05c8","org_name":"Picis Clinical Solutions, Inc. d/b/a Medstreaming","org_type":"professional_services","ransomware":null,"records_affected":8840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-11-picis-clinical-solutions-inc-d-b-a-medstreaming"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-11","discovered_date":"2025-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"94a9e3ae1a8afd0a581391b7f2df462828b8b3ef","impact_type":"data_theft","incident_date":"2025-03-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33974.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1f7f11152eac","org_name":"Ocuco","org_type":"unknown","ransomware":null,"records_affected":9839,"reviewed":false,"root_cause":"A vulnerability in third-party software Ocuco used enabled unauthorized access and was not timely disclosed to Ocuco.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33974.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ocuco-2025-07-28"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33974.pdf"}],"summary":"Ocuco reported that an actor accessed two non-production servers through a vulnerability in third-party software and copied some files containing personal information.","supporting_quote":"Ocuco’s investigation determined this unauthorized access was enabled by a newly discovered vulnerability contained within third-party software Ocuco uses that was not timely disclosed to Ocuco.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-07-11","discovered_date":"2025-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f12fdf6e2a9b04b23e90ac0debcf314be114bb10","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Exhibit%20A.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"9a5ad2916b82","org_name":"New American Funding, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Exhibit%20A.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33970.pdf"}],"summary":"An unauthorized actor accessed systems containing New American Funding consumer data held by its notary services vendor, and documents may have been taken.","supporting_quote":"MNZ has given us very little information about the incident, but we understand that an unauthorized actor gained access to systems containing New American Funding consumer data and may have taken documents.","technology_involved":["MNZ systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MNZ"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"b0b76d165732","name":"MNZ"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-11","discovered_date":"2025-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"200177de68175b1ad23ade0a20108dc964313b25","impact_type":"data_theft","incident_date":"2025-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Supplemental%20Consumer%20Letter%2012.4.25.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2c32a0b83d45","org_name":"HopeHealth, Inc.","org_type":"healthcare","ransomware":null,"records_affected":5716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Supplemental%20Consumer%20Letter%2012.4.25.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Supplemental%20Consumer%20Letter%2012.4.25.pdf"}],"summary":"HopeHealth reported that an unauthorized individual may have viewed and copied personal information during activity between March 19 and March 20, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99c7462279a9b93b0547c8ecd47f858695f66fb1","impact_type":"unknown","incident_date":"2024-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LETTER_A-_ADULT_SSN_12-24_Rev1_-_REDACTED_36493391v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2feb96e81ab6","org_name":"Dordt University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605274"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33975.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"08f03750f9102bcd5ee00db8ebcbce8644482787","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a61937fe0c3","org_name":"Covenant Health","org_type":"professional_services","ransomware":null,"records_affected":7864,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-11-covenant-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"e74a9eaf769c62879d535f1cc03caa787dfc54c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAD_IDX%20Notification%20Letter%20-%20Final.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bb197a89414e","org_name":"Anne Arundel Dermatology","org_type":"healthcare","ransomware":null,"records_affected":1905000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-11-anne-arundel-dermatology"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605254"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAD_IDX%20Notification%20Letter%20-%20Final.pdf"}],"summary":"Anne Arundel Dermatology reported that an unauthorized third party could access files containing personal or health information from February 14 to May 13, 2025, with no confirmed viewing or exfiltration.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc6237d3b74bfc9d838b33dc9dffa756a6bbe41a","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33959.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d0e439a4cfb8","org_name":"Northwest Radiologists","org_type":"healthcare","ransomware":null,"records_affected":348118,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33959.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33959.pdf"}],"summary":"Northwest Radiologists reported unauthorized access to information stored on its network from January 20 to January 25, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"interlock","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0274fa9e66e9e95e0968c0602ddf42d74fe35f27","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91858bf9bf61","org_name":"Naper Grove Vision Care","org_type":"healthcare","ransomware":true,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-10-naper-grove-vision-care"},{"fetched_at":null,"title":"Leak-site claim by interlock","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TmFwZXIgR3JvdmUgVmlzaW9uIENhcmVAaW50ZXJsb2Nr"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"interlock","claim_groups":["interlock"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"69fcae6b746f4bc6fd57c9063cace05a87ce4262","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c84493fe5b10","org_name":"Mountain Laurel Dermatology","org_type":"healthcare","ransomware":null,"records_affected":3324,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-10-mountain-laurel-dermatology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1953a5b2a1b8040dde1fdce915d166de946de82","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-29","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.05.30%20London%20Data%20Breach%20Notification%20%28FINAL%29_0.pdf"},"notes":null,"org_country":"US","org_id":"c73e1b1a9acc","org_name":"London Properties, LTD.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.05.30%20London%20Data%20Breach%20Notification%20%28FINAL%29_0.pdf"}],"summary":"London Properties reported that an unauthorized third party accessed an accounting server containing files that may have included personal and financial information.","supporting_quote":null,"technology_involved":["accounting server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-07-10","discovered_date":"2025-10-09","entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecc87c04afc920141906224a594534b14faae387","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9F0F895-FB98-AB91-59F5-1FD0297E236D"},"incident_date":"2025-07-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"935859a879d9","org_name":"GlobalLogic","org_type":"technology_saas","ransomware":null,"records_affected":10471,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/11/11/hitachiowned_globallogic_admits_data_stolen/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a69e0001-a0f8-46d9-a49d-cb01159afec2.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.comparitech.com/news/globallogic-notifies-10000-people-of-data-breach-that-leaked-ssns-financial-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/globallogic-warns-10-000-employees-of-data-theft-after-oracle-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-614005"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004658"}],"summary":"\"Digital engineering outfit GlobalLogic says personal data from more than 10,000 current and former employees was exposed in the wave of Oracle E-Business Suite (EBS) attacks attributed to the Clop ransomware gang. The Hitachi-owned biz joins a growing roster of high-profile vict","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cdaa6a0552e6d2a6d348a7523b2f5afa275af2a","impact_type":"unknown","incident_date":"2025-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Regional%20Center%20of%20the%20East%20Bay%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c01a3809a00a","org_name":"Regional Center of the East Bay","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605205"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-09","discovered_date":"2025-02-25","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864eb1e43c16075fa88b0a4a237615af74bb56c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-24339%20Genex%20Ad%20CM%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"acfc383c15a5","org_name":"Genex Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack compromised the laptops of two employees.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605206"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24339%20Genex%20Ad%20CM%20r1prf.pdf"}],"summary":"A phishing attack compromised two Genex employees’ laptops and gave an unauthorized actor access to files containing personal information.","supporting_quote":"Our investigation determined that Genex was the victim of a phishing attack that compromised the laptops of two employees.","technology_involved":["employee laptops"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"27d4cd99dd39b993be5701855a16bb5488773017","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"273ad6bfe604","org_name":"Florida Lung, Asthma & Sleep Specialists (FLASS)","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-09-florida-lung-asthma-sleep-specialists-flass"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-09","discovered_date":"2025-06-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee595034f6c70011f90451851a504c82032248fb","impact_type":"unknown","incident_date":"2025-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f45b4d172b41","org_name":"David Beck Financial Services LLC","org_type":"unknown","ransomware":null,"records_affected":38,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#David%20Beck%20Financial%20Services%20LLC-2025-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-07-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0fd7e477cd277207e94fc17a75c8a5c4fcbd60c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14BFA6BB-1487-5E45-BBA0-28A21ED38046"},"incident_date":"2025-07-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"9370a74f5c86","org_name":"Louis Vuitton","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techradar.com/pro/security/louis-vuitton-says-customer-data-was-leaked-following-cyberattack"}],"summary":"\"\"Cybercriminals broke into the Korean subsidiary of luxury brand Louis Vuitton and stole sensitive files, the company has confirmed.\n\n\"We regret to inform that an unauthorized third party temporarily accessed our system resulting in the leak of some customer information,\" the co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-07-07","discovered_date":"2025-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2751d1d82cb147a823bce1d4fe34646c93110ab0","impact_type":"data_theft","incident_date":"2025-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19692.pdf"},"notes":null,"org_country":"US","org_id":"47424ad005bf","org_name":"EventConnect","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19692.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19692.pdf"}],"summary":"An unauthorized party accessed EventConnect’s platform and acquired some data relating to hotel reservation lists, including contact information and potentially payment card details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-07","discovered_date":"2024-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"280bd4c87c3fc32e204d1a83c535ffe0716335f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33868.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"595c6989450f","org_name":"Cierant Corporation","org_type":"professional_services","ransomware":null,"records_affected":902,"reviewed":false,"root_cause":"An unauthorized actor exploited a vulnerability in the third-party Cleo VLTrader tool to access Cierant systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33868.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33868.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in the third-party Cleo VLTrader tool to access Cierant systems and potentially compromise files containing personal and medical information.","supporting_quote":"The investigation determined that an unauthorized actor exploited the third-party Cleo VLTrader vulnerability to gain limited access to Cierant systems that may have compromised certain files.","technology_involved":["Cleo VLTrader"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Cleo"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"bcec34a18960","name":"Cleo"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-07","discovered_date":"2024-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"957aa5d341b1d1a7f411e79e83b62f24b45121b5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33858.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"595c6989450f","org_name":"Cierant Corporation","org_type":"professional_services","ransomware":null,"records_affected":530,"reviewed":false,"root_cause":"An unauthorized actor exploited a vulnerability in the Cleo VLTrader secure file transfer tool.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33858.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33858.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in Cleo VLTrader to access Cierant systems and may have acquired files containing personal information.","supporting_quote":"The investigation determined that an unauth orized actor exploited the vulnerability in Cleo VLTrader to gain lim ited access to Cierant systems, possibly acquiring certain files.","technology_involved":["Cleo VLTrader","secure file transfer tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Cleo VLTrader"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"bcec34a18960","name":"Cleo"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"387409dbb62e8c3ca3f206cb1837b01003c72e1e","impact_type":"data_theft","incident_date":"2024-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bitcoin%20Depot%20Sample%20Notice%20with%20ID.pdf"},"notes":null,"org_country":"US","org_id":"660146c430bf","org_name":"Bitcoin Depot, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605105"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bitcoin%20Depot%20Sample%20Notice%20with%20ID.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33873.pdf"}],"summary":"Bitcoin Depot reported that an unauthorized individual obtained documents containing customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"05f6824a9f1f93c0859a39621b65f64a0a934fab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dc19f6411df7","org_name":"Zumpano Patricios, P.A.","org_type":"professional_services","ransomware":null,"records_affected":279275,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-03-zumpano-patricios-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c8e75434625ec24cd4c7351b43fa5c69a8c4ccd0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c19be045e07","org_name":"Urology Associates of Charleston","org_type":"healthcare","ransomware":null,"records_affected":2060,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-03-urology-associates-of-charleston"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-03","discovered_date":"2025-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd635de37ee49c12de24de182bd48e68978b7c9c","impact_type":"data_theft","incident_date":"2024-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HEXPOL%20-%20Adult%20SSN%20Proof%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"8712907a0d0a","org_name":"HEXPOL Holding Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HEXPOL%20-%20Adult%20SSN%20Proof%20%28Redacted%29.pdf"}],"summary":"HEXPOL detected unauthorized network access and found that copies of certain files may have been taken, including files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c2dafe4a481c673551f60a0317ee5bfb56088c5","impact_type":"unknown","incident_date":"2024-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Finastra%20Individual%20Notice%20Template.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c553de62ee4","org_name":"Finastra Technology, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604911"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Finastra%20Technology%2C%20Inc.-2025-07-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"acde0237c15caa105996c906518426a1a6a2a501","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%207.3.2025.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e07b37d181c1","org_name":"Finastra","org_type":"unknown","ransomware":null,"records_affected":1424,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%207.3.2025.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a308ea277ccd58e423bdf3c57aeac619b551069e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19ba69552d63","org_name":"City of Franklin","org_type":"healthcare","ransomware":null,"records_affected":3233,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-03-city-of-franklin"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-03","discovered_date":"2024-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"40e64815c550ffc7f138e69d26ea04487e0cb6ca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letters%20-%20Horizon%20-%202025.07.03.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"595c6989450f","org_name":"Cierant Corporation","org_type":"professional_services","ransomware":null,"records_affected":232506,"reviewed":false,"root_cause":"An unauthorized actor exploited a vulnerability in the third-party Cleo VLTrader tool to gain access to Cierant systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-03-cierant-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605101"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letters%20-%20Horizon%20-%202025.07.03.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in the third-party Cleo VLTrader tool to gain limited access to Cierant systems and potentially compromised files containing personal and medical information.","supporting_quote":"The investig ation determined that an unauthorized actor exploited the third-party Cleo VLTrader vulnerability to gain limited access to Cierant systems that may have compromised certain files.","technology_involved":["Cleo VLTrader"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Cleo"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bcec34a18960","name":"Cleo"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-07-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efa8cd7812dd7800c98f58dc1b6168b0a105d346","impact_type":"data_theft","imported_from":null,"incident_date":"2025-06-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"162bb6e5c82b","org_name":"Catwatchful","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A SQL injection vulnerability enabled email addresses and plain text passwords to be extracted from the system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Catwatchful","type":"hibp","url":"https://haveibeenpwned.com/Breach/Catwatchful"}],"summary":"Catwatchful suffered a data breach in June 2025 in which a SQL injection vulnerability enabled email addresses and plain text passwords to be extracted.","supporting_quote":"The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-03","discovered_date":"2025-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8903d06bf64e0c166deaeb2a07131c70d07f9cc","impact_type":"data_theft","incident_date":"2025-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMW%20FS%20-%20AIS%20Template%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"32d2a62ee933","org_name":"BMW Financial Services NA, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604910"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMW%20FS%20-%20AIS%20Template%20Consumer%20Notice.pdf"}],"summary":"BMW Financial Services NA, LLC reported that an unauthorized actor accessed its environment and took a limited subset of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-03","discovered_date":"2025-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"5ef148b72a7fb58d760d42126b3807f3bac7f41b","impact_type":"data_theft","imported_from":null,"incident_date":"2025-04-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arbor%20Associates%20Inc.%20-%20CA%20Attachment_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b5a569ff777f","org_name":"Arbor Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":17040,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-03-arbor-associates-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604990"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606902"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arbor%20Associates%20Inc.%20-%20CA%20Attachment_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33819.pdf"}],"summary":"Arbor Associates determined that files containing personal and medical information may have been acquired without authorization between April 15 and April 17, 2025.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"b138b3cb0ced7c846ff32e7698d568adf3a89abe","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33806.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9240a50cbd7f","org_name":"Integrated Specialty Coverages, LLC","org_type":"financial","ransomware":null,"records_affected":822,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integrated%20Specialty%20Coverages%2C%20LLC%20%28%22ISC%22%29-2025-07-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33806.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_3.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33806.pdf"}],"summary":"An unauthorized third party accessed part of Integrated Specialty Coverages' environment, and the company identified files containing personal information, including basic medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4485dc1fa6ee671d5069fe6908cc88a8f50583d5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/USBFS1206-RAR-Letter-A-CM_v2%2836403413.1%29_Redacted%2836438500.1%29_Redacted_36438519v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5df9ab348081","org_name":"Radiology Associates of Richmond, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1419091,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-01-radiology-associates-of-richmond-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604837"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33795.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-07-01","discovered_date":"2024-10-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b466bc3246da43450c6179ab85ff781be386e7eb","impact_type":"data_theft","incident_date":"2024-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_13.pdf"},"notes":null,"org_country":"US","org_id":"472c9bf22dd9","org_name":"Idealab","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_13.pdf"}],"summary":"An unknown actor acquired certain Idealab data without authorization on or about October 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b98a067c6203f7e914d58cefb364668a9202228","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e459ed910a18","org_name":"Heart of America Medical Center (“HAMC”)","org_type":"healthcare","ransomware":null,"records_affected":29430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-07-01-heart-of-america-medical-center-hamc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-30","discovered_date":"2025-01-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1534fcea8dcb753b0838483c59da1575eef15463","impact_type":"data_theft","incident_date":"2024-10-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33767.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3193071b827b","org_name":"Western Alliance Bank","org_type":"financial","ransomware":null,"records_affected":539,"reviewed":false,"root_cause":"An unknown vulnerability in a third-party vendor’s secure file transfer software was exploited to access Western Alliance’s systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Western%20Alliance%20Bank%20%28%22WAB%22%29-2025-06-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33767.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33767.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in third-party secure file transfer software to access Western Alliance systems and acquire files containing personal information.","supporting_quote":"In October 2024, an unauthorized actor began exploiting this unknown vulnerability in the third-party software that allowed the unauthorized actor to gain access to a limited portion of Western Alliance’s systems and to obtain copies of files from those systems.","technology_involved":["secure file transfer software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"91a8e8dcecac01010232a565391cc26a8b523785","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98ab91096b25","org_name":"Texas Center for Infectious Disease Associates","org_type":"healthcare","ransomware":null,"records_affected":19481,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-30-texas-center-for-infectious-disease-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28ec47842eb6bca8e1e22d5fbbd079dcd6a63ab8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C8349CC-7260-AE62-E3B1-396831A8398F"},"incident_date":"2025-06-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60779bd4749b","org_name":"Republic Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7807a4fac437b0b382dc42628d410c5a07a35f0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3F390D8-8E4C-41F2-747B-FA2F1B5F87DB"},"incident_date":"2025-06-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"df1fd0a959d8","org_name":"Pandora","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c35ce4a521e80d054339272560cf1bcb6191774","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A115815-4DFA-42CA-DDBD-0694A4E9BDC8"},"incident_date":"2025-06-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"384e42205d4b","org_name":"KFC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-30","discovered_date":"2023-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02c8fc1ced563b1f3d382d84e76a2786c192b2f0","impact_type":"both","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Johnson%20Controls%20-%20U.S.%20Reg.%20Notice%20Form%20Attachment%2C%20California%20%28Final%29_0.pdf"},"notes":null,"org_country":"US","org_id":"c7ebdedad7fd","org_name":"Johnson Controls","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Johnson%20Controls%20-%20U.S.%20Reg.%20Notice%20Form%20Attachment%2C%20California%20%28Final%29_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19691.pdf"}],"summary":"Johnson Controls reported unauthorized access to its systems and theft of information, along with disruption to its IT infrastructure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ff22d3e6d8bbc129555dd268f9a52606e5d5e64","impact_type":"unknown","incident_date":"2024-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CVWD%20--%20Ex.%20A_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"32086a8e929e","org_name":"Cucamonga Valley Water District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604778"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"164b0070b39485cfe693ee81e4074a0bc2d57b4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a00bcbde2df6","org_name":"Clinical Practices of the University of Pennsylvania","org_type":"healthcare","ransomware":null,"records_affected":1432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-30-clinical-practices-of-the-university-of-pennsylvania"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"03fadf14f8146bb30fd24bd35ef0fcd53bd4de40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f8c03cbd387","org_name":"Centers for Medicare & Medicaid Services","org_type":"healthcare","ransomware":null,"records_affected":107154,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-30-centers-for-medicare-medicaid-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-30","discovered_date":"2025-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9e00d7ebc135654ceb8af39738c48b6faa8b3bb","impact_type":"data_theft","incident_date":"2025-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AIS%20InfoSource%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"fe80a8f30570","org_name":"AIS InfoSource","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607958"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604752"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605868"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AIS%20InfoSource%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"AIS InfoSource reported that an unauthorized actor accessed its environment and took a limited subset of data, including information related to the recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d29584193e66be8c7bfd9c42bcd2bb626cfd0ae","impact_type":"data_theft","incident_date":"2025-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Whittaker%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f48e131745f7","org_name":"Whittaker & Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604594"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Whittaker%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor accessed Whittaker & Company’s network and obtained copies of certain documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-27","discovered_date":"2025-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e783bf38186bb5626a8b2a3b29cd74978e1bf456","impact_type":"both","incident_date":"2025-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Southwood-ConsumerLetter.pdf"},"notes":null,"org_country":"US","org_id":"10095808b9d1","org_name":"Southwood Financial LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604695"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Southwood-ConsumerLetter.pdf"}],"summary":"Southwood Financial LLC reported a temporary network disruption and possible unauthorized access to files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6e05e6562fb5eae01431996569a1dd1b8adf6dd8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"998869cf0583","org_name":"PDCM Insurance","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-27-pdcm-insurance"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef31cc8c828cc552fe984f8c24b7e9097f23fccd","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33736.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6150e6daed35","org_name":"Medicare CompareUSA","org_type":"healthcare","ransomware":null,"records_affected":1258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33736.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33736.pdf"}],"summary":"Medicare CompareUSA reported unauthorized access to certain email accounts between November 5 and November 21, 2024, involving files containing personal and health-related information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"106fa5e86be5d4cd40225d0b9ce8d08a3ccdac45","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2838023A-778D-FAEC-DC21-2708F721B788"},"incident_date":"2025-06-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"327a0ceaecb6","org_name":"McDonalds","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-27","discovered_date":"2024-12-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"4faf508ba9d40ebe0d9fbd2b36ec321eb3e2caae","impact_type":"both","incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Notification%20Letter%20to%20Consumer%20Supplemental.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d6b14d5b818a","org_name":"Horizon Healthcare RCM","org_type":"professional_services","ransomware":null,"records_affected":9672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Notification%20Letter%20to%20Consumer%20Supplemental.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Notification%20Letter%20to%20Consumer%20Supplemental.pdf"}],"summary":"Horizon Healthcare RCM reported that a computer virus locked access to some files and that files on certain systems were likely copied without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f1f47fb5298e1254b23c4dc433e50acc4f60f9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3295C76A-CBF4-CAAE-D33C-36B1B5FC2CB1"},"incident_date":"2025-06-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"cc1ee750cb9c","org_name":"Chanel","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cyberinsider.com/chanel-suffers-data-breach-after-attack-on-salesforce-systems/"}],"summary":"\"Luxury fashion brand Chanel has suffered a data breach linked to a broader cyberattack campaign targeting customers of Salesforce, a popular cloud-based customer relationship management (CRM) platform.\n\nChanel says it first detected the breach on July 25th, after attackers acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d7c7690025fba5d87c778b1d54ee533b15bd339","impact_type":"unknown","incident_date":"2024-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCARE%20Fresno%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40a9f8d196a3","org_name":"California Cancer Associates for Research and Excellence - Fresno","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604689"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-27","discovered_date":"2025-06-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2402992c4eae9d6e0667c74c18bb5a62eb579f31","impact_type":"unknown","incident_date":"2025-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"50a4bef4866f","org_name":"Alaska Air Group","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/766421/000076642125000023/alk-20250627.htm"},{"fetched_at":null,"title":"8-K SECOND QUARTER 2025 EARNINGS RELEASE","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/766421/000076642125000026/ex9917232025earningsrelease.htm"}],"summary":"Alaska Air Group reported that its subsidiary Hawaiian Airlines identified a cybersecurity incident affecting certain information technology systems on June 23, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"ALK","base_day":"2025-06-27","returns":{"1":{"day":"2025-06-30","raw":0.0022,"adj":-0.0026},"5":{"day":"2025-07-07","raw":0.0243,"adj":0.0149},"21":{"day":"2025-07-29","raw":0.0968,"adj":0.0637},"63":{"day":"2025-09-26","raw":0.0306,"adj":-0.0457},"126":{"day":"2025-12-26","raw":0.0429,"adj":-0.0797},"250":{"day":"2026-06-26","raw":0.0909,"adj":-0.0946}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-26","discovered_date":"2025-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bb7b22c206bcd425c0ec0acd0f37e894a9798ff9","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"90b7a1894eb0","org_name":"United Natural Foods","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1020859/000102085925000036/unfi-20250621.htm"}],"summary":"United Natural Foods reported unauthorized activity on certain IT systems that temporarily disrupted its ability to fulfill and distribute customer orders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"price":{"ticker":"UNFI","base_day":"2025-06-26","returns":{"1":{"day":"2025-06-27","raw":0.0601,"adj":0.0551},"5":{"day":"2025-07-03","raw":0.0829,"adj":0.0609},"21":{"day":"2025-07-28","raw":0.3236,"adj":0.2826},"63":{"day":"2025-09-25","raw":0.4055,"adj":0.33},"126":{"day":"2025-12-24","raw":0.5736,"adj":0.4452},"250":{"day":"2026-06-25","raw":1.3417,"adj":1.1416}}}}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58794d27d128f2ff66ff0972440cff4b40b03932","impact_type":"data_theft","incident_date":"2024-12-12","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRS%20-%20Individual%20Notification%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"5901cae3a7b8","org_name":"Prime Retirement Solutions, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604567"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRS%20-%20Individual%20Notification%20Templates.pdf"}],"summary":"An unauthorized third party accessed and removed personal information from a PRS employee’s Office 365 account.","supporting_quote":null,"technology_involved":["Office 365"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal"],"disclosed_date":"2025-06-26","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b51c89f30a44d7fe46926b2f659c0f4b2d7227d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33713.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a14ac72581f0","org_name":"Mead School District","org_type":"education","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":"The FinalForms account was accessed with credentials previously compromised in unrelated data breaches.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33713.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33713.pdf"}],"summary":"An unauthorized party accessed a Mead School District coaches account on FinalForms using credentials previously compromised in unrelated data breaches, exposing student personal information.","supporting_quote":"Instead, the unauthorized party gained access using legitimate login credentials (email and password combinations) that were previously compromised in unrelated, external data breaches (such as Chegg or Yahoo).","technology_involved":["FinalForms"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FinalForms"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"fd18ef26f2e3","name":"FinalForms"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-26","discovered_date":"2024-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ddb59bb0746a966b017e89c6742cdf98d63534f","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EmCentrix%20-%20Consumer%20Notification%20Letter%20-%20ADULT_v02.pdf"},"notes":null,"org_country":"US","org_id":"401bd36ad9d3","org_name":"EmCentrix","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604542"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EmCentrix%20-%20Consumer%20Notification%20Letter%20-%20ADULT_v02.pdf"}],"summary":"EmCentrix reported that files were accessed or acquired without authorization and that some affected files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-06-26","discovered_date":"2025-04-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c3b70233eadae76bb1832a3bce8970f97d63f33","impact_type":"data_theft","incident_date":"2025-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Calton_0.pdf"},"notes":null,"org_country":"US","org_id":"1aa376f6e134","org_name":"Calton & Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604549"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Calton_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33726.pdf"}],"summary":"Unauthorized individuals accessed Calton & Associates' network and took files containing some customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d64354b140b51c83363f47d934eafc054d710738","impact_type":"unknown","incident_date":"2024-12-02","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bridges%20-%20Adult%20SSN_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"5c6a662cfbd4","org_name":"Bridges Experience, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604527"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bridges%20-%20Adult%20SSN_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bridges%20Experience%2C%20Inc.-2025-06-26"}],"summary":"Bridges Experience reported that an unauthorized party accessed a limited number of employee email accounts between December 2, 2024, and January 22, 2025.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"03cae79cbfa4980b86cb3aa3b0d6fc9198d1fb4f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a12a0df4a365","org_name":"Amalgamated Meat Cutters and Retail Food Store Employees Union Local 342 Health Care Fund","org_type":"healthcare","ransomware":null,"records_affected":56615,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-26-amalgamated-meat-cutters-and-retail-food-store-employees-union-local-342-health-"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","internal"],"disclosed_date":"2025-06-26","discovered_date":"2024-11-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42bfade9e091a5d1fcdab33b8e9bafb5609e1d4b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_Individual_Notification.pdf"},"notes":null,"org_country":"US","org_id":"7bd8f313b90e","org_name":"Ahold Delhaize USA Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_Individual_Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ahold%20Delhaize%20USA%20Services%2C%20LLC-2025-06-26"}],"summary":"An unauthorized third party obtained files from an internal U.S. file repository containing personal information, including employment, financial, and health information.","supporting_quote":null,"technology_involved":["file repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-06-25","discovered_date":"2025-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa4ad25dcea7178b3df39c302f967edc59fc4306","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Think%20Tax%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d67cef00b724","org_name":"Think Tax Solutions Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Think%20Tax%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized individual accessed a third-party tax-filing software platform and downloaded information related to Think Tax Solutions Inc. clients.","supporting_quote":null,"technology_involved":["third-party tax-filing software platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"312639565c4bbde34d5f9c3a547d079cc9a98bd1","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33701.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad61610dad23","org_name":"The Yakima Herald-Republic & The Walla Walla Union-Bulletin","org_type":"unknown","ransomware":null,"records_affected":659,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33701.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdcaffabf99f7df371182f5297012f591a238bcd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"PH","org_id":"9718a98b8119","org_name":"Robinsons Malls","org_type":"retail_ecommerce","ransomware":null,"records_affected":195597,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Robinsons Malls","type":"hibp","url":"https://haveibeenpwned.com/Breach/RobinsonsMalls"}],"summary":"A data breach stemming from Robinsons Malls' mobile app exposed personal information associated with 195,597 unique email addresses.","supporting_quote":null,"technology_involved":["mobile app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2025-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1947ced85f8a36ff62f4d614dd53e6abfd429e30","impact_type":"data_theft","imported_from":null,"incident_date":"2021-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_id":"e6319d8b2dfa","org_name":"Have Fun Teaching","org_type":"education","ransomware":null,"records_affected":27126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Have Fun Teaching","type":"hibp","url":"https://haveibeenpwned.com/Breach/HaveFunTeaching"}],"summary":"Have Fun Teaching experienced a breach involving WooCommerce transactions that were later posted to a hacking forum.","supporting_quote":null,"technology_involved":["WooCommerce"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6924140c8b7e619bf232880dc15c5b14734601c7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"568f5e46c4ec","org_name":"Clement Manor","org_type":"healthcare","ransomware":null,"records_affected":16046,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-25-clement-manor"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3ee30f4e2c71918f622445182e11de46b863e789","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a5f7f91940a","org_name":"Minneapolis VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1099,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-24-minneapolis-va-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2b22521bd987efc50e7d0558ff4e2d1199f6095e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2472bf464e2a","org_name":"McLaren Health Care","org_type":"healthcare","ransomware":null,"records_affected":743131,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-24-mclaren-health-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-24","discovered_date":"2025-04-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"988dee50bf60689c0f8873f05744cf3a95d6767d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FTB%20Notice%20of%20Data%20Breach%20-%20Order%20to%20Withhold%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"167f0b2a69c9","org_name":"Franchise Tax Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A programming issue caused an Order to Withhold Notice to be sent in error to a third-party payor.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604418"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605594"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FTB%20Notice%20of%20Data%20Breach%20-%20Order%20to%20Withhold%20Notice.pdf"}],"summary":"The Franchise Tax Board discovered that an Order to Withhold Notice containing personal information was sent in error to a third-party payor.","supporting_quote":"On April 25, 2025, we discovered that due to a programming issue, an Order to Withhold Notice was sent in error to a third-party payor.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa678d689676da4f551faaaa89733b335e4f2b0d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mindfuel-user-notification.pdf"},"notes":null,"org_country":"CA","org_id":"ea89fd69cfd4","org_name":"The MindFuel Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party service provider placed a snapshot of a historical testing database in a location accessible to MindFuel developers and web crawlers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mindfuel-user-notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33672.pdf"}],"summary":"The MindFuel Foundation reported that a third-party service provider placed a historical testing database snapshot in a location accessible to web crawlers, potentially exposing personal information and credentials.","supporting_quote":"During a recent review, we learned that a snapshot of a historical testing database was placed in a location accessible to MindFuel developers by a third-party service provider and may have been viewed by web crawlers on May 5, 2025.","technology_involved":["historical testing database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2822dc90924c59f74fcf4c3cb29edd864ef8bd0a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f99962aadae8","org_name":"Mainline Health Systems Inc","org_type":"healthcare","ransomware":null,"records_affected":101104,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-23-mainline-health-systems-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-23","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cadb19fff91d838ed9c196c88322b9230bf31e16","impact_type":"data_theft","incident_date":"2025-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMS%20Holdings%2C%20LP%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"57dfe7da6a83","org_name":"BMS Holdings, LP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMS%20Holdings%2C%20LP%20-Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed BMS Holdings’ network between February 5 and February 24, 2025, and copied files that may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-21","discovered_date":"2025-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9bc261184f81e5f35a338a47f0e25dea96ce55a2","impact_type":"disruption_or_ransomware","incident_date":"2025-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33661.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1643c96de854","org_name":"32 Pearls","org_type":"healthcare","ransomware":null,"records_affected":23550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33661.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33661.pdf"}],"summary":"32 Pearls reported that an unauthorized actor accessed some systems and files were encrypted by malicious software.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"936617b38c2cb0831e5e3cf0e6cc756aaab817e3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fda1edec8440","org_name":"Retina Associates of Cleveland, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-20-retina-associates-of-cleveland-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f4d436251861b30fa08f7052c080b7eb9b1326d","impact_type":"data_theft","incident_date":"2025-04-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33657.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"267807c1fea6","org_name":"Pierce County Library System","org_type":"government","ransomware":null,"records_affected":336826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33657.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33657.pdf"}],"summary":"Pierce County Library System reported that unauthorized access resulted in files being copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2bce697ca92976facb4a6b32628c039e3ccf6a9f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6059efadfe7e","org_name":"Los Angeles County Developmental Services Fdn., Inc. dba Frank D. Lanterman Regional Ctr.","org_type":"healthcare","ransomware":null,"records_affected":19000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-20-los-angeles-county-developmental-services-fdn-inc-dba-frank-d-lanterman-regional"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e9b2a3bab23c9f387a024ce65869c466fcfb5fd2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"193554b2d9d1","org_name":"Harbor","org_type":"healthcare","ransomware":null,"records_affected":2703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-20-harbor"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"07e92a801f1e5454ffcfbecc50285b762a9b6d81","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1a74db696ff","org_name":"Esse Health","org_type":"healthcare","ransomware":null,"records_affected":23671,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-20-esse-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-20","discovered_date":"2025-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"093752641661710ca45c3b635b6c91ae24e68700","impact_type":"data_theft","incident_date":"2024-09-17","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Electronics%20For%20Imaging%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"4184dd7d6347","org_name":"Electronics For Imaging, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604280"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Electronics%20For%20Imaging%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Electronics For Imaging, Inc. reported unauthorized access to its network, during which copies of certain files may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-06-20","discovered_date":"2025-12-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"d3ef68a878d4748cf3d1b7f365cf9251ce944efb","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-06-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38cb90a009ec","org_name":"Aflac Incorporated","org_type":"financial","ransomware":false,"records_affected":22653844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004744"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616010"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/4977/000000497725000128/afl-20250620.htm"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aflac%20-%20Notice%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aflac%20Incorporated-2025-07-11"}],"summary":"Aflac reported that an unauthorized actor obtained personal information from an Aflac system on June 12, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"price":{"ticker":"AFL","base_day":"2025-06-20","returns":{"1":{"day":"2025-06-23","raw":0.0149,"adj":0.005},"5":{"day":"2025-06-27","raw":0.0171,"adj":-0.0176},"21":{"day":"2025-07-22","raw":-0.0058,"adj":-0.064},"63":{"day":"2025-09-19","raw":0.0459,"adj":-0.0709},"126":{"day":"2025-12-18","raw":0.0693,"adj":-0.069},"250":{"day":"2026-06-18","raw":0.1178,"adj":-0.1387}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-19","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2e553d132deab571222464750d3a45cf301eb1fa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d5a30fb27af","org_name":"Skin Care Specialty Physicians","org_type":"healthcare","ransomware":null,"records_affected":1038,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-19-skin-care-specialty-physicians"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-06-18","discovered_date":"2025-03-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"b0774745a85a8a1758a32686135b3bd12501257a","impact_type":"data_theft","incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/TRG%20A%201%20yr.pdf"},"notes":null,"org_country":"US","org_id":"de6683597178","org_name":"TRG, LLC","org_type":"professional_services","ransomware":null,"records_affected":126994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TRG%2C%20LLC-2025-09-15"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TRG%20A%201%20yr.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33632.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TRG%20A%201%20yr.pdf"}],"summary":"An unauthorized party accessed Nationwide systems and acquired files containing information Nationwide collected from TRG, LLC.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Nationwide"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"5d9e444ac8d1","name":"Nationwide"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1f18191f0c12a28d4c65987e24ad85b36329c10","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ff9ec1ff7b0","org_name":"Marquette County Medical Care Facility","org_type":"healthcare","ransomware":null,"records_affected":1499,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-18-marquette-county-medical-care-facility"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad729658c20e440aa86387f70696114a6543bb16","impact_type":"unknown","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Inspira%20-%20Individual%20Notification%20Letter%20%28Update%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5519d3073222","org_name":"Inspira Financial Trust, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604197"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"89ad6d527a160da5c1fc6f82e93294b510eafe8e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b74c0b27bd54","org_name":"Winkler County Hospital District","org_type":"healthcare","ransomware":null,"records_affected":637,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-17-winkler-county-hospital-district"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-06-17","discovered_date":"2024-09-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a377862c3afd5d4022a9409307cbcb0bbf98ee8","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marin%20Housing%20Authority%20Data%20Breach%20Notification%20Letter%20%28COMBINED%29%2847669693.2%29_Rev%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"26f110b34b77","org_name":"Marin Housing Authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604142"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marin%20Housing%20Authority%20Data%20Breach%20Notification%20Letter%20%28COMBINED%29%2847669693.2%29_Rev%20%28002%29.pdf"}],"summary":"Marin Housing Authority reported unauthorized access to multiple email accounts that may have exposed sensitive information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-17","discovered_date":"2024-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"480bda80630f3711317a04f244757c1f96610bed","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Krispy%20Kreme%20-%20Sample%20Individual%20Notice%20-%20Confidential.pdf"},"notes":null,"org_country":"US","org_id":"b4505230256a","org_name":"Krispy Kreme Doughnut Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604172"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Krispy%20Kreme%20-%20Sample%20Individual%20Notice%20-%20Confidential.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/consumer%20notice.pdf"}],"summary":"Krispy Kreme Doughnut Corporation reported unauthorized activity on part of its information technology systems that affected personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4cda3ed303a81f4c6b6bb731f1c18f8f773a2c1e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5faf7b32a124","org_name":"Broadwest Specialty Surgical Center","org_type":"healthcare","ransomware":null,"records_affected":536,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-17-broadwest-specialty-surgical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-06-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aafc0b1c0965fbfba3f48b6b501762149798a9f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D82C8D16-19AD-8176-D665-453CFB2E55F0"},"incident_date":"2025-06-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"8c1f839532cd","org_name":"ASICS","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cebb8cddda862ffcf8444aac589c82ca4d3f6819","impact_type":"unknown","incident_date":"2024-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ACPHS_REDACTED_NOTICE_36355373v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"948f380fd366","org_name":"Albany College of Pharmacy and Health Sciences","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604110"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33617.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a8449ea27694c4f64acb848ea4bc8def968cd9f","impact_type":"data_theft","incident_date":"2024-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33594.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c760e8aea937","org_name":"Decisely Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":2861,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33594.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33594.pdf"}],"summary":"Decisely Insurance Services reported that personal information may have been acquired in a data security incident involving its cloud storage platform.","supporting_quote":null,"technology_involved":["cloud storage platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-14","discovered_date":"2024-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"2113482fdea8a845c7a5a633a8905b65e6bb7f94","impact_type":"data_theft","incident_date":"2024-12-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Decisely_%209.30%20Reg%20Notice%20CA%20%281%29_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c760e8aea937","org_name":"Decisely Insurance Services","org_type":"financial","ransomware":null,"records_affected":261155,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Decisely%20Insurance%20Services-2025-12-30"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Decisely%20Insurance%20Services%2C%20LLC-2025-10-08"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004767"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-612391"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604086"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605850"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Decisely_%209.30%20Reg%20Notice%20CA%20%281%29_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Decisely_%209.30%20Reg%20Notice%20CA%20%281%29_0.pdf"}],"summary":"Decisely Insurance Services reported that personal information may have been acquired in a data security incident involving its cloud storage platform.","supporting_quote":null,"technology_involved":["cloud storage platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-13","discovered_date":"2025-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"ab5e9c2160ee8cb21279e4a9948ef0d7a64fda2b","impact_type":"unknown","imported_from":null,"incident_date":"2025-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"75b63754db17","org_name":"Zoomcar Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":8400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K CURRENT REPORT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1854275/000121390025054319/ea0245724-8k_zoomcar.htm"}],"summary":"Zoomcar Holdings identified unauthorized access to a dataset containing personal information associated with approximately 8.4 million users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4496fe30819585e3863ef6a665b9f366a5771287","impact_type":"data_theft","imported_from":null,"incident_date":"2025-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c5196ceb9667","org_name":"Ualabee","org_type":"technology_saas","ransomware":null,"records_affected":472296,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ualabee","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ualabee"}],"summary":"Ualabee records were scraped from an interface on its platform, including email addresses, names, profile photos, dates of birth, and phone numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ecdb2e234755e0d83a04cb237bfb81aaeec985f8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a75425fc327b","org_name":"Mount Rogers Community Services","org_type":"healthcare","ransomware":null,"records_affected":38191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-13-mount-rogers-community-services"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TW91bnQgUm9nZXJzIENvbW11bml0eSBTZXJ2aWNlc0BpbmNyYW5zb20"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c6ef079e6fa91aa7255a974573ba9a73df6f726","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Effortless%20Office_0.pdf"},"notes":null,"org_country":"US","org_id":"63fb22374508","org_name":"Effortless Office Enterprises, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604038"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Effortless%20Office_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Effortless%20Office%20Enterprises%2C%20LLC-2025-06-13"}],"summary":"Effortless Office Enterprises reported unauthorized access to its computer network between May 9 and July 23, 2024, and said personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4f3a9895298458d5e71a68027357e78be899f4ce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"500c537a5319","org_name":"Diversified Services Enterprises","org_type":"professional_services","ransomware":null,"records_affected":61066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-13-diversified-services-enterprises"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"88cf3ba4b173d7d2764c151a60f2a25c97548cca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8bdac53db738","org_name":"Central Kentucky Radiology","org_type":"healthcare","ransomware":null,"records_affected":166953,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-13-central-kentucky-radiology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-13","discovered_date":"2024-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2abeb4beb13f0855ef7aca15c8353492d75ea30a","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Consumer%20Letter.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8cf1c670f32a","org_name":"Asheville Eye Associates, PLLC","org_type":"healthcare","ransomware":null,"records_affected":2046,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Consumer%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Consumer%20Letter.pdf"}],"summary":"Asheville Eye Associates detected an unauthorized party's access to its network and acquisition of files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-13","discovered_date":"2024-08-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"15e3ed27c2610a043b5bbaf639fd9661641d47fb","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AltaMed%20Health%20Services%20Corporation%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e4ad28bac69","org_name":"AltaMed Health Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":4530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-13-altamed-health-services-corporation"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604053"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AltaMed%20Health%20Services%20Corporation%20-%20Notice%20of%20Data%20Event%20%20-%20CA_0.pdf"}],"summary":"AltaMed reported unauthorized access to an email account between August 5 and August 9, 2024, potentially affecting personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-12","discovered_date":"2025-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2c2b337e798f22623911c198337678402589cb2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vino%20Farms_General%20Notice%20Letter_AG%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"7174712e9c66","org_name":"Vino Farms, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603986"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vino%20Farms_General%20Notice%20Letter_AG%20Sample.pdf"}],"summary":"Vino Farms reported unauthorized activity in its computer systems and said personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d6d6a0b31a5fcc9368bf7c758e9c22f47f82ca95","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/consumer%20notice%20RHS.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5621bff1497","org_name":"Rural Health Services","org_type":"healthcare","ransomware":null,"records_affected":36542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-12-rural-health-services"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/consumer%20notice%20RHS.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27439c74a189460e12a26f021f5beb347f7a0dd9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mckay%20Wealth%20Management%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7413ada1595a","org_name":"McKay Wealth Management","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603973"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mckay%20Wealth%20Management%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#McKay%20Wealth%20Management-2025-06-12"}],"summary":"An unauthorized person accessed a McKay Wealth Management employee’s email account, which contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd191f29687c7c186bca9ffbb323fe171dd74fc4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20%28Version%201%29%20Wave%202.pdf"},"notes":null,"org_country":"US","org_id":"d82548f6e74b","org_name":"Lemonade, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the new Online Flow could allow its integration to reveal a driver's license number to an actor's browser.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20%28Version%201%29%20Wave%202.pdf"}],"summary":"A vulnerability in Lemonade's Online Flow may have exposed users' driver’s license numbers to a bad actor.","supporting_quote":"For this to have happened, the bad actor needed to enter a name, date of birth, and residential address into the new Online Flow.","technology_involved":["Online Flow"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3fc7722e9577a46b92dbbe6d19c63d1c0231dca1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f94ac2f948ec","org_name":"Kelley Drye & Warren LLP","org_type":"professional_services","ransomware":null,"records_affected":771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-12-kelley-drye-warren-llp"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e77db0c6222d0801cac1f881acd8759941c97d78","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5b2968bfe6c","org_name":"Imperial Beach Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":10358,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-12-imperial-beach-community-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-12","discovered_date":"2024-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43d19520b38d498fa69932e1ce5cd9932cb9aee5","impact_type":"data_theft","incident_date":"2024-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Doyon%20-%20PI.pdf"},"notes":null,"org_country":"US","org_id":"a3fe648e51d3","org_name":"Doyon, Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603922"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Doyon%20-%20PI.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33575.pdf"}],"summary":"Doyon, Limited discovered that an unauthorized actor or actors accessed and acquired files from its IT systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e0fffd3897467626596b7f429410cbe4a7a1be4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.06.06-Notice%20of%20Data%20Breach%20%28Final%29_0.pdf"},"notes":null,"org_country":"US","org_id":"23685ad5b541","org_name":"Colorado West Construction, Next Level Construction Services, and 4 Corners Repair & Restoration","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.06.06-Notice%20of%20Data%20Breach%20%28Final%29_0.pdf"}],"summary":"The organizations reported unauthorized access to internal data systems and said files containing employee personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b661c4b7e905dfc61d1a8e97d20461772568fc84","impact_type":"unknown","incident_date":"2024-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Infinity_Plumbling-Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"6bb055b548b8","org_name":"Infinity Plumbing Designs, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603899"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Infinity_Plumbling-Notice_0.pdf"}],"summary":"Infinity Plumbing Designs, Inc. notified affected individuals of a security incident and offered credit monitoring.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d19226b0d508b654e03423cca1aa9b297c120a10","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"975b53718251","org_name":"Clarkston Chiropractic Sports & Wellness","org_type":"healthcare","ransomware":null,"records_affected":2757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-11-clarkston-chiropractic-sports-wellness"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2025-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10afd56b1e73616fe957bfdb35da751ee4e103f5","impact_type":"data_theft","imported_from":null,"incident_date":"2022-05-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"17b2edfd8829","org_name":"WiredBucks","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WiredBucks","type":"hibp","url":"https://haveibeenpwned.com/Breach/WiredBucks"}],"summary":"WiredBucks suffered a data breach that exposed user contact details, names, usernames, earnings, physical addresses, and plaintext passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e89aa1c0dbfb2df210dab151e877a9a7c6ac88f8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e7a005ab4f03","org_name":"Repay Management Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":606,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-10-repay-management-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-10","discovered_date":"2024-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7b5245e9e190223a4766d3fa36b3e8bd80b0ac5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSMD%20-%20CA%20AG%20Notice%20Letter%28314559359.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"d2b667fc2b8d","org_name":"Comyns, Smith, McCleary & Deaver LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSMD%20-%20CA%20AG%20Notice%20Letter%28314559359.1%29_0.pdf"}],"summary":"CSMD reported unauthorized activity in one email account, with names and other unspecified information potentially subject to unauthorized access.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","other"],"disclosed_date":"2025-06-10","discovered_date":"2025-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb8c9c6d40d467d308f28c2916ed3c6ab8f93d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2025.06.06-Notice%20of%20Data%20Breach%20%28Final%29.pdf"},"notes":null,"org_country":"US","org_id":"f444e7785bb2","org_name":"COLORADO WEST CONSTRUCTION","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2025.06.06-Notice%20of%20Data%20Breach%20%28Final%29.pdf"}],"summary":"Colorado West Construction discovered unauthorized access to its internal data systems, and files containing current and former employees’ personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90e361ece0c4774bb8dd089b924c201f883c5222","impact_type":"data_theft","incident_date":"2024-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NYU%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"7c0cf486f03a","org_name":"New York University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603791"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NYU%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20York%20University-2025-06-09"}],"summary":"New York University reported that an unauthorized actor took files from its network containing names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-09","discovered_date":"2024-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"93deda84c5e219d13cfa895606dfa816b439dad7","impact_type":"both","imported_from":null,"incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20NRS1.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f03b6410caa3","org_name":"Nationwide Recovery Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":5770,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20NRS1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SRH%20-%20South%20Carolina%20-%20Consumer%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20NRS1.pdf"}],"summary":"Nationwide Recovery Services reported unauthorized access to its systems, resulting in a network outage and the copying of files containing individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cac46da9b30ab9344642fa5620846d3676cd8a8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"5ab161d5b7ea","org_name":"Disk Union","org_type":"retail_ecommerce","ransomware":null,"records_affected":690667,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Disk Union","type":"hibp","url":"https://haveibeenpwned.com/Breach/DiskUnion"}],"summary":"Disk Union suffered a data breach that exposed email addresses, names, post codes, phone numbers, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-06","discovered_date":"2025-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0838f42b45b19a9af1d8d16739c4951b52e317ba","impact_type":"data_theft","imported_from":null,"incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Episource%20Individual%20Notice%20Letter%20Template%20No%20SSN%205-21-25_v2%20%28Static%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"12af51fa73bf","org_name":"Sharp HealthCare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Episource%20Individual%20Notice%20Letter%20Template%20No%20SSN%205-21-25_v2%20%28Static%20Proof%29.pdf"}],"summary":"A criminal copied data from Sharp HealthCare computer systems during an incident that began January 27, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-06","discovered_date":"2025-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ff3accdd81897048a16d22b936f24a7e9731f79","impact_type":"data_theft","incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Episource%20Individual%20Notice%20Letter%20Template%20No%20SSN%205-21-25_v2%20%28Static%20Proof%29_0_0.pdf"},"notes":null,"org_country":"US","org_id":"619bac3317e0","org_name":"Sharp Community Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608454"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Episource%20Individual%20Notice%20Letter%20Template%20No%20SSN%205-21-25_v2%20%28Static%20Proof%29_0_0.pdf"}],"summary":"Sharp Community Medical Group reported that a criminal copied data from its computer systems between January 27 and February 6, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-06","discovered_date":"2024-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a2e20eb1611f299b8317e38b30d7d7ac5896256","impact_type":"both","incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Select%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4b7f251a61c5","org_name":"Select Medical Holdings Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603731"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Select%20-%20California%20Notification.pdf"}],"summary":"NRS reported unauthorized access to its systems, a network outage, and copied files that may have contained Select Medical Holdings Corporation individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"NRS"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bb5fafbd5568","name":"NRS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8b14503b62b9e69f476dba7bf91331753eb8da82","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1ec74fcd3f2","org_name":"Public Health Trust of Miami Dade County DBA Jackson Health System","org_type":"healthcare","ransomware":null,"records_affected":2599,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-public-health-trust-of-miami-dade-county-dba-jackson-health-system"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-06","discovered_date":"2025-04-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cd362e5419c5bcc8c9d9e6d59c484edf1f823c27","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33534.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cdfe50252649","org_name":"Patinkin Research Strategies, LLC","org_type":"professional_services","ransomware":null,"records_affected":28614,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33534.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33534.pdf"}],"summary":"Patinkin Research Strategies reported that an unauthorized third party likely accessed stored data, potentially exposing names and full dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e8c1700809f568ac0997d308ed613345222b0f72","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1805a3610eb0","org_name":"NYC Health + Hospitals","org_type":"healthcare","ransomware":null,"records_affected":5728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-nyc-health-hospitals"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7c252b0c47c1bb642ffd86e08d988acdf0c6ecb0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"abf82da28af2","org_name":"Huron Regional Medical Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":25398,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-huron-regional-medical-center-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-06-06","discovered_date":"2025-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"44c31e13ad65d9f84e376495414efdc10989d167","impact_type":"data_theft","incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33536.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"278504f30c49","org_name":"Episource","org_type":"professional_services","ransomware":null,"records_affected":102913,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33536.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33536.pdf"}],"summary":"Episource said a criminal copied data from its computer systems between January 27 and February 6, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6829b6e838872007ed0f9d5d754e37d4f6dc2625","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Episource%20-%20Individual%20Notification%20Templates%20-%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"278504f30c49","org_name":"Episource, LLC","org_type":"professional_services","ransomware":null,"records_affected":6725572,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-episource-llc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603716"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605327"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Episource%2C%20LLC-2025-06-06"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a870b4844ac93129b01b6ba3094f68cdbd6d0e2b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"189250d16658","org_name":"Centivo Corporation","org_type":"professional_services","ransomware":null,"records_affected":630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-centivo-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-06-06","discovered_date":"2025-04-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"04f355d88bcf49a719ff8c22e78235744a93c6be","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXP_N4674_BSC%20%232_DBM-5102_L01_SAS_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":673,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-06-blue-shield-of-california"},{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-06-23-blue-shield-of-california"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603730"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605839"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXP_N4674_BSC%20%232_DBM-5102_L01_SAS_0.pdf"}],"summary":"An incorrect data merge potentially exposed some Blue Shield of California members’ health information to other members through the Member Health Record feature on its portal.","supporting_quote":null,"technology_involved":["Member Health Record feature","member portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-06-05","discovered_date":"2025-04-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17d123ba9b62cb944228c1f26d57f597d31b3d57","impact_type":"both","incident_date":"2025-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sensata%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"74ce0e291459","org_name":"Sensata Technologies","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sensata%20-%20California%20Notification.pdf"}],"summary":"Sensata Technologies reported that an unauthorized actor obtained files from its network and encrypted certain servers with ransomware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-04","discovered_date":"2024-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d6ef97c5968f6ebe740bac8b114bfce4aa8f36a","impact_type":"data_theft","incident_date":"2024-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-24352%20Prenovost%202%20Ad%20CM%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"6138dcfb4065","org_name":"Prenovost, Normandin, Dawe & Rocha, A.P.C.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603629"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-24352%20Prenovost%202%20Ad%20CM%20r3prf.pdf"}],"summary":"The firm reported that certain data items were acquired without authorization, and that some affected files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"331d1de7b1d2895e261043ccc8b05ee63b26ddd8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/csl%20consumer%20notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1fdee2da93c5","org_name":"Charleston School of Law","org_type":"unknown","ransomware":null,"records_affected":1432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/csl%20consumer%20notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c075db29741cad4bf07e2a0805e06ed6d037269","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-05-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"306d1edc1fa9","org_name":"ColoCrossing","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The breach stemmed from a vulnerability in the single sign-on system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ColoCrossing","type":"hibp","url":"https://haveibeenpwned.com/Breach/ColoCrossing"}],"summary":"ColoCrossing reported that a single sign-on vulnerability affected its ColoCloud platform and exposed customer email addresses, names, and password hashes.","supporting_quote":"ColoCrossing advised the incident was isolated to their cloud/VPS platform and stemmed from a single sign-on vulnerability.","technology_involved":["ColoCloud virtual server product","single sign-on"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-02","discovered_date":"2025-05-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"815bdd1245a1c0cd8b7ab7fe2b90fceb938d9ddd","impact_type":"data_theft","incident_date":"2025-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Renkim%20Template%20Notices.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ebeb4ac2ff7a","org_name":"Renkim Corporation","org_type":"unknown","ransomware":null,"records_affected":80178,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Renkim%20Template%20Notices.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Renkim%20Corporation-2025-06-23"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606917"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Renkim%20Template%20Notices.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Renkim%20Template%20Notices.pdf"}],"summary":"Renkim Corporation reported that an unauthorized third party may have obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-02","discovered_date":"2023-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"484669532be1243df4580c431ac7e957c3a71877","impact_type":"both","imported_from":null,"incident_date":"2023-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33488.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"26b159f6e80b","org_name":"Clark County","org_type":"government","ransomware":null,"records_affected":58168,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clark%20County%2C%20WA-2025-06-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33488.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33488.pdf"}],"summary":"Clark County detected suspicious activity, found some systems encrypted by malware, and determined that an unknown actor accessed and/or stole data from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-06-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da8150f1365deee61484c32249c9ea7b7ab2a868","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20San%20Clemente_%20Sample%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b75de6be2fb0","org_name":"City of San Clemente","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20San%20Clemente_%20Sample%20Breach%20Notification%20Letter.pdf"}],"summary":"The City of San Clemente reported that a third-party platform displayed sensitive personal data from certain business license applications.","supporting_quote":"In March 2025, we were informed that, for certain business licenses, the Platform on the San Clemente website, instead of displaying only summaries of the license information, was displaying sensitive personal data that was not intended for public disclosure.","technology_involved":["third-party platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44491754e263118eb085f1192b6d74b7081da72d","impact_type":"unknown","incident_date":"2024-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AES%20-%20Notice%20Letter%20A%20Adult%20SSN%20%28REDACTED%29%2836268107.1%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db901969f8c0","org_name":"Arrowhead Evaluation Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603516"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3894b6991901d7e6fc3cbb5b0a43bf916702412","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43A395DE-4AC4-4A42-91D1-8515CB114105"},"incident_date":"2025-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"143665712c56","org_name":"Open Arms Care Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/data-breaches-open-arms-care-elmwood-home-care/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/open-arms-care-corporation-notifies-individuals-of-data-security-incident-302798525.html"}],"summary":"Open Arms Care Corporation, a Brentwood, Tennessee nonprofit providing residential and therapeutic care for individuals with disabilities, discovered in August 2025 that an unauthorized third party had accessed one of its email accounts between June and August 2025. Emails in the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b68b7dffb1ba7d2b11bef7803e9d93e191d68ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78f4877f5018","org_name":"Upper Dublin Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-30-upper-dublin-family-dentistry"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0da789dfe261b29330a03be2439ea714ad3bac70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2C420D9-28D4-BF8C-E0FF-2EC19B371514"},"incident_date":"2025-05-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebcaa95cf466","org_name":"Tiffany","org_type":"retail_ecommerce","ransomware":null,"records_affected":2590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/tiffany-dior-suffer-south-korean-customer-data-breaches-a-28548;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/47105f5d-2775-40c0-9634-52890313356c.html"}],"summary":"\"Jewelry retailer Tiffany & Co. said hackers stole South Korean customers' data from a third-party vendor's platform, a disclosure that came shortly after sister brand Dior announced a similar breach. The Tiffany's breach occurred on April 8 but the company discovered on May 9 th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"cba375f97553b287ccf42cf402e49d9ff59c47d7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bf5f0b88f4a","org_name":"Providia Home Care, LLC dba Preferred Care Home Health Services","org_type":"healthcare","ransomware":null,"records_affected":38401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-30-providia-home-care-llc-dba-preferred-care-home-health-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41bfe7d28adcf4ce6dba72f4e1037622c7f22c8d","impact_type":"data_theft","incident_date":"2025-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Precision%20Tax%20Relief%2C%20LLC%20%E2%80%93%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"df733443ebb9","org_name":"Precision Tax Relief LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Precision%20Tax%20Relief%2C%20LLC%20%E2%80%93%20Exhibit%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Precision%20Tax%20Relief%20LLC-2025-05-30"}],"summary":"An unauthorized actor accessed Precision Tax Relief LLC's network and viewed or copied information in impacted files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a9d42628f66af6fedb17680d9e040fe6112d474e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2f274cea01a2","org_name":"Oliver Street Dermatology Management LLC","org_type":"professional_services","ransomware":null,"records_affected":13717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-30-oliver-street-dermatology-management-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1221a7c0dcb6572499b31bdce9345af339543f51","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4060b5f3f21","org_name":"Next Step Healthcare LLC","org_type":"healthcare","ransomware":null,"records_affected":12090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-30-next-step-healthcare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f29e8633be522c7da25a59d900d74f85c89b540","impact_type":"data_theft","incident_date":"2024-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KMTG_Individual%20Notice%20Letter%20Sample.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"f440465ff505","org_name":"Kronick Moskovitz Tiedemann & Girard","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603439"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KMTG_Individual%20Notice%20Letter%20Sample.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33410.pdf"}],"summary":"Kronick discovered unauthorized access to internal systems, and an investigation confirmed that data was obtained and temporarily posted online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca8ce225599bdd03716cd4a7caf063e161803e69","impact_type":"data_theft","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kelly%20Benefits.pdf"},"notes":null,"org_country":"US","org_id":"b033c68991bd","org_name":"Kelly & Associates Insurance Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603420"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604771"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kelly%20Benefits.pdf"}],"summary":"Kelly & Associates Insurance Group reported unauthorized access to its environment and said certain files containing personal information were copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e681637854f674ac07fa045e06c9353b9837db0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32BB90E8-976A-AB52-98D5-DA10FE66F21D"},"incident_date":"2025-05-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"012717116671","org_name":"Farmers Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/farmers-insurance-data-breach-impacts-over-1-million-people/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f8689502-4645-45aa-a675-8c5e8fb1d96d.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8e99d3e3-b1f1-4f30-bbb9-be7dfca5e281.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.farmers.com/content/dam/farmers/marketing/digital/aem/pdfs/disclosures/notice-of-incident.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ksnt.com/news/kansas/over-1-million-persons-data-leaked-after-farmers-insurance-hack/;"}],"summary":"\"Farmers Insurance has published a notice to customers after a recent data hack resulted in the breach of personal addresses, names, driver’s license numbers and Social Security information.\n\nOn May 30, 2025, a third-party vendor alerted Farmers Insurance of suspicious activity i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e4e78b7199f66bd6907b149610447aa82c675486","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0895973b908a","org_name":"Northwestern Community Services Board","org_type":"healthcare","ransomware":null,"records_affected":21856,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-29-northwestern-community-services-board"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4d1d42c57cfc732e2c7d87d56ab65a6763db9b4b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c6cbcf5df7e2","org_name":"Gateway Community Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":34498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-29-gateway-community-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"71f8a3aac1441b0b03a4b80f314455a83d9f20fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e80fee9aa56","org_name":"Mary B. Toporcer, MD, P.C.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-28-mary-b-toporcer-md-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d3e753e23a26b29f683e0034805a9cf12950537","impact_type":"data_theft","incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/El%20Dorado%20-%20Individual%20Notification%20Letter%20-%20CW%20Draft_EID%20rev_v2%20%28Static%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"47f48417cf30","org_name":"El Dorado Irrigation District","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603269"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/El%20Dorado%20-%20Individual%20Notification%20Letter%20-%20CW%20Draft_EID%20rev_v2%20%28Static%20Proof%29.pdf"}],"summary":"Information related to El Dorado Irrigation District individuals may have been acquired during unauthorized access to NRS systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"NRS"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"bb5fafbd5568","name":"NRS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"eb2c7f04136f57c5660557c3c550925962d640bb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"226a1e01166e","org_name":"Covenant Surgical Partners, Inc.","org_type":"professional_services","ransomware":null,"records_affected":88609,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-28-covenant-surgical-partners-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-28","discovered_date":"2025-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bdf6ca04c6237da000b6f8f4114827988662bf75","impact_type":"unknown","incident_date":"2025-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"620727962d1a","org_name":"Amalgamated Sugar Company","org_type":"unknown","ransomware":null,"records_affected":18679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Amalgamated%20Sugar%20Company-2025-05-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-27","discovered_date":"2025-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ebbb5294341856df027cbaef2ab683aac2b7896","impact_type":"data_theft","incident_date":"2024-12-25","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LNRS%20-%20Sample%20Individual%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"205cd9187a80","org_name":"LexisNexis Risk Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LNRS%20-%20Sample%20Individual%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LexisNexis%20Risk%20Solutions-2025-05-27"}],"summary":"LexisNexis Risk Solutions said an unauthorized third party acquired personal information from a third-party software development platform.","supporting_quote":"On April 1, 2025, we learned that on December 25, 2024, an unauthorized third party acquired certain LNRS data from a third-party platform used for software development.","technology_involved":["software development platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79c992f4764c96e00a70c37bb63399ddc3a42e29","impact_type":"data_theft","incident_date":"2024-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"e3b0b6d089a5","org_name":"Free","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Free","type":"hibp","url":"https://haveibeenpwned.com/Breach/FreeMobile"}],"summary":"Free suffered a data breach in October 2024 in which personal information and some IBAN bank account numbers were leaked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54a95908828d065a68f79988f29b8a485a241fdd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"179B6A6D-C3D5-4945-BD19-591272049A11"},"incident_date":"2025-05-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"0ad687c5ed7d","org_name":"DataPost","org_type":"technology_saas","ransomware":true,"records_affected":146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.channelnewsasia.com/singapore/datapost-income-insurance-ransomware-attack-breach-pdpc-5158576;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/singapore/consumer/details-of-146-income-insurance-policyholders-compromised-after-cyberattack-on-external-vendor"},{"fetched_at":null,"title":"Leak-site claim by direwolf","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RGF0YVBvc3RAZGlyZXdvbGY"}],"summary":"\"A ransomware attack on a Singapore-based data handling service provider has compromised the personal information of at least 146 Income Insurance policy holders.\n\nThe company in question, DataPost, is in the early stages of investigating the attack, the firm said on Thursday (Ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"claim_groups":["direwolf"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-23","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"5e91435d87d7e6998143982c8853ee0fa00b5015","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33408.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"66cc890f572a","org_name":"Washington Gastroenterology","org_type":"healthcare","ransomware":null,"records_affected":556349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33408.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-607578"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Washington%20Gastroenterology%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33408.pdf"}],"summary":"Washington Gastroenterology reported that an unknown third party accessed and exposed data that may have included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7dddf446e9a577b87a9a8be9dcfa94a23ebbc843","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"21400fdc689a","org_name":"The Cooper Health System","org_type":"healthcare","ransomware":null,"records_affected":57412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-23-the-cooper-health-system"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-23","discovered_date":"2025-04-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f284c72baba58d0da12edc11adf195addaa7ab22","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea37a9ed1744","org_name":"The City of Columbia City","org_type":"unknown","ransomware":null,"records_affected":771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20City%20of%20Columbia%20City-2025-05-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d309556c0b109e72f8c07feb7b68b235ea8a71c1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24ceb8920225","org_name":"Sports Physical Therapy, Occupational Therapy and Rehabilitation Services of the North Shore, P.L.L.C","org_type":"healthcare","ransomware":null,"records_affected":6195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-23-sports-physical-therapy-occupational-therapy-and-rehabilitation-services-of-the-"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-23","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f52b4fcf13364d74500423b6d787f53540c6e3e","impact_type":"data_theft","incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lockton%20Individual%20Notice%20Letter%20-%20Master_0.pdf"},"notes":null,"org_country":"US","org_id":"8ccd4f1705d4","org_name":"Southeast Series of Lockton Companies, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603128"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604687"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lockton%20Individual%20Notice%20Letter%20-%20Master_0.pdf"}],"summary":"Lockton reported that an unauthorized party accessed an individual account and computer and obtained files containing personal information.","supporting_quote":null,"technology_involved":["computer","individual account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4e8cf398317280307aa1331a73968f18be565a7b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e40f228168cb","org_name":"North Shore University Hospital Sleep Disorders Center","org_type":"healthcare","ransomware":null,"records_affected":13332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-23-north-shore-university-hospital-sleep-disorders-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7df93c61eccbc4f21143f881cf542ebd45a99c78","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7063d5aaa547","org_name":"NHPP Physical Medicine and Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":1353,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-23-nhpp-physical-medicine-and-rehabilitation"}],"summary":null,"supporting_quote":null,"technology_involved":["Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-23","discovered_date":"2025-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b4cb51b904d6df05a9c24c9da992a1d11c2f05d","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kenneth%20Wong%2C%20CPA%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ba978f75bce0","org_name":"Kenneth Wong, CPA, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603155"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kenneth%20Wong%2C%20CPA%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Kenneth Wong, CPA, Inc. reported that an unauthorized party accessed or copied information from certain computer systems, including tax and financial account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-05-23","discovered_date":"2024-06-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c5f7c11b095d43b78b0832a4440c2bf6c3d8b87","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Humboldt%20IPA%20-%20Individual%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"eeeaaf2f5fc5","org_name":"Humboldt Independent Practice Association","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603120"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Humboldt%20IPA%20-%20Individual%20Notice%20Template.pdf"}],"summary":"Humboldt Independent Practice Association reported that an unauthorized actor accessed an email account and acquired its contents, including protected health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-23","discovered_date":"2025-03-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"ec72b2e6d395c27beba5db6122dee1770f0343a2","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35971.pdf"},"notes":null,"org_country":"US","org_id":"b43f61838816","org_name":"Apro, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Apro%2C%20LLC%20d/b/a%20United%20Pacific-2025-12-29"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35971.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35972.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616358"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-616356"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603159"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_6.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35971.pdf"}],"summary":"An unauthorized third party accessed Apro systems and obtained files containing some individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-23","discovered_date":"2025-01-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a2e54a6e824deec9a3bab3091e548f330178db4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ANBT%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"db64fc49126d","org_name":"American National Bank & Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603161"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ANBT%20-%20California%20Notification.pdf"}],"summary":"American National Bank & Trust reported unauthorized network access and access to a file containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2025-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a0a800047c86c1f1cf37aebcee22ae8c1e701fe3","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34136.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b7db33dbe42","org_name":"Washington State Opportunity Scholarship Foundation","org_type":"unknown","ransomware":null,"records_affected":16668,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34136.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33399.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a62c3c22f913f7ff5152ad884ba9fa7d667b8adf","impact_type":"disruption_or_ransomware","incident_date":"2025-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kenai%20Security%20Breach%20Notification%20-%20Current%20Employees%20%28002%29%20%28002%29_0.pdf"},"notes":null,"org_country":"US","org_id":"681738a5ad8d","org_name":"KENAI DRILLING LIMITED","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603095"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kenai%20Security%20Breach%20Notification%20-%20Current%20Employees%20%28002%29%20%28002%29_0.pdf"}],"summary":"Unauthorized parties accessed and encrypted files on KENAI’s Document File Server containing employee personal and wage information.","supporting_quote":null,"technology_involved":["Document File Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bb4c3b2d2d4ab2e60a1f0ac8fc6926035b69d99","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Interactive%20Brokers%20-%20GENERAL%20NOTIFICATION%20LETTER%20%5B5.22.25%5D.pdf"},"notes":null,"org_country":"US","org_id":"9426067bece0","org_name":"Interactive Brokers LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603100"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Interactive%20Brokers%20-%20GENERAL%20NOTIFICATION%20LETTER%20%5B5.22.25%5D.pdf"}],"summary":"Interactive Brokers LLC reported that certain customer information was inadvertently disclosed to an unauthorized third party on April 14, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b3d8533e65d7a1ee2f72edf0b68204d7e70f7de","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"df949afd406d","org_name":"Fédération Française de Rugby","org_type":"nonprofit","ransomware":true,"records_affected":281977,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fédération Francaise de Rugby","type":"hibp","url":"https://haveibeenpwned.com/Breach/FFR"}],"summary":"The Fédération Française de Rugby reported a data breach affecting email servers that exposed personal information and involved an attempted ransom.","supporting_quote":null,"technology_involved":["email servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-22","discovered_date":"2025-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63f832506a15b91e8da741a6d15d86776352b581","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CIYMCA%20-%20Regulatory%20Notification%20Letter%20for%20Submission%2812908184.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"13a10a8c0a6f","org_name":"Channel Islands YMCA","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CIYMCA%20-%20Regulatory%20Notification%20Letter%20for%20Submission%2812908184.1%29_0.pdf"}],"summary":"Channel Islands YMCA reported that emails in its work email environment may have been accessed without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73887146d3f155e3fd879ebd285f28cfe7159a01","impact_type":"unknown","incident_date":"2024-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BBB-SSN_%28002%29_36231921v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8190a2b931fa","org_name":"Better Business Bureau Serving the Pacific Southwest, Central & Inland California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603070"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1faf2ad01c3a0cde17ed2417df3c0520fe3c36e9","impact_type":"data_theft","incident_date":"2024-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9593f01389a9","org_name":"Alera Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603045"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alera%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alera%20Group%2C%20Inc.-2025-05-21"}],"summary":"Alera Group reported that personal information may have been removed from its technology environment following unauthorized access between July 19 and August 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d82de98abf54f290e44917625978364e2334159","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Appendix%20A%20-%20Coinbase%20Template%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"9530b19d335b","org_name":"Coinbase","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"Coinbase support personnel improperly accessed customer information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602952"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Appendix%20A%20-%20Coinbase%20Template%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33375.pdf"}],"summary":"Coinbase support personnel improperly accessed customer information, and a third party later claimed access and attempted extortion.","supporting_quote":"We discovered that a small number of individuals, performing services for Coinbase at our overseas retail support locations, improperly accessed customer information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-20","discovered_date":"2025-05-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0da2d972eba3debaae8e38e24401f4b4ce93aa9f","impact_type":"unknown","incident_date":"2025-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91b40b4b2293","org_name":"Casey Hawkins, Inc.","org_type":"unknown","ransomware":null,"records_affected":480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Casey%20Hawkins%2C%20Inc.-2025-05-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e8b0a44d8273d09ff85fcd5eccd6be234fafe95","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20-%20Data%20Subject%20Notice%20Letter%20-%20CA%20-%202025.05.20.pdf"},"notes":null,"org_country":"US","org_id":"1c04dd552e71","org_name":"AXT, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20-%20Data%20Subject%20Notice%20Letter%20-%20CA%20-%202025.05.20.pdf"}],"summary":"AXT detected an unauthorized third-party compromise of its network environment, where personal information could have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1e8d448f6aa304eeb52a05ec2bc631a149e3713b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d7875e5fd07","org_name":"Community Hospital of Anaconda","org_type":"healthcare","ransomware":null,"records_affected":21243,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-19-community-hospital-of-anaconda"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-16","discovered_date":"2025-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"670e2b21fe4fad9851983569d6433a6585d222e2","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Promises_%20Regulatory%20Mail%20Merge%2812885000.1%29.pdf"},"notes":null,"org_country":"US","org_id":"c75e12a02f88","org_name":"Promises2Kids","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Promises_%20Regulatory%20Mail%20Merge%2812885000.1%29.pdf"}],"summary":"Promises2Kids reported that an incident involving unauthorized access to its computer network may have resulted in personal information being accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a98a5a84537903f65bd858864d52239a83f7a27f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3cac0b01378","org_name":"Mercy Surgical Dressing Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":4159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-16-mercy-surgical-dressing-group-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2c2b01b90f8c37a09bcb391cb1d7a659fd3af46c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48fd4f4113a5","org_name":"Insulet Corporation","org_type":"healthcare","ransomware":null,"records_affected":841,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-16-insulet-corporation"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a619b95a0916faf907141ad9aa68dd918ee71c9e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d661a1d93882","org_name":"Compassion Health Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":23282,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-16-compassion-health-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1abf95b9a43f69dc278ed9a2e6071ffaecc9addf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e4490cacdf9","org_name":"Weiser Valley Hospital District dba Weiser Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":59990,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-15-weiser-valley-hospital-district-dba-weiser-memorial-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-15","discovered_date":"2024-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae724c774b438c3b13b9f8f8defe288c92f5b304","impact_type":"data_theft","incident_date":"2024-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Weiser%20-%20Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"312f8c034976","org_name":"Weiser Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602742"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Weiser%20-%20Sample%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Weiser%20Memorial%20Hospital-2025-05-13"}],"summary":"Weiser Memorial Hospital reported unusual network activity and said certain data may have been acquired without authorization on or about September 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-15","discovered_date":"2024-12-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9b0a0dfdbc9e565d2fe13ef7f0eadb387446465e","impact_type":"unknown","incident_date":"2024-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee834a52954a","org_name":"Thede Culpepper Moore Munroe & Silliman LLP","org_type":"unknown","ransomware":null,"records_affected":1259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Thede%20Culpepper%20Moore%20Munroe%20%26%20Silliman%20LLP-2025-05-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8b22fae987991a8fcb75b5e08473108c94ee3649","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dd21c15d2fb9","org_name":"Hunter Health Clinic","org_type":"healthcare","ransomware":null,"records_affected":28431,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-15-hunter-health-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2025-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e7ecf2b63964f176475782fa3c47c031e3c6f865","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"6e060e16733a","org_name":"Coinbase Global","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"Support personnel were paid to collect information from internal systems they could access for their jobs.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm"},{"fetched_at":null,"title":"8-K EX-2.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1679788/000167978825000086/exhibit21-8xk.htm"}],"summary":"Coinbase reported that support personnel were paid to collect customer and internal data from systems they could access, and an unknown threat actor demanded money to keep the information private.","supporting_quote":"The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities.","technology_involved":["customer-service systems","account-management systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse","derived":{"price":{"ticker":"COIN","base_day":"2025-05-15","returns":{"1":{"day":"2025-05-16","raw":0.0901,"adj":0.0837},"5":{"day":"2025-05-22","raw":0.1125,"adj":0.125},"21":{"day":"2025-06-16","raw":0.0701,"adj":0.0494},"63":{"day":"2025-08-15","raw":0.2991,"adj":0.2094},"126":{"day":"2025-11-13","raw":0.1583,"adj":0.0202},"250":{"day":"2026-05-14","raw":-0.1327,"adj":-0.3998}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"89e88704a943c9853956b978d4a5ac34833de588","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"09d1a865da7a","org_name":"CareNexa, LLC, doing business as Molecular Testing Labs","org_type":"healthcare","ransomware":null,"records_affected":7711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-15-carenexa-llc-doing-business-as-molecular-testing-labs"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1827939083d7055889b9ddc997ac7844323c8b34","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d3e4fd358545","org_name":"Anne Arundel County Department of Health","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-15-anne-arundel-county-department-of-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-14","discovered_date":"2025-04-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4eee251b6ae9d0ba198c4a56992809de3dad89d9","impact_type":"unknown","incident_date":"2025-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"204eb011e85c","org_name":"Resort Data Processing","org_type":"unknown","ransomware":null,"records_affected":5007,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Resort%20Data%20Processing-2025-05-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-14","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc559b9f861a54be9cede371353445b90acce7fd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"313f125cf964","org_name":"ODHS","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ODHS-2025-05-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"787feb7db43bf19cc0a5b01127e60c9cf177aa4c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/South%20Bay%20Credit%20Union_Individual%20Notice_CA.pdf"},"notes":null,"org_country":"US","org_id":"6da626c19f82","org_name":"South Bay Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602658"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/South%20Bay%20Credit%20Union_Individual%20Notice_CA.pdf"}],"summary":"South Bay Credit Union discovered unauthorized access to an employee email account, where personal information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33e947e9b6f03effafb0dc119a75a496ec76f01b","impact_type":"data_theft","incident_date":"2025-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Oxford%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e955a36678f9","org_name":"Oxford Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602657"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Oxford%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oxford%20Life%20Insurance%20Company-2025-05-13"}],"summary":"An unauthorized person accessed Oxford Life Insurance Company’s IT network for approximately one hour and copied some files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4043d6851df98813bb25f66d4a6deb3e09f1c7aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A87FF679-A2F3-E71D-9181-A67B7542122C"},"incident_date":"2025-05-13","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"7f4bb75dd66e","org_name":"LVMH","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://jingdaily.com/posts/dior-china-data-breach-tests-brand-trust;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.globaltimes.cn/page/202505/1333930.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/shinyhunters-behind-salesforce-data-theft-attacks-at-qantas-allianz-life-and-lvmh/"}],"summary":"\"A wave of data breaches impacting companies like Qantas, Allianz Life, LVMH, and Adidas has been linked to the ShinyHunters extortion group, which has been using voice phishing attacks to steal data from Salesforce CRM instances.\n\nIn June, Google's Threat Intelligence Group (GTI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-13","discovered_date":"2024-06-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8504798a8b8096e0665915228a35c74e132a96cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HCOE_%20Adult%20Letter_Final.pdf"},"notes":null,"org_country":"US","org_id":"41c7bb9da801","org_name":"Humboldt County Office of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602639"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HCOE_%20Adult%20Letter_Final.pdf"}],"summary":"Humboldt County Office of Education reported unauthorized access to a limited number of employee email accounts, which may have exposed personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9c8625e78cb6a684f44aa1a85807c08e6a368ea","impact_type":"disruption_or_ransomware","incident_date":"2025-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20%28CA%20DOJ%20-%20Submission%20Copy%29.pdf"},"notes":null,"org_country":"US","org_id":"31576991c88c","org_name":"EB Archbald & Associates, Inc.","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20%28CA%20DOJ%20-%20Submission%20Copy%29.pdf"}],"summary":"EB Archbald & Associates reported a ransomware attack that encrypted data on its servers and Microsoft cloud-based portal, while attackers claimed they had downloaded information.","supporting_quote":null,"technology_involved":["Microsoft cloud-based portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c824c534d4c4668d7506bc65c518a4d563a79902","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33299.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8b6172351ba3","org_name":"MedicareCompareUSA","org_type":"unknown","ransomware":null,"records_affected":1768,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33299.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33299.pdf"}],"summary":"MedicareCompareUSA reported unauthorized access to certain email accounts, and files involved included names and dates of birth.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"07dde02f6b77dc2e9d2cc9af6bff28b12e1b34f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33300.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"59cad6b92775","org_name":"MedicareCompareUS","org_type":"professional_services","ransomware":null,"records_affected":922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33300.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33300.pdf"}],"summary":"MedicareCompareUS found unauthorized access to certain email accounts, and files involved contained personal and health insurance information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7ed503ca5409fd920807ac07bc571ab2778dd38","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20D.pdf"},"notes":null,"org_country":"US","org_id":"cc321bd784bb","org_name":"Andy Frain Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602584"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20D.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33284.pdf"}],"summary":"Andy Frain Services identified unauthorized activity involving human resources files, and said personal information could have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"18b2093329b049d2513b54e54ef04bd0dc01ca8d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a5ced826e2c","org_name":"Blue Cross Blue Shield of Texas","org_type":"professional_services","ransomware":null,"records_affected":593,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-09-blue-cross-blue-shield-of-texas"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"62ba728af6f4990ae7d1776f9d42fb132d287850","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb2b9653396c","org_name":"Tri-City Cardiology Consultants, P.C.","org_type":"healthcare","ransomware":null,"records_affected":22753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-08-tri-city-cardiology-consultants-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02773ddc7f5b67764d624f8d036fc7ac89cd1ac8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Variations%20Combine.pdf"},"notes":null,"org_country":"US","org_id":"14dede6e3661","org_name":"Roman Catholic Bishop of San Diego","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An HR spreadsheet was sent to an incorrectly entered email address.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602444"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Variations%20Combine.pdf"}],"summary":"The Roman Catholic Bishop of San Diego reported that an HR spreadsheet containing personal information was accidentally emailed to the wrong address.","supporting_quote":"An internal spreadsheet was inadvertently sent by our HR Department to the wrong email address and RCBSD has been unable to obtain confirmation from the recipient that the spreadsheet was destroyed.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46ae6fb79a17a81c8713e07dedab386873e13051","impact_type":"data_theft","incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8c133f025635","org_name":"OnRPG","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OnRPG","type":"hibp","url":"https://haveibeenpwned.com/Breach/OnRPG"}],"summary":"OnRPG’s July 2016 breach exposed email addresses, IP addresses, usernames and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"774bb6529475cdf45918f2788aa4323baa2145ea","impact_type":"data_theft","incident_date":"2025-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"30267728501c","org_name":"Kittrich Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification_1.pdf"}],"summary":"Kittrich Corporation reported that an unauthorized third party accessed and exfiltrated files from its internal systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-08","discovered_date":"2025-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"403a0ab6674d730555f517e2e83174e7419d5512","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20Intelliloan.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8f5a6bbb67c8","org_name":"Intelliloan, Inc.","org_type":"financial","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Intelliloan%2C%20Inc.-2025-05-08"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-610568"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20Intelliloan.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20Intelliloan.pdf"}],"summary":"Intelliloan identified unauthorized activity involving files related to customers and employees that could have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557890c00265f0143335860143660c502336933b","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Culinary%20Notification%20Letter%20Live%20Proof_0.pdf"},"notes":null,"org_country":"US","org_id":"7ca6ff8a09ee","org_name":"Culinary Services of America Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Culinary%20Notification%20Letter%20Live%20Proof_0.pdf"}],"summary":"An unauthorized actor accessed personal information at Culinary Services of America, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-05-07","discovered_date":"2025-03-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab28fc4f79b5bff04fddcccdd6aacbb32c89306f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-08","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SogoTrade%20Data%20Breach%20Letter%20California%20Residents.pdf"},"notes":null,"org_country":"US","org_id":"07c6419de2ef","org_name":"SogoTrade, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email containing malicious software led to the compromise of four email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602415"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SogoTrade%20Data%20Breach%20Letter%20California%20Residents.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SogoTrade%2C%20Inc.-2025-05-07"}],"summary":"SogoTrade reported that a phishing email containing malicious software led to the compromise of four email accounts and may have exposed personal information.","supporting_quote":"On or about March 18, 2025, SogoTrade, Inc. (“SogoTrade”) learned that a phishing email containing malicious software led to the compromise of four email accounts by an unauthorized party that may have resulted in the exposure of affected individuals’ personal information.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-07","discovered_date":"2024-12-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cda26a7a85827b1651b06fbadbd18fe0c6f2ef44","impact_type":"data_theft","incident_date":"2024-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cc1c1f9cdab7","org_name":"Long Beach Convention and Entertainment Center","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602388"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Letter.pdf"}],"summary":"The Center identified suspicious activity, took certain systems offline, and later determined that files containing personal information were taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-07","discovered_date":"2025-04-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53dc56a9c575a1ab061020726ec036345e6e71a7","impact_type":"unknown","incident_date":"2025-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"114e6a8accd1","org_name":"CareOregon, Inc.","org_type":"unknown","ransomware":null,"records_affected":1768,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CareOregon%2C%20Inc.-2025-05-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-07","discovered_date":"2025-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18a58da9b92c9c9725da047507419a33355f798c","impact_type":"data_theft","imported_from":null,"incident_date":"2025-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Caltrol_Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"caa0c1da62f5","org_name":"Caltrol Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602410"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Caltrol_Notice%20Letter.pdf"}],"summary":"Caltrol Inc. reported that an unauthorized actor accessed its systems and exfiltrated data, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-07","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"decee9a778d779ab5aa3a2a9a786ca02d3508466","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da292900b4ba","org_name":"Allied Services Division Welfare Fund","org_type":"healthcare","ransomware":null,"records_affected":5727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-07-allied-services-division-welfare-fund"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac730255cf976357a59876b665818cd75e010fbf","impact_type":"unknown","incident_date":"2024-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Weir_Canyon_Honda-Adult_Letter-Final_v2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"92e551c02dbb","org_name":"Weir Canyon Honda","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Weir_Canyon_Honda-Adult_Letter-Final_v2_Redacted.pdf"}],"summary":"Weir Canyon Honda sent a notification letter about a security incident to affected people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f910f370cf1851ffdd3de07e36943a72b6ca03f8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2031875c48e8","org_name":"The Carpenter Health Network","org_type":"healthcare","ransomware":null,"records_affected":878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-06-the-carpenter-health-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb50dd18009721d19a9cbe4556ad7135dc6211d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03AFDBD6-6E79-29B1-25F8-597834FA83A4"},"incident_date":"2025-05-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1dab51b2eec","org_name":"Saks Fifth Avenue","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"07e5ae71cd86625bed273278d9c5450993ce91ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33223.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c1884000ab9e","org_name":"Regence","org_type":"healthcare","ransomware":null,"records_affected":706,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33223.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33223.pdf"}],"summary":"Regence reported unauthorized access to certain email accounts from November 5 to November 21, 2024, and said files involved included personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cad04c47340ae18920e4d33edd741b71ea750fe2","impact_type":"unknown","incident_date":"2025-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gardena_Honda-Adult_Letter-Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2373852aa3a7","org_name":"Gardena Honda","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602338"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gardena_Honda-Adult_Letter-Redacted.pdf"}],"summary":"Gardena Honda sent a consumer notification letter about an incident, but the provided text does not describe what happened or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-05-05","discovered_date":"2025-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"af4f8232fe33038cbc7eafabc337114becc024da","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-05","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19133.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d65d8de43fe4","org_name":"Swedish Edmonds Hospital","org_type":"healthcare","ransomware":null,"records_affected":746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19133.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19133.pdf"}],"summary":"Swedish Edmonds Hospital reported that an unauthorized third party accessed files at its former collection-services provider, Nationwide Recovery Services, Inc., that may have contained personal, financial, and medical information.","supporting_quote":"NRS determined that between July 5, 2024 to July 11, 2024 an unauthorized third-party was able to access files and folders from the NRS network.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Nationwide Recovery Services, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"f03b6410caa3","name":"Nationwide Recovery Services, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-05","discovered_date":"2025-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d28df611799be7ced16807f64143f03abd6bb7d4","impact_type":"data_theft","incident_date":"2025-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sonrisas%20Adult%20Proof%20%28Reg%20Notice%29.pdf"},"notes":null,"org_country":"US","org_id":"337567f79d78","org_name":"Sonrisas Dental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602242"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sonrisas%20Adult%20Proof%20%28Reg%20Notice%29.pdf"}],"summary":"Sonrisas Dental Health reported unauthorized access to and acquisition of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b4f0272a8914fb0a4d8532dccd2b45afa63d4cdf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2db9a5d5adeb","org_name":"Minnesota Orthodontics and Dentofacial Orthopedics, P.A.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-05-minnesota-orthodontics-and-dentofacial-orthopedics-p-a"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-05","discovered_date":"2024-10-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e862bddede0ffe9cca1a752dd411ce332b6afdcc","impact_type":"data_theft","incident_date":"2023-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GeoLogics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"013618a0898e","org_name":"GeoLogics Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GeoLogics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"GeoLogics reported that personal information may have been accessed or taken from its network between December 21 and 23, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2025-05-03","discovered_date":"2025-03-10","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b4afbe9f2afe9be96e77c3401fa4bc80dfeb806","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Couples%20Learn%20HIPAA%20Breach%20Notification.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"fd9b8494aaed","org_name":"Schewitz Psychological Services Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Couples%20Learn%20HIPAA%20Breach%20Notification.pdf"}],"summary":"An unauthorized individual accessed Schewitz Psychological Services Inc’s Acuity Scheduling account using a hacked staff password and used it to send spam phishing emails.","supporting_quote":"On or around March 10, 2025, we became aware that an unauthorized individual(s) gained access to our online scheduling account through a hacked staff password.","technology_involved":["Acuity Scheduling"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Acuity"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3e507f2924a7","name":"Acuity"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b67e87480f3460453e082b65d010989e88f410ae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10839d4e2d78","org_name":"Monongalia Health System, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4895,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-03-monongalia-health-system-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e0821ba1bfcfebf710a6d3fb2162cff71414788d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1bb4e68389bf","org_name":"CardioVascular Health Clinic","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-03-cardiovascular-health-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-02","discovered_date":"2025-04-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cac06ab0f3328834316d2e736d8f32cc82a23760","impact_type":"unknown","incident_date":"2025-03-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4275fdc26e98","org_name":"St. Charles Health System, Inc.","org_type":"unknown","ransomware":null,"records_affected":4152,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Charles%20Health%20System%2C%20Inc.-2025-05-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efbb3227137ddc349eec3114f56f7ea883eb281c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nixon%20-%20%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"74d9e913f86c","org_name":"Nixon, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602184"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nixon%20-%20%20Notification%20Letter.pdf"}],"summary":"An unauthorized individual accessed files on Nixon, Inc.'s systems that contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b605c773069d79b2e4aa894a275785cc22ab3ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F61408E-3AFB-633E-50CD-F1B20DE6F466"},"incident_date":"2025-05-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"992f49685a28","org_name":"HBO Max","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"229aa46756b8655f6e2ad89f6d6d360b1f3ef44c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44F683A8-4163-B352-3AFE-57C2E008BC8C"},"incident_date":"2025-05-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c80962ca5bb3","org_name":"CarMax","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a34977e31bdf48b6ad9e5ea98f410adcbe74657","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1679091C-5A88-0FAF-6FB5-E6087EB1B2DC"},"incident_date":"2025-05-02","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc3992e05a47","org_name":"Adidas","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"460d3e9df28fb8f0ee23f2291052ed845295d9ee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2529e877e8d9","org_name":"Absolute Dental Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":1223635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-05-02-absolute-dental-group-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-05-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0fdbb650605d32b24cad605e6e5c24b9b94c62c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F39F831-7FBD-B198-8EF4-C628EBA02591"},"incident_date":"2025-05-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8da729880271","org_name":"AAA","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33de6e021ec83220d6316e87b699e7c788e30165","impact_type":"data_theft","imported_from":null,"incident_date":"2025-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"HU","org_id":"738b68970600","org_name":"TehetségKapu","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TehetségKapu","type":"hibp","url":"https://haveibeenpwned.com/Breach/TehetsegKapu"}],"summary":"TehetségKapu records containing email addresses, names, and usernames were breached and published to a hacking forum.","supporting_quote":null,"technology_involved":["TehetségKapu website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-01","discovered_date":"2024-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d9a41b40593cc52585d602e81603c3610a167514","impact_type":"unknown","incident_date":"2024-06-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d8ba89207cf8","org_name":"Kindthread","org_type":"unknown","ransomware":null,"records_affected":254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kindthread-2025-05-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-05-01","discovered_date":"2024-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70026b3fac964fa605d082884546d24f5eb04fdf","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Conrey%20-%2012%20Adult%20Notice%20Letter_%20Exhibit%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"9528488166cf","org_name":"Conrey Insurance Brokers & Risk Managers","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602136"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Conrey%20-%2012%20Adult%20Notice%20Letter_%20Exhibit%20A_0.pdf"}],"summary":"Conrey Insurance Brokers & Risk Managers reported unauthorized access to a portion of its network, and the affected information included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"832a11206607008b402df65c104f1e2b22332d3f","impact_type":"unknown","incident_date":"2024-06-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Kindthread%20-%20Adult%20Notice%20Proof.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ecc2ed75198","org_name":"301 Scrubs Investors, LLC d/b/a Scrubs & Beyond LLC d/b/a Kindthread","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602108"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-30","discovered_date":"2024-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1a2a8ade50c885c697e8f80b7bee3be03c16df5","impact_type":"data_theft","incident_date":"2024-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_12_0.pdf"},"notes":null,"org_country":"US","org_id":"f1eb4c22f4ac","org_name":"Thompson Coburn LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602081"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_12_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ThompsonCoburnLLP.pdf"}],"summary":"Thompson Coburn reported that an unauthorized actor accessed or acquired files containing personal information between May 28 and May 29, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"650394b06861d05eb584bfba9ac1019c501ace7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sunsweet%20Growers%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0bbfcf7b754d","org_name":"Sunsweet Growers Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-608074"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602082"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sunsweet%20Growers%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Sunsweet Growers reported that an unauthorized actor accessed certain systems, which were inaccessible when the company became aware of the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2813658609c380651f7d7bdeb3583b0e16d829e1","impact_type":"data_theft","incident_date":"2024-12-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/iHeart%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"86af7e2e815c","org_name":"iHeartMedia + Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602062"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/iHeart%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor viewed and obtained files stored on systems at a small number of iHeartMedia local stations; the files contained personal, financial, and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-30","discovered_date":"2024-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d50551105c7ac7777bc862b77134ac0883b06520","impact_type":"disruption_or_ransomware","incident_date":"2024-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hacienda%20-%20General%20Adult%20Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"86f53399524f","org_name":"Hacienda La Puente Unified School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605025"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602092"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hacienda%20-%20General%20Adult%20Notice%20Letter%20Sample.pdf"}],"summary":"Hacienda La Puente Unified School District reported a ransomware attack and unauthorized access to its systems from February 9 to April 12, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b60f1dbfb1825f749c0f5d592fd3c3f6218dd0bd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/CharlestonSchoolDistrict.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfabba16f3e7","org_name":"Charleston School District","org_type":"unknown","ransomware":null,"records_affected":18725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/CharlestonSchoolDistrict.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bd49291267d858259909c7177a9cdce6f1bce009","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"39b2156e726f","org_name":"Canby Clinic","org_type":"healthcare","ransomware":null,"records_affected":549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-30-canby-clinic"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Canby%20Clinic-2025-05-17"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"188c5e7b2251e2713bd90c67468f033907105eae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57c0b3dfce94","org_name":"Berkeley Research Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-30-berkeley-research-group-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ddc7594d43776d5d094d1cb5e4d021f19f41ee1d","impact_type":"data_theft","incident_date":"2024-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19132.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cce665cd4eb1","org_name":"Albion College","org_type":"education","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19132.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM19132.pdf"}],"summary":"Albion College reported unauthorized network access on December 17, 2024, and said personal information was removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b318e8790f7f9c041cf26714300d0e5ffc19afb9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f09169e83859","org_name":"Physician Wound Solutions, LLC dba Apollo Medical Supply","org_type":"healthcare","ransomware":null,"records_affected":3561,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-29-physician-wound-solutions-llc-dba-apollo-medical-supply"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-28","discovered_date":"2024-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25fd35632b4e2dddc331bce627d97057fcc6f5dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33137.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c335eac9522e","org_name":"Schauermann Thayer Law Firm","org_type":"professional_services","ransomware":null,"records_affected":2021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Schauermann%20Thayer%20Law%20Firm-2025-04-28"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33137.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33137.pdf"}],"summary":"Schauermann Thayer Law Firm reported that information may have been subject to unauthorized access in connection with a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"393896de42b250f2d8bf74d259bf8e3f7ba8d392","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/PowerSchool.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"327f587e1789","org_name":"PowerSchool Individual School District Notices SC DJJ School District (3/13/2025)","org_type":"unknown","ransomware":null,"records_affected":500320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/PowerSchool.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"75401040dfff5d7c86441aa40299e2cd518de734","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ca53d59e48a","org_name":"Minnesota Epilepsy Group","org_type":"healthcare","ransomware":null,"records_affected":38401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-28-minnesota-epilepsy-group"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a38cd2eb60b12058d7b7fb30f9a421362bfb477","impact_type":"unknown","incident_date":"2025-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXP_N2135_LOCMI_DBM-4998_CM24_L01_SAS_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0eeafaadcef8","org_name":"Law Offices of Chris M. Ingram","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601999"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ff9b9194e59ffa0766c8e2a69dae57f62b8b8d34","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a8ae2940ef6","org_name":"Ascension Health","org_type":"healthcare","ransomware":null,"records_affected":437329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-28-ascension-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-25","discovered_date":"2024-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9400f8836b13d8562040f532633a91127af58dc","impact_type":"both","imported_from":null,"incident_date":"2024-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33122.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"52c8dbc2d7e4","org_name":"VeriSource Services Inc","org_type":"unknown","ransomware":null,"records_affected":121108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33122.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#VeriSource%20Services%20Inc.-2025-04-26"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/VeriSourceInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33122.pdf"}],"summary":"VeriSource Services Inc reported that an incident disrupted access to certain systems and may have resulted in personal information being acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-25","discovered_date":"2024-02-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d5c99ec82f32deb4bff617d87d2ad13f12d32a8","impact_type":"data_theft","incident_date":"2024-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Silgan%20Containers%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"708b535a3f02","org_name":"Silgan Containers","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601916"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Silgan%20Containers%20-Sample%20Notice.pdf"}],"summary":"Unauthorized access to files and folders in Silgan Containers systems resulted in some information being copied between February 2 and February 16, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"be2c6754612ba36c37e7b72566549f593c1f791c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/PalmettoRuralTelephoneCooperative.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e287b363a8d0","org_name":"Palmetto Rural Telephone Cooperative","org_type":"unknown","ransomware":null,"records_affected":1576,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/PalmettoRuralTelephoneCooperative.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7c1a082e7edc35d55fd15256a49688cdc8d41c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCCTC%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"4a62fa21bcbc","org_name":"Northern California Children's Therapy Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in the system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCCTC%20Notice%20of%20Data%20Breach.pdf"}],"summary":"Northern California Children's Therapy Center reported that an unauthorized third party accessed a limited number of screening records by exploiting a vulnerability in its cloud-based file system.","supporting_quote":"On March 16, 2025, an unauthorized third party identified a vulnerability in the system and was able to access a limited number of records.","technology_involved":["cloud-based file system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-25","discovered_date":"2025-01-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91c3f2f09101ce114d6c7a544e5055ede8affe4c","impact_type":"data_theft","incident_date":"2024-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Newport%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"db24d164916a","org_name":"Newport Advisory, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Newport%20-%20Sample%20Letter.pdf"}],"summary":"Newport Advisory reported that files containing personal information were copied from its network in late December 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-25","discovered_date":"2024-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d49fdff6ae839e39dd880b26bb4acd9084fb2d28","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Complete%20Payroll%20Solutions%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0dd51f26b7ba","org_name":"Complete Payroll Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601920"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602525"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Complete%20Payroll%20Solutions%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Complete Payroll Solutions reported that an unauthorized individual accessed or acquired information stored on its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0d468cd936e6c24a3c23e8a260750a7e2a737c48","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9b284ae79608","org_name":"Carlton County Public Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":3502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-25-carlton-county-public-health-and-human-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-25","discovered_date":"2025-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c57cd7710d580bd2517d831267f803f7287bc6b","impact_type":"unknown","incident_date":"2025-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"830470907438","org_name":"Broadway Medical Clinic","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Broadway%20Medical%20Clinic-2025-04-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-04-24","discovered_date":"2025-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9775f75fd1e443385bb66a38eeb6f8a48eb566a8","impact_type":"both","incident_date":"2025-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Palo%20Verde%20-%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"607a6a0f5205","org_name":"Palo Verde Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619538"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601829"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Palo%20Verde%20-%20Notification.pdf"}],"summary":"An unauthorized party accessed Palo Verde Hospital systems, disrupting IT operations and accessing or removing files containing personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2ddbb8be17941bf4b15cfd578d8a567496994454","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79f579094bd2","org_name":"Drug and Alcohol Treatment Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":22215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-24-drug-and-alcohol-treatment-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8533001dcbbe6629d08d912b4d397de9a5034e2a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ba09e85316e","org_name":"Cache Valley Ear Nose & Throat","org_type":"healthcare","ransomware":null,"records_affected":26469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-24-cache-valley-ear-nose-throat"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2043510a3867ac7d072b73741cb8b8807dcd194d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48222df7543f","org_name":"Brainard Surgery Center LLC","org_type":"healthcare","ransomware":null,"records_affected":1820,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-24-brainard-surgery-center-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-23","discovered_date":"2025-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"baea234b8e7a66dc7785241d986b6b34f0570d22","impact_type":"unknown","incident_date":"2025-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb31d095a725","org_name":"West Portland Chiropractic","org_type":"unknown","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#West%20Portland%20Chiropractic-2025-04-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fcddc291e0f18f9167b485b3097a6cc4a955a73e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cbd6b33ce4e1","org_name":"Orthopaedic Specialists of Connecticut","org_type":"healthcare","ransomware":null,"records_affected":22541,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-23-orthopaedic-specialists-of-connecticut"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/T3J0aG9wYWVkaWMgU3BlY2lhbGlzdHMgb2YgQ29ubmVjdGljdXRAaW5jcmFuc29t"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["incransom"]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-04-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd878e8d6402365eca44315608969e76535fb4ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B53B3A3D-6AB9-0CE0-2682-29151C9BDE11"},"incident_date":"2025-04-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"3e2647a2d40c","org_name":"Kering (Gucci, Balenciaga, Brioni, Alexander McQueen)","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-23","discovered_date":"2024-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"989d3f61ef0a9b5dc544e850ffa00dd08086adef","impact_type":"data_theft","incident_date":"2024-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CUPA%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"313721fe68d2","org_name":"Cambridge University Press & Assessment","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601784"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CUPA%20-%20California%20Notification.pdf"}],"summary":"Cambridge University Press & Assessment identified suspicious activity in a network segment of its Australian subsidiary and found that an unauthorized party accessed data including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"290ec4619f57675ae4b9796972187b4957194a7f","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amex%20-%20Sample%20Customer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Co., Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601790"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amex%20-%20Sample%20Customer%20Letter.pdf"}],"summary":"American Express reported that some personal information was inadvertently disclosed to an unauthorized third party on February 19, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"541799427144b957e990ee1fd8714d568e57e6e4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/OnsiteMammography.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f2ba1074258","org_name":"Onsite Mammography","org_type":"unknown","ransomware":null,"records_affected":6925,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/OnsiteMammography.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"44d6052899d8a3941056c96f4033aeacb35cbeda","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cecd1b801707","org_name":"Icon Family Healthcare LLC","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-22-icon-family-healthcare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-22","discovered_date":"2025-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"753346604c4f4af2edb4169f8bfc75f4dc2de38b","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e57d0f0fa3a6","org_name":"Dallas School District 2","org_type":"unknown","ransomware":null,"records_affected":2132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dallas%20School%20District%202-2025-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-22","discovered_date":"2025-04-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc2ccaa18012961b4a001696c3e9a4ad512d0809","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a76435117ee0","org_name":"Dallas School Dallas","org_type":"unknown","ransomware":null,"records_affected":2132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dallas%20School%20Dallas-2025-04-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb1dd07f82921bd748d6a6da20a958981e37a424","impact_type":"data_theft","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33076.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b033c68991bd","org_name":"Kelly & Associates Insurance Group","org_type":"professional_services","ransomware":null,"records_affected":5640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33076.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33076.pdf"}],"summary":"Kelly & Associates Insurance Group determined that unauthorized access occurred in December 2024 and that files containing personal information were copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-21","discovered_date":"2025-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f446a020af726d2087e27a063db99352aba9ed9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33071.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6f014522165e","org_name":"Grant County Public Utility District No. 2","org_type":"government","ransomware":null,"records_affected":850,"reviewed":false,"root_cause":"Files containing personal information were inadvertently sent to an individual outside the organization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33071.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33071.pdf"}],"summary":"Grant County Public Utility District No. 2 reported that files containing employees’ personal information were inadvertently sent to an individual outside the organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-21","discovered_date":"2024-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dc19dd9db94b4c5e565368e74ac19df72c03348","impact_type":"data_theft","incident_date":"2024-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Allied%20Telesis%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"243d853531eb","org_name":"Allied Telesis, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601709"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Allied%20Telesis%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33074.pdf"}],"summary":"Allied Telesis determined that an unauthorized actor accessed certain systems and removed files between April 30 and May 20, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3bab3807b602394299fba16104cd764a074bc4a1","impact_type":"data_theft","incident_date":"2025-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33042.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a011c790067a","org_name":"Compare.com Insurance Agency, LLC","org_type":"financial","ransomware":null,"records_affected":1752,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33042.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33042.pdf"}],"summary":"Compare.com reported that an unauthorized third party accessed its system and took files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ea2abcc5713c981570904395deb2498ba4c0aed","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20CA%20-%2090%20Degree%20Benefits%20-%20MN_0.pdf"},"notes":null,"org_country":"US","org_id":"de285f4bf1c3","org_name":"90 Degree Benefits","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601612"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20CA%20-%2090%20Degree%20Benefits%20-%20MN_0.pdf"}],"summary":"An unauthorized actor accessed a 90 Degree Benefits employee’s email account and certain emails and attachments containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d6104cbfd28f132c4d99dcc39800a7aa621ab285","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33710.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"09d431fad33d","org_name":"Nth Degree Investment Group","org_type":"unknown","ransomware":null,"records_affected":741,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nth%20Degree%20Investment%20Group-2025-06-25"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33710.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604519"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601565"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9eb2658cf71873a8470697dc5426c679c3f0f5bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-20","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33035.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"231ab2204bea","org_name":"Behavioral Health Resources","org_type":"healthcare","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33035.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33035.pdf"}],"summary":"Behavioral Health Resources reported that an unauthorized actor accessed systems containing information including names, but the investigation found no evidence the information was viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cbe7b1d64ae177c13f781ecd5dbbe0aea1ad7bb","impact_type":"data_theft","incident_date":"2024-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JKI%20-%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b0ae9fe91877","org_name":"Jani-King International","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601515"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JKI%20-%20Consumer%20Notice%20Letter.pdf"}],"summary":"Jani-King International reported that an unauthorized third party accessed and copied files containing personal information from its internal systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a318ccc0da9442a05ef01b6c5414d24f52b96757","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c19b14197f6b","org_name":"HEALTH AND WELLNESS OF TEXAS","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-16-health-and-wellness-of-texas"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record","Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ea11cd2724d8644e169cc5934f069005b4b2e74","impact_type":"data_theft","incident_date":"2025-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20-%20Vanni%20Humphrey_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7ea8e0db58ac","org_name":"Vanni & Humphrey","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20-%20Vanni%20Humphrey_Redacted.pdf"}],"summary":"An unauthorized third party accessed and downloaded documents from Vanni & Humphrey’s SmartVault client portal.","supporting_quote":null,"technology_involved":["SmartVault"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33d2b4961e0b88d50de5afceb61ba250516a09d0","impact_type":"unknown","incident_date":"2024-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"26709a9f95ed","org_name":"Minyard Morris LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601469"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%20Letter.pdf"}],"summary":"Minyard Morris LLP notified affected people of an incident and offered credit monitoring and identity protection services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a75e92fa1c219a4d28e44218666a44888044eb32","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/HT-Customer_Letter-Redacted%20Proof_Redacted1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0833785c434c","org_name":"Home Telecom","org_type":"unknown","ransomware":null,"records_affected":55763,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/HT-Customer_Letter-Redacted%20Proof_Redacted1.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"7aede987f52c9ee403ed3f36b1d02c22e4df9b61","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33013.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"538cd13e3452","org_name":"City of Long Beach","org_type":"government","ransomware":null,"records_affected":983,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20City%20of%20Long%20Beach%2C%20CA-2025-04-14"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33013.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Long%20Beach%20-%20Adult%20SSN%20%28CA%29%20Proof%20%28REDACTED%29.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33013.pdf"}],"summary":"The City of Long Beach reported that an unauthorized actor accessed its network and that files containing personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"medusa","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"272b3e3e7eb0bb10e091a03a70ead936e7f0c64d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ef9014dcf250","org_name":"Bell Ambulance, Inc.","org_type":"healthcare","ransomware":true,"records_affected":237830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-14-bell-ambulance-inc"},{"fetched_at":null,"title":"Leak-site claim by medusa","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/QmVsbCBBbWJ1bGFuY2VAbWVkdXNh"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"medusa","claim_groups":["medusa"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6debcab496c3da30fda1131a25ba75f332f09cd","impact_type":"data_theft","imported_from":null,"incident_date":"2025-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"16916c889c24","org_name":"Samsung Germany","org_type":"manufacturing","ransomware":null,"records_affected":216333,"reviewed":false,"root_cause":"The breach was allegedly caused by credentials obtained by malware running on a Spectos employee's machine.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Samsung Germany Customer Tickets","type":"hibp","url":"https://haveibeenpwned.com/Breach/SamsungGermany"}],"summary":"Data from Samsung Germany, including customer contact, purchase, shipping, and support-ticket information, was compromised in a breach involving its logistics provider Spectos.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Spectos"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"45dfbc045fa4","name":"Spectos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c5e7023954cfa54a2666dfe74bea5b8a124f8826","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32999.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e189cd4b1c8c","org_name":"Whitman County Public Hospital District No. 3","org_type":"unknown","ransomware":null,"records_affected":48174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32999.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-11","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00d7ce4bf81d6999ab4cb20de7c45c5834596172","impact_type":"data_theft","incident_date":"2025-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01%20Individual%20Notice%20Letter%20-%20US%20Claims_v2__Static_Proof_R4.pdf"},"notes":null,"org_country":"US","org_id":"ac73371c7be8","org_name":"US Claims Capital, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601331"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01%20Individual%20Notice%20Letter%20-%20US%20Claims_v2__Static_Proof_R4.pdf"}],"summary":"US Claims Capital reported that an unauthorized individual may have acquired personal information during suspicious activity discovered on January 7, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-11","discovered_date":"2025-02-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"603b406db51bc82a140e8fdd78015d2be245f129","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PDF%20-%20CA%20Notice%20Letter%20-%204-11-25.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"e5e20b47189e","org_name":"The Hertz Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited zero-day vulnerabilities in Cleo’s file transfer platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601348"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PDF%20-%20CA%20Notice%20Letter%20-%204-11-25.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Hertz%20Corporation%2C%20on%20behalf%20of%20Hertz%2C%20Dollar%2C%20and%20Thrifty-2025-04-11"}],"summary":"Hertz reported that an unauthorized third party acquired data by exploiting zero-day vulnerabilities in Cleo’s file transfer platform.","supporting_quote":"On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleo’s platform in October 2024 and December 2024.","technology_involved":["Cleo file transfer platform"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Cleo"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bcec34a18960","name":"Cleo"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"add2d65c1063357520dae56b8ca611461d619e6f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eceea359a0bf","org_name":"The Gatesworth Senior Living St. Louis","org_type":"healthcare","ransomware":null,"records_affected":31124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-11-the-gatesworth-senior-living-st-louis"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a894a374c03d43807d24802220be23db634a03ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"001bec005b7e","org_name":"Summit Healthcare Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":1861,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-11-summit-healthcare-medical-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ed43193894757f45d27a60ddb5449dfeff727a13","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a618596438fc","org_name":"Parc Provence Memory Care Facility","org_type":"healthcare","ransomware":null,"records_affected":13954,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-11-parc-provence-memory-care-facility"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-11","discovered_date":"2025-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccaa76b909da587744fcc9fc00b8d844091cc093","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice%20%28Version%201%29.pdf"},"notes":null,"org_country":"US","org_id":"d82548f6e74b","org_name":"Lemonade, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601295"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice%20%28Version%201%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32981.pdf"}],"summary":"Lemonade reported that driver’s license numbers were likely exposed through a vulnerability in its Online Flow.","supporting_quote":null,"technology_involved":["Online Flow"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-11","discovered_date":"2024-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c85b14433ef90f10e2a42a5754778d4f53967a48","impact_type":"both","incident_date":"2024-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32996.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c62ee73b5172","org_name":"Landmark Admin, LLC","org_type":"professional_services","ransomware":null,"records_affected":11691,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32996.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32996.pdf"}],"summary":"Landmark Admin detected suspicious activity, and its investigation found unauthorized access, data encryption, and exfiltration.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-04-11","discovered_date":"2025-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"9637c6041185df8d7a0d5138b6caea102f52332b","impact_type":"data_theft","incident_date":"2025-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Endue%20Software%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"de8d42318663","org_name":"Endue Software","org_type":"professional_services","ransomware":null,"records_affected":118028,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-11-endue-software"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Endue%20Software%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed Endue Software systems and copied files containing personal and medical information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-04-11","discovered_date":"2025-02-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7605b5f9c9d70df52027e832fc27de07d263175","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0f9ff60146a4","org_name":"Dallas County MHMR","org_type":"healthcare","ransomware":null,"records_affected":542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004227"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb35ee7dde206d96e9a8224b9e8910b7255429dd","impact_type":"unknown","incident_date":"2024-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chicano%20Federation%20of%20San%20Diego%20County%20Notifies%20Affected%20Individuals%20of%20Information%20Security%20Incident%2835971564.1%29.pdf"},"notes":null,"org_country":"US","org_id":"fa34ad9f3ae5","org_name":"Chicano Federation of San Diego County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601333"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chicano%20Federation%20of%20San%20Diego%20County%20Notifies%20Affected%20Individuals%20of%20Information%20Security%20Incident%2835971564.1%29.pdf"}],"summary":"The Chicano Federation of San Diego County reported unauthorized access to its network and an employee email account during the stated date ranges.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c85f0ace3999c961f2dd5d021f8aefa901bf6a19","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"951690321f90","org_name":"Altior Healthcare, LLC","org_type":"healthcare","ransomware":null,"records_affected":1002,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-11-altior-healthcare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce0749129fa747e4199943d70bdca02b1099a4cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-23","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32977.pdf"},"notes":null,"org_country":"US","org_id":"448c347f6bea","org_name":"VetCT","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":"A successful phishing attempt provided access to a VET.CT Gmail account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#VetCT-2025-04-10"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32977.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32977.pdf"}],"summary":"VetCT reported that a phishing attempt gave an external person access to a Gmail account containing emails with personal information.","supporting_quote":"An external person gained access to a single VET.CT Gmail account on 23rd March 2025 and we believe that this was almost certainly as a result of a successful phishing attempt.","technology_involved":["Gmail"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-10","discovered_date":"2025-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2dba865a3f86dee9da57cec4a5cb8660fee63220","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ELN-24803%20Skyward%20Specialty%20Insurance%20Adult%20No%20CM%20r1prf-c.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c2a51f539c16","org_name":"Skyward Specialty Insurance Group","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":"A miscalibration in the database settings made documents publicly discoverable.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ELN-24803%20Skyward%20Specialty%20Insurance%20Adult%20No%20CM%20r1prf-c.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ELN-24803%20Skyward%20Specialty%20Insurance%20Adult%20No%20CM%20r1prf-c.pdf"}],"summary":"Skyward Specialty discovered that documents in a misconfigured database were publicly discoverable and reviewed them for personal information.","supporting_quote":"Skyward Service determined that this was made possible due to a miscalibration in the database settings.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-04-10","discovered_date":"2024-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1b90e42a504537a3722e0f7e3ab513789ad46bb","impact_type":"data_theft","incident_date":"2024-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NHPMG%20Exhibit%205.01%20-%20Adult%20Notification%20Letter%20V.2.pdf"},"notes":null,"org_country":"US","org_id":"dfc34eba2f08","org_name":"Newport Harbor Pathology Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NHPMG%20Exhibit%205.01%20-%20Adult%20Notification%20Letter%20V.2.pdf"}],"summary":"Newport Harbor Pathology Medical Group reported that an unauthorized actor potentially viewed and copied personal and medical information from its environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"e3335dacc61a84af458f1d8f53169759b6f45764","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Kelly%20and%20Associates.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"21a16cc968d4","org_name":"Kelly & Associates Group, Inc","org_type":"professional_services","ransomware":null,"records_affected":5793,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Kelly%20and%20Associates.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Kelly%20and%20Associates.pdf"}],"summary":"Kelly & Associates Group found that unauthorized access occurred between December 12 and December 17, 2024, and that files containing personal information were copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2d0959fe37663123ac4ed10c35bf864c6f195c85","impact_type":"both","imported_from":null,"incident_date":"2025-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"1a7b9cc98c20","org_name":"Sensata Technologies Holding plc","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1477294/000147729425000047/st-20250406.htm"},{"fetched_at":null,"title":"8-K EX-99.1 - PRESS RELEASE","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1477294/000147729425000065/q125pressrelease.htm"}],"summary":"Sensata Technologies reported a ransomware incident that encrypted devices, temporarily disrupted operations, and involved files being taken from its environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"price":{"ticker":"ST","base_day":"2025-04-09","returns":{"1":{"day":"2025-04-10","raw":-0.069,"adj":-0.0251},"5":{"day":"2025-04-16","raw":-0.0819,"adj":-0.04},"21":{"day":"2025-05-09","raw":0.2237,"adj":0.195},"63":{"day":"2025-07-11","raw":0.533,"adj":0.3963},"126":{"day":"2025-10-09","raw":0.5077,"adj":0.2843},"250":{"day":"2026-04-09","raw":0.853,"adj":0.6137}}}}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"905d78d7fa7f99d3103c130d26222e4aff0f4267","impact_type":"data_theft","imported_from":null,"incident_date":"2021-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ID","org_id":"2f80dca803c6","org_name":"Qraved","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Qraved","type":"hibp","url":"https://haveibeenpwned.com/Breach/Qraved"}],"summary":"Qraved suffered a data breach in July 2021 in which email addresses, names, phone numbers, dates of birth, and MD5-hashed passwords were exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47a9d9f12365e0fb81cdaebcc7990ca34335e7e2","impact_type":"unknown","incident_date":"2024-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Omni%20Healthcare%20-%20Notice%20Letter%20Template%2012%20months%20%28final%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9db76523d29a","org_name":"Omni Healthcare Financial Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601206"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-04-09","discovered_date":"2025-03-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fbac4105c6b0394a857963cda2ad40945f2deff0","impact_type":"data_theft","incident_date":"2024-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32969.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"55e0d53c0d2d","org_name":"Lee Valley Tools, Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2882,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32969.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32969.pdf"}],"summary":"Lee Valley Tools reported that an unauthorized third party captured credit card information entered on its website between October 8, 2024, and March 12, 2025.","supporting_quote":null,"technology_involved":["website","cloud server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-04-09","discovered_date":"2025-03-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f7106507a404f4c82912968c43f89885dbb1aa","impact_type":"data_theft","incident_date":"2024-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20template.pdf"},"notes":null,"org_country":"US","org_id":"55e0d53c0d2d","org_name":"Lee Valley Tools, Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601179"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lee%20Valley%20Tools-2025-04-09"}],"summary":"An unauthorized third party captured credit card information entered on Lee Valley Tools’ website between October 8, 2024, and March 12, 2025.","supporting_quote":null,"technology_involved":["cloud server","website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-04-09","discovered_date":"2024-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37aea7dc01c66cf13d24a481c8a7e7b761f525d4","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LSC%20Website%20Notice%20-%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"831eafd755e3","org_name":"Laboratory Services Cooperative","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601185"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LSC%20Website%20Notice%20-%20Notice%20of%20Data%20Breach.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Laboratory%20Services%20Cooperative-2025-04-10"}],"summary":"Laboratory Services Cooperative identified unauthorized access to its network and removal of files that may have contained patient and worker-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"49604e9fdea7d97de8dd8a3714d52719ca405832","impact_type":"data_theft","incident_date":"2024-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kelly%20Benefits%20-%20Sample%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b033c68991bd","org_name":"Kelly & Associates Insurance Group","org_type":"professional_services","ransomware":null,"records_affected":553332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-09-kelly-associates-insurance-group-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kelly%20Benefits%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kelly%20%26%20Associates%20Insurance%20Group%2C%20Inc.-2025-04-21"}],"summary":"Kelly & Associates Insurance Group reported unauthorized access to its environment and the copying and removal of files containing personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b82580ceb9e4d565115848f0b810a27c3c93bce","impact_type":"unknown","incident_date":"2023-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/250328001%20Breach%20Notice_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601161"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-04-08","discovered_date":"2024-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20a6b5a8aad9696f95e65d1eda9b32f5ca7ebb0e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/12%20Month%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"8a96054dbc06","org_name":"VectraRx LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/12%20Month%20Proof.pdf"}],"summary":"VectraRx reported that an unauthorized actor may have viewed and copied data stored on a VectraRx-operated server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05d72fb6b850515ede5b692f8610394f33497e51","impact_type":"data_theft","incident_date":"2023-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eisner%20Advisory%20Group%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7cdd2070714f","org_name":"Eisner Advisory Group LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eisner%20Advisory%20Group%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eisner%20Advisory%20Group%20LLC-2025-04-08"}],"summary":"Eisner Advisory Group LLC reported that an unknown actor accessed and acquired certain files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39ade90528ea4eda02f6107625208e46d8cc7849","impact_type":"unknown","incident_date":"2024-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Chatsworth%20Products%2C%20Inc.%20-%20Exhibit%20A_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a3277d6896e","org_name":"Chatsworth Products, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601131"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08b7aa35747097510355ca0db53a1dc92aa02d54","impact_type":"data_theft","imported_from":null,"incident_date":"2024-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"f8416fdc2984","org_name":"Boulanger","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Boulanger","type":"hibp","url":"https://haveibeenpwned.com/Breach/Boulanger"}],"summary":"Boulanger customer data, including email addresses, names, contact details and location data, was exposed and later published on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-08","discovered_date":"2024-09-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a2229c5ff35f46a0ced940ccb42b074db6c0c27","impact_type":"data_theft","incident_date":"2024-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AACOM%20-%20Regulator%20Letter_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9f0dc324788c","org_name":"American Association of Colleges of Osteopathic Medicine","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601144"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AACOM%20-%20Regulator%20Letter_CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Association%20of%20Colleges%20of%20Osteopathic%20Medicine-2025-04-08"}],"summary":"The organization discovered unusual activity associated with an employee email account, and its investigation found that certain emails or attachments may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e73ac731210193a94166d36388adcf9b55903fdc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a67e0df7576f","org_name":"Alabama Ophthalmology Associates","org_type":"healthcare","ransomware":null,"records_affected":131576,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-08-alabama-ophthalmology-associates"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-07","discovered_date":"2024-10-31","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b88cb01a4f565b7c105f70150a42c2f76d165495","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32947.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cf44820e87f9","org_name":"Ulrich Consulting & Investment Group, LLC","org_type":"financial","ransomware":null,"records_affected":533,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32947.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32947.pdf"}],"summary":"Ulrich Consulting & Investment Group discovered unauthorized access to an employee email account, and personal information may have been accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-07","discovered_date":"2024-12-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05ace4dcdda4e72993a119cac9f3d168884cb43d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SFCJL%20-%20CA%20AG%20Notice%28311196318.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"bc647f682118","org_name":"San Francisco Campus for Jewish Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601065"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SFCJL%20-%20CA%20AG%20Notice%28311196318.1%29_0.pdf"}],"summary":"San Francisco Campus for Jewish Living reported unauthorized access to an employee email account, where personal information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-04-07","discovered_date":"2024-10-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c569c078f905510bbe90ad1300b0a66fb9b700cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32948.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b6f1f3e2feb8","org_name":"Benefits Partner, LLC","org_type":"professional_services","ransomware":null,"records_affected":1315,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32948.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32948.pdf"}],"summary":"Benefits Partner, LLC identified suspicious activity in an employee’s email account and found unauthorized access to it on October 9, 2024.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f894f6c168900f901047e00ac042d2e8d775694d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67C6A1E7-CE56-D3D6-FA74-8AB6D9AF3FD7"},"incident_date":"2025-04-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"2bee37fa839e","org_name":"Aeromexico","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-04-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63bd25e14bec3ea55a50fccb9481b6ae05fb1881","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20-%20VF%20Sample%20Consumer%20Notice%20Letter%20%28CA%29%20-%20April%202025.pdf"},"notes":null,"org_country":"US","org_id":"8439f2c883a4","org_name":"VF Outdoor, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker used credentials obtained from another source to access an account on the website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20-%20VF%20Sample%20Consumer%20Notice%20Letter%20%28CA%29%20-%20April%202025.pdf"}],"summary":"VF Outdoor, LLC reported that an attacker used credentials obtained from another source in a credential-stuffing attack against its website, potentially accessing account information.","supporting_quote":"Based on our investigation, we believe that the attacker previously gained access to your email address and password from another source (not from us) and then used those same credentials to access your account on our Website.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-04","discovered_date":"2025-03-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"09d2199b09982c23ddd16f439d66fd3e3e93fd64","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6010b6d00c3","org_name":"Port Orford-Langlois SD 2CJ","org_type":"unknown","ransomware":null,"records_affected":359,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Port%20Orford-Langlois%20SD%202CJ-2025-04-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"746443c914258ec0a5f66ef4e8f67ea4f780ae39","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"70a3c957fc82","org_name":"Newburgh Healthcare Residential Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-04-newburgh-healthcare-residential-center-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-04","discovered_date":"2025-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14e8a96641aaa4c507da3db77e816d5a0a153580","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Security%20Letter%20Final.pdf"},"notes":null,"org_country":"US","org_id":"902fb4ff8353","org_name":"Mission Bell Mfg Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600915"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Security%20Letter%20Final.pdf"}],"summary":"Mission Bell Mfg Inc reported unauthorized access to certain personal information, including potentially Social Security and driver's license numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"05337e06bb26b1067d67b75586a8d494e2817237","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0803a9af5bf8","org_name":"Loretto Hospital","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-04-loretto-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"medusa","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1af6e79abdfd41c6a075220aedfcc932db57632f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a54a7eb61fc","org_name":"Friendship House, Inc.","org_type":"healthcare","ransomware":true,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-04-friendship-house-inc"},{"fetched_at":null,"title":"Leak-site claim by medusa","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/RnJpZW5kc2hpcCBIb3VzZUBtZWR1c2E"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"medusa","claim_groups":["medusa"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-03","discovered_date":"2025-02-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6a12ca21082627d3e95ce9cffa5eb1f76d3788a0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e9b07985ee70","org_name":"Tokyo Electron U.S. Holdings","org_type":"unknown","ransomware":null,"records_affected":793,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tokyo%20Electron%20U.S.%20Holdings-2025-04-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2025-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0aba67dfb96a3a193ee9114f600cd3ff0fc9bd04","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32921.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa251f5d5595","org_name":"Port of Seattle","org_type":"unknown","ransomware":null,"records_affected":71939,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32921.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-03","discovered_date":"2025-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70c162ba4fdbe121c228c91e86c7e1be7217e106","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SampleNotice_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"3032ddfd8ee8","org_name":"Harcourts Prime Properties","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600857"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SampleNotice_0.pdf"}],"summary":"Harcourts Prime Properties reported a ransom demand on the Dark Web with sample Agent Information sheets and possible exposure of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f4aa37355f138169ec9063e29ea661ab122a42","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SoloPoint%20Solutions%20Sample%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"72a6bce03427","org_name":"SoloPoint Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SoloPoint%20Solutions%20Sample%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32877.pdf"}],"summary":"SoloPoint Solutions reported that an unknown third party accessed an internal server, and employee HR files containing personal and financial information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-02","discovered_date":"2024-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d03e8d214d2c80a5dafd83f904d90937162337b1","impact_type":"data_theft","incident_date":"2024-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rodl%20Management%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2a2a05420c13","org_name":"Rödl Management, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rodl%20Management%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Rödl Management, Inc. reported that an unauthorized actor accessed information in its systems between around January 30 and February 9, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-02","discovered_date":"2024-12-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa42da2069bc750e39056d7ffb14b14079c39053","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nevro%20Corp.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"52a22c1ef49f","org_name":"Nevro Corp.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600839"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nevro%20Corp.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Nevro reported that an unknown individual accessed some of its systems and may have taken information, including names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2025-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c8f91d666cebd53cbf6f9d215dca0aa849203c8a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32911.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9f99a4eb028","org_name":"Neltac, Inc.","org_type":"unknown","ransomware":null,"records_affected":2584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32911.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-04-02","discovered_date":"2024-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"44cbebb4f22f7c6bc54b135f922fae6c4003444f","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32909.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a36e69fec3d1","org_name":"Highline School District","org_type":"education","ransomware":true,"records_affected":92954,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32909.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32909.pdf"}],"summary":"Highline School District reported a ransomware incident in which an unknown actor accessed systems and files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-04-02","discovered_date":"2025-02-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1f8c1e45bff734ed1de24e0bd93927e66285fa0","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gilead_Consumer%20Notice%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"64d42d2e3ca4","org_name":"Gilead Sciences","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"1095-C tax forms were mailed with a shipping label that visibly included recipients' Social Security numbers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600828"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gilead_Consumer%20Notice%20Sample.pdf"}],"summary":"1095-C tax forms mailed by BDS displayed recipients' Social Security numbers in the shipping label.","supporting_quote":"On February 18, 2025, Trusaic discovered that BDS inadvertently mailed 1095-C tax forms containing visible personal information in the shipping label.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6ecc0d8248515e71eeae5e2df6bea56d5740bd67","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_Proof_35959696v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5688514836eb","org_name":"Dameron Hospital","org_type":"healthcare","ransomware":null,"records_affected":210706,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-02-dameron-hospital"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600811"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9f1a2c113a39160501eabe295a37eb09ea6c038c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05019e18cc45","org_name":"Allegany Council on Alcoholism & Substance Abuse, Inc.","org_type":"healthcare","ransomware":null,"records_affected":696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-02-allegany-council-on-alcoholism-substance-abuse-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fbdade0debb26299196ebc17309e57f9ea63be9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62666B4E-7964-42D8-8215-B17150C44AC3"},"incident_date":"2025-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"47137d5f7739","org_name":"Toppan Next Tech","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.frontier-enterprise.com/toppan-breach-exposes-supply-chain-risks-in-singapore/"}],"summary":"\"When news broke that Toppan Next Tech — a key print vendor for the Singapore Police Force, DBS Bank, Bank of China, and the Elections Department — had suffered a ransomware attack, it sent ripples through Singapore’s public and private sectors.\n\nAlthough the breach did not affec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c66f53a1615a0bf97e74365ad17cfe8849cf8cc6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8cefeb675792","org_name":"Health Services LLC","org_type":"healthcare","ransomware":null,"records_affected":75906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-01-health-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f1608d638ac473472358ceb990052484111d33f4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aeeaf89f4bb1","org_name":"Central District Health Department of Nebraska","org_type":"healthcare","ransomware":null,"records_affected":58519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-04-01-central-district-health-department-of-nebraska"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-04-01","discovered_date":"2025-01-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"54eeb2299186c2136066cab80ff473e040bd6d5d","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff1bffc4cc0e","org_name":"CDS in Texas","org_type":"financial","ransomware":null,"records_affected":566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004114"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"68ba99c72faf976b59fbbe92888d2ea81976c030","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0127d3eb7865","org_name":"Willamette Family, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-31-willamette-family-inc"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Willamette%20Family%2C%20Inc.-2025-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2211154afd50cc52ef93191b8ff6c57a3525b2a0","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted%20Notification%20Letter%20-%20Morton%20Golf_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b558329bdb89","org_name":"Morton Golf LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600645"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-03-31","discovered_date":"2024-09-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0c6520f5fe198379840d21575906d371a45f82c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32884.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ef48970cb13b","org_name":"Montana Health Solutions","org_type":"unknown","ransomware":null,"records_affected":619,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32884.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32884.pdf"}],"summary":"Montana Health Solutions reported that data potentially associated with an employee email account could have been viewed without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"649dccd9b28e1940c053e83e1795e84378c953e1","impact_type":"disruption_or_ransomware","incident_date":"2024-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-23777%20Laborers%20Local%201184%20Ad%20CM%20r2prf_0002.pdf"},"notes":null,"org_country":"US","org_id":"2776b7f2f752","org_name":"Laborers' International Union of North America, Local 1184","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600660"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-23777%20Laborers%20Local%201184%20Ad%20CM%20r2prf_0002.pdf"}],"summary":"An unauthorized third party accessed Local 1184’s computer system and infected it with ransomware; personal information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30e67bba4527d13e213f80a5dcda0a62178f245e","impact_type":"data_theft","incident_date":"2024-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DRAFT%20Notification%20Letter%20-%20First%20City%20Credit%20Unionrkn_Final_Live_Proof_R2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"380b4d3ca45f","org_name":"First City Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600664"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DRAFT%20Notification%20Letter%20-%20First%20City%20Credit%20Unionrkn_Final_Live_Proof_R2_Redacted.pdf"}],"summary":"First City Credit Union detected unauthorized access to part of its email environment, and personal information was likely compromised.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-31","discovered_date":"2024-11-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6af7b5ab936c754d8095a644aa736f92f32b7e56","impact_type":"data_theft","incident_date":"2024-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Exhibit%20A%20Ciuni%20%26%20Panichi%20Sample%20%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"3bc96042198d","org_name":"Ciuni & Panichi, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600657"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Exhibit%20A%20Ciuni%20%26%20Panichi%20Sample%20%20Notice%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ciuni%20%26%20Panichi-2025-04-28"}],"summary":"Ciuni & Panichi reported unauthorized activity in an employee email account and said information in accessed files may have been accessed by an unauthorized third party.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b69407c0e11ad25f7f8fa51f0da3e76026f672b1","impact_type":"data_theft","imported_from":null,"incident_date":"2025-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"da1b781a2a33","org_name":"German Doner Kebab","org_type":"retail_ecommerce","ransomware":null,"records_affected":162373,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: German Doner Kebab","type":"hibp","url":"https://haveibeenpwned.com/Breach/GermanDonerKebab"}],"summary":"Data allegedly sourced from German Doner Kebab was published on a hacking forum, and the company sent a disclosure notice to impacted individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2025-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58df0354fe135d3959f276aec877bb3da82abdb4","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UnitedDomestic_CA%20record%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7209804deaaf","org_name":"United Domestic Workers of America","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UnitedDomestic_CA%20record%20-%20Redacted.pdf"}],"summary":"United Domestic Workers of America reported an attempted unauthorized access to its servers, with some internal HR data potentially exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-28","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"896cb63250d4a409fa1a18a3ad48e062910b1e9e","impact_type":"data_theft","incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32866.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f4d87bfd1655","org_name":"Samaritan's Purse","org_type":"nonprofit","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32866.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32866.pdf"}],"summary":"An unauthorized person accessed a Lockton user account and computer and obtained files shared by Samaritan's Purse that contained employees' and dependents' personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Lockton Companies, LLC"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"b26a0edda2d9","name":"Lockton Companies, LLC"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac44a9c8601f25666f17bd480385dae69bde4680","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D86EDE3-C1FD-450F-AE67-BEDF1822447C"},"incident_date":"2025-03-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"1f7f11152eac","org_name":"Ocuco Ltd.","org_type":"healthcare","ransomware":null,"records_affected":240961,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/privacy-alert-ocuco-under-investigation-for-data-breach-of-over-240-000-patient-records-302506223.html"},{"fetched_at":null,"title":"Leak-site claim by killsec","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/T2N1Y29Aa2lsbHNlYw"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605301"}],"summary":"A data breach involving eye care technology provider Ocuco Ltd. has potentially compromised the personal and health information of customers who received eye exams or purchased eyewear at SpecSavers in Kelowna.\n\nThe breach, which occurred between March 28 and April 1, 2025, stemm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"claim_groups":["killsec"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9824ada4319afa8c34f7f72b4fb4838e70154b6","impact_type":"unknown","incident_date":"2024-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lyon%20Management%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e09b50824999","org_name":"Lyon Management Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600563"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lyon%20Management%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Lyon Management Group, Inc. reported that an unknown actor accessed certain systems and potentially copied files containing affected people’s information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"06af3488f453820a41689760b9ed32881b04b245","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"885ca0fefb4e","org_name":"Community Dental Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":134903,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-28-community-dental-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-28","discovered_date":"2024-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad61deb998c72e78d7e0d4462e9a003a9c4c7129","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/04%20No%20Credit%20Monitoring_CA_Member%20Notification%20Letter%20%282024-11-002904%29.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600565"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/04%20No%20Credit%20Monitoring_CA_Member%20Notification%20Letter%20%282024-11-002904%29.pdf"}],"summary":"A data mismatch may have allowed family members on the same plan to view health records through the Blue Shield Member Portal, but Blue Shield had no confirmation that the information was viewed.","supporting_quote":null,"technology_involved":["Blue Shield Member Portal","Member Health Record feature","health information exchange"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"health information exchange"},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5a0eb210142f144a5c6eb677f4cfca0b298bedd4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e38c4ace3d8f","org_name":"Baptist Hospitals of Southeast Texas","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-28-baptist-hospitals-of-southeast-texas"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-27","discovered_date":"2025-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4908cb621a512dfd057ea85fbc57b28a65bd9991","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ActVnet%20-%20Parent%20Data%20Breach%20Notice%20-%20March%202025%20-%20English_0%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"db2fd56ac3bc","org_name":"Riverdale Joint Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ActVnet%20-%20Parent%20Data%20Breach%20Notice%20-%20March%202025%20-%20English_0%20%281%29.pdf"}],"summary":"A TCOE staff member inadvertently emailed Riverdale Joint Unified School District staff and student information to two staff members of another district.","supporting_quote":"A member of their staff inadvertently distributed a list of Fipps Primary School and Central Valley Preschool staff and student information to two staff members of Lone Pine Unified School District.","technology_involved":["ActVnet","email"],"third_party":{"archetype":null,"involved":true,"vendor":"Tulare County Office of Education"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"74a73fc36712","name":"Tulare County Office of Education"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8be35c68fc4b29b2a8e19d6029fad1cf1c5cd35e","impact_type":"both","incident_date":"2025-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pac%20Res%20Notice%20Letter%20Form.pdf"},"notes":null,"org_country":"US","org_id":"3a4d9905acfc","org_name":"Pacific Residential Mortgage, LLC","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pac%20Res%20Notice%20Letter%20Form.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20Residential%20Mortgage%2C%20LLC-2025-03-26"}],"summary":"Pacific Residential Mortgage detected a ransomware lockdown on February 10, 2025, and determined that personal and financial information may have been impacted or accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0487122e1b759959c97d3e82d26bcbdf3789c38a","impact_type":"data_theft","incident_date":"2024-03-09","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28Lee%20University%29%20-%20Consumer%20Notice%20Letter%20-%20General_CM_V02__Static_Proof_R2.pdf"},"notes":null,"org_country":"US","org_id":"3464cb6976d6","org_name":"Lee University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party software vulnerability impacted the university's local systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28Lee%20University%29%20-%20Consumer%20Notice%20Letter%20-%20General_CM_V02__Static_Proof_R2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lee%20University-2025-03-25"}],"summary":"Lee University said a third-party software vulnerability impacted its local systems and some university data may have been downloaded.","supporting_quote":"In March 2024, we experienced a security incident that impacted our local systems through a third-party software vulnerability.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5be8040b9f2841a6f3744710c1fda796d05b11f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32831.pdf"},"notes":null,"org_country":"US","org_id":"a5d2c7369624","org_name":"Humana Insurance ACE","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32831.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32831.pdf"}],"summary":"Humana Insurance ACE reported unauthorized access to certain email accounts between November 5 and November 21, 2024, involving files that included names.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-25","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31eefd7348bf2d0744b63d4b1f5dff4cc552375","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"778dbd446489","org_name":"Troy Hunt","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Troy Hunt's Mailchimp List","type":"hibp","url":"https://haveibeenpwned.com/Breach/TroyHuntMailchimpList"}],"summary":"A phishing attack accessed Troy Hunt's Mailchimp account and exported subscriber data, including email addresses and location information.","supporting_quote":"In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog .","technology_involved":["Mailchimp"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Mailchimp"},"updated_at":null,"veris_action":"social","derived":{"vendors":[{"id":"a954740ee08e","name":"Mailchimp"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"13ffee679ba81da763e7b01661b8149e838a2a7b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0431048c101","org_name":"James J. Lynch, MD Ltd. dba Swift Institute","org_type":"healthcare","ransomware":null,"records_affected":13430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-25-james-j-lynch-md-ltd-dba-swift-institute"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-25","discovered_date":"2024-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16849b9a872245aa67f0b4714348fe2cffe39007","impact_type":"both","incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lassen%20Clinics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"1311b1534cb8","org_name":"Dignity Health Lassen Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600355"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lassen%20Clinics%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized third party accessed Lassen Clinics’ systems, temporarily disrupting its IT network and obtaining copies of files containing confidential patient medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17dfad1d623f33837feabedad77a22cef81b27e0","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crossroads%20-%20Template%20Individual%20Notice%20%28California%29.pdf"},"notes":null,"org_country":"US","org_id":"40707ffc1de1","org_name":"Crossroads Trading Co., Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600342"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crossroads%20-%20Template%20Individual%20Notice%20%28California%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Crossroads%20Trading%20Co.%2C%20Inc.-2025-03-25"}],"summary":"An unauthorized third party accessed a Crossroads server and encrypted data stored on the company’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2fc269bb87c7f704c367e10a0122f9378ef4bb46","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8539b26eb974","org_name":"Bigfork Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":8496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-25-bigfork-valley-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-24","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3485e57ac04fe52787762c575d183616bb5d540","impact_type":"data_theft","imported_from":null,"incident_date":"2024-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_6.pdf"},"notes":null,"org_country":"US","org_id":"569e68d00cca","org_name":"Word & Brown Insurance Administrators","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600323"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_6.pdf"}],"summary":"Word & Brown identified unauthorized access to an employee’s workstation, and certain files containing names and other information were downloaded to an external server.","supporting_quote":null,"technology_involved":["workstation"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-24","discovered_date":"2025-02-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8f5084a6990718f103c597c1c1994f00e31d088","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/D%26S%20Notice%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"3600db763c28","org_name":"D&S Insurance Agency, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600331"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/D%26S%20Notice%20Proof.pdf"}],"summary":"D&S Insurance Agency reported that an unauthorized individual accessed two employee email accounts, and files containing personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a754092bb6729d464e12d8c154e6b4a1641476c9","impact_type":"unknown","incident_date":"2023-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample_SJCM_Adult_SSN_redacted_35902409v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90d41ddb9dc9","org_name":"St. Joseph’s College of Maine","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600250"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Joseph%E2%80%99s%20College%20of%20Maine-2025-03-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-21","discovered_date":"2024-07-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d302faacb643e09a43a3ff3c6a6db22bcac8b974","impact_type":"both","incident_date":"2024-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32773.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"818f2a4490f7","org_name":"Prosser School District","org_type":"education","ransomware":null,"records_affected":963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32773.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32773.pdf"}],"summary":"Prosser School District reported that an unknown actor accessed its systems, copied files, and malware encryption affected certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d13c8c72e0de1960c753dcafca44c2c82131e57c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Monro%2C%20Inc.%20-%20Notice%20Under%20CA%20s.%201798.82%20-%203.21.2025.pdf"},"notes":null,"org_country":"US","org_id":"a5c5ae6206d6","org_name":"Monro, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600257"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monro%2C%20Inc.%20-%20Notice%20Under%20CA%20s.%201798.82%20-%203.21.2025.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/MonroInc.pdf"}],"summary":"Monro reported that an unauthorized actor accessed an employee’s electronic mailbox and selected files, potentially affecting personal and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8c85d9769c77d311702255ae544e1dbfa7c72b74","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e2960e42160d","org_name":"Mid Florida Primary Care, PA","org_type":"healthcare","ransomware":null,"records_affected":16435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-21-mid-florida-primary-care-pa"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"80460d05eb3913732735820ed7083e4a2bb5b2b8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8de5a6e8488a","org_name":"MedRevenu, LLC","org_type":"professional_services","ransomware":null,"records_affected":17775,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-21-medrevenu-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c1df66c526cdf7ddc6a7deb6003ac92384847e5b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b6172351ba3","org_name":"MedicareCompareUSA","org_type":"professional_services","ransomware":null,"records_affected":5782,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-21-medicarecompareusa"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-21","discovered_date":"2024-10-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0c1c2aeced5b585b7af15bb851ada68e22e509e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32774.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f76f70b3a07f","org_name":"Issaquah Financial","org_type":"financial","ransomware":null,"records_affected":795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32774.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32774.pdf"}],"summary":"An unauthorized actor logged into an Issaquah Financial employee email account, but the investigation could not confirm whether client information was viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8ecb4ce6a2b07064e0ecb2b8cc29d2e9e2ab50c7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9350a27ad3b","org_name":"Fyzical Acquisition Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":43045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-21-fyzical-acquisition-holdings-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b6bc959e62e738dd7ce52fb2c3fdd3c1ed677dee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06c1f0e59d6b","org_name":"AmeriHealth Caritas Louisiana","org_type":"healthcare","ransomware":null,"records_affected":1552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-21-amerihealth-caritas-louisiana"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server","Other"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"f3ba54751cc49d0dbfe90af9d17461e2403a0966","impact_type":"data_theft","incident_date":"2024-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33412.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a8bec84aae0d","org_name":"ALN Medical Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":7587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33412.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603176"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600260"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Supplemental%20Notice%20of%20Data%20Event%20-%20ALN%20Medical%20Management%20%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33412.pdf"}],"summary":"ALN Medical Management reported that an unauthorized actor accessed or took files and folders in a third-party hosted environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-20","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"55f5534cbc6bbf608db06e632dba3b087ac64d82","impact_type":"data_theft","incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32758.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8ccd4f1705d4","org_name":"Southeast Series of Lockton Companies, LLC","org_type":"professional_services","ransomware":null,"records_affected":11794,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Southeast%20Series%20of%20Lockton%20Companies%2C%20LLC%20%28%E2%80%9CLockton%E2%80%9D%29-2025-03-20"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32758.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32758.pdf"}],"summary":"Lockton reported that an unauthorized party accessed an individual account and computer and obtained files containing personal information.","supporting_quote":null,"technology_involved":["individual account","computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19910f97a74dbf70af4e711fc05d4128b9055fd4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OrthoMinds%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"},"notes":null,"org_country":"US","org_id":"cdaf59817c83","org_name":"OrthoMinds, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600173"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OrthoMinds%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"}],"summary":"OrthoMinds reported that files and folders on certain databases may have been accessible to people outside the organization between November 17 and November 27, 2024.","supporting_quote":null,"technology_involved":["databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"251a08178689758182a4146ce555dbd5f48e2708","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LFCU%20-%20Adult%201%20YR%20CM%20%281%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"22fbfdd27c07","org_name":"Lafayette Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605396"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600147"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LFCU%20-%20Adult%201%20YR%20CM%20%281%29_Redacted.pdf"}],"summary":"An unauthorized third party accessed an employee email account and may have acquired personal information contained in it.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"732c5ef2f8632c1fd1170c3c483a0e767a539a9e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keeco%20CA%20Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"bc4f27b7c5ac","org_name":"Keeco Home, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keeco%20CA%20Notice%20Letter%20Sample.pdf"}],"summary":"Keeco Home reported unauthorized access to its system between March 28 and May 19, 2024, and found that a document contained information about the recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-20","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"998790369446c50c5b37ac83cb210a4829e0bf3f","impact_type":"unknown","incident_date":"2024-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"483c0e75d143","org_name":"Culver School District No. 4","org_type":"unknown","ransomware":null,"records_affected":981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Culver%20School%20District%20No.%204-2025-03-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b6b0fb463562a389647374401a7116b8cf6aba9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSG%20Notification%20Letter%28281135093.2%29_v3%20%28Print%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"c96c0201ea86","org_name":"CSG Consultants, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600170"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSG%20Notification%20Letter%28281135093.2%29_v3%20%28Print%20Proof%29.pdf"}],"summary":"CSG Consultants reported that an unauthorized user accessed its system and that personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2aae23ad37379bc140031703e2d7d4842bc56c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vista%20Point%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"25db510709e7","org_name":"Vista Point Mortgage, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vista%20Point%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Vista Point Mortgage discovered suspicious activity involving two employees’ email accounts, which contained personal information accessed without authorization.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"848c452ab185554be1fe06bd37c15df93e544d82","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"107f7b93d52d","org_name":"SpyX","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SpyX","type":"hibp","url":"https://haveibeenpwned.com/Breach/SpyX"}],"summary":"A June 2024 data breach at SpyX exposed email addresses, device and location information, PINs, and iCloud credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-19","discovered_date":"2024-08-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b01a2b3da3ce735ac38fea2de3d7c0f7c2db942f","impact_type":"unknown","incident_date":"2024-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OBI%20Seafoods_Adult%20CM%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"97dd0ef0c36e","org_name":"OBI Seafoods, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OBI%20Seafoods_Adult%20CM%20Notification%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OBI%20Seafoods%2C%20LLC-2025-03-19"}],"summary":"OBI Seafoods reported a security incident affecting part of its environment, with information relating to current and former workers and vendors potentially involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8d22cc1cc00738b906f513221f1a6eab4307c3fe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5517762c9847","org_name":"Millennium Home Health Care","org_type":"healthcare","ransomware":null,"records_affected":4743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-19-millennium-home-health-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Puppygirl Hacker Polycule","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"770871092e39fd687001998bb83b36c2f53c2234","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"db43365f9f5b","org_name":"Lexipol","org_type":"technology_saas","ransomware":null,"records_affected":672546,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lexipol","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lexipol"}],"summary":"Lexipol suffered a data breach in February 2025, exposing user records and documents that were subsequently published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"puppygirlhackerpolycule"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba4a64d716722936f8b4218b6d5629d5d124b760","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ConverseUniversity.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3abadcf37a59","org_name":"Converse University","org_type":"unknown","ransomware":null,"records_affected":19874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/ConverseUniversity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c100c8d28a6878e38ee54d7eb8eaff56ca452ca4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61212debd213","org_name":"Brookings-Harbor School District","org_type":"unknown","ransomware":null,"records_affected":2557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brookings-Harbor%20School%20District-2025-03-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9a4843fc66ebab0e6bd8c20db95ed02a241fe3b6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4bd515802969","org_name":"Presbyterian Health Plan","org_type":"healthcare","ransomware":null,"records_affected":7100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-18-presbyterian-health-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0cbe6f19d743c8a6f06e6a43a3aa7968ac128605","impact_type":"data_theft","incident_date":"2024-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32728.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c0bb54016b36","org_name":"Pennsylvania State Education Association","org_type":"nonprofit","ransomware":null,"records_affected":795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32728.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32728.pdf"}],"summary":"The Pennsylvania State Education Association reported that an unauthorized actor acquired files containing personal information during a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3571e93387cd2f76a764caf858f31403704ef21","impact_type":"unknown","incident_date":"2024-10-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Mark_Thomas_-_Letter_Proof_%2812%29_35883805v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d95588032414","org_name":"Mark Thomas","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600030"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"dbf9d0ed95de82a76465cf981629a045bb06e4ce","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98251a582d01","org_name":"Lena Pope Home Inc.","org_type":"healthcare","ransomware":null,"records_affected":3523,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-17-lena-pope-home-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-03-14","discovered_date":"2025-01-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a56444a1d32e9ef516be550860ae1427e1252235","impact_type":"data_theft","imported_from":null,"incident_date":"2024-10-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WAB%20-%20Adult%201%20Year%20CM.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"3193071b827b","org_name":"Western Alliance Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown vulnerability in a third-party vendor’s secure file transfer software was exploited to gain access to Western Alliance’s systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599939"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WAB%20-%20Adult%201%20Year%20CM.pdf"}],"summary":"An actor exploited a vulnerability in a third-party secure file transfer product to access Western Alliance systems and acquire files containing personal information.","supporting_quote":"In October 2024, an unauthorized actor began exploiting this unknown vulnerability in the third-party software that allowed the unauthorized actor to gain access to a limited portion of Western Alliance’s systems and to obtain copies of files from those systems.","technology_involved":["secure file transfer software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-14","discovered_date":"2025-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"521135dbee26209dd1a0ca204a849d8a018cf6cb","impact_type":"data_theft","incident_date":"2025-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32694.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"84a6ed9fbda1","org_name":"Klickitat Valley Health","org_type":"healthcare","ransomware":null,"records_affected":11960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32694.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32694.pdf"}],"summary":"Klickitat Valley Health reported that an unauthorized person obtained copies of files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4012de2f54876047d260b529e92907b68061807d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"132e4e32c458","org_name":"Columbia Eye Clinic","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-14-columbia-eye-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"32278a93515e397433a6a1481770cd5b6490d355","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"768492c9e094","org_name":"CDHA Management, LLC and Spark DSO, LLC dba Chord Specialty Dental Partners","org_type":"healthcare","ransomware":null,"records_affected":173430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-14-cdha-management-llc-and-spark-dso-llc-dba-chord-specialty-dental-partners"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-03-14","discovered_date":"2024-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df342fbd3d87b95bac53cc784494ddc864359454","impact_type":"unknown","incident_date":"2024-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCB%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"40b15df9ac62","org_name":"California Cryobank","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599946"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCB%20-%20California%20Notification.pdf"}],"summary":"California Cryobank reported unauthorized access to its IT environment and said files containing personal, financial, and health insurance information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1d85b409001cda50e69ce045627ab3ed8f6e99ca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58b2eca50d8c","org_name":"Baylor Scott & White Texas Spine & Joint Hospital","org_type":"healthcare","ransomware":null,"records_affected":1640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-14-baylor-scott-white-texas-spine-joint-hospital"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-13","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cf5e8e6c31f8ae1ea6ad792459c26db7e8bd4101","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d03ab32b922","org_name":"Tillamook School District 9","org_type":"unknown","ransomware":null,"records_affected":1826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tillamook%20School%20District%209-2025-03-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-13","discovered_date":"2024-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a1002172e96f1599ca9534acc6d3b3540cf11312","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AuthoraCareCollective.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a39e485152bf","org_name":"AuthoraCare Collective","org_type":"healthcare","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AuthoraCareCollective.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AuthoraCareCollective.pdf"}],"summary":"AuthoraCare Collective reported that an unauthorized actor accessed or acquired protected health data, including Social Security numbers and medical diagnoses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7523fc2d086e59bcea0f51620d0f426fd0dc68f","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff85e0809bc9","org_name":"Willamette Education Service District","org_type":"unknown","ransomware":null,"records_affected":4183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Willamette%20Education%20Service%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-12","discovered_date":"2024-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1ddb2f554b52fcaa92e2cbb0b7f503b6b41c02e","impact_type":"data_theft","incident_date":"2024-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPM%20-%20Cover%20Letter%20to%20California%20Attorney%20General_0.pdf"},"notes":null,"org_country":"US","org_id":"6893b1b25489","org_name":"Trinity Petroleum Management, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPM%20-%20Cover%20Letter%20to%20California%20Attorney%20General_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trinity%20Petroleum%20Management%2C%20LLC-2025-03-12"}],"summary":"Trinity Petroleum Management, LLC reported unauthorized access to its systems and said personal information, including Social Security numbers, may have been exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"992fd7d031393615b68ecaacdb2949251270d500","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20b05066b65f","org_name":"Silver Falls School District 4J","org_type":"unknown","ransomware":null,"records_affected":2110,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Silver%20Falls%20School%20District%204J-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f11b28021714e831a32858ef85d9be62d8f4069f","impact_type":"data_theft","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32680.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5a45dd963913","org_name":"Reynolds School District #7","org_type":"education","ransomware":null,"records_affected":739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Reynolds%20School%20District%20%237-2025-03-12"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32680.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32680.pdf"}],"summary":"Reynolds School District #7 reported that Carruth experienced a security incident in which personal information may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Carruth"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"095fde7959c1","name":"Carruth"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"897c86c2778bfb62f6f1a0972c0b6ab26980966c","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42c8977820de","org_name":"Northwest Regional Education Service District","org_type":"unknown","ransomware":null,"records_affected":4185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Regional%20Education%20Service%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3fac3893cf523b4c90398a51373bd232f373b1f0","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df50be67bcd0","org_name":"North Clackamas School District","org_type":"unknown","ransomware":null,"records_affected":14039,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Clackamas%20School%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3730019c01e1a08d386802e960487ea3c8243714","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"def010dfefd0","org_name":"Monroe School District 1J","org_type":"unknown","ransomware":null,"records_affected":475,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Monroe%20School%20District%201J-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9840b6c7501f4142af1c415219ded8e8e175667e","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e76c4598aab7","org_name":"Lake Oswego School District","org_type":"unknown","ransomware":null,"records_affected":3254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lake%20Oswego%20School%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96d16bf684b8bbdefa6fdb7ef9e47e0e26181075","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f6f9d07d6bb","org_name":"Jewell School District 8","org_type":"unknown","ransomware":null,"records_affected":329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jewell%20School%20District%208-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f16c417c4df38481ef6295eea1f2177c135c387e","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51115c639ed6","org_name":"Gresham-Barlow School District","org_type":"unknown","ransomware":null,"records_affected":9629,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gresham-Barlow%20School%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"af1190dc224eed72553c22659d78a36edc229600","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"194052e0b958","org_name":"Gervais School District #1","org_type":"unknown","ransomware":null,"records_affected":986,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gervais%20School%20District%20%231-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-12","discovered_date":"2024-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e0ad70e94e7ee0d256fe5a6600f127b33f95145","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Erickson_Synergos%20Individual%20-12%20Months_final.pdf"},"notes":null,"org_country":"US","org_id":"2f5cd8bb4955","org_name":"Erickson Companies, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599833"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Erickson_Synergos%20Individual%20-12%20Months_final.pdf"}],"summary":"Erickson Companies, LLC detected unusual activity and said personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-12","discovered_date":"2025-03-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"32e13d7dea293d521197827dce85e9bd644c111f","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"43abf0644a79","org_name":"David Douglas School District","org_type":"unknown","ransomware":null,"records_affected":6820,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#David%20Douglas%20School%20District-2025-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09daf792d74a860c682010b31ed347c854d592ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Unauth%20Disclosure%20Minor%20Dependent%20%20OAG_0.pdf"},"notes":null,"org_country":"US","org_id":"ee40832e682f","org_name":"California Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Unauth%20Disclosure%20Minor%20Dependent%20%20OAG_0.pdf"}],"summary":"A document containing a child’s personal information was inadvertently emailed to a personal email account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00cee6179df8661458915570646f3133dbc8c071","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/United_Notification_Redacted2.pdf"},"notes":null,"org_country":"US","org_id":"7a51b550fc6b","org_name":"Unite Health Share Ministries","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party contractor inadvertently uploaded a document containing confidential information to a public site.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599782"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/United_Notification_Redacted2.pdf"}],"summary":"A third-party contractor inadvertently uploaded a document containing personal and health-related information about Unite Health Share Ministries members to a public site.","supporting_quote":"On or around January 15, 2025, Unite Health Share Ministries discovered an incident in which a third-party contractor of Unite Health Share Ministries inadvertently uploaded a document containing some confidential information to a public site.","technology_involved":["public website"],"third_party":{"archetype":null,"involved":true,"vendor":"third-party contractor"},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"894ddd28235801c30b15dfdb42f986f4f4818a07","impact_type":"unknown","incident_date":"2024-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AG_Sample_-_12_Months_35846424v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da7ca316169a","org_name":"Smart ERP Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599764"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Smart%20ERP%20Solutions%2C%20Inc.-2025-03-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8d91b54380105627f7048f2686049a7696c17f0","impact_type":"unknown","incident_date":"2024-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_Job45821d33_SMC_L04_DBM-4827_SAS_2_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa380de5d627","org_name":"SMC Corporation of America/ Advanced Pressure Technology (APTech)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599710"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3c8fdbd1fe616e4e97630ca48f06995bae13542c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2f7c688677d4","org_name":"Nice Healthcare Management Company, Inc","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-10-nice-healthcare-management-company-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-10","discovered_date":"2024-09-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72d3207c2bffb1f470de9b89225422cfccc8bca2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHCM%20-%20California%20Notifications.pdf"},"notes":null,"org_country":"US","org_id":"89090e3dad64","org_name":"College Hospital Costa Mesa","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHCM%20-%20California%20Notifications.pdf"}],"summary":"College Hospital Costa Mesa reported that a threat actor accessed files on its systems, which contained names, Social Security numbers, and driver’s license numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-03-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2512f5bd03cf0d031dfea4826b51f0ac85bde104","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9D4F495-E875-A2E0-75A1-A4A6E1B9770F"},"incident_date":"2025-03-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15d709ab281e","org_name":"UPS","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"9182f459b3fe1b63525fd46539c85c8c398a2803","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32625.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0dd1d7134dcd","org_name":"United Seating and Mobility, LLC","org_type":"healthcare","ransomware":null,"records_affected":6884,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32625.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/UnitedSeatingandMobilityLLCdbaNumotion.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599593"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-23594-Numotion-3-Adult-CM-r4prf_Redacted.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32625.pdf"}],"summary":"Numotion reported unauthorized access to certain employee email accounts between September 2 and November 18, 2024, which contained some personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-07","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"feb282e0748f3b63eabd11c2fc484162762bab93","impact_type":"data_theft","incident_date":"2024-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sunflower%20Medical_%20Adult%201%20Year%20CM%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"fe7ef1eab7b1","org_name":"Sunflower Medical Group, P.A.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599633"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sunflower%20Medical_%20Adult%201%20Year%20CM%20%28Redacted%29.pdf"}],"summary":"Sunflower Medical Group learned that an unauthorized third party had accessed its systems and acquired copies of certain files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-06","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef9aa5a5274e61205985a3a97666c8f292fa3fb6","impact_type":"both","incident_date":"2024-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-23665%20SSK%20Plastic%20Surgery%20Adult%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"b39c35022610","org_name":"SSK Plastic Surgery Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599527"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-23665%20SSK%20Plastic%20Surgery%20Adult%20r2prf.pdf"}],"summary":"An unknown intruder accessed client information, removed a limited number of documents, and attempted to extort SSK Plastic Surgery.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"63214f9c3d7f97dc3f352e375e49fb5ae9f6c931","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SRPFederalCreditUnion.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9be458206228","org_name":"SRP Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":136503,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SRPFederalCreditUnion.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SRPFederalCreditUnion.pdf"}],"summary":"An unauthorized third party accessed SRP Federal Credit Union's computer systems and may have acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ba1f881cfab66a848c4a6ac3cce2696594d91ed4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"374010a1b20e","org_name":"SCLARC","org_type":"professional_services","ransomware":null,"records_affected":722,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-06-sclarc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599557"}],"summary":null,"supporting_quote":null,"technology_involved":["Laptop","Other Portable Electronic Device","Paper/Films"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d1722981d538918dbe33e74fea6480558dfb3ce1","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2025-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"2a7aca753811","org_name":"National Presto Industries, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/80172/000143774925006475/npk20250306_8k.htm"}],"summary":"National Presto Industries experienced a cybersecurity incident that caused a system outage and temporarily affected operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"872016abc28dd9ec0478b24e4fdbe0ada869ba09","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"543dd229cf2c","org_name":"Fort Wayne Medical Education Program","org_type":"healthcare","ransomware":null,"records_affected":28502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-06-fort-wayne-medical-education-program"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-06","discovered_date":"2025-01-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0dade8f1cf9216bade1683f81469f8c925fa5b33","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Best%20Collateral%20Notification%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"44a35d8fbe21","org_name":"Best Collateral Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599546"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Best%20Collateral%20Notification%20Letter%20Sample.pdf"}],"summary":"Best Collateral Inc. discovered suspicious activity and later determined that files containing personal information may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-05","discovered_date":"2025-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"83812272399a241c87b581eda93470b4db091ea8","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32605.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8009976c3ea4","org_name":"Select Sires Member Cooperative","org_type":"other","ransomware":null,"records_affected":592,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32605.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32605.pdf"}],"summary":"Select Sires Member Cooperative discovered unauthorized access to a Washington server location containing sensitive personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5c4c304241836d48ac460e350d29e99260b667c4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4c67cd16f80","org_name":"Madison County, MS","org_type":"healthcare","ransomware":null,"records_affected":6082,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-05-madison-county-ms"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a5ee32d4e2fc3bdce1acfc46d81b0fac266a350","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CRA.CA_.Adult_.CM_.2.21.25_0.pdf"},"notes":null,"org_country":"US","org_id":"2aa0972d5c3f","org_name":"Colorado River Adventures","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599481"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CRA.CA_.Adult_.CM_.2.21.25_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colorado%20River%20Adventures-2025-03-05"}],"summary":"Colorado River Adventures found evidence of unauthorized access to some data that may have included personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5af0b74cf4e923c078de7e9dcf03e3f1156b00a3","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dfe7d5d307cf","org_name":"West Linn-Wilsonville School District","org_type":"unknown","ransomware":null,"records_affected":13111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#West%20Linn-Wilsonville%20School%20District-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-03-04","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9293f34820ddc06bf63c0b2f3003e962aa1fa721","impact_type":"data_theft","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32585.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"06f85a11fae3","org_name":"Multnomah Education Service District","org_type":"education","ransomware":null,"records_affected":606,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Multnomah%20Education%20Service%20District-2025-03-04"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32585.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32585.pdf"}],"summary":"Multnomah Education Service District reported that Carruth’s security incident may have led to unauthorized acquisition of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Carruth"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"095fde7959c1","name":"Carruth"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-03-04","discovered_date":"2025-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08e92edbf23673a2b816556153694afa7a98ed3a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JESD%20-%20AG%20Notice%20%28CA%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"fa3e6876fd4e","org_name":"Jefferson Elementary School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599415"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JESD%20-%20AG%20Notice%20%28CA%29_Redacted.pdf"}],"summary":"Jefferson Elementary School District reported that a file found during review of archived data contained personal information, including names, addresses, Social Security numbers, and salary information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa41fa4a711f4b2af5d304703e9ceb803891dfba","impact_type":"unknown","incident_date":"2024-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/USBFS222-Hillcrest-HIPAA-Adult-C-edit-C_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f1c8b47fcb1","org_name":"Hillcrest Convalescent Center, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599438"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hillcrest%20Convalescent%20Center%2C%20Inc.-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58b1d9824ee5b9a84b2bd3b2f6b73d80b735123c","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0df4de2cd016","org_name":"Clackamas Education Service District","org_type":"unknown","ransomware":null,"records_affected":2618,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clackamas%20Education%20Service%20District-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d371b62b49e8d8925fb9ef425037046e6c5d3898","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9c0b387b4d2b","org_name":"Centennial School District","org_type":"unknown","ransomware":null,"records_affected":7664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Centennial%20School%20District-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-04","discovered_date":"2025-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3cafb68bf9817b152b89794148af87e3ceff37b1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32592.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c71f8cce8662","org_name":"Capp, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":33538,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32592.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32592.pdf"}],"summary":"Capp, Inc. reported that an unauthorized third party may have accessed personal information of Airbuds users; the method of access was not stated.","supporting_quote":null,"technology_involved":["Airbuds"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"149678cbabd9beb0767b74ff4c818e94ffd7e727","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b22a0091cd6","org_name":"Canby School District","org_type":"unknown","ransomware":null,"records_affected":5594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Canby%20School%20District-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-04","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e96a4179705941372f35b146f1d1115f718964f5","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ded069a43056","org_name":"Bend-La Pine School District","org_type":"unknown","ransomware":null,"records_affected":9749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bend-La%20Pine%20School%20District-2025-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-03-03","discovered_date":"2024-10-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34384a836da3c3bb4e03d344901dbe0e5c182193","impact_type":"data_theft","incident_date":"2024-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/System%20Pavers%2C%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"860972bd36b4","org_name":"System Pavers, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/System%20Pavers%2C%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#System%20Pavers%2C%20LLC-2025-03-03"}],"summary":"System Pavers reported that an unauthorized actor accessed data containing personal information between September 20 and October 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5661754b7539c2738fe43ffe27bc8ad9ae2afac5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f18c704343c","org_name":"Manchester Rehabilitation and Healthcare Center","org_type":"healthcare","ransomware":null,"records_affected":5415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-03-03-manchester-rehabilitation-and-healthcare-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-03","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2faa479c5244ca32cb8bc574e08845412252fb0a","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cf9001441b1","org_name":"Linn Benton Community College","org_type":"unknown","ransomware":null,"records_affected":15008,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Linn%20Benton%20Community%20College-2025-03-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f5b06c0f73b78f6feb54d2de60b2b622d0646b0","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9492b170b756","org_name":"Color Dating","org_type":"technology_saas","ransomware":null,"records_affected":220503,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Color Dating","type":"hibp","url":"https://haveibeenpwned.com/Breach/ColorDating"}],"summary":"A breach of Color Dating exposed email addresses, bios, names, profile photos, and bcrypt password hashes.","supporting_quote":null,"technology_involved":["Color Dating app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f49070dddf30a5c9772f1cce422a12a9a8f2a01","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20Letter_US.pdf"},"notes":null,"org_country":"US","org_id":"b14da6eced9a","org_name":"Birch Medical LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599367"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20Letter_US.pdf"}],"summary":"Birch Medical reported that unauthorized individuals may have accessed a folder containing health information, but its investigation could not confirm whether files were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e7bbce06e68573e8fa09d86c162cf96c97ecd6cf","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6d81021ee4d","org_name":"Vernonia School District","org_type":"unknown","ransomware":null,"records_affected":663,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vernonia%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7db2e9f1690f115229d29b84321e0b1f324fd752","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d775bff8f95","org_name":"St. Helens School District","org_type":"unknown","ransomware":null,"records_affected":2498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Helens%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"15cf7eeb1ac8ef6b9a096c25da8d94768d39a40b","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"751ec554b06c","org_name":"North Wasco County School District","org_type":"unknown","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Wasco%20County%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df4e2fbbc0a748620ab9d36ddaa20a7e42db1978","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6cc009469231","org_name":"Molalla River School District","org_type":"unknown","ransomware":null,"records_affected":2410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Molalla%20River%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4ccf6010e6eff42ef3fb82a895b550647488c9ef","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e62f5c254fd","org_name":"Lincoln County School District","org_type":"unknown","ransomware":null,"records_affected":3533,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lincoln%20County%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c567af78f7ac0fb9052b84303c902f1cdbc9c972","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"59c11ee39824","org_name":"Klamath County School District","org_type":"unknown","ransomware":null,"records_affected":3494,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Klamath%20County%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c99e03354b369df134996a94b9bb2cf7c884304e","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b29c66804aef","org_name":"Jefferson School District","org_type":"unknown","ransomware":null,"records_affected":981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jefferson%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"677ad8e2cf9029a24d8ba11e319a7cfa94a813fb","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90faa17e4a92","org_name":"Greater Albany Public School District","org_type":"unknown","ransomware":null,"records_affected":5599,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Greater%20Albany%20Public%20School%20District-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81357a2058d4f1ea4d9c9727d2db369e82fc2736","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6b1c77344d54","org_name":"Flat Earth Sun, Moon and Zodiac App","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Flat Earth Sun, Moon and Zodiac App","type":"hibp","url":"https://haveibeenpwned.com/Breach/FlatEarthDave"}],"summary":"The Flat Earth Sun, Moon and Zodiac App was found leaking users’ personal information, including email addresses, location data, and plain-text passwords.","supporting_quote":null,"technology_involved":["Flat Earth Sun, Moon and Zodiac App"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-02","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1b9d9d59e6cd887d01fdeec7e159488139202b9","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc5139988f4c","org_name":"Central School District 13J","org_type":"unknown","ransomware":null,"records_affected":263,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Central%20School%20District%2013J-2025-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-01","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"604afa2e0cda9ecc79119895cc69f1d45586ec3c","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3cbe254433ff","org_name":"Southern Oregon Education Service District","org_type":"unknown","ransomware":null,"records_affected":2982,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Southern%20Oregon%20Education%20Service%20District-2025-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-01","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0c2f0448ee2ae8df390b6a4e05b22d0ec3edfc61","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f27d3f280cb6","org_name":"Columbia Gorge Education Service District","org_type":"unknown","ransomware":null,"records_affected":694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20Gorge%20Education%20Service%20District-2025-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-01","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b1f62e27f4da590598f63c3f256e81b87b879ee","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69aece5fce49","org_name":"Center for Advanced Learning","org_type":"unknown","ransomware":null,"records_affected":302,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Center%20for%20Advanced%20Learning-2025-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-01","discovered_date":"2025-02-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5516e9210274aa79e2f63bec5eeacb0b622c98a","impact_type":"unknown","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b9f8c80b199","org_name":"Bethel School District #52","org_type":"unknown","ransomware":null,"records_affected":6595,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bethel%20School%20District%20%2352-2025-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-03-01","discovered_date":"2025-02-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"81c6c0ac46f047ce1339a63104486f91a5606399","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81deef589f89","org_name":"Banks School District #13","org_type":"unknown","ransomware":null,"records_affected":746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Banks%20School%20District%20%2313-2025-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7feb862a5d1f4172c4704d0c94b2a6fe04311c2","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9c6a1f46f0a7","org_name":"Umatilla School District","org_type":"unknown","ransomware":null,"records_affected":1364,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Umatilla%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d8fd4cb2ab70a2c7b8b65658ecdb4a72b50b118","impact_type":"unknown","incident_date":"2024-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FINAL%20Individual%20Notification%20%5BStandard%2012%20months%5D_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"88115de21586","org_name":"Transak USA LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599269"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32536.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"10a387a1bca5709d35267363516e275094819cb3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"28fb0a15d0b1","org_name":"Total Medical Imaging","org_type":"healthcare","ransomware":null,"records_affected":27000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-28-total-medical-imaging"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c182497a3879e067c7b15283d839e75b8c804815","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6310f5cb9fcd","org_name":"Sweet Home School District 55","org_type":"unknown","ransomware":null,"records_affected":2261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sweet%20Home%20School%20District%2055-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"08fa4ef1464f16a3f1d4d7079c792edfb98219e0","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee9435403088","org_name":"Springfield Public Schools","org_type":"unknown","ransomware":null,"records_affected":3389,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Springfield%20Public%20Schools-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-28","discovered_date":"2024-11-20","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"40313c2d3f1483d09cb17f57bbb21dc8d70306bf","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lockton%20Individual%20Notice%20Letter%2003.20.2025.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8ccd4f1705d4","org_name":"Southeast Series of Lockton Companies, LLC","org_type":"professional_services","ransomware":null,"records_affected":1124727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-28-southeast-series-of-lockton-companies-llc-lockton"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600175"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lockton%20Individual%20Notice%20Letter%2003.20.2025.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SoutheastSeriesofLocktonCompaniesLLC.pdf"}],"summary":"Lockton found that an unauthorized party accessed an individual account and computer and obtained files containing personal information on November 20, 2024.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9188b7cd87ae6eade2a4a4c5067d8e24b51a8e54","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04d3cc240c17","org_name":"Santiam Canyon School District 129J","org_type":"unknown","ransomware":null,"records_affected":587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Santiam%20Canyon%20School%20District%20129J-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35d8d4037d7b2c12e678901416480d92538cef24","impact_type":"data_theft","incident_date":"2024-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rivers%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"aa70fa2b7816","org_name":"Rivers Casino Philadelphia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599300"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rivers%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rivers%20Casino%20Philadelphia-2025-02-28"}],"summary":"An unauthorized actor accessed and/or took files from Rivers Casino Philadelphia computer systems containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6237fa2b855f0b2d2bca943faa980c8ee0f424f3","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a232b3a5db1","org_name":"Rainier School District","org_type":"unknown","ransomware":null,"records_affected":1118,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rainier%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7bce19ee2af44e93e103cbd1a8d2ec80c0733c57","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1eab23e475d9","org_name":"Pleasant Hill School District 1","org_type":"unknown","ransomware":null,"records_affected":1013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pleasant%20Hill%20School%20District%201-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1c39d8a3fe3a02080f2e4e5841c7ca8ace61816e","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4558a62ca752","org_name":"Pilot Rock School District","org_type":"unknown","ransomware":null,"records_affected":469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pilot%20Rock%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"61fbc3352a9adedd080f31c3de0b3cd6da375435","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"802c8809c2f0","org_name":"Philomath School District","org_type":"unknown","ransomware":null,"records_affected":1355,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Philomath%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"81f98e21828ecac22a3191dccc35067426e7a354","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a497fe9cfff8","org_name":"Perrydale School District","org_type":"unknown","ransomware":null,"records_affected":679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perrydale%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"74f62c54ec6267648d016536c12fdc48686e1b7a","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"793441cadfda","org_name":"Pendleton School District 16R","org_type":"unknown","ransomware":null,"records_affected":2849,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pendleton%20School%20District%2016R-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"80a39e848c5b58dd62457c828c78071634258dd4","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae59f6d963b6","org_name":"Parkrose School District","org_type":"unknown","ransomware":null,"records_affected":3382,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Parkrose%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3fdbf0725a9d4d2310a6419bd763a27be060ad81","impact_type":"both","incident_date":"2024-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32538.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b504d7e390c8","org_name":"Northwest Retirement Plan Consultants, LLC","org_type":"professional_services","ransomware":null,"records_affected":1821,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32538.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/NorthwestRetirementPlanConsultantsLLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32538.pdf"}],"summary":"Northwest Retirement Plan Consultants reported a network disruption and that an unauthorized individual acquired information from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9958b856e051d4b632474a74ecaea3ff107b87d3","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"759832efb865","org_name":"North Santiam School District 29 J","org_type":"unknown","ransomware":null,"records_affected":1049,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Santiam%20School%20District%2029%20J-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"775c49c474f10711f61f31366cad205526efde43","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dda47990c0f6","org_name":"North Marion School District #15","org_type":"unknown","ransomware":null,"records_affected":1239,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Marion%20School%20District%20%2315-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"90c6fba065176e2a107b353696190b1800307855","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b7ab96d6210","org_name":"Marcola School District","org_type":"unknown","ransomware":null,"records_affected":658,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marcola%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6979779ba92013c0c28d42bec0bc04ded10271e9","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26c57f92a1cd","org_name":"Linn Benton Lincoln ESD","org_type":"unknown","ransomware":null,"records_affected":3274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Linn%20Benton%20Lincoln%20ESD-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"858534695941afed6625471cd0902b397fe184e8","impact_type":"data_theft","incident_date":"2024-04-25","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33282.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4a38f98c34a1","org_name":"Legacy Professionals, LLP","org_type":"professional_services","ransomware":null,"records_affected":890,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33282.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Legacy%20-%20Exhibit%20A.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33282.pdf"}],"summary":"Legacy Professionals, LLP reported that an unauthorized actor took files from its servers; the method of access was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3028f99312f6a76ff54402002b7bbaf9d801d781","impact_type":"unknown","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2ddc8eca9168","org_name":"Lebanon Community School District 9","org_type":"unknown","ransomware":null,"records_affected":3069,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lebanon%20Community%20School%20District%209-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dbe88504f88e9808843a912e6515ac12f385a89d","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b24a1f12fb08","org_name":"Lane ESD","org_type":"unknown","ransomware":null,"records_affected":1770,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lane%20ESD-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cabb8d03c37df14747945daca703bd5b7ce1da8f","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9ae9835995c","org_name":"Lane Community College","org_type":"unknown","ransomware":null,"records_affected":14275,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lane%20Community%20College-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"99dc962b5771f0004438fc85b42b14a9129db06e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KMTG_Individual%20Notice%20Template%202.28.2025.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"f440465ff505","org_name":"Kronick Moskovitz Tiedemann & Girard","org_type":"professional_services","ransomware":null,"records_affected":2511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-28-kronick-moskovitz-tiedemann-girard"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KMTG_Individual%20Notice%20Template%202.28.2025.pdf"}],"summary":"Kronick discovered unauthorized access to its network in August 2024, and an unknown third party obtained data from internal systems.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-01-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb78a7ceff587e2679dc229ad88dfd04d35de93d","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4cda70988aa9","org_name":"Junction City School District","org_type":"unknown","ransomware":null,"records_affected":981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Junction%20City%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d4cfc9b9f57dcbed270f0a5301c41cd266157857","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82e9bfdf98b5","org_name":"Ione School District 2","org_type":"unknown","ransomware":null,"records_affected":286,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ione%20School%20District%202-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b7b6c8adb344bf2e2b22dce7927934692a63666","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48cde8b65ec3","org_name":"InterMountain ESD","org_type":"unknown","ransomware":null,"records_affected":3293,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#InterMountain%20ESD-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7aa0e2676f46258d33d0da4f234a1742753388e","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7a041c106022","org_name":"Hillsboro School District 1J","org_type":"unknown","ransomware":null,"records_affected":12549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hillsboro%20School%20District%201J-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e48ebde93e1ebacec141a66e0b9b61c06ea32cb4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a40a8f8319f7","org_name":"Gladstone School District","org_type":"unknown","ransomware":null,"records_affected":4318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gladstone%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1d528cb57f14904aacc7d3d880abd7e7ac3d229","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7711bcc5eedf","org_name":"Forest Grove School District","org_type":"unknown","ransomware":null,"records_affected":4122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Forest%20Grove%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1d1ead9cff1d03b1f519c38a563e4f01ec8d1a0","impact_type":"unknown","incident_date":"2025-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"456671388d82","org_name":"Eugene School District 4J","org_type":"unknown","ransomware":null,"records_affected":1951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eugene%20School%20District%204J-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5ee42fc99ce25515fdf61dbe8eb4881f73c05d51","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b66eb5676e47","org_name":"Estacada School District","org_type":"unknown","ransomware":null,"records_affected":2438,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Estacada%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fbf1413cabf27794fa00c732aa222590b8f1245c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c286045c9ea0","org_name":"East Hawaii Rehab, Inc. DBA Lehua Physical Therapy and Rehab","org_type":"healthcare","ransomware":null,"records_affected":8472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-28-east-hawaii-rehab-inc-dba-lehua-physical-therapy-and-rehab"}],"summary":null,"supporting_quote":null,"technology_involved":["Other","Other Portable Electronic Device","Paper/Films"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df1f50d7fb97e1abab11e76753128046c2ccc010","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99f88cec3431","org_name":"Corvallis School District 509J","org_type":"unknown","ransomware":null,"records_affected":4834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Corvallis%20School%20District%20509J-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a48b7b18cf02733529f4325b40422cc96e8f44bf","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"548fb6bfb7da","org_name":"Chemeketa Community College","org_type":"unknown","ransomware":null,"records_affected":7408,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Chemeketa%20Community%20College-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ca984a7adf76d68b6268b167bb2ed6da388066b","impact_type":"unknown","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1f7ffe59586b","org_name":"Central Oregon Community College","org_type":"unknown","ransomware":null,"records_affected":5210,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Central%20Oregon%20Community%20College-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f77fffa700939e16c04b464015616d7acd4254db","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ce8348d3b88","org_name":"CEI Vision Partners, LLC","org_type":"professional_services","ransomware":null,"records_affected":10841,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-28-cei-vision-partners-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ae6bbcf9c0f97e11e5103eec85c095d66bf15742","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/CarolinaArthritisAssociates.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a890ef24ec3","org_name":"Carolina Arthritis Associates","org_type":"unknown","ransomware":null,"records_affected":434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/CarolinaArthritisAssociates.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"63f38061337cb8c96c46185eec61de40f5a0cc2c","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5039e3582228","org_name":"Baker School District","org_type":"unknown","ransomware":null,"records_affected":477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baker%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-28","discovered_date":"2025-02-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9d1429e3dc6c320e52e0ec9ea18d5a945dd2db2","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"783f345e8d57","org_name":"Astoria School District","org_type":"unknown","ransomware":null,"records_affected":1440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Astoria%20School%20District-2025-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-27","discovered_date":"2024-02-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5d736693702b7b4d1257eab7d32c6f288946564","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valsoft%20Corporation%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6236d8717160","org_name":"Valsoft Corporation Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602351"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valsoft%20Corporation%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Valsoft%20Corporation%20Inc.%20d/b/a%20AllTrust-2025-02-27"}],"summary":"An unauthorized actor accessed Valsoft Corporation Inc.'s network and took files; the organization could not confirm which files were accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e365e07edc37888bbecaa3a068d677eea386b05b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e49e84ec26d8","org_name":"Spyzie","org_type":"technology_saas","ransomware":null,"records_affected":518643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Spyzie","type":"hibp","url":"https://haveibeenpwned.com/Breach/Spyzie"}],"summary":"Spyzie suffered a data breach that exposed customer email addresses and reportedly enabled unauthorized access to captured messages, photos, and call logs.","supporting_quote":null,"technology_involved":["Spyzie"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2025-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9581f88c9fa36a2f955561d3343993c1a164b4cb","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RO","org_id":"1e69d0b50495","org_name":"Orange Romania","org_type":"telecom","ransomware":null,"records_affected":556557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Orange Romania","type":"hibp","url":"https://haveibeenpwned.com/Breach/OrangeRomania"}],"summary":"A breach involving Orange Romania exposed email addresses, phone numbers, subscription details, partial credit card data, and internal documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-02-27","discovered_date":"2024-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fbd469105ac311e17f836e8c1279bc5d90fe138","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jaime-Individual_Letter-Final%28152338027.1%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"bd445f267b09","org_name":"Jaime Schwartz MD, PC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599198"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jaime-Individual_Letter-Final%28152338027.1%29_Redacted.pdf"}],"summary":"An unauthorized third party used a vendor’s credentials to access Jaime Schwartz MD, PC’s medical billing and practice management system and acquire data.","supporting_quote":"Our office discovered on June 27, 2024, that an unauthorized third party utilized a third-party vendor’s credentials to access the practice’s medical billing and practice management system.","technology_involved":["medical billing and practice management system"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f4f594e02c0cc0ce75cf7464b00fe1b3b257da6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"5f8aa8de9068","org_name":"Kyocera International, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Files containing personal information were inadvertently made accessible via the company's employee-only intranet site.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice_0.pdf"}],"summary":"An employee downloaded files containing personal information that had inadvertently been accessible via Kyocera International's employee-only intranet site.","supporting_quote":"On or about October 29, 2024, an employee downloaded files containing personal information that had inadvertently been made accessible via our intranet site, which is only available to employees of Kyocera International, Inc. (“KII”) and its subsidiaries.","technology_involved":["intranet site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8361b8b9de76458c30702a4e8b729ca7ed09083","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35040EB1-5CFD-4BE7-8024-300E579EA11B"},"incident_date":"2025-02-26","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8a1b260c711","org_name":"DermCare Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/dermatology-clinics-practice-management-company-data-breach/"}],"summary":"\"Several dermatology practices have recently announced data breaches following an attack on their management company. The number of attacks reported this year by dermatology practices suggests they are being targeted by one or more threat actors.\n\nIn May 2025, DermCare Management","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6fafb964a3a824641f882a0ebe18fe475c1808ba","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SMCCorporationofAmerica.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f92d1daf1c4","org_name":"SMC Corporation of America","org_type":"unknown","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/SMCCorporationofAmerica.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"122d8811185780878656b6a70147292dc89814d5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"11aa5477ecf2","org_name":"Lake Washington Vascular","org_type":"healthcare","ransomware":null,"records_affected":21534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-25-lake-washington-vascular"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/bGFrZS13YXNoaW5ndG9uLXZhc2N1bGFyQHFpbGlu"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2025-02-25","discovered_date":"2025-01-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a89dba2fcee8fcfc3008ccc9bd1728c062348398","impact_type":"data_theft","incident_date":"2024-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Biagi%20Bros.%2C%20Inc.%20-sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"41f61ddce77b","org_name":"Biagi Bros, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Biagi%20Bros.%2C%20Inc.%20-sample%20notice.pdf"}],"summary":"Biagi Bros. reported unauthorized access to certain systems and that information was viewed or downloaded between December 31, 2024, and January 10, 2025.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-25","discovered_date":"2024-08-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bc382e2ea8b6e18f936eba94d67b7b1bfe5cb2c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Azamara%20-%20Sample%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"4275a7c2a969","org_name":"Azamara Cruises","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599143"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Azamara%20-%20Sample%20Notices.pdf"}],"summary":"Azamara Cruises reported unauthorized access to a single email account, whose contents may have been downloaded.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60e9163309ad01851a8d7e260cd077b5fc16e9de","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PS%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"a51aa25c175f","org_name":"PS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599089"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PS%20Sample.pdf"}],"summary":"An unauthorized party accessed a PS employee’s email account, and an accessed email or attachment contained some personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-24","discovered_date":"2024-04-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c77ce738cc7a4715285044ac6e676ef9afbcde8c","impact_type":"data_theft","incident_date":"2024-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20CA.pdf"},"notes":null,"org_country":"US","org_id":"be1bce663c57","org_name":"DISA Global Solutions, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599040"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599684"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20CA.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DISA%20Global%20Solutions%2C%20Inc.-2025-02-21"}],"summary":"DISA Global Solutions discovered that an unauthorized third party accessed its environment and procured some information, including files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-02-21","discovered_date":"2024-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4822acea9a4048ab0552c1480cdb6ce46b8f03f3","impact_type":"data_theft","incident_date":"2024-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nuna%20Baby%20Essentials%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8941d1d2d1e6","org_name":"Nuna Baby Essentials, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nuna%20Baby%20Essentials%2C%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nuna%20Baby%20Essentials%2C%20Inc.-2025-02-21"}],"summary":"Nuna reported that information entered on its website checkout page may have been copied or accessed by an unauthorized party.","supporting_quote":null,"technology_involved":["website payment platform","checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60dd6ab7cffeeb82e315e857da06643e934cf86a","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f92eeeb66529","org_name":"Spyic","org_type":"technology_saas","ransomware":null,"records_affected":875999,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Spyic","type":"hibp","url":"https://haveibeenpwned.com/Breach/Spyic"}],"summary":"Spyic suffered a data breach that exposed customer email addresses and reportedly enabled unauthorized access to captured messages, photos, and call logs.","supporting_quote":null,"technology_involved":["Spyic"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-20","discovered_date":"2024-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc413fa6379e70cd72eeb50ca4a91c2af906b198","impact_type":"unknown","incident_date":"2024-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af8256fc9eb8","org_name":"INTERLINK Health Services Inc.","org_type":"unknown","ransomware":null,"records_affected":1980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#INTERLINK%20Health%20Services%20Inc.-2025-02-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"562570783e7d6fc0e5262f657c9974c6792fc0a1","impact_type":"data_theft","imported_from":null,"incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d444a014ecfa","org_name":"Cocospy","org_type":"technology_saas","ransomware":null,"records_affected":1798059,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cocospy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Cocospy"}],"summary":"Cocospy suffered a data breach that exposed customer email addresses and reportedly enabled unauthorized access to captured messages, photos, call logs, and other data.","supporting_quote":null,"technology_involved":["Cocospy"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-19","discovered_date":"2025-02-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5ac30d39943ef915f298933ee443ffea4ca700c6","impact_type":"unknown","imported_from":null,"incident_date":"2025-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bdf369f9d242","org_name":"NioCorp Developments Ltd.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1512228/000153949725000735/n2574_x251-8k.htm"}],"summary":"NioCorp Developments Ltd. reported unauthorized access to its information systems, including portions of its email systems, that led to misdirected vendor payments totaling approximately $0.5 million.","supporting_quote":null,"technology_involved":["email systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-18","discovered_date":"2024-11-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98beb172e25f44232e4b005f4c4e3c08eae0ff08","impact_type":"unknown","incident_date":"2024-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24ac8ee092d0","org_name":"University of Oregon","org_type":"unknown","ransomware":null,"records_affected":3690,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20of%20Oregon-2025-02-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23ce994c3db11f0107cf2828be200324e7d447cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trident%20Maritime%20Systems%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ed178e7c0c33","org_name":"Trident Maritime Systems LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598818"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trident%20Maritime%20Systems%20-%20Sample%20Notice.pdf"}],"summary":"Trident Maritime Systems reported that an unauthorized actor accessed its computer network in February 2023 and may have accessed or taken data that included names, Social Security numbers, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-18","discovered_date":"2024-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8734bd21b32dc4bbcf5edd9f2a92b17f0f992ff7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T9%20Draft%20Notice%20of%20Breach%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"c69909f70822","org_name":"Title 9 Sports","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T9%20Draft%20Notice%20of%20Breach%20Letter%20Template.pdf"}],"summary":"Title 9 Sports reported unauthorized access to files containing names, contact information, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-18","discovered_date":"2025-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-09","id":"8c3fa2f01e9344bce1482c50ff70ebb82f5abb11","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lee%20Enterprises%20Sample%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"55ec33dd8504","org_name":"Lee Enterprises","org_type":"other","ransomware":true,"records_affected":39779,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lee%20Enterprises-2025-06-04"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-603619"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/58361/000162828025005855/lee-20250212.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/58361/000162828025010944/lee-20250212.htm"},{"fetched_at":null,"title":"Leak-site claim by qilin","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TGVlIEVudGVycHJpc2VzQHFpbGlu"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lee%20Enterprises%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lee%20Enterprises%20Sample%20Notice.pdf"}],"summary":"Lee Enterprises reported that employee personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"claim_groups":["qilin"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"65710094aee4de024271f4b5378e2093e38adbc7","impact_type":"data_theft","incident_date":"2024-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32343.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"635f7f465b37","org_name":"Daniel A. Eckman, PC","org_type":"unknown","ransomware":null,"records_affected":705,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32343.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32343.pdf"}],"summary":"An unauthorized actor accessed Daniel A. Eckman, PC's server and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-17","discovered_date":"2024-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4feeea79010f9c25af8aee8ac687b2f5b12f3d6f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-12-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32325.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8c658c1ee153","org_name":"THE RESHAPOING AND NUTRITIONAL COMPANY LLC","org_type":"unknown","ransomware":null,"records_affected":3080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32325.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32325.pdf"}],"summary":"The company reported unauthorized access to customer information on servers operated by its third-party provider Epic.","supporting_quote":"On December 9th, 2024 we were informed of unauthorized access to servers operated by our third-party provider Epic.","technology_involved":["Epic"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Epic"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"c49b43b212bf","name":"Epic"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95662ae4b6c280b0309c55103bd62c14ea9dbcf6","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6f31cba8f622","org_name":"Storenvy","org_type":"retail_ecommerce","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Storenvy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Storenvy"}],"summary":"Storenvy customer data, including personal information and salted SHA-1 password hashes, was exposed in a mid-2019 breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"05b21e4dbd64e9901506df501455f91cd104ec29","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f638ba66e377","org_name":"Consultants in Pain Medicine","org_type":"healthcare","ransomware":null,"records_affected":1124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-16-consultants-in-pain-medicine"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-14","discovered_date":"2024-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6618f543ddbf6630767cff9b0ab610e7c98a8f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Pension%20Specialist%20-%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"90aad739272e","org_name":"The Pension Specialist","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598639"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Pension%20Specialist%20-%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32836.pdf"}],"summary":"The Pension Specialist reported that certain files may have been accessed or acquired without authorization, and that personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"80f5ecc4921cd30904b8f60ce44e267c4927287e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7a8b6fb09ea0","org_name":"Spring Management OK, LLC","org_type":"professional_services","ransomware":null,"records_affected":2494,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-14-spring-management-ok-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"15ea8faea03d6e7c6e76d568fb0c28320a10aadd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4777ce1eab50","org_name":"Restorix Health, Inc.","org_type":"professional_services","ransomware":null,"records_affected":38553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-14-restorix-health-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"871dafc4d746aba776175d3102e9317fdf82f9a3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"52c6be569f19","org_name":"Cornerstones of Care","org_type":"healthcare","ransomware":null,"records_affected":2771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-14-cornerstones-of-care"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-14","discovered_date":"2025-01-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"698282ff81818bcd49d671431212c5ba4bec5afb","impact_type":"unknown","incident_date":"2024-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"133b0d21ef5c","org_name":"City of Roseburg","org_type":"unknown","ransomware":null,"records_affected":15718,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20Roseburg-2025-02-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-14","discovered_date":"2024-02-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83682d0421ba766ae4df090e4b2549326c44e54a","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Innovative%20Renal%20Care%20-%20sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"827a7024d089","org_name":"American Renal Management LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598711"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Innovative%20Renal%20Care%20-%20sample%20notice.pdf"}],"summary":"An unauthorized actor accessed certain computer systems and copied files from internal systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"TOoDA","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71fba71c840720cfce3fb5ea66018ee71f54817b","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e7ac617299f9","org_name":"Doxbin","org_type":"technology_saas","ransomware":null,"records_affected":336000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Doxbin (TOoDA)","type":"hibp","url":"https://haveibeenpwned.com/Breach/DoxbinTOoDA"}],"summary":"Doxbin was compromised by a group calling itself TOoDA, and data including email addresses and usernames was dumped publicly.","supporting_quote":null,"technology_involved":["Doxbin website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"tooda"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04948c0c2f496c2518501f5ee5d12a0854c98854","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d85cc2edfbed","org_name":"Zacks","org_type":"financial","ransomware":null,"records_affected":11994223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zacks (2024)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zacks2024"}],"summary":"Zacks was allegedly breached in June 2024, and data including email addresses, password hashes, and other personal information was published to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-12","discovered_date":"2024-12-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2a80837f5d57a735f95461aa5e1b839f58b168a2","impact_type":"unknown","incident_date":"2024-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bfb85fa29b9a","org_name":"Scio School District 95-C","org_type":"unknown","ransomware":null,"records_affected":685,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Scio%20School%20District%2095-C-2025-02-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4da99853db56e008b265d7316bb714583e68dd41","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/RileyPope%26LaneyLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07b09977ebeb","org_name":"Riley Pope & Laney","org_type":"unknown","ransomware":null,"records_affected":3875,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/RileyPope%26LaneyLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"25443921ee94b27153345512b7d6acc991c0d70d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"449b266807d4","org_name":"UNITED BACKCARE PS dba Pacific Rehabilitation Centers","org_type":"healthcare","ransomware":null,"records_affected":18900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-11-united-backcare-ps-dba-pacific-rehabilitation-centers"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-11","discovered_date":"2024-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59120ad92ec72e85138859d3e93482fd19b61029","impact_type":"data_theft","incident_date":"2024-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/New%20Era_California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"daccaeff825d","org_name":"New Era Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598552"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/New%20Era_California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32246.pdf"}],"summary":"New Era Enterprises reported that an unauthorized person accessed its IT network and copied some files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","other"],"disclosed_date":"2025-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed9f327e8c746e96215d6b4cb307932d1655e6eb","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bef313a2f6a9","org_name":"LandAirSea","org_type":"technology_saas","ransomware":null,"records_affected":337373,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LandAirSea","type":"hibp","url":"https://haveibeenpwned.com/Breach/LandAirSea"}],"summary":"A January 2025 breach exposed LandAirSea customer contact details, password hashes, partial payment-card data, and GPS device identifiers and locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-11","discovered_date":"2024-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e375df184389454e7b5addfc2906d94f061decbc","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KRUE-Adult_Letter-ENG_ESP-Final.pdf"},"notes":null,"org_country":"US","org_id":"40e16615627f","org_name":"Kings River Union Elementary","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598532"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KRUE-Adult_Letter-ENG_ESP-Final.pdf"}],"summary":"Kings River Union Elementary identified unauthorized access to a portion of its network between October 13 and November 8, 2024, and found that the information involved included names and other unspecified data elements.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-02-10","discovered_date":"2024-12-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"ae0624bb48bf6be3cfe20417b2401ac3e79f45b5","impact_type":"data_theft","incident_date":"2024-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32214.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"20bc4234d359","org_name":"CPS Solutions, LLC","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-10-cps-solutions-llc"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32214.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32214.pdf"}],"summary":"An unauthorized third party accessed a CPS Solutions employee’s O365 business email account and removed data that may have included personal and medical information.","supporting_quote":null,"technology_involved":["O365 business email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43c3b37a00f5b28ee3b20ff7b456229630b444e9","impact_type":"data_theft","imported_from":null,"incident_date":"2022-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"298d4a6a24be","org_name":"Adopt Me Trading Values","org_type":"other","ransomware":null,"records_affected":86136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adopt Me Trading Values","type":"hibp","url":"https://haveibeenpwned.com/Breach/AdoptMeTradingValues"}],"summary":"A breach of the Adopt Me Trading Values website exposed email addresses, usernames, IP addresses, and bcrypt password hashes.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43f3e51121096f16558cf235259a302468f5f4c7","impact_type":"data_theft","imported_from":null,"incident_date":"2019-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ID","org_id":"5bff20696c2c","org_name":"Youthmanual","org_type":"education","ransomware":null,"records_affected":937912,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Youthmanual","type":"hibp","url":"https://haveibeenpwned.com/Breach/Youthmanual"}],"summary":"A breach of Youthmanual exposed personal information and salted SHA-1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-07","discovered_date":"2025-01-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"567225f91a2b11934b72834110bb9932b6e15278","impact_type":"unknown","incident_date":"2023-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dab0c7a5c940","org_name":"St. Andrew’s Resources for Seniors System","org_type":"unknown","ransomware":null,"records_affected":16869,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Andrew%E2%80%99s%20Resources%20for%20Seniors%20System-2025-02-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b7206f36031b86eafc6122a5c16116f612ec0a4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-01-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ecc6038e0a61","org_name":"Rezeptwelt","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Thermomix Recipe World Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/Thermomix"}],"summary":"The Rezeptwelt forum for Thermomix owners exposed registered users’ personal details in a January 2025 data breach.","supporting_quote":null,"technology_involved":["online forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3ac23bc2d5c7eaf15a05521460e93322e2f41f12","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3435cb25180a","org_name":"OnePoint Patient Care","org_type":"unknown","ransomware":null,"records_affected":93672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OnePoint%20Patient%20Care-2025-02-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-02-06","discovered_date":"2023-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"488135369b3a25032f5e21ed82715b7b87393d59","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HSHS%201%20year%20Proof.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"8c81f53ef950","org_name":"Hospital Sisters Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598352"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HSHS%201%20year%20Proof.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18448.pdf"}],"summary":"An unauthorized third party accessed files on Hospital Sisters Health System’s network containing personal, medical, and health insurance information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"148eaf3d644d070b5a2240dec5e8616ffa9771af","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"JP","org_id":"e5d336f63539","org_name":"Hakko Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hakko Corporation","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hakko"}],"summary":"A March 2019 breach exposed Hakko Corporation customer records, including personal information and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-02-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1347d3f45e64e6ab8476ff9cc31c2cf5787ee2cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"093F65E0-80A2-95F8-076B-1C5722A46AA2"},"incident_date":"2025-02-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"891df1c11903","org_name":"Puma","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cfb1676119c9c7551d338129041c9637a202b1e2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Accendo%20Insurance%20Company%20-%20Supplemental%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c382066b298","org_name":"Accendo Insurance Company","org_type":"unknown","ransomware":null,"records_affected":16829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Accendo%20Insurance%20Company%20-%20Supplemental%20Notification.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-04","discovered_date":"2024-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ba014a65f55b5b1e617673bd48cc031e226e345","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SFMFB%20-%20Adult%20notice%20letter%20proof.pdf"},"notes":null,"org_country":"US","org_id":"60235c0a5c48","org_name":"San Francisco-Marin Food Bank","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598255"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SFMFB%20-%20Adult%20notice%20letter%20proof.pdf"}],"summary":"The San Francisco-Marin Food Bank reported unauthorized network access between May 10 and May 30, 2024, that may have affected names and other unspecified information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28252d9541f22b3cd26dcb0d466f41650cbc7f97","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"KR","org_id":"b5c4393ee089","org_name":"PoinCampus","org_type":"education","ransomware":null,"records_affected":89116,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PoinCampus","type":"hibp","url":"https://haveibeenpwned.com/Breach/PoinCampus"}],"summary":"PoinCampus suffered a data breach, and data including email addresses, names, phone numbers and dates of birth was later published on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3e0b845259095deb360a31fed2ae8148328bf383","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fef3751c9803","org_name":"Escambia Community Clinics, Inc. dba Community Health Northwest Florida","org_type":"healthcare","ransomware":null,"records_affected":143969,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-03-escambia-community-clinics-inc-dba-community-health-northwest-florida"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"104805c7cd4fad21f3faa7b48dfffa6e4d040265","impact_type":"data_theft","imported_from":null,"incident_date":"2013-08-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"4f10703a011b","org_name":"DragonNest","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DragonNest","type":"hibp","url":"https://haveibeenpwned.com/Breach/DragonNest"}],"summary":"A 2013 DragonNest breach exposed email addresses, usernames, IP addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":["DragonNest"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-02-03","discovered_date":"2024-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46cec20f4cae1d08f48ad23b0fcf3144bb00b0e7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cabrillo%20Exhibit%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"d5626b8ba56e","org_name":"Cabrillo College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cabrillo%20Exhibit%20A_0.pdf"}],"summary":"Cabrillo College reported that information stored on its computer network was subject to unauthorized access between May 12 and May 14, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-02-03","discovered_date":"2024-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffe723142707d580d133647ec9121f24e56ae574","impact_type":"data_theft","incident_date":"2024-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bayhealth%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6a3420027daa","org_name":"Bayhealth Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598207"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bayhealth%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Bayhealth Medical Center reported unauthorized access to its system and acquisition of information, including protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-02-03","discovered_date":"2024-05-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"35b8192eed076940e5aebfb516281768a372fcad","impact_type":"unknown","incident_date":"2024-02-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a8ae2940ef6","org_name":"Ascension Health","org_type":"unknown","ransomware":null,"records_affected":5466931,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ascension%20Health-2025-02-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3df75681bb36c46944f32a2b009189641b5f1dda","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"114c5d37501a","org_name":"1win","org_type":"other","ransomware":null,"records_affected":96166543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 1win","type":"hibp","url":"https://haveibeenpwned.com/Breach/1win"}],"summary":"A November 2024 data breach at 1win exposed user contact details, locations, IP addresses, dates of birth, and SHA-256 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"09b444e4daee4606503edadafd44232cbac5d4d6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10ea0d594df9","org_name":"ARC Community Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-02-02-arc-community-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d8c0837f692849ad844b34f38dcd414f208adca","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BE","org_id":"12396e13d0c2","org_name":"9Lives","org_type":"other","ransomware":null,"records_affected":109515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 9Lives","type":"hibp","url":"https://haveibeenpwned.com/Breach/9Lives"}],"summary":"The 9Lives gaming news forum suffered a breach that exposed email addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-31","discovered_date":"2024-12-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"48acf25d12ec2551de96aef7e083b6263f4fb5e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32096.pdf"},"notes":null,"org_country":"US","org_id":"c1884000ab9e","org_name":"Regence","org_type":"healthcare","ransomware":null,"records_affected":714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32096.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32096.pdf"}],"summary":"An API transition caused dependent claim notifications to be sent to policy holders through Regence member portal accounts.","supporting_quote":null,"technology_involved":["API","digital member portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c75419d8efa2668f0cfd845f6eaac91202ff3479","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0feee93ab4df","org_name":"PIH Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2947264,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-31-pih-health-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2025-01-31","discovered_date":"2024-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"052acc7250942b199e571af64035cbf565ec6ee3","impact_type":"data_theft","imported_from":null,"incident_date":"2024-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Delta%20-%20A%20-%201%20Yr.pdf"},"notes":null,"org_country":"US","org_id":"cddca208d13d","org_name":"Delta County Memorial Hospital District","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598144"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Delta%20-%20A%20-%201%20Yr.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Delta%20County%20Memorial%20Hospital%20District-2025-01-31"}],"summary":"An unauthorized third party accessed Delta's systems and may have acquired files containing personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"39d4c325c4178cedc501ffda302ec96102e67c37","impact_type":"disruption_or_ransomware","incident_date":"2024-12-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32086.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e72954942f50","org_name":"UNITED BACKCARE","org_type":"healthcare","ransomware":true,"records_affected":18600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32086.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32086.pdf"}],"summary":"UNITED BACKCARE reported that ransomware encrypted data on its servers, while unauthorized access or data export had not been confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-30","discovered_date":"2024-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b95f4e3ff96e322fbc7e113f3a43738a5893a4e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"f6ed0283da67","org_name":"The Reshaping and Nutritional Company LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#THE%20RESHAPING%20AND%20NUTRITIONAL%20COMPANY%20LLC%20DBA%20ARDYSS%20LIFE-2025-02-24"}],"summary":"The company reported that an intruder installed malware on servers operated by Epic and accessed customer information.","supporting_quote":null,"technology_involved":["Epic servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Epic"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"c49b43b212bf","name":"Epic"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"595faa804454282a4067e760a2770e69796015aa","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"cc17a5ee2100","org_name":"Speedio","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Speedio","type":"hibp","url":"https://haveibeenpwned.com/Breach/Speedio"}],"summary":"Data allegedly taken from Speedio was posted for sale, but its origin could not be independently verified.","supporting_quote":null,"technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-30","discovered_date":"2023-07-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0907cb8709fa60ad14a67fcbeb6a3136a1b63f80","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32073.pdf"},"notes":null,"org_country":"CA","org_id":"031a19b925db","org_name":"Prizm Media, Inc.","org_type":"professional_services","ransomware":null,"records_affected":23469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32073.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32073.pdf"}],"summary":"An unauthorized actor accessed a Prizm Media employee email account containing personal and medical information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0116040498be825715b5e40eaa079e5f6d0d15ed","impact_type":"unknown","incident_date":"2024-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/pvsd%20breach%20notification%20letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dc0ec9a9f8a0","org_name":"Portola Valley School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598065"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f0eba30f31fc94b968ad0a757891876af6295ff","impact_type":"unknown","incident_date":"2023-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lucent_Health_Redacted_Notice_Letter_2_35621366v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d79dfe2db74","org_name":"Lucent Health Solutions","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598075"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-30","discovered_date":"2025-01-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01871e48f5cbd75eae0424a156e5235ed15cfcf5","impact_type":"data_theft","incident_date":"2024-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHC%20Letter%20Versions.pdf"},"notes":null,"org_country":"US","org_id":"c6929e4d7c3b","org_name":"Community Health Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598047"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHC%20Letter%20Versions.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/CommunityHealthCenterInc.pdf"}],"summary":"A criminal hacker accessed Community Health Center, Inc.’s computer systems and took data that may have included personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2025-01-29","discovered_date":"2024-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9f0d295c42bee0d77ce24a8d076774311141bf8","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20-%20NorthBay%20Health%20-%20Adult%201%20YR%20CM.pdf"},"notes":null,"org_country":"US","org_id":"fc14e7e534d9","org_name":"NorthBay Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598007"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20-%20NorthBay%20Health%20-%20Adult%201%20YR%20CM.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NorthBay%20Healthcare%20Corporation-2025-01-29"}],"summary":"NorthBay Healthcare reported that an unauthorized third party accessed files containing individuals’ personal information between January 11 and April 1, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-29","discovered_date":"2024-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"626ec6097c445ae137646247f8a2044cbd619b75","impact_type":"data_theft","incident_date":"2023-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Hayward%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b3cdd8cf41fb","org_name":"City of Hayward","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598004"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Hayward%20Sample%20Notice.pdf"}],"summary":"The City of Hayward reported that an unauthorized actor stole data from its network, and that downloaded files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e79755cb26664644611ed019aa8c8b8299d8b4a9","impact_type":"data_theft","incident_date":"2024-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/00%20L01%20Draft%20IndNotification-%20UFCW%28305243619.2%29_v02___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"8caca2fcef15","org_name":"UFCW Local 135","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597925"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598567"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/00%20L01%20Draft%20IndNotification-%20UFCW%28305243619.2%29_v02___Static_Proof_R1.pdf"}],"summary":"UFCW reported that a third party may have accessed and acquired data from its network environment without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-28","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a989549423ada839ad11c5138f1fc7a955a2733","impact_type":"data_theft","incident_date":"2024-12-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20O%27Farrell%20Charter%20School%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ec12dd42965c","org_name":"The O'Farrell Charter School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597885"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20O%27Farrell%20Charter%20School%20Sample%20Notice.pdf"}],"summary":"The O'Farrell Charter School reported that personal data belonging to school families and staff was compromised in a cybersecurity incident involving PowerSchool.","supporting_quote":"We want to inform you about a recent cybersecurity incident involving PowerSchool, the software vendor that provides our Student Information System (SIS).","technology_involved":["PowerSchool","Student Information System (SIS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PowerSchool"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2b11e9b46aed","name":"PowerSchool"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2025-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fd0e32da2fa6ecdfa7977c28f0e156454677ff3","impact_type":"data_theft","imported_from":null,"incident_date":"2021-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4c55cc39c0fd","org_name":"HeatGames","org_type":"technology_saas","ransomware":null,"records_affected":647896,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HeatGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/HeatGames"}],"summary":"HeatGames suffered a data breach in June 2021 that exposed email addresses, IP addresses, geographic locations, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["gaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f87fea40fdb60aa3bde8ca02d7f39545e40868b","impact_type":"unknown","incident_date":"2025-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"04aaba146336","org_name":"Doxbin Scrape","org_type":"unknown","ransomware":null,"records_affected":435784,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Doxbin Scrape","type":"hibp","url":"https://haveibeenpwned.com/Breach/DoxbinScrape"}],"summary":"In January 2025, 435k email addresses were scraped from the \"doxing\" service Doxbin . Posts to the service are usually intended to disclose the personal information of non-consensually third parties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-28","discovered_date":"2024-07-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05685fc8f6d0ffb77b4711af3cbe7d76525deb30","impact_type":"unknown","imported_from":null,"incident_date":"2024-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Berman%20%26%20Rabin%20P.A.%20%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9d8d54a54bbe","org_name":"Berman & Rabin, P.A.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597972"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Berman%20%26%20Rabin%20P.A.%20%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Berman%20%26%20Rabin%2C%20P.A.-2025-01-28"}],"summary":"Berman & Rabin identified suspicious activity involving encrypted files, and an unknown actor may have accessed or acquired information from certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-27","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3300f9b92c724e42d5c601ba3b07dc1afa985aa3","impact_type":"data_theft","incident_date":"2024-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCESD%20Powerschool%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2e02e10d380b","org_name":"Salinas City Elementary School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597852"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCESD%20Powerschool%20Notice.pdf"}],"summary":"Salinas City Elementary School District reported that legacy student and staff data held by PowerSchool was accessed in a security breach.","supporting_quote":null,"technology_involved":["PowerSchool","student information system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PowerSchool"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2b11e9b46aed","name":"PowerSchool"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-27","discovered_date":"2024-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e9edcf408c677f353a85b89fdb99f298b7dfaa9","impact_type":"data_theft","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PowerSchool%20-%20AG%20-%20End%20User%20Notification%20Template%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"2b11e9b46aed","org_name":"PowerSchool Group LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597863"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PowerSchool%20-%20AG%20-%20End%20User%20Notification%20Template%20%28US%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PowerSchool%20Group%20LLC-2025-01-27"}],"summary":"PowerSchool reported unauthorized exfiltration of personal information from Student Information System environments through its PowerSource customer support portal.","supporting_quote":null,"technology_involved":["PowerSchool Student Information System (SIS)","PowerSource"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-27","discovered_date":"2024-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"066005c969901598a1d4f3799e96471c59cebd5d","impact_type":"data_theft","incident_date":"2024-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Mity%20.pdf"},"notes":null,"org_country":"US","org_id":"00f4d49a1561","org_name":"Mity, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597819"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Mity%20.pdf"}],"summary":"Mity, Inc. reported that an unauthorized third party accessed or acquired information from some of its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3f40c1c2de0f65c55235976069335d0e6d757fc7","impact_type":"both","incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32016.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a24780d9ad9e","org_name":"Texas Tech University Health Sciences Center El Paso","org_type":"healthcare","ransomware":null,"records_affected":889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32016.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32016.pdf"}],"summary":"Texas Tech University Health Sciences Center El Paso reported a cybersecurity event involving temporary system disruption and access to or removal of files and folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-24","discovered_date":"2024-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d5c961a2ca04e0ccdd16616b994947ce1fdcb17e","impact_type":"both","incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23805.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"efc6f6e66962","org_name":"Texas Tech University Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":813892,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23805.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Texas%20Tech%20University%20Health%20Sciences%20Center-2026-04-24"},{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005000"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-622258"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597806"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Texas%20Tech%20University%20System%20-%20Notice%20of%20Data%20Event%20-%20Supplemental%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23805.pdf"}],"summary":"A cybersecurity event caused temporary disruption and access to or removal of files and folders containing potentially affected personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36c0f03d0b8e064e12a03a5abb1bfa862ea9215f","impact_type":"both","incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TTUHSC%20-%20EP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a9d1050d2145","org_name":"Texas Tech University Health Science Center El Paso","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597807"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TTUHSC%20-%20EP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Texas Tech University Health Science Center El Paso reported a cybersecurity event involving temporary system disruption and access to or removal of files and folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-24","discovered_date":"2024-12-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"feca809cf6744b5088d84b394116b79f3b9039d8","impact_type":"unknown","incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc972fae7194","org_name":"Texas Tech Health University Sciences Center El Paso","org_type":"unknown","ransomware":null,"records_affected":868133,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Texas%20Tech%20Health%20University%20Sciences%20Center%20El%20Paso-2025-01-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"500712379adba571153691ac194bc45ef2ac9c14","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83e85813d04a","org_name":"Spring River Mental Health & Wellness","org_type":"healthcare","ransomware":null,"records_affected":3250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-24-spring-river-mental-health-wellness"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af754a7c720ebd0815502b780656fd7ed2f54101","impact_type":"unknown","incident_date":"2022-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult%20Notice%20Letter%20Template%20-%20CR%26R%2C%20Incorporated.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"610f542b942d","org_name":"CR&R Incorporated","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597714"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2025-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69d5a56aa886ee203e953c9aa904313bb0c8d24e","impact_type":"unknown","incident_date":"2023-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"5f3466d7b1cd","org_name":"Welhof","org_type":"unknown","ransomware":null,"records_affected":107292,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Welhof","type":"hibp","url":"https://haveibeenpwned.com/Breach/Welhof"}],"summary":"In late 2023, the Dutch appliance store Welhof suffered a data breach . The incident exposed over 100k unique email addresses along with names, physical addresses and the value of purchases made.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-22","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7cd3c59697f0768d551fd12b7e54a731d06f472","impact_type":"unknown","incident_date":"2024-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05f8ec241105","org_name":"Perkins Law","org_type":"unknown","ransomware":null,"records_affected":753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20Law-2025-01-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"63f53143b1dd5543f25542dec0f906a157092caf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a814a80c9ad","org_name":"Inlet Health dba Communicare","org_type":"healthcare","ransomware":null,"records_affected":3771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-22-inlet-health-dba-communicare"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90d400f851d5b2e624593d5b39add1cbeee0ae24","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2025-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"37863830d5e4","org_name":"Frame & Optic","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Frame & Optic","type":"hibp","url":"https://haveibeenpwned.com/Breach/FrameAndOptic"}],"summary":"Frame & Optic suffered a data breach that exposed email addresses, names, phone numbers and geolocation data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2025-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d06db64abc60faea08bf78337282e496f04f39f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C1037873-BB0C-4468-8382-0E1C47D24385"},"incident_date":"2025-01-22","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"430e37b1377d","org_name":"Cerner/Oracle Health","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/oracle-health-responding-to-hack-legacy-cerner-ehr-data-a-27884?rf=2025-04-01_ENEWS_SUB_GIS__Slot6_ART27884;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/oracle-health-data-breach-affected-multiple-hospitals-potentially-leaking-sensitive-patient-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/indiana-health-system-notifies-263000-oracle-hack-a-28353;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.compliancejunction.com/oracle-health-cerner-hack-affects-nearly-263000-individuals/;"}],"summary":"\"A breach at Oracle Health impacts multiple US healthcare organizations and hospitals after a threat actor stole patient data from legacy servers.\n\nOracle Health has not yet publicly disclosed the incident, but in private communications sent to impacted customers and from convers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bfba8e166301d30600f2088fe2971c4ca479bc3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31983.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8c8986c13a68","org_name":"Columbia Hospitality, Inc.","org_type":"other","ransomware":null,"records_affected":3787,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31983.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31983.pdf"}],"summary":"Columbia Hospitality reported that some information may have been acquired without authorization during unusual activity on or about July 30, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"f37fdcd9db66f434c1ffff0ee3c46b08a46b57e8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1e4ab85dc41","org_name":"Holdrege Memorial Homes, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1446,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-20-holdrege-memorial-homes-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f4ae063178baf4dfebd8c4e15894476042ea4a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9e35fd5dbf7c","org_name":"Otelier","org_type":"technology_saas","ransomware":null,"records_affected":436855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Otelier","type":"hibp","url":"https://haveibeenpwned.com/Breach/Otelier"}],"summary":"A threat actor accessed Otelier’s hotel management platform in July 2024 and retrieved customer data, including personal information and partial credit card data.","supporting_quote":null,"technology_involved":["Otelier hotel management platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc86afe7d9200048f5e2cb13207d90ca072b840a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/WolfHaldensteinAdlerFreemanHerzLLP.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0115dde723d5","org_name":"Wolf Halderstein Adler Freeman & Herz LLP","org_type":"unknown","ransomware":null,"records_affected":15318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/WolfHaldensteinAdlerFreemanHerzLLP.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2683dad0b28538795aece53b9fbb74840c5f99a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-07-07","initial_access":"misconfiguration_or_exposure","notes":null,"org_country":"unknown","org_id":"cfd8b8d3c971","org_name":"MSI","org_type":"manufacturing","ransomware":null,"records_affected":249990,"reviewed":false,"root_cause":"MSI inadvertently exposed RMA customer records, making them publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MSI","type":"hibp","url":"https://haveibeenpwned.com/Breach/MSI"}],"summary":"MSI inadvertently exposed customer RMA records containing personal information, which were found to be publicly accessible.","supporting_quote":"In July 2024, MSI inadvertently exposed hundreds of thousands of customer records related to RMA claims that were subsequently found to be publicly accessible .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-17","discovered_date":"2024-12-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c090b117d4927cca96cebce5e2345e00ddfd2e8f","impact_type":"data_theft","incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Garden%20of%20Life%20LLC%20-%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"846b129e52dd","org_name":"Garden of Life, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Garden%20of%20Life%20LLC%20-%20Consumer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31956.pdf"}],"summary":"Garden of Life reported unauthorized access to software used by its website to collect payment card information, exposing consumer personal and card data.","supporting_quote":null,"technology_involved":["website payment-card collection software"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-01-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbf2b05c8478ba82f99c6a381e9aefbcf439f734","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"072B030B-A126-B2F4-B237-4F342BE9ED44"},"incident_date":"2025-01-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"145f68587423","org_name":"Cartier","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.independent.co.uk/news/business/cartier-data-breach-hacked-cyber-attack-b2762734.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2025/06/03/cartier_attack_data_theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://uk.finance.yahoo.com/news/cartier-customer-data-stolen-latest-124759633.html"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9764a0ba4f5ddadf71816745cd5765eea4cd5228","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"231ab2204bea","org_name":"Behavioral Health Resources","org_type":"healthcare","ransomware":null,"records_affected":49213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-17-behavioral-health-resources"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3939a79bacfe40fb6e42478b4388729c056aad05","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"345be8370252","org_name":"Alpine Ears, Nose & Throat, P.L.L.C.","org_type":"healthcare","ransomware":null,"records_affected":65648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-17-alpine-ears-nose-throat-p-l-l-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2025-01-16","discovered_date":"2024-11-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f5053f7a4cd0c126cd952ad44711f4ddda70b87","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31945.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b08a1517cec1","org_name":"United Time Group LLC","org_type":"unknown","ransomware":null,"records_affected":1494,"reviewed":false,"root_cause":"Unauthorized website access was likely caused by unauthorized use of credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31945.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31945.pdf"}],"summary":"United Time Group LLC reported unauthorized website access likely caused by unauthorized credential use, potentially involving personal information.","supporting_quote":"The incident resulted from unauthorized website access likely caused by unauthorized use of credentials which occurred between September 3 -14 and between November 2-3.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2025-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8d8f90029e299611d59a40c9571c153baa52a7e","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CO","org_id":"907f40f68bfa","org_name":"Le Coq Sportif","org_type":"retail_ecommerce","ransomware":null,"records_affected":79712,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Le Coq Sportif Columbia","type":"hibp","url":"https://haveibeenpwned.com/Breach/LeCoqSportif"}],"summary":"Data from Le Coq Sportif’s Colombian website, including personal information and bcrypt password hashes, was posted to a hacking forum.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"93daf6efe65da17bc5db4949313205aa7d47e082","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b07f25ca54af","org_name":"Community Treatment Solutions","org_type":"healthcare","ransomware":null,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-16-community-treatment-solutions"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-16","discovered_date":"2024-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aed2f006eb7e66b5c90b158399b694e7347cb1e","impact_type":"disruption_or_ransomware","incident_date":"2024-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20Customer%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"7122dae4f91d","org_name":"Avery Products Corporation","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597433"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598529"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20Customer%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31898.pdf"}],"summary":"Avery reported a ransomware attack involving its website, where malicious software scraped payment-card information and other personal data.","supporting_quote":null,"technology_involved":["Avery.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fdaa634e97174e1e4015606e472243ee3947b88","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d5e106fbb13c","org_name":"Wolf Haldenstein Adler Freeman & Herz LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wolf%20Haldenstein%20Adler%20Freeman%20%26%20Herz%20LLP-2025-01-16"}],"summary":"Wolf Haldenstein detected suspicious activity and later learned an unauthorized actor had accessed files and data stored within its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-15","discovered_date":"2025-01-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed5bc054374c70fae88c4a27232292ab2055965e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1dd4066b9fc","org_name":"Me,myself,and I","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Me%2Cmyself%2Cand%20I-2025-01-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-15","discovered_date":"2024-08-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5740181134814a27e9c7e79a476c85896e78d6fd","impact_type":"unknown","incident_date":"2024-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3ab25912413","org_name":"ABC Legal Serivces","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ABC%20Legal%20Serivces-2025-01-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-14","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66aaab7cf108ccf0105891c0edac1d1288dd8a99","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Duong%20Letters%2012-5-2024.pdf"},"notes":null,"org_country":"US","org_id":"f0cd37f9c49b","org_name":"Han Van Duong","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Duong%20Letters%2012-5-2024.pdf"}],"summary":"A burglar stole three laptops from Han Van Duong’s clinic, including one containing some patients’ medical information that may have been exposed.","supporting_quote":"The perpetrator(s) had rummaged through cabinets and drawers in the office, but only took some small valuables and three laptop computers.","technology_involved":["laptop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91e09145878815fc33196faaee5a1b9844adb407","impact_type":"data_theft","imported_from":null,"incident_date":"2025-01-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8b412a6b0191","org_name":"Scholastic","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Scholastic","type":"hibp","url":"https://haveibeenpwned.com/Breach/Scholastic"}],"summary":"A breach involving 4.2 million unique email addresses and some names, phone numbers, and physical addresses surfaced at Scholastic.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66bd01b0eb70be99428ce63e54ec32d6b87c2184","impact_type":"data_theft","incident_date":"2024-12-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Santee%20School%20District%20Security%20Breach%20Notification%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"086a6cccd72b","org_name":"Santee School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597295"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Santee%20School%20District%20Security%20Breach%20Notification%20Sample.pdf"}],"summary":"Santee School District reported that student and staff data held by its vendor PowerSchool was downloaded by an unauthorized user.","supporting_quote":"We were made aware earlier this week that our Student Information System vendor, PowerSchool, was hacked over the holidays.","technology_involved":["PowerSchool","Student Information System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PowerSchool"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2b11e9b46aed","name":"PowerSchool"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-13","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36be6d1cccc523d509f537917a65a0f4ba4dd512","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20Families%20regarding%20Powerschool%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"0a38af0d29fb","org_name":"Ramona Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20Families%20regarding%20Powerschool%20Incident.pdf"}],"summary":"PowerSchool reported unauthorized access to customer data in its Student Information System, including information belonging to Ramona Unified School District families and educators.","supporting_quote":null,"technology_involved":["PowerSchool","Student Information System (SIS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PowerSchool"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2b11e9b46aed","name":"PowerSchool"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"08454330e9ff961195bb38bb646026e338607026","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f9f7f1f13a34","org_name":"Mid America Physician Services","org_type":"healthcare","ransomware":null,"records_affected":104513,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-13-mid-america-physician-services"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-13","discovered_date":"2024-11-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32cfa9e78d725630d89476ee389d1d5620f4d279","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Regulatory%20Notification%20Letter%20-%20Kafene_0.pdf"},"notes":null,"org_country":"US","org_id":"93bda778fff5","org_name":"Kafene, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597283"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Regulatory%20Notification%20Letter%20-%20Kafene_0.pdf"}],"summary":"Kafene reported that an unauthorized actor accessed its systems and potentially downloaded files containing some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4bf87fa68708511000ce064d1913fb7ed9bfa95","impact_type":"unknown","incident_date":"2024-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult%20SSN%20%28Letter%20C%29%20%28E-Benefit%29%2834555391.1%29_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b24a2240021","org_name":"E-Benefit Solution","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597285"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-13","discovered_date":"2024-12-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36e1716fb07920ad54c460b9b74ec07b92d9ac0e","impact_type":"unknown","incident_date":"2024-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"73cad37183ee","org_name":"Carruth Compliance Consulting","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carruth%20Compliance%20Consulting-2025-01-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2025-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eb5fc7ecb316389d5b8d46531a401ef8b45ba3b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e4c92ba9df57","org_name":"SuperDraft","org_type":"technology_saas","ransomware":null,"records_affected":300187,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SuperDraft","type":"hibp","url":"https://haveibeenpwned.com/Breach/SuperDraft"}],"summary":"SuperDraft’s October 2024 breach exposed customer records containing personal information, purchase data, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2025-01-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5f42b04ad01dbf46abf05cb64083130a4f982987","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29a3eecd50d7","org_name":"Samaritan Counseling Center of the Fox Valley","org_type":"healthcare","ransomware":null,"records_affected":956,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-10-samaritan-counseling-center-of-the-fox-valley"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b40ebb57f9484d83cc28f8625d6689d9bcefc2f","impact_type":"unknown","incident_date":"2024-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Post%20Details%20_%20Rancho%20Santa%20Fe%20School%20District.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"41051912f69b","org_name":"Rancho Santa Fe School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597241"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2025-01-10","discovered_date":"2024-11-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"67e1e833237a9f8fc3d1415444c7a5f2adda97e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31894.pdf"},"notes":null,"org_country":"US","org_id":"2b37b5d93d6e","org_name":"Northwest Asthma & Allergy Center","org_type":"healthcare","ransomware":null,"records_affected":39342,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31894.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31894.pdf"}],"summary":"Northwest Asthma & Allergy Center reported that an unauthorized user accessed an employee email account containing patient information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"350cff3a575d53b8fb552a80de6481879fa024d1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/OneBloodInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5dce6ee561f","org_name":"OneBlood, Inc.","org_type":"unknown","ransomware":null,"records_affected":1530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OneBlood%2C%20Inc.-2025-01-09"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/OneBloodInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-09","discovered_date":"2025-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d3412ca5da005614eaa2fb964d67e32757c3c30","impact_type":"exposure_no_theft_confirmed","incident_date":"2025-01-01","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31886.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"99f9d5fdee18","org_name":"Get Air Management, Inc.","org_type":"other","ransomware":null,"records_affected":294217,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31886.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31886.pdf"}],"summary":"Get Air Management reported that an unauthorized third party accessed customer data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0cc2db5ac08f2c35481a96ed55f79ca806746b27","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AikenHousingAuthority.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"124c4559fd6a","org_name":"Aiken Housing Authority","org_type":"unknown","ransomware":null,"records_affected":3171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AikenHousingAuthority.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-08","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbb5464de9f45b21a1b4e0ea7e804b4e3223c188","impact_type":"data_theft","incident_date":"2024-10-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stiiizy%20-%20Substitute%20Website%20Notice%20of%20Data%20Breach_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f0b8713ceece","org_name":"Stiiizy Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597121"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stiiizy%20-%20Substitute%20Website%20Notice%20of%20Data%20Breach_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31767.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Stiiizy%20Inc.-2025-01-28"}],"summary":"Stiiizy reported that attackers acquired customer personal information and documents processed by a vendor providing point-of-sale services.","supporting_quote":"On November 20, 2024, we were notified by a vendor of point-of-sale processing services for some of our retail locations that accounts with their organization had been compromised by an organized cybercrime group.","technology_involved":["point-of-sale processing service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-08","discovered_date":"2024-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76bbf5a931d1a7d7e585e4e1d353765de879a229","impact_type":"data_theft","incident_date":"2024-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31857.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"99bc803d7501","org_name":"ITC Investments, Inc.","org_type":"unknown","ransomware":null,"records_affected":867,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31857.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31857.pdf"}],"summary":"ITC Investments, Inc. reported that files containing personal information were accessed or acquired without authorization between September 2 and November 2, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-08","discovered_date":"2024-10-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d40bde6bc9b78665147e25a3aed05c2e93e8fc06","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33195.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"92a7a8668667","org_name":"BayMark Health Services","org_type":"healthcare","ransomware":null,"records_affected":2263,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BayMark%20Health%20Services%2C%20Inc.-2025-05-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33195.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602162"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597092"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Baymark%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33195.pdf"}],"summary":"An unauthorized party accessed files on BayMark’s systems containing personal, medical, and insurance information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8a1ba330e82e48569dfc5cb7961c0f2de07ed72","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Customers%20-%20Mission%20Bank_Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"548c9d8676ac","org_name":"Mission Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20-%20Customers%20-%20Mission%20Bank_Final_Redacted.pdf"}],"summary":"Mission Bank reported that an unauthorized party accessed certain systems and that personal and financial information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2025-01-07","discovered_date":"2023-12-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"11eb43cc368ff8f4a0660c10905345bd3c5b5f8a","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Medusind%20-%20Exhibit%20B%20-%20Sample%20Individual%20Notice_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c078a8d9c906","org_name":"Medusind Inc.","org_type":"professional_services","ransomware":null,"records_affected":701475,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2025-01-07-medusind-inc"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597072"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Medusind%20-%20Exhibit%20B%20-%20Sample%20Individual%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medusind%2C%20Inc.-2025-01-07"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medusind%2C%20Inc.-2025-02-11"}],"summary":"Medusind discovered suspicious activity in its IT network, and its investigation found evidence that a cybercriminal may have obtained files containing personal information.","supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6d60ed68aff3693bad35faad7dd8fc78a3aa36f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arixa%20Capital%20-%20Consumer%20Notification%20Letter%20-%20V3%20Proof%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"f2cb5409ab15","org_name":"Arixa Capital Advisors LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597069"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arixa%20Capital%20-%20Consumer%20Notification%20Letter%20-%20V3%20Proof%20%281%29.pdf"}],"summary":"Arixa Capital reported that an unauthorized actor accessed its network and may have downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-06","discovered_date":"2024-11-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd05de44eac04a9a74274af0b9d33a8c1875fab9","impact_type":"both","incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NLACRC%20Adult%20Notice%20Ltr.pdf"},"notes":null,"org_country":"US","org_id":"cfd0b67c193f","org_name":"North Los Angeles County Regional Center","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-625748"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596993"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NLACRC%20Adult%20Notice%20Ltr.pdf"}],"summary":"North Los Angeles County Regional Center reported that an unauthorized actor copied some information and encrypted or encoded certain computer systems, making them inaccessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-06","discovered_date":"2024-12-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a84d7ef89f8411bbd935a0d64d321028690f84e","impact_type":"unknown","incident_date":"2024-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7e2dab1c971","org_name":"Newberg School District","org_type":"unknown","ransomware":null,"records_affected":5078,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Newberg%20School%20District-2025-01-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12591ff0fbdc7012e2a45c8560815dd5028bc45d","impact_type":"data_theft","incident_date":"2024-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB09794-Hyperince-adult-letter_v3_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"8fdfda1e0afb","org_name":"Hyper Ice, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB09794-Hyperince-adult-letter_v3_Redacted.pdf"}],"summary":"Hyper Ice, Inc. reported a network disruption after which files may have been acquired without authorization, and personal information including Social Security numbers may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-06","discovered_date":"2024-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d77adc8dc65fd1892cce6883fb4dacd2dc8bc454","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GBP%20-%20Template%20Individual%20Notice_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"86a1642dd008","org_name":"Green Bay Packers, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GBP%20-%20Template%20Individual%20Notice_Redacted.pdf"}],"summary":"Malicious code on the Green Bay Packers Pro Shop website may have exposed customer information entered at checkout.","supporting_quote":null,"technology_involved":["Pro Shop website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb3d2ee8eb303ce81b29a4d92e628620238aed02","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1D0C6E8-3F02-7327-D846-1063F4AC58A6"},"incident_date":"2025-01-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"6a7e8b919edc","org_name":"Toyota Motor","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaab45c54338b4873d4443b36e2a4dbcf52218a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66F041E1-6A60-928B-05A7-E228A89C3799"},"incident_date":"2025-01-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"061763e75904","org_name":"Petco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbc1c156103af5adc9b607be4f7c35e83f756026","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72B32A1F-754B-A1C0-9B36-95E0CB6CDE7F"},"incident_date":"2025-01-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f3c97b2bb1c","org_name":"Instacart","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2025-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b3e118f84a1b632869a3576d1644e3d1e195b38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7177163-C833-DFF4-B38F-C8D2872F1EC6"},"incident_date":"2025-01-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1a79d5790af","org_name":"Disney/Hulu","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/widespread-data-theft-hits-salesforce-customers-via-third-party-619871;"},{"fetched_at":null,"title":null,"type":"press","url":"https://databreaches.net/2025/10/03/more-salesforce-customer-attacks-revealed-in-new-leak-site-by-scattered-lapsus-hunters/"}],"summary":"\"There is clearly a lot of data to go through, and this is just a preliminary report. DataBreaches also asked ShinyHunters whether all of these victims had been contacted previously with ransom demands or if some might first be finding out today. He replied that all had been noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2025-01-03","discovered_date":"2024-10-22","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc80fe105b0aaf78930961f28568cdc561682fee","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PPMG%20-%20Template%20Notice%20Letter%20-%20Monitoring.pdf"},"notes":null,"org_country":"US","org_id":"534e1f9bfe01","org_name":"Pacific Pulmonary Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PPMG%20-%20Template%20Notice%20Letter%20-%20Monitoring.pdf"}],"summary":"Pacific Pulmonary Medical Group reported that an employee’s credentials to third-party scheduling software were compromised, potentially affecting personal information.","supporting_quote":"On or about October 22, 2024, Pacific Pulmonary Medical Group became aware of a compromise to an employee’s credentials to a third- party software utilized by our organization for scheduling.","technology_involved":["third-party scheduling software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2025-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6f1107566a1ddb8739c7e1b14ceb3c060b346ed","impact_type":"data_theft","imported_from":null,"incident_date":"2023-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1d72914c3124","org_name":"GLAMIRA","org_type":"retail_ecommerce","ransomware":null,"records_affected":874594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GLAMIRA","type":"hibp","url":"https://haveibeenpwned.com/Breach/GLAMIRA"}],"summary":"GLAMIRA reported that an unauthorized individual briefly accessed a server, and data including customer contact details and purchases was later published.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2025-01-02","discovered_date":"2024-10-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1de9464a051677cd0f224615803d77b60dd1e358","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-20","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tecta%20America%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"05ad1960fdd5","org_name":"Tecta America Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596885"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tecta%20America%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Tecta America Corporation reported that an unauthorized actor accessed its environment and may have accessed or acquired files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2025-01-02","discovered_date":"2024-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f54f2674eca80d277954012a35a7c8087236d7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Trust%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a5c8f8df405a","org_name":"American Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596909"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Trust%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31822.pdf"}],"summary":"American Trust Company determined that emails containing personal information may have been copied without authorization.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d7f9968308940ef449ddabb4ba8e60a2d24124f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C20AD4D7-6FE9-7759-AA27-A0C99BFF6710"},"incident_date":"2025-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbf4e9330338","org_name":"Harvard University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/harvard-investigating-breach-linked-to-oracle-zero-day-exploit/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://therecord.media/harvard-says-limited-number-linked-to-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.com/183379/security/harvard-university-hit-in-oracle-ebs-cyberattack-1-3-tb-of-data-leaked-by-cl0p-group.html"}],"summary":"\"Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site, saying the alleged breach was likely caused by a recently disclosed zero-day vulnerability in Oracle's E-Business Suite servers.\n\n\"Harvard is aware of report","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2025-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd77df02ad1a45903af9997553b2773f089a3429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C51CE410-C124-A10E-0DB5-E4B97FC2AF39"},"incident_date":"2025-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"62a7f90bb8b1","org_name":"Barts Health NHS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/barts-health-nhs-discloses-data-breach-after-oracle-zero-day-hack/"}],"summary":"\"Barts Health NHS Trust, a major healthcare provider in England, announced that Clop ransomware actors have stolen files from one of its databases after exploiting a vulnerability in its Oracle E-business Suite software.\n\nThe stolen data are invoices spanning several years that e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b06c65a3ad0da0c02c62352c6b5090fbb0a1353e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a712e9f8c56a","org_name":"Watsonville Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":30312,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-31-watsonville-community-hospital"},{"fetched_at":null,"title":"Leak-site claim by termite","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/V2F0c29udmlsbGUgQ29tbXVuaXR5IEhvc3BpdGFsQHRlcm1pdGU"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["termite"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"865cfd35e179d3d67a456c9a77f9d83566159cad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"092879878739","org_name":"Legacy Treatment Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":29898,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-31-legacy-treatment-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"274cc0e1ca4c94a05682c57e05ecd83b83ab1d99","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31812.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3cf9c3a19cf","org_name":"Eastern Washington University","org_type":"unknown","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31812.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8bff122da49c4e63a6b9e6f5a79042a51898bd1","impact_type":"both","imported_from":null,"incident_date":"2024-05-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Central%20Valley%20Meat-Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"8c53035d9c88","org_name":"Central Valley Meat Co. Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Central%20Valley%20Meat-Notice%20of%20Data%20Breach.pdf"}],"summary":"Central Valley Meat reported that files containing employee names and Social Security numbers were taken before its systems were disrupted and rendered inaccessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-31","discovered_date":"2024-11-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a88cc6e45dbf0264fa743de7a3876802876e6a9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Betterdoor_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"faddade116c3","org_name":"Betterdoor.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596806"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Betterdoor_CA%20Sample.pdf"}],"summary":"Betterdoor identified unauthorized code on its e-commerce platform that may have obtained information entered during checkout.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ae266f8ce2e17243fd62b2faa643375bcbe828f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d85044700bf","org_name":"Omaha Surgical Center","org_type":"healthcare","ransomware":null,"records_affected":1110,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-30-omaha-surgical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4091aaa127c44d9c9d8b2369e1e85aead5058670","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TTSD_NoticeofDataBreachFinal.pdf"},"notes":null,"org_country":"US","org_id":"c53f72d5c14a","org_name":"Tahoe Truckee Sierra Disposal Co Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596700"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TTSD_NoticeofDataBreachFinal.pdf"}],"summary":"Tahoe Truckee Sierra Disposal Co Inc detected unauthorized activity in its computer system, and personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2295483e623d169cdea310a8eb8811033c55c136","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Norwalk.CA_.CM_.12.17.24_v2___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"261da19411a0","org_name":"Norwalk La Mirada Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Norwalk.CA_.CM_.12.17.24_v2___Static_Proof_R1.pdf"}],"summary":"Norwalk La Mirada Unified School District identified unauthorized access to a database system, and documents that were potentially accessed contained names.","supporting_quote":null,"technology_involved":["database system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-27","discovered_date":"2024-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"342461eea9e712d37412e3f0a4cb2055dcb3a580","impact_type":"data_theft","incident_date":"2024-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MyBlock%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4e11cbbb899b","org_name":"HRB Tax Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596699"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MyBlock%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31750.pdf"}],"summary":"HRB Tax Group said an unauthorized third party used personal information obtained from other sources to access information associated with client or MyBlock accounts.","supporting_quote":null,"technology_involved":["MyBlock accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2be630accfd551e1776db0de6f39950ad18fa122","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eee8de8751d0","org_name":"Dragonfly Health","org_type":"professional_services","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-27-dragonfly-health"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-26","discovered_date":"2024-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db322b5544aef25f907ed96778126bce9b7c948e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024.12.26%20Proof%20Adult%20-%20Letter%20DAP%20Health.pdf"},"notes":null,"org_country":"US","org_id":"1749fd03b862","org_name":"DAP Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024.12.26%20Proof%20Adult%20-%20Letter%20DAP%20Health.pdf"}],"summary":"DAP Health reported that an unauthorized actor accessed and/or acquired files and data stored in its email environment.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee2d25772b7d4c6e17c786d1463abde33e7804c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31790.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4f6dc17acb68","org_name":"Chief Leschi Schools","org_type":"education","ransomware":null,"records_affected":655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31790.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31790.pdf"}],"summary":"Chief Leschi Schools reported that an unauthorized individual may have accessed personal information, including names, Social Security numbers, and driver’s license or state identification numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"0f05d4ee75a930bbdfad2bab583742eeb1c4af98","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd3df5f2ca89","org_name":"Polaris Endeavors","org_type":"healthcare","ransomware":null,"records_affected":4552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-24-polaris-endeavors"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-23","discovered_date":"2024-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7063455e78c0d4fe38d6f27ffb8bd665c8b38ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20-%202024-12-23%20-%20Notification%20to%20Data%20Subjects.pdf"},"notes":null,"org_country":"US","org_id":"d6231fe3e73a","org_name":"Norwex USA, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20-%202024-12-23%20-%20Notification%20to%20Data%20Subjects.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Norwex%20USA%2C%20Inc.-2024-12-23"}],"summary":"Norwex USA, Inc. reported that an unauthorized person accessed systems that may contain personal data around December 11, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-23","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"712a8814236dfcc183badad1bce0d4444f6489f7","impact_type":"both","incident_date":"2024-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DBM%20Global%2C%20Inc.%20%28CA%29%20Regulatory%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"bbe67a0e0a79","org_name":"DBM Global Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-606978"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DBM%20Global%2C%20Inc.%20%28CA%29%20Regulatory%20Notification_0.pdf"}],"summary":"DBM Global reported that an unknown actor acquired personal information without authorization after unusual activity disrupted access to certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c93f043bd0810d44d4fa188f5d54d80aa49f9216","impact_type":"unknown","incident_date":"2024-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/241126002%20Breach%20Notice_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596590"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cae2cfd7d416d1e67942d619f7818172c22ffa4d","impact_type":"unknown","incident_date":"2024-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AAC%20-%20Sample%20Individual%20Notice%20to%20Residents.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5471e977981e","org_name":"American Addiction Centers, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596615"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31768.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d601c2385da450b7266fb8d0afb6d463b4809306","impact_type":"both","incident_date":"2023-10-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Akumin%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"bf14d4e34ec0","org_name":"Akumin, Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Akumin%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18180.pdf"}],"summary":"Akumin reported that malware locked access to some computer files and that files containing personal, medical, and billing information were copied without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcf087b1f2c2d89604f0be68517b20d4c51b8062","impact_type":"unknown","incident_date":"2023-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Access%20Telecare%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64f775399330","org_name":"Access TeleCare","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599935"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596609"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"19349446b2a995a996a322e0eaebf64afabaf6c5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb6c0c3b079c","org_name":"Khalil Foundation (DBA Khalil Center)","org_type":"healthcare","ransomware":null,"records_affected":1153,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-22-khalil-foundation-dba-khalil-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-12-20","discovered_date":"2024-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c7a385155919194a7911d7686f7fb590e8bf9d0","impact_type":"unknown","incident_date":"2024-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31765.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"432ea71ed660","org_name":"Youth Eastside Services","org_type":"healthcare","ransomware":null,"records_affected":755,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31765.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31765.pdf"}],"summary":"Youth Eastside Services reported that an unknown actor accessed certain computer systems and that files were accessed and/or exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e13e9569163298a347283bb4627f99fdd33bbd89","impact_type":"data_theft","incident_date":"2023-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Self%20Esteem%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"287693180bf3","org_name":"Self Esteem Brands, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598312"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Self%20Esteem%20-%20California%20Notification.pdf"}],"summary":"Self Esteem Brands reported that an unauthorized actor viewed and obtained files from certain servers and accessed employee email accounts.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"43e386f1760be19a80cd9527c506cf9752844573","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31761.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c399b25f817","org_name":"RV Country, Inc.","org_type":"unknown","ransomware":null,"records_affected":773,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31761.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7fda8ad0826d36dcce1ad3d579370aaf81ef075","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ae4445d10ae","org_name":"Oregon Reproductive Medicine, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Reproductive%20Medicine%2C%20LLC-2024-12-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-20","discovered_date":"2024-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a8f1acee698db595a9d6a477c4ee1f446c16caa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31760.pdf"},"notes":null,"org_country":"US","org_id":"fd45ec7a98db","org_name":"Marine Floats LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31760.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31760.pdf"}],"summary":"Marine Floats detected unusual activity, and an investigation found that data including dates of birth was accessible to an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"119498dbb235c0eaafc9b96f4f934b54c73b1c43","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51e4ea4a3323","org_name":"HealthEquity, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-20-healthequity-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6797be3b7abb165e299f7d2794825c09688a9a52","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-09-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c55089842881","org_name":"French Citizens","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A database containing the data was left exposed on the public internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: French Citizens","type":"hibp","url":"https://haveibeenpwned.com/Breach/FrenchCitizens"}],"summary":"A publicly facing database containing a compiled corpus of data on French citizens was found exposed in September 2024.","supporting_quote":"In September 2024, over 90M rows of data on French Citizens was found left exposed in a publicly facing database .","technology_involved":["publicly facing database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a0dce3838f85114feca181824b807f55ff0f3507","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63fb22374508","org_name":"Effortless Office Enterprises, LLC","org_type":"professional_services","ransomware":null,"records_affected":3112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-20-effortless-office-enterprises-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa51aa0977533ae05030707c8371b551da874d20","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alta%20Resources%20Corp.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"91994bbd329b","org_name":"Alta Resources Corp.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alta%20Resources%20Corp.%20-%20Sample%20Notice.pdf"}],"summary":"Alta Resources reported unauthorized access to certain servers in November 2023, and personal information including names and Social Security numbers may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92c663b2189571313a4ee0f20f554bb6974bd38c","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d9a4ff1c7e75","org_name":"Young Living Essential Oils","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Young Living Essential Oils","type":"hibp","url":"https://haveibeenpwned.com/Breach/YoungLivingEssentialOils"}],"summary":"Data claimed to be from Young Living Essential Oils was posted to a hacking forum, including email addresses, names, account countries, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97838e117ece5fadf1520dc730b6f4e0e7eb5325","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"079cc97d21c5","org_name":"schenkYOU","org_type":"retail_ecommerce","ransomware":null,"records_affected":237349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: schenkYOU","type":"hibp","url":"https://haveibeenpwned.com/Breach/schenkYOU"}],"summary":"Data from schenkYOU was offered for sale and included email addresses, names, dates of birth, and salted SHA-256 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73ec5ab8eda688ba628e26ffd34fee8c968c3531","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/International%20Coffee%20%26%20Tea%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"42176c896062","org_name":"International Coffee & Tea, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/International%20Coffee%20%26%20Tea%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Coffee%20%26%20Tea%2C%20LLC-2024-12-19"}],"summary":"The Coffee Bean & Tea Leaf reported unauthorized access to certain systems and limited email accounts, with personal information potentially accessible.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-19","discovered_date":"2024-07-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e8206e8e24e2d1fd9a98619b1af11442651e4e6","impact_type":"data_theft","incident_date":"2024-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20One%20Year.pdf"},"notes":null,"org_country":"US","org_id":"a815246b0294","org_name":"Illinois Bone & Joint Institute, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20One%20Year.pdf"}],"summary":"An unauthorized third party accessed IBJI systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34648b37c389144fa401a48a01cf9798ee737fba","impact_type":"data_theft","imported_from":null,"incident_date":"2024-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2164f6314160","org_name":"BitView","org_type":"technology_saas","ransomware":null,"records_affected":63127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BitView","type":"hibp","url":"https://haveibeenpwned.com/Breach/BitView"}],"summary":"BitView suffered a data breach that exposed customer records from a backup taken by a previous administrator.","supporting_quote":null,"technology_involved":["backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-12-19","discovered_date":"2024-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14407162fbee4bcf65ff3c881890ac712f17fd13","impact_type":"both","incident_date":"2024-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ascension%20Health%20%E2%80%93%20Exhibit%20A%20%E2%80%93%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"5a8ae2940ef6","org_name":"Ascension Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598203"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596447"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ascension%20Health%20%E2%80%93%20Exhibit%20A%20%E2%80%93%20Notice%20Template_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ascension%20Health-2024-12-19"}],"summary":"A cybercriminal copied files containing patient and associate information during a ransomware attack on Ascension’s technology systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-12-18","discovered_date":"2024-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e376fa2c7c29fcdf129d6f82bc818321264afb8e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Natomas%20-%20Notice%20of%20Data%20Event%20-%20%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"d6b0f431c7c4","org_name":"Natomas Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596411"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Natomas%20-%20Notice%20of%20Data%20Event%20-%20%20CA_0.pdf"}],"summary":"Natomas Unified School District discovered suspicious activity and could not confirm whether an unauthorized user viewed usernames and passwords; it found no evidence that data was taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-18","discovered_date":"2019-10-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"73ed04d1711169b528cfd5e9bafcdf9280c78166","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cff1a7fe0361","org_name":"Dhs oha","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dhs%20oha-2024-12-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"956d3e2f5b8c3730c84df6f5271ba43b105329bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"538062C0-8501-4B8B-835F-53971677E646"},"incident_date":"2024-12-17","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29c4142ab896","org_name":"Kelly Benefits","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/kelly-benefits-data-breach-impacts-260000-people/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://kellybenefits.com/data-event/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/31cc467f-60ce-43da-985b-1157966dc553.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/kelly-benefits-data-breach-impact-grows-to-400000-individuals/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaanswers.com/over-413000-individuals-affected-by-kelly-benefits-data-breach/;"}],"summary":"\"Maryland-based benefits and payroll solutions provider Kelly & Associates Insurance Group (dba Kelly Benefits) has disclosed a data breach impacting more than 260,000 people.\n\nKelly Benefits provides benefits administration and technology, broker and consulting services, and pay","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a92f8c68950daf98cbd47bdbe610227fbd93209d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keeco_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"4b0336d33fd5","org_name":"Keeco, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596342"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keeco_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Keeco reported unauthorized access to its network between March 28 and May 19, 2024, and later identified a document containing information about the recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-12-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e6b33da069cfcb91d95f93a5f12f609695bd68f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-12-04","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31722.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"376cd4c5c2a5","org_name":"SeaTac Electric Inc","org_type":"other","ransomware":null,"records_affected":122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31722.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31722.pdf"}],"summary":"SeaTac Electric reported that a cyber event may have compromised an employee's email account, potentially making employee information available.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-16","discovered_date":"2024-09-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b1f8430d40b911e0ca0747e65d182c3f858d700","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"54529d660347","org_name":"Regional Care, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31724.pdf"}],"summary":"Regional Care, Inc. detected unusual activity on an account and found that an unauthorized party may have accessed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-16","discovered_date":"2024-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d7f2bd30310ce57639adff5010eb128f6b50c29","impact_type":"data_theft","incident_date":"2024-09-17","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31719.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9893ede73caf","org_name":"Kitsap Mental Health Services","org_type":"healthcare","ransomware":null,"records_affected":56981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31719.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31719.pdf"}],"summary":"Kitsap Mental Health Services reported that an unauthorized actor accessed some of its systems and downloaded data, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a2dfdb8f962c7a4e82bbb5c1c975a58c5f176d7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"40e4aa2e7455","org_name":"Hopamedia","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hopamedia","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hopamedia"}],"summary":"Data relating to Hopamedia appeared in a publicly exposed database, including personal information for 23,835,870 records.","supporting_quote":"In 2024, data relating to an unknown service referred to as \"Hopamedia\" and dating back to 2020 appeared in a publicly exposed database .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b515b31415393c1e6cd371ba170aa5fa7cfc4562","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e94a3fbf98e0","org_name":"MC2 Data","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"MC2 Data left a database publicly accessible without a password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MC2 Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/MC2Data"}],"summary":"MC2 Data exposed subscriber personal information and salted SHA-256 password hashes in a database left publicly accessible without a password.","supporting_quote":"In August 2024, data aggregator MC2 Data left a database publicly accessible without a password which was subsequently discovered by a security researcher .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e9ac86f9c153d855aa7ee9d36f1c0408bed759d","impact_type":"data_theft","imported_from":null,"incident_date":"2024-11-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"SN","org_id":"dace0f5ccf26","org_name":"Yonéma","org_type":"financial","ransomware":null,"records_affected":35962,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Yonéma","type":"hibp","url":"https://haveibeenpwned.com/Breach/Yonema"}],"summary":"Data from the Senegalese payment platform Yonéma was posted to a hacking forum, including personal information and what appeared to be encrypted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c2e685fcc9847131f1a556f0321801e4cdc990c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"8380af88d0ae","org_name":"Tibber","org_type":"energy_utilities","ransomware":null,"records_affected":50002,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tibber","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tibber"}],"summary":"Tibber exposed customer names, email addresses, geographic locations, and purchase totals in a November 2024 data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-13","discovered_date":"2024-10-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2ce7f0842540d95a3fb026e23b49b55ead439e08","impact_type":"unknown","incident_date":"2024-06-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0275cd013a57","org_name":"Saif","org_type":"unknown","ransomware":null,"records_affected":3002,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Saif-2024-12-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-12-13","discovered_date":"2024-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61140a2322ac5b5027d2faa91e38c396fd07e686","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_3.pdf"},"notes":null,"org_country":"US","org_id":"5a99000d741a","org_name":"ConnectOnCall.com, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596101"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_3.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31694.pdf"}],"summary":"An unknown third party accessed ConnectOnCall and certain data within the application, including information in provider-patient communications.","supporting_quote":null,"technology_involved":["ConnectOnCall"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e01c8889cd0f43efc2b0266e4cc5a6d6e16ef9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Americhek%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"fe49917ccd96","org_name":"Americhek","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596074"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Americhek%20-%20Regulatory%20Notification%20Packet%20%28CA%29_0.pdf"}],"summary":"BackChecked disclosed unauthorized access to its systems that may have exposed Americhek applicants’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"BackChecked"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c4f3c0d21466","name":"BackChecked"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-12","discovered_date":"2024-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a028d7f8b6dac09a69037fb2948084a9baa2db05","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/YoungLife%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"},"notes":null,"org_country":"US","org_id":"a0bae7c49e25","org_name":"Young Life","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596050"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/YoungLife%20-%20Notice%20of%20Data%20Event%20-%20CA%20_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Young%20Life-2024-12-12"}],"summary":"Young Life reported malware infection and possible unauthorized access to files containing information about current and former employees, their dependents, and certain volunteers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-12","discovered_date":"2024-05-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3c255a3bf1a2cf6eba493d7590cd74c215de9d93","impact_type":"both","incident_date":"2024-05-24","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31681.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5c8527bac194","org_name":"The Seattle Public Library","org_type":"government","ransomware":null,"records_affected":26965,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31681.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31681.pdf"}],"summary":"The Seattle Public Library reported a cyberattack that disrupted services and involved an unauthorized actor downloading files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53b15f78424d7d38c93ecb46e7d2deea437b3501","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CenterforVeinRestorationLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29b5ac53339f","org_name":"Center for Vein Restoration, LLC","org_type":"unknown","ransomware":null,"records_affected":6207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CenterforVeinRestorationLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6aeb426f9936697190ae66ddbe506108e63a2d36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"41e485e9fc78","org_name":"River Region Cardiology","org_type":"healthcare","ransomware":null,"records_affected":48600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-11-river-region-cardiology"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-11","discovered_date":"2023-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3f8d37233141ca99c622a4c022f8a5144fcddf5d","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31675.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6173d3eaa1d6","org_name":"Doxim","org_type":"technology_saas","ransomware":null,"records_affected":1636,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31675.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Doxim%2C%20Inc.-2024-12-16"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/DoximInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31675.pdf"}],"summary":"Doxim detected suspicious activity affecting systems supporting its credit union services, and its investigation found that files containing personal information had been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-11","discovered_date":"2024-04-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4c1a554e56254dcb535b3a14ca4db2c6eb61a621","impact_type":"unknown","incident_date":"2024-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"afced4ce4202","org_name":"D. P. Nicoli, Inc.","org_type":"unknown","ransomware":null,"records_affected":1207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#D.%20P.%20Nicoli%2C%20Inc.-2025-02-11"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#D.%20P.%20Nicoli%2C%20Inc.-2024-12-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1aced2d60b358ed7fb0207160c610ad7366f1a71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89fff9c41c73","org_name":"Community Connections","org_type":"healthcare","ransomware":null,"records_affected":18949,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-12-11-community-connections"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-11","discovered_date":"2024-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14dc9553b87e3d189526c83200b17bc9daf0dce5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB09792-Byte-letter-Consumer-baseline.pdf"},"notes":null,"org_country":"US","org_id":"a85143bf261c","org_name":"Byte Federal Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker gained access by exploiting a vulnerability in third-party software; the letter does not identify the software or vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595939"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB09792-Byte-letter-Consumer-baseline.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Byte%20Federal%20Inc.-2024-12-13"}],"summary":"Byte Federal reported that an attacker exploited a vulnerability in third-party software to access a server, with no evidence that customer personal information was compromised or misused.","supporting_quote":"On November 18, 2024, Byte Federal became aware of a security breach by a bad actor who gained unauthorized access to one of our servers by exploiting a vulnerability in software provided by a third party.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-12-10","discovered_date":"2024-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e52969f603085a04f8ff06c3cd4e3decec6f7ada","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20MSG%20Adult%20Individual%20Notification%20Letter%20v02___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"f3057faab1fa","org_name":"Martin Sprocket & Gear, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595922"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20MSG%20Adult%20Individual%20Notification%20Letter%20v02___Static_Proof_R1.pdf"}],"summary":"Martin Sprocket & Gear reported that an unauthorized user accessed a server containing personally identifiable information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09f85ffa0b6e1f1ff3848ccecf745786efe18e2d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"60449b5cbe83","org_name":"Senior Dating","org_type":"other","ransomware":null,"records_affected":765517,"reviewed":false,"root_cause":"The breach was attributed to an exposed Firebase database.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Senior Dating","type":"hibp","url":"https://haveibeenpwned.com/Breach/SeniorDating"}],"summary":"Senior Dating exposed personal information of users through an exposed Firebase database.","supporting_quote":"Attributed to an exposed Firebase database, the breach included extensive personal information on 766k users of the service including email addresses, photos, genders, links to Facebook accounts, dates of birth and precise latitude and longitude, among other personal attributes.","technology_involved":["Firebase"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2024-12-09","discovered_date":"2023-09-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"937dbf34932139b585a0471f25dcf8ffc69d2bdd","impact_type":"data_theft","incident_date":"2022-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Attachment%20A_Sabre%20Corporation_L01_SAS_2_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"dc60b199a47d","org_name":"Sabre GLBL Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595874"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Attachment%20A_Sabre%20Corporation_L01_SAS_2_Redacted_0.pdf"}],"summary":"Sabre GLBL Inc. reported that an unauthorized third party compromised employee-related information, some of which was posted on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6522d34271d71719678a6ca4d7d9c98bbf36b3e9","impact_type":"data_theft","incident_date":"2024-07-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"04abc0510161","org_name":"Ladies.com","org_type":"other","ransomware":null,"records_affected":118809,"reviewed":false,"root_cause":"A Firebase database was exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ladies.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ladies"}],"summary":"Ladies.com experienced a breach involving an exposed Firebase database and personal information about users.","supporting_quote":"Attributed to an exposed Firebase database, the breach included extensive personal information on 119k users of the service including email addresses, photos, sexual orientation, genders, dates of birth and precise latitude and longitude, among other personal attributes.","technology_involved":["Firebase"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-12-09","discovered_date":"2024-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"b9c7cf6f61069967d93c81d101ec92ae745852e1","impact_type":"data_theft","incident_date":"2024-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Artivion%20-%20CA%20Sample%20Notice%201.pdf"},"notes":null,"org_country":"US","org_id":"d1f3c73efa0d","org_name":"Artivion, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-605480"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/784199/000078419924000253/aort-20241209.htm"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Artivion%20-%20CA%20Sample%20Notice%201.pdf"}],"summary":"Artivion reported that an unauthorized third party accessed its network and obtained files containing some individuals’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0551853c50b25ad8227ab3e3cbfef1ab6982911d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enclosure%20%20A%20-%20Amegis-Letter_Adult-Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"0a9398f73217","org_name":"Amergis Healthcare Staffing, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enclosure%20%20A%20-%20Amegis-Letter_Adult-Final_Redacted.pdf"}],"summary":"Amergis reported unauthorized activity in email accounts containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-12-06","discovered_date":"2024-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca4a6dc166e9b6609d61c12f5bfc49dcf3b57c4b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orthopedics%20Rhode%20Island%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e70f0446f8b5","org_name":"Orthopedics Rhode Island, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595817"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orthopedics%20Rhode%20Island%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Orthopedics Rhode Island reported that an unknown actor acquired files containing personal, billing, claims, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-12-06","discovered_date":"2024-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc24c0dabe9f5e784a6316dba4842ddfd99e14c3","impact_type":"both","incident_date":"2024-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Highgate%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"cbf299d213f8","org_name":"Highgate Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595784"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Highgate%20-%20California%20Notification.pdf"}],"summary":"Highgate Hotels reported unauthorized access to files and employee email accounts, with some devices becoming unavailable.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeb33d0e0709c573ca63e5b98dd6d027c4bc39b6","impact_type":"unknown","incident_date":"2024-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ABC%20Legal%20-%20Redacted%20Notification%201YR.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3b1267c4f72","org_name":"ABC Legal Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595805"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31630.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-04","discovered_date":"2024-11-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa5abb7145d75dddeff7f75d3458b729f82b9f7f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Acadia%20-%20Consumer%20Notice%2012042024.pdf"},"notes":null,"org_country":"US","org_id":"5bfa09bbcf82","org_name":"Acadia Pharmaceuticals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595644"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Acadia%20-%20Consumer%20Notice%2012042024.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Acadia%20Pharmaceuticals%20Inc.-2024-12-04"}],"summary":"Acadia Pharmaceuticals sent community emails in which the recipient names did not match the email addresses, potentially disclosing registered names to other members.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"487957c427357ce625da2552862bc9a87277f48a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LA%20Financial%20%282%29%20-%20General%20Adult%20Notice%20Letter%20V.3%20%28Print%20Proof%29.pdf"},"notes":null,"org_country":"US","org_id":"b65358e525cd","org_name":"LA Financial Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600344"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595600"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596779"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596766"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LA%20Financial%20%282%29%20-%20General%20Adult%20Notice%20Letter%20V.3%20%28Print%20Proof%29.pdf"}],"summary":"LA Financial Federal Credit Union reported unauthorized access to one employee email account, where personal information may have been at risk.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ff19af47434e6fd93277dc0ba0172d272338f2b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bob%27s%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"9ba46adbd8f6","org_name":"Bob's Discount Furniture","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bob%27s%20-%20California%20Notification.pdf"}],"summary":"Bob’s reported unauthorized access to a file containing customers’ personal information and My Bob’s credit card/account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-12-03","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"70c9c216e83741b9dc441b30fe61e74bf74d67ac","impact_type":"unknown","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea1153fcf33e","org_name":"American Intercontinental University System","org_type":"unknown","ransomware":null,"records_affected":25864,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Intercontinental%20University%20System-2024-12-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-02","discovered_date":"2024-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"11556308fd0721d3462f6c1ead4af2f5847e6e5f","impact_type":"data_theft","incident_date":"2024-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31578.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"06e950cddf4b","org_name":"The Ability Experience","org_type":"nonprofit","ransomware":null,"records_affected":1409,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31578.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31578.pdf"}],"summary":"The Ability Experience reported unauthorized network access, and its investigation found that impacted files containing personal information may have been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-12-02","discovered_date":"2024-09-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d87e659b48c85c50e07157fb95ec4c44f285fb64","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAG%20-%20California%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"45fe0c5d8561","org_name":"SAG-AFTRA Health Plan","org_type":"healthcare","ransomware":null,"records_affected":937,"reviewed":false,"root_cause":"A phishing email resulted in the compromise of an employee’s email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599945"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595543"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAG%20-%20California%20Notification_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SAG-AFTRA%20Health%20Plan-2025-03-14"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32692.pdf"}],"summary":"A phishing email led to unauthorized access to an employee’s email account at SAG-AFTRA Health Plan.","supporting_quote":"This incident resulted from a phishing email, and it is important to note that the Plan’s systems were not impacted.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a81eecc97bea61ac8c3fd290d37c5637468bb63","impact_type":"data_theft","incident_date":"2024-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OSG%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f2f480a3895e","org_name":"Overseas Shipholding Group, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595514"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OSG%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31569.pdf"}],"summary":"An unauthorized actor accessed and/or took files from Overseas Shipholding Group’s computer systems, which contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-12-02","discovered_date":"2024-11-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e53e48afcfd81e8a933ea64dcc72b50090b152ef","impact_type":"disruption_or_ransomware","incident_date":"2024-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"ce020e2242aa","org_name":"ENGlobal Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/933738/000165495425000798/eng_8ka.htm"},{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/933738/000165495424015098/eng_8k.htm"}],"summary":"ENGlobal Corporation reported unauthorized access to part of its IT system, encryption of some data files, operational disruption, and access to a system containing sensitive personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc4b77082e11287bb9102311260d33296d72a356","impact_type":"unknown","incident_date":"2023-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/UPI_Redacted_Notice_SSN_34550051v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a4f55e5a7a6","org_name":"UniversalPegasus International","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595456"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-27","discovered_date":"2024-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"649bdac779a7ce884e13c597198e42693b5f9f39","impact_type":"data_theft","incident_date":"2024-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keesal%20Young%20%26%20Logan%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"35fda65a99a7","org_name":"Keesal, Young & Logan","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595481"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keesal%20Young%20%26%20Logan%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31547.pdf"}],"summary":"Keesal, Young & Logan reported unauthorized access to its network from June 7 to June 13, 2024, during which an actor acquired information stored there.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-11-26","discovered_date":"2024-11-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"40e5117f3865bffda692f998b55f460e51ff3bed","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18112.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a3034ba507f6","org_name":"Mason Therapy PLLC","org_type":"healthcare","ransomware":null,"records_affected":130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18112.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18112.pdf"}],"summary":"Mason Therapy PLLC reported that personal, medical, and billing information may have been accessible through its apps after potential breaches.","supporting_quote":null,"technology_involved":["Proton","Simple Practice","Phone.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9874cbf882d0678c86114b8198b0422315610a1","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HBP_CA%20%26%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"e1cb4c298d6f","org_name":"Holstrom, Block & Parke APLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595430"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HBP_CA%20%26%20Sample.pdf"}],"summary":"Holstrom, Block & Parke APLC reported that an unauthorized party accessed its network and may have accessed or taken files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6ca34833f72fbaf566a6ab78fd7143436618e48f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a24780d9ad9e","org_name":"Texas Tech University Health Sciences Center El Paso","org_type":"healthcare","ransomware":null,"records_affected":815000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-25-texas-tech-university-health-sciences-center-el-paso"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"220ba3b76266537f84e1bf758621320af6cf13f7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"efc6f6e66962","org_name":"Texas Tech University Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":650000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-25-texas-tech-university-health-sciences-center"},{"fetched_at":null,"title":"Leak-site claim by interlock","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VGV4YXMgVGVjaCBVbml2ZXJzaXR5IEhlYWx0aCBTY2llbmNlcyBDZW50ZXJAaW50ZXJsb2Nr"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"claim_groups":["interlock"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-25","discovered_date":"2024-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74714e834a8e119711c39b7cf9cbca6d77a72f6b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Datamaxx%20-%20Consumer%20Notification%20Letter%20Template__Static_Proof_R4.pdf"},"notes":null,"org_country":"US","org_id":"05677565bcd8","org_name":"Datamaxx Applied Technologies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595376"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Datamaxx%20-%20Consumer%20Notification%20Letter%20Template__Static_Proof_R4.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Datamaxx%20Applied%20Technologies%2C%20Inc.-2024-11-25"}],"summary":"Datamaxx determined that files may have been accessed or acquired without authorization and that some personal information was in the potentially affected data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"14178340b50d638b331454c16aa4ee49969347cd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65fe8fc8c37d","org_name":"Conceptions Reproductive Associates of Colorado","org_type":"healthcare","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-25-conceptions-reproductive-associates-of-colorado"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-11-22","discovered_date":"2024-02-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ad34719b8a1bd9d3a4b1bd8da39a22c2e229df2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Walsworth%20Publishing%20Company%20-%20Notice%20of%20Data%20Security%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"4d06c80b5a12","org_name":"Walsworth Publishing Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595255"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Walsworth%20Publishing%20Company%20-%20Notice%20of%20Data%20Security%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Walsworth%20Publishing%20Company-2024-11-22"}],"summary":"Walsworth reported that customer names and payment card information may have been involved in a potential incident affecting its website and purchasing page.","supporting_quote":null,"technology_involved":["website","purchasing page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4d0f30352132b0608afa194f5c2dc7643aaaf52","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"75c337366351","org_name":"The Real World","org_type":"education","ransomware":null,"records_affected":324382,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Real World","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheRealWorld"}],"summary":"The Real World experienced a data breach that exposed usernames, email addresses, and chat logs for 324,382 users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97e155b61c77f9c503c2ecab90f538ce51409221","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDED1838-6B52-4F2E-8572-854E71D52165"},"incident_date":"2024-11-22","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"bc32962afe5f","org_name":"Softway Medical Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tripwire.com/state-of-security/750000-patients-medical-records-exposed-after-data-breach-french-hospital;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/cyberattack-at-french-hospital-exposes-health-data-of-750-000-patients/"}],"summary":"\"A data breach at an unnamed French hospital exposed the medical records of 750,000 patients after a threat actor gained access to its electronic patient record system.\n\nA threat actor using the nickname 'nears' (previously near2tlg) claimed to have attacked multiple healthcare f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-22","discovered_date":"2024-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0edd2a8f76d68b02430cee01df95be9a106a07d3","impact_type":"data_theft","incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wave%203%20Notice_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"d76392d01f19","org_name":"LCPtracker, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597348"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595284"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596512"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wave%203%20Notice_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31500.pdf"}],"summary":"LCPtracker reported that an unauthorized actor accessed and acquired files and data stored in its online storage account environment between August 14 and August 20, 2024.","supporting_quote":null,"technology_involved":["online storage account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3a7cc08a04cde856153b3807faf1d6ae153b2bb","impact_type":"data_theft","incident_date":"2024-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dome%20Construction%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"1293e05f894e","org_name":"Dome Construction Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595283"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dome%20Construction%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"}],"summary":"Dome Construction Corporation reported that an unauthorized party accessed certain systems and copied files containing employee records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-22","discovered_date":"2024-09-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"994d048574c522f60b1e6b1ebf81dde12c8f3d14","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31502.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"80adc61a05e9","org_name":"Ardon Health, LLC","org_type":"healthcare","ransomware":null,"records_affected":6527,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ardon%20Health%2C%20LLC-2024-11-22"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31502.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31502.pdf"}],"summary":"An unauthorized third party accessed Ardon Health email accounts containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-21","discovered_date":"2024-04-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"612ace853ea9d16be1f66df13e7491d5e3f2adb6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Targus%20-%20California%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7144c79317cb","org_name":"Targus","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Targus%20-%20California%20Consumer%20Notification%20Letter.pdf"}],"summary":"Targus reported that a cybersecurity incident affected personal information, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24997524f3c5e411202278e721984b02743acf7b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spring%20EQ%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c4408e04855c","org_name":"Spring EQ LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595246"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spring%20EQ%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor accessed a Spring EQ employee’s email account, and the investigation could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-21","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20dead3e1bf6618d70c6453a70b9a4d177e3360e","impact_type":"both","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-23024%20Infosys%20W26%20Ad%20CM%2024m%20Farmers%20Gen%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"a6ccb17a2792","org_name":"Farmers New World Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595194"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-23024%20Infosys%20W26%20Ad%20CM%2024m%20Farmers%20Gen%20CA%20r2prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31499.pdf"}],"summary":"Ransomware encrypted IMS systems, and an investigation found unauthorized access to and acquisition of personal information related to Farmers New World Life Insurance Company policies and annuities.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"90084e73dc62a2a702dcbdd18e5e8ef7a4ae1752","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"237a7cff116a","org_name":"East Central Missouri Behavioral Health Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-21-east-central-missouri-behavioral-health-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dd5542f61183d46986f41b9214a81b0722af827","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7CFB8E6-7C28-4DC5-9FE4-D5D97C0747AC"},"incident_date":"2024-11-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08eb876e2523","org_name":"Blue Yonder","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kcra.com/article/software-company-grocery-stores-ransomware-attack/63007596;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.darkreading.com/cyberattacks-data-breaches/ransomware-attack-blue-yonder-starbucks-supermarkets;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbsnews.com/news/starbucks-ransomware-attack-blue-yonder-barista/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://therecord.media/starbucks-bic-morrisons-blue-yonder-supply-chain-attack-ransomware;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.blackfog.com/ransomware-meets-retail-blue-yonder-attack/;"},{"fetched_at":null,"title":"Leak-site claim by termite","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/Qmx1ZSBZb25kZXJAdGVybWl0ZQ"}],"summary":"\"“On November 21, 2024, Blue Yonder experienced disruptions to its managed services hosted environment, which was determined to be the result of a ransomware incident,” Blue Yonder said in an initial public statement on Friday. The company said in an updated statement on Saturday","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"claim_groups":["termite"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8e7b26fcea5f1e3499632f7709880255d59e9f8e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"831eafd755e3","org_name":"Laboratory Services Cooperative","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-20-laboratory-services-cooperative"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e143c2fa2c279b51a185838c3141ba826fb88b3b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-11-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d4d8c938b5e1","org_name":"FlipaClip","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exposed Firebase server led to records being exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FlipaClip","type":"hibp","url":"https://haveibeenpwned.com/Breach/FlipaClip"}],"summary":"FlipaClip records were exposed from an exposed Firebase server in November 2024.","supporting_quote":"In November 2024, the animation app FlipaClip suffered a data breach that exposed almost 900k records due to an exposed Firebase server .","technology_involved":["Firebase"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Firebase"},"updated_at":null,"veris_action":"error","derived":{"vendors":[{"id":"78ca4b4b0545","name":"Firebase"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8b2f8bf39677e91a7993165583c7e9a8f8056d1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BojanglesRestaurantsInc%20(1).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aaf4238310f2","org_name":"Bojangles Restaurants, Inc.","org_type":"unknown","ransomware":null,"records_affected":32721,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BojanglesRestaurantsInc%20(1).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190","T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4aa881426c51b8cd107d3f60b8fc09c7842ab6e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-23","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult.pdf"},"notes":null,"org_country":"US","org_id":"5429005320ea","org_name":"Pinnacle Claims Management, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The incident resulted from exploitation of a security vulnerability in Progress Software's MOVEit file transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595115"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult.pdf"}],"summary":"Pinnacle Claims Management was impacted by Progress Software’s MOVEit breach, which exposed information that may have included names.","supporting_quote":"Progress’s breach was caused by the exploitation of a security vulnerability in its MOVEit file transfer application.","technology_involved":["Progress Software","MOVEit file transfer application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"937c34b092b398a231bb8cc2d67a836089cb5214","impact_type":"data_theft","imported_from":null,"incident_date":"2024-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"7ed36e446e91","org_name":"Finsure","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Finsure","type":"hibp","url":"https://haveibeenpwned.com/Breach/Finsure"}],"summary":"Email addresses and other personal information associated with Finsure were obtained from the ActivePipe real estate marketing platform.","supporting_quote":null,"technology_involved":["ActivePipe"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ActivePipe"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"5cc0386afb63","name":"ActivePipe"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50f93e3d4e8e76f23707391277541a664ddfafbb","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vista%20Point%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"25db510709e7","org_name":"Vista Point Mortgage, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595056"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vista%20Point%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Vista Point Mortgage discovered unauthorized access to two employees’ email accounts, where information related to affected individuals was located.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac0d375f4f1028319f9d2ac9198257d7e5ecf4d3","impact_type":"data_theft","incident_date":"2024-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Tech%20Interactive%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"eb8c3298741d","org_name":"The Tech Interactive","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595054"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Tech%20Interactive%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"The Tech Interactive reported that an unknown actor accessed or acquired files containing personal information after gaining access to parts of its network between April 9 and April 13, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"063e08a8e111e6d1b9b6514ce19733567842a890","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b89763ff98a","org_name":"Terrace of Hialeah","org_type":"healthcare","ransomware":null,"records_affected":1177,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-18-terrace-of-hialeah"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"941502e8e9d549c6e37100feb3a156a70b334a72","impact_type":"unknown","imported_from":null,"incident_date":"2024-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0564e8c3139a","org_name":"iLearningEngines, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K CURRENT REPORT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1835972/000121390024099394/ea0221424-8k_ilearning.htm"}],"summary":"iLearningEngines reported unauthorized access to its environment and files, a misdirected $250,000 wire payment, and deletion of email messages.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-15","discovered_date":"2024-03-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"775894d5aff111e28615bf9537ebe04114b92cad","impact_type":"data_theft","incident_date":"2024-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31394.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6bbce7d443ec","org_name":"Witherspoon Brajcich McPhee, PLLC","org_type":"professional_services","ransomware":null,"records_affected":6419,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31394.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31394.pdf"}],"summary":"Witherspoon Brajcich McPhee, PLLC reported that an unknown actor accessed certain systems and took or viewed data that may have included Social Security numbers, taxpayer identification numbers, or business EINs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69bf7677c61eeb5f16e1d7c5ec64aaed60e06f84","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/RBNandAssociatesInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5ee07fc4c60","org_name":"RBN and Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":2326,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/RBNandAssociatesInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-11-15","discovered_date":"2024-08-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdcda29a066ca5d688f670f72ec1539f827c62d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OCH%20Template%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"80fb23b673f4","org_name":"Option Care Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594993"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OCH%20Template%20Notification.pdf"}],"summary":"An unknown party briefly accessed an Option Care Health employee's email inbox, and some patients' PHI may have been impacted.","supporting_quote":null,"technology_involved":["email inbox"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d55a61ebd123e1a377a46552f094f093c68737c0","impact_type":"unknown","incident_date":"2024-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Maxar%20-%20Adult%20CA%20Sample%20Ltr_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b513dc4279dd","org_name":"Maxar Space LLC and Maxar Space Robotics LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594961"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"41bfa53242cca40bf44bbd4bbc1bc41989a22dd2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb5f3e53b6c9","org_name":"ESHA, Inc.","org_type":"professional_services","ransomware":null,"records_affected":76922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-15-esha-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3e3ff2bfbddbd498eaa27a15cf8d933677b04081","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"47c699031f00","org_name":"ASPEN HEALTHCARE SERVICES INC","org_type":"healthcare","ransomware":null,"records_affected":7195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-15-aspen-healthcare-services-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Electronic Medical Record"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f2a981d9116877abcbf38e5e0ec137dbdd3733c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AmericanNeighborhoodMortgageAnnieMac.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0dc3189eb7a1","org_name":"American Neighborhood Mortgage","org_type":"unknown","ransomware":null,"records_affected":6218,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AmericanNeighborhoodMortgageAnnieMac.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-14","discovered_date":"2024-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc409d8c4f0eb03cf7010e366e3ee11236cfcd3d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MBCBreachTemplateUpdated111424.pdf"},"notes":null,"org_country":"US","org_id":"07d8637ee008","org_name":"Medical Board of California","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MBCBreachTemplateUpdated111424.pdf"}],"summary":"The Medical Board of California reported that a document containing personal information was erroneously uploaded to an unauthorized location.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e91cd2d49f91b3c9de9537e849f69ed33703d864","impact_type":"unknown","incident_date":"2023-12-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/KTBS_LAW_-_Notice_A_-_Adult_SSN%2834176409.1%29_Redacted_34486482v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ddcd63eae2e2","org_name":"KTBS Law LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594874"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-14","discovered_date":"2024-06-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e10be0fd9987f7de2f1d0bdaa74bf20dd258c53d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/El%20Dorado%20H.S.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f4798f4cd86f","org_name":"El Dorado Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594882"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/El%20Dorado%20H.S.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"El Dorado Union High School District reported unauthorized access to its environment and said information stored there could have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-14","discovered_date":"2024-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"ee13ebea6424a659df3c388a6376f5404d8289a9","impact_type":"data_theft","incident_date":"2024-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/AnnieMac%20Home%20Mortgage%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d332bb458f28","org_name":"AnnieMac Home Mortgage","org_type":"financial","ransomware":null,"records_affected":171074,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Neighborhood%20Mortgage%20Acceptance%20Company%2C%20LLC%20%28AnnieMac%20Home%20Mortgage%29-2024-11-14"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594854"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AnnieMac%20Home%20Mortgage%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31385.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AnnieMac%20Home%20Mortgage%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"AnnieMac Home Mortgage reported that an unknown actor accessed systems and viewed or copied files containing names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bcac27dca36c8478f72ef5d0eaf9ebd0322ea944","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"076fa335cf98","org_name":"Rocky Mountain Gastroenterology Associates PLLC","org_type":"healthcare","ransomware":null,"records_affected":366491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-13-rocky-mountain-gastroenterology-associates-pllc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9acdf010d7cf420dcc4e629ccdc3576b4ccb561b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"226374707a21","org_name":"DemandScience","org_type":"professional_services","ransomware":null,"records_affected":121796165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DemandScience by Pure Incubation","type":"hibp","url":"https://haveibeenpwned.com/Breach/DemandScience"}],"summary":"Data associated with DemandScience appeared for sale on a hacking forum and included business contact information and social media profile links.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2401482e80b2b76be8d677dd14edd3a2959b65f2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d009ce42a6fe","org_name":"Radiologic Medical Services, P.C.","org_type":"healthcare","ransomware":null,"records_affected":56902,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-12-radiologic-medical-services-p-c"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-12","discovered_date":"2024-09-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc3d063d06fc959176813c41388f703264ddf4a9","impact_type":"data_theft","incident_date":"2024-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PLA%20-%20California%20Regulatory%20Reporting_0.pdf"},"notes":null,"org_country":"US","org_id":"9ee1eeb726a8","org_name":"Pallet Logistics of America","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594751"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PLA%20-%20California%20Regulatory%20Reporting_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31346.pdf"}],"summary":"Pallet Logistics of America reported that an unauthorized actor acquired limited files from legacy systems, and personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-12","discovered_date":"2023-08-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d4c4d403ef85180f0c3798fbc0939905e68301a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Great%20Star%20Tools%20USA%20-%20Supplemental%20%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"1d8fbf4e6e9e","org_name":"Great Star Tools USA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597090"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594733"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Great%20Star%20Tools%20USA%20-%20Supplemental%20%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed certain Great Star systems between August 2 and August 17, 2023, and may have viewed or copied data that included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a63e92636f7ba1aca221688f41f61ac17de73495","impact_type":"unknown","incident_date":"2024-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/G%20Adventures%20Sample%20Consumer%20Notice%20Letters.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64469a2e7b37","org_name":"G Adventures Inc. (“G Adventures”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594755"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-12","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"52ac35d0bbe264cdd9d1dca7a137194f4f4477fa","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31347.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a42bf0de7cde","org_name":"Colorado Technical University","org_type":"education","ransomware":null,"records_affected":22236,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31347.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colorado%20Technical%20University-2024-12-03"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31347.pdf"}],"summary":"Colorado Technical University information held by FBCS may have been accessed or exfiltrated during unauthorized access to FBCS systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FBCS"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"eb6cbc3b5d80","name":"FBCS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-12","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd4eb30fec82633546ccc4509e1669fd5fd3fc40","impact_type":"data_theft","incident_date":"2024-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calibrated%20-%20Fourth%20Supplemental%20CA%20Notice%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"29d0b53e9715","org_name":"Calibrated Healthcare, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594766"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calibrated%20-%20Fourth%20Supplemental%20CA%20Notice%20Exhibit%201_0.pdf"}],"summary":"Calibrated Healthcare, LLC found that certain files were likely copied without authorization after portions of its systems were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-12","discovered_date":"2023-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"204baaa972b85c1ad3857f4054ec6f3a3ed5deb7","impact_type":"data_theft","imported_from":null,"incident_date":"2023-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAMPLE%20Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"bfd05467d443","org_name":"ASM Global Parent, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594767"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594728"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20Individual%20Notice_0.pdf"}],"summary":"ASM Global reported that files were accessed and acquired during unauthorized activity involving certain legacy systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-11","discovered_date":"2024-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8e8e1819c542169079acc9b678e1bff9478f29e","impact_type":"data_theft","incident_date":"2024-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Misionero%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"61e7b7d383a8","org_name":"Misionero Vegetables","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Misionero%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Misionero Vegetables reported that files containing personal information were accessed or acquired without authorization from September 26 to September 27, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b171603b5b811be11b5d01b1312aa4e1f0ea6edb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f441274010a","org_name":"Humboldt Independent Practice Association (Humboldt IPA)","org_type":"healthcare","ransomware":null,"records_affected":26353,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-11-humboldt-independent-practice-association-humboldt-ipa"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d2a74f03985d2dbe26663e94728b6cd5dcc4211","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"334d136d34ba","org_name":"Hot Topic","org_type":"retail_ecommerce","ransomware":null,"records_affected":56904909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hot Topic","type":"hibp","url":"https://haveibeenpwned.com/Breach/HotTopic"}],"summary":"Hot Topic reported a data breach exposing personal information and partial credit card data associated with 56,904,909 email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1485","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-11-11","discovered_date":"2024-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99ce1f4f0861adc4c053a175ea979c50aaf653da","impact_type":"both","imported_from":null,"incident_date":"2023-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024%2011%2011%20Letter%20to%20CA%20AG%20with%20Sample%20Letters_0.pdf"},"notes":null,"org_country":"US","org_id":"bc4c26fd128b","org_name":"BBS Financial Services, LLC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024%2011%2011%20Letter%20to%20CA%20AG%20with%20Sample%20Letters_0.pdf"}],"summary":"BBS Financial Services reported that a threat actor accessed part of its network, exfiltrated data including medical billing records, and demanded ransom for its deletion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3972e6234cafcfc273b451c0ca55dd5d69c75021","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Set%20Forth-%20Draft%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5cf17863e4c9","org_name":"Set Forth, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594625"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Set%20Forth-%20Draft%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SetForthInc.pdf"}],"summary":"Set Forth reported that personal information may have been accessed during an incident identified on May 21, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3475168ea57c718dab8cb7ae69c66866abeeb56a","impact_type":"data_theft","incident_date":"2024-02-22","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31327.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"14e53c354e5d","org_name":"Inszone Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":18649,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31327.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31327.pdf"}],"summary":"Inszone reported that data stored on one of its systems may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5b6cd24f7b8ff809c0233b894b30d58af3541caa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7a0630cee8cb","org_name":"Huron Inc. Health Plan","org_type":"healthcare","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-08-huron-inc-health-plan"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3265a143b3f524393e773195603a1daf52ffbb32","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-28","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_Rev3_0.pdf"},"notes":null,"org_country":"US","org_id":"dcf99845d577","org_name":"Allocation Services, Inc. dba IMPAXX","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594588"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_Rev3_0.pdf"}],"summary":"A former employee retained personal information processed by IMPAXX after their employment ended; the organization reported no evidence that it was shared.","supporting_quote":"In April 2024, we became aware that a former employee had potentially retained a copy of certain data after their employment with IMPAXX concluded.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-07","discovered_date":"2024-10-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a6a8b1d1368e9deed8bbd586b9391c32147cdf7e","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-10-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"b61bf0cccdf8","org_name":"Newpark Resources","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/71829/000007182924000111/nr-20241029.htm"}],"summary":"Newpark Resources detected a ransomware incident in which an unauthorized third party accessed certain internal information systems, disrupting access to some systems and business applications.","supporting_quote":null,"technology_involved":["internal information systems","business applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8a916aa721420c21ead89fd06477e0e3dc96c1e4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd4ab0708bc8","org_name":"Great Plains Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":133149,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-07-great-plains-regional-medical-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0db6da8db5310be1391298e1c88a187f6255baee","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"af771f1792fc","org_name":"Earth 2","org_type":"technology_saas","ransomware":null,"records_affected":420961,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Earth 2","type":"hibp","url":"https://haveibeenpwned.com/Breach/Earth2"}],"summary":"Email addresses and usernames associated with Earth 2 were derived from embedded Gravatar images.","supporting_quote":null,"technology_involved":["Gravatar"],"third_party":{"archetype":null,"involved":true,"vendor":"Gravatar"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"01a9f23a2014","name":"Gravatar"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-11-07","discovered_date":"2024-06-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0cf728193735cb15ac59e746c73cb12ebbb58e4","impact_type":"data_theft","incident_date":"2024-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Acadian%20Ambulance%20Service%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"1a63415c23b9","org_name":"Acadian Ambulance Service, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594566"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Acadian%20Ambulance%20Service%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Acadian%20Ambulance%20Service%2C%20Inc.-2024-11-07"}],"summary":"Acadian Ambulance Service reported unauthorized access to its systems and that files containing personal and medical information were or may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other"],"disclosed_date":"2024-11-06","discovered_date":"2024-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9464ea40d33f9ad52d5f6831cd6bd8baed23e2a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data%20Breach%20Kroll.pdf"},"notes":null,"org_country":"US","org_id":"b24200002af2","org_name":"Preferred Travel Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594479"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data%20Breach%20Kroll.pdf"}],"summary":"An unauthorized third party accessed certain I Prefer program accounts and related login credentials, loyalty points or certificates, and reservation information.","supporting_quote":null,"technology_involved":["I Prefer loyalty program portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4b60c4720300186b4fe67ad7681f7095ccae37d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6693c7206a7","org_name":"Fiskars Group (Fiskars)","org_type":"unknown","ransomware":null,"records_affected":6306,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fiskars%20Group%20%28Fiskars%29-2024-11-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-05","discovered_date":"2024-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e0c2714f8dcd0e77eb9a6711ca858d99ed886cb","impact_type":"both","incident_date":"2024-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Diligent%20-%20Adult%20Template%20Notification%20Letter__Static_Proof_R4.pdf"},"notes":null,"org_country":"US","org_id":"6753f4a0113c","org_name":"Diligent Delivery Systems","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594425"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Diligent%20-%20Adult%20Template%20Notification%20Letter__Static_Proof_R4.pdf"}],"summary":"Diligent Delivery Systems reported that an unknown actor accessed and obtained company data, disrupting access to some systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2024-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"856af37b6d8e33b8a85b5f3655728b795682b21a","impact_type":"data_theft","imported_from":null,"incident_date":"2021-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"182c9119ec32","org_name":"Dennis Kirk","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dennis Kirk","type":"hibp","url":"https://haveibeenpwned.com/Breach/DennisKirk"}],"summary":"Data associated with Dennis Kirk’s online store, including customer contact details and purchase information, was circulated.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2024-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"525b2d1f6e87618c1a141e9fe071bc023e721a03","impact_type":"data_theft","imported_from":null,"incident_date":"2022-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"858469d54fa9","org_name":"Altenen","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Altenen","type":"hibp","url":"https://haveibeenpwned.com/Breach/Altenen"}],"summary":"Altenen suffered a data breach in June 2022, and the exposed data included email addresses, usernames, password hashes, and cryptocurrency wallet addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2024-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24e4c3a089a7ee7ecb60b3371191bbacd79a6914","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d53764a4305b","org_name":"Z-lib","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Z-lib","type":"hibp","url":"https://haveibeenpwned.com/Breach/ZLib"}],"summary":"In June 2024, data from Z-lib was discovered exposed online, including usernames, email addresses, locations, wallet addresses, purchases and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be5f70dd6d2db1e8728b6d2d58c072cd71dab45e","impact_type":"both","incident_date":"2024-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RedwoodCoast-letter-General.pdf"},"notes":null,"org_country":"US","org_id":"3183f7bb7006","org_name":"Redwood Coast Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594369"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RedwoodCoast-letter-General.pdf"}],"summary":"Redwood Coast Regional Center reported a network disruption and that an unauthorized individual acquired information that may have included personal, medical, and financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"590c02ce1cc20a941e92948fefd45ff2ca2a81b3","impact_type":"unknown","incident_date":"2023-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Raimondo%20Pettit%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"626c71a47d8f","org_name":"Raimondo Pettit Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594359"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-11-04","discovered_date":"2024-09-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c0cfdbbe3fbd8413e28789f1e3c8966dd3ca0eb","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MWI%20Individual%20Notice%20-%20California.pdf"},"notes":null,"org_country":"US","org_id":"1f2ddf60e9de","org_name":"MWI Veterinary Supply, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594357"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MWI%20Individual%20Notice%20-%20California.pdf"}],"summary":"MWI Veterinary Supply reported that personal information, including health insurance information, was involved in a data security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee5d438532c33513ad7b48faaf2f02a9eb44b85c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"e1134dcb8fec","org_name":"Cornerstone Healthcare Group Management Services LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594295"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter_0.pdf"}],"summary":"Cornerstone Healthcare Group Management Services LLC reported unauthorized access to data that included personal information, with the breach confirmed on December 19, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-01","discovered_date":"2024-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1df2dd16eb2867846d243ed7fefbce574fd30157","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Specimen.pdf"},"notes":null,"org_country":"US","org_id":"dfd53cc6f467","org_name":"Van Wagner Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594205"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Specimen.pdf"}],"summary":"Van Wagner Group, LLC reported that a malware incident may have involved personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b64a919016b1111e297fc0956179e99533e450d0","impact_type":"data_theft","incident_date":"2024-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%5B2024%5D%2012.27%20-%20True%20World%20Sample%20Notice%20Letter%20-%2012%20month.pdf"},"notes":null,"org_country":"US","org_id":"cbf6e3ada6a5","org_name":"True World Holdings LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-596599"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594278"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595297"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%5B2024%5D%2012.27%20-%20True%20World%20Sample%20Notice%20Letter%20-%2012%20month.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30878.pdf"}],"summary":"True World Holdings reported that unauthorized actors copied files from its network, including files that may contain customer personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"a2e925d0eaebe3d6d9d108e73d77dc1d7fab61bb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"11f990125a65","org_name":"Northeast Professional Home Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-01-northeast-professional-home-care-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-11-01","discovered_date":"2024-09-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d89aba1944ff50cb9ad0236aef55a9892d8fc9b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"69635eabb44e","org_name":"Kaiser Foundation Hospitals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594220"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20FINAL.pdf"}],"summary":"An unauthorized party accessed two Kaiser Permanente workforce members’ email accounts, exposing protected health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-11-01","discovered_date":"2024-10-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f450f8da707c4dfc19e6548ef9faf052248bdafd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31249.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"88ff6adda5a2","org_name":"Green Dot Corporation","org_type":"financial","ransomware":null,"records_affected":1715,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31249.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31249.pdf"}],"summary":"An unauthorized third party requested information from a Green Dot system and received a response containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"3a17f3371b1aa19571fdd3748380dd3446ed6f36","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24de22250876","org_name":"Brain & Eye Connection Vision Clinic, PC","org_type":"healthcare","ransomware":null,"records_affected":2207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-11-01-brain-eye-connection-vision-clinic-pc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2024-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d2a853accfee7924cc2ec989382b4200b9c9a6a","impact_type":"unknown","incident_date":"2020-05-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"7b343e1e4652","org_name":"Stalker Online","org_type":"unknown","ransomware":null,"records_affected":1385472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Stalker Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/StalkerOnline"}],"summary":"In May 2020, over 1.3M records from the MMO game Stalker Online were breached . The data included email and IP addresses, usernames and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2024-10-31","discovered_date":"2024-09-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"799799fd1a02fe466970098c911f92cdaabcd4fa","impact_type":"data_theft","incident_date":"2024-01-07","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Samples_0.pdf"},"notes":null,"org_country":"US","org_id":"ef1a8e499ca6","org_name":"SelectBlinds","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594202"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Samples_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SelectBlinds-2024-10-31"}],"summary":"SelectBlinds reported that an unauthorized third party embedded malware on its website to scrape checkout transactions, potentially obtaining personal, payment-card, and account data.","supporting_quote":null,"technology_involved":["SelectBlinds website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-31","discovered_date":"2024-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d80268796c54123d13e11d98f1e178db277363e2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BNB_General%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"bdf99271ef56","org_name":"BNBuilders","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594198"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BNB_General%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31248.pdf"}],"summary":"BNBuilders reported a data security incident that may have affected personally identifiable information, including names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5b017adc9b05c19d47bb90dcdd26cd405be8655","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"8a270d9c8981","org_name":"VimeWorld","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: VimeWorld","type":"hibp","url":"https://haveibeenpwned.com/Breach/VimeWorld"}],"summary":"VimeWorld suffered a data breach in October 2018 involving usernames, email and IP addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ac31055449f3b24c7f9619f2d857f5474de4158","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"363132ea21aa","org_name":"TNAFlix","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TNAFlix","type":"hibp","url":"https://haveibeenpwned.com/Breach/TNAFlix"}],"summary":"TNAFlix suffered a data breach in June 2022 that exposed email and IP addresses, usernames, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-30","discovered_date":"2024-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec2e891497739f1118a0f554912c205dd4572778","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Soliant%20-%20Regulatory%20Notice_CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"db4c6eeb6aa3","org_name":"Soliant Health, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594103"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Soliant%20-%20Regulatory%20Notice_CA_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31230.pdf"}],"summary":"Soliant discovered suspicious activity associated with an employee’s email account, and its investigation found that personal information may have been acquired without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-30","discovered_date":"2024-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"93696504f244b2c72e399ee1c0a38a127aad8137","impact_type":"unknown","incident_date":"2024-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31231.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2d12b78c8005","org_name":"Sierra Construction Company, Inc.","org_type":"other","ransomware":null,"records_affected":1103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31231.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31231.pdf"}],"summary":"Sierra Construction reported a security incident affecting part of its environment, and certain employment-related information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"574744d9e39bcd4f3ce37ee8cc4b58d16abf8518","impact_type":"data_theft","incident_date":"2024-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Solairus%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5a2e4ef05755","org_name":"Solairus Aviation, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594042"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Solairus%20-%20California%20Notification.pdf"}],"summary":"Solairus Aviation determined that files containing personal, health insurance, and financial account information may have been taken by an unauthorized party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-28","discovered_date":"2024-01-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26f4b20d43903e6d0693d5f4d07ffa05d7facf8d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_10_0.pdf"},"notes":null,"org_country":"US","org_id":"639008ae285d","org_name":"CUSO Financial Services, LP","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594024"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_10_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CUSO%20Financial%20Services%2C%20LP-2024-10-28"}],"summary":"An unauthorized individual accessed a CUSO employee account used with a third-party communications archiving service, which contained personal information.","supporting_quote":null,"technology_involved":["communications archiving service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4887542fdbe42a0bee5eab5dcf9009ff4a36420a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/AutobellCarWashLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69e26d83a7b9","org_name":"Autobell Car Wash, LLC","org_type":"unknown","ransomware":null,"records_affected":3210,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/AutobellCarWashLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60518624e1d90d6cdf71ae7bdab40bcd2e5a3951","impact_type":"data_theft","imported_from":null,"incident_date":"2020-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"76b8294a9c0d","org_name":"StreamCraft","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: StreamCraft","type":"hibp","url":"https://haveibeenpwned.com/Breach/StreamCraft"}],"summary":"StreamCraft suffered a data breach involving usernames, email and IP addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccb342ae334aa75588b9fd1cc36456aefecd7ea5","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"cb2bb6836a42","org_name":"The Club Penguin Experience","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Club Penguin Experience","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheClubPenguinExperience"}],"summary":"The Club Penguin Experience breach exposed subscribers’ email addresses, usernames, age groups, password hashes, and some plain-text password hints.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-25","discovered_date":"2024-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"223df7ff1d5139eba0a910827d8d62e6e641ba3d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31140.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d157aae1c71f","org_name":"Wireless Communications, Inc.","org_type":"telecom","ransomware":null,"records_affected":508,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wireless%20Communications%2C%20Inc.%20dba%20Cellular%20Plus-2024-10-25"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31140.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31140.pdf"}],"summary":"Wireless Communications, Inc. reported unauthorized network access on or about August 15, 2024, and said files containing personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84e28da386f55b6768218c6a3ba8581fb084c59e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-09-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"113427cbe88c","org_name":"digiDirect","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: digiDirect","type":"hibp","url":"https://haveibeenpwned.com/Breach/digiDirect"}],"summary":"A breach sourced from digiDirect was published to a hacking forum, exposing personal information including email and physical addresses, names, phone numbers, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-24","discovered_date":"2024-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e52fec2ed3a5f5688c290650135e4fae1707e0e1","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WorkWave-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"101aef7e0e79","org_name":"TEAM Software","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593874"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594758"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WorkWave-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TEAM%20Software-2024-11-12"}],"summary":"TEAM Software reported that an unauthorized actor accessed certain systems and that personal information may have been accessible or taken.","supporting_quote":null,"technology_involved":["TEAM Software application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"dbc7f8380ef5b11203553d8c8189663148aadace","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d3912b63ad5","org_name":"Gandara Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":20024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-24-gandara-mental-health-center"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-24","discovered_date":"2024-03-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1388c4c89bcb0452b3e86e2ba6fd70d1b1cd9c1","impact_type":"data_theft","incident_date":"2024-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chimienti%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"d09ecd70f7ff","org_name":"Chimienti & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chimienti%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Chimienti%20%26%20Associates-2024-10-24"}],"summary":"Chimienti & Associates reported that an unauthorized actor viewed and/or copied data from a single internal email account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82bdf227b2ec945e298b97a62386d9dc134a925f","impact_type":"unknown","incident_date":"2024-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A_9.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a0f63b4a60d","org_name":"Toro Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593813"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-23","discovered_date":"2024-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccf2da86c3f3b961a32f3d4597ddc2011008cb3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Systems%20Application%20%26%20Technologies%2C%20LLC%20dba%20SA-TECH%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6b37b4b981c3","org_name":"Systems Application & Technologies Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593790"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Systems%20Application%20%26%20Technologies%2C%20LLC%20dba%20SA-TECH%20-%20Sample%20Notice.pdf"}],"summary":"Systems Application & Technologies Inc. reported that certain files and folders were accessed and/or taken without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-23","discovered_date":"2024-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c509147ef3d03694d56c4f84385b268c403dc03e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20No%20CM%20%28Tristar%20letters%29.pdf"},"notes":null,"org_country":"US","org_id":"3435cb25180a","org_name":"OnePoint Patient Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598340"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593770"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595288"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20No%20CM%20%28Tristar%20letters%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OnePoint%20Patient%20Care-2024-10-23"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/OnepointPatientCare.pdf"}],"summary":"OnePoint Patient Care reported that an unauthorized third party acquired information from its network between August 6 and August 8, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f85002b183e96bf8698a407197f939ec51be2105","impact_type":"data_theft","imported_from":null,"incident_date":"2024-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MMI%20Services%20Inc.%20-%20Notice%20Template%20Letter%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"5519c570bb8b","org_name":"MMI Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593795"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MMI%20Services%20Inc.%20-%20Notice%20Template%20Letter%20Proof.pdf"}],"summary":"MMI Services, Inc. reported that an unauthorized actor may have acquired limited information related to individuals during a network disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-23","discovered_date":"2024-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c7e392fdfc63c176d12077646fa191d60fc1880","impact_type":"both","incident_date":"2024-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20Sample%20Letter%20-%20Wave%201%20-%20Landmark.pdf"},"notes":null,"org_country":"US","org_id":"c62ee73b5172","org_name":"Landmark Admin, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601278"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593796"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20Sample%20Letter%20-%20Wave%201%20-%20Landmark.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Landmark%20Admin%2C%20LLC-2024-10-23"}],"summary":"Landmark Admin detected suspicious activity, and an investigation found unauthorized network access, data encryption, and data exfiltration.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-23","discovered_date":"2023-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09bc8890340fd85ef05552e2762def4072d0ae0c","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_M2244_HENRY_SCHEIN_INC_%2316_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"8611d6b1df67","org_name":"Henry Schein, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_M2244_HENRY_SCHEIN_INC_%2316_L01_SAS_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Henry%20Schein%2C%20Inc.-2024-10-23"}],"summary":"Henry Schein reported a cybersecurity incident that disrupted some operations and resulted in personal information being obtained by an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abdbfc4539a6cb417a1816e8dfa42f3acaf30e68","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"CA","org_id":"a12b6e775e6b","org_name":"Fair Vote Canada","org_type":"nonprofit","ransomware":null,"records_affected":134336,"reviewed":false,"root_cause":"A volunteer inadvertently exposed data from 2020.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fair Vote Canada","type":"hibp","url":"https://haveibeenpwned.com/Breach/FairVoteCanada"}],"summary":"Fair Vote Canada data from 2020 was inadvertently exposed by a volunteer.","supporting_quote":"The incident was attributed to \"a well-meaning volunteer\" who inadvertently exposed data from 2020 which included 134k unique email addresses, names, physical addresses, phone numbers and, for some individuals, date and amount of a donation.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6cfd0a48303abcd4872e211f1a2b94e300bea7d3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AdamsHomesInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7a01b2282af","org_name":"Adams Home Realty, Inc.","org_type":"unknown","ransomware":null,"records_affected":811,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AdamsHomesInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"236c71bb82aedf14aa20af80386fefd24ccb0c2e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheCityofColumbus.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e835443ec39c","org_name":"The City of Columbus, Ohio","org_type":"unknown","ransomware":null,"records_affected":106,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheCityofColumbus.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"43968f129f2aa13d9a3846a0403cb9629d28bfee","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab20e72cc895","org_name":"Summit Pathology and Summit Pathology Laboratories, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1813538,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-18-summit-pathology-and-summit-pathology-laboratories-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-10-18","discovered_date":"2024-04-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a510142daf16e0ad63d763d04ad634bf3df888a","impact_type":"unknown","imported_from":null,"incident_date":"2024-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31027.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5342d8b0082a","org_name":"Summit Pathology","org_type":"healthcare","ransomware":null,"records_affected":3250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31027.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31027.pdf"}],"summary":"Summit Pathology identified suspicious activity in its computer environment, and files containing demographic and healthcare information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-10-18","discovered_date":"2024-04-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecfbef07112de3d65f132c0340a117fa2b0cce65","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Summit%20Pathology%20-%20Notification%20Letter%20-%20Adult%20%28General%29%20v2___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"5342d8b0082a","org_name":"Summit Pathology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Summit%20Pathology%20-%20Notification%20Letter%20-%20Adult%20%28General%29%20v2___Static_Proof_R1.pdf"}],"summary":"Summit Pathology identified suspicious activity in its computer environment, and files containing personal, medical, and financial information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"fdbbc18403316af93097339cb11f6ba2f96d8ba9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea9021468e57","org_name":"RRCA Accounts Management Inc.","org_type":"professional_services","ransomware":null,"records_affected":115837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-18-rrca-accounts-management-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Desktop Computer","Network Server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f545891575d972c0168f19a38bd36ab7ec8a8641","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18181.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8345444c82ac","org_name":"Falco Sult & Company, PS","org_type":"professional_services","ransomware":null,"records_affected":1788,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18181.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM18181.pdf"}],"summary":"Falco Sult found evidence that an unauthorized actor accessed some files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"837b501ae87c7a7c49ca89f75c26dea9dfc97d8a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f7403dfdadac","org_name":"Detroit Wayne Integrated Health Network","org_type":"healthcare","ransomware":null,"records_affected":3347,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-18-detroit-wayne-integrated-health-network"}],"summary":null,"supporting_quote":null,"technology_involved":["Laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"00b41dbea1de7aae4ed7af3a4af91f7138685fab","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"75da14bbd941","org_name":"Clay Platte Family Medicine","org_type":"healthcare","ransomware":null,"records_affected":53916,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-18-clay-platte-family-medicine"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-18","discovered_date":"2024-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5114927678fb2931aae956da56b1d0768927d69","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-11","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31241.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"065577ef1ea6","org_name":"City of Richland","org_type":"government","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31241.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31241.pdf"}],"summary":"The City of Richland reported that an unknown actor accessed certain computer systems and may have accessed or taken information including names, Social Security numbers, and incidental health references.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-18","discovered_date":"2024-09-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f45edbfd34e7c7176ec9ca40a4d210ba309bf5a1","impact_type":"unknown","incident_date":"2024-02-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc5139988f4c","org_name":"Central School District 13J","org_type":"unknown","ransomware":null,"records_affected":13992,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Central%20School%20District%2013J-2024-10-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"5ae0bd3921c45b6a3f19ae4ee510178822437e1f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1f313b37656","org_name":"Advanced Recovery Equipment & Supplies, LLC","org_type":"healthcare","ransomware":null,"records_affected":56000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-18-advanced-recovery-equipment-supplies-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5a374b452f3ef59bdf1f63dce5ec7d6404b8d2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20%E2%80%93%20Adult%201%20YR%20CM_R2_Source-c_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7adf718dd592","org_name":"Abbott Laboratories Employees Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593556"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20%E2%80%93%20Adult%201%20YR%20CM_R2_Source-c_Redacted.pdf"}],"summary":"An unauthorized third party accessed an ALEC employee email account and may have acquired personal information contained in it.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38ce1ad58fe9a83278612d2c407d88fd88a0a16e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-10-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"750beeea8fc5","org_name":"1stUnited Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_Redacted.pdf"}],"summary":"1stUnited Credit Union reported that mail containing paper checks endorsed with customers’ names and account numbers was stolen in transit.","supporting_quote":"On October 7, 2024, we were notified that our mail courier was interrupted in transit and our mail was stolen.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-17","discovered_date":"2024-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"629bd7c87e4142a1e66da867cd4aea9608e19397","impact_type":"data_theft","incident_date":"2024-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LWC%20-%20Exhibit%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"622d7de7663d","org_name":"Loring, Wolcott & Coolidge","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LWC%20-%20Exhibit%20-%20CA_0.pdf"}],"summary":"Loring, Wolcott & Coolidge reported malware activity that led to unauthorized access to and, in some cases, acquisition of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa706b2b0b0fbc2fb21667620821b943f6ba4268","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"44cc18f398c7","org_name":"AlpineReplay","org_type":"technology_saas","ransomware":null,"records_affected":898681,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AlpineReplay","type":"hibp","url":"https://haveibeenpwned.com/Breach/AlpineReplay"}],"summary":"AlpineReplay suffered a 2019 data breach that exposed user information, including email addresses, names, usernames, dates of birth, physical attributes, and password hashes.","supporting_quote":null,"technology_involved":["AlpineReplay"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-16","discovered_date":"2024-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cfdd2a69f810343cfdb10b42f571cad00fba9f2","impact_type":"data_theft","incident_date":"2023-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Casad%20Company%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"3c321319df85","org_name":"Totally Promotional","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593446"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595375"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Casad%20Company%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Totally%20Promotional-2024-10-16"}],"summary":"Totally Promotional reported that unauthorized code on its website payment platform could have captured customers’ names and payment card information.","supporting_quote":null,"technology_involved":["website payment platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-16","discovered_date":"2024-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6259fe4cd7e7b4d7c2d64901ef8bc44eee2617a4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31007.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3a5afcfa106e","org_name":"Form I-9 Compliance","org_type":"unknown","ransomware":null,"records_affected":3514,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Form%20I-9%20Compliance-2024-10-16"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31007.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FormI-9Compliance.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31007.pdf"}],"summary":"An unauthorized third party accessed a portion of Form I-9 Compliance’s network, affecting some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e418e6ca84fc982f295ab2967886d930b5de2346","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BC%20breach%20notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"3ec2e37bb5ad","org_name":"Birth Choice of San Marcos","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BC%20breach%20notification%20letter_0.pdf"}],"summary":"Birth Choice of San Marcos notified clients that potentially impacted health information was held on systems accessed during an incident at National Diagnostic Imaging.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"National Diagnostic Imaging"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c2fe88a4fef2","name":"National Diagnostic Imaging"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52f1e7ecb3c506c8ee4c6ded4639a842b670c3a4","impact_type":"unknown","incident_date":"2023-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/Save%20Mart%20Supermarkets%2C%20LLC%20%E2%80%93%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10e8e604eb8e","org_name":"Save Mart Supermarkets, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593385"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2cd971865782ba2bd3ca7a7f69d8c1828d1cc3b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dd44b443e188","org_name":"Key Benefit Administrators","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Key%20Benefit%20Administrators-2024-10-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-14","discovered_date":"2024-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab51423396ddd5ab6a49979b7e2978912f6dcfbb","impact_type":"data_theft","incident_date":"2024-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter%20%2810%2014%2024%29%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"538db90f6beb","org_name":"Varsity Brands Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593321"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter%20%2810%2014%2024%29%20%282%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17814.pdf"}],"summary":"Varsity Brands identified unusual activity, and an unauthorized third party obtained a subset of company files that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-12","discovered_date":"2023-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1efa6007832f4096ba47d9fc249560580dfeb19","impact_type":"data_theft","incident_date":"2023-11-08","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/10.1.24%20Tri-City%20-%20Adult%20Template%20Notification%20Letter%2811832080.1%29_v2__Static_Proof_R2.pdf"},"notes":null,"org_country":"US","org_id":"c07493017a29","org_name":"Tri-City Healthcare District","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593304"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/10.1.24%20Tri-City%20-%20Adult%20Template%20Notification%20Letter%2811832080.1%29_v2__Static_Proof_R2.pdf"}],"summary":"Tri-City Healthcare District reported that an unknown actor accessed and obtained data from its network, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1bf2b320fc0278ec8b9d15a63cbee077fc179cb8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"203343125a60","org_name":"Wilmington Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":11601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-11-wilmington-community-clinic"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-10-11","discovered_date":"2024-08-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3450d61725dd0910456ae6bd5aca6b744c1fc3de","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_M2014_Wellfleet_Group_L02_SAS_0_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"65649c6534f8","org_name":"Wellfleet Group, LLC","org_type":"healthcare","ransomware":false,"records_affected":null,"reviewed":false,"root_cause":"A misconfiguration on Wellfleet's website allowed deep-links to medical referral pages to be accessed without authentication.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593295"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_M2014_Wellfleet_Group_L02_SAS_0_Redacted.pdf"}],"summary":"A misconfiguration on Wellfleet's website allowed medical referral pages to be accessed online without authentication and indexed by search engines.","supporting_quote":"Wellfleet immediately took steps to disable this misconfiguration, remove the Referrals from the Internet, and identify any other misconfigurations with the Website.","technology_involved":["Wellfleet website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-11","discovered_date":"2024-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a939cc5de1abaca7f0849f2f9011ac4af2bf6d1b","impact_type":"unknown","incident_date":"2024-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3cce79a3622f","org_name":"Visionworks of America, Inc.","org_type":"unknown","ransomware":null,"records_affected":39825,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Visionworks%20of%20America%2C%20Inc.-2024-10-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"628c7d0f3cb5a2f8f189363d3dc68494403e9983","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MiCare%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9eba3763a2b8","org_name":"MiCare Health Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593255"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-11","discovered_date":"2024-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34a14d3319753ca7d199645b0dac5eae788b7a96","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gryphon%20Healthcare%20%E2%80%93%20Notice%20of%20Data%20Security%20Event%20%E2%80%93%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9b112771a4c2","org_name":"Gryphon Healthcare, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gryphon%20Healthcare%20%E2%80%93%20Notice%20of%20Data%20Security%20Event%20%E2%80%93%20CA_0.pdf"}],"summary":"Gryphon Healthcare reported a third-party security incident that may have exposed files containing patients’ personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-11","discovered_date":"2024-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61625eaf1ef5fc46be47df635104ff3a0c1ee1e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%2012m.pdf"},"notes":null,"org_country":"US","org_id":"59a5200db0bd","org_name":"Bel-Air Bay Club Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593235"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Example%20Notification%2012m.pdf"}],"summary":"Bel-Air Bay Club Ltd reported unauthorized access to files on its network between September 3 and September 4, 2024, that included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"256e6746833574ed16c613cd894a7e1310f1a728","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d163832a4127","org_name":"Ad Valorem Records, Inc.","org_type":"professional_services","ransomware":null,"records_affected":590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-10-11-ad-valorem-records-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Paper/Films"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-10","discovered_date":"2024-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fb44a30f738e56d8e3a789bf69ea7bf4f9260ed","impact_type":"data_theft","incident_date":"2024-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Omni%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"603e50668634","org_name":"Omni Family Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593183"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Omni%20Sample%20Notification%20Letter.pdf"}],"summary":"Omni Family Health reported that data posted on the dark web appeared to relate to its patients and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"35577c0fb43578646e36306b3e85493291121daa","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/KershawCountySchoolDistrict.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9b9db89cf1ed","org_name":"Kershaw County School District","org_type":"unknown","ransomware":null,"records_affected":8802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/KershawCountySchoolDistrict.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1b7fb2c21e74255a1a90a2dd840cc73e9a9ffd74","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BonSecoursHealthInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"76465448b508","org_name":"Bon Secours Mercy Health, Inc","org_type":"unknown","ransomware":null,"records_affected":8696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BonSecoursHealthInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a97efbbc5e1fa94b77cec8b05457604567add1","impact_type":"data_theft","imported_from":null,"incident_date":"2024-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cabae64ed8ec","org_name":"Internet Archive","org_type":"unknown","ransomware":null,"records_affected":31081179,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Internet Archive","type":"hibp","url":"https://haveibeenpwned.com/Breach/InternetArchive"}],"summary":"The Internet Archive breach exposed user records including email addresses, screen names and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-09","discovered_date":"2024-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca161724db4cfe17eccb657dcd73b38772204000","impact_type":"data_theft","incident_date":"2024-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter_5.pdf"},"notes":null,"org_country":"US","org_id":"c19f7f24bb4b","org_name":"Fidelity Investments","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593165"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_5.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fidelity%20Investments-2024-10-09"}],"summary":"A third party used two recently established customer accounts to access and obtain some Fidelity Investments customer information without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-09","discovered_date":"2024-05-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2836b8522755118464995071fb92f55e6bc13367","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%5B00%5D%20CUSD%20-%20Reg%20Notice%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"237c9cd97773","org_name":"Cottonwood Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%5B00%5D%20CUSD%20-%20Reg%20Notice%20Exhibit%20A.pdf"}],"summary":"Cottonwood Union School District reported that an unauthorized third party may have accessed a limited amount of information in connection with an incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8ca163a765b0c5e669f2af8c5492bd59e0d8c8","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/01-1%20TheraCom-AG%20Ntc%20Form-CA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4ca44bcfaa95","org_name":"TheraCom, L.L.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593110"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/01-1%20TheraCom-AG%20Ntc%20Form-CA%20Sample%20Notice.pdf"}],"summary":"Cencora reported that data exfiltrated from its information systems included some personal information associated with TheraCom recipients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2024-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26f9d60d3387057529518abd574dc7726c2031fa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a4198c24ed21","org_name":"Muah.AI","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Muah.AI","type":"hibp","url":"https://haveibeenpwned.com/Breach/Muah"}],"summary":"A breach of the Muah.AI website exposed email addresses and prompts to generate AI-based images.","supporting_quote":null,"technology_involved":["Muah.AI website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b6964b904353e2b18b755fd462e6e578a696c64","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MEMCLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4328c7b4538b","org_name":"MEMC, LLC","org_type":"unknown","ransomware":null,"records_affected":1485,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MEMCLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-08","discovered_date":"2024-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"421825eb7a7581b8d2d4f5c0bfb9bf6bab05d3b7","impact_type":"data_theft","incident_date":"2024-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McKell%20Financial%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"69f9165b361a","org_name":"McKell Financial Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McKell%20Financial%20-%20Sample%20Notice.pdf"}],"summary":"McKell Financial reported that an unauthorized party may have acquired the contents of one individual’s mailbox.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b50ed3d82925957faa223c3d46582830019a5832","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/01-1%20ABSG-AG%20Ntc%20Form-CA%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2f5c824f09b2","org_name":"AmerisourceBergen Specialty Group, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593111"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e5b8410a1e62324caf1ce77d9316d8580214f17","impact_type":"data_theft","imported_from":null,"incident_date":"2023-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALS%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5f91b679eb18","org_name":"Alliance Laundry Systems","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593101"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALS%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized individual accessed Alliance Laundry Systems’ network and copied files between December 11 and December 24, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-08","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2d211b108b002abb3feb425000357760d5b9689","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-26","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Access%20Group_AK437_v03.pdf"},"notes":null,"org_country":"US","org_id":"38da00cc9c81","org_name":"AccessLex Institute","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593097"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Access%20Group_AK437_v03.pdf"}],"summary":"AccessLex Institute reported that client information may have been accessed or acquired during a security incident limited to vendor FBCS’s network.","supporting_quote":"The incident was limited to FBCS’s network, and none of Access Group’s systems were compromised in this event.","technology_involved":["FBCS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FBCS"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"eb6cbc3b5d80","name":"FBCS"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-07","discovered_date":"2024-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f238aae4c43acf2f461c76d46d20f383caa861b","impact_type":"data_theft","incident_date":"2024-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30915.pdf"},"notes":null,"org_country":"US","org_id":"8b2cc0811203","org_name":"MoneyGram Payment Systems, Inc.","org_type":"financial","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30915.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30915.pdf"}],"summary":"An unauthorized third party accessed and acquired consumer personal information between September 20 and 22, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-07","discovered_date":"2024-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6a3aab2ce4601fd71c926468cc0334b939af6da","impact_type":"data_theft","incident_date":"2024-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dohman%20Adult%20Consumer%20Notification%20Letter%201_v02__Static_Proof_R2.pdf"},"notes":null,"org_country":"US","org_id":"12667f0dcbe1","org_name":"Dohman, Akerlund & Eddy","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593038"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dohman%20Adult%20Consumer%20Notification%20Letter%201_v02__Static_Proof_R2.pdf"}],"summary":"Dohman, Akerlund & Eddy reported that files may have been acquired without authorization and that the impacted data may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-07","discovered_date":"2023-12-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7b52a25dcebc283a972479ba0f2ddd22f0d5d97","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Community%20HousingWorks%20-%20Exhibit%20A%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"a78ebc08c963","org_name":"Community HousingWorks","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Community%20HousingWorks%20-%20Exhibit%20A%20-%20CA.pdf"}],"summary":"An unauthorized actor accessed email accounts belonging to certain Community HousingWorks employees, and the accounts contained information that could have been affected.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-07","discovered_date":"2024-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"908b78b28cec1826f7c51f3abc1705268c61c836","impact_type":"unknown","incident_date":"2024-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"eb44fdd0f848","org_name":"American Water Works Company","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1410636/000119312524233300/d869346d8k.htm"},{"fetched_at":null,"title":"8-K FORM 8-K - REACTIVATION OF SYSTEMS PRESS RELEASE","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1410636/000141063624000179/awk-20241010.htm"},{"fetched_at":null,"title":"8-K EX-99.1 - PRESS RELEASE OF AMERICAN WATER","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1410636/000141063624000179/ex-991xawkpressreleaseoct1.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1410636/000119312524247634/d821194dex991.htm"},{"fetched_at":null,"title":"8-K EX-99.2","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1410636/000119312524247634/d821194dex992.htm"}],"summary":"American Water Works reported unauthorized activity in its computer networks and systems, discovered on October 3, 2024, and said it activated response measures.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2024-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c6bc14e08923f33d27ae90a1525eb79f143c60d2","impact_type":"both","imported_from":null,"incident_date":"2024-10-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"US","org_id":"60ff75db493c","org_name":"ADT Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1703056/000119312524233900/d876174d8k.htm"}],"summary":"ADT reported that an unauthorized actor accessed its network using compromised credentials obtained through a third-party business partner, exfiltrated certain encrypted internal data, and caused disruptions to information systems.","supporting_quote":"ADT Inc. (“ADT” or the “Company”) recently became aware of unauthorized activity on the Company’s network, and discovered an unauthorized actor had illegally accessed ADT’s network using compromised credentials obtained through a third-party business partner.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71908ad7eaddf2231b1ebb82c0904e3ae22d6e48","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"HU","org_id":"5efaf05428d5","org_name":"Switch","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Customer records were inadvertently exposed through a public GitHub repository.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Switch","type":"hibp","url":"https://haveibeenpwned.com/Breach/Switch"}],"summary":"Switch inadvertently exposed customer records, including job applications, through a public GitHub repository.","supporting_quote":"In October 2024, the Hungarian IT headhunting service Switch inadvertently exposed thousands of customer records via a public GitHub repository .","technology_involved":["GitHub"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"504990f3a447970b04290783b11859c977f4c0b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/5.11%2C%20Inc%20-%20Notice%20of%20Data%20Security%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2e8916f301d9","org_name":"5.11, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592971"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/5.11%2C%20Inc%20-%20Notice%20of%20Data%20Security%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#5.11%2C%20Inc.-2024-10-05"}],"summary":"5.11 reported unusual activity involving its online store that may have involved customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-04","discovered_date":"2024-08-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bf85e643650473f9c9a81eaff3a3b23be7021d49","impact_type":"unknown","incident_date":"2024-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ddccf55ec2ed","org_name":"Station. Bank and. Change health care","org_type":"unknown","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Station.%20Bank%20and.%20Change%20health%20care-2024-10-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-03","discovered_date":"2024-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cdb840557866665bc30b537e5f913afe49d611c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-16","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30880.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a387595be4e5","org_name":"TransUnion Risk and Alternative Data Solutions","org_type":"financial","ransomware":null,"records_affected":1721,"reviewed":false,"root_cause":"Individuals misrepresented themselves to gain access to TRADS products and personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TransUnion%20Risk%20and%20Alternative%20Data%20Solutions%2C%20Inc.%20%28TRADS%29-2024-10-03"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30880.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30880.pdf"}],"summary":"Individuals misrepresented themselves to access TRADS products, exposing affected consumers’ personal information.","supporting_quote":"Once we finished our extensive examination of the matter on September 10, 2024 we concluded that, while the security of our systems was not compromised, individuals misrepresented themselves to gain access to our products and, by extension, your personal information between .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-03","discovered_date":"2024-09-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ae853cf3156b2804745ccdec5b8aa953a32a5c5a","impact_type":"unknown","incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1fad6bf08271","org_name":"Tektronix, Inc.","org_type":"unknown","ransomware":null,"records_affected":8719,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tektronix%2C%20Inc.-2024-10-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-03","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17fe752f488a859a462e2a4c788eae0d2374ee73","impact_type":"both","imported_from":null,"incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Comcast.NoticeLetter.pdf"},"notes":null,"org_country":"US","org_id":"b04b0acafb3d","org_name":"Comcast Cable Communications LLC","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592869"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Comcast.NoticeLetter.pdf"}],"summary":"Data about Comcast consumers held by Financial Business and Consumer Solutions, Inc. was downloaded during a ransomware incident at FBCS.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Financial Business and Consumer Solutions, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"eb6cbc3b5d80","name":"FBCS"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-03","discovered_date":"2024-07-19","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bb426d73aca0ec019af8d4409c8415e95e93ff7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-06","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL_Breach_Letter-CIR-124103_ITAL_092724_FEED.pdf"},"notes":null,"org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592849"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL_Breach_Letter-CIR-124103_ITAL_092724_FEED.pdf"}],"summary":"Employees of a contractor improperly accessed case information in the ebtEDGE Web Admin platform.","supporting_quote":"The CDSS discovered that employees of a contractor that was hired to operate the Sun Bucks call center improperly accessed case information in ebtEDGE.","technology_involved":["ebtEDGE Web Admin platform"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-03","discovered_date":"2024-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba7df31d20b8f9f3c3fdb1c31256a3cafdfec26f","impact_type":"data_theft","incident_date":"2024-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Balboa%20Bay%20Club%20Ventures%20LLC%20-%20Notice%20of%20Data%20Event%20%E2%80%93%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"139c6b4ad82a","org_name":"Balboa Bay Club Ventures LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592842"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Balboa%20Bay%20Club%20Ventures%20LLC%20-%20Notice%20of%20Data%20Event%20%E2%80%93%20CA_0.pdf"}],"summary":"Balboa Bay Club Ventures LLC reported that files containing personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-10-02","discovered_date":"2024-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcb9392e44524854b9bafdccdbb2710a474aea18","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-16","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TLO%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a387595be4e5","org_name":"TransUnion Risk and Alternative Data Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Individuals misrepresented themselves to gain access to TRADS products and, by extension, personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592808"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TLO%20Consumer%20Letter.pdf"}],"summary":"Individuals misrepresented themselves to access TRADS products and, by extension, consumers’ personal information.","supporting_quote":"Once we finished our extensive examination of the matter on September 10, 2024 we concluded that, while the security of our systems was not compromised, individuals misrepresented themselves to gain access to our products and, by extension, your personal information between .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96bd194431563bc85f738b0dc0af007f370eec2f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FindGreatPeople.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b7ebae9dfaa6","org_name":"Find Great People","org_type":"unknown","ransomware":null,"records_affected":11143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FindGreatPeople.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-10-01","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c87fac85789f43f2113e735be4417ff893d5971","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TruistBank.NoticeLetter.pdf"},"notes":null,"org_country":"US","org_id":"a93802ac32b8","org_name":"Truist Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592704"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TruistBank.NoticeLetter.pdf"}],"summary":"Truist Bank reported that personal and financial information maintained by its third-party debt collection agency, FBCS, may have been affected by unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Financial Business and Consumer Solutions, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"eb6cbc3b5d80","name":"FBCS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55048a5aab93f21142f95a95504309e3836adaf3","impact_type":"unknown","incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PacSci%20-%20CA%20-%20AG%20Notification%20%28241001%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5a6cd5215ac","org_name":"Pacific Scientific Energetic Materials Company (California) LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592742"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe3fbe623aa60792ba9ff1e72534e3319c2f747c","impact_type":"unknown","incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FTV%20-%20CA%20-%20AG%20Notification%20%28241001%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8e95bb72e952","org_name":"FTV Employment Services LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592745"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30849.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9143c46cefc1e95a4d28ea72c733024be8941115","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30848.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8de9b02644f8","org_name":"Fluke Corporation","org_type":"unknown","ransomware":null,"records_affected":2312,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30848.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be00db826602aefd4ac66d68706e26f5006d1147","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12A05887-6463-48A9-A2CD-7C958C5D31D1"},"incident_date":"2024-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f4ef2795543","org_name":"Conduent Business Services","org_type":"other","ransomware":true,"records_affected":15494592,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cybersecuritydive.com/news/government-payments-conduent-cyberattack/738123/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cybersecuritydive.com/news/conduent-data-breach-began-2024-intrusion/803930/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.crn.com/news/security/2025/conduent-discloses-theft-of-client-data-in-hack-significant-number-of-individuals-impacted?itc=refresh;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dailymontanan.com/2025/10/22/state-officials-blue-cross-blue-shield-breach-could-compromise-one-third-of-all-residents-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cybersecuritydive.com/news/conduent-breach-significant-number/745963/;"}],"summary":"\"Conduent Inc. warned in an April 14 regulatory filing with the Securities and Exchange Commission that a “significant” number of people had their personal data stolen in a January cyberattack that affected a limited number of the company’s clients.\nThe company, a major governmen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5860d705d1f37433588fe83e822b2f2cfbec067a","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0263c44789f4","org_name":"BudTrader","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BudTrader","type":"hibp","url":"https://haveibeenpwned.com/Breach/BudTrader"}],"summary":"A breach of BudTrader exposed email addresses, usernames, and WordPress password hashes.","supporting_quote":null,"technology_involved":["WordPress"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6cd110dd9cebbdbafb0153ce11dfa101559c0c9","impact_type":"unknown","incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ASP%20-%20CA%20-%20AG%20Notification%20%28241001%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7164530d95cc","org_name":"Advanced Sterilization Products, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592743"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2024-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5df69877a7a3561921c28317867087b90dbcc2e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b2a061edb520","org_name":"Central Tickets","org_type":"technology_saas","ransomware":null,"records_affected":722860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Central Tickets","type":"hibp","url":"https://haveibeenpwned.com/Breach/CentralTickets"}],"summary":"Data from Central Tickets was publicly posted to a hacking forum, exposing personal information, purchase details and passwords stored as unsalted SHA-1 hashes.","supporting_quote":null,"technology_involved":["ticketing service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98346eaa4048bc1f0adb3e74266d4e6b46f11442","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AikenElectricCo-opInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"189e14b12a46","org_name":"Aiken Electric Co-op, Inc.","org_type":"unknown","ransomware":null,"records_affected":4604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AikenElectricCo-opInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-27","discovered_date":"2024-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ac651fe729c8436c6d6fcf96867df3acd7945ec","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Empereon%20Marketing%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA%20%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"88552743a51d","org_name":"Empereon Marketing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592570"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Empereon%20Marketing%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA%20%20%281%29.pdf"}],"summary":"An unauthorized actor accessed an archived data set containing Empereon Marketing files held in a partner company’s computer environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ffd6ad58e3bf29be57b4c2280088d7538e053e9","impact_type":"unknown","incident_date":"2024-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BREACH_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c1e8f44029d","org_name":"New TSI Holdings, Inc./New York Sports Club","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592496"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4043ad242ad7151228a9ac64de99f122aeee1118","impact_type":"unknown","incident_date":"2024-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MALAMA_-_REDACTED_ADULT_SSN_34226851v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71517048f36b","org_name":"Community Clinic of Maui, Inc. dba Malama I Ke Ola Health Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592480"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-09-26","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1ed12cead2de186865d18c946ececda4d524aa6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30775.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d34ce238f994","org_name":"CF Medical","org_type":"unknown","ransomware":null,"records_affected":11199,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30775.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CFMedical.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30775.pdf"}],"summary":"CF Medical reported unauthorized access to its systems from February 14 to February 26, 2024, during which an actor could view or acquire personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-26","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86115b23ddb15c7753690daf020bfa42fcc15a69","impact_type":"data_theft","incident_date":"2024-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calibrated%20Healthcare%2C%20LLC%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"29d0b53e9715","org_name":"Calibrated Healthcare, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-599645"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592504"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593098"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calibrated%20Healthcare%2C%20LLC%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Calibrated Healthcare identified unauthorized access to portions of its network, and certain files were likely copied without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-25","discovered_date":"2024-08-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"a8ce815342d6991af41d43844dfbfbbd328c3153","impact_type":"data_theft","incident_date":"2024-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30738.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"386aaa906baf","org_name":"Prentke Romich Company","org_type":"manufacturing","ransomware":null,"records_affected":690,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30738.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592423"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRC-Saltillo%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30738.pdf"}],"summary":"An unauthorized actor may have copied files containing personal information from PRC-Saltillo’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-09-25","discovered_date":"2024-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5ce3073acae703d6685a732072ca567782dc4f8","impact_type":"data_theft","incident_date":"2023-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amgen%20-%20Individual%20Notice%2009252024_0.pdf"},"notes":null,"org_country":"US","org_id":"222e313ddb83","org_name":"Amgen","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592382"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amgen%20-%20Individual%20Notice%2009252024_0.pdf"}],"summary":"Files containing information related to Amgen may have been copied from Sirva systems accessed by unknown actors.","supporting_quote":null,"technology_involved":["Sirva systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sirva"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"987337278584","name":"Sirva"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-24","discovered_date":"2023-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44bcddfc9abe24f5ca6ba16cc7617ee57efec0c9","impact_type":"data_theft","incident_date":"2023-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WMDDH%20-%20Sample%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4452d2e129eb","org_name":"Wright, Moore, DeHart, Dupuis & Hutchinson, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592354"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WMDDH%20-%20Sample%20Consumer%20Notice%20Letter.pdf"}],"summary":"Wright, Moore, DeHart, Dupuis & Hutchinson, LLC reported that data may have been acquired without authorization and personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-24","discovered_date":"2024-08-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"67a22b6ae5a5b32d2593827012967d317126a86c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"501137a6ff5f","org_name":"Orchid Orthopedic Solutions","org_type":"unknown","ransomware":null,"records_affected":1425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Orchid%20Orthopedic%20Solutions-2024-09-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-24","discovered_date":"2023-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d85030c4996c097d3084bfae22f820fa1c33708b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mattson%20-%20CA_1_0.pdf"},"notes":null,"org_country":"US","org_id":"41857121b29b","org_name":"Mattson Technology, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592359"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mattson%20-%20CA_1_0.pdf"}],"summary":"Mattson reported that an unauthorized individual accessed its network and certain files, which may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f2c9e2ad9553bfc665ce5dd1a0b044cfcc87d26","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30709.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c71fd421d6e","org_name":"Patelco Credit Union (Amended Notice)","org_type":"unknown","ransomware":null,"records_affected":8176,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30709.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db71fabfc1a0d0ae0195dd007547220de79e4dd3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"VN","org_id":"83c63a4dd0d4","org_name":"GameVN","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GameVN","type":"hibp","url":"https://haveibeenpwned.com/Breach/GameVN"}],"summary":"GameVN suffered a data breach in May 2016 exposing email addresses, usernames, IP addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["XenForo"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ba42e52f869ca88d89cdd202fde152e7d3a34e2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/OctapharmaPlasmaInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e30b5972b7c7","org_name":"Octapharma","org_type":"unknown","ransomware":null,"records_affected":2114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/OctapharmaPlasmaInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2024-09-20","discovered_date":"2024-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"12e60c626cf0d02be9a0f171712e42281ba59b8c","impact_type":"data_theft","incident_date":"2024-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30665.pdf"},"notes":null,"org_country":"US","org_id":"3d3d9f332916","org_name":"Compex Legal Services Inc.","org_type":"professional_services","ransomware":null,"records_affected":308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Compex%20Legal%20Services%20Inc.-2024-09-20"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30665.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CompexLegalServicesInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30665.pdf"}],"summary":"Compex Legal Services reported unauthorized access beginning April 9, 2024, during which an unknown actor acquired files from its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-09-20","discovered_date":"2024-08-15","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69cbe6a6b1361c19f255f2c985074e038bd96e48","impact_type":"data_theft","incident_date":"2024-07-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blundstone%20-%20Template%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a9500ff48ef8","org_name":"Blundstone","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in the Adobe Commerce platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592140"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blundstone%20-%20Template%20Individual%20Notice.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in Adobe Commerce to install malicious code on Blundstone’s checkout webpage and collect customer contact and payment information.","supporting_quote":"On August 15, 2024, we learned that an unauthorized third party had exploited a vulnerability in the Adobe Commerce platform that allowed this third party to install malicious code that duplicated a Blundstone webpage at the point of sale.","technology_involved":["Adobe Commerce","e-commerce website"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Adobe"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"c33b99e67332","name":"Adobe"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-19","discovered_date":"2024-12-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8439b2c2caf0d49da7d4077be35ed2c27367f305","impact_type":"both","incident_date":"2023-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20TCAG%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"c2abc352e22d","org_name":"Tuttle-Click Automotive Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20TCAG%20-%20CA_0.pdf"}],"summary":"Tuttle-Click Automotive Group reported that an unknown actor accessed certain systems, accessed or acquired data, and malware encrypted certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a3842d339ef030d8d3c960f7e305f7c71eb5a3c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20TradeZero%20America%2C%20Inc.%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"12f17e578506","org_name":"TradeZero America Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592107"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20TradeZero%20America%2C%20Inc.%20-%20CA_0.pdf"}],"summary":"TradeZero reported that an unauthorized actor may have accessed personal information in files associated with customer communications on the Tawk.To platform.","supporting_quote":null,"technology_involved":["Tawk.To"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Tawk.To"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c179492fb854","name":"Tawk.To"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"638cb042125d58000fc2a76dcb5dddda5bbe976c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20re%20Info%20Affected%20by%20Cyber-Attack.pdf"},"notes":null,"org_country":"US","org_id":"c31881c33e89","org_name":"The Gill Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20re%20Info%20Affected%20by%20Cyber-Attack.pdf"}],"summary":"The Gill Corporation reported that personal information, including Social Security numbers and possibly bank account numbers and past W-2 forms, may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"135016fa2191d4bad6ed2c0df08db662ea5c31be","impact_type":"unknown","incident_date":"2024-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20All%20Versions%20-%202024.09.18.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31826152a281","org_name":"siParadigm LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592129"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-19","discovered_date":"2024-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"365d89edfa39b9e536889330daf719f9e682d5ea","impact_type":"data_theft","incident_date":"2024-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OPI%20-%20Sample%20Consumer%20Notice%20Letter%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"5ba1bc294ccb","org_name":"Octapharma Plasma, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OPI%20-%20Sample%20Consumer%20Notice%20Letter%20%28US%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30414.pdf"}],"summary":"Octapharma Plasma detected suspicious activity and determined that an unauthorized party acquired information stored in its file share systems.","supporting_quote":null,"technology_involved":["file share systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d735458175284bb3d2ddc762eaa037f62b9cb6d8","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7119132ed23f","org_name":"HuntStand","org_type":"technology_saas","ransomware":null,"records_affected":2795947,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HuntStand","type":"hibp","url":"https://haveibeenpwned.com/Breach/HuntStand"}],"summary":"Records scraped from HuntStand were publicly posted, including email addresses and some names, dates of birth, and countries.","supporting_quote":null,"technology_involved":["HuntStand"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4b44a7fcc3f50449a9e17910975b943f3982620","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MIPS%20Holding%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"fbe29ccdec9b","org_name":"MIPS Holding, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592066"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MIPS%20Holding%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"}],"summary":"MIPS Holding, Inc. reported unauthorized access to files and folders on June 26, 2024, that may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5aa51933eedf504c728518a3d4c462867d55520c","impact_type":"data_theft","incident_date":"2024-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IAMS%20Consumer%20Notice%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"87fbd2090a1f","org_name":"Insurance Agency Marketing Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IAMS%20Consumer%20Notice%20Templates.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30611.pdf"}],"summary":"An unauthorized third party remotely accessed IAMS computer systems and accessed and/or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-18","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4291a2a67ea8d59f62d4e6f25973fac315b6dbd","impact_type":"unknown","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f201195eda1e","org_name":"Exeter Finance LLC","org_type":"unknown","ransomware":null,"records_affected":48202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Exeter%20Finance%20LLC-2024-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2024-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a4773bd29b00ea04f64f04cba587da418ad1714","impact_type":"unknown","imported_from":null,"incident_date":"2024-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30601.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f392460cbe79","org_name":"DICK'S Sporting Goods","org_type":"retail_ecommerce","ransomware":null,"records_affected":72012,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30601.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30601.pdf"}],"summary":"DICK'S Sporting Goods notified affected people of a security incident and offered identity restoration assistance.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2256d38e7466a908deb792096df73fc14792eafa","impact_type":"data_theft","incident_date":"2024-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Tech%20Interactive%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"eb8c3298741d","org_name":"The Tech Interactive","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591725"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Tech%20Interactive%20-%20Sample%20Notice.pdf"}],"summary":"An unknown actor accessed or acquired files on The Tech Interactive’s network that contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-16","discovered_date":"2023-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ccea3bd4fbc37539c5adbf5d33803650312582d","impact_type":"data_theft","incident_date":"2023-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/River%20Delta%20Unified%20School%20District%20-%20Notice%20of%20Data%20Event%20-%20CA%20AG.pdf"},"notes":null,"org_country":"US","org_id":"60068c55ab4b","org_name":"River Delta Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591724"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/River%20Delta%20Unified%20School%20District%20-%20Notice%20of%20Data%20Event%20-%20CA%20AG.pdf"}],"summary":"An unknown actor accessed certain River Delta systems and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2025432f1d82c69e19964a316b124f510c99cb8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CL","org_id":"f58a8e8b8a62","org_name":"Instituto Nacional de Deportes de Chile","org_type":"government","ransomware":null,"records_affected":319613,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Instituto Nacional de Deportes de Chile","type":"hibp","url":"https://haveibeenpwned.com/Breach/InstitutoNacionalDeDeportesDeChile"}],"summary":"Instituto Nacional de Deportes de Chile had a data breach exposing personal information and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3752371b9d6d2a4b0e044ba8046342bb15a1597","impact_type":"unknown","incident_date":"2024-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/David%27s%20Bridal%20-%20Sample%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c45804fc5976","org_name":"David's Bridal","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594717"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591716"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#David%E2%80%99s%20Bridal-2024-09-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bc1fdc1c3b53b4ec2b818b02ff33d444731d7e0","impact_type":"data_theft","imported_from":null,"incident_date":"2020-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"dac37ef25741","org_name":"Games Box","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Games Box","type":"hibp","url":"https://haveibeenpwned.com/Breach/GamesBox"}],"summary":"Games Box suffered a data breach involving email addresses, usernames, genders, ages, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-13","discovered_date":"2023-09-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c08b592cc814ce584c9e6018e8c0a7b9475a67ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30558.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5b10f22c36b4","org_name":"Law Offices of Todd S. Richardson, PLLC","org_type":"professional_services","ransomware":null,"records_affected":1106,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30558.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30558.pdf"}],"summary":"The law office discovered unauthorized access to a single email account, which occurred between August 20 and September 26, 2023.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f3f43fafcf3817a49c87df4d59e0f4cd58a53a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LA%20Financial%20-%20General%20Notice%20Letter%20V.2___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"b65358e525cd","org_name":"LA Financial Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LA%20Financial%20-%20General%20Notice%20Letter%20V.2___Static_Proof_R1.pdf"}],"summary":"LA Financial Federal Credit Union reported unauthorized access to an employee email account, where personal information may have been present.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4482f83593c7347d1192311f4104203b947db3c5","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30565.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7d76570c171d","org_name":"Campus CE Corporation","org_type":"unknown","ransomware":null,"records_affected":52175,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30565.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30565.pdf"}],"summary":"Campus CE Corporation reported that a log file with limited student data may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-13","discovered_date":"2023-09-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5cc42da5d863c32d14d04330cda5eb7f6897f70","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-11","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Altman%20Specialty%20Plants%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7b42d1632078","org_name":"Altman Specialty Plants, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591666"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Altman%20Specialty%20Plants%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Altman Specialty Plants reported unauthorized access to certain files and folders containing information that included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-13","discovered_date":"2024-09-08","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9259b5b8adab0701e95473106e2c3c34955457b0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30737.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"32df92e0b86d","org_name":"Aim Inc","org_type":"professional_services","ransomware":null,"records_affected":1156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30737.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30737.pdf"}],"summary":"A break-in at Aim Inc's office led to locked file cabinets containing personal client information being opened.","supporting_quote":"On the afternoon of Sunday, September 8th, 2024, we discovered that our office located at 11112 66th Ave E, Puyallup, WA 98373 had been broken into sometime in the previous 28 hours, and locked file cabinets containing client documents were opened.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8852d01029c0ca5b9352e90e6313ae12f3096fee","impact_type":"unknown","incident_date":"2023-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DB09182-TGTS-letter-A-AdultSSN-v2a%2834169305.1%29_Redacted_34173465v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c236633867c6","org_name":"Theresa Gordon Tax Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591556"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2024-09-11","discovered_date":"2024-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcdb320814bdcc1a42e9a27bd92b6bd3483d640d","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DATA%20BREECH.pdf"},"notes":null,"org_country":"US","org_id":"8f8140242b07","org_name":"Hamel Cranial Chiropractic & Wellness INC.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DATA%20BREECH.pdf"}],"summary":"An attacker accessed the practice’s business software and created a fake deposit bank account; saved credit card and medical chart information could have been accessed.","supporting_quote":null,"technology_involved":["business software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5773b45993ebcbcf9ad610db4291863da357ddb4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kemper%20Sports%20Management%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ce8974624d05","org_name":"Kemper Sports Management, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591409"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kemper%20Sports%20Management%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kemper%20Sports%20Management%2C%20LLC-2024-09-09"}],"summary":"KemperSports reported that an unauthorized user accessed data containing personal information, including names and Social Security numbers, on April 1, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a98a73449eb8968fcc40b8bac25a0ee74f415b14","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/El%20Monte%20Union%20School%20District%20General%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b0be27bf9903","org_name":"El Monte Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591436"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/El%20Monte%20Union%20School%20District%20General%20Notification%20Letter.pdf"}],"summary":"El Monte Union School District reported that information in its systems, including names and Social Security numbers, was subject to unauthorized access around July 4, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-09-06","discovered_date":"2024-07-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3383c9bf0e567a907eec6ca65f51d0fabf9cb47","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welcome%20Health%20Data%20Breach%20Notice%209.6.24%20CA%20AG_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"c645d600a934","org_name":"Welcome Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Welcome Health user's credentials were compromised, enabling unauthorized access to Welcome Health systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591348"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welcome%20Health%20Data%20Breach%20Notice%209.6.24%20CA%20AG_Redacted.pdf"}],"summary":"Welcome Health reported that compromised user credentials enabled unauthorized access to an email account and certain systems, where patient and contractor personal and health information may have been impacted.","supporting_quote":"Following an extensive forensic analysis, we learned that the user’s credenƟals were compromised and, because of the compromise, an unauthorized party was able to access certain Welcome Health systems.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef20d1ecee16b1c15b2085f305c7f3fa3a354668","impact_type":"data_theft","incident_date":"2024-02-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB09194-USMerchants-Letter-v2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"db201f1aad7c","org_name":"US Merchants Financial Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB09194-USMerchants-Letter-v2_Redacted.pdf"}],"summary":"An unauthorized third party accessed US Merchants Financial Group’s network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-06","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffc13330fa199a67972906431fcb8b86517283e6","impact_type":"data_theft","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-22683%20Infosys%20W16%20Ad%20CM%2024m%20Outreach%20N%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"1ecce83428ae","org_name":"TIAA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591328"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-22683%20Infosys%20W16%20Ad%20CM%2024m%20Outreach%20N%20r4prf.pdf"}],"summary":"The notice reports that an unauthorized party accessed IMS systems and data between October 29 and November 2, 2023, and that personal information was subject to unauthorized access or acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-09-06","discovered_date":"2024-06-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98c6aae84651127601ef9546a7f6478d3a66a145","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Slim%20CD%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"da59a1f13118","org_name":"Slim CD","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Slim%20CD%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Slim%20CD%2C%20Inc.-2024-09-06"}],"summary":"Slim CD identified unauthorized access to its systems, which may have enabled an actor to view or obtain credit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae4f1c1f9e10b19b008ed178dd20f00cc4b788b1","impact_type":"unknown","incident_date":"2024-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_SSNProof.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0149a17cc954","org_name":"Retail Data","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591344"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-05","discovered_date":"2023-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02909af88fafe0e49414775c7eee73c072747f32","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30470.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d2291c975563","org_name":"Water For People","org_type":"nonprofit","ransomware":null,"records_affected":2084,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30470.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30470.pdf"}],"summary":"Water For People reported that an unauthorized third party may have accessed personal information during activity within its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-05","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"144221dda7528951f697dbcb915fa04a9d02371d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Taxellent%20Accounting%20-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"eb5006ccf259","org_name":"Taxellent Accounting Services Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Taxellent%20Accounting%20-%20Sample.pdf"}],"summary":"A computer containing personal information was stolen from Taxellent Accounting’s office.","supporting_quote":"On August 9, 2024, one computer in Taxellent Accounting’s office was stolen.","technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d710bbd6a7e33092d9e191b943ee7a7826d1ed","impact_type":"data_theft","incident_date":"2024-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NoticeLetter_RiversideResort_REVISED_v2_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"debaaf471581","org_name":"Riverside Resort & Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591217"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NoticeLetter_RiversideResort_REVISED_v2_Redacted_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Riverside%20Resort%20%26%20Casino-2024-09-05"}],"summary":"Riverside Resort & Casino reported that an unauthorized third party potentially accessed and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f053a4f0584d6da43639a419be9376c21ba7694e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ef5460192ca","org_name":"JERICO PICTURES, INC.","org_type":"unknown","ransomware":null,"records_affected":1350684,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JERICO%20PICTURES%2C%20INC.%20D/B/A%20NATIONAL%20PUBLIC%20DATA-2024-09-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8fbccff10cb364fa9f7cbc3b90202dd54adf2f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30464.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61ff4b69dceb","org_name":"Graham Emmanuel Baptist Church","org_type":"unknown","ransomware":null,"records_affected":1335,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30464.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-05","discovered_date":"2024-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22a1b8d785af924408434d3bef9eac9263449bba","impact_type":"data_theft","incident_date":"2024-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Avis%20-%20Individual%20Notification%20Sample%20%2809%2004%2024%29.pdf"},"notes":null,"org_country":"US","org_id":"ff685bce5c3a","org_name":"Avis Rent A Car System LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591235"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Avis%20-%20Individual%20Notification%20Sample%20%2809%2004%2024%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Avis%20Rent%20A%20Car%20System%20LLC-2024-09-05"}],"summary":"Avis Rent A Car System LLC reported that an unauthorized third party accessed a business application and obtained personal information.","supporting_quote":null,"technology_involved":["business application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-03","discovered_date":"2023-11-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e90c70d7e6b7063b03d9b0a4106a650568a7a62b","impact_type":"data_theft","incident_date":"2023-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KNS%20-%20Regulatory%20Notification%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"c7c20f872619","org_name":"Katz Nannis + Solomon","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KNS%20-%20Regulatory%20Notification%20-%20CA_0.pdf"}],"summary":"Katz Nannis + Solomon reported that data was acquired without authorization between November 21 and November 27, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-03","discovered_date":"2024-08-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"1b7b8e9f0fd3ea0ce01feb93c3a307a254d28202","impact_type":"both","incident_date":"2024-08-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"7ea6f760e9fa","org_name":"Halliburton Company","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/45012/000004501224000052/hal-20240830.htm"}],"summary":"Halliburton reported that an unauthorized third party accessed and exfiltrated information from its systems, disrupting access to some business applications.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a970a14c2b703db63230534ac5cf2fc48f17ba8a","impact_type":"data_theft","imported_from":null,"incident_date":"2023-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c7bb03a6d022","org_name":"Blooms Today","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Blooms Today","type":"hibp","url":"https://haveibeenpwned.com/Breach/BloomsToday"}],"summary":"Data associated with Blooms Today, including personal information and partial credit card data, was listed for sale in April 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e56a67cf1171947ab340c9284e1fbb26dc07164a","impact_type":"unknown","incident_date":"2024-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Propark%20Mobility_L01_Sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"851f99d737cd","org_name":"Propark Mobility","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591116"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fbd59e13458d2aa09bbf5123e5b4d1dd02de2da","impact_type":"unknown","incident_date":"2023-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"ce8b7a69b316","org_name":"Market Moveis","org_type":"unknown","ransomware":null,"records_affected":28220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Market Moveis","type":"hibp","url":"https://haveibeenpwned.com/Breach/MarketMoveis"}],"summary":"In August 2023, the Portuguese home decor company Market Moveis suffered a data breach that impacted 28k records. The exposed records were limited to names and email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2024-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3d4cf592e9c6866446541d66a47432d8131ac40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17547.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ece867b5f6aa","org_name":"Connecticut College","org_type":"unknown","ransomware":null,"records_affected":711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17547.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a0f2969056ab88a2ef615a51235eb65d49acb76","impact_type":"data_theft","incident_date":"2024-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPOCC%20-sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"053f6e4000c8","org_name":"Turning Point of Central California, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598932"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPOCC%20-sample%20notice.pdf"}],"summary":"Turning Point of Central California reported that an unauthorized user accessed its system and that some documents may have been copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-30","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"760353010a51c4c4159ef83943b4c6c4f33e9381","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-27","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-22788%20County%20LA%20Proj%20Red%20Grove%20Ad%20No%20CM%20Stand%20EN%20SP%20r1prfmt2.pdf"},"notes":null,"org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees interacted with a phishing email, allowing the attacker to obtain Microsoft Office 365 account credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591079"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-22788%20County%20LA%20Proj%20Red%20Grove%20Ad%20No%20CM%20Stand%20EN%20SP%20r1prfmt2.pdf"}],"summary":"A phishing email led to the compromise of three Microsoft Office 365 employee accounts and access to personal information.","supporting_quote":"Users interacted with the phishing email, allowing the malicious actor or actors to obtain the log-in credentials for the Microsoft Office 365 user accounts, compromising the accounts of three employees.","technology_involved":["Microsoft Office 365"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2637f37b64243bb91bd5988f1260d4326c9ce3d9","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cbd1b6f7d992","org_name":"Lookiero","org_type":"retail_ecommerce","ransomware":null,"records_affected":4981760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lookiero","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lookiero"}],"summary":"Lookiero customer data, including email addresses and other personal information, was posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"054a483ef23c7418399e4875428baf3f74f5d4d8","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FFIG_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"b5e08e8e6986","org_name":"Futurity First Insurance Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FFIG_CA%20App%20%26%20Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Futurity%20First%20Insurance%20Group-2024-08-30"}],"summary":"Futurity First Insurance Group found unauthorized access to certain email accounts but could not determine whether emails or attachments were accessed or acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0b08ab1d573c8003278279aaf365b0ed269a62f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30408.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"be93c1367f2a","org_name":"Boys and Girls Clubs of Whatcom County","org_type":"nonprofit","ransomware":null,"records_affected":870,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30408.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30408.pdf"}],"summary":"Boys and Girls Clubs of Whatcom County notified affected individuals that their names and Social Security numbers may have been subject to unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5c2e032412c66746141ded43ecaf6e74f97a402","impact_type":"unknown","incident_date":"2024-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Western%20Electrical%20Contractors%20Association%20Inc.%20-%20Exhibit%20A%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19cb98235795","org_name":"Western Electrical Contractors Association, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590975"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30376.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-08-29","discovered_date":"2024-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f9140fd09437fde7d98bf5c45a1df622f7488f6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Member%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e932719285c5","org_name":"USAA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591026"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Member%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#USAA-2024-08-29"}],"summary":"A system error during a routine update to USAA’s document delivery system caused some members’ documents to be posted to another member’s online account.","supporting_quote":null,"technology_involved":["document delivery system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ced9d4f2658a51a2a7be726043ce7a51b63402ff","impact_type":"unknown","incident_date":"2024-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Exhibit%20A%20%28SOCCCD%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dcef588d30ac","org_name":"South Orange County Community College District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591014"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46796516c141b0addbe32eb7ea8b31a4c7451145","impact_type":"unknown","incident_date":"2024-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PARS%20SSN_Source.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6fbd6b4faf3","org_name":"Phase II Systems d/b/a PARS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591001"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-29","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6943311557bcf0a33aa64da3135ce2faae6e8966","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SRS%20Distribution%2C%20Inc.%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ded2f391d32d","org_name":"Imperial Sprinkler, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SRS%20Distribution%2C%20Inc.%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"}],"summary":"Imperial Sprinkler reported that a thumb drive containing personal information was missing from a damaged shipment, with no known access or misuse.","supporting_quote":"Unfortunately, the package arrived at its destination in a damaged state and the thumb drive was not in the package as expected.","technology_involved":["thumb drive"],"third_party":{"archetype":null,"involved":true,"vendor":"United States Postal Service"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"ed8c1aacc480","name":"United States Postal Service"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-29","discovered_date":"2023-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd538b2c5c599fadd7b5ef98419829249e34c789","impact_type":"data_theft","incident_date":"2023-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591017"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Covenant Care identified suspicious activity and determined that an unauthorized party copied files containing names from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-28","discovered_date":"2024-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f49be0beaf2597e86eb4734e92a56b4616f0f4c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20No%20CM_Source.pdf"},"notes":null,"org_country":"US","org_id":"a8d036aa9f6b","org_name":"Strive HoldCo, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20No%20CM_Source.pdf"}],"summary":"Strive HoldCo, LLC reported unauthorized access to an employee email account, with personal information believed to be at risk.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2024-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"639da7a385dd549adf3609ed7d87a29d8d30f206","impact_type":"data_theft","incident_date":"2024-04-18","initial_access":"unknown","notes":null,"org_country":"FR","org_id":"bd34f11007f5","org_name":"Sport 2000","org_type":"manufacturing","ransomware":null,"records_affected":4400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sport 2000","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sport2000"}],"summary":"Sport 2000 suffered a data breach involving records with contact details, dates of birth and store purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"337f639b88a14f982fa851bd5322143d265b8fc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30362.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"aa44495807bf","org_name":"Moser Wealth Advisors","org_type":"financial","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30362.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30362.pdf"}],"summary":"An unauthorized third party accessed parts of Moser Wealth Advisors’ computer network, and personal information may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-27","discovered_date":"2024-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"92cf8261b9b6bddfa9aa9b8a1eaf19eeac08f983","impact_type":"disruption_or_ransomware","incident_date":"2024-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30356.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"09a729de6d80","org_name":"Lake Washington Institute of Technology","org_type":"education","ransomware":true,"records_affected":8694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30356.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30356.pdf"}],"summary":"Lake Washington Institute of Technology reported a ransomware incident that began around June 10, 2024, disrupted computer systems, and may have affected personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"199cc46d03d95bf0e0ef358c29f9a0ac5970f470","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"047df89d713d","org_name":"CODAC Inc dba CODAC Behavioral Health and CODAC Healthcare, LLC","org_type":"healthcare","ransomware":null,"records_affected":9592,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-08-27-codac-inc-dba-codac-behavioral-health-and-codac-healthcare-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-26","discovered_date":"2024-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23a47f7877dae98e0338fe5cdfe6bc5d77315074","impact_type":"data_theft","incident_date":"2024-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Young%20Consulting%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_1.pdf"},"notes":null,"org_country":"US","org_id":"2173ff5147a8","org_name":"Young Consulting LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-604904"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601297"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598024"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Young%20Consulting%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Young%20Consulting%20LLC-2024-08-26"}],"summary":"An unauthorized actor accessed Young Consulting’s network and downloaded files containing names and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-26","discovered_date":"2024-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8661e1183c4530c03dcb62b4cdb60f0b67397e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/St.%20Helena%20-%20Template%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"0628260726a8","org_name":"City of St. Helena","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590801"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/St.%20Helena%20-%20Template%20Notices.pdf"}],"summary":"The City of St. Helena detected unauthorized network activity and determined that an unauthorized third party accessed materials containing personal and limited medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cccf728f21a25d0fd923033c0f2fe96c1a97847","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-09-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9b3afb9f7bb2","org_name":"Traderie","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Traderie","type":"hibp","url":"https://haveibeenpwned.com/Breach/Traderie"}],"summary":"Traderie suffered a data breach in September 2022 that exposed email and IP addresses, usernames, and social media profile links.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60588e8f9c5481785a083a875af629166766243e","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Texas%20Dow%20Employees%20Credit%20Union%20-%20Notice%20Letter%20%28redacted%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"370b6828fbcf","org_name":"Texas Dow Employees Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590654"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-23","discovered_date":"2024-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"181435c6596ab1f87b7f855266fcdce252e68c4d","impact_type":"both","incident_date":"2024-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30312.pdf"},"notes":null,"org_country":"US","org_id":"4efaba8482af","org_name":"Okanogan Behavioral HealthCare","org_type":"healthcare","ransomware":null,"records_affected":15774,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30312.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30312.pdf"}],"summary":"Okanogan Behavioral HealthCare reported that a threat actor accessed files containing client information after an incident disrupted some IT systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64d232112b3a744958c4fa2f55aef81e0f8a1e7f","impact_type":"unknown","incident_date":"2024-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/KT_ALS_-_Letter_Proof_Redacted_34083444v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f4db0914c2c6","org_name":"Kingdom Trust","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590671"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-08-22","discovered_date":"2024-07-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cdcf63f1f2cbbac50690241aedd6ed38fd806bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Individual%20Template%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"58a632f41e37","org_name":"Artifact Uprising","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party software vulnerability affected the organization's website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Individual%20Template%20Notice%20Letter.pdf"}],"summary":"Artifact Uprising reported that a third-party software vulnerability affecting its website may have exposed customers' personal and credit card information to unauthorized acquisition.","supporting_quote":"On or about July 12, 2024, we became aware of and investigated a data incident that involved a third-party software vulnerability that affected our website.","technology_involved":["website"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24b64f7e902a7cb9e3ddb29d46a920fb22a9f27b","impact_type":"unknown","incident_date":"2024-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ParkTree%20Community%20%20-%20Notice%20of%20Data%20Security%20Event%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1566fcee623","org_name":"Pomona Community Health Center dba ParkTree Community Health Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590522"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-21","discovered_date":"2023-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01378a6aa538f2cb24ee817a25d5f95334b78207","impact_type":"both","imported_from":null,"incident_date":"2023-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_L8615_Keystone_Pacific_Property_Management_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"4dc845bf3fe2","org_name":"Keystone Pacific Property Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590531"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_L8615_Keystone_Pacific_Property_Management_L01_SAS_0.pdf"}],"summary":"Keystone Pacific Property Management reported unauthorized acquisition of files containing personal information and disruption to access to certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3c6635ae454f230e9d8ae22cbf0d57766bdc4bab","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30284.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1438c2c7459e","org_name":"Ellensburg School District","org_type":"education","ransomware":null,"records_affected":3955,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30284.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30284.pdf"}],"summary":"Ellensburg School District reported a network disruption and said limited information may have been accessed by an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-20","discovered_date":"2024-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5230261db164dd5dd5e0c16aeab60772f2f8366a","impact_type":"data_theft","incident_date":"2024-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Project%20Capital%20-%20Adult%20Consumer%20Template%20Letter%20%28No%201%29%20v3__Static_Proof_R4.pdf"},"notes":null,"org_country":"US","org_id":"52c8dbc2d7e4","org_name":"VeriSource Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601930"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594490"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Project%20Capital%20-%20Adult%20Consumer%20Template%20Letter%20%28No%201%29%20v3__Static_Proof_R4.pdf"}],"summary":"VeriSource Services reported that an unknown actor may have acquired personal information without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeaa36d75824eb14154b401760efcbb08cc55281","impact_type":"unknown","incident_date":"2024-05-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PATELCO_NOTICE_-_REDACTED_34080757v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"949731d667cf","org_name":"Patelco Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590495"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Patelco%20Credit%20Union-2024-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-20","discovered_date":"2024-08-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"756bc40bedab742bfef88a92304bfe9d1b812e4a","impact_type":"disruption_or_ransomware","incident_date":"2024-08-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'Play' not in source; cleared","org_country":"US","org_id":"faed72af3f94","org_name":"Microchip Technology Incorporated","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/827054/000082705424000153/mchp-20240820.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/827054/000082705424000181/mchp-20240904.htm"},{"fetched_at":null,"title":"Leak-site claim by play","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWljcm9jaGlwIFRlY2hub2xvZ3lAcGxheQ"}],"summary":"Microchip Technology Incorporated detected suspicious IT activity on August 17, 2024, and reported that an unauthorized party disrupted some servers and business operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["play"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ebc9c49bb65221d8559cd5198c5e06756bc3cf7","impact_type":"unknown","incident_date":"2023-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DHC%20Sample%20Notice%20Letter%20CA%20.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b4c383fb154","org_name":"Davidoff Hutcher & Citron LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590496"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30151.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8ae95899a74b596c9583cd95665325e709aced0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"59d8e730f89e","org_name":"Tracki","org_type":"technology_saas","ransomware":null,"records_affected":372557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tracki","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tracki"}],"summary":"Vulnerabilities exposed the names and email addresses of 372,557 Tracki users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"819d5eb4737ce926fa0dd6a198a5625c940241d4","impact_type":"unknown","incident_date":"2023-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Cannon%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04b5a470ad8a","org_name":"The Cannon Corporation dba CannonDesign","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590429"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"83ebc79856f887c2121e4cf7fe7b4198e74e7756","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b885c695017","org_name":"Mid-Columbia Center for Living","org_type":"unknown","ransomware":null,"records_affected":4435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mid-Columbia%20Center%20for%20Living-2024-08-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07d15eefc319f240dec8092307adba1e2dd7d952","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0d3c8d42c13a","org_name":"Explore Talent","org_type":"other","ransomware":null,"records_affected":11400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Explore Talent (August 2024)","type":"hibp","url":"https://haveibeenpwned.com/Breach/ExploreTalentAug2024"},{"fetched_at":null,"title":"Have I Been Pwned: Explore Talent (July 2024)","type":"hibp","url":"https://haveibeenpwned.com/Breach/ExploreTalent"}],"summary":"A vulnerable API exposed personal records of 11.4 million Explore Talent users, including email addresses.","supporting_quote":null,"technology_involved":["API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-19","discovered_date":"2023-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"796596ba360c8a72c4c723e265740cb7cb80462a","impact_type":"data_theft","incident_date":"2023-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arden%20Claims%20-%20Regulatory%20Notification%20Letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"84706bc00ea5","org_name":"Arden Claims Service","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arden%20Claims%20-%20Regulatory%20Notification%20Letter%20%28CA%29_0.pdf"}],"summary":"Arden Claims Service reported that an unknown actor acquired data without authorization related to an email account, including some personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2ddefb34ab99b01d2147dac2e813913e3c1de60","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_8.pdf"},"notes":null,"org_country":"US","org_id":"e66d6e082560","org_name":"Allergy Medical Group of the North Area, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590421"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_8.pdf"}],"summary":"Allergy Medical Group of the North Area detected suspicious activity on a server, and its investigation found that personal, health, and financial information could have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7d68cdf6af03dd29deb65aa89d398beae84991e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NPD%20Breach%20Notification%20Letter%208_10.pdf"},"notes":null,"org_country":"US","org_id":"41e9d8d5448c","org_name":"National Public Data","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590388"},{"fetched_at":null,"title":"Have I Been Pwned: National Public Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/NationalPublicData"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NPD%20Breach%20Notification%20Letter%208_10.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NationalPublicData.pdf"}],"summary":"National Public Data reported a data security incident involving personal information, with potential data leaks in April and summer 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2024-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6344d2b7ac7614e5179e23c98a06f40044a586e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30230.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7863901ae49f","org_name":"T&B Inc","org_type":"unknown","ransomware":null,"records_affected":1770,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30230.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-08-16","discovered_date":"2024-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44ec302eeee4ce6ebfd0cc8845fa8dd8c56a66a7","impact_type":"data_theft","incident_date":"2023-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Oregon%20Zoo%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f82720fb81d3","org_name":"Oregon Zoo","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590306"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Oregon%20Zoo%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Zoo-2024-08-16"}],"summary":"An unauthorized actor redirected Oregon Zoo customers’ online ticket transactions from its third-party processor, potentially obtaining payment card information.","supporting_quote":null,"technology_involved":["online ticketing service"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62aca56f4cf03104a40c89ce774ba1f4426386b8","impact_type":"data_theft","incident_date":"2024-02-13","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Enroll%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9bce020011c1","org_name":"Enroll Confidently, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590317"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Enroll%20-%20CA_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30238.pdf"}],"summary":"An unauthorized actor accessed Enroll Confidently’s systems and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":"A Plus Dental Group","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfd73d3c323c7ea27fa439521c9228208ad7bd9b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Disclosure%20Form.pdf"},"notes":null,"org_country":"US","org_id":"27cc63efc54e","org_name":"Blain Jacobson DMD, CAGS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590384"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Disclosure%20Form.pdf"}],"summary":"A fraudulently prepared transfer form led to an unauthorized transfer of Blain Jacobson DMD, CAGS patient accounts through Invisalign.","supporting_quote":null,"technology_involved":["Invisalign","AlignTech"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Invisalign (AlignTech)"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"beddbdf23dc7","name":"Invisalign"}],"actor_id":"aplusdentalgroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"611dfb6608eed9c87d650358107f9f01e07234ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult_Source.pdf"},"notes":null,"org_country":"US","org_id":"59af80d0ace2","org_name":"Baker Places, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult_Source.pdf"}],"summary":"Baker Places, Inc. reported that an unauthorized individual may have accessed information in an employee email account between February 12 and February 29, 2024.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-16","discovered_date":"2024-06-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2f51f2ba43b753dae88f597b10a2904c78ac4db","impact_type":"data_theft","incident_date":"2024-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Around%20the%20Clock%2C%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0a366b06081e","org_name":"Around the Clock Companies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600123"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590318"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Around%20the%20Clock%2C%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown actor accessed systems and copied files containing personal information from Around the Clock Companies.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01d47fa48b4b3a0cb98800eef922831ba4c9652b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"d954090015a1","org_name":"LDLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1266026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LDLC","type":"hibp","url":"https://haveibeenpwned.com/Breach/LDLC"}],"summary":"LDLC customer data, including email addresses, names, phone numbers and physical addresses, was listed for sale on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2024-08-13","discovered_date":"2024-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed6b4bae15d51434929f34b2720df3372e5d4723","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20Data%20Subjects-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"7d80501b5460","org_name":"FlightAware","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A configuration error may have inadvertently exposed personal information in FlightAware accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590178"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20Data%20Subjects-%20CA.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FlightAware-2024-08-13"}],"summary":"A configuration error may have exposed personal information, including account credentials and partial credit card numbers, in FlightAware accounts.","supporting_quote":"On July 25, 2024, we discovered a configuration error that may have inadvertently exposed your personal information in your FlightAware account, including user ID, password, and email address.","technology_involved":["FlightAware account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"096b2b3f443891692637fa47d711a0e6ebc1deaa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-10","initial_access":"unknown","notes":null,"org_country":"MY","org_id":"8ec8d9ddfce1","org_name":"Chris Leong","org_type":"professional_services","ransomware":null,"records_affected":27096,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chris Leong","type":"hibp","url":"https://haveibeenpwned.com/Breach/ChrisLeong"}],"summary":"The website of Master Chris Leong suffered a data breach that exposed personal information, including email addresses, names, physical addresses, dates of birth, genders, nationalities and social media profile links.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a012c8395d7337236a0aed337c41201765850fa4","impact_type":"unknown","incident_date":"2024-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Ambulnz%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48f2fb4525de","org_name":"Ambulnz Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590182"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-08-12","discovered_date":"2024-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b30f680f2bfed2422251be9f3c64b3590f05f055","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_4.pdf"},"notes":null,"org_country":"US","org_id":"adc6501763da","org_name":"Kootenai Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590144"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_4.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kootenai%20Health-2024-08-13"}],"summary":"Kootenai Health reported that an unknown actor may have accessed data on its network on or about February 22, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-08-12","discovered_date":"2024-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45468888bd320b7d758bda5825ed6c101c4ed7df","impact_type":"data_theft","incident_date":"2024-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crown%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"5ab2ae66d2fd","org_name":"Crown Equipment Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590093"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crown%20Notice%20Letter%20Template.pdf"}],"summary":"Crown Equipment Corporation reported unauthorized access to some IT systems and compromise of files containing employee and family-member personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7a9642dcd8a719032bbfef77ea1d93f7d9525e7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e27253c56d11","org_name":"Shadow","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shadow","type":"hibp","url":"https://haveibeenpwned.com/Breach/Shadow"}],"summary":"Shadow suffered a data breach that exposed customer records containing names, email and physical addresses, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15db17a6b59b65e00ffa1df2bdbc3dbd02fa73da","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"92073a0262c4","org_name":"Not SOCRadar","org_type":"unknown","ransomware":null,"records_affected":282478425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Not SOCRadar","type":"hibp","url":"https://haveibeenpwned.com/Breach/NotSOCRadar"}],"summary":"A dataset of email addresses was posted to a hacking forum and was concluded to have been gathered using SOCRadar platform features designed to collect publicly available information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1a66cea0ffc9406b7351851b38b19aaed76a9e9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Monte_Nido_Adult_SSN_-_Redacted_34029227v1.pdf"},"notes":null,"org_country":"US","org_id":"1a587a56cd1f","org_name":"Monte Nido","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monte_Nido_Adult_SSN_-_Redacted_34029227v1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Monte%20Nido-2024-08-09"}],"summary":"Monte Nido reported unauthorized access to its systems between September 16 and September 22, 2023, and said some personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2024-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1912a5549f727e92f496995c95cabeea0aa829ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30150.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cae328f895af","org_name":"King Arthur Baking Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":1274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30150.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9c245b88e3c470b528c4efe6a3cfd1f4a77c73f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/JJECapitalHoldingsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0b4173ec183","org_name":"JJE Capital Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":1580,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/JJECapitalHoldingsLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-09","discovered_date":"2024-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb8c912ed443abc98d215a0e02275fd9772eb739","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-21","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Educators%20Benefit%20Consultants%20-%20Sample%20Letter%20-%20Category%201.pdf"},"notes":null,"org_country":"US","org_id":"dcb33582e7b4","org_name":"Educators Benefit Consultants, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The incident resulted from a zero-day vulnerability in a software program used by an external IT provider.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590046"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Educators%20Benefit%20Consultants%20-%20Sample%20Letter%20-%20Category%201.pdf"}],"summary":"Educators Benefit Consultants reported that a zero-day vulnerability in software used by an external IT provider led to a security incident in which personal information may have been exposed.","supporting_quote":"The investigation determined that the incident resulted from a zero-day vulnerability in a software program used by an external IT provider (meaning a security vulnerability that is exploited before it has been patched by the software company).","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-08-09","discovered_date":"2024-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6a1dd49ce7c5a880edd1e1c540f65c94aead91a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSC%20Notification%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"90b5752cd159","org_name":"CSC ServiceWorks","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSC%20Notification%20Templates.pdf"}],"summary":"An unauthorized third party accessed part of CSC ServiceWorks’ computer system, and personal, financial, and medical information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d53006ff5620e133d8569896605e2a26867228a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BlueRidgeRuralWaterCompanyInc%20(1).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a29309653239","org_name":"Blue Ridge Rural Water Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":16220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BlueRidgeRuralWaterCompanyInc%20(1).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-08","discovered_date":"2024-01-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d65ff8419ee3dc2ef6f1f7c8c6a63994f94de379","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/STA%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"54f8fd19d979","org_name":"Student Transportation of America","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/STA%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Student Transportation of America reported unauthorized access to certain employees’ email accounts, with the information potentially affected not specified in the provided text.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-08","discovered_date":"2024-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1da771b97a55c2e134b1616a19199f834e1d650e","impact_type":"data_theft","incident_date":"2024-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Evening%20Post%20Publishing%20Inc.%20-%20Sample%20Notice%20.pdf"},"notes":null,"org_country":"US","org_id":"6ebe9c2b468a","org_name":"Evening Post Publishing Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595434"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Evening%20Post%20Publishing%20Inc.%20-%20Sample%20Notice%20.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/EveningPostPublishingInc.pdf"}],"summary":"Evening Post Publishing Inc. reported that an unknown actor accessed its network and acquired certain files between March 13 and March 20, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-08","discovered_date":"2024-06-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9a3e405a9832cbdf64ad47e7ed6ab972c9465f1","impact_type":"data_theft","incident_date":"2024-05-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Baxter%20-%20Template%20Individual%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c954ee200b2c","org_name":"Baxter International","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Baxter%20-%20Template%20Individual%20Letter.pdf"}],"summary":"An unauthorized third party downloaded files containing personal information from Baxter’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b4a5a1bc26a77fe410bb3eda6e7a20c0370b7373","impact_type":"data_theft","imported_from":null,"incident_date":"2024-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"60ff75db493c","org_name":"ADT Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K CURRENT REPORT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1703056/000095015724001064/form8k.htm"}],"summary":"ADT reported that unauthorized actors accessed customer order databases and obtained some customers’ email addresses, phone numbers, and postal addresses.","supporting_quote":null,"technology_involved":["customer order databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-07","discovered_date":"2024-07-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f248d65f956963a16e3e0e54dc81f2610fee5126","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20to%20Affected%20Parties.pdf"},"notes":null,"org_country":"US","org_id":"5b8aaab20fb6","org_name":"Pacific Oaks College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An internal page intended to be non-public was publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20to%20Affected%20Parties.pdf"}],"summary":"Pacific Oaks College reported that an internal page of its Community Site was publicly accessible and exposed private student information.","supporting_quote":"On the evening of July 23, 2024, Pacific Oaks College was notified that an internal, non-\npublic facing page of the Pacific Oaks College Community Site was publicly accessible.","technology_involved":["Pacific Oaks College Community Site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-07","discovered_date":"2023-11-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"339b4526e254550f15adf1d3e0000ec39a4af0d9","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ingo%20Money%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"1e3f9a63292a","org_name":"Ingo Money","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ingo%20Money%20-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17550.pdf"}],"summary":"Ingo Money reported that an unauthorized third party removed data from part of its corporate computer network and publicly disclosed information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"700d6f3651d0aa83c25d0c12fdf86c090cf4802d","impact_type":"disruption_or_ransomware","incident_date":"2024-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DATA.BRCH_.NTC_.7-31-24.pdf"},"notes":null,"org_country":"US","org_id":"59b50fbb0518","org_name":"Olympus Financial","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589862"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DATA.BRCH_.NTC_.7-31-24.pdf"}],"summary":"An unauthorized third party accessed Olympus Financial’s on-site database and encrypted files in June 2024.","supporting_quote":null,"technology_involved":["on-site database","document management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ad1d5ef51155ad2221f5990581cf902f477a3ca","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"fe165f9279bf","org_name":"Shoe Zone","org_type":"retail_ecommerce","ransomware":null,"records_affected":46140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shoe Zone","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShoeZone"}],"summary":"Shoe Zone customer data, including names, addresses, partial card details, purchases, and email addresses, was breached and posted for sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2024-08-03","discovered_date":"2024-03-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"da6e3e7370295fbbb19999974a48561f4a1d362a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24c248d398d4","org_name":"Change Healthcare Inc.","org_type":"other","ransomware":null,"records_affected":192700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Texas AG data security breach report","type":"state_ag","url":"https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0004611"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589771"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/July%2029%202024%20Change%20Healthcare%20Individual%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Change%20Healthcare%20Inc.-2024-08-03"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Change%20Healthcare-2024-09-16"}],"summary":"Change Healthcare reported that a cybercriminal accessed its computer system and copied data that included personal, health, and billing information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2024-08-02","discovered_date":"2024-06-11","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f1c57d496da3759342ce928efede9c1323c7607","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30080.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2c272b1e1d86","org_name":"QuoteWizard","org_type":"unknown","ransomware":null,"records_affected":717781,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#QuoteWizard-2024-08-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30080.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30080.pdf"}],"summary":"An unknown third party used a service account credential to access vendor-hosted business systems, potentially exposing consumers’ personal information.","supporting_quote":"On June 11, 2024, QuoteWizard determined that an unknown third party used a service account credential to access certain vendor-hosted business systems, which likely resulted in the unauthorized access to or disclosure of consumer data.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2024-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5415a48b343291f2e81bea382461751daed2f39f","impact_type":"data_theft","imported_from":null,"incident_date":"2024-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AE","org_id":"2687a1b4279f","org_name":"LuLu","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LuLu","type":"hibp","url":"https://haveibeenpwned.com/Breach/LuLu"}],"summary":"LuLu customer data, including contact details, addresses, orders, and password hashes, was shared online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2024-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0ce4a8ad55c1902d91d32c379f7c89ea8c03dfa","impact_type":"data_theft","incident_date":"2024-07-04","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Disclosure.pdf"},"notes":null,"org_country":"US","org_id":"ee72a3ee7d6b","org_name":"FilterBaby, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former contractor shared customer personal data after being terminated.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589676"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Disclosure.pdf"}],"summary":"FilterBaby said a former contractor shared customer personal data after being terminated.","supporting_quote":"The breach incident involved a former contractor of the company who, after being terminated, shared the personal data from customers of the company.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-02","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1769d5e738bd1c7541d96dbd3c2784ea8b51076","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calibrated%20Healthcare%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"29d0b53e9715","org_name":"Calibrated Healthcare","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589741"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calibrated%20Healthcare%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Calibrated Healthcare identified unauthorized access to portions of its network, and certain files were likely copied without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3604851783845a46167b4d3ec85ef4f466a50213","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Peterson%20Holding%20Company%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a9afc9cd307e","org_name":"Peterson Holding Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Peterson%20Holding%20Company%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Peterson%20Holding%20Company-2024-08-01"}],"summary":"Peterson Holding Company reported that an unauthorized actor accessed certain computer systems and may have accessed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"626f735bd19154b4218eca427216fa62d3f890fb","impact_type":"data_theft","imported_from":null,"incident_date":"2018-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IT","org_id":"ba2d80bb0dc9","org_name":"Multiplayer.it","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Multiplayer.it","type":"hibp","url":"https://haveibeenpwned.com/Breach/MultiplayerIt"}],"summary":"Multiplayer.it confirmed a September 2018 breach involving email addresses, usernames, and salted MD5 password hashes that were reposted in 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c0ec07d6bfe453927b78ba7a6169902805cfa8b5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/GunsterYoakley%26StewartPA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"895514c5a70b","org_name":"Gunster, Yoakley & Stewart, PA","org_type":"unknown","ransomware":null,"records_affected":3358,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/GunsterYoakley%26StewartPA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7cf6ec48dfc2f2ab7dee63e47d5e0eb7c86321ca","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b869eb64a44","org_name":"LS Networks","org_type":"unknown","ransomware":null,"records_affected":682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LS%20Networks-2024-07-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64ca07ced0dc7fcd3278d245be41fc89667cec50","impact_type":"unknown","incident_date":"2023-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Brownell%20Travel%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"238a28d92df6","org_name":"Brownell Travel, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589577"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2024-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbad35d71a5ac691be06d48e909f23f090aa4a1c","impact_type":"data_theft","imported_from":null,"incident_date":"2024-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"361555ff48f7","org_name":"AnimeLeague","org_type":"other","ransomware":null,"records_affected":192134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AnimeLeague","type":"hibp","url":"https://haveibeenpwned.com/Breach/AnimeLeague"}],"summary":"AnimeLeague’s breach involved databases containing event registration records and a phpBB bulletin board dump, including personal information, passwords, and private messages.","supporting_quote":null,"technology_involved":["phpBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6245f54ad69a30eca7498c539d00592892da7e21","impact_type":"data_theft","imported_from":null,"incident_date":"2024-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6b353c274367","org_name":"Ubook","org_type":"technology_saas","ransomware":null,"records_affected":699908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ubook","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ubook"}],"summary":"Data described as allegedly scraped from Ubook was posted to a hacking forum and included email addresses and other personal information.","supporting_quote":null,"technology_involved":["Ubook Exchange (UBX)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e96ed9ba79c65720896603db92853b29196f5948","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3642d3674258","org_name":"Spytech","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Spytech","type":"hibp","url":"https://haveibeenpwned.com/Breach/Spytech"}],"summary":"A breach at Spytech exposed data about purchasers and targets of its spyware, including browsing histories, device information, email addresses, names, purchases, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-29","discovered_date":"2024-02-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"114218a235e2b66a0e51c1b4012dd2d62547de62","impact_type":"unknown","incident_date":"2024-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1332455a3514","org_name":"Advantage Orthopedic & Sports Medicine, LLP","org_type":"unknown","ransomware":null,"records_affected":1937,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advantage%20Orthopedic%20%26%20Sports%20Medicine%2C%20LLP-2024-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-26","discovered_date":"2024-04-23","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc8c57ec978851aed73faa6d646111d9e4020031","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01%20%281year%29.pdf"},"notes":null,"org_country":"US","org_id":"5bda24f72356","org_name":"United of Omaha Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing campaign targeting United of Omaha employees resulted in unauthorized access to an employee email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589387"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01%20%281year%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29966.pdf"}],"summary":"A phishing campaign led to unauthorized access to a United of Omaha employee’s email account, where personal and limited health information may have been viewed; the company reported no email exfiltration.","supporting_quote":"The access was the result of a phishing campaign targeting United of Omaha employees.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-07-26","discovered_date":"2024-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e324ce74ba9b54dff224cc1e6488d00c9802e8df","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HealthEquity%20Sample%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"51e4ea4a3323","org_name":"HealthEquity, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602630"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602736"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-602786"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600258"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601166"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-601522"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589401"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HealthEquity%20Sample%20Notice_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#HealthEquity%2C%20Inc.-2024-07-26"}],"summary":"HealthEquity reported unauthorized access to an unstructured data repository containing personal information, including protected health information and payment card information.","supporting_quote":null,"technology_involved":["unstructured data repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a8a7f6cb9cb3b90cce70ec323bec33883d0f296","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hair%20Club%20-%20California%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"4ed9e953e2f1","org_name":"Hair Club for Men, Ltd., Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591668"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589317"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hair%20Club%20-%20California%20Notification_0.pdf"}],"summary":"Hair Club for Men identified folders on certain systems that may have been accessed without authorization in October 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de43abac7fce944e33c65d9d2c32a4b4672a54dd","impact_type":"data_theft","incident_date":"2019-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"80e4d362178c","org_name":"Condo.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Condo.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/CondoCom"}],"summary":"Condo.com suffered a data breach in June 2019 that exposed email addresses, names, phone numbers and some physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"de1afda4d8ea380a232fdaf3c87800b603a63bd4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29940.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8d21763fb784","org_name":"Spokane County Title","org_type":"professional_services","ransomware":null,"records_affected":4887,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29940.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29940.pdf"}],"summary":"Spokane County Title detected unauthorized access to an employee email account and subsequent network access, and determined that some data may have been accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d6282723bee922f0982abff5cc34b8ba8b547e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024-6-25_Gemini%20Notification%20Email.pdf"},"notes":null,"org_country":"US","org_id":"b32150a4dac5","org_name":"Gemini Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589257"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024-6-25_Gemini%20Notification%20Email.pdf"}],"summary":"A banking partner reported unauthorized access to an internal collaboration tool on its system that may have exposed Gemini customers’ names and banking information.","supporting_quote":null,"technology_involved":["internal collaboration tool"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-24","discovered_date":"2024-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ee01dae59abb761f273e731dc20655ac299bbc0","impact_type":"data_theft","incident_date":"2024-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Compex%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"3d3d9f332916","org_name":"Compex Legal Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593915"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589239"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Compex%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_0.pdf"}],"summary":"Compex Legal Services discovered unauthorized network access beginning April 9, 2024, during which an unknown actor acquired certain files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"186246ad5e992a4dd818adac089a050ed6256dfb","impact_type":"unknown","incident_date":"2024-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Copy%20of%20Wise%20US%20Customer%20Comms_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50cbead6ebb9","org_name":"Wise US Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589135"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Wise%20US%2C%20Inc.%20-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9689216df2835a218065af743570afdedf58e6ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pinnacle_CA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"93f0d17fb73a","org_name":"Pinnacle Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589175"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pinnacle_CA%20Sample%20Notice.pdf"}],"summary":"An unauthorized individual accessed a Pinnacle employee’s email account, which contained an email or attachment with personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"455defa517d154062dad2fac907649dbd7f4825d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/WebTPAEmployerServicesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"05238bbbfbba","org_name":"WebTPA Employer Services, LLC","org_type":"unknown","ransomware":null,"records_affected":62138,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/WebTPAEmployerServicesLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b7e9f8c1830395739d10c0fdd25acff63b1d857","impact_type":"disruption_or_ransomware","incident_date":"2024-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29921.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"55d270e1a30f","org_name":"Sutton Dental Arts","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sutton%20Dental%20Arts-2024-07-22"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29921.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29921.pdf"}],"summary":"Sutton Dental Arts reported malicious file encryption that made some systems inaccessible and an unknown actor accessing files that could contain personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a86bb2fdf5c20413d38eebb861c996813e68bb00","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20Adult-CA%20-%202024.07.16.pdf"},"notes":null,"org_country":"US","org_id":"0253f4ef1dda","org_name":"Green Investment Management, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589106"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20-%20Adult-CA%20-%202024.07.16.pdf"}],"summary":"Green Investment Management identified unauthorized activity in its email environment, and personal or financial information may have been affected.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5b47c1a13028880fff7c08af2c14cced123cad95","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BarrettEyeCare.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5bb4d5ce98a","org_name":"Barrett Eye Care","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BarrettEyeCare.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-22","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d32e226c1dccfaf2a571de73ca9ca8291749424f","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AllCare%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"6a7a97807e1c","org_name":"Allcare Medical Management, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589095"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589697"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AllCare%20-%20California%20Notification.pdf"}],"summary":"An unauthorized user accessed an employee email account, and information in emails and attachments may have been viewed or acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab4443389ac542252aaa6b695a79403af0f01f6d","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9cacc3b42824","org_name":"Life360","org_type":"technology_saas","ransomware":null,"records_affected":442519,"reviewed":false,"root_cause":"Data was scraped from a misconfigured Life360 API.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Life360","type":"hibp","url":"https://haveibeenpwned.com/Breach/Life360"}],"summary":"Data scraped from a misconfigured Life360 API was posted online, including email addresses, names, and phone numbers.","supporting_quote":"In July 2024, data scraped from a misconfigured Life360 API was posted online after being obtained several months earlier .","technology_involved":["Life360 API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-19","discovered_date":"2024-05-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"e1f97ca0c532050f4079e460410daf86786fc9b0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Data%20Subject%20Notification%20Letter%20-%202024.07.18.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fdd30a830b73","org_name":"Therapeutic Health Services","org_type":"healthcare","ransomware":null,"records_affected":27170,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Therapeutic%20Health%20Services-2024-10-31"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588999"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Data%20Subject%20Notification%20Letter%20-%202024.07.18.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29805.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Data%20Subject%20Notification%20Letter%20-%202024.07.18.pdf"}],"summary":"Therapeutic Health Services reported unauthorized activity involving its computer network, and personal or medical information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-19","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6feeb704f0a1c3a3239e06f3badee93403c5d6","impact_type":"both","imported_from":null,"incident_date":"2023-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMS%20-%20Individual%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"cdb2355f0e6f","org_name":"PHL Variable Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588924"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMS%20-%20Individual%20Notice%20Template.pdf"}],"summary":"The notice reports that ransomware encrypted IMS systems and that personal information was subject to unauthorized access and acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"edd20ec467fe83ff394d49bf403e2fabd7c858c9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e3d7247c993","org_name":"Community Counseling of Bristol County, Inc.","org_type":"healthcare","ransomware":null,"records_affected":44991,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-07-19-community-counseling-of-bristol-county-inc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-19","discovered_date":"2024-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4923d90f4a177f423e0cb61e8702e2d886f4f63a","impact_type":"unknown","imported_from":null,"incident_date":"2024-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"7016df2f0953","org_name":"Cadre Holdings, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1860543/000110465924081176/tm2419841d1_8k.htm"},{"fetched_at":null,"title":"8-K EX-99.2","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1860543/000155837024011748/cdre-20240809xex99d2.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1860543/000155837024011748/cdre-20240809xex99d1.htm"}],"summary":"Cadre Holdings reported that an unauthorized third party accessed certain company technology systems, affecting some operations; the scope and impact were still under investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c68a6b76a1cd8d3c3b6f4bd86afda4063d3a39f","impact_type":"data_theft","incident_date":"2024-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A-Line%20Staffing%20Solutions%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"795befc4c1be","org_name":"A-Line Staffing Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589018"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A-Line%20Staffing%20Solutions%20Sample%20Notice.pdf"}],"summary":"A-Line Staffing Solutions reported that an unauthorized party compromised personal information in an incident detected on June 3, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-07-18","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c56a6e91b38256a84ac8837b1d98d87f6ca8819b","impact_type":"both","incident_date":"2024-02-21","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29881.pdf"},"notes":null,"org_country":"US","org_id":"9f41bbff0d8c","org_name":"Washington State University","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29881.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29881.pdf"}],"summary":"Change Healthcare reported ransomware and data exfiltration from its environment used for WSU pharmacy services, though WSU had not been notified which patients’ data was involved.","supporting_quote":null,"technology_involved":["electronic pharmacy services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Change Healthcare"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"24c248d398d4","name":"Change Healthcare"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"06808330bae85d38cc96eeb0e6cb754e1e7ce18a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"baf4649b7232","org_name":"United Seating and Mobility, L.L.C.","org_type":"unknown","ransomware":null,"records_affected":698577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#United%20Seating%20and%20Mobility%2C%20L.L.C.%2C%20d/b/a%20Numotion%20%28%E2%80%9CNumotion%E2%80%9D%29-2024-07-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9adf5641693da8b0a53f17c781d85dd2740609c8","impact_type":"unknown","incident_date":"2024-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MarineMax%20-%20Template%20Notification%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"d79d4faaf28b","org_name":"MarineMax, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588758"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MarineMax%20-%20Template%20Notification%20%28CA%29.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/MarineMaxInc.pdf"}],"summary":"MarineMax notified affected individuals of a security incident and offered identity monitoring.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-16","discovered_date":"2023-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"858658b9ad4f541be352d8b1a60366bd9b84a756","impact_type":"data_theft","imported_from":null,"incident_date":"2023-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Injectable%20Therapy%20Services%2C%20Inc%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f2c5bc4b1103","org_name":"Injectable Therapy Services, Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588774"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Injectable%20Therapy%20Services%2C%20Inc%20Sample%20Notice.pdf"}],"summary":"Injectable Therapy Services, Inc reported potential exfiltration of files containing names and other order and payment-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-16","discovered_date":"2023-10-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd983d95efc42835d5268eb569cacf0309659101","impact_type":"disruption_or_ransomware","incident_date":"2023-10-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Example%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8f67078523dd","org_name":"FCDG Management LLC","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588780"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Example%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FCDG%20Management%2C%20LLC-2024-07-16"}],"summary":"FCDG Management LLC reported that an unauthorized actor accessed some files, encrypted some data, and left a ransom note on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1472fd958b12888e136a2dc4739db208ce48262c","impact_type":"data_theft","incident_date":"2024-06-06","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rite%20Aid%20-%20Individual%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown third party impersonated a company employee to compromise business credentials and gain access to business systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588589"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rite%20Aid%20-%20Individual%20Notice%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rite%20Aid%20Corporation-2024-07-15"}],"summary":"Rite Aid reported that an unknown third party impersonated an employee to compromise business credentials, access business systems, and acquire personal data associated with certain retail product purchases.","supporting_quote":"On June 6, 2024, an unknown third party impersonated a company employee to compromise their business credentials and gain access to certain business systems.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-15","discovered_date":"2023-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b58509f59170a2171bab8dee1c70d1127b40f847","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MNGI%20-%20Sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"63ce5c1b5c3f","org_name":"MNGI Digestive Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588626"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MNGI%20-%20Sample%20notice.pdf"}],"summary":"MNGI Digestive Health discovered unauthorized activity in its digital environment, and an investigation found unauthorized access to portions of its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-15","discovered_date":"2024-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc52a81df0e72f7c3723ff041b0e0c9b496a8e2e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCAL%20Breach%20Notification%20Letter%20FINAL%20071024.pdf"},"notes":null,"org_country":"US","org_id":"128cc07cf0ab","org_name":"Kaiser Foundation Hospitals, Northern California and The Permanente Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A workforce member accessed portions of patients’ medical records without a reasonable basis.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588624"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCAL%20Breach%20Notification%20Letter%20FINAL%20071024.pdf"}],"summary":"A workforce member inappropriately accessed portions of patients’ medical records without a reasonable basis.","supporting_quote":"On May 16, 2024, as part of our compliance program, Kaiser Permanente determined that a member of our workforce inappropriately accessed portions of patients’ medical records without a reasonable basis.","technology_involved":["medical record system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"975015b3914cde18c46e38e15301545c6f2fea45","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20%2812%29%20Notification%20Freudenberg%20Medical_Redacted_Redacted.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"09fd405b2442","org_name":"Freudenberg Medical, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588612"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20%2812%29%20Notification%20Freudenberg%20Medical_Redacted_Redacted.pdf"}],"summary":"Freudenberg Medical reported an unauthorized attempt to disable certain systems and later determined that personal information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"256065fb38eb66b3a328166f46a573e7e1b63424","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted-Adult-letter.pdf"},"notes":null,"org_country":"US","org_id":"b1f93b1f092a","org_name":"Central Contra Costa Transit Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588634"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted-Adult-letter.pdf"}],"summary":"Central Contra Costa Transit Authority reported that an unauthorized actor may have accessed files and data, including personal and limited medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-15","discovered_date":"2024-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6b4a759fd05dd07221685da7fcab9053eda4d6e6","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"79c591c74d79","org_name":"Bassett Furniture Industries","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/10329/000143774924022743/bset20240715_8k.htm"},{"fetched_at":null,"title":"8-K FORM 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/10329/000143774924024679/bset20240805_8ka.htm"}],"summary":"Bassett Furniture Industries reported that a threat actor encrypted some data files, disrupting operations and leaving its manufacturing facilities offline.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other"],"disclosed_date":"2024-07-12","discovered_date":"2024-04-19","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"41a93303f535f6a396b2e4c7ab663c9d3df2255b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"bb3053e1495b","org_name":"AT&T","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K 1.05 MATERIAL CYBERSECURITY INCIDENT","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm"}],"summary":"AT&T reported that threat actors accessed an AT&T workspace on a third-party cloud platform and exfiltrated customer call and text interaction records.","supporting_quote":null,"technology_involved":["third-party cloud platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4170638a9236fdaa5bc88dbebc971d1e458f4214","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheMedibaseGroupInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2da602e16307","org_name":"The Medibase Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":44958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheMedibaseGroupInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"104d7ef53b44cad0b8908c38c026e608955625a2","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7174f52aa341","org_name":"mSpy","org_type":"technology_saas","ransomware":null,"records_affected":2394179,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: mSpy (2024)","type":"hibp","url":"https://haveibeenpwned.com/Breach/mSpy2024"}],"summary":"Hacktivists obtained and published mSpy user data, support tickets, and attachments.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4c93a83a99cfd1a5fa6e50b55d59f0f9d98a7a6","impact_type":"unknown","incident_date":"2024-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/K%26D%20CA%20Notification%20Letter%20Example.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c8a700566970","org_name":"Karis & Drake dba Bandolier","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588491"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b35b85d4dedba40e62f2fd1409198844e9175f22","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-13","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29808.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d1a9df780c49","org_name":"Family Dynamics Counseling Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3129,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29808.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29808.pdf"}],"summary":"Family Dynamics Counseling Services reported that personal and healthcare information was possibly compromised in an incident it determined occurred on May 13, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc350b3f5350b4c54461c29889e7c5ce1dbf1fb7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AdvanceStoresCompanyInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a74ff5459ba","org_name":"Advance Stores Compan y, Inc.","org_type":"unknown","ransomware":null,"records_affected":64107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AdvanceStoresCompanyInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b050363ca447eadf7111e5b96a6cef344ccc7c72","impact_type":"data_theft","imported_from":null,"incident_date":"2024-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"316f18633781","org_name":"The Heritage Foundation","org_type":"nonprofit","ransomware":null,"records_affected":72004,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Heritage Foundation","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheHeritageFoundation"}],"summary":"Hacktivists published data taken from The Heritage Foundation, including email addresses, names, IP addresses, comments, usernames and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2024-07-10","discovered_date":"2023-08-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c28e4128eab5b7903a4cbde3df0a05236954f1cf","impact_type":"disruption_or_ransomware","incident_date":"2023-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29794.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"751a1a56c4d7","org_name":"Coalition for the Common Good","org_type":"education","ransomware":true,"records_affected":4276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29794.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29794.pdf"}],"summary":"Coalition for the Common Good reported that Antioch detected a ransomware attack and that an unauthorized actor accessed a limited number of its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1530"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-10","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"f608c1124829e44dc736474f0f90e54c990a65ee","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Advance%20Auto%20Parts%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c4b6404c71da","org_name":"Advance Stores Company, Incorporated","org_type":"retail_ecommerce","ransomware":null,"records_affected":2316591,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advance%20Stores%20Company%2C%20Incorporated-2024-07-10"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Advance%20Auto%20Parts%2C%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Advance%20Auto%20Parts%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized third party accessed or copied personal information maintained by Advance Auto Parts in Snowflake.","supporting_quote":null,"technology_involved":["Snowflake"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Snowflake"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"871cb14cb964","name":"Snowflake"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1530"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-10","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb30e77aeeb1a5b7714668154d06ce4b50981b3c","impact_type":"data_theft","incident_date":"2024-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29791.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"82eafcb177b3","org_name":"Advance Auto Parts","org_type":"retail_ecommerce","ransomware":null,"records_affected":21791,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29791.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29791.pdf"}],"summary":"Advance Auto Parts reported that an unauthorized third party accessed or copied personal information maintained in Snowflake.","supporting_quote":null,"technology_involved":["Snowflake"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-09","discovered_date":"2023-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed7a44c96dd1d5b8aea5085e491a33879b333d1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/New%20York%20School%20of%20Interior%20Design%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"60bbf952a722","org_name":"New York School of Interior Design","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588283"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/New%20York%20School%20of%20Interior%20Design%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29775.pdf"}],"summary":"New York School of Interior Design reported that an unknown actor accessed certain files and systems, and that information including names may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2024-07-09","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b36b95e6ee6dcf7c2145368258760d29494f2e7a","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"US","org_id":"53dd66944572","org_name":"Neiman Marcus","org_type":"retail_ecommerce","ransomware":null,"records_affected":31152842,"reviewed":false,"root_cause":"The breach was traced back to attacks against the Snowflake cloud service.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Neiman Marcus","type":"hibp","url":"https://haveibeenpwned.com/Breach/NeimanMarcus"}],"summary":"Neiman Marcus customer data, including personal details and partial credit card data, was exposed in a breach traced to attacks against Snowflake.","supporting_quote":"The breach was traced back to a series of attacks against the Snowflake cloud service which impacted 165 organisations worldwide.","technology_involved":["Snowflake"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Snowflake"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"871cb14cb964","name":"Snowflake"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-09","discovered_date":"2023-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"315d9f51f1fc9f9e288f863393bff098bcb7c85d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-03","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/La%20Jolla%20Group%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f1f833c5a4f7","org_name":"La Jolla Group, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588292"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/La%20Jolla%20Group%20-%20Sample%20Notice.pdf"}],"summary":"La Jolla Group reported that systems were accessed between November 3 and November 7, 2023, and that affected information included names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8fb055a4a102a47da26917c41f2bc8afe54f7dd","impact_type":"unknown","incident_date":"2023-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CM_Source_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"afd258cd219a","org_name":"Kovack Financial","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588298"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2318ee9a110f9f15d308cfe6488e842658ad8c4b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/FPLFoodLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d53b7b1df049","org_name":"FPL Food, LLC","org_type":"unknown","ransomware":null,"records_affected":1703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/FPLFoodLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8cecb5e6713f10937b753eae52dd7874ed7471bd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/ArdaghGlassInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c32e366e15b","org_name":"Ardagh Glass Inc.","org_type":"unknown","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/ArdaghGlassInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3a4c0e8ec304e256f7a8de0c6e8e1e44d6af0c7","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter%207.8.24%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"63c3634d6625","org_name":"Otsuka Patient Assistance Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588205"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter%207.8.24%20%28CA%29.pdf"}],"summary":"The notice reported that data was exfiltrated from Cencora’s information systems and that personal information, potentially including health diagnoses and medications, was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-08","discovered_date":"2024-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3beb0c6658f206b026ec65d9699d0b3082f617c","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/U.S.%20Individual%20Notice%20_%20Template%20%2807%2008%2024%29.pdf"},"notes":null,"org_country":"US","org_id":"2d783636ee28","org_name":"Evolve Bank & Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/U.S.%20Individual%20Notice%20_%20Template%20%2807%2008%2024%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Evolve%20Bank%20%26%20Trust-2024-07-08"}],"summary":"Evolve Bank & Trust reported unauthorized activity that disrupted some systems and resulted in customer information being downloaded from databases and a file share.","supporting_quote":null,"technology_involved":["database","file share"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7581694e8d330da700beda914968ef0c0ade1d0a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"4ce131e6972f","org_name":"Husky Owners","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Husky Owners","type":"hibp","url":"https://haveibeenpwned.com/Breach/HuskyOwners"}],"summary":"The Husky Owners forum website was defaced and linked to exposed user data including usernames, email addresses, dates of birth and time zones.","supporting_quote":null,"technology_involved":["forum website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f31f0e41d6a5ef332008eaed3f90a801459a8d57","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e4fbcbddeee9","org_name":"FNTECH","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FNTECH","type":"hibp","url":"https://haveibeenpwned.com/Breach/RobloxDeveloperConference2024"}],"summary":"FNTECH suffered a data breach that exposed registrants’ email addresses, names, and IP addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"679f522a94d93f8890de8e135ae71a5dda4d5380","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/SouthCoastHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95ca7cb969c7","org_name":"SouthCoast Health","org_type":"unknown","ransomware":null,"records_affected":32835,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/SouthCoastHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"786dd9a00c33614b9b5470909e2bc78cf868ef4c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/JKPrivateWealthLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e28fc9fd24f2","org_name":"JK Private Wealth, LLC","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/JKPrivateWealthLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-05","discovered_date":"2024-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-09","id":"66d6594a0655e8e0e7e491f6326f9ca57c3a978c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-26","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31705.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d3880579486c","org_name":"Crimson Wine Group","org_type":"manufacturing","ransomware":null,"records_affected":3436,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Crimson%20Wine%20Group-2024-12-13"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31705.pdf"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1562151/000156215124000030/cwgl-20240630.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1562151/000156215124000032/cwgl-20240725.htm"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31705.pdf"}],"summary":"Crimson Wine Group reported that an unauthorized third party accessed certain systems and that information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c6571e7dcdbccb3ba3fcec3ce8e4c68ea9f44f1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"abcac9a5ebed","org_name":"Date Hot Brunettes","org_type":"other","ransomware":null,"records_affected":1494078,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Date Hot Brunettes","type":"hibp","url":"https://haveibeenpwned.com/Breach/DateHotBrunettes"}],"summary":"Date Hot Brunettes suffered a data breach that exposed email addresses, IP addresses, usernames, user-entered bios, and MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ee7a48923e04c212805022178bf6a94d750827a","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Adult%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"9c0b9a4cf02d","org_name":"Olson Steel","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Adult%20Notification%20Letter.pdf"}],"summary":"Olson Steel reported an IT outage and unauthorized access to its network, with an unknown actor potentially acquiring files containing employees’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-07-03","discovered_date":"2024-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0567746aa1f07115de6a1c884d29e802e04a2df","impact_type":"exposure_no_theft_confirmed","incident_date":"2027-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IDX%20DaVita%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"044380ce652e","org_name":"DaVita Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587990"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IDX%20DaVita%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DaVita%20Inc.-2024-07-03"}],"summary":"DaVita determined that tracking technologies on its health portal and Care Connect mobile application may have transmitted personal information to third-party vendors.","supporting_quote":null,"technology_involved":["health portal","Care Connect mobile application","tracking pixels"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"incransom","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2bc98371ccb4105a814a18464f4d8fa7aa920694","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b10121fa018","org_name":"Regional Obstetrical Consultants PC","org_type":"healthcare","ransomware":true,"records_affected":25650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-07-02-regional-obstetrical-consultants-pc"},{"fetched_at":null,"title":"Leak-site claim by incransom","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UmVnaW9uYWwgT2JzdGV0cmljYWwgQ29uc3VsdGFudHNAaW5jcmFuc29t"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"incransom","claim_groups":["incransom"]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a0d7779c6c65fd98abe0501d7d452079a098a55a","impact_type":"data_theft","incident_date":"2023-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29682.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c291d2119d6f","org_name":"CF Arcis XII, LLC","org_type":"unknown","ransomware":null,"records_affected":4853,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29682.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29682.pdf"}],"summary":"An unauthorized third party accessed CF Arcis XII, LLC’s network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-01","discovered_date":"2024-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80cdc84b7b7cc693aee9ef53394220107c7f464b","impact_type":"data_theft","incident_date":"2023-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB09023-ArcisGolf-letter-Adult-Standard_v4_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"0aef9eae5d5c","org_name":"Arcis Golf","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587876"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB09023-ArcisGolf-letter-Adult-Standard_v4_Redacted.pdf"}],"summary":"An unauthorized third party accessed Arcis Golf’s network and acquired files containing some individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-07-01","discovered_date":"2024-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"bb542c38134bb1723b80330a07dc354b4646d19b","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"1e52a417abba","org_name":"Affirm Holdings, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1820953/000182095324000027/afrm-20240625.htm"}],"summary":"Affirm reported that personal and financial information of Affirm Card users may have been compromised in a cybersecurity incident at Evolve Bank & Trust.","supporting_quote":null,"technology_involved":["Evolve Bank & Trust","Affirm Card"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Evolve Bank & Trust"},"veris_action":"unknown","derived":{"vendors":[{"id":"2d783636ee28","name":"Evolve Bank & Trust"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be2ca7b16f3085349455f71cad48cf691a78a939","impact_type":"data_theft","incident_date":"2024-05-31","initial_access":"unknown","notes":null,"org_country":"AU","org_id":"84854dd5724b","org_name":"Ticketek","org_type":"retail_ecommerce","ransomware":null,"records_affected":17643173,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ticketek","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ticketek"}],"summary":"Ticketek reported a data breach linked to a third-party cloud platform, and the exposed data included personal information and hashed passwords.","supporting_quote":null,"technology_involved":["Snowflake"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Snowflake"},"veris_action":"unknown","derived":{"vendors":[{"id":"871cb14cb964","name":"Snowflake"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2024-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4bd30b46f5d79e57162dda11394ba53cd784a424","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29649.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"efaabba13dac","org_name":"Adapt Health (Philips Respironics, Inc.)","org_type":"unknown","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29649.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-27","discovered_date":"2024-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86af95efc215352c0ee74b7d9b01d0c8c619a974","impact_type":"data_theft","incident_date":"2024-04-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%5BT01%5D%20US-General.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"9cda79d9f858","org_name":"Ticketmaster LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587685"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%5BT01%5D%20US-General.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29588.pdf"}],"summary":"Ticketmaster reported that an unauthorized third party obtained personal information from a cloud database hosted by a third-party data services provider.","supporting_quote":null,"technology_involved":["cloud database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"19d3fafa603965d527273e3e327e947a0e4f6495","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3350da063d24","org_name":"Morrison Child and Family Services","org_type":"unknown","ransomware":null,"records_affected":2042,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morrison%20Child%20and%20Family%20Services-2024-06-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-06-27","discovered_date":"2024-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e8a44e51975a57eb4ca5832f4d7d5dc348d5156","impact_type":"data_theft","incident_date":"2024-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29637.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"54c324aa8d16","org_name":"Holstein Association USA, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29637.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29637.pdf"}],"summary":"Holstein Association USA confirmed that an unauthorized third party accessed and took data from its IT network, including personal information and health plan participant data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b992778b23b64224bbcaca03d78078b6ac7846b","impact_type":"unknown","incident_date":"2024-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/US_-_Redacted%5B1%5D_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"35d02eb90e7d","org_name":"Ann & Robert H. Lurie Children’s Hospital Of Chicago","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587643"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-26","discovered_date":"2024-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3585f7905793ee2972d83804739b449d8a374ada","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-15","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Providence%20St.%20Joseph%20Health%20Notification%20Letter%20AG%20Reporting.pdf"},"notes":null,"org_country":"US","org_id":"8edbe569bb20","org_name":"Providence Mission Heritage Endocrinology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587534"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Providence%20St.%20Joseph%20Health%20Notification%20Letter%20AG%20Reporting.pdf"}],"summary":"Providence Mission Heritage Endocrinology reported that information was accessed from within the clinic between December 15, 2020 and May 15, 2024.","supporting_quote":"We found that the access was from within the clinic and not the result of a threat actor or hacker, and that our patient data were properly secured and met security standards at the time of access.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-25","discovered_date":"2024-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d17ca7a11b2acd3d6209a8703e616371753e7cca","impact_type":"both","imported_from":null,"incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Epiq%20letter%20-%20IMS.pdf"},"notes":null,"org_country":"US","org_id":"af78af33f457","org_name":"The Union Labor Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Epiq%20letter%20-%20IMS.pdf"}],"summary":"The Union Labor Life Insurance Company reported that its third-party administrator, InfoSys/McCamish Systems LLC, experienced a ransomware attack involving unauthorized acquisition of personal information.","supporting_quote":null,"technology_involved":["InfoSys/McCamish Systems LLC"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"InfoSys/McCamish Systems LLC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"cea89fb3ae59","name":"InfoSys"},{"id":"eaedac3c9a20","name":"McCamish Systems LLC"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":["T1567"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2024-06-25","discovered_date":"2024-06-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90cd31c63c5c179885acfa8fbe93e5d18014a6db","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-05-03","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification%20to%20Affected%20Data%20Subjects.pdf"},"notes":null,"org_country":"US","org_id":"77e33ba5fc39","org_name":"AEG Presents, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587470"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%20to%20Affected%20Data%20Subjects.pdf"}],"summary":"An AEG Presents employee emailed company files, including personal information, from a work email account to a personal email account, with no evidence they were further acquired or shared.","supporting_quote":"On June 18, 2024, AEG P resents, LLC ( “we” or “Company”), learned that an employee had emailed certain company files from their work email account to their personal email account between September 27, 2021 and May 3, 2024.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"992c3ce7096a29e372629bf9c0e054a2c21d1b4b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheNeimanMarcusGroupLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"891a3de089b9","org_name":"The Neiman Marcus Group, LLC","org_type":"unknown","ransomware":null,"records_affected":11049,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheNeimanMarcusGroupLLC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29606.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"136b8c6a565c5be422a6963e2bffdd9dd6bfbf75","impact_type":"disruption_or_ransomware","incident_date":"2024-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/P-Fleet%20-%20Sample%20Notice%20Letter%20CA.pdf"},"notes":null,"org_country":"US","org_id":"e7f5b5f34b27","org_name":"Plavan Commercial Fueling Inc.","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587423"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/P-Fleet%20-%20Sample%20Notice%20Letter%20CA.pdf"}],"summary":"Plavan Commercial Fueling Inc. reported a ransomware incident on or about February 23, 2024, in which personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-24","discovered_date":"2024-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b37befe37f63b1550c8bae8f17a79312a12e71fb","impact_type":"disruption_or_ransomware","incident_date":"2024-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"US","org_id":"1df247e581c1","org_name":"Lithia Motors","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1023128/000102312824000079/lad-20240619.htm"}],"summary":"A cybersecurity incident impacting CDK Global disrupted Lithia Motors’ CDK-hosted dealer management and related systems.","supporting_quote":"On June 19, 2024, Lithia Motors, Inc. (the “Company”) received notice from CDK Global (“CDK”), a third-party provider of certain information systems used by the Company, that CDK had suspended systems used by the Company in response to a cybersecurity incident impacting CDK.","technology_involved":["CDK Global","CDK-hosted dealer management system","customer relationship management system"],"third_party":{"archetype":null,"involved":true,"vendor":"CDK Global"},"veris_action":"unknown","derived":{"vendors":[{"id":"04e2def36298","name":"CDK Global"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"730a1c592cb7cbb0f24da174b6fb0e02a89b75c9","impact_type":"data_theft","imported_from":null,"incident_date":"2024-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"82eafcb177b3","org_name":"Advance Auto Parts","org_type":"retail_ecommerce","ransomware":null,"records_affected":79243727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Advance Auto Parts","type":"hibp","url":"https://haveibeenpwned.com/Breach/AdvanceAutoParts"}],"summary":"Advance Auto Parts customer and employee records were exposed following unauthorized access to Snowflake cloud services.","supporting_quote":null,"technology_involved":["Snowflake"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Snowflake"},"updated_at":null,"veris_action":"unknown","derived":{"vendors":[{"id":"871cb14cb964","name":"Snowflake"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-24","discovered_date":"2024-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"7c176e3d6b6833a9926f17c45074507ebc412633","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"6d97b4713070","org_name":"Group 1 Automotive","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1031203/000103120324000048/gpi-20240619.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1031203/000103120324000048/exhibit991.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1031203/000103120324000055/a2024q2exhibit991.htm"}],"summary":"A cybersecurity incident at CDK disrupted Group 1 Automotive’s U.S. operations that relied on CDK’s dealership systems.","supporting_quote":"On June 19, 2024, Group 1 Automotive, Inc. (“Group 1” or the “Company”) was informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems (the “CDK incident”).","technology_involved":["CDK Global","CDK dealer management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CDK Global"},"veris_action":"unknown","derived":{"vendors":[{"id":"04e2def36298","name":"CDK Global"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c3a41fe683ecd8f4aabeef54491920c598821a6e","impact_type":"disruption_or_ransomware","incident_date":"2024-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":null,"org_country":"US","org_id":"7fa13898955f","org_name":"Sonic Automotive","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1043509/000104350924000063/sah-20240705.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1043509/000104350924000059/sah-20240619.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1043509/000104350924000060/sah-20240705.htm"}],"summary":"Sonic Automotive experienced operational disruptions after a cybersecurity incident at CDK Global affected access to its information systems and applications.","supporting_quote":"As previously disclosed in the Original Form 8-K, the Company has experienced disruptions in its access to certain information systems provided to the Company by CDK Global (“CDK”) due to a cybersecurity incident experienced by CDK on June 19, 2024 (the “Incident”).","technology_involved":["CDK Global","dealer management system (DMS)","customer relationship management system (CRM)","customer lead applications","inventory management applications"],"third_party":{"archetype":null,"involved":true,"vendor":"CDK Global"},"veris_action":"unknown","derived":{"vendors":[{"id":"04e2def36298","name":"CDK Global"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-21","discovered_date":"2024-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e7c4fa596213448ac35a57fcfa4ca9ab0daac422","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"e87864e26162","org_name":"Penske Automotive Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1019849/000101984924000089/pag-20240619.htm"}],"summary":"Penske Automotive Group reported that a cybersecurity incident at CDK disrupted the dealer management system used by its Premier Truck Group business.","supporting_quote":"Our Premier Truck Group business utilizes CDK’s dealer management system which has been disrupted.","technology_involved":["CDK Global dealer management system"],"third_party":{"archetype":null,"involved":true,"vendor":"CDK Global"},"veris_action":"unknown","derived":{"vendors":[{"id":"04e2def36298","name":"CDK Global"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"966e9bb35ffcdb475e84d3522ee3442e62fa58ef","impact_type":"unknown","incident_date":"2024-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Final%20Notification%20Letter%20English%206.20.24.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"77a091dd5b0f","org_name":"Los Angeles County - Department of Health Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587273"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe81415fce1dda1649ced69f70d2a0ffc7e241dc","impact_type":"unknown","incident_date":"2023-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LivaNova%20-%20Appendix%202%20-%20V1_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2918bb2cf445","org_name":"LivaNova USA, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587312"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589535"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LivaNova%20USA%2C%20Inc.-2024-06-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110.004"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-06-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02f2ec53e01229b16ca01f4b768e424b50fc3cac","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-06-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LSCo._CA%20Consumer%20Notice%20%286_21_24%29.pdf"},"notes":null,"org_country":"US","org_id":"396c5be14264","org_name":"Levi Strauss & Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Compromised login credentials from another source were tested against the Levi.com website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587315"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LSCo._CA%20Consumer%20Notice%20%286_21_24%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Levi%20Strauss%20%26%20Co.-2024-06-21"}],"summary":"Levi Strauss & Co. reported that attackers used compromised credentials from another source to access accounts on its website.","supporting_quote":"Users often assign the same email and password combination across multiple online accounts allowing an unauthorized person to gain access more easily using stolen login credentials from another source.","technology_involved":["Levi.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-20","discovered_date":"2024-01-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c547a9d154ff3ebc4b198295fca47a40f4d9ca23","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Venture%20County%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2152c33aa871","org_name":"Ventura County Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587224"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Venture%20County%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"}],"summary":"Unauthorized access to one Ventura County Credit Union employee email account exposed access to information related to affected individuals.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-20","discovered_date":"2023-11-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"229791537ef935cdf2935fe683df1fac40c5b39d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Escondido%20Union%20High%20School%20District%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b4084cdbb870","org_name":"Escondido Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Escondido%20Union%20High%20School%20District%20-%20CA_0.pdf"}],"summary":"Escondido Union High School District reported malware and unauthorized access to certain systems, with information that may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27c60a577a05fd7ac0930b89cc4c4f7fd5c9084c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notice_Source.pdf"},"notes":null,"org_country":"US","org_id":"50bfb846a65a","org_name":"Class Advisors","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587233"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notice_Source.pdf"}],"summary":"An unauthorized individual accessed certain Class Advisors data between February 12 and March 6, 2024, potentially exposing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f85f97b699d7b1d8746b80f35086412d1d1efd3d","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/L01%20-%20CareDx-Lash%20Individual%20Notice%20Letter%20-%20CA%20-%2006.20.24.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6555d052e9a0","org_name":"CareDx, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587245"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6700dd0057b05dd70190856a01caf385ee1e845","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Acrotech%20Individual%20Notice%20Letter%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"54464c461849","org_name":"Acrotech Biopharma Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Acrotech%20Individual%20Notice%20Letter%20-%20CA.pdf"}],"summary":"Cencora reported that data from its information systems was exfiltrated and that some personal information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"154645a5ab9e06c192d6a4f565db4464b49714ec","impact_type":"data_theft","imported_from":null,"incident_date":"2023-11-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"3be907348d76","org_name":"Zadig & Voltaire","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zadig & Voltaire","type":"hibp","url":"https://haveibeenpwned.com/Breach/ZadigVoltaire"}],"summary":"Zadig & Voltaire confirmed an incident more than six months before June 2024, and data including names, contact details, physical addresses, and genders was publicly posted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4921fd715bce1a68c47edf408a4272bc3c71d43","impact_type":"data_theft","incident_date":"2024-01-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Scout%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5f69a0e00b6d","org_name":"Scout Energy Management LLC","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586948"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Scout%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Scout%20Energy%20Management%20LLC-2024-06-14"}],"summary":"An unauthorized actor accessed and acquired files from Scout Energy Management LLC’s computer servers, including documents containing a person’s name and Social Security number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2024-06-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb85de0ffe8c7a061c3b99196a0c9131d1aa2fa7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-19","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notice%20Template%206.14.24.pdf"},"notes":null,"org_country":"US","org_id":"289645c640d0","org_name":"Los Angeles County Department of Public Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees clicked a phishing link, believing it was a legitimate message.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notice%20Template%206.14.24.pdf"}],"summary":"Los Angeles County Department of Public Health reported that a phishing email led employees to click a link and expose login credentials and information in potentially compromised email accounts.","supporting_quote":"In this case, the DPH employees clicked on the link located in the body of the e -mail, thinking that they were accessing a legitimate message from a trustworthy sender.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","medical"],"disclosed_date":"2024-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09711487fbc72b61e7f8baeab86607a8613477da","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LOPS%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"0c9c12a68777","org_name":"Law Office of Peter S. Stern","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LOPS%20Notification%20Letter_Redacted.pdf"}],"summary":"The Law Office of Peter S. Stern detected suspicious activity in its business email environment, and an investigation found that an unauthorized third party may have accessed emails containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"23c1692f73da379fc0b1584ea3bba261ff951839","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-06-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"72df4bf48708","org_name":"Globe Life Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/320335/000032033524000029/gl-20240614.htm"}],"summary":"Globe Life reported likely unauthorized access to consumer and policyholder information through a company web portal.","supporting_quote":null,"technology_involved":["Company web portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-14","discovered_date":"2023-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c613218ab466b42f66c7fae0366d0286938f857f","impact_type":"data_theft","incident_date":"2023-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Example%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6173d3eaa1d6","org_name":"Doxim, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586958"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Example%20Individual%20Notice.pdf"}],"summary":"Doxim detected suspicious activity affecting systems supporting its credit union services and found that files containing personal information had been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27bf516ff5fa7c48c0d5e42d1cd7ddccb917b2ce","impact_type":"data_theft","incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/000%20Individual%20Notifications%20-%20BA-final_v5_Redacted_Redacted_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"4683928a5677","org_name":"Consulting Radiologists LTD.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590877"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/000%20Individual%20Notifications%20-%20BA-final_v5_Redacted_Redacted_Redacted.pdf"}],"summary":"Consulting Radiologists LTD. reported that an unauthorized actor accessed files and data containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-06-14","discovered_date":"2024-02-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9238e16c52982e5b2e497b5e040cfb3474b29e82","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ATPE%20-%20CA%20AG%20Notice%20with%20Exhibit%20-%206-14-2024_0.pdf"},"notes":null,"org_country":"US","org_id":"526d581df4bf","org_name":"Association of Texas Professional Educators","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586954"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ATPE%20-%20CA%20AG%20Notice%20with%20Exhibit%20-%206-14-2024_0.pdf"}],"summary":"The Association of Texas Professional Educators found that an unauthorized user accessed some of its systems, potentially exposing members’ personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-13","discovered_date":"2024-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa606ec1f077708f7a2a646f176836177a5d6882","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Panera_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"3937f1b23635","org_name":"Panera, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586888"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Panera_CA%20App%20%26%20Sample_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29507.pdf"}],"summary":"Panera identified unauthorized access to internal files containing a person's name and Social Security number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-13","discovered_date":"2023-12-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d3dbaad4b6094707e4a76194a6090945565070e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29508.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"aa3d46d200a9","org_name":"Atria Wealth Solutions","org_type":"financial","ransomware":null,"records_affected":779,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29508.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29508.pdf"}],"summary":"Atria reported that an unknown individual accessed an employee's email account containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f79ffdd84df7c48ad04917e068a337f6e83db52","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/LandmarkAdminLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c62ee73b5172","org_name":"Landmark Admin, LLC","org_type":"unknown","ransomware":null,"records_affected":55488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/LandmarkAdminLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"LockBit Black","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-06-12","discovered_date":"2024-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"923781e37045787b3005922d4f9ada8994e64d21","impact_type":"disruption_or_ransomware","incident_date":"2024-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_M4294_Kulicke%20%20Soffa%20Industries_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"ad222557a78b","org_name":"Kulicke and Soffa Industries","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595272"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593171"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/56978/000005697824000075/klic-20240528.htm"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_M4294_Kulicke%20%20Soffa%20Industries_L01_SAS_0.pdf"}],"summary":"Kulicke and Soffa Industries reported that LockBit Black said it had accessed and encrypted specific company files, with personal and financial information potentially accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware","derived":{"actor_id":"lockbitblack"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2024-06-12","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6ed16f729a7bbe3be88765d415ae2c8ed022eb4","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kirkland%20%26%20Ellis%20-%20Individual%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"256ac5bedd2b","org_name":"Kirkland & Ellis LLP","org_type":"professional_services","ransomware":null,"records_affected":35274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586862"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kirkland%20%26%20Ellis%20-%20Individual%20Notification%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28066.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29497.pdf"}],"summary":"Kirkland & Ellis reported that an unauthorized third party obtained files transferred through Progress Software's MOVEit Transfer tool, including files containing personal information.","supporting_quote":"Through our investigation, we found that, between around May 27 and May 31, 2023, an unauthorized third party obtained certain of our files that were transferred through the MOVEit tool.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-12","discovered_date":"2024-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"657128c74cb97a55d92a66aabe2660543e62df73","impact_type":"data_theft","imported_from":null,"incident_date":"2024-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HUSD%20-%20CA%20AG%20Attachment_0.pdf"},"notes":null,"org_country":"US","org_id":"c70fc415733d","org_name":"Hesperia Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HUSD%20-%20CA%20AG%20Attachment_0.pdf"}],"summary":"Hesperia Unified School District reported that an unauthorized party may have accessed files containing employee personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-06-12","discovered_date":"2023-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"432190bb6de419b4cdfdff35d5d27345bc875b87","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Datamate%20-%20CA%20AG%20Notice%20with%20Exhibit%20-%206-11-2024_0.pdf"},"notes":null,"org_country":"US","org_id":"192e19900e5c","org_name":"Datamate Bookkeeping & Tax, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586857"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Datamate%20-%20CA%20AG%20Notice%20with%20Exhibit%20-%206-11-2024_0.pdf"}],"summary":"Datamate reported that an unauthorized actor accessed some files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36846a047f788d607ee2f921bb5157a624484f22","impact_type":"disruption_or_ransomware","incident_date":"2023-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20Santoro%20Whitmire%20-%20UPDATED%20v03___Static_Proof_R3.pdf"},"notes":null,"org_country":"US","org_id":"fd51c85004ec","org_name":"Santoro Whitmire, LTD","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586814"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20Santoro%20Whitmire%20-%20UPDATED%20v03___Static_Proof_R3.pdf"}],"summary":"Santoro Whitmire, LTD reported a ransomware attack, and said personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f366e48410e524c130a0b3a19681c2851813096b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17229.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"00fed3d3c2ff","org_name":"Rairdon Automotive Group","org_type":"unknown","ransomware":null,"records_affected":2301,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17229.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-11","discovered_date":"2024-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf688c1078d1a450763a1e2aeadd94faaa1aaf53","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-13","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Frontier%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a9fc30826ef6","org_name":"Frontier Communications","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586806"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Frontier%20Notification%20Letter.pdf"}],"summary":"Frontier Communications detected unauthorized access to internal IT systems and identified personal information among the data affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d650f27c60ecc0ebbb7e2e0e38ab19a64ef9fd0b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheAmericanBarAssociation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08fda3a3a9ac","org_name":"The American Bar Association","org_type":"unknown","ransomware":null,"records_affected":28021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheAmericanBarAssociation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-10","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32a13064e6773b3ad84dfc8f7b98f550c933e985","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Sanofi%29%205.30.24_CA.pdf"},"notes":null,"org_country":"US","org_id":"bdadc406e613","org_name":"Sanofi US Services Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Sanofi%29%205.30.24_CA.pdf"}],"summary":"The notice says data from Cencora’s information systems was exfiltrated and some personal and health information associated with Sanofi was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56956ff3087c7217807bf7fe452045c2eb4f50e3","impact_type":"unknown","incident_date":"2023-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20First%20American%20Notification%20Letter_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d71c55c3cb6a","org_name":"First American Financial Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586703"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#First%20American%20Financial%20Corporation-2024-06-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c0f73d7f1f0b624a4d0caa5d7dcd9a8f48bd7ab2","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29443.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f0d3ac3f69eb","org_name":"Pfizer, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":2650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29443.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29443.pdf"}],"summary":"The letter reports that data from Cencora’s information systems was exfiltrated and that affected information included personal details, diagnoses, and medication or prescription information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea054898706baae07bc3e4402909590ed05831e2","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Pfizer%29%206.7.24%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"f0d3ac3f69eb","org_name":"Pfizer Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586568"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Pfizer%29%206.7.24%20%28CA%29.pdf"}],"summary":"Personal and medical information associated with Pfizer was affected after data was exfiltrated from Cencora's information systems.","supporting_quote":null,"technology_involved":["Cencora"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89b1a84e4ab4508062f61a4fe8a3d72ce127408f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A_Mariposa%20-%20Individual%20Letter%20V.2%20HR.pdf"},"notes":null,"org_country":"US","org_id":"cdcd3a2f7f97","org_name":"Mariposa Landscapes Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586585"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A_Mariposa%20-%20Individual%20Letter%20V.2%20HR.pdf"}],"summary":"Mariposa Landscapes Inc. reported that an unauthorized actor may have accessed limited information maintained on its network between October 12 and October 15, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-07","discovered_date":"2024-05-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddd6f1109461283f5a32527c1ee3dab550a45cd2","impact_type":"data_theft","incident_date":"2024-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Christie%27s%20Individual%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"3b121c67fcfa","org_name":"Christie’s Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586557"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Christie%27s%20Individual%20Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Christie%E2%80%99s%20Inc.-2024-06-07"}],"summary":"Christie’s reported that an unauthorized actor accessed some systems and copied files containing individuals’ names and other information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79380287ec5849337f7ba0b711741a7b83e57e5b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Compromise%20Customer%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ecf6b936280","org_name":"Peak Design","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586512"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0473dafce90a041279b9c6fa6a489a95140ea383","impact_type":"data_theft","incident_date":"2024-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/My%20Daily%20Choice%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1485","org_country":"US","org_id":"5c95b4d15ab9","org_name":"My Daily Choice, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586481"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/My%20Daily%20Choice%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#My%20Daily%20Choice%2C%20Inc.-2024-06-06"}],"summary":"My Daily Choice reported that an unauthorized actor accessed, copied, and attempted to delete files containing customer information in a third-party hosted environment.","supporting_quote":null,"technology_involved":["third-party hosted environment"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-06","discovered_date":"2024-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aa4dfcb8c5105434fca348bf2cfc154abdf1a608","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29432.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4764b8bf90af","org_name":"Frontier Communications Parent, Inc.","org_type":"telecom","ransomware":null,"records_affected":7534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29432.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Frontier%20Communications%20Parent%2C%20Inc.-2024-06-11"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FrontierCommunicationsParentInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29432.pdf"}],"summary":"Frontier Communications detected unauthorized access to internal IT systems and identified personal information among the data affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"076eda7aa9520f7acd62d56a876438d68c4c5b1f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elk%20Grove%20Unified%20School%20District%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f5bae1039b00","org_name":"Elk Grove Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586438"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elk%20Grove%20Unified%20School%20District%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Elk Grove Unified School District reported unauthorized access to two employees’ email accounts and said personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-06-05","discovered_date":"2024-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17bd5903926e76006d227786416b4aa23fa60344","impact_type":"data_theft","incident_date":"2024-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Drive%20Sally%20LLC%20-%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"f8b1b62a97af","org_name":"Drive Sally, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586452"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Drive%20Sally%20LLC%20-%20Notification%20Letter%20Template.pdf"}],"summary":"An unauthorized third party accessed Drive Sally, LLC’s staging database and acquired files containing personal information.","supporting_quote":null,"technology_involved":["staging database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa24f9694557ea1d8b7ce6a6ddc1c2d520c6c6e2","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter%206.5.24%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"847063270236","org_name":"Bausch Health Companies Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter%206.5.24%20%28CA%29.pdf"}],"summary":"Personal information associated with Bausch Health was affected after data was exfiltrated from Cencora's information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-06-04","discovered_date":"2023-12-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"75515c8117332d39823a61121a967564d8107f3b","impact_type":"disruption_or_ransomware","incident_date":"2023-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29378.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"681664e7ea37","org_name":"Medjet Assistance","org_type":"professional_services","ransomware":null,"records_affected":9142,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29378.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29378.pdf"}],"summary":"Medjet’s systems were temporarily disrupted by malware, and data including names, addresses, and Social Security numbers may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"697cd6fbcd6b147f7b2846d756807402de5d82f9","impact_type":"unknown","incident_date":"2024-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"41b7b5895901","org_name":"Gapbuster Worldwide Pty Ltd (GBW)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586357"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f644660558e321f51a9c08ab14acd229096db926","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29369.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7137b07a3802","org_name":"Rotech Healthcare (Philips Respironics, Inc.)","org_type":"unknown","ransomware":null,"records_affected":2802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29369.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"426af5063f0e984d532289ce741f3d6dd6a933e0","impact_type":"unknown","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/KP-General.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6237f0dbe0ad","org_name":"Philips Respironics","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586333"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Philips%20Respironics%2C%20Inc.-2024-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-03","discovered_date":"2023-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9210a22ae8aa2660f08d301dc485ddbfc1bbb15","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulatory%20Notice%20-%20NAHC%20-%20CA%20AG%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"ddb49c6e027c","org_name":"Native American Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulatory%20Notice%20-%20NAHC%20-%20CA%20AG%20%281%29_0.pdf"}],"summary":"Native American Health Center reported that an unauthorized actor accessed files that may have contained personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd659a8cc8c413b1ebe21626164b48e6570b3a30","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29371.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb3a52a91def","org_name":"Kaiser Foundation Health Plan, Inc. (Philips Respironics, Inc.)","org_type":"unknown","ransomware":null,"records_affected":17530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29371.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df0e0421dcb3eb0b3378b3fe2ea187e83a6ac16e","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%206.3.24.pdf"},"notes":null,"org_country":"US","org_id":"40207ec22210","org_name":"Heron Therapeutics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586345"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%206.3.24.pdf"}],"summary":"The notice reported that data from Cencora's information systems was exfiltrated and personal and health information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2024-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14b3b52f25463debe6ad5784165240be55c0ddba","impact_type":"data_theft","incident_date":"2024-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"a6dd6934756b","org_name":"Combolists Posted to Telegram","org_type":"unknown","ransomware":null,"records_affected":361468099,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Combolists Posted to Telegram","type":"hibp","url":"https://haveibeenpwned.com/Breach/TelegramCombolists"}],"summary":"In May 2024, 2B rows of data with 361M unique email addresses were collated from malicious Telegram channels . The data contained 122GB across 1.7k files with email addresses, usernames, passwords and in many cases, the website they were entered into. The data appears to have bee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3cd8cd3df7e53f5a5e86de606d6d8eefc97d7d69","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29345.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"53d45e496703","org_name":"Takeda Pharmaceuticals U.S.A., Inc.","org_type":"healthcare","ransomware":null,"records_affected":889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29345.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29345.pdf"}],"summary":"Personal information associated with Takeda Pharmaceuticals U.S.A., Inc. was affected after Cencora reported exfiltration of data from its information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa79114339f7098329466c3d65590c3c8b8f5831","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA.pdf"},"notes":null,"org_country":"US","org_id":"53d45e496703","org_name":"Takeda Pharmaceuticals U.S.A.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586211"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA.pdf"}],"summary":"Personal information associated with Takeda was affected when data was exfiltrated from Cencora’s information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddf7f980a4180820955e45342aaf5d887e717772","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29.pdf"},"notes":null,"org_country":"US","org_id":"b94070054c89","org_name":"Sandoz Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586206"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29.pdf"}],"summary":"Cencora reported that data exfiltrated from its information systems included personal information affected by the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca07e887b98cafd3015f7aeb885e15d1a3ed867f","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29350.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cdec74d5436e","org_name":"Rayner Surgical Inc.","org_type":"professional_services","ransomware":null,"records_affected":829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29350.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29350.pdf"}],"summary":"The incident involved exfiltration of data from Cencora’s information systems, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71e0da586218ff4e8f40a8d88785341da761ed64","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29_0.pdf"},"notes":null,"org_country":"US","org_id":"cdec74d5436e","org_name":"Rayner Surgical Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29_0.pdf"}],"summary":"Data exfiltrated from Cencora’s information systems included personal information affected by the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3639e5633c2ea3ed3174c95b692e5ebc2eaf3dc0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/PruittHealthInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8570f01f8fce","org_name":"Pruitt Health, Inc.","org_type":"unknown","ransomware":null,"records_affected":5217,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/PruittHealthInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-31","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f990fe59d54e4787e2ef20503db300afd9d0d57","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29_1.pdf"},"notes":null,"org_country":"US","org_id":"a8f3ed202237","org_name":"Otsuka America Pharmaceutical, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586215"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05-31-2024%20AG%20Notice%20CA%20ONLY%20%28Consumer%20Ltr%29_1.pdf"}],"summary":"Data from Cencora's information systems was exfiltrated, affecting personal and medical information associated with Otsuka America Pharmaceutical.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7c06d0a28d9435abc908a908e8316471deb2277","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8611d6b1df67","org_name":"Henry Schein, Inc.","org_type":"unknown","ransomware":null,"records_affected":63760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Henry%20Schein%2C%20Inc.-2024-05-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-31","discovered_date":"2024-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aaeb6a7147cfeea68e8ac14a5e443a3a4e541215","impact_type":"unknown","incident_date":"2024-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Form%20I-9%20-%20Individual%20Notification%20Template_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"3a5afcfa106e","org_name":"Form I-9 Compliance","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593283"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586216"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20I-9%20-%20Individual%20Notification%20Template_Redacted.pdf"}],"summary":"Form I-9 Compliance reported unauthorized access to part of its network, affecting some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-31","discovered_date":"2024-03-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"0e9816bea34e222d4ee3d5427487a7575e458b7c","impact_type":"data_theft","incident_date":"2024-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29971.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"54fa899645d3","org_name":"DG3 North America, Inc.","org_type":"professional_services","ransomware":null,"records_affected":2670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29971.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586225"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588022"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DG3%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29971.pdf"}],"summary":"DG3 North America discovered suspicious activity and determined that information was accessed and/or copied from its systems between February 5 and 22, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f0fad6d263fc60f80312ac578d3c188f1ceabea5","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29328.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bdadc406e613","org_name":"Sanofi US Services Inc.","org_type":"professional_services","ransomware":null,"records_affected":24496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29328.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29328.pdf"}],"summary":"Data from Cencora’s information systems was exfiltrated, and the incident affected personal information including health diagnoses and medications or prescriptions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"076e2e93b608268573c262a31de2dec34acf96e9","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29336.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"222e313ddb83","org_name":"Amgen","org_type":"healthcare","ransomware":null,"records_affected":14081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29336.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29336.pdf"}],"summary":"The letter reports that data from Cencora’s information systems was exfiltrated and that personal information, including health information, was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa2207b46e5d5022e567704e7c0061a9f474ee3b","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05.30.2024%20Consumer%20Ltr--CA%20ONLY.pdf"},"notes":null,"org_country":"US","org_id":"222e313ddb83","org_name":"Amgen Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586179"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05.30.2024%20Consumer%20Ltr--CA%20ONLY.pdf"}],"summary":"Cencora reported that data from its information systems was exfiltrated and that some personal information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fbc94c10f77217a5a06bf5c48ec5be07c452dd7d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/VictoriaEyeCenter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3df8545943d","org_name":"Victoria Eye Center","org_type":"unknown","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/VictoriaEyeCenter.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a9f6e6239371146eb910f937da484cc589061a0b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/4%20Nan%20Ya%20America%20Draft%20Notice%20Letter%20(non%20state%20specific%20-%20SSN%20and%20medical).pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7a4f1b93fb09","org_name":"Nan Ya Plastics Corporation America","org_type":"manufacturing","ransomware":null,"records_affected":1348,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/4%20Nan%20Ya%20America%20Draft%20Notice%20Letter%20(non%20state%20specific%20-%20SSN%20and%20medical).pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/4%20Nan%20Ya%20America%20Draft%20Notice%20Letter%20(non%20state%20specific%20-%20SSN%20and%20medical).pdf"}],"summary":"Nan Ya Plastics Corporation America reported that personal and medical information was accessed without authorization during a security incident at its affiliate, Formosa Plastics Corporation, U.S.A.","supporting_quote":"We recently learned that, as a result of a security incident at Formosa Plastics Corporation, U.S.A. in early March 2024, a portion of our company data, including a limited amount of your personal information has been accessed without authorization.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Formosa Plastics Corporation, U.S.A."},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"3e76d55383ae","name":"Formosa Plastics Corporation"},{"id":"0f3aefd517c2","name":"U.S.A"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-29","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e2bc7b0bfbcbc0f90f9e977fa4ae6268193582e","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%205.29.2024.pdf"},"notes":null,"org_country":"US","org_id":"dc6b29dde877","org_name":"Cencora","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586078"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%205.29.2024.pdf"}],"summary":"Cencora reported that data from its information systems was exfiltrated and that personal information, including health information, was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-28","discovered_date":"2024-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"904c7cc9ffdc0b60539a9550388bf7f0e69e7d53","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TABS_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"763f913e477e","org_name":"Toshiba America Business Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TABS_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Toshiba America Business Solutions identified suspicious activity in its email environment and learned that personal information may have been viewed by an unauthorized individual.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c54d1af70720edef2030002078d9afdbed858bf","impact_type":"disruption_or_ransomware","incident_date":"2023-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Combine%20-%20Sample%20Letters%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"edfb96aa2e0f","org_name":"R3 Education Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combine%20-%20Sample%20Letters%20-%20Exhibit%20A.pdf"}],"summary":"R3 Education reported unauthorized access to its computer systems and encryption of stored information, with personal and medical information potentially subject to access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d03e00753fbd1b04cf06f97d5f3479c3b835e47e","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29273.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"53ad798328fa","org_name":"Johnson & Johnson Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":5954,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29273.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29273.pdf"}],"summary":"Personal information, including health-related information, was exfiltrated from information systems in an incident reported by the organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-28","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fa53ed8f7c35d90567b9defc2a1fb5df3d16813","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%205.28.2024%20.pdf"},"notes":null,"org_country":"US","org_id":"53ad798328fa","org_name":"Johnson & Johnson Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586066"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%29%205.28.2024%20.pdf"}],"summary":"The notice says data from Cencora’s information systems was exfiltrated and that some personal information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c122f2224f8c85e64c0e6a9a4b05158c09f1234f","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29278.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"012e0ea81390","org_name":"Johnson & Johnson Patient Assistance Foundation, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":12835,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29278.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29278.pdf"}],"summary":"Personal information associated with Johnson & Johnson Patient Assistance Foundation was affected after data was exfiltrated from Cencora’s information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c2fe32e58fe7f451d28222f6d8f727a545b805b","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Redacted%20%28CA%29%205-28-24.pdf"},"notes":null,"org_country":"US","org_id":"012e0ea81390","org_name":"Johnson & Johnson Patient Assistance Foundation, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Redacted%20%28CA%29%205-28-24.pdf"}],"summary":"Data exfiltrated from Cencora's information systems affected personal and health information associated with Johnson & Johnson Patient Assistance Foundation, Inc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"715fcce3ce0518d9a223e626c80a5818b9b41be2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29280.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c728360454fc","org_name":"HealthFirst Urgent Care, PLLC","org_type":"unknown","ransomware":null,"records_affected":4111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29280.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df984e3c94b746dcbba62f11c484dc4075549be9","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"19942d3bcea5","org_name":"pcTattletale","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: pcTattletale","type":"hibp","url":"https://haveibeenpwned.com/Breach/pcTattletale"}],"summary":"pcTattletale’s website was defaced and data including membership records, captured messages, IP addresses, and device information was posted publicly.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-24","discovered_date":"2023-08-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"0283403c4ba585626fce5c16573b2ced9156d952","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/WelltokInc.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4d5751531773","org_name":"Welltok, Inc","org_type":"professional_services","ransomware":null,"records_affected":135359,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/WelltokInc.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/WelltokInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/WelltokInc.pdf"}],"summary":"Welltok reported that an unknown actor exploited vulnerabilities to access its MOVEit Transfer server and exfiltrate data.","supporting_quote":"our investigation determined on August 11, 2023, that an unknown actor exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-24","discovered_date":"2024-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64854b71c686cc46b9e1d3b4d913ecd213ad3f12","impact_type":"both","incident_date":"2024-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29258.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e90a6c704416","org_name":"TRC Staffing Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":8880,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29258.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TRCStaffingServicesInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29258.pdf"}],"summary":"TRC Staffing Services identified file encryption and possible access to or acquisition of personal information on certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4deeef1633c970b210b002a6891211aa312d0083","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/SouthStateBank%20(1).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"077b1e28b1bb","org_name":"SouthState Bank","org_type":"unknown","ransomware":null,"records_affected":844672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/SouthStateBank%20(1).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-24","discovered_date":"2024-04-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7adc30dd74a17aac71d286bb3e43f42d7bcb5597","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BDG%20Innovations%2C%20LLC%20%E2%80%93%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"9f844d375d1b","org_name":"Rex Signature Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594742"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585925"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BDG%20Innovations%2C%20LLC%20%E2%80%93%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA.pdf"}],"summary":"Rex Signature Services reported that an unknown actor accessed certain systems and likely accessed or acquired files containing personal information and limited medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-24","discovered_date":"2024-03-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa69f2efa7ed93e4383af956ea95e244f69b8643","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29250.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"15e38b269b3b","org_name":"New York Life Investment Management LLC","org_type":"financial","ransomware":null,"records_affected":772,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29250.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29250.pdf"}],"summary":"New York Life Investment Management LLC reported that personal information was accessed and/or copied from its systems between February 5 and 22, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"60cfe2faf079c0f9aa43c3d3714594e297062e36","impact_type":"data_theft","incident_date":"2023-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29246.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9c5183e863b7","org_name":"Messner Reeves","org_type":"professional_services","ransomware":null,"records_affected":678,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29246.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29246.pdf"}],"summary":"Messner Reeves reported that an unknown actor accessed certain systems and copied files containing client information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-05-24","discovered_date":"2024-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e27755a4ace5f41cd203444d0a68225a33220a3f","impact_type":"both","imported_from":null,"incident_date":"2024-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29253.pdf"},"notes":null,"org_country":"US","org_id":"8aae2e453a69","org_name":"Hypertension-Nephrology Associates, P.C.","org_type":"healthcare","ransomware":true,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29253.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29253.pdf"}],"summary":"Cybercriminals accessed the Practice’s systems, exfiltrated patient information, and carried out an extortion attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-24","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e0f90082f87e2984e07824ed2f41757b7c5d9be7","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29247.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"568bfbe0c985","org_name":"GSK Patient Access Programs Foundation","org_type":"manufacturing","ransomware":null,"records_affected":6617,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29247.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29247.pdf"}],"summary":"Personal and medical information connected to GSK’s patient access programs was affected after data was exfiltrated from Cencora’s information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50a2ed1c08b9227ea213567eba95f1a96ff7f59a","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice_GSK_5-24-2024%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"c477595473ea","org_name":"GlaxoSmithKline","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice_GSK_5-24-2024%20%28CA%29.pdf"}],"summary":"Personal information of GlaxoSmithKline patient access program recipients was affected after data was exfiltrated from Cencora's information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04ce83149b1e9da77f5e98c3f95c809fb701fcb7","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%205.24.2024%20CA.pdf"},"notes":null,"org_country":"US","org_id":"73968907ab6c","org_name":"Endo Pharmaceuticals Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%205.24.2024%20CA.pdf"}],"summary":"The notice reports that personal information, including potentially health diagnoses and medication details, was affected after data was exfiltrated from Cencora information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-05-24","discovered_date":"2024-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f33ecf150bf6f92969a473006e57f4bd4c16d48","impact_type":"data_theft","incident_date":"2023-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AA%20Services%20-%20Letter%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"7ede84ec274d","org_name":"A&A Services d/b/a Sav-Rx","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585926"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AA%20Services%20-%20Letter%20Templates.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#A%26A%20Services%2C%20d/b/a%20Sav-Rx-2024-05-24"}],"summary":"An unauthorized third party accessed Sav-Rx’s non-clinical systems and obtained files containing health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-23","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3a317c8de396852e960131cbf5413781c6a8cda","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Sumitomo%29%205.23.24%20CA.pdf"},"notes":null,"org_country":"US","org_id":"d40d654358f7","org_name":"Sumitomo Pharma America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585855"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28Sumitomo%29%205.23.24%20CA.pdf"}],"summary":"Personal information belonging to a Sumitomo Pharma America individual was affected after data was exfiltrated from Cencora’s information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77d9827a6a9ec5c089e119f9694915cd570294e4","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29236.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"049e69011d3d","org_name":"Incyte Corporation","org_type":"healthcare","ransomware":null,"records_affected":745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29236.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29236.pdf"}],"summary":"Data from Cencora’s information systems was exfiltrated, and some personal information associated with this incident was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d7975f0839e4d0a2f958ca59cb166068442f42","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%205.23.2024%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"049e69011d3d","org_name":"Incyte Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585847"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35d46ef5e6c205099a744034bb48d22eb0e0dea2","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"577dc606c374","org_name":"Dota2","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dota2","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dota2"}],"summary":"A breach of Dota2’s official developers forum exposed email and IP addresses, usernames, and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"733517594d291588cbf5a2286359e7c3a83fe10d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/AffiliatedDermatologists%26DermatologicSurgeonsPA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f923404dc82c","org_name":"Dermatologists & Dermatologic Surgeons P.A","org_type":"unknown","ransomware":null,"records_affected":1199,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/AffiliatedDermatologists%26DermatologicSurgeonsPA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4075929f7c0f15757f5f59dd56a912e4c97d7215","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29243.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"18c729e665e9","org_name":"Dendreon Pharmaceuticals","org_type":"healthcare","ransomware":null,"records_affected":920,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29243.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29243.pdf"}],"summary":"The notice reported that personal and medical information was exfiltrated from Cencora information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e64ee55cb459c69958cce4e79cceb695453bf8da","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%205.23.2024%29.pdf"},"notes":null,"org_country":"US","org_id":"18c729e665e9","org_name":"Dendreon Pharmaceuticals LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20%28CA%205.23.2024%29.pdf"}],"summary":"Personal information associated with Dendreon Pharmaceuticals LLC was affected after data was exfiltrated from Cencora's information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-23","discovered_date":"2024-03-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67c5b73ef9f62a785d779399065414f2f4e357f1","impact_type":"both","incident_date":"2024-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/24-05-23%20-%20Individual%20Notice%20Letter%20Sample%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"01e9b1bbf25f","org_name":"Affiliated Dermatologists & Dermatologic Surgeons P.A.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585886"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/24-05-23%20-%20Individual%20Notice%20Letter%20Sample%20-%20Redacted.pdf"}],"summary":"Affiliated Dermatologists & Dermatologic Surgeons P.A. reported that an unauthorized actor accessed systems, copied personal information, and left a ransom note.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31d4f79bf86a83e2b1e4b8b036fc3616d1951b8a","impact_type":"data_theft","incident_date":"2023-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trionfo%20-%201%20Yr%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"7c1b4c560f45","org_name":"Trionfo Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585798"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trionfo%20-%201%20Yr%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trionfo%20Solutions%2C%20LLC-2024-05-22"}],"summary":"An unauthorized party accessed certain Trionfo systems between December 4 and December 6, 2023, and may have acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0efcc946b57b382b9a55b2f155264edf28777d47","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29228.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0e170c7a4a8e","org_name":"Regeneron Pharmaceuticals","org_type":"healthcare","ransomware":null,"records_affected":13958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29228.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29228.pdf"}],"summary":"Cencora reported that data from its information systems was exfiltrated, affecting personal and medical information associated with Regeneron Pharmaceuticals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7095a9e3119f177a92e575d46018dee742eb8d3c","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%205.22.2024%20CA.pdf"},"notes":null,"org_country":"US","org_id":"0e170c7a4a8e","org_name":"Regeneron Pharmaceuticals","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%205.22.2024%20CA.pdf"}],"summary":"Personal and medical information associated with Regeneron was affected after data was exfiltrated from Cencora’s information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e13bcf08a7856b71aa442c9535b0ee55a7520775","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29217.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ec4a71ae62c1","org_name":"Novartis Pharmaceuticals Corporation","org_type":"healthcare","ransomware":null,"records_affected":2520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29217.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29217.pdf"}],"summary":"Cencora reported that data exfiltrated from its information systems included personal information affecting Novartis Pharmaceuticals Corporation’s customer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a1098335155fe9a2d9536728dc342dc8b6b2c93","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20-%20Novartis%20-%205-22-24%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"ec4a71ae62c1","org_name":"Novartis Pharmaceuticals Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585783"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Notice%20-%20Novartis%20-%205-22-24%20-%20CA.pdf"}],"summary":"Personal and health information associated with Novartis was affected after data was exfiltrated from Cencora information systems.","supporting_quote":null,"technology_involved":["Cencora information systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-22","discovered_date":"2023-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9265231786b2bfa8f48b513ce7b3adfd9f8383e","impact_type":"disruption_or_ransomware","incident_date":"2023-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"6b22c878cce9","org_name":"Association of California School Administrators","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585791"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20CA_1.pdf"}],"summary":"An unauthorized actor accessed certain ACSA systems and encrypted certain files, and personal information may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b98448e813379fb16ab8a12f186ac98f14a51b4","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29192.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a453a6be68c4","org_name":"The Lash Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":7931,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29192.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29192.pdf"}],"summary":"A state attorney general filing reports a security incident involving The Lash Group, LLC, dated February 21, 2024, affecting 7,931 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-05-21","discovered_date":"2024-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"b16e210289b62960e6eafb52a3323fc3655a47e7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Clesius%20and%20Voyager.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"89b6a91c4ad3","org_name":"Stretto Inc","org_type":"professional_services","ransomware":null,"records_affected":5696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Clesius%20and%20Voyager.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Notice%20-%20Clesius%20and%20Voyager.pdf"}],"summary":"Stretto confirmed that an unauthorized party accessed personal and claim-related information associated with the Voyager bankruptcy matter.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-05-21","discovered_date":"2024-01-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9f3722d23de89b16f8a0d3366bff58711bf69a2","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fitzgerald%20Notification%20Letter%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"73632dec0c9b","org_name":"Daniel E. Fitzgerald, CPA","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585765"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fitzgerald%20Notification%20Letter%20Redacted.pdf"}],"summary":"Daniel E. Fitzgerald, CPA discovered a ransomware attack that gave a threat actor unauthorized access to its computer network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-21","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c5d28836ad04b3fc6ef0f6cff854ab172dd978ff","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29207.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5bfa09bbcf82","org_name":"Acadia Pharmaceuticals","org_type":"healthcare","ransomware":null,"records_affected":851,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29207.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29207.pdf"}],"summary":"Cencora reported that data from its information systems had been exfiltrated, including personal information affecting Acadia Pharmaceuticals customers.","supporting_quote":null,"technology_involved":["Cencora"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a8abb702ba38bac4b3078fbc0dc94645479b67a","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-21.pdf"},"notes":null,"org_country":"US","org_id":"5bfa09bbcf82","org_name":"Acadia Pharmaceuticals Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585716"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-21.pdf"}],"summary":"Personal information associated with Acadia Pharmaceuticals was affected after data was exfiltrated from Cencora's information systems.","supporting_quote":null,"technology_involved":["Cencora information systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9dab4f9e21a8ff3f763088659ff861c65eddf60","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/L02_AbbVie%20%28CA%29_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd8c78ea3ab5","org_name":"AbbVie Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585726"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45f393a1b757657f83a073a1793fb4e343ca5c43","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-20_0.pdf"},"notes":null,"org_country":"US","org_id":"ee03090a7bd4","org_name":"Genentech","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585650"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-20_0.pdf"}],"summary":"The letter reports that data from Cencora information systems was exfiltrated and that some personal information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-20","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"87673cc29a75d3d2fe1921db7a0db74ab2e3aa9f","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17399.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"daefd3e60b13","org_name":"Bayer Corporation","org_type":"manufacturing","ransomware":null,"records_affected":2060,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17399.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17399.pdf"}],"summary":"The notice reports that data containing personal information, including potentially health information, was exfiltrated from information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-20","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e9f718dfaf8477561fd47f40b625de70a9cf8d2","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-20.pdf"},"notes":null,"org_country":"US","org_id":"daefd3e60b13","org_name":"Bayer Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Individual%20Letter_CA%205-20.pdf"}],"summary":"Cencora reported that data exfiltrated from its information systems included personal information associated with this notification.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cencora"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dc6b29dde877","name":"Cencora"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f85cc480b690896874d9b8d604ae72faf5138ea","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheLashGroupLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a453a6be68c4","org_name":"The Lash Group, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-17"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-20"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-21"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-22"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-23"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-24"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheLashGroupLLC.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-28"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-30"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-05-31"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lash%20Group%2C%20LLC-2024-06-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-17","discovered_date":"2023-09-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d9ff1028a2c1ecafdbb518cf7c139452f3e11ff","impact_type":"both","incident_date":"2023-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"0728c25968c8","org_name":"OmniVision Technologies, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585548"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20CA_0.pdf"}],"summary":"OmniVision Technologies reported that an unauthorized party encrypted certain systems and took personal information between September 4 and September 30, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8522ad285dd68426b589082fa470e292ab02990d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PROJ%20SIDECAR%20NOB%20STANDARD%20ENGLISH51724mt.pdf"},"notes":null,"org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee scanned a QR code in a phishing document, allowing the threat actor to access the employee’s Microsoft Office 365 account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PROJ%20SIDECAR%20NOB%20STANDARD%20ENGLISH51724mt.pdf"}],"summary":"A phishing email led to access to a Los Angeles County Department of Mental Health employee’s Microsoft Office 365 account and possible exposure of personal and medical information.","supporting_quote":"The employee followed the instructions included in the document and scanned the QR code, sending the email to a malicious website, allowing the threat actor the ability to get access to the employee’s Microsoft Office 365 account.","technology_involved":["Microsoft Office 365"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cbe3d0d603984a22feec6410a69c4d3c29f704e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29161.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b5950ec1e0a","org_name":"Bristol Myers Squibb/Bristol Myers Squibb Patient Assistance Foundation (The Lash Group, LLC)","org_type":"unknown","ransomware":null,"records_affected":34644,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29161.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce43ea9377dafa3e32cc8d34f087b48819c71e4a","impact_type":"unknown","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BMS_L02_CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eaac002d8da6","org_name":"Bristol Myers Squibb Company and Bristol Myers Squibb Patient Assistance Foundation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585529"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a351bc14e7e4b9ac2c99464f48cdc422eb77bfe9","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024.05.13%20-%20Oxford%20-%20%20Letter%20to%20CA%20Employees.pdf"},"notes":null,"org_country":"US","org_id":"bc2d9ca61f46","org_name":"Oxford Global Resources, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024.05.13%20-%20Oxford%20-%20%20Letter%20to%20CA%20Employees.pdf"}],"summary":"An Oxford employee inadvertently emailed a file containing employee W-2s to a former consultant, creating potential access to personal information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb2a881e7f3ae280d205caa2a8c1aed9fb90757d","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L02_Redacted%205-15-24.pdf"},"notes":null,"org_country":"US","org_id":"dc6b29dde877","org_name":"Cencora","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585423"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L02_Redacted%205-15-24.pdf"}],"summary":"Cencora reported that data exfiltrated from its information systems included personal information, potentially including health diagnoses and medications.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"85bca882cd21addcf77e8adacbb5681b8da92bf5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TrueHomesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3414d6b7a6b","org_name":"True Homes, LLC","org_type":"unknown","ransomware":null,"records_affected":5794,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TrueHomesLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e40deef6977ac137cb6220321af4462074de71","impact_type":"unknown","incident_date":"2023-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_Proof%2833586409.1%29_Redacted_33590438v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3864fc38c764","org_name":"Thayer Academy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585338"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69691329fc3cd315c42542a7b39478b48a39f784","impact_type":"unknown","incident_date":"2023-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NNA%20Sample%20Incident%20Notice_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99070f8c305d","org_name":"Nissan North America, Inc. (“NNA”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585372"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00d051fc9baa07ba2ae25ca9f5720ed8fd0c3b51","impact_type":"both","imported_from":null,"incident_date":"2024-05-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"4374cc3d6859","org_name":"The Post Millennial","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Post Millennial","type":"hibp","url":"https://haveibeenpwned.com/Breach/ThePostMillennial"}],"summary":"The Post Millennial experienced a website defacement and exposure of data associated with writers, editors, subscribers, and mailing lists.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-10","discovered_date":"2024-05-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4930f16384387ea45b5a3967524d1c4740f8ce75","impact_type":"both","imported_from":null,"incident_date":"2024-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"0483b5734f1a","org_name":"Key Tronic Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/719733/000071973324000047/ktcc-20240506.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/719733/000071973324000044/q42024preliminaryexhibit991.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/719733/000071973324000053/q42024exhibit991.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/719733/000071973324000035/ktcc-20240506.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/719733/000071973324000015/ktcc-20240506.htm"}],"summary":"Key Tronic Corporation reported unauthorized access to portions of its IT systems, operational disruption, and exfiltration of limited data that included personally identifiable information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5334195fa1f0496b206b9c0d8f7cbbda59a2f62c","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BD","org_id":"14c92ac9140c","org_name":"Tappware","org_type":"professional_services","ransomware":null,"records_affected":94734,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tappware","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tappware"}],"summary":"Data taken from Tappware in April 2024 was published to a hacking forum and included personal information and government-issued identity card scans.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-09","discovered_date":"2024-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95c78ce6e00c955113d2dd8d34c2088163447f7b","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SIR0105842_Notification_Sample.pdf"},"notes":null,"org_country":"US","org_id":"d31e329150ee","org_name":"Paychex","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585048"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SIR0105842_Notification_Sample.pdf"}],"summary":"Paychex inadvertently provided an unclaimed-property listing containing personal information to an unauthorized individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e2fe1f9bbea079699fe6ad6a97d2a0de2d9ca2d","impact_type":"unknown","imported_from":null,"incident_date":"2023-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ohio_Lottery_-_CA_Notice_Letter_Redacted_33574115v1.pdf"},"notes":null,"org_country":"US","org_id":"eeb883e7ac67","org_name":"Ohio Lottery","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ohio_Lottery_-_CA_Notice_Letter_Redacted_33574115v1.pdf"}],"summary":"The Ohio Lottery detected unauthorized access to its internal office network that resulted in exposure of data it maintained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"CL0P","variety":"organized_crime"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d64d09590a6baa741364e1279275a5bd3a7ce3fe","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job43041d24_Enstar_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"3bf654482005","org_name":"Allianz Global Risks U.S. Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor exploited a zero-day vulnerability in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job43041d24_Enstar_L01_SAS_1.pdf"}],"summary":"An unauthorized actor exploited a zero-day vulnerability in MOVEit Transfer and exfiltrated data stored on the server.","supporting_quote":"Our investigation determined that an unauthorized actor (subsequently identified as the criminal group known as ‘CL0P’) exploited this zero-day vulnerability, accessed the MOVEit Transfer server between May 29, 2023, and May 31, 2023, and exfiltrated data over that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corp."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}],"actor_id":"clop"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-08","discovered_date":"2023-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb52ab08e600f3ab6b8cb8211be43b58558f169","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024.05.08%20-%20Individual%20Notice%20Template%20%28WebTPA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"05238bbbfbba","org_name":"WebTPA Employer Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589007"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024.05.08%20-%20Individual%20Notice%20Template%20%28WebTPA%29_0.pdf"}],"summary":"WebTPA reported that an unauthorized actor may have accessed or obtained personal information between April 18 and April 23, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e861b68101e328e0c7f71d27ac649dcc00491bb","impact_type":"unknown","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17230.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7c991d037bc5","org_name":"WebTPA","org_type":"professional_services","ransomware":null,"records_affected":38420,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17230.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17230.pdf"}],"summary":"WebTPA filed an update regarding a previously reported data security incident and additional notices to Washington residents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-05-08","discovered_date":"2024-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a2a8390228c670511b3f28fa3cf89f5a70938b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bodyartforms%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"37055ffabf70","org_name":"Bodyartforms LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585029"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bodyartforms%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bodyartforms%20LLC-2024-05-08"}],"summary":"Bodyartforms reported that customer payment card information entered on its website checkout page may have been captured by an unknown party.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-05-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d20ab16be293b0574aa932319105d4ae1081cb34","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Varo%20Bank%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"01d184a838bd","org_name":"Varo Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584955"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Varo%20Bank%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"}],"summary":"Varo Bank identified unusual activity involving customer accounts, where credentials were used to access a Varo account and personal and bank account information may have been accessible.","supporting_quote":"Varo believes that your credentials were used by an unauthorized third party to lo g in to your Varo account.","technology_involved":["customer portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-07","discovered_date":"2023-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aec511ae600ce3c88eeee08e38c5df9f02575c89","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20The%20May%20Institute%2C%20Inc.%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"11a0fca6931d","org_name":"The May Institute","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584961"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20The%20May%20Institute%2C%20Inc.%20-%20CA_0.pdf"}],"summary":"The May Institute reported that files containing personal and medical information may have been accessed or taken by an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c5496d9db66ffcd5ed09f8f5b82a1e796d351a9f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2707098bb1c5","org_name":"State of Maine","org_type":"unknown","ransomware":null,"records_affected":1873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#State%20of%20Maine-2024-05-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-07","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c45f89c7182643775d4d603bc76f9e407584607d","impact_type":"data_theft","incident_date":"2023-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Recology%20-%20Set%202%20-%20Adult%201%20Year%20CM.pdf"},"notes":null,"org_country":"US","org_id":"b9e0afe264bc","org_name":"Recology Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589837"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584954"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Recology%20-%20Set%202%20-%20Adult%201%20Year%20CM.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Recology%20Inc.-2024-05-07"}],"summary":"Recology discovered unusual activity on its computer network and determined that documents had been acquired from its system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"025f04733d58818ba425933ba634b7050a83d3e5","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"cd78b4f527e2","org_name":"DocGo Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1822359/000182235924000037/dcgo-20240507.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1822359/000182235924000043/ex991.htm"}],"summary":"DocGo reported that a threat actor accessed and acquired protected health information from a limited number of healthcare records in its U.S. ambulance transportation business.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-07","discovered_date":"2024-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"99baee5a3fbcba572f81049f0633d96a2ec976ac","impact_type":"both","imported_from":null,"incident_date":"2024-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"f4aff0141676","org_name":"Brandywine Realty Trust","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/790816/000119312524133132/d824906d8k.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/790816/000119312524147625/d774339d8ka.htm"}],"summary":"Brandywine Realty Trust reported unauthorized access to and encryption of portions of its corporate IT systems, with business disruptions and some files exfiltrated.","supporting_quote":null,"technology_involved":["financial and operating reporting systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-06","discovered_date":"2023-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bec22f455e067d7b99399ddf0fb31748883c4218","impact_type":"data_theft","incident_date":"2023-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20%28Adult%29%20-%20KSOJA__Static_Proof_R3_0.pdf"},"notes":null,"org_country":"US","org_id":"ea424a2a3564","org_name":"The State of Kansas Office of Judicial Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584884"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20%28Adult%29%20-%20KSOJA__Static_Proof_R3_0.pdf"}],"summary":"The State of Kansas Office of Judicial Administration reported unauthorized access to its system and that a limited number of files containing personal information were taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-03","discovered_date":"2024-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5b47b5aeca9b6c951318512d3b4d60bedadeaef","impact_type":"data_theft","incident_date":"2020-10-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Guardant%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"44a11ecf6750","org_name":"Guardant Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Guardant employee inadvertently transferred the file to a publicly accessible online platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Guardant%20-%20California%20Notification.pdf"}],"summary":"Guardant Health said an employee inadvertently made a file publicly accessible, and unidentified third parties copied it.","supporting_quote":"Guardant recently determined that a file containing certain personal information related to samples collected in late 2019 and 2020 was inadvertently made available in a publicly accessible online platform.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-05-03","discovered_date":"2024-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb4ad44920284ff8754379ecb357a21dc31ece22","impact_type":"disruption_or_ransomware","incident_date":"2024-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29015.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a0121cadafda","org_name":"Electric Mirror LLC","org_type":"unknown","ransomware":null,"records_affected":1313,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29015.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29015.pdf"}],"summary":"Electric Mirror reported that an unauthorized third party accessed its computer systems and encrypted information, and may have accessed files containing personal, financial, and health-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1657"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74c98528768bd304e8c5a18dbf5a451d1e7dd70b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CFCU_-_Adult_SSN_Proof_Redacted_33542532v1.pdf"},"notes":null,"org_country":"US","org_id":"6655af1ee71d","org_name":"Community First Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584828"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CFCU_-_Adult_SSN_Proof_Redacted_33542532v1.pdf"}],"summary":"An unauthorized third party accessed an employee’s email account, potentially viewed personal information, and attempted financial fraud that was blocked.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77357f83aec412d06ef8fd2f2cc73bc88adee1dc","impact_type":"unknown","incident_date":"2024-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sterling_Noticev2_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b06ef1edbfd","org_name":"Sterling Plumbing Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584760"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"e5712dda099d095d0a3881cd441950131d374bcd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b081cc435bd","org_name":"Medical Express Ambulance Inc.  D/B/A Medex Ambulance","org_type":"healthcare","ransomware":null,"records_affected":121190,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-05-02-medical-express-ambulance-inc-d-b-a-medex-ambulance"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f6ab79c6c7c94df9a7801f9d8e9cce6d9bdcf663","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CooperCreekPartnersManagementLLC%20(1).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"906b2e04668f","org_name":"Cooper Creek Partners, LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CooperCreekPartnersManagementLLC%20(1).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8502ce84476cbdae25a571da0e672b7459adc251","impact_type":"unknown","incident_date":"2023-02-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult_SSN_Redacted_33531808v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db1ea8a40fda","org_name":"Virginia Union University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584706"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-05-01","discovered_date":"2024-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"658fb537731ac52fded5ef499ecbe54ee0c0356d","impact_type":"both","incident_date":"2024-02-29","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28990.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"baf4649b7232","org_name":"United Seating and Mobility, L.L.C.","org_type":"healthcare","ransomware":null,"records_affected":35143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28990.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588807"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584714"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-22251%20Numotion%20Wave%204%20Adult%20CM%201yr%20Patient%20r1prf.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28990.pdf"}],"summary":"An unauthorized third party accessed United Seating and Mobility’s computer systems, encrypted some files, and may have accessed and acquired files containing protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e59599b4468110a59bffda41eedf65ae0189cfb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/UnitedSeatingandMobilityLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0dd1d7134dcd","org_name":"United Seating and Mobility, LLC","org_type":"unknown","ransomware":null,"records_affected":10627,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/UnitedSeatingandMobilityLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72da9054a137585e038bfa46f2089f56859d3b5c","impact_type":"unknown","incident_date":"2023-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Phoenix%20Business%20Consulting%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"e072e4c0a436","org_name":"Phoenix Business Consulting","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Phoenix%20Business%20Consulting%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"}],"summary":"Phoenix Business Consulting offered identity monitoring and restoration services in connection with a data event.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2024-05-01","discovered_date":"2024-04-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"d7ea57adbcd459e352a4f289f2f1c659c87121b4","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Dropbox%2C%20Inc.-%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fb5c7930c1ff","org_name":"Dropbox","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1467623/000146762324000024/dbx-20240429.htm"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Dropbox%2C%20Inc.-%20Consumer%20Notice.pdf"}],"summary":"Dropbox disclosed unauthorized access to the Dropbox Sign production environment and data related to its users.","supporting_quote":null,"technology_involved":["Dropbox Sign"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-05-01","discovered_date":"2024-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"602be828c9ffd0f3a9dc36e0592b98429156edbf","impact_type":"data_theft","incident_date":"2024-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Pensacola%20-%20Employee%20Notice-final_v2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"d31d873edac0","org_name":"City of Pensacola","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584692"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Pensacola%20-%20Employee%20Notice-final_v2_Redacted.pdf"}],"summary":"The City of Pensacola discovered unauthorized access to its network environment, and its investigation found that personal information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-30","discovered_date":"2024-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d01dc5fbc5f2f375580bb789c0987ded0ad721ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28967.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"36a7f5832d32","org_name":"Panda Restaurant Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":6916,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Panda%20Restaurant%20Group%2C%20Inc.%20%28PRG%29-2024-04-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28967.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28967.pdf"}],"summary":"Panda Restaurant Group reported that an unauthorized actor accessed personal information maintained on certain corporate systems between March 7 and 11, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ab2ec7e6ed51df33b6b0d0b5ccd544d9f2baa5c","impact_type":"unknown","incident_date":"2023-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/OEFCU-ADT-CM_02%20%5Bredacted%5D%20CALI.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4379317224a2","org_name":"OE Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584667"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28961.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0852259964a8330bf8405ded1e02e1b426b50de","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"a0c0cc4dabf6","org_name":"MovieBoxPro","org_type":"technology_saas","ransomware":null,"records_affected":6009014,"reviewed":false,"root_cause":"A vulnerability in MovieBoxPro's API allowed records to be scraped.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MovieBoxPro","type":"hibp","url":"https://haveibeenpwned.com/Breach/MovieBoxPro"}],"summary":"Records containing email addresses and usernames were scraped from MovieBoxPro through a vulnerable API.","supporting_quote":"In April 2024, over 6M records from the streaming service MovieBoxPro were scraped from a vulnerable API.","technology_involved":["API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-04-30","discovered_date":"2024-01-25","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e7f170ba55584a95adaca444a0858dc06a8512c","impact_type":"data_theft","incident_date":"2024-01-15","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28947.pdf"},"notes":null,"org_country":"US","org_id":"5f4de25bbdfb","org_name":"Continuum Global Solutions, LLC","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":"Unauthorized actors obtained Caremark member information by impersonating Continuum employees.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28947.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28947.pdf"}],"summary":"Unauthorized actors impersonated Continuum employees to obtain Caremark member information through Caremark call center applications.","supporting_quote":"We investigated and determined that the unauthorized actors obtained Information about Caremark members through Caremark call center applications by impersonating Continuum employees.","technology_involved":["Caremark call center applications"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Caremark"},"updated_at":"2026-10-12","veris_action":"social","derived":{"vendors":[{"id":"44c84694f982","name":"Caremark"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-29","discovered_date":"2023-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afe6d93c0bcb32cf5e5359980a165a24659e7ddf","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Philadelphia%20Inquirer%2C%20PBC%20-%20CA%20Exhibit%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"68edcf1e6dc6","org_name":"The Philadelphia Inquirer","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584607"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Philadelphia%20Inquirer%2C%20PBC%20-%20CA%20Exhibit%20A_0.pdf"}],"summary":"The Philadelphia Inquirer determined that an unauthorized party accessed its systems and viewed or copied files containing personal information between May 11 and May 13, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb9fb96a91a91227b9cb83652dd55386e80198a","impact_type":"unknown","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sleep%20Data%20Notice%20pdf.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90e32d095ccb","org_name":"Sleep Data Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584606"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-29","discovered_date":"2023-12-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a124218b3b2890486c54f3844730b246f761e52d","impact_type":"unknown","incident_date":"2023-12-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"143bb0b8c963","org_name":"Nations Direct Mortgage, LLC","org_type":"unknown","ransomware":null,"records_affected":83108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nations%20Direct%20Mortgage%2C%20LLC-2024-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e20dbfa46e2a390e87aa3b41caccbda631fd2342","impact_type":"unknown","incident_date":"2021-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/J.P.%20Morgan%20Privacy%20Breach%20Template.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85847079d597","org_name":"JPMorgan Chase Bank, N.A.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584615"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29152.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-29","discovered_date":"2024-04-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b3681b8d772fcc9be443d8e6b34d08bafd8d4ac9","impact_type":"unknown","incident_date":"2024-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"aaf27e029ea6","org_name":"1996 LLC","org_type":"unknown","ransomware":null,"records_affected":489,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#1996%20LLC%20dba%20Chambers%20Construction%20Co.-2024-04-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1529685117ea5d707dc7b6a0b19f33fc84d69c15","impact_type":"unknown","incident_date":"2021-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PRI-12526413%20Privacy%20Breach%20Template.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a65250f5041b","org_name":"J.P. Morgan","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584558"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#J.P.%20Morgan-2024-04-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2778e7fa4d930fa0f72a6d1444da8e2b74810884","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"df47cb91e5c4","org_name":"VF Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/103379/000119312524118163/d755724d8k.htm"}],"summary":"VF Corporation reported that its investigation of a previously disclosed cybersecurity incident had concluded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-04-26","discovered_date":"2024-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f045351d805095902f474d299b8003a948b5f4bb","impact_type":"both","imported_from":null,"incident_date":"2024-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Signature%20Healthcare%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c8b33bc41dfe","org_name":"Signature Healthcare Services LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592904"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584514"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Signature%20Healthcare%20-%20California%20Notification.pdf"}],"summary":"Signature Healthcare Services reported that an unauthorized party accessed some systems and accessed or acquired files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c87c4fde83f48e71885575ebc5239d4e82536580","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a56c909160b8","org_name":"Piping Rock","org_type":"retail_ecommerce","ransomware":null,"records_affected":2103100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Piping Rock","type":"hibp","url":"https://haveibeenpwned.com/Breach/PipingRock"}],"summary":"Data associated with Piping Rock, including email addresses, names, phone numbers, and physical addresses, was publicly posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-26","discovered_date":"2024-03-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dfd9fbaec2fd9f5d8f87ad14757713e692c23f3","impact_type":"data_theft","incident_date":"2024-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/00%20-%20Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"9c0634d4f1cb","org_name":"Lagunitas Brewing Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/00%20-%20Sample%20Individual%20Notice%20Letter.pdf"}],"summary":"Lagunitas Brewing Company reported unauthorized acquisition of personal information belonging to some employees and their beneficiaries.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1c364b8c26a23b43b495df89e3f13a2b0eb49df","impact_type":"unknown","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample_Notification_template_04-26-2024.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15865ff8805e","org_name":"Gerber Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584506"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-26","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"208260b3cfe5f2cd75cd4aac620fb72b74351574","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FBCS%20-%20CA%20AG%20Supplemental%20Notification%20Letter%28165368659.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"eb6cbc3b5d80","org_name":"Financial Business and Consumer Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595469"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588198"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588363"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588795"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588983"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589139"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584498"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585144"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586094"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FBCS%20-%20CA%20AG%20Supplemental%20Notification%20Letter%28165368659.1%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Financial%20Business%20and%20Consumer%20Solutions%2C%20Inc.-2024-04-26"}],"summary":"Financial Business and Consumer Solutions discovered unauthorized access to certain network systems, and information may have been accessed or exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-26","discovered_date":"2024-01-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ffbc790a49aa74021cb48839468d5e66d2c19a4","impact_type":"data_theft","incident_date":"2024-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB08694-DRS-letter-General_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"d2d2d56b4f31","org_name":"Designed Receivable Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587486"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588736"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584550"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB08694-DRS-letter-General_Redacted_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Designed%20Receivable%20Solutions%2C%20Inc.-2024-04-26"}],"summary":"Designed Receivable Solutions, Inc. reported that an unauthorized actor accessed and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-04-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c34600c36f3f85f9a06790566ef335644a75af0b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-02-19","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Notification%20letter-%20English%204%2023%2024%20signed.pdf"},"notes":null,"org_country":"US","org_id":"77a091dd5b0f","org_name":"Los Angeles County Department of Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees clicked a link in a phishing email while believing it was a legitimate message.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584405"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Notification%20letter-%20English%204%2023%2024%20signed.pdf"}],"summary":"Los Angeles County Department of Health Services reported that phishing emails exposed employee email accounts that may have contained personal and medical information.","supporting_quote":"Specifically, a hacker was able to gain log-in credentials of 23 DHS employees through a phishing e-mail.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-25","discovered_date":"2023-09-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a558b9c1950a35ffb9f2a3002cc4fd94906d2d41","impact_type":"data_theft","incident_date":"2023-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C_Version%201%20-%20BerryDunn%20Notification%20Letter%20Adult_3.13.24_v02%20HR%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"6c84549364f5","org_name":"Berry, Dunn, McNeil & Parker, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584457"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C_Version%201%20-%20BerryDunn%20Notification%20Letter%20Adult_3.13.24_v02%20HR%20%282%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Berry%2C%20Dunn%2C%20McNeil%20%26%20Parker%2C%20LLC-2024-04-25"}],"summary":"BerryDunn reported that an unauthorized actor accessed its managed service provider Reliable Networks of Maine’s network and took data stored on HAPG systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"Reliable Networks of Maine, LLC"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ef62af824e7c","name":"Reliable Networks of Maine, LLC"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-24","discovered_date":"2023-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"403233dc0c1b8ecc1436d5b785d1b68734f2d767","impact_type":"both","incident_date":"2023-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Camino%20Nuevo%20Charter%20Academy%20-%20CA%20Exhibit%20A_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"a26430533c01","org_name":"Camino Nuevo Charter Academy","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584360"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Camino%20Nuevo%20Charter%20Academy%20-%20CA%20Exhibit%20A_Redacted.pdf"}],"summary":"Camino Nuevo Charter Academy reported unauthorized access to certain systems, encryption of files and systems, and possible access to or download of files containing personal and financial account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5652de33ba404ee500b5a914b95d433a25a421bd","impact_type":"data_theft","incident_date":"2024-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valley%20Vet%20-%20General%20Notification%20Letter___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"ec01a9fe7a41","org_name":"Valley Veterinary Clinic, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584329"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valley%20Vet%20-%20General%20Notification%20Letter___Static_Proof_R1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Valley%20Veterinary%20Clinic%2C%20LLC-2024-04-23"}],"summary":"Valley Veterinary Clinic said payment card information and names may have been captured in connection with online transactions.","supporting_quote":null,"technology_involved":["company webpage","online payments"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-23","discovered_date":"2023-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01f54eb6c88f49bddcaba26ecf97e37ac3ddd8b1","impact_type":"data_theft","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Indivividual%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"7dbccc3fbd3b","org_name":"Transamerica Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Indivividual%20Notice%20Template.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TransamericaLifeInsuranceCompany.pdf"}],"summary":"Transamerica Life Insurance Company notified customers that their personal information may have been accessed or obtained in an incident involving WebTPA.","supporting_quote":null,"technology_involved":["WebTPA"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"WebTPA"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7c991d037bc5","name":"WebTPA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9db7f461d4efd41de642f84ab3ec3ab7ea69b23","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a57ddba14c1","org_name":"Cleveland Brothers Equipment Company","org_type":"unknown","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Cleveland%20Brothers%20Equipment%20Company-2024-04-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a0bbfe01d68a0e8b9b910534be37c86f9c382b","impact_type":"data_theft","incident_date":"2024-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08777_Biggs_NoticeAdult_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"22b432bae61a","org_name":"Biggs Cardosa Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08777_Biggs_NoticeAdult_Redacted_0.pdf"}],"summary":"Biggs Cardosa Associates reported that an unauthorized third party potentially acquired personal information during an incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0407b39640dfeb0def16de009d5b364c127c82b6","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"60706ba9d1b2","org_name":"T2","org_type":"retail_ecommerce","ransomware":null,"records_affected":94584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: T2","type":"hibp","url":"https://haveibeenpwned.com/Breach/T2"}],"summary":"Records from the T2 tea store were posted to a hacking forum, including personal information and scrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-04-19","discovered_date":"2023-08-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7efca7b0121a289f2a394dd2f110d4ee041dc27a","impact_type":"data_theft","incident_date":"2023-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VMRC%20-%20Regulatory%20Notification%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"fd6c2af821e1","org_name":"Valley Mountain Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VMRC%20-%20Regulatory%20Notification%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Valley%20Mountain%20Regional%20Center-2024-04-19"}],"summary":"Valley Mountain Regional Center reported that personal information, including names and Social Security numbers, was acquired without authorization on or about July 29, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-19","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec41fa39474bc66c2e82da29b86db0858eaf5c86","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16714.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":2384,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16714.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16714.pdf"}],"summary":"An attacker exploited vulnerabilities in Welltok's MOVEit Transfer server and exfiltrated data related to Premera Blue Cross.","supporting_quote":"our investigation determined on August 11, 2023, that an unknown actor exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Welltok, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"4d5751531773","name":"Welltok, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-19","discovered_date":"2024-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"54f68c0ce9eb87644e4911b9188ffb2312f0e432","impact_type":"unknown","incident_date":"2024-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b7eba9354921","org_name":"LMG Holdings Inc.","org_type":"unknown","ransomware":null,"records_affected":1510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LMG%20Holdings%20Inc.-2024-04-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-19","discovered_date":"2023-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82c566b8680bdd2e1f33b75c14d7672141bbf809","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Green%20Diamond%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9a1c53593fc8","org_name":"Green Diamond Resource Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584144"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Green%20Diamond%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Green%20Diamond%20Resource%20Company-2024-04-19"}],"summary":"Green Diamond Resource Company reported that an unknown actor accessed parts of its network, and personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"754310f092c97b1ded11df179476bfc4a0841aa7","impact_type":"data_theft","incident_date":"2023-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28750.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"979a925c4956","org_name":"Centennial Bank","org_type":"financial","ransomware":null,"records_affected":3044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28750.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28750.pdf"}],"summary":"An unauthorized person accessed Centennial Bank’s computer network in April 2023, and the access appears to have allowed copying of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-18","discovered_date":"2024-02-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f4132310a4cffb1f80e279ef28c23fd8d5b2f1e","impact_type":"unknown","incident_date":"2024-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff086ea6e942","org_name":"Oregon State Bar Professional Liability Fund","org_type":"unknown","ransomware":null,"records_affected":498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20State%20Bar%20Professional%20Liability%20Fund-2024-04-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"350e56112698a688b9b0b691ca8023b9ceefc63a","impact_type":"unknown","incident_date":"2024-04-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"76e9276006e1","org_name":"Le Slip Français","org_type":"unknown","ransomware":null,"records_affected":1495127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Le Slip Français","type":"hibp","url":"https://haveibeenpwned.com/Breach/LeSlipFrancais"}],"summary":"In April 2024, the French underwear maker Le Slip Français suffered a data breach . The breach included 1.5M email addresses, physical addresses, names and phone numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-18","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf53b2564aa885098a40d896a787743af9067f74","impact_type":"data_theft","imported_from":null,"incident_date":"2023-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulatory%20Notification%20Letter%20-%20CA%20-%20Kisco%20Senior%20Living_0.pdf"},"notes":null,"org_country":"US","org_id":"3714b13c0680","org_name":"Kisco Senior Living, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584127"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulatory%20Notification%20Letter%20-%20CA%20-%20Kisco%20Senior%20Living_0.pdf"}],"summary":"Kisco Senior Living reported that files may have been acquired without authorization and that personal information was present in the affected data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-17","discovered_date":"2024-04-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f2e4cf32f7f8e157ef3fb861114bcb464acdca12","impact_type":"unknown","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f392e46227c0","org_name":"Transamerica Life Insurance Company (“TLIC”)","org_type":"unknown","ransomware":null,"records_affected":168225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transamerica%20Life%20Insurance%20Company%20%28%E2%80%9CTLIC%E2%80%9D%29-2024-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a33294e18a732a8625e23dab86090af7a974588f","impact_type":"both","incident_date":"2023-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sysinformation%2C%20Inc.%20-Supplemental%20Notice%20of%20Data%20Event-Exhibit%201-CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a8fdbcb18a5e","org_name":"SysInformation Healthcare Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-594086"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584072"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sysinformation%2C%20Inc.%20-Supplemental%20Notice%20of%20Data%20Event-Exhibit%201-CA_0.pdf"}],"summary":"SysInformation reported unauthorized access and/or acquisition of files and folders that caused a network outage and may have involved individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-17","discovered_date":"2024-03-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0a6d62d65a3f920c55a7fdc160a96fdc394a50da","impact_type":"unknown","incident_date":"2024-03-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cca7acf2e30b","org_name":"Meadows Health and Wellness LLC","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Meadows%20Health%20and%20Wellness%20LLC-2024-04-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e96b8bd19f0307786b6fab2f56ad8ec61ab4c658","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BauknightPietras%26StromerPA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3246729bfb5","org_name":"Bauknight Pietras & Stromer PA","org_type":"unknown","ransomware":null,"records_affected":1138,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BauknightPietras%26StromerPA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21768495c1313a528502ed9b8efb24a457116f82","impact_type":"both","incident_date":"2023-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DES%20Architects%20%2B%20Engineers%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"697bbcff4f91","org_name":"DES Architects and Engineers","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584019"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DES%20Architects%20%2B%20Engineers%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"DES Architects and Engineers reported malicious encryption affecting its computer systems and unauthorized access during which files were downloaded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ae67ce694001b41bc5fe2d8a551e6051451517e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16689.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"564639efde2d","org_name":"Blue Cross Blue Shield Federal Employee Program","org_type":"healthcare","ransomware":null,"records_affected":4479,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16689.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16689.pdf"}],"summary":"The Federal Employee Program notified members that personal information may have been affected in a data event.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c059d6f220c6e0a4b08bc13de1f1e5d63e63534","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SampleLetterRedacted%20%28003%29.pdf"},"notes":null,"org_country":"US","org_id":"d6fbab635a5f","org_name":"Visionary Integration Professionals","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SampleLetterRedacted%20%28003%29.pdf"}],"summary":"Visionary Integration Professionals reported unauthorized access to select servers, and said personal information including Social Security numbers may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9496780386c94d20653dcf2abcc937e1a4644c2","impact_type":"data_theft","imported_from":null,"incident_date":"2024-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/i_2024.03.23-Individual%20Notification%28294807322.1%29%20DOP%20revised%28295261884.1%29_v2%20HR_r1.pdf"},"notes":null,"org_country":"US","org_id":"69566404d435","org_name":"The Roman Catholic Diocese of Phoenix","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/i_2024.03.23-Individual%20Notification%28294807322.1%29%20DOP%20revised%28295261884.1%29_v2%20HR_r1.pdf"}],"summary":"The Diocese reported that an unauthorized actor accessed files and data, including personal information, stored in its network environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-12","discovered_date":"2024-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6f5dc27de14376ca3db27bbec7ab70ba6676f878","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"a21061e5abf8","org_name":"OraSure Technologies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1116463/000119312524094797/d825009d8k.htm"}],"summary":"OraSure Technologies disclosed that an unauthorized third party accessed company data and exfiltrated certain files; the access method and the information in the files remained under investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-12","discovered_date":"2023-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9470b743b8b668e1ba200b5de89892ca103773ef","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Affected%20Individuals%20Notification%20Letter%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"505d85b3913c","org_name":"Kaiser Foundation Health Plan, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583875"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Affected%20Individuals%20Notification%20Letter%20FINAL.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kaiser%20Foundation%20Health%20Plan%2C%20Inc.-2024-04-12"}],"summary":"Kaiser Permanente determined that cookies or pixels on its websites and mobile applications may have transmitted member and patient information to Google, Microsoft Bing, and X.","supporting_quote":null,"technology_involved":["Google","Microsoft Bing","X","cookies or pixels","websites","mobile applications"],"third_party":{"archetype":null,"involved":true,"vendor":"Google, Microsoft Bing, and X"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0e9f335c7c68","name":"Google"},{"id":"fe3ebe1ecfe8","name":"Microsoft Bing"},{"id":"2bdaf367fe52","name":"X"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-12","discovered_date":"2023-09-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd2dd4a7ddd2e96fd089a43a77db302dbbdf9be2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28651.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"471973550ed1","org_name":"Goddard Systems, LLC","org_type":"unknown","ransomware":null,"records_affected":640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28651.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28651.pdf"}],"summary":"Goddard identified suspicious activity in an employee’s email account, and personal data was contained in the account, though the investigation found no evidence that an unauthorized party accessed it.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6b451d0f433a589be196ec616925c2494a6c70e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-04","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CA","org_id":"2ac3df20900c","org_name":"Giant Tiger","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Giant Tiger","type":"hibp","url":"https://haveibeenpwned.com/Breach/GiantTiger"}],"summary":"Giant Tiger reported a March 2024 breach exposing customer names, contact details and physical addresses, attributed to a vendor.","supporting_quote":"Attributed to a vendor of the retailer, the breach included physical and email addresses, names and phone numbers.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b21502215a7dfebdcd0686fcaade55c78c16ba0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cerrito_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"86ee7d7b32dd","org_name":"City of El Cerrito","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583864"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cerrito_CA%20App%20%26%20Sample_0.pdf"}],"summary":"The City of El Cerrito found unauthorized access to folders containing files with personal information between June 1 and June 7, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2024-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2cab5a309e696c047712fca174e2393fcbf92279","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28631.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87fde16aa306","org_name":"Mississippi Children's Home Services, Inc., Mississippi Chil","org_type":"unknown","ransomware":null,"records_affected":2477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28631.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-04-11","discovered_date":"2023-12-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a3c458c912b0f225cb1527515b054c893bbeb39","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HBSC%20-%20CA%20AG%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"5109a0050165","org_name":"Hapy Bear Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HBSC%20-%20CA%20AG%20Notice_0.pdf"}],"summary":"Hapy Bear Surgery Center reported unauthorized access to some files following a network disruption, and said personal and medical information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed6e6b2baa371b5997da2b2d43b70acb89d11ba6","impact_type":"data_theft","imported_from":null,"incident_date":"2024-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SV","org_id":"e7e990c6b6d0","org_name":"Salvadoran Citizens","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Salvadoran Citizens","type":"hibp","url":"https://haveibeenpwned.com/Breach/SalvadoranCitizens"}],"summary":"Data concerning Salvadoran citizens, including personal information and profile photos, was published to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20c060f5fcd6b9dd96ca523dd7a04dc2e50a6967","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"14078a7e1e29","org_name":"Kaspersky Club","org_type":"other","ransomware":null,"records_affected":55971,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kaspersky Club","type":"hibp","url":"https://haveibeenpwned.com/Breach/KasperskyClub"}],"summary":"A breach of the Kaspersky Club forum exposed email addresses, usernames, IP addresses, and password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"86e5253c5b60044aa84168185cbbe3d23129fa23","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/ESO%20Solutions%2C%20Inc.-Supplemental%20Notice-%20Data%20Security%20Incident.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a2a938588e8","org_name":"ESO Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":7965,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/ESO%20Solutions%2C%20Inc.-Supplemental%20Notice-%20Data%20Security%20Incident.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-04-09","discovered_date":"2024-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"047a6bdee88f805b8f941140a7982038d6648bea","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"bb3053e1495b","org_name":"AT&T Inc.","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583705"},{"fetched_at":null,"title":"Have I Been Pwned: AT&T","type":"hibp","url":"https://haveibeenpwned.com/Breach/AllegedATT"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AT%26TInc.pdf"}],"summary":"AT&T determined that customer information was included in a dataset released on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-08","discovered_date":"2023-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a8691f751d1ee66167ad8ee5aec30f583bc9b2b","impact_type":"both","incident_date":"2023-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-21590%20E%20Automotive%20Ad%20CM%201y%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"d0a2b6c61a15","org_name":"EBlock Corp.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583617"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-21590%20E%20Automotive%20Ad%20CM%201y%20r2prf.pdf"}],"summary":"EBlock reported unauthorized access to legacy ABS Auto Auctions infrastructure that temporarily disrupted a business unit, and said data may have been compromised.","supporting_quote":null,"technology_involved":["legacy ABS Auto Auctions infrastructure"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1addc0db097f678d03b060222547702a37cb79","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"faf78da53743","org_name":"boAt","org_type":"retail_ecommerce","ransomware":null,"records_affected":7528985,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: boAt","type":"hibp","url":"https://haveibeenpwned.com/Breach/boAt"}],"summary":"A data breach at boAt exposed customer records that were later published on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bf728c1fc1807b267b40d2d8ac10ead128c4ab8","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Santa%20Rosa_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"ab6ac4852d50","org_name":"Santa Rosa City Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583563"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Santa%20Rosa_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Santa Rosa City Schools reported unauthorized access to an employee email account that contained an individual's name.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1d565eb6270b7d94a40d03b2f9e0cb73ec75268","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GreylockMcKinnon%26Associates.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0085feadbf6","org_name":"Greylock McKinnon & Associates \"GMA\"","org_type":"unknown","ransomware":null,"records_affected":1820,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GreylockMcKinnon%26Associates.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdace6cf7b943686ff45086f1b811c7ba59a1879","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GMA%20O-CS%2012-Month%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"018d0b390c0c","org_name":"Greylock McKinnon Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587692"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GMA%20O-CS%2012-Month%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Greylock%20McKinnon%20Associates%2C%20Inc.-2024-04-05"}],"summary":"Greylock McKinnon Associates reported that personal information, including names, addresses, and Social Security numbers, may have been affected by unusual activity on its internal network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-04-05","discovered_date":"2023-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7219478eb72cb7503b48c09c0dda1865f7eb8cbc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GreenWaste%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"03d97273013c","org_name":"GreenWaste","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583537"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GreenWaste%20Templates.pdf"}],"summary":"GreenWaste identified suspicious activity and found that an unauthorized third party accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-05","discovered_date":"2024-02-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cb69624ce398eed67d60313bfd806c8ec625df2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BenefitsCal%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"70a2f17d3625","org_name":"California Statewide Automated Welfare System","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Accounts were accessed using reused passwords taken from other websites.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583547"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BenefitsCal%20Breach%20Letter.pdf"}],"summary":"Unauthorized users may have accessed BenefitsCal accounts using reused passwords, potentially exposing personal information.","supporting_quote":"On February 9, 2024, BenefitsCal discovered that someone, that was not allowed, may have logged into accounts of some users of the BenefitsCal website using reused passwords taken from other websites.","technology_involved":["BenefitsCal website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-04","discovered_date":"2023-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae8088d1a57385c52fcdf8c3a46a101784764fcf","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_3.pdf"},"notes":null,"org_country":"US","org_id":"c07493017a29","org_name":"Tri-City Healthcare District","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583497"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_3.pdf"}],"summary":"Tri-City Healthcare District reported that an unknown actor may have accessed data containing names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-04","discovered_date":"2023-09-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a916003006a636d6c1807789d6c3c40fbce75234","impact_type":"data_theft","incident_date":"2023-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20PGL%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"5272f81a9e41","org_name":"Pacific Guardian Life Insurance Company, Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583525"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20PGL%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20Guardian%20Life%20Insurance%20Company%2C%20Limited-2024-04-04"}],"summary":"Pacific Guardian Life Insurance Company reported that an unauthorized actor may have accessed or acquired data from its email environment.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-04-04","discovered_date":"2024-02-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad011ab5513f926b014a0d003d65dbeacf7b7c6e","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20to%20Members.pdf"},"notes":null,"org_country":"US","org_id":"61b92f788f25","org_name":"Dental Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583480"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20to%20Members.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28513.pdf"}],"summary":"Dental Health Services accidentally emailed member invoices and separately sent recipients the encryption password, exposing personal and premium information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2ec8da827d0158bca553ffd3915c169cabbcac0b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/OnQFinancialLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0bc996c2afc","org_name":"Q Financial, LLC","org_type":"unknown","ransomware":null,"records_affected":19974,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/OnQFinancialLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-03","discovered_date":"2024-03-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e74f149d37d149f33b027b7bb2e48814e5574617","impact_type":"unknown","incident_date":"2023-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f187b2c14da","org_name":"Campbell Killin Brittan & Ray LLC","org_type":"unknown","ransomware":null,"records_affected":4448,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Campbell%20Killin%20Brittan%20%26%20Ray%20LLC-2024-04-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf645dbf0cddb717528e10cf5493bdc577e3951d","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2ab7a7246552","org_name":"SurveyLama","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SurveyLama","type":"hibp","url":"https://haveibeenpwned.com/Breach/SurveyLama"}],"summary":"SurveyLama suffered a breach that exposed customer email addresses and other personal information, including hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4c5cf845c77cfd16e36f111a438031b90af3fdd2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SpartanburgRehabilitationInstitute.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"330991cb6a45","org_name":"Spartanburg Rehabilitation Institute","org_type":"unknown","ransomware":null,"records_affected":4335,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SpartanburgRehabilitationInstitute.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-02","discovered_date":"2024-02-20","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01a63d9295fe7afac280cdce47dcadbc98e2783b","impact_type":"data_theft","incident_date":"2024-02-21","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_7.pdf"},"notes":null,"org_country":"US","org_id":"92eef1a818ab","org_name":"On Q Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in ConnectWise ScreenConnect permitted an unknown individual to access On Q Financial's computer network.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583432"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_7.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28496.pdf"}],"summary":"On Q Financial reported that a vulnerability in ConnectWise ScreenConnect was used to access its network and exfiltrate clients’ personal information.","supporting_quote":"On March 14, 2023, the investigation determined that the ConnectWise vulnerability permitted an unknown individual to gain access to our computer network and the personal information of some of our clients was exfiltrated from our network.","technology_involved":["ConnectWise ScreenConnect"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"ConnectWise"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"9581c758c411","name":"ConnectWise"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"300726b7b551a2d0f568df59729ef99e5e0a04a6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MidlandsRegionalRehabilitationHospitalLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9547cb3d3f3","org_name":"Midlands Regional Rehabilitation Hospital, LLC","org_type":"unknown","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MidlandsRegionalRehabilitationHospitalLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6513de8f5795ff3952f2fc16af4f22d4f2d06b7f","impact_type":"unknown","incident_date":"2024-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/240328%20Data%20Breach%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9958e633fb28","org_name":"Law Offices of Bobby P. Luna","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583397"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d6c5d6c4a35eb300affb5016e3fae9297fafdc7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GreenwoodRegionalRehabilitationHospital.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25084bd48184","org_name":"Greenwood Regional Rehabilitation Hospital","org_type":"unknown","ransomware":null,"records_affected":5980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GreenwoodRegionalRehabilitationHospital.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-04-02","discovered_date":"2023-10-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5d446f6b1716dd3e808751106f82ec6fa4375a8","impact_type":"data_theft","incident_date":"2023-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MASTER%20ELN-21573%20City%20of%20Hope%202%20Ad%20CM%202y%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"026998b442ba","org_name":"City of Hope","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583421"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MASTER%20ELN-21573%20City%20of%20Hope%202%20Ad%20CM%202y%20r2prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28495.pdf"}],"summary":"City of Hope reported that an unauthorized third party accessed some systems and obtained copies of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-01","discovered_date":"2024-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d6a8435e73f57e0d51e6cf04b0a387ed0016d3d0","impact_type":"data_theft","imported_from":null,"incident_date":"2024-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28469.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2531ae5af5c3","org_name":"Rehabilitation Hospital of the Northwest","org_type":"healthcare","ransomware":null,"records_affected":728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28469.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28469.pdf"}],"summary":"Rehabilitation Hospital of the Northwest reported that an unauthorized party accessed its IT network and may have accessed or acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9080c49eb71f5d2b6b41f7e48d563ca3f637433","impact_type":"data_theft","imported_from":null,"incident_date":"2024-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared; actor name 'Sanggiero and IntelBroker' not in source; cleared","org_country":"unknown","org_id":"7d6a192d326e","org_name":"Pandabuy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pandabuy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Pandabuy"}],"summary":"Data associated with Pandabuy, including email addresses and other personal information, was posted to a hacking forum.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-01","discovered_date":"2024-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"84112503e4e863591b68f3e7469b40400f6b9af2","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28468.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2852bf2dd13b","org_name":"Northern Idaho Advanced Care Hospital","org_type":"healthcare","ransomware":null,"records_affected":2728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28468.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28468.pdf"}],"summary":"An unauthorized party accessed the hospital’s IT network and files that may have contained information about current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98b70cbcf54776cb5beba827b282d3e3d3dfc142","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Example%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5f4a169aa6c7","org_name":"HALO Branded Solutions","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583354"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Example%20Individual%20Notification.pdf"}],"summary":"A criminal threat actor accessed computer systems containing personal information in November 2023 and acquired files containing that information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b00fff8a12b45bd076f47b5de1ebe310de23728","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/George%26GeorgeAttorneysatLawLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c34c09d57e77","org_name":"George & George Attorneys at Law, LLC","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/George%26GeorgeAttorneysatLawLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-01","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"27d7831c9ba81e84c8d1884f3c61c21064d1b116","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a18d9a49822c","org_name":"Clackamas Community College","org_type":"unknown","ransomware":null,"records_affected":8797,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clackamas%20Community%20College-2024-04-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-04-01","discovered_date":"2024-03-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0747b9c50b3253b8c7aeecf10592c214dacd1731","impact_type":"unknown","incident_date":"2023-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af2579cc4450","org_name":"Aldrich Services, LLC","org_type":"unknown","ransomware":null,"records_affected":1045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aldrich%20Services%2C%20LLC%20on%20behalf%20of%20all%20operating%20affiliated%20entities-2024-04-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-04-01","discovered_date":"2023-10-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e5897b6ab375471c0e45961394b4a3d9e2bfdbb","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"0996a80adafb","org_name":"Ace Hardware Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583345"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28472.pdf"}],"summary":"Ace Hardware reported that an unauthorized actor may have accessed information on certain corporate systems, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f8fcc85d4d6b5dcd75db8c97433c95c946eee9e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"7ff8aede73df","org_name":"Washington State Food Worker Card","org_type":"government","ransomware":null,"records_affected":1594305,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Washington State Food Worker Card","type":"hibp","url":"https://haveibeenpwned.com/Breach/WashingtonStateFoodWorkerCard"}],"summary":"The Washington State Food Worker Card online training system had a data breach involving personal information from a 2018 database backup.","supporting_quote":null,"technology_involved":["online training system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-29","discovered_date":"2023-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a9a75c916b88ee82417b78d7545d35facddaa70","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TUC%20-%20Regulatory%20Notification%20Letter_CA%2810997785.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"26da339e4ac7","org_name":"The Unity Council","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583276"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TUC%20-%20Regulatory%20Notification%20Letter_CA%2810997785.1%29_0.pdf"}],"summary":"The Unity Council reported unusual activity involving certain systems and said data may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c066dec55f2605d5c896fd60e5ab031313eaf85a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SouthState%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"077b1e28b1bb","org_name":"SouthState Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SouthState%20California%20Notification.pdf"}],"summary":"SouthState Bank reported unauthorized access to folders containing files with customers’ names, financial account numbers, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-29","discovered_date":"2024-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0708bc785a0108adbf2fd8361ee6f944c8d535f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20SRH%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4365d79edb91","org_name":"Sacramento Rehabilitation Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583288"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20SRH%20Notification.pdf"}],"summary":"Sacramento Rehabilitation Hospital reported that an unauthorized party accessed its IT network and files containing information about current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d2ed79f06b14fead59913b6fb254c2ec67091b2","impact_type":"unknown","incident_date":"2023-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ridge_Individual%20Notification%20Letter%20%28US%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b40b70842e33","org_name":"Ridge Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ridge_Individual%20Notification%20Letter%20%28US%29_Redacted.pdf"}],"summary":"Ridge Vineyards filed a consumer notification letter regarding a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-29","discovered_date":"2024-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3a3d2202e7afd974accadd7bc7f5ad8741ec746","impact_type":"data_theft","incident_date":"2024-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20RHSC%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"dce13a445c15","org_name":"Rehabilitation Hospital of Southern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20RHSC%20Notification.pdf"}],"summary":"An unauthorized party accessed the organization's IT environment and accessed and/or acquired files containing information about current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-29","discovered_date":"2024-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"702dca83855de78028d2bd5dd7da58e7a38b0ed5","impact_type":"data_theft","incident_date":"2024-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20Template%20%283.29.2024%29.pdf"},"notes":null,"org_country":"US","org_id":"a3e4c815c819","org_name":"Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Prudential%20Insurance%20Company%20of%20America-2024-05-24"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20Template%20%283.29.2024%29.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/PrudentialInsuranceCompanyofAmerica.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20Template%20%283.29.2024%29.pdf"}],"summary":"Prudential reported unauthorized third-party access to company systems and the removal of some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1dfddb78a0f3cc5830e27c4d1317cdcc0e05d28a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"GB","org_id":"c5ffb283d98c","org_name":"England Cricket","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: England Cricket","type":"hibp","url":"https://haveibeenpwned.com/Breach/ECB"}],"summary":"England Cricket's icoachcricket website suffered a breach that exposed email addresses and hashed passwords.","supporting_quote":null,"technology_involved":["icoachcricket website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"674830eaf9e4a2cff10b996996d52b8e5602d4d3","impact_type":"unknown","incident_date":"2023-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Catholic%20Charities%20-%20Notice%20%28Redacted%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a46fa1c80ec6","org_name":"Catholic Charities CYO of The Archdiocese of San Francisco","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591064"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583244"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-29","discovered_date":"2024-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48235072e4c843397884dc676b049e64dca912de","impact_type":"data_theft","incident_date":"2024-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20BRH%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f45305f573bd","org_name":"Bakersfield Rehabilitation Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583285"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20BRH%20Notification.pdf"}],"summary":"Bakersfield Rehabilitation Hospital reported that an unauthorized party accessed its IT environment and accessed and/or acquired files containing information about current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"CL0P","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e4d45d23673c621ea9038b7202dacfa11fd85e6","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K0903_University%20System%20of%20Georgia_L01_SAS_013%20wtw-03282024.pdf"},"notes":null,"org_country":"US","org_id":"13440fbac84f","org_name":"University System of Georgia","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the MOVEit Secure File Transfer software allowed unauthorized access to files stored on the platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K0903_University%20System%20of%20Georgia_L01_SAS_013%20wtw-03282024.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20System%20of%20Georgia-2024-03-28"}],"summary":"A vulnerability in MOVEit Secure File Transfer allowed the CL0P cybercriminal group to access files on the University System of Georgia’s platform.","supporting_quote":"As has now been widely reported, the MOVEit ® software included a vulnerability that allowed cybercriminals unauthorized access to the files stored on the MOVEit® platform at numerous government, higher education, and corporate customer sites worldwide beginning on or about May 28, 2023.","technology_involved":["MOVEit Secure File Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}],"actor_id":"clop"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0ebdedcf0bca1f5492567307b8921aa25d9ecac","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSB_%20CA%20APP%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"13729af82c4b","org_name":"Summit State Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSB_%20CA%20APP%20%26%20Sample_0.pdf"}],"summary":"Summit State Bank confirmed unauthorized access to a single employee email account between October 16 and October 25, 2023.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"663aec9dc20f898847a583ccd4166490c4527a4d","impact_type":"unknown","incident_date":"2023-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Risas%20-%20Regulatory%20Notification%20Letter%20-%20CA%2810936492.1%29_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8967342a0a38","org_name":"Risas Dental & Braces","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583203"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dea7e72ce3af2cf7cd395ae777e246eecca322ea","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Resident%20Notification_1194-draft_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"188bacab9582","org_name":"Metropolitan Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583199"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584216"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Resident%20Notification_1194-draft_Redacted.pdf"}],"summary":"Metropolitan Life Insurance Company reported that a coding transmission error misdirected electronic dental claim information to incorrect dental providers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b655c496a161cd87507f309caeb9126c40348f02","impact_type":"unknown","imported_from":null,"incident_date":"2023-11-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hot%20Topic%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"334d136d34ba","org_name":"Hot Topic, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583177"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hot%20Topic%20Notice%20of%20Data%20Breach.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28434.pdf"}],"summary":"Hot Topic reported automated attacks using valid credentials against Hot Topic Rewards accounts, with some personal and payment-card information potentially accessible if logins were unauthorized.","supporting_quote":"Following a careful investigation, we determined that unauthorized parties launched automated attack s against our website and mobile application on November 18-19 and November 25, 2023 using valid account credentials (e.g., email addresses and passwords) obtained from an unknown third-party source.","technology_involved":["website","mobile application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acdd839c1d13ad0fe6047dd7b68282119e3c6d27","impact_type":"data_theft","imported_from":null,"incident_date":"2022-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"05d3e61b377e","org_name":"Exvagos","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Exvagos","type":"hibp","url":"https://haveibeenpwned.com/Breach/Exvagos"}],"summary":"Exvagos suffered a data breach that exposed email addresses, IP addresses, usernames, dates of birth and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d50d2f281964b0919295e85c2b1c0d70637ba58f","impact_type":"unknown","incident_date":"2023-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c9cc0fd8119","org_name":"Columbia County Child Abuse Assessment Center","org_type":"unknown","ransomware":null,"records_affected":760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20County%20Child%20Abuse%20Assessment%20Center%20dba%20The%20Amani%20Center-2024-03-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"310a0a73953af7dc0b337bad7ecebb818f48036e","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4eb383ea154b","org_name":"GSM Hosting","org_type":"technology_saas","ransomware":null,"records_affected":2607440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GSM Hosting","type":"hibp","url":"https://haveibeenpwned.com/Breach/GSMHosting"}],"summary":"Data from GSM Hosting’s vBulletin forum appeared for sale in August 2016, including email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2874e857265934dd9c8146afbef6017219745efb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3547ecc44dcc","org_name":"SwordFantasy","org_type":"other","ransomware":null,"records_affected":2690657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SwordFantasy","type":"hibp","url":"https://haveibeenpwned.com/Breach/SwordFantasy"}],"summary":"SwordFantasy suffered a data breach that exposed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-26","discovered_date":"2024-01-10","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"549f767b116dd8c7d70355dbbb90aff13180d3e4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orsini%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"cf24c43ac767","org_name":"Orsini Pharmaceutical Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583083"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orsini%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Orsini%20Pharmaceutical%20Services-2024-03-26"}],"summary":"An unauthorized party accessed one Orsini employee’s email account, where emails contained personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a261568d63ec0d9df365799dca8324d0fb0a5315","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20-%20Adult%201YR%20CM_Rev4.pdf"},"notes":null,"org_country":"US","org_id":"2def9b0153c8","org_name":"Orange County’s Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583064"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20-%20Adult%201YR%20CM_Rev4.pdf"}],"summary":"Orange County’s Credit Union reported unauthorized access to files in its file repository system that contained names, Social Security numbers, and financial account numbers, with no evidence of downloads or misuse.","supporting_quote":null,"technology_involved":["file repository system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80874355c38fe8395e90fc3612fb09f1d4783b5a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/F%2BB_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"1d0965f1fe5d","org_name":"The Law Firm of Friedman + Bartoumian","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582983"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/F%2BB_CA%20App%20%26%20Sample_0.pdf"}],"summary":"The Law Firm of Friedman + Bartoumian reported that unauthorized actors viewed and obtained files containing personal, financial, and health information from certain servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-25","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"091e590fdf9c761c79c58e5e183e3eae26e72f71","impact_type":"data_theft","incident_date":"2024-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08621_DeltaPipeline_Notice_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"6f5f1e7c2206","org_name":"Delta Pipeline, Inc.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08621_DeltaPipeline_Notice_Redacted_0.pdf"}],"summary":"Delta Pipeline reported that an unauthorized third party potentially acquired personal and medical information during an incident discovered on February 26, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-22","discovered_date":"2023-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c57fdb6cb37c152daf37103ad71cd7f39bbe72a7","impact_type":"data_theft","incident_date":"2023-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K7150_KeenanAssociates_Notice_Letter_Redacted_33370774v1.pdf"},"notes":null,"org_country":"US","org_id":"81ab08590076","org_name":"Santa Clarita Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582896"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K7150_KeenanAssociates_Notice_Letter_Redacted_33370774v1.pdf"}],"summary":"An unauthorized party accessed Keenan internal systems and obtained data that included personal and health information related to individuals associated with the district.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Keenan Associates"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"cfb4ea5f04f0","name":"Keenan Associates"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"057663dcaea82fceeea1badfabc7003dd8ce7711","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pomona%20Valley%20-%20Notification%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"f5e02fba02e3","org_name":"Pomona Valley Hospital Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582882"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pomona%20Valley%20-%20Notification%20Templates.pdf"}],"summary":"Pomona Valley Hospital Medical Center reported that an unauthorized third party accessed data in a vendor-provided patient-management tool and encrypted files.","supporting_quote":null,"technology_involved":["patient-management tool"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-22","discovered_date":"2024-03-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"04621821009a79450c03279efa02b01302833cfa","impact_type":"unknown","incident_date":"2023-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecbf37fd109d","org_name":"Oregon Taxi, Deluxe Taxi Transportation, and Direct Medical Transportation","org_type":"unknown","ransomware":null,"records_affected":1147,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Taxi%2C%20Deluxe%20Taxi%20Transportation%2C%20and%20Direct%20Medical%20Transportation-2024-03-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0946876014f81c86d0c852556fd3c14760ed80f","impact_type":"both","imported_from":null,"incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"NZ","org_id":"32830a113068","org_name":"MediaWorks","org_type":"other","ransomware":true,"records_affected":162710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MediaWorks","type":"hibp","url":"https://haveibeenpwned.com/Breach/MediaWorks"}],"summary":"MediaWorks visitor competition data was publicly posted, and some affected people later received ransom demands for its deletion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1621"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"881aa0e178a1d439a2df6ab4f5c2caba80bbfc04","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20PDR%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582905"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20PDR%20Sample.pdf"}],"summary":"An attacker accessed a Los Angeles County Department of Mental Health employee’s Microsoft Office 365 account through email exchanges with the City of Gardena Police Department, potentially accessing personal information.","supporting_quote":null,"technology_involved":["Microsoft Office 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"907e869eff6ad38f1aa9fd0f166b7cf9374d3be1","impact_type":"unknown","incident_date":"2023-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lewis_and_Clark-_Sample_Notice_Letter_-_California_33369829v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c39419744c6","org_name":"Lewis and Clark College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582901"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lewis%20and%20Clark%20College-2024-03-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"054acea50fda5bf982fb39af7a4b4f4bdd5d3342","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IATSE%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4268e9b384dd","org_name":"I.A.T.S.E. Staff Retirement and National Pension Funds","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582913"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IATSE%20-%20California%20Notification.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer and downloaded data from a server used by I.A.T.S.E. Staff Retirement and National Pension Funds.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-22","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3be427c08316d2f5a34912de22b8c90fff560bce","impact_type":"data_theft","incident_date":"2023-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20Health%20Plan%20Intermediaries%20Holdings.pdf"},"notes":null,"org_country":"US","org_id":"88039acc8bcd","org_name":"Health Plan Intermediaries Holdings","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582906"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20Health%20Plan%20Intermediaries%20Holdings.pdf"}],"summary":"Orrick detected unauthorized remote access to its network, and an investigation determined that files containing personal information were obtained.","supporting_quote":null,"technology_involved":["file share"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Orrick"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"f6aed65f8610","name":"Orrick"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-22","discovered_date":"2023-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfb237a2968729036d34d6cbb575ab05c458c5b2","impact_type":"data_theft","incident_date":"2023-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GardaWorld%20Cash%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a27672015bcf","org_name":"GardaWorld Cash U.S.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GardaWorld%20Cash%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GardaWorld%20Cash%20U.S.-2024-03-22"}],"summary":"An unauthorized actor accessed administrative files on GardaWorld Cash U.S. facility systems in Florida, and some files were copied.","supporting_quote":null,"technology_involved":["facility systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3ce4871ad741ccc5584eea1627a7e474de595ad2","impact_type":"both","incident_date":"2023-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28359.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"635cf9cde37b","org_name":"Fox Specialties Inc.","org_type":"unknown","ransomware":true,"records_affected":1601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28359.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28359.pdf"}],"summary":"Encompass discovered ransomware-encrypted systems, and an unauthorized actor removed files containing names and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-22","discovered_date":"2024-03-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2c6953932dd9d12620de9a3609b1ce26d5dc682e","impact_type":"unknown","incident_date":"2023-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cebbabea5d29","org_name":"CJ Eateries","org_type":"unknown","ransomware":null,"records_affected":879,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CJ%20Eateries-2024-03-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd50534684d91671b01571f17eee625e2edf6bfd","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Plant%20Site%20Breach%20-%20CDFA%20Employee%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"04263fd76ec0","org_name":"California Department of Food and Agriculture","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582925"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Plant%20Site%20Breach%20-%20CDFA%20Employee%20Notification.pdf"}],"summary":"A breach of the California Department of Food and Agriculture's extranet site may have exposed users' personal information and usernames and passwords.","supporting_quote":null,"technology_involved":["extranet site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-21","discovered_date":"2023-10-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b6c1ac4d57022b6204afa4226ae11f5211b2d3c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SST%20-%20Individual%20Notice%20Letter%20Template_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f7f11c33e6f0","org_name":"Simpson Strong-Tie Co. Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582877"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SST%20-%20Individual%20Notice%20Letter%20Template_Redacted.pdf"}],"summary":"Simpson Strong-Tie reported that an unknown third party accessed its information technology infrastructure and had access to data including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac262845f42c4937b1a5497f2aab803200d327c5","impact_type":"unknown","incident_date":"2023-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20-%201%20YR.pdf"},"notes":null,"org_country":"US","org_id":"941a540d476b","org_name":"Select Education Group","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20-%201%20YR.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Select%20Education%20Group-2024-03-21"}],"summary":"Select Education Group said a criminal threat actor accessed its computer systems on or around November 5, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3fc94b7f0bfec087609b3d724195dde70ce88e9","impact_type":"unknown","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MM%20Newport%20-%20Minor_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582783"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-03-21","discovered_date":"2023-07-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b135d4403ab81ce42f14d08c6dfe65daf22dfed3","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MD%20-%20Letter%20to%20Patients%20%28general%29%20-%20Redacted%20Proof%284085005.1%29.pdf"},"notes":null,"org_country":"US","org_id":"f34cbbf85ef0","org_name":"M&D Capital Premier Billing LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MD%20-%20Letter%20to%20Patients%20%28general%29%20-%20Redacted%20Proof%284085005.1%29.pdf"}],"summary":"M&D Capital Premier Billing LLC reported that an unauthorized threat actor may have accessed or acquired files containing personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-20","discovered_date":"2024-01-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa1cb75aae0814a75df24ff9cc54c8cec7180040","impact_type":"data_theft","incident_date":"2024-01-20","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Woodruff-Sawyer%20Notification%20Letter_L01.pdf"},"notes":null,"org_country":"US","org_id":"a61c431f6155","org_name":"Woodruff-Sawyer & Co.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A mobile carrier employee was convinced to transfer an executive’s phone number to another device.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587730"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582759"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Woodruff-Sawyer%20Notification%20Letter_L01.pdf"}],"summary":"Woodruff-Sawyer & Co. reported that an attacker used a SIM swap to reset an executive’s work password, access company systems, and download files containing personal information.","supporting_quote":"An unknown individual went to a mobile carrier’s retail store and successfully convinced a store employee to transfer the phone number of one of our execuƟves to another device.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-20","discovered_date":"2024-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"9be489c2b6ff3b5678b519507bbcfb6234676d0c","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"fcc2813a772e","org_name":"Radiant Logistics, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1171155/000095017024033954/rlgt-20240319.htm"}],"summary":"Radiant Logistics detected a cybersecurity incident affecting its Canadian operations, causing customer service delays while recovery efforts were underway.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a4eaa1d2677dcc3fba438949cec343c0ac20536","impact_type":"disruption_or_ransomware","incident_date":"2022-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Monmouth%20Notice%20Letter%20-%20CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"bf567cc00bfa","org_name":"Monmouth College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582774"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monmouth%20Notice%20Letter%20-%20CA%20Sample.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28330.pdf"}],"summary":"Monmouth College reported a ransomware incident that occurred between December 6 and December 14, 2022, in which personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-20","discovered_date":"2023-10-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c66f0dc6b9c50907de8c5a3ce132977a7fe0bc8","impact_type":"unknown","incident_date":"2023-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28324.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac4c905df3f0","org_name":"Axiom Construction and Consulting","org_type":"professional_services","ransomware":null,"records_affected":1127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28324.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28324.pdf"}],"summary":"Axiom Construction and Consulting reported a network incident affecting its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-03-19","discovered_date":"2021-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b05c4a6c5729df9f512d52213f3fa0b282ea3191","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Example.pdf"},"notes":null,"org_country":"US","org_id":"c998964ff205","org_name":"U.S. Vision, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582677"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Example.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#U.S.Vision%2C%20Inc.%2C-2024-03-20"}],"summary":"U.S. Vision reported that an unauthorized individual accessed its network and may have viewed or taken files containing personal, vision care, insurance, and billing information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73dac9578dbaa41d28855bcdd00f19331cdb6fcc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fiduciary_Outsourcing-_Notice_Letter_Sample_-_California_33353157v1.pdf"},"notes":null,"org_country":"US","org_id":"d6394bb73dd1","org_name":"Fiduciary Outsourcing, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day vulnerability in MOVEit Transfer was actively exploited to access data stored on the platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582685"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fiduciary_Outsourcing-_Notice_Letter_Sample_-_California_33353157v1.pdf"}],"summary":"Fiduciary Outsourcing reported that a zero-day vulnerability in MOVEit Transfer was exploited to access data stored on the platform.","supporting_quote":"On May 31, 2023, MOVEit reported a zero-day vulnerability in MOVEit Transfer that has been actively exploited by unauthorized actors to gain access to data stored on MOVEit Transfer.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8d0e942f6262e2cdad23b3aa1c60ece3544181c","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28292.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"051943a10ded","org_name":"Dial Temporary Help Service, Inc.","org_type":"professional_services","ransomware":null,"records_affected":528,"reviewed":false,"root_cause":"An administrative error caused recipients' Social Security numbers to be partially or fully visible through the envelopes containing tax forms.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dial%20Temporary%20Help%20Service%2C%20Inc.%20dba%20Employers%20Overload-2024-03-19"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28292.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28292.pdf"}],"summary":"An administrative error caused Social Security numbers on some mailed tax forms to be visible through the envelopes.","supporting_quote":"Unfortunately, due to an administrative error, the recipient's social security number may have been partially or fully visible through the envelope.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fac0ff6dd4a746e37c44c56d7754ce5d07607e4","impact_type":"unknown","incident_date":"2024-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Final_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91e294188f17","org_name":"BioLife Plasma Services, L.P.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582687"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28237.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-18","discovered_date":"2024-02-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e2d9050628cb429c7e4eb436f4e77fb41dd407a1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28287.pdf"},"notes":null,"org_country":"US","org_id":"42de32cdeef4","org_name":"V12 Software, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28287.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#V12%20Software%2C%20Inc.-2024-04-01"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28287.pdf"}],"summary":"V12 Software, Inc. filed a breach notification letter, but the available text contains placeholders rather than incident details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-18","discovered_date":"2024-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc33b050076fcb198afb8b32ec1de1948df733fe","impact_type":"both","incident_date":"2024-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%201.pdf"},"notes":null,"org_country":"US","org_id":"bf52377ce60f","org_name":"Jordano’s Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585417"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582640"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%201.pdf"}],"summary":"Jordano’s reported that an unknown actor accessed and obtained data from its network, disrupting access to certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-18","discovered_date":"2024-02-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43546eeddc98196e7d240d71049b6eaa096f4a1a","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JM%20-%20Template%20Individual%20Notice%20%28California%29.pdf"},"notes":null,"org_country":"US","org_id":"a821e816ad00","org_name":"Johnson Matthey","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A contractor inadvertently left files on a third-party storage platform, where they may have remained without access controls.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582607"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JM%20-%20Template%20Individual%20Notice%20%28California%29.pdf"}],"summary":"Johnson Matthey reported that a contractor left workforce files on a third-party storage platform without access controls, with no evidence that the files were accessed or downloaded.","supporting_quote":"The Company believes the documents may have been stored on the platform since 2020 without access controls.","technology_involved":["third-party storage platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-18","discovered_date":"2023-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4c63e1ec3c76d19a8495624f68e93275d462b7d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gresser%20Adult%20Notice%20Letter__Static_Proof_R3.pdf"},"notes":null,"org_country":"US","org_id":"15b0db3f3d36","org_name":"Gresser Inc. and Affiliates","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gresser%20Adult%20Notice%20Letter__Static_Proof_R3.pdf"}],"summary":"Gresser Inc. and Affiliates reported that an unauthorized actor may have accessed limited information maintained on its network between July 7 and July 10, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c64a036f4cd4def3712323cdc93701f791b04058","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08500_EUSD_Notice.pdf"},"notes":null,"org_country":"US","org_id":"22cbc05d8c97","org_name":"Eastside Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582657"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08500_EUSD_Notice.pdf"}],"summary":"Eastside Union School District reported unauthorized access to information that included names, dates of birth, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-18","discovered_date":"2024-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0311fb97c87657804a358d33891bfa7bf0e4d0a9","impact_type":"data_theft","incident_date":"2024-02-12","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28276.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"069cef24c768","org_name":"Bethel School District","org_type":"education","ransomware":null,"records_affected":28645,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28276.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28276.pdf"}],"summary":"An unauthorized actor accessed and took files from certain systems at Bethel School District between February 12 and 13, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-15","discovered_date":"2024-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06d1f2b70e273f878a348fbd345d0438457f94db","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20DRAFT.pdf"},"notes":null,"org_country":"US","org_id":"5d25445785db","org_name":"Eland Energy","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582524"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20DRAFT.pdf"}],"summary":"Eland Energy discovered that personally identifiable information was present on a server accessed by an unauthorized user.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88fecbe69c4f4ff242f09a54b4fe6d209cb0f197","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheBiltmoreCompanyInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec884255c533","org_name":"Biltmore Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":1028,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TheBiltmoreCompanyInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-03-14","discovered_date":"2023-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24d2cdd529743ff4055fcc0b806f68b034755775","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-21335%20NDM%20Ad%20CM%2024%20Mo%20All%20States%20r3prf%2881240583.1%29.pdf"},"notes":null,"org_country":"US","org_id":"143bb0b8c963","org_name":"Nations Direct Mortgage, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-21335%20NDM%20Ad%20CM%2024%20Mo%20All%20States%20r3prf%2881240583.1%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28178.pdf"}],"summary":"Nations Direct Mortgage reported unauthorized access to certain systems and said an unauthorized third party potentially removed data that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-13","discovered_date":"2023-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0126419e30550b2cf3273d94b5e9c163bc5a6611","impact_type":"data_theft","incident_date":"2023-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Teleflora_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"cfb648b283cf","org_name":"Teleflora","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582403"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Teleflora_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Teleflora reported that an unauthorized person accessed or acquired certain files from its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-13","discovered_date":"2024-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"721bcc1f6f82a83069eb2e9b517aa123e3c1dbc4","impact_type":"data_theft","incident_date":"2024-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PTAC_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"d618e38a77c9","org_name":"Precision Tune Auto Care","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582407"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PTAC_CA%20App%20%26%20Sample_0.pdf"}],"summary":"An unauthorized actor viewed and obtained files containing personal information from Precision Tune Auto Care's servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2024-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c60d3aca19653f6c9876e6d155f5987dcf76aa0","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8bd103689718","org_name":"ClickASnap","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ClickASnap","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClickASnap"}],"summary":"A September 2022 breach of ClickASnap exposed personal records, including email addresses, usernames, hashed passwords, and paid subscription details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c49cb6f1d87d6bbe2fd90fe29e7e0bdbd3c73d71","impact_type":"unknown","incident_date":"2024-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/240227001%20Breach%20Notice-Patient_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582371"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-12","discovered_date":"2024-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"4d9e8735e1be38198d9ad7f39b92d4359bc9dbfe","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"d79d4faaf28b","org_name":"MarineMax","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1057060/000095017024030041/hzo-20240310.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1057060/000095017024038881/hzo-20240310.htm"},{"fetched_at":null,"title":"Leak-site claim by rhysida","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TWFyaW5lTWF4QHJoeXNpZGE"}],"summary":"MarineMax reported unauthorized access to portions of its information environment, with containment measures causing some business disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["rhysida"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e89058bf143ae45a8de59c8e4bf22fdd3cf899bd","impact_type":"disruption_or_ransomware","incident_date":"2023-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notice%20Letter%20-%202024.03.12.pdf"},"notes":null,"org_country":"US","org_id":"3398e9a0364f","org_name":"Gerson Lehrman Group, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582357"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notice%20Letter%20-%202024.03.12.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gerson%20Lehrman%20Group%2C%20Inc.-2024-03-12"}],"summary":"Gerson Lehrman Group reported that a ransomware incident on November 12, 2023, involved unauthorized access to data on its computer system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2024-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67e93a20ef641d3ff7cf3e97b41b89429169d734","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"15801992b06a","org_name":"Flipkart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Misattributed Flipkart Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/Flipkart"}],"summary":"Records alleged to be from Flipkart appeared on a hacking forum, but Flipkart concluded they were not sourced from its services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ec1c2625d91248d3239dc4140d741337638fc98","impact_type":"unknown","incident_date":"2023-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCM_Health-_Letter_Version_A_-_Redacted_33906662v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec6ca7c9b4a4","org_name":"CCM Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588884"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582358"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583580"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28211.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-11","discovered_date":"2023-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7597917147fb8ae783ced58e7119c0e53fb01887","impact_type":"disruption_or_ransomware","incident_date":"2023-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stanford%20DPS%20CA%20AG%20Data%20Breach%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"d1b2d57b4c7a","org_name":"Stanford University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stanford%20DPS%20CA%20AG%20Data%20Breach%20Notification_0.pdf"}],"summary":"Stanford DPS discovered a ransomware attack in which an unauthorized individual accessed its network, and personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-11","discovered_date":"2024-01-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6525cbd7ea8cd61aa9617e3cae522ee3a401486e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-21417%20Rancho%20Health%20Ad%20No%20CM%20Patient%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"70662aa1f4fa","org_name":"Rancho Family Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582276"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-21417%20Rancho%20Health%20Ad%20No%20CM%20Patient%20r1prf.pdf"}],"summary":"A security event on KMJ Health Solutions’ server may have exposed Rancho Family Medical patients’ personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"KMJ Health Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"a3afaa591d84","name":"KMJ Health Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other","personal"],"disclosed_date":"2024-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"148f4aa589e47b28b89cb9066e3ebe642f9d6ece","impact_type":"data_theft","incident_date":"2021-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"67e714863fd7","org_name":"Misattributed Habib's Data","org_type":"unknown","ransomware":null,"records_affected":3517679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Misattributed Habib's Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/Habibs"}],"summary":"In August 2021, an allegation was made that the Brazilian fast food company \"Habib's\" had suffered a data breach that was later redistributed as part of a larger corpus of data . Upon thorough investigation, parent company Gennius concluded that the information in the breach was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"805b3ec7866935a0dc3475e4b651a832cf7c73e6","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"TW","org_id":"bdbd375abf87","org_name":"APK.TW","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: APK.TW","type":"hibp","url":"https://haveibeenpwned.com/Breach/APKTW"}],"summary":"A September 2022 breach of the Taiwanese Android forum APK.TW exposed email addresses, IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78bf37c78eb7fb98baf0309bd90abb2924418f09","impact_type":"unknown","incident_date":"2024-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/UCSDH_CA_AG_Appendix_3_8_24_Prism_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e796e311cc05","org_name":"UC San Diego Health Hillcrest - Hillcrest Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582207"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ece551b2350b3ca9c5162b5b3493f73ccf7a1265","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28188.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"46029e7ef3cc","org_name":"Spokane Valley Fire Department","org_type":"government","ransomware":null,"records_affected":575,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28188.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28188.pdf"}],"summary":"An unauthorized third party accessed the Spokane Valley Fire Department’s networks and certain files that may have contained residents’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-08","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63c106f53c973777f1e9309076d159de00900e6e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification%203-8-2024.pdf"},"notes":null,"org_country":"US","org_id":"364e92c32cf4","org_name":"Roku","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Consumers reused username/password combinations across third-party services and Roku accounts, enabling credentials obtained from unrelated third-party sources to access Roku accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582208"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%203-8-2024.pdf"}],"summary":"Unauthorized actors used credentials obtained from unrelated third-party sources to access individual Roku accounts, change login information, and attempt subscription purchases in a limited number of cases.","supporting_quote":"It appears likely that the same username/password combinations had been used as login information for such third-party services as well as certain individual Roku accounts.","technology_involved":["Roku accounts"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"chromebook breachers","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"589b451be395158d931c0ad37cb5278ad07f2abb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2024-03-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ac493d48d65e","org_name":"WoTLabs","org_type":"other","ransomware":null,"records_affected":21994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WoTLabs","type":"hibp","url":"https://haveibeenpwned.com/Breach/WoTLabs"}],"summary":"WoTLabs suffered a data breach and website defacement that exposed forum members’ personal data.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"chromebookbreachers"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-07","discovered_date":"2024-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"a64c52935ca8e68ea1445a549d3cae8de60bfeda","impact_type":"data_theft","incident_date":"2024-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17552.pdf"},"notes":null,"org_country":"US","org_id":"b1aaa7e4ea0a","org_name":"Rebound Orthopedics & Neurosurgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17552.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rebound%20Orthopedics%20%26%20Neurosurgery-2024-03-21"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-598260"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rebound%20Orthopedics%20%26%20Neurosurgery%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17552.pdf"}],"summary":"An unauthorized actor accessed Rebound Orthopedics systems and viewed or copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"094855daf511ee7769710843f5413c6e2218adc8","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"3b4f54256c3f","org_name":"Online Trade","org_type":"retail_ecommerce","ransomware":null,"records_affected":3805265,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Online Trade (Онлайн Трейд)","type":"hibp","url":"https://haveibeenpwned.com/Breach/OnlineTrade"}],"summary":"A September 2022 breach exposed customer records from Online Trade, including personal information and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-06","discovered_date":"2023-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0762af1c1b43fae983f0d0324e5426c241575f02","impact_type":"both","incident_date":"2023-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kids%20Care%20Dental%20-%20Sample%20Adult%20HIPAA%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"08749494904d","org_name":"Kids Care Dental & Orthodontics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kids%20Care%20Dental%20-%20Sample%20Adult%20HIPAA%20Individual%20Notice%20Letter.pdf"}],"summary":"Kids Care Dental & Orthodontics reported that an unknown actor accessed and obtained data from its network, disrupting access to certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc4b9896e306167eafab3aa4e156c815d87f7ff0","impact_type":"data_theft","incident_date":"2023-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"16037ddddad4","org_name":"NALS Apartment Homes LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581959"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letters.pdf"}],"summary":"NALS Apartment Homes reported unauthorized access to its network and the acquisition of certain files and folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3c2148cf9cdc13be173c9fd2115d16b5e4030803","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TalentLaunchLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f039cc40002e","org_name":"Talent Launch, LLC","org_type":"unknown","ransomware":null,"records_affected":1401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TalentLaunchLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-04","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f0ba99e1c639030f1d90a96a2d1a236e78e72ed","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Victor%20Valley%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Victor%20Valley%29_0.pdf"}],"summary":"Illuminate Education discovered unauthorized access to customer-data systems, and investigators confirmed that certain Illuminate databases were obtained without authorization.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-04","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20bd43073f413397de3a9967831099f91858b3a4","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Tracy%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581866"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Tracy%29_0.pdf"}],"summary":"Illuminate Education confirmed that unauthorized parties obtained certain Illuminate databases containing student information.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-04","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c09eb7bb72eaada927359be434ae89bb6c767bec","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Tehachapi%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581865"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Tehachapi%29_0.pdf"}],"summary":"Illuminate Education confirmed that its databases containing student information were obtained without authorization between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-04","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"728899006751fdaac23809510a3c99e3c40f0006","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Santa%20Monica-Malibu%29_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581864"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Santa%20Monica-Malibu%29_0.pdf"}],"summary":"Illuminate Education reported that Illuminate databases containing student information were obtained without authorization between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-03-04","discovered_date":"2024-02-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f614ca806ccbc346de4c097537e21e6a7e3faa6","impact_type":"data_theft","incident_date":"2022-04-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IS1801_PRVCY131_Individual%20FINAL%20Template%20of%20all%20versions.pdf"},"notes":null,"org_country":"US","org_id":"03a756774193","org_name":"Assurance IQ, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A contracted agent violated Assurance's policies by using their credentials to access agent systems and share information without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IS1801_PRVCY131_Individual%20FINAL%20Template%20of%20all%20versions.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28154.pdf"}],"summary":"A contracted agent used their credentials to access Assurance's agent systems and share customer information for unauthorized solicitation.","supporting_quote":"On February 12, 2024, we learned that an Assurance contracted agent violated our policies by inappropriately using their credentials to access our agent systems and share certain information about you for an unauthorized use.","technology_involved":["agent systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ad2450d111987cd85cfd7adb1152ec22c3cf8b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bfae4c7bc491","org_name":"Mr. Green Gaming","org_type":"other","ransomware":null,"records_affected":27123,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mr. Green Gaming","type":"hibp","url":"https://haveibeenpwned.com/Breach/MrGreenGaming"}],"summary":"Mr. Green Gaming reported that a March 2024 data breach exposed user email addresses, IP addresses, usernames, geographic locations, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03a6fb9c61e62866fae4da2640b86b4807b4fe0a","impact_type":"unknown","incident_date":"2023-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/YVR-letter-SSN_Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"284179f2f01a","org_name":"Yakima Valley Radiology PC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581800"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Yakima%20Valley%20Radiology%20PC-2024-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c7eaede1a666be7c52127dabfac06bce03ee228","impact_type":"unknown","incident_date":"2023-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Western_National_-_Notice_Letter_-_Redacted_33284896v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c10f9a581eca","org_name":"Western National Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581818"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"CLOP","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1c5cb63e5a47df10acd6710400a58382c033861","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RCI_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"55d783f97642","org_name":"RCI, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"CLOP exploited a vulnerability in MOVEit Transfer to access and obtain files from the device RCI used to operate the application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581805"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RCI_CA%20App%20%26%20Sample_0.pdf"}],"summary":"CLOP exploited a vulnerability in MOVEit Transfer to access and obtain files from RCI, LLC, including files containing government identification numbers.","supporting_quote":"The evidence showed that a group known as CLOP had identified a vulnerability in MOVEit’s Transfer software and used that vulnerability to access and obtain files from the device we used to operate the MOVEit Transfer application between May 31, 2023 , and June 1, 2023.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}],"actor_id":"clop"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-03-01","discovered_date":"2023-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"671718e17d32ee3c0333432aa1bc736be8277f3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28133.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"257fe4f64eb1","org_name":"Pacific Cataract and Laser Institute","org_type":"healthcare","ransomware":null,"records_affected":6587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20Cataract%20and%20Laser%20Institute%2C%20Inc.%2C%20P.C.-2024-03-01"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28133.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28133.pdf"}],"summary":"Pacific Cataract and Laser Institute identified unauthorized access to systems containing files with personal and protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c90f906e47906e5086a57c1a1e596ea5e20bf9d9","impact_type":"data_theft","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Update%20to%20March%20Filing%20For%20InfoSys%20McCamish%20Security%20Incident%20-%20%20CA%20Notification%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7d93830795ef","org_name":"Fidelity Investments Life Insurance Company and Empire Fidelity Investments Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-588922"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581779"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582636"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Update%20to%20March%20Filing%20For%20InfoSys%20McCamish%20Security%20Incident%20-%20%20CA%20Notification%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized third party accessed IMS systems and obtained data that included information about customers of Fidelity Investments Life Insurance Company and Empire Fidelity Investments Life Insurance Company.","supporting_quote":null,"technology_involved":["IMS systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IMS"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3cff0e6a2220","name":"IMS"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"73801ab38965db865c5b96c194e86ce8d99e8ef7","impact_type":"data_theft","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28134.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5b5aa25e298d","org_name":"Fidelity Investments Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":768,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28134.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28134.pdf"}],"summary":"An unauthorized third party accessed IMS systems and obtained data stored there, including information about Fidelity Investments Life Insurance Company customers.","supporting_quote":null,"technology_involved":["IMS systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IMS"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3cff0e6a2220","name":"IMS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-03-01","discovered_date":"2023-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b1190790c57272de8c4b35b36315b1ef8e92787","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Elemetal%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"266cd82ae74f","org_name":"Elemetal, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Elemetal%20-%20CA_0.pdf"}],"summary":"Elemetal discovered suspicious activity on its computer network and determined that an unauthorized actor may have accessed or acquired data on its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec8ca3aebef7b4f058bd8ee708c3aafe13aa2700","impact_type":"unknown","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TalentLaunch-_Notice_Letter_Sample_CA_33281948v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a5930c408cc6","org_name":"Alliance Solutions Group, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581806"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alliance%20Solutions%20Group%2C%20LLC%20%28dba%20TalentLaunch%29-2024-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5b181dcb1128ca965517a4b24b648f4292d1b6bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TAGUrgentCareSupportServicesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a4213fee8be","org_name":"TAG Urgent Care Support Services LLC","org_type":"unknown","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TAG%20Urgent%20Care%20Support%20Services%20LLC-2024-02-29"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/TAGUrgentCareSupportServicesLLC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28116.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"72be3f891b1a01c816614f181ac218664a538ea5","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28125.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e25fe662712","org_name":"Renton School District","org_type":"education","ransomware":null,"records_affected":18891,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28125.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28125.pdf"}],"summary":"Renton School District reported that information on its systems may have been accessed or taken without authorization during a cyberattack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b8ce42f73f4e4ad65269de3f1a062d8dbac25c1","impact_type":"unknown","incident_date":"2023-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Procopio%20California%20Notice%20Letter_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d3735db76949","org_name":"Procopio, Cory, Hargreaves & Savitch LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581771"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77f793738cef24387a7dcf14e0b42525e05e7808","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f06d87865f5","org_name":"Medical Management Resource Group, L.L.C., d.b.a. American Vision Partners (“MMRG”)","org_type":"unknown","ransomware":null,"records_affected":2264157,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medical%20Management%20Resource%20Group%2C%20L.L.C.%2C%20d.b.a.%20American%20Vision%20Partners%20%28%E2%80%9CMMRG%E2%80%9D%29-2024-02-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a3daf4f44776904d48223e01d5e87757dff0d64","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-10-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28127.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c2db023ba353","org_name":"Fred Hutchinson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":14898,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28127.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28127.pdf"}],"summary":"A Fred Hutch provider lost a personal laptop containing access to their Fred Hutch email, and the organization reported no evidence that information had been accessed.","supporting_quote":"On October 27, 2023, we learned that a Fred Hutch provider lost their personal laptop while traveling.","technology_involved":["personal laptop","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"648df6c5face9bdbfb602c88ae471f581d7f2c1c","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Baesman%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"225c3fefd754","org_name":"Baesman Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Baesman%20Group%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baesman%20Group%2C%20Inc.-2024-02-29"}],"summary":"Baesman Group, Inc. filed a data-event notice, but the provided excerpt does not describe what happened or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-02-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"098ab7d03ff1465ff3cd824612aefd49e2715c65","impact_type":"data_theft","imported_from":null,"incident_date":"2023-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Employee%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"b6e9126eb436","org_name":"American Vision Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Employee%20Sample.pdf"}],"summary":"American Vision Partners reported that an unauthorized party obtained employee personal information after unauthorized activity was detected on November 14, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-28","discovered_date":"2023-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1229ab753b5292241d559270a0c4cbc59ee1a28a","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA%20%281%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"4d5751531773","org_name":"Welltok","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581671"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA%20%281%29_Redacted.pdf"}],"summary":"An unknown actor exploited vulnerabilities in Welltok's MOVEit Transfer server and exfiltrated data.","supporting_quote":null,"technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14d1e528b09d187cb8ca049de1d56882fd7bd6bc","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"6c9e1f88a884","org_name":"Tangerine","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tangerine","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tangerine"}],"summary":"A breach of Tangerine exposed customer records, including personal information and bcrypt password hashes, from a legacy customer database.","supporting_quote":null,"technology_involved":["legacy customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59e8b10e297709afefa3c19ebde88c2d736713c3","impact_type":"unknown","incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult_SSN_Proof_Redacted_33272706v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fea3a4ebd72f","org_name":"Institute of Food Technologists","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581655"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"652d4b017a4d8da57e19ad6b033dd3963c017a95","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Houser%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"c5fb68bed485","org_name":"Houser LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581661"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583097"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583890"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Houser%20LLP%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Houser%20LLP-2024-02-28"}],"summary":"Houser LLP notified affected people that their name was present in potentially affected files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-28","discovered_date":"2024-02-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7408823f1a29f04d513486f32580d4df005442af","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISO02321%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"2662d20d3889","org_name":"Department of State Hospitals","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISO02321%20Breach%20Letter.pdf"}],"summary":"The Department of State Hospitals reported that Leave and Activity Balance reports containing names and Social Security numbers were disseminated to staff at DSH-A.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70631f09f9389cd84acbf75128ca057ca441e0f7","impact_type":"data_theft","imported_from":null,"incident_date":"2024-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b1e4cf14ff54","org_name":"Cutout.Pro","org_type":"technology_saas","ransomware":null,"records_affected":19972829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cutout.Pro","type":"hibp","url":"https://haveibeenpwned.com/Breach/CutoutPro"}],"summary":"Cutout.Pro suffered a data breach that exposed email and IP addresses, names, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["Cutout.Pro"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2024-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a079dbaa3e423aec528b68312d3084ff550f51e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/AspenDentalManagementInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c657fa232fb9","org_name":"Aspen Dental Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":904,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aspen%20Dental%20Management%2C%20Inc.-2024-02-28"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/AspenDentalManagementInc.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28094.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-28","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7004bd8e23a1072cb7a57f6fcb77c52493c233c7","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16516.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"38c4bb072ade","org_name":"Aetna ACE","org_type":"healthcare","ransomware":null,"records_affected":2653,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16516.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16516.pdf"}],"summary":"An unknown actor exploited vulnerabilities in the MOVEit Transfer server and exfiltrated data relating to Aetna ACE members.","supporting_quote":"On July 26, 2023, we were alerted to an earlier alleged compromise of our MOVEit Transfer server in connection with software vulnerabilities made public by the developer of the MOVEit Transfer tool.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfea567e0863d97610b0d29242435803cc395219","impact_type":"unknown","incident_date":"2023-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Rio%20Hondo%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c86c34d3549b","org_name":"Rio Hondo Community College District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581591"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"6155a9c879ef7ed4657d4a5438ce61442b977e5b","impact_type":"data_theft","imported_from":null,"incident_date":"2024-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"aca68a715625","org_name":"loanDepot","org_type":"financial","ransomware":null,"records_affected":16900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000020/ldi-20240104.htm"},{"fetched_at":null,"title":"8-K EX-99.2","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000059/a4q23investorpresentatio.htm"},{"fetched_at":null,"title":"8-K EX-99.1","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000059/a2023q4formearningsrelease.htm"},{"fetched_at":null,"title":"Leak-site claim by alphv","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/TG9hbkRlcG90QGFscGh2"}],"summary":"loanDepot reported that a cybersecurity incident affected sensitive personal information of up to approximately 16.9 million individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["alphv"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-27","discovered_date":"2024-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"63d459e7bdcce5bd63c5cb2c3da08c94ce173e56","impact_type":"disruption_or_ransomware","incident_date":"2024-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"3b2d8c6cbd91","org_name":"Encompass Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/785161/000078516124000006/ehc-20240227.htm"}],"summary":"Encompass Health reported that a cybersecurity incident at Change Healthcare affected its payment-claims submission service, while it had found no compromise or unauthorized access to its own systems.","supporting_quote":null,"technology_involved":["Change Healthcare"],"third_party":{"archetype":null,"involved":true,"vendor":"Change Healthcare"},"veris_action":"unknown","derived":{"vendors":[{"id":"24c248d398d4","name":"Change Healthcare"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9525f9fc4d92041c88d52e9762bbdd5083a32805","impact_type":"data_theft","incident_date":"2023-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UNITE%20HERE%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"17e86d06a675","org_name":"UNITE HERE","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581456"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UNITE%20HERE%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UNITE%20HERE-2024-02-23"}],"summary":"UNITE HERE reported unauthorized access to systems containing personal information, and said files may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-02-23","discovered_date":"2023-09-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3aefc155155e15907039cd5500d7f2f53f7b3058","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NewGen%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"a3ac293d149c","org_name":"NewGen Administrative Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581462"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NewGen%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"NewGen reported potential unauthorized access to data stored on servers hosted by an unnamed managed services provider.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-02-23","discovered_date":"2023-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7ff43ddd68aea1f4a4819bb279d6d97ffb07207","impact_type":"both","incident_date":"2023-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/medQ%20Adult%2012-Month.pdf"},"notes":null,"org_country":"US","org_id":"d641959d74c2","org_name":"medQ, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586082"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581459"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/medQ%20Adult%2012-Month.pdf"}],"summary":"An unauthorized actor encrypted files on servers used by the medQ Platform and copied some files from the platform.","supporting_quote":null,"technology_involved":["medQ Platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-02-23","discovered_date":"2024-01-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8697cc7217e11b13dcf81a33b08d5fe80ea5c779","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K7315_LOANDEPOT.COM%20LLC_L01_SAS_2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"fadd8805aa7d","org_name":"loanDepot.com, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581431"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K7315_LOANDEPOT.COM%20LLC_L01_SAS_2_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27956.pdf"}],"summary":"An unauthorized third party accessed loanDepot systems containing sensitive personal information between January 3 and January 5, 2024.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcdc6b8a89aa2eeb9c7200f9993aea6ccb657c4c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82AAE7E2-43DE-49C4-86F7-E530242C8B54"},"incident_date":"2024-02-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e52f5a9f464e","org_name":"Epic Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaaguide.net/healthcare-providers-sued-unauthorized-access-nude-images/"}],"summary":"\"A class action lawsuit has been filed against the University of Kansas Health System, Lawrence Memorial Hospital in Kansas, and Epic Systems by two women who had their nude images and sensitive health information accessed by a physical therapist without authorization when there ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f17dd5298bd41e70213e0848627ec7be5c0d5270","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28041.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bad30ebba8d6","org_name":"CVS Caremark Part D Services, L.L.C.","org_type":"healthcare","ransomware":null,"records_affected":2193,"reviewed":false,"root_cause":"Human error caused the mailing process not to be followed properly by equipment operators.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28041.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28041.pdf"}],"summary":"CVS Caremark Part D Services reported that a mailing-process error may have exposed personal and health information.","supporting_quote":"The mailing process was not followed properly by our equipment operators.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2024-02-23","discovered_date":"2023-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"020d8cac1dc77817e7e9a33e9e97e8fbb83aee71","impact_type":"disruption_or_ransomware","incident_date":"2023-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_L4035_CROSSROADS_EQUIPMENT_LEASE%26FINANCE_%232_L01_SAS_2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"317b58b4e71e","org_name":"Crossroads Equipment Lease & Finance, LLC","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586359"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581427"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_L4035_CROSSROADS_EQUIPMENT_LEASE%26FINANCE_%232_L01_SAS_2_Redacted.pdf"}],"summary":"Crossroads reported that a ransomware attack encrypted its computer systems and that personal information present in accessed systems may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2024-02-22","discovered_date":"2023-12-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9ce3b3cb1710f1b9b59db65527b4a3366c36e47","impact_type":"data_theft","imported_from":null,"incident_date":"2023-07-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/U-Haul%20-%20California%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"b132592a029a","org_name":"U-Haul International, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/U-Haul%20-%20California%20Notification_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#U-Haul%20International%2C%20Inc.-2024-02-22"}],"summary":"An unauthorized party used legitimate credentials to access U-Haul’s customer reservation and records system and access customer records containing personal information.","supporting_quote":"U-Haul learned on December 5, 2023, that legitimate credentials were used by an unauthorized party to access a system U-Haul Dealers and Team Members use to track customer reservations and view customer records.","technology_involved":["customer reservation and records system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2024-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68d0375e21e0f578356ef011c1bbba1180714f91","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_Data_Breach%20Notification_Letters_SAFE%20Credit%20Union_February%202024.pdf"},"notes":null,"org_country":"US","org_id":"56b0f1d23116","org_name":"SAFE Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581347"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_Data_Breach%20Notification_Letters_SAFE%20Credit%20Union_February%202024.pdf"}],"summary":"SAFE Credit Union reported that debit card information may have been exposed during ATM transactions from January 28 through February 4, 2024.","supporting_quote":null,"technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81da70a002acc2a066452b79502f8de55e0d9df9","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Attachment%20A%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6a0f11730e60","org_name":"Insomniac Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581402"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Attachment%20A%20-%20Sample%20Notice.pdf"}],"summary":"Insomniac Games reported that an unauthorized actor accessed some IT systems and downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5639701080ce31765365d8f2ba0b0c46536eba91","impact_type":"data_theft","imported_from":null,"incident_date":"2023-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b29ae2eca774","org_name":"Facebook Marketplace","org_type":"technology_saas","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Facebook Marketplace","type":"hibp","url":"https://haveibeenpwned.com/Breach/FacebookMarketplace"}],"summary":"Records associated with Facebook Marketplace were allegedly obtained from a Meta contractor and posted to a hacking forum.","supporting_quote":null,"technology_involved":["Facebook Marketplace"],"third_party":{"archetype":null,"involved":true,"vendor":"Meta contractor"},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2024-02-22","discovered_date":"2023-11-13","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ff85df37e83eae4fa31e27349184088844c90ad","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Air%20Methods%20-%20California%20Notification_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"40441e11813f","org_name":"Air Methods","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581389"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Air%20Methods%20-%20California%20Notification_Redacted.pdf"}],"summary":"A laptop containing files that may have included patient information was stolen from an Air Methods billing office.","supporting_quote":"On November 9, 2023, an Air Methods billing office was broken into, and a laptop was stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-21","discovered_date":"2023-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e35162c81bd4c2f62e804496feaedf5cc2ead706","impact_type":"data_theft","incident_date":"2023-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EdisonLearning%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"41075519220f","org_name":"EdisonLearning, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581305"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EdisonLearning%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"EdisonLearning reported that an unauthorized actor accessed computer systems and downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-21","discovered_date":"2023-12-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"907212ddc29457d0ad6c10c6b280f924cd296142","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Davlyn%20-%20Regulator%20Notice_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"703f921bdf54","org_name":"Davlyn Investments","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581276"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Davlyn%20-%20Regulator%20Notice_CA_0.pdf"}],"summary":"Davlyn Investments reported that information including names and Social Security numbers may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a51b1495cd606e8fa21f58d41441220f5ca0fb8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/UniversityofSouthCarolinaSalkehatchie.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ed55cc0b408","org_name":"University of South Carolina Salkehatchie","org_type":"unknown","ransomware":null,"records_affected":2413,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/UniversityofSouthCarolinaSalkehatchie.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e0c5034f16d49b182ea6410c8d130ad07e9e413","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/LexingtonHealthInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5fe51201717","org_name":"Lexington Health, Inc.","org_type":"unknown","ransomware":null,"records_affected":1942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/LexingtonHealthInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-16","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"787459ffd0d20e0be709ad43fba42cc77a4df472","impact_type":"both","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Draft%20Template%20IMS%20Supplemental%20Individual%20Notification%20Letter%20-%206.27.24.pdf"},"notes":null,"org_country":"US","org_id":"febd9fe6509d","org_name":"The Northwestern Mutual Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587635"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581102"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581699"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Draft%20Template%20IMS%20Supplemental%20Individual%20Notification%20Letter%20-%206.27.24.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Northwestern%20Mutual%20Life%20Insurance%20Company-2024-02-29"}],"summary":"IMS reported that ransomware encrypted certain systems and that personal information was subject to unauthorized access and acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efa70b275b936dccc2a25aed399107a7c941780f","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Golden%20Corral%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9f9141005c88","org_name":"Golden Corral Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Golden%20Corral%20Corporation%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/GoldenCorralCorporation.pdf"}],"summary":"Golden Corral reported that an unauthorized actor accessed its systems and acquired data, temporarily disrupting corporate operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-16","discovered_date":"2023-10-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89da54991006a14e8303d8753196e8f1189583d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-05","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CUSO%20Financial%20Services%2C%20LP%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"639008ae285d","org_name":"CUSO Financial Services, LP","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Barracuda Networks' email application allowed unauthorized access to historical emails and attachments.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CUSO%20Financial%20Services%2C%20LP%20-%20Exhibit%20A.pdf"}],"summary":"A vulnerability in Barracuda Networks' email application allowed unauthorized access to CUSO Financial Services data in historical emails and attachments.","supporting_quote":"Specifically, an email application, Barracuda Networks, had a vulnerability that allowed an unauthorized party to gain access to historical emails and attachments.","technology_involved":["Barracuda Networks","email application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Barracuda Networks"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5f900759f395","name":"Barracuda Networks"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c6c7a9a20f78e92a82a54952e4ace76415bb1501","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27940.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d71090d00b59","org_name":"Webber Chiropractic Sports Clinic, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27940.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27940.pdf"}],"summary":"Webber Chiropractic Sports Clinic detected an incident in which someone outside the organization temporarily accessed its network environment, potentially exposing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c80a4f39628c80b0a72a9b003eae6ceae110f330","impact_type":"disruption_or_ransomware","incident_date":"2022-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20VFB%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9c7b83c0c86b","org_name":"Virginia Farm Bureau","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581089"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20VFB%20-%20CA_0.pdf"}],"summary":"Virginia Farm Bureau reported that an unknown actor accessed some systems and that certain files may have been viewed or downloaded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-15","discovered_date":"2023-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46161f28f92d9bbaf2156d695c1909fd1f99f22d","impact_type":"data_theft","incident_date":"2023-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulatory%20Notification%20Letter%20-%20CA%20-%20Superior%20Communications%2C%20Inc._0.pdf"},"notes":null,"org_country":"US","org_id":"08e19ab576c4","org_name":"Superior Communications, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581048"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulatory%20Notification%20Letter%20-%20CA%20-%20Superior%20Communications%2C%20Inc._0.pdf"}],"summary":"Superior Communications reported that files may have been acquired without authorization around July 9, 2023, and that personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab9fa0fd56d06b5de3bfd8063c7d16579bffcca7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/CGMInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b193ea44bfc8","org_name":"CGM, Inc.","org_type":"unknown","ransomware":null,"records_affected":1412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/CGMInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d79d30eeef5c0647c269ba3b39026062338d01a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BankofAmericaNA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"146437a4a012","org_name":"Bank of America, N.A.","org_type":"unknown","ransomware":null,"records_affected":1039,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BankofAmericaNA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2024-02-13","discovered_date":"2024-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"2c21ec430790440539d12023515a99256891c665","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"actor name 'ALPHV' not in source; cleared","org_country":"US","org_id":"27261d9e2341","org_name":"Prudential Financial","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1137774/000119312524033753/d770643d8k.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1137774/000119312524040749/d766318d8ka.htm"},{"fetched_at":null,"title":"Leak-site claim by alphv","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/UHJ1ZGVudGlhbCBGaW5hbmNpYWxAYWxwaHY"}],"summary":"Prudential Financial reported unauthorized access to certain systems beginning February 4, 2024, and said a threat actor accessed company administrative and user data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"claim_groups":["alphv"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a0d121b3b5322b88d446840165bee0a50e05ac6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Navvis%26CompanyLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e1e93606507","org_name":"Navvis & Company, LLC","org_type":"unknown","ransomware":null,"records_affected":2090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Navvis%26CompanyLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4be240529b46c3cc221464b33641ea9662487af7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BankersLifeandCasualtyCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71fa23a54b36","org_name":"Bankers Life and Casuality","org_type":"unknown","ransomware":null,"records_affected":1134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/BankersLifeandCasualtyCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16ea70b77901d0e5316ccdd0c25df0aa2395b00d","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20VIMARC_Baesman%202.7.2024%20DRAFT%20Template.pdf"},"notes":null,"org_country":"US","org_id":"ed5500f4b08d","org_name":"Anthem Insurance Companies, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580879"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20VIMARC_Baesman%202.7.2024%20DRAFT%20Template.pdf"}],"summary":"An unknown actor accessed Anthem Insurance Companies’ MOVEit Transfer server and took data that included personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-09","discovered_date":"2024-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"b288a8c48e70a0df36b365c89c7799fd8983b7fc","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2024-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"8fa7286522ce","org_name":"Willis Lease Finance Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1018164/000101816424000005/wlfc-20240209.htm"}],"summary":"Willis Lease Finance Corporation detected unauthorized activity on portions of its IT systems and took certain systems offline while investigating and responding.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73a6b57684614604d83f9837c96183f5c122955b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-07-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TUIC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e20821c00f0d","org_name":"Trinity Universal Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580830"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TUIC%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trinity%20Universal%20Insurance%20Company-2024-02-09"}],"summary":"Trinity Universal Insurance Company reported that backup tapes went missing while its office was being moved, potentially exposing personal information.","supporting_quote":"These backup tapes were contained in a padlocked case (“lockbox”) and went missing sometime between July 7, 2023 and July 10, 2023.","technology_involved":["backup tapes"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-09","discovered_date":"2024-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"11dedf1d1d3f0b6b50d35bff238c1ed706397939","impact_type":"unknown","imported_from":null,"incident_date":"2024-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"6289f71e120e","org_name":"SouthState Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/764038/000155837024004390/ssb-20240206x8ka.htm"},{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/764038/000095010324002017/dp206600_8k.htm"}],"summary":"SouthState Bank, N.A. detected a cybersecurity incident that affected certain business processes, and personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"LockBit","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-02-09","discovered_date":"2023-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3f53226dbc26db8829dbfb6c86fe5eb806f3878","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K7176_Planet%20Home%20Lending_L01_SAS_1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"928dddeb251f","org_name":"Planet Home Lending","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability known as Citrix Bleed in software Planet purchased from Citrix was exploited to gain unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580833"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K7176_Planet%20Home%20Lending_L01_SAS_1_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16278.pdf"}],"summary":"Planet Home Lending reported that LockBit exploited the Citrix Bleed vulnerability and accessed a folder containing copies of customer loan files.","supporting_quote":"While Planet had implemented multiple layers of security tools designed to prevent this type of unauthorized access, the threat actor was able to exploit this Citrix Bleed vulnerability to bypass these protections.","technology_involved":["Citrix Systems, Inc."],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Citrix Systems, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"6ff730cf6d53","name":"Citrix"}],"actor_id":"lockbit"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-02-09","discovered_date":"2023-02-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50a8fe7baf8e7461d254522a29db11b0f39e6f91","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27878.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f6cd75cc17ab","org_name":"International Center of Photography","org_type":"nonprofit","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27878.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27878.pdf"}],"summary":"The International Center of Photography reported unauthorized network access, during which files containing personal and financial information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-02-08","discovered_date":"2023-11-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7c2c41f7283d40fce33a6686e4845b9a5eb62e6","impact_type":"data_theft","incident_date":"2023-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SinglePoint%20-%20HRO%20Adult%20Notice%20Letter%20v9.pdf"},"notes":null,"org_country":"US","org_id":"dfb62afccca3","org_name":"SinglePoint Outsourcing, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583096"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583904"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580740"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SinglePoint%20-%20HRO%20Adult%20Notice%20Letter%20v9.pdf"}],"summary":"An unauthorized individual acquired files containing personal information and potentially bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2024-02-08","discovered_date":"2024-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"630cebe0b8f745b2fdb17daca471765244096a0c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-21120%20MFLEX%20Ad%20Letter%201%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"6d6496bfa05e","org_name":"Multi-Fineline Electronix, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-21120%20MFLEX%20Ad%20Letter%201%20CA%20r1prf.pdf"}],"summary":"Multi-Fineline Electronix reported that a compromise exposed personal information between approximately December 1, 2022, and January 2, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf01dfd3e82603911b463c8c0e10ae826e337c0a","impact_type":"unknown","incident_date":"2023-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CT_College_-_AG_Notification_-_California_%28Wave_1_-_Final%29_33204492v1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ece867b5f6aa","org_name":"Connecticut College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580737"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"91cc9dcdbbd8abce0829f35f18b634366fbb126b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/CityofClemsonSouthCarolina.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6eb740f901ed","org_name":"City of Clemson, SC","org_type":"unknown","ransomware":null,"records_affected":20255,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/CityofClemsonSouthCarolina.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d8667863b702334577fde1a8ba2102bc8aaae2e","impact_type":"data_theft","incident_date":"2023-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HealthEC%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"5ceee209431f","org_name":"U.S. Renal Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580670"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HealthEC%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"}],"summary":"HealthEC reported that an unknown actor accessed certain systems and copied files containing information relating to U.S. Renal Care clients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"HealthEC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"1474bcdeae14","name":"HealthEC"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-07","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"19aa733b661f4a3843a89258afe8bf699f7ca8ef","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27852.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c07861c5319c","org_name":"Lineage, Inc","org_type":"financial","ransomware":null,"records_affected":844,"reviewed":false,"root_cause":"Unauthorized actors exploited a vulnerability in the MOVEit file transfer software application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27852.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27852.pdf"}],"summary":"Unauthorized actors exploited a vulnerability in MOVEit Transfer and accessed and acquired Company information.","supporting_quote":"On June 1, 2023, the Company learned unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"78eaca0801df366d52ccfa31a220c9cf9399fc68","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/HealixInfusionherapyLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb75ccd445b7","org_name":"Healix Infusion Therapy, LLC","org_type":"unknown","ransomware":null,"records_affected":1463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/HealixInfusionherapyLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-07","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caf882ca60928f088a5a0d860eea3feec79cdeda","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Delta%20Dental%20of%20California%20and%20affiliates_Adult.pdf"},"notes":null,"org_country":"US","org_id":"7254a8a0bbd0","org_name":"Delta Dental of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized actors exploited a vulnerability in the MOVEit file-transfer software application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580628"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Delta%20Dental%20of%20California%20and%20affiliates_Adult.pdf"}],"summary":"Delta Dental of California reported that unauthorized actors exploited a vulnerability in MOVEit and accessed and acquired company information.","supporting_quote":"On June 1, 2023, the Company learned unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","technology_involved":["Progress Software MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef8f5c2d06960791b32125a4d1614e7cbf59cd65","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27847.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61c8301f0f3f","org_name":"Medical Management Resource Group, L.L.C.","org_type":"unknown","ransomware":null,"records_affected":4482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27847.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"823ddee636943872868708bf5940ecf8ef88dc47","impact_type":"data_theft","incident_date":"2023-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/INTEGRIS%20Health%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"519255a0b4f2","org_name":"INTEGRIS Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583081"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580600"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581803"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/INTEGRIS%20Health%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27839.pdf"}],"summary":"An unauthorized party accessed files containing INTEGRIS Health patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-02-06","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fed3680144ead8421c1abc7f3bfed5ddb44e2d5f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-25","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27830.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"54534b845fde","org_name":"Employment Security Department of Washington State","org_type":"government","ransomware":null,"records_affected":519,"reviewed":false,"root_cause":"Individuals entered their login credentials on spoofed websites and may have provided them to unauthorized individuals.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27830.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27830.pdf"}],"summary":"Individuals who entered credentials on spoofed Secure Access Washington websites may have had information in their Employment Security Department accounts viewed by an unauthorized individual.","supporting_quote":"As a result, between October 25, 2023, to November 20, 2023 , individuals who entered their login credentials on one of these spoofed websites may have unknowingly provided their SAW login c redentials to unauthorized individuals.","technology_involved":["Secure Access Washington (SAW)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2024-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ebe97665517502bcd0505b12cff23f85fe0b8604","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5245efb47a99","org_name":"Bradford Health Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":28543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"HHS OCR breach report","type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf#2024-02-06-bradford-health-services-llc"}],"summary":null,"supporting_quote":null,"technology_involved":["Network Server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25788518d3e082e49629945e05801b38348d5bcc","impact_type":"unknown","incident_date":"2023-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample_Mailing_Verizon.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95c0db5db205","org_name":"Verizon Communications Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580549"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Verizon%20Communications%20Inc.-2024-02-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2024-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5df154bc314c0b4aca0471f94d663efb7730ccdc","impact_type":"data_theft","imported_from":null,"incident_date":"2024-01-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9d4333e95103","org_name":"Spoutible","org_type":"technology_saas","ransomware":null,"records_affected":207114,"reviewed":false,"root_cause":"A misconfigured API inadvertently returned excessive personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Spoutible","type":"hibp","url":"https://haveibeenpwned.com/Breach/Spoutible"}],"summary":"Spoutible records were scraped through a misconfigured API that returned excessive personal information, including password hashes, 2FA secrets, backup codes, and reset tokens.","supporting_quote":"In January 2024, Spoutible had 207k records scraped from a misconfigured API that inadvertently returned excessive personal information .","technology_involved":["API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eade8416ef2e5d669efdb18a90848e75cc43725b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TRISTARInsuranceCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e8bf4659f327","org_name":"TRISTAR Insurance Company","org_type":"unknown","ransomware":null,"records_affected":1488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TRISTARInsuranceCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-02","discovered_date":"2023-12-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"c4b09683405ceed721062ad486cb5e9aa882e05d","impact_type":"data_theft","incident_date":"2023-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27811.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"634c9dc12221","org_name":"Sage Home Loans Corporation","org_type":"financial","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sage%20Home%20Loans%20Corporation%20f/k/a%20Lenox%20Financial%20Mortgage%20Corporation%20d/b/a%20Weslend%20Financial%20%28%E2%80%9CLen-2024-02-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27811.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592239"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024.08.27%20-%20Lenox%20-%20Sample%20Copies%20of%20Individual%20Notification%20Letters.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27811.pdf"}],"summary":"An unauthorized actor accessed Lenox’s network and obtained data, including potentially impacted personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee5499c78d3e77e0560d1ca9d6c30c96fd152b85","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NAH--California%20AG%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"6dfbf0a819f5","org_name":"National Advisors Holdings, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580452"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NAH--California%20AG%20Notice%20Letter_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NationalAdvisorsHoldingsInc.pdf"}],"summary":"An unauthorized individual accessed four employee web-based company email accounts containing client information, which may have included names.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2024-02-02","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"4b49dedfb1ee7f37e07309d5482f0b876f93889b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/InfosysMcCamishSystemsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d8422b417dd7","org_name":"Infosys McCamish Systems, LLC","org_type":"professional_services","ransomware":true,"records_affected":43393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Infosys%20McCamish%20Systems%2C%20LLC-2024-06-27"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/InfosysMcCamishSystemsLLC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29635.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-600189"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-595897"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-593656"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590264"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-591410"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587689"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_IMS_3.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Infosys%20McCamish%20Systems%20LLC-2024-02-02"}],"summary":"Infosys McCamish Systems reported that ransomware encrypted certain systems and that personal information was subject to unauthorized access and acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7c5e529c07203bf7b20f353f0f557f8df03b103","impact_type":"unknown","incident_date":"2023-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Emmanuel_College_-_Redacted_Sample_Notice_General_33157946v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da194bc0fe2b","org_name":"Emmanuel College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580384"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-02","discovered_date":"2023-10-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14d9c5eeceafe801ab5ebc7c8eb15273f7c8b46f","impact_type":"data_theft","incident_date":"2023-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27805.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1b8ddabdc875","org_name":"Advarra, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27805.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27805.pdf"}],"summary":"An unauthorized third party accessed an Advarra employee’s account and downloaded company data, including individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-02-01","discovered_date":"2023-12-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b21e05bbe25cf4589ea232e468580b8beead88e","impact_type":"unknown","incident_date":"2023-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"707bee29730f","org_name":"Fora Health","org_type":"unknown","ransomware":null,"records_affected":2053,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fora%20Health-2024-02-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-02-01","discovered_date":"2022-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9960794d4d6ef1666cc0775c3edf11d24c65023","impact_type":"data_theft","incident_date":"2022-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Concord%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b289cc33aacf","org_name":"Concord Music Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580343"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Concord%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unknown actor accessed Concord systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae7a293221a68225143f264ce8210f03abb050f2","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2023-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Prestige%20Care%2C%20Inc.%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"d6598f493ce2","org_name":"Prestige Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580296"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Prestige%20Care%2C%20Inc.%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27776.pdf"}],"summary":"Prestige Care reported malware that prevented access to certain files and possible unauthorized access to systems containing personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d9b24eda44fec2d7a83c4918e098725c315df95","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20Letter%20%28291887153.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"28c3d59f0412","org_name":"J.D. Gilmour","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20Letter%20%28291887153.1%29_0.pdf"}],"summary":"J.D. Gilmour reported unauthorized access to an employee email account, with personal information potentially exposed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-31","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b46a5cc03e071eeaca8cfed8ed7a7ff25032628","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Orange%20Unified%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580268"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Orange%20Unified%29_0.pdf"}],"summary":"Illuminate Education confirmed that unauthorized parties obtained certain databases containing student information between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-31","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba62cb94b7670939aae58b08d5bdb4542159c405","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Azusa%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580269"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Azusa%29_0.pdf"}],"summary":"Illuminate Education confirmed that certain databases containing student information were obtained without authorization.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c70abee816531e2f5963cc63fb97f34ef379ba9","impact_type":"unknown","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/Delta%20Dental%20DDC%20and%20Affiliates%20Notification%20Letter%201.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65a8c6d44c4f","org_name":"GEICO Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580275"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-01-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7b7ef3b9d635aa1bd92ad7181844a5b774d098b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-25","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27760.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"d65678b2682a","org_name":"Washington State Department of Licensing","org_type":"government","ransomware":null,"records_affected":997,"reviewed":false,"root_cause":"Spoofed websites induced individuals to enter their Secure Access Washington login credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27760.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27760.pdf"}],"summary":"Spoofed websites captured Secure Access Washington credentials, and information in some Department of Licensing accounts may have been viewed by unauthorized individuals.","supporting_quote":"As a result, between October 25, 2023, and November 20, 2023, individuals who entered their login credentials on one of these spoofed websites may have unknowingly provided their SAW login credentials to unauthorized individuals.","technology_involved":["Secure Access Washington"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-30","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a7e5b8ce320c545da748b941eb1ba23ca0b29a8","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27751.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7254a8a0bbd0","org_name":"Delta Dental of California","org_type":"healthcare","ransomware":null,"records_affected":1186,"reviewed":false,"root_cause":"Attackers exploited a vulnerability in Progress Software's MOVEit file-transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27751.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27751.pdf"}],"summary":"Delta Dental of California reported that attackers exploited a vulnerability in MOVEit and accessed and acquired company information.","supporting_quote":"On June 1, 2023, the Company learned unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","technology_involved":["MOVEit file-transfer software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-29","discovered_date":"2023-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e775c94b50560ca4f301e6b2643a274896d7b4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-28","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Washington%20National%20-%20Template%20Notification%20Letter%20%28Adult%20and%20Minor%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a63e1bd8d21d","org_name":"Washington National Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A wireless carrier retailer allowed the senior officer’s phone number to be swapped without proper authorization or verification, enabling the SIM-swap attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Washington%20National%20-%20Template%20Notification%20Letter%20%28Adult%20and%20Minor%29_0.pdf"}],"summary":"A SIM-swap attack targeting a senior officer’s cellular account enabled access to Washington National’s company data and information that included some personal information.","supporting_quote":"Because of the “SIM swapping,” the threat actor was then able to gain access to certain company data.","technology_involved":["cellular account","multi-factor authentication"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-29","discovered_date":"2023-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9086c3f61f3631125ede7e4466495a69a4a282f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bankers%20Life%20-%20Template%20Notification%20Letter%20%28Adult%20and%20Minor%29_0.pdf"},"notes":null,"org_country":"US","org_id":"40f398077642","org_name":"Bankers Life and Casualty Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A wireless carrier retailer allowed the senior officer’s phone number to be swapped without proper authorization or appropriate verification.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bankers%20Life%20-%20Template%20Notification%20Letter%20%28Adult%20and%20Minor%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bankers%20Life%20and%20Casualty%20Company-2024-01-29"}],"summary":"A SIM-swapping attack involving a senior officer’s cellular account allowed a threat actor to access certain company data.","supporting_quote":null,"technology_involved":["cellular account"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2024-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9919ee998ed20a1454830d4762b89e768a1b8ca","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ID","org_id":"54a9dc139059","org_name":"MyPertamina","org_type":"energy_utilities","ransomware":null,"records_affected":44000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyPertamina","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyPertamina"}],"summary":"A November 2022 breach of the MyPertamina service exposed records containing personal information and purchase data.","supporting_quote":null,"technology_involved":["MyPertamina"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dd825dd3a638e211863c9340307b54510b2b886","impact_type":"unknown","incident_date":"2023-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac72453104e8","org_name":"Keenan & Associates (“Keenan”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583827"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580027"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-01-26","discovered_date":"2023-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc68f53058560dac5a67a00b30491ae23f555230","impact_type":"both","incident_date":"2023-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27714.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8611d6b1df67","org_name":"Henry Schein","org_type":"manufacturing","ransomware":null,"records_affected":1953,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27714.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27714.pdf"}],"summary":"Henry Schein reported a cybersecurity incident affecting manufacturing and distribution operations, with employee personal information potentially accessed and obtained by an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04ee652d1d1f15569e184a0a6f86c6eba6a128f0","impact_type":"unknown","incident_date":"2023-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EMK_Letter_-_Recacted%2833132372.1%29_Redacted_33134355v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad4f833037a1","org_name":"ElGuindy, Meyer & Koegel, APC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579990"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"282026677669d760d023086e9337de5e0a691580","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2023-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_8.pdf"},"notes":null,"org_country":"US","org_id":"8010f058d331","org_name":"Fullerton Joint Union High School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579899"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_8.pdf"}],"summary":"Fullerton Joint Union High School District experienced a ransomware attack that disrupted its network, and a limited amount of data may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-01-24","discovered_date":"2023-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b4e91eafa635930f5ffd3b2e1343811224980bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BNJ_Individual%20Notice%20Redacted%20%28Ex.%20A%29_0.pdf"},"notes":null,"org_country":"US","org_id":"c5a94ceec917","org_name":"Bake ‘N Joy Foods, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BNJ_Individual%20Notice%20Redacted%20%28Ex.%20A%29_0.pdf"}],"summary":"An unauthorized person accessed Commerce V3’s e-commerce platform, where Bake ‘N Joy Foods customer order information, including payment card details, was accessible.","supporting_quote":null,"technology_involved":["Commerce V3","e-commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Commerce V3"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85b72a206ad8f2c0bf29c49391e4c7683e99c578","impact_type":"data_theft","imported_from":null,"incident_date":"2024-01-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"87880a839037","org_name":"Trello","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Trello","type":"hibp","url":"https://haveibeenpwned.com/Breach/Trello"}],"summary":"Data scraped from a publicly accessible Trello resource was posted for sale after being enumerated using email addresses from previous breach corpuses.","supporting_quote":"Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses.","technology_involved":["Trello"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7127350c2e5b8526d9c2f3ff15f97a2b314228f6","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27658.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8fc3c8220f22","org_name":"Philips Respironics International Colorado, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":14476,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27658.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27658.pdf"}],"summary":"Philips Respironics International Colorado reported an incident involving personal information affecting 14,476 people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8bab5419f4635c00aad100742773d3983570f440","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Jasons%20Deli-%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e8c3fe51c1d1","org_name":"Deli Management Inc.","org_type":"unknown","ransomware":null,"records_affected":1881,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/Jasons%20Deli-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93fa63c054e2a9a6b8775a5179912abb1744a074","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/First%20Financial%20Security%20Sample%20Notification%20Letter.PDF"},"notes":null,"org_country":"US","org_id":"04e6d8ea80d2","org_name":"Columbus Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/First%20Financial%20Security%20Sample%20Notification%20Letter.PDF"}],"summary":"Columbus Life Insurance Company reported that a ransomware attack exposed a limited amount of system data, including personal information and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","other"],"disclosed_date":"2024-01-21","discovered_date":"2023-10-01","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da85e519e58eaf258e275421912c6395eaac6756","impact_type":"data_theft","incident_date":"2023-04-29","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20CA%20Notification%20Letters.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"d510a5877ed1","org_name":"23andMe","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker used credentials reused between 23andMe and other websites.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20CA%20Notification%20Letters.pdf"}],"summary":"A threat actor used reused credentials to access 23andMe accounts and obtain DNA Relatives profile information.","supporting_quote":"The threat actor accessed those accounts where the usernames and passwords that were used on 23andMe.com were the same as those used on other websites that were previously compromised or otherwise available.","technology_involved":["23andMe.com","DNA Relatives feature"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f5f0d1df5cf5b935021074268d5cc9697f15549","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/J_First%20Financial%20Security_draft%20notifcaiton%20letter%20all%20states.PDF"},"notes":null,"org_country":"US","org_id":"406b4b232d80","org_name":"First Financial Security, Inc.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/J_First%20Financial%20Security_draft%20notifcaiton%20letter%20all%20states.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#First%20Financial%20Security%2C%20Inc.-2024-01-23"}],"summary":"First Financial Security, Inc. reported a ransomware attack that did not freeze systems but exposed a limited amount of system data, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e82262eeb697bd49bbfdd33c1b0dc42f7f601ea2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%28134836822.1%29.pdf"},"notes":null,"org_country":"US","org_id":"aa45be419e1c","org_name":"Chuze Fitness","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579619"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%28134836822.1%29.pdf"}],"summary":"Chuze Fitness reported unauthorized access to its network environment, and names, mailing addresses, and Social Security numbers may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-19","discovered_date":"2023-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed9a3537462274af244a709014ccf24f68c4b18","impact_type":"data_theft","incident_date":"2023-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ashford%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"0c449a71137a","org_name":"Ashford, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579636"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ashford%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA-%20Exhibit%201_0.pdf"}],"summary":"Ashford, Inc. reported that an unauthorized actor accessed systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-18","discovered_date":"2023-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"97475f83a5b912a788f845fd4b1c14d90fe216bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-22","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27634.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bb4e49846072","org_name":"Umpqua Community College","org_type":"education","ransomware":null,"records_affected":691,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Umpqua%20Community%20College-2024-01-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27634.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27634.pdf"}],"summary":"Umpqua Community College discovered unusual activity in its systems, and a review identified names and student identification numbers as potentially impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2024-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0bf8dabe469f249bc67532950396af0e6a25d21e","impact_type":"unknown","incident_date":"2023-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27623.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"179346ba89bf","org_name":"The Washington Center for Deaf & Hard of Hearing Youth","org_type":"education","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27623.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27623.pdf"}],"summary":"The Washington Center for Deaf & Hard of Hearing Youth reported a security incident affecting 594 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-18","discovered_date":"2023-12-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8c3a51cbde1402e28d970ec7e321cc0938935a5","impact_type":"unknown","incident_date":"2023-03-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6241ba661071","org_name":"Hutchinson Cox","org_type":"unknown","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hutchinson%20Cox-2024-01-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"17e9c28f89d9c9616137b9990e9feeb566640eba","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27622.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c37da89e4d2f","org_name":"TGI Direct","org_type":"unknown","ransomware":null,"records_affected":3428,"reviewed":false,"root_cause":"The actor exploited vulnerabilities in MOVEit to access data stored in the tool.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27622.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27622.pdf"}],"summary":"An unauthorized actor exploited vulnerabilities in MOVEit and accessed data stored for TGI.","supporting_quote":"An unauthorized actor exploited MOVEit’s vulnerabilities and accessed data without permission for companies, including TGI.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-17","discovered_date":"2023-11-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d66a62c8dd7a3f5a74d6a8254c592e057c0c97","impact_type":"exposure_no_theft_confirmed","incident_date":"2024-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB08325-OVG-Emp-letter%20%282%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"8c0f49997441","org_name":"Oak View Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579494"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB08325-OVG-Emp-letter%20%282%29_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27620.pdf"}],"summary":"Oak View Group detected unauthorized access to parts of its network, and a review found that personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2024-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ec870a10ec2b73ec1734f97028cef9db63f697c","impact_type":"data_theft","incident_date":"2023-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"4e7c9292c7e2","org_name":"Naz.API","org_type":"unknown","ransomware":null,"records_affected":70840771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Naz.API","type":"hibp","url":"https://haveibeenpwned.com/Breach/NazApi"}],"summary":"In September 2023, over 100GB of stealer logs and credential stuffing lists titled \"Naz.API\" was posted to a popular hacking forum . The incident contained a combination of email address and plain text password pairs alongside the service they were entered into, and standalone cr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-01-16","discovered_date":"2023-10-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f14dc10c8d0bd9ff5677c5a6fb3106b59260425","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McCarthy%20%26%20Holthus%20-CA%20-%20Notice%20of%20Data%20Event%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"65bcfed20189","org_name":"McCarthy & Holthus, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579456"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McCarthy%20%26%20Holthus%20-CA%20-%20Notice%20of%20Data%20Event%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#McCarthy%20%26%20Holthus-2023-12-08"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27614.pdf"}],"summary":"McCarthy & Holthus, LLP reported unauthorized access to its network from October 1 to October 8, 2023, during which an actor could view or acquire information including names, loan numbers, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94ec3fed5b42a011285b8ae3dc66ab521d36e8cf","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hanmi%20Bank%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"9f303f73d085","org_name":"Hanmi Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hanmi%20Bank%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Hanmi Bank reported that unauthorized actors obtained files transferred through MOVEit Transfer, exposing some personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71b19e836b0b42607e9d871f1b5f4f8f57478b5c","impact_type":"disruption_or_ransomware","incident_date":"2023-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SRHS%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0d76f4aceb23","org_name":"Singing River Health System","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-585279"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579335"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SRHS%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Singing River Health System reported a ransomware attack involving unauthorized access to its environment and files potentially containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e63d179364a14e83171960b80195ec73242c74cb","impact_type":"unknown","incident_date":"2023-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RCS%20Sample%20Notification%20Letter%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6cc256d3c1b5","org_name":"Rebekah Children’s Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579322"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68313602f4d8f1d88a94169f4eb49427766aee0d","impact_type":"unknown","incident_date":"2023-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Nautic_Partners%20LLC-SSN_final_Jan12%20_redacted_%2833073536.1%29_Redacted%2833074049.1%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4e09c87e73ae","org_name":"Nautic Partners, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579282"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20d5e3e1d3d389d736a7db41013c502c1377f0de","impact_type":"data_theft","imported_from":null,"incident_date":"2023-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"d2b79e32201f","org_name":"Hathway","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hathway","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hathway"}],"summary":"Data allegedly taken from Hathway in December 2023 appeared on a hacking website, exposing personal information and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0aabf27e1753a84b21815f6648e41bc9da3a808c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hair%20Club_CA%20App%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"f53207fa5eb7","org_name":"Hair Club","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579314"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hair%20Club_CA%20App%20%26%20Sample_0.pdf"}],"summary":"Hair Club reported unauthorized access to certain systems and identified files that may have contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-12","discovered_date":"2023-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"622ecda1d55b95e28b91db4026f9c2a75d3e0dd6","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K6458_Carnegie%20Mellon%20University_L02_SAS_2_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"949afcd3ab42","org_name":"Carnegie Mellon University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579261"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K6458_Carnegie%20Mellon%20University_L02_SAS_2_Redacted.pdf"}],"summary":"An unauthorized third party accessed a Carnegie Mellon University computer system, and files that may have been copied could have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-01-12","discovered_date":"2023-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"63b374076df95fcf1180792ca5e9d9ad37b8cd0f","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/LoanCare%20Cybersecurity%20Incident%20Borrower%20Notice%20template.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c53a69a40d70","org_name":"Atlantic Bay Mortgage Group, LLC","org_type":"financial","ransomware":null,"records_affected":3036,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/LoanCare%20Cybersecurity%20Incident%20Borrower%20Notice%20template.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/LoanCare%20Cybersecurity%20Incident%20Borrower%20Notice%20template.pdf"}],"summary":"An unauthorized third party exfiltrated data from Fidelity National Financial systems, and Atlantic Bay Mortgage Group borrowers’ personal information may have been included.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fidelity National Financial, Inc."},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"89d4f41f603d","name":"Fidelity National Financial, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ae95afeeb33c32c1cca4b938bc81e5bfa372620c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27555.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b974ee050202","org_name":"Alpha Supported Living Services","org_type":"healthcare","ransomware":null,"records_affected":1383,"reviewed":false,"root_cause":"An Alpha employee was the victim of an email phishing attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27555.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27555.pdf"}],"summary":"Alpha Supported Living Services reported that an employee was targeted in an email phishing attack and that names, addresses, and Social Security numbers may have been accessed.","supporting_quote":"Regrettably, an Alpha employee was the victim of a sophisticated email phishing attack.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1552"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2024-01-11","discovered_date":"2024-01-09","entry_asset":"api_or_integration_token","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce73fd9ade34f1d7ae718f28cce8595993dc7809","impact_type":"data_theft","incident_date":"2023-12-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Incident%20Report%20for%20Jan%2010th.pdf"},"notes":null,"org_country":"US","org_id":"4280f5654357","org_name":"PLUS FIVE FIVE","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A database API key was exposed as a client-side environment variable on the Resend Dashboard.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579226"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Incident%20Report%20for%20Jan%2010th.pdf"}],"summary":"Attackers used an exposed database API key to access Resend customer data, including email metadata, API keys, logs, and contacts.","supporting_quote":"On December 30th, at 11:20 pm, the attackers first gained access to our system by discovering an exposed database API key as an environment variable on the client-side of the Resend Dashboard.","technology_involved":["Resend Dashboard","database API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2024-01-11","discovered_date":"2023-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a9b5fb44b0eb30895b66106770dfa48f703e7b3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach_Blink%20Mobility.pdf"},"notes":null,"org_country":"US","org_id":"ecfbb21dd472","org_name":"Blink Mobility","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579251"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach_Blink%20Mobility.pdf"}],"summary":"Blink Mobility reported that a vulnerability in a former vendor’s MongoDB database may have compromised customer data.","supporting_quote":"On December 14, 2023, Blink Mobility received notice that a former vendor’s database had a vulnerability that may have compromised some customer data on October 20, 2023.","technology_involved":["MongoDB database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-10","discovered_date":"2023-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"09fc9c6f1af88dff844c81b1e82fb6dbd7080728","impact_type":"data_theft","incident_date":"2023-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27527.pdf"},"notes":null,"org_country":"US","org_id":"e2fb036d9ab9","org_name":"Indigo Sky Casino and Resort and Outpost Casino","org_type":"other","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27527.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27527.pdf"}],"summary":"Indigo Sky Casino and Resort and Outpost Casino reported that an unknown third party acquired documents containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-10","discovered_date":"2023-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c1d000f80032b7390581ca86566d1e157ffc0b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GUSD%20-%20CA%20AG%20Supplemental%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"2fc213d5183a","org_name":"Glendale Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-590048"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GUSD%20-%20CA%20AG%20Supplemental%20Notice_0.pdf"}],"summary":"Glendale Unified School District reported that an unauthorized party accessed files stored on its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"92b236354c4f7569ea7133659ebcaef72ea8dd12","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27519.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4d3539b91eec","org_name":"CellNetix Pathology and Laboratories","org_type":"healthcare","ransomware":null,"records_affected":1146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27519.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27519.pdf"}],"summary":"CellNetix reported that an unauthorized party accessed its network environment, and personal and health insurance information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4463ade88b730f5bc7993a6094ee86884feb96ff","impact_type":"data_theft","incident_date":"2023-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Meat%20-%20Regulatory%20Notification%20-%20CA%2810576437.2%29_0.pdf"},"notes":null,"org_country":"US","org_id":"3f294b2513ab","org_name":"American Meat Companies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579194"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Meat%20-%20Regulatory%20Notification%20-%20CA%2810576437.2%29_0.pdf"}],"summary":"American Meat Companies reported that a July 2023 incident may have resulted in unauthorized access to or acquisition of personal information belonging to current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-09","discovered_date":"2023-12-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca898ecc90965a41c22743512944ac7900d02eb7","impact_type":"unknown","incident_date":"2022-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0440be3f481","org_name":"Oregon Pacific Bancorp","org_type":"unknown","ransomware":null,"records_affected":423,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Pacific%20Bancorp-2024-01-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-08","discovered_date":"2023-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99318953b63a2e7b9408fa38070e8615c75d4649","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice-%20Magellan.pdf"},"notes":null,"org_country":"US","org_id":"0e52da576da9","org_name":"Sharp Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579058"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579056"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice-%20Magellan.pdf"}],"summary":"A system error in a vendor’s printing software omitted members’ names from mailing address lines, potentially exposing behavioral health information to other household members.","supporting_quote":"On December 26, 2023, Sharp Health Plan confirmed that a system error in its vendor’s printing software failed to apply Sharp Health Plan members’ names to the address line in a bulk mailing.","technology_involved":["printing software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"6e096ab1028c2fc7e32429e5beda0d826d709fa0","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"aca68a715625","org_name":"loanDepot","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000004/ldi-20240104.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000009/ldi-20240112.htm"},{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1831631/000183163124000011/ldi-20240104.htm"}],"summary":"loanDepot reported unauthorized access to certain company systems and data encryption, and shut down some systems while responding.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-08","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0ab3d23c3f44a936e27c4df0fcf9554607cd8403","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16394.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac5dca180a25","org_name":"Highmark Blue Cross Blue Shield","org_type":"healthcare","ransomware":null,"records_affected":504,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16394.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16394.pdf"}],"summary":"Highmark Blue Cross Blue Shield reported that data was accessed and exfiltrated from its MOVEit Transfer server.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"014874a92766086371e434c03d7463d24bd3d914","impact_type":"unknown","incident_date":"2022-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ELN-20770_Musick_Peeler__Garrett_Ad_CM_1yr_%5Bredacted%5D_33049382v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6af4138f475e","org_name":"Musick, Peeler & Garrett LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578962"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580829"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-05","discovered_date":"2023-09-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"077b5136bc619e0d039dc6a554e6a8566a58c4f9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27492.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d8e8767d0d91","org_name":"Moses Lake Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":1189,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27492.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27492.pdf"}],"summary":"Moses Lake Community Health Center reported that an unauthorized person accessed two email accounts containing personal and clinical information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f4ffcab8012f57cbcef718c9638028696260fda","impact_type":"unknown","incident_date":"2023-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Cooper_Aerobics_-_CA_AG_Notice_Sample_33047434v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c4bba6a81a38","org_name":"Cooper Aerobics Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578895"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-05","discovered_date":"2023-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24a9c68f7700ba5197dd364767496f05420bdaba","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2023-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Buckley%20King%20-%20ADULT%20Notification%20Letter%20V2___Static_Proof_R1%2810515883.1%29.pdf"},"notes":null,"org_country":"US","org_id":"420bc5f1c735","org_name":"Buckley King LPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578899"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Buckley%20King%20-%20ADULT%20Notification%20Letter%20V2___Static_Proof_R1%2810515883.1%29.pdf"}],"summary":"Buckley King discovered a systems-disrupting incident and later learned that personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d36a638341e3e4969d6a829b63cf381094c4fd9a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Academy%20Sample%20Notifications_Redacted.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"a86bd9501049","org_name":"Academy Mortgage Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578941"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579377"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Academy%20Sample%20Notifications_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16247.pdf"}],"summary":"Academy Mortgage Corporation detected and stopped an incident in which an unauthorized third party accessed and disabled some systems and may have accessed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2024-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8209b96b62d72ca088baedf850a3a4d04d4b4e05","impact_type":"data_theft","incident_date":"2024-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Information%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"ff61fa8bc0c1","org_name":"WICR Waterproofing and Construction Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578869"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Information%20Breach_0.pdf"}],"summary":"WICR reported a breach of its accounting system that released customers’ contact information and open balances.","supporting_quote":null,"technology_involved":["accounting system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-04","discovered_date":"2023-08-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4650a709915705763f2da8e2d1481491fdf707db","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok%20-%20Notice%20of%20Data%20Privacy%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"4d5751531773","org_name":"Welltok","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578830"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok%20-%20Notice%20of%20Data%20Privacy%20Event%20-%20CA_0.pdf"}],"summary":"Welltok reported that an unknown actor exploited software vulnerabilities in its MOVEit Transfer server and exfiltrated data.","supporting_quote":"On July 26, 2023, we were alerted to an alleged compromise of our MOVEit Transfer server in connection with software vulnerabilities made public by the developer of the MOVEit Transfer tool.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-04","discovered_date":"2022-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b87df14e7629a2cf6f087a5c425d7d4d2d7307be","impact_type":"data_theft","incident_date":"2022-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Adult.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"4029a5ca7674","org_name":"Wabtec Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Adult.pdf"}],"summary":"Wabtec reported unauthorized access to certain systems, with data taken from its environment and later posted to a threat actor’s leak site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2024-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f778c1cd93f1f344f171d30cfec5793463600d2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"ea85947196ba","org_name":"Legendas.TV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Legendas.TV","type":"hibp","url":"https://haveibeenpwned.com/Breach/LegendasTV"}],"summary":"Legendas.TV suffered a breach in October 2017 that exposed customer records, including personal information and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-03","discovered_date":"2024-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a9f4317854fc49c851c0a4fc2c9401ca882398e","impact_type":"data_theft","incident_date":"2022-01-25","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Best%20Hands%20LA%20data%20breach.pdf"},"notes":null,"org_country":"US","org_id":"2a409152f254","org_name":"Mellow Massage Hollywood","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee had unauthorized access to contact information and obtained patient information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578784"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Best%20Hands%20LA%20data%20breach.pdf"}],"summary":"A former employee obtained patients’ contact information from Mellow Massage Hollywood.","supporting_quote":"At this time it appears the breach was through a former employee with unauthorized access to contact information, making detection and prevention of breaches of this nature difficult.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2024-01-03","discovered_date":"2023-11-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e6c1a0045cbe752fe204dec743c4eae0fd00e0ea","impact_type":"unknown","incident_date":"2023-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"974e8a3f1245","org_name":"Marathon Coach, Inc.","org_type":"unknown","ransomware":null,"records_affected":704,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marathon%20Coach%2C%20Inc.-2024-01-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-03","discovered_date":"2023-06-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b09cfbeb425514767c10ac13c1e5ad3c8b8fcad","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notice%20Letter%20Proof%20-%20HACSB.pdf"},"notes":null,"org_country":"US","org_id":"2884dd5193c7","org_name":"Housing Authority of the County of San Bernardino","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578810"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notice%20Letter%20Proof%20-%20HACSB.pdf"}],"summary":"The Housing Authority of the County of San Bernardino confirmed unauthorized access to one employee email account, with a limited amount of personal information potentially accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2024-01-03","discovered_date":"2023-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"442b021514f7bde8805ddff6ef74e558e5dea5fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16327.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"406b4b232d80","org_name":"First Financial Security","org_type":"financial","ransomware":true,"records_affected":2328,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16327.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16327.pdf"}],"summary":"First Financial Security experienced a ransomware attack, and a limited amount of system data was exposed without disruption to operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2024-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49ff9aed95a89c93137ba0da218ac764162f40bc","impact_type":"data_theft","incident_date":"2023-10-12","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Template%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"bd3a52cbd2b8","org_name":"Knox Ricksen LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Template%20Notice.pdf"}],"summary":"Knox Ricksen reported that an unauthorized party accessed files containing medical records and health insurance information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-31","discovered_date":"2023-10-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee426f22a1b1dc7972bf41f083e164e1aaa65fe7","impact_type":"both","incident_date":"2023-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Resident%20notice%20template%28182336006.1%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"43b3d7f67b2e","org_name":"Estes Express Lines","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578650"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Resident%20notice%20template%28182336006.1%29.pdf"}],"summary":"Estes Express Lines reported that an unauthorized threat actor accessed company IT systems, deployed ransomware, and extracted data that may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-29","discovered_date":"2023-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83fdc7c05a88ebe9e6e5a4e019ec68dc6339ab9d","impact_type":"data_theft","incident_date":"2023-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Transformative%20-%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"55777cea8dc8","org_name":"Transformative Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578595"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Transformative%20-%20Consumer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transformative%20Healthcare-2023-12-29"}],"summary":"Transformative Healthcare reported that an unauthorized party obtained files from its data storage archive that may have contained personal information.","supporting_quote":null,"technology_involved":["data storage archive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f5920dcbcf01ba7f1f44d69d99eb78028f6683","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TFS%20CA%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4e28eebd87aa","org_name":"Toyota Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586799"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578618"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TFS%20CA%20Notification%20Letter.pdf"}],"summary":"Incorrectly linked Toyota Financial Services customer accounts made some customers' personal data accessible to other customers through the website, app, or IVR.","supporting_quote":null,"technology_involved":["TFS website","TFS smartphone app","interactive voice response system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-29","discovered_date":"2023-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dc9376070271009c2c2576f7fa72b0a7eec0c06","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Navvis%20%26%20Company%20LLC%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9e1e93606507","org_name":"Navvis & Company, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-586490"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578562"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579111"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580801"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Navvis%20%26%20Company%20LLC%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Navvis%20%26%20Company%2C%20LLC-2023-12-29"}],"summary":"Navvis identified suspicious activity and found that an unauthorized actor may have accessed or acquired files containing personal and protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"86cec7128f61e7c8b529417132065bcd0fa53fd4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FallonAmbulanceServices.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3bd1d5b7e183","org_name":"Fallon Ambulance Services","org_type":"unknown","ransomware":null,"records_affected":1783,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FallonAmbulanceServices.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-29","discovered_date":"2023-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"410ff4f60296bfc0d724d258b509d687e88405c3","impact_type":"both","incident_date":"2023-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BHCC%20Individual%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"14de7e9e9640","org_name":"Bunker Hill Community College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578568"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BHCC%20Individual%20Notification%20Letter_Redacted.pdf"}],"summary":"Bunker Hill Community College reported unauthorized access to its systems, ransomware deployment, and copying of a limited amount of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-29","discovered_date":"2023-11-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38175d07042e049c12e3417758351531229e30d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AmWins%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"543f87b44b29","org_name":"Amwins Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578587"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AmWins%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Amwins said personal information was identified on a MOVEit Transfer server used by Paycor after an unauthorized actor accessed the server.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Paycor"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"cb6a8e4fc2ca","name":"Paycor"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ccff32670eb0ed37fe29b84afda26dd05a3c9c87","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SharonviewFederalCreditUnion.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71e46147ce30","org_name":"Sharonview Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":4594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SharonviewFederalCreditUnion.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-28","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0abf3ef6403ad42a6ec0c2de135f154a4009f787","impact_type":"data_theft","incident_date":"2023-02-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP%20-%20Combined%20Sample%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5acbf6a2ed89","org_name":"Orrick, Herrington & Sutcliffe LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578559"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP%20-%20Combined%20Sample%20Individual%20Notification.pdf"}],"summary":"An unauthorized third party remotely accessed part of Orrick’s network and obtained files containing personal information.","supporting_quote":null,"technology_involved":["file share"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e230e2c527150fe8cd0f4123886b50552b6c3120","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18626%20FiServ%20Impacted%20Ind%20Adult%20CM%2024%20Mo%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"dfb3a8a76a61","org_name":"Merrick Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The incident involved vulnerabilities in MOVEit Transfer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578522"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18626%20FiServ%20Impacted%20Ind%20Adult%20CM%2024%20Mo%20r3prf.pdf"}],"summary":"Merrick Bank reported that unauthorized actors obtained files containing personal information through its MOVEit Transfer environment.","supporting_quote":"Analysis to date has identified unauthorized activity in the relevant MOVEit Transfer environment between May 27 to 31, 2023, which was before Progress Software publicly disclosed the existence of this vulnerability.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-28","discovered_date":"2023-12-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"969af088875ee60b49a14d56ab6d1eea2f507ca8","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_JG_Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"024f0e87d3c1","org_name":"Maxco Supply, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_JG_Final_Redacted.pdf"}],"summary":"Maxco Supply reported that confidential information related to current and former employees was viewable on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-28","discovered_date":"2023-11-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5fadff7fbdf777a050d7a9affdbae234a19b3884","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"735c5deb882e","org_name":"Boys & Girls Club of Salem, Marion and Polk Counties","org_type":"unknown","ransomware":null,"records_affected":329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Boys%20%26%20Girls%20Club%20of%20Salem%2C%20Marion%20and%20Polk%20Counties-2023-12-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-22","discovered_date":"2023-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0d4889c336fad246ccd3c67cbe818f15f8fbcd88","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16398.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6854144f0498","org_name":"United Healthcare Services, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":9938,"reviewed":false,"root_cause":"An unknown actor exploited a previously unknown vulnerability in MOVEit Transfer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16398.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16398.pdf"}],"summary":"An unknown actor exploited a vulnerability in MOVEit Transfer to access the server and exfiltrate personal information.","supporting_quote":"On August 11, 2023, Welltok determined that an unknown actor exploited the software vulnerability between May 30, 2023 – May 31, 2023 , accessed the MOVEit Transfer server, and exfiltrated certain data during that time .","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7980d17dbf135ca791b678ba57114a2f2d414a9e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27382.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02463ab2b68f","org_name":"The Switch Enterprises LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27382.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal"],"disclosed_date":"2023-12-22","discovered_date":"2023-12-06","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa23252baf68eadf5ffc3212a68f61c5e711dee7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27384.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"df18f22d08f0","org_name":"Snagajob","org_type":"technology_saas","ransomware":null,"records_affected":2220,"reviewed":false,"root_cause":"The actor used credentials stolen from other sources to access Snagajob accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27384.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27384.pdf"}],"summary":"An actor used credentials stolen from other sources to access Snagajob accounts, exposing account and employment information.","supporting_quote":"After investigating this activity, we believe that the unauthorize actor used credentials (e.g., email address and password) stolen from other sources to access your account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2023-12-22","discovered_date":"2022-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee838515f2e05dfd7f3d305cbfb87813705028c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter%20%28US%29%20-%20Panasonic%20Avionics%20Corporation.pdf"},"notes":null,"org_country":"US","org_id":"19d3d938d4db","org_name":"Panasonic Avionics Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter%20%28US%29%20-%20Panasonic%20Avionics%20Corporation.pdf"}],"summary":"Panasonic Avionics Corporation reported unauthorized access that may have impacted personal information, including medical, financial, and employment information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-22","discovered_date":"2022-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fee4fd856786aa309c32c09cfba66443c6bc508","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Amusements%2C%20Inc.%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"304c456dc8bf","org_name":"National Amusements","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578357"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Amusements%2C%20Inc.%20-%20Exhibit%20A.pdf"}],"summary":"National Amusements reported that an unauthorized individual accessed its computer network and may have viewed or taken files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9c65d0c76016e56680cf3018522cb60b981c565","impact_type":"data_theft","incident_date":"2023-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LoanCare_Individual%20Notification%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"0f85add319e5","org_name":"LoanCare, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578386"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LoanCare_Individual%20Notification%20Sample.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/LoanCareLLC.pdf"}],"summary":"An unauthorized third party exfiltrated data from Fidelity National Financial systems, and LoanCare identified that customers’ personal information may have been included.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-22","discovered_date":"2023-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1c74777de10c8b0341881c87b39b4f896da12ca","impact_type":"data_theft","incident_date":"2023-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fred%20Hutch%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c2db023ba353","org_name":"Fred Hutchinson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fred%20Hutch%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fred%20Hutchinson%20Cancer%20Center-2023-12-22"}],"summary":"Fred Hutchinson Cancer Center reported that an unauthorized third party accessed its clinical network and obtained files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11d9f0368c7ed788aafc57f02d773394716bfd68","impact_type":"disruption_or_ransomware","incident_date":"2023-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Brown%20_%20Streza%20LLP%20-%20Regulatory%20Notification%20Letter%20-%20CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"c5349765becf","org_name":"Brown & Streza LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Brown%20_%20Streza%20LLP%20-%20Regulatory%20Notification%20Letter%20-%20CA_0_0.pdf"}],"summary":"Brown & Streza LLP reported that an unknown actor accessed its network, disrupting resources and possibly acquiring files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"99f5147a16e03bac90a08bb7a18be23f97abdd7e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ViSeniorLiving%20030724.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f280945de86","org_name":"Vi Senior Living","org_type":"unknown","ransomware":null,"records_affected":1765,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ViSeniorLiving%20030724.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"575c26d5a8dd71e90f10d73b1d21c71df82fc395","impact_type":"both","incident_date":"2023-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Middlefield%20Banking%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b852eaa6ec41","org_name":"The Middlefield Banking Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Middlefield%20Banking%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"The Middlefield Banking Company reported unauthorized access to systems and acquisition of files containing personal information, along with a temporary disruption to corporate operations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b6045ab0e030226a9ce367263115fec7afb7439a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40078609ec9a","org_name":"Qorvo, Inc.","org_type":"unknown","ransomware":null,"records_affected":2963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Qorvo%2C%20Inc.-2023-12-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8dedc80c511d76d517ccca0daa00b3e9b3feaaa","impact_type":"data_theft","imported_from":null,"incident_date":"2023-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20Sample%204861-2942-5048%20v1.pdf"},"notes":"attack_techniques without supporting words dropped: T1621","org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20Sample%204861-2942-5048%20v1.pdf"}],"summary":"An attacker accessed a Los Angeles County Department of Mental Health employee’s Microsoft Office 365 account and may have accessed personal and medical information.","supporting_quote":null,"technology_involved":["Microsoft Office 365"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-21","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65fe3de693c2c0969fcb1e41666498b29d89ccb1","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Riverside%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578318"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Riverside%29_0.pdf"}],"summary":"Illuminate Education confirmed that certain databases containing student personal information were obtained without authorization between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-21","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"444c5bef4e5d46074aca7fafc612028541d79eef","impact_type":"data_theft","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Orcutt%29_0.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578320"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice%20of%20Data%20Event%20-%20CA%20%28Orcutt%29_0.pdf"}],"summary":"Illuminate Education reported that certain databases containing student personal information were obtained without authorization between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["Illuminate databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5e10b6310df31708c15c43c97a5e4afbc14f4b5","impact_type":"data_theft","incident_date":"2023-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-12-21%20-%20FSH%20Individual%20Notice%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"23001e10b289","org_name":"Fresno Surgical Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578321"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-12-21%20-%20FSH%20Individual%20Notice%20Letters.pdf"}],"summary":"Fresno Surgical Hospital reported that an unauthorized third party accessed systems and removed data containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"314a14cdac449abb7717633bd2d460cab3bf4575","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20Final.pdf"},"notes":null,"org_country":"US","org_id":"5280705253bb","org_name":"Fresno Regional Workforce Development Board","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20Final.pdf"}],"summary":"Fresno Regional Workforce Development Board reported a ransomware cyberattack in which an unauthorized party accessed its electronic data system and may have accessed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6930fa7df0526bea34f446b6a5695f2033b070b4","impact_type":"data_theft","incident_date":"2023-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CNSU%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"1690c5aa93a7","org_name":"California Northstate University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578338"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CNSU%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27368.pdf"}],"summary":"California Northstate University reported that an unauthorized actor potentially accessed and obtained files stored on university servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9bdb72145f2353a36af7ea5ca01b4e08df2ffac","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AGYHoldingCorp.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4520dece5185","org_name":"AGY Holding Corp.","org_type":"unknown","ransomware":null,"records_affected":2024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AGYHoldingCorp.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-20","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d95bc22ea29367d3fc3dbd1041986f44490c7293","impact_type":"data_theft","incident_date":"2023-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Recology%20-%20Notification%20Letter%20Proof%2892695379.1%29.pdf"},"notes":null,"org_country":"US","org_id":"b9e0afe264bc","org_name":"Recology Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578304"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Recology%20-%20Notification%20Letter%20Proof%2892695379.1%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Recology%20Inc.-2023-12-20"}],"summary":"Recology reported that an unknown third party acquired documents from its system, including employment-related records that could contain personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"605b296a2a544605d7e62e73009cf35f0c28c0bf","impact_type":"unknown","incident_date":"2022-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Merced%20City%20School%20District%20-Notice%20of%20Data%20Event%20-%20CA-%20Exhibit%201_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"355d67d4ab85","org_name":"Merced City School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578282"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-20","discovered_date":"2023-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"92c288a5a5070f0e023d3ae2a8d0ea4a29de6557","impact_type":"unknown","incident_date":"2023-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe700cf02737","org_name":"JAE Oregon, Inc.","org_type":"unknown","ransomware":null,"records_affected":757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JAE%20Oregon%2C%20Inc.-2023-12-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-12-19","discovered_date":"2023-10-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e03f9358af75fbca4545ed183d26168cd30a2066","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20TTM%20Notification%20D%20-%20General.pdf"},"notes":null,"org_country":"US","org_id":"dfb56fb53233","org_name":"TTM Technologies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581817"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578132"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20TTM%20Notification%20D%20-%20General.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TTM%20Technologies-2023-12-19"}],"summary":"TTM Technologies reported that an unauthorized third party accessed its systems and personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2023-12-19","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a979eb135d5359bfcd439b364c21b6aa4f2ba999","impact_type":"data_theft","incident_date":"2023-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29043.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b9e0afe264bc","org_name":"Recology","org_type":"other","ransomware":null,"records_affected":3540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29043.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29043.pdf"}],"summary":"Recology discovered unusual computer-network activity and determined that documents were acquired from its system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f43b7648615022290b36b13862fe2fab68cb55aa","impact_type":"data_theft","incident_date":"2023-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Los%20Altos%20-%20Draft%20Notification%20Letter%20-%20Language%20Combined.pdf"},"notes":null,"org_country":"US","org_id":"a34bc38dc3d2","org_name":"Los Altos Food Products, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Los%20Altos%20-%20Draft%20Notification%20Letter%20-%20Language%20Combined.pdf"}],"summary":"An unauthorized third party accessed Los Altos Food Products’ computer system and removed files containing personal information, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9adb0df8083beeb397de7e4b38bd272ef95ce9a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27308.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ca037c13640","org_name":"Kwik Trip, Inc.","org_type":"unknown","ransomware":null,"records_affected":1191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27308.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"349f9af1b32db2618987a8ad19aa77848e7ae9f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kimco%20Staffing%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"449bad31d322","org_name":"Kimco Staffing Services Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578164"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kimco%20Staffing%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Kimco Staffing Services reported unauthorized access to a limited number of its systems and said names and Social Security numbers may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-19","discovered_date":"2023-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a032458a22ccea123fa3614402a34cece5419949","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Glendale%20Community%20College%20-%201%20YR%20CM%20Employee%20Notice%20Letter%20V2___Static_Proof_R1.pdf"},"notes":null,"org_country":"US","org_id":"4181c287d033","org_name":"Glendale Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Glendale%20Community%20College%20-%201%20YR%20CM%20Employee%20Notice%20Letter%20V2___Static_Proof_R1.pdf"}],"summary":"Glendale Community College reported that an unauthorized party accessed or acquired files containing employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-19","discovered_date":"2023-09-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da8a0b244a9c6674579487175753f2fa52f4ad2f","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2023-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20AG%20Notification%20%28Final%29%2812.18.2023%29_1.pdf"},"notes":null,"org_country":"US","org_id":"1a2a938588e8","org_name":"ESO Solutions, Inc.","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578125"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578243"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20AG%20Notification%20%28Final%29%2812.18.2023%29_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ESO%20Solutions%2C%20Inc.-2023-12-20"}],"summary":"ESO Solutions detected ransomware that accessed and encrypted some computer systems, and personal and patient information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-18","discovered_date":"2023-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed7a16efad5a4c62c875442d9ad41435d3fd96b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-02","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/E9%20EXPERIAN_K5080_ZOLL_MEDICAL_CORPORATION_L13E9_SAS_1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"11e41912d68c","org_name":"ZOLL Medical Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee was deceived by an email phishing attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/E9%20EXPERIAN_K5080_ZOLL_MEDICAL_CORPORATION_L13E9_SAS_1_Redacted.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ZOLLMedical.pdf"}],"summary":"ZOLL Medical Corporation reported that an employee was targeted in an email phishing attack, exposing information included in affected emails.","supporting_quote":"Regrettably, a ZOLL employee was the victim of a sophisticated email phishing attack.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-18","discovered_date":"2023-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-09","id":"41ca463bcaf583583c6b0dc7732071bc394ff04b","impact_type":"both","imported_from":null,"incident_date":"2023-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"df47cb91e5c4","org_name":"VF Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":35500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/103379/000119312524010243/d641969d8ka.htm"},{"fetched_at":null,"title":"8-K 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/103379/000095012323011228/d659095d8k.htm"},{"fetched_at":null,"title":"Leak-site claim by alphv","type":"ransomware_leak_site","url":"https://www.ransomware.live/id/VkYgQ29ycG9yYXRpb25AYWxwaHY"}],"summary":"VF Corporation reported that a cyber incident disrupted operations and resulted in the theft of personal data belonging to approximately 35.5 million consumers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"claim_groups":["alphv"]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b1cbcf37406a117aa2ec1ca0127d5a963e2cb7f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/RichlandSchoolDistrictOne.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2052745af4ba","org_name":"Richland School District One","org_type":"unknown","ransomware":null,"records_affected":4353,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/RichlandSchoolDistrictOne.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"346a4860f3be7f873a995eeeba82b598833050cb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB08174-ILS-letter-Individual-V4-ILSonly_masked_0.pdf"},"notes":null,"org_country":"US","org_id":"88e5c8b85c63","org_name":"Health Net Community Solutions","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578093"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB08174-ILS-letter-Individual-V4-ILSonly_masked_0.pdf"}],"summary":"Health Net Community Solutions investigated potential effects on personal and health information after a vulnerability was reported in MOVEit Transfer.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ee9a2c24f9c0e4860c6018dac89bdfabf0feb41","impact_type":"data_theft","imported_from":null,"incident_date":"2023-10-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Copy%20of%20Customer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b04b0acafb3d","org_name":"Comcast Cable Communications LLC","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized access to internal systems resulted from a vulnerability in a Citrix product that had not yet been mitigated.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578091"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Copy%20of%20Customer%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Comcast%20Cable%20Communications%20LLC-2023-12-18"}],"summary":"Comcast Cable Communications LLC reported unauthorized access to internal systems through a vulnerability in a Citrix product, with customer information likely acquired.","supporting_quote":"However, we subsequently discovered that prior to mitigation, between October 16 and October 19, 2023, there was unauthorized access to some of our i nternal systems that we concluded was a result of this vulnerability.","technology_involved":["Citrix"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Citrix"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"6ff730cf6d53","name":"Citrix"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-16","discovered_date":"2023-11-30","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2934de68fbd2450480b112f3991fda6ebe2fc37","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27281.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"37f995b65d74","org_name":"Orchard LLC","org_type":"unknown","ransomware":null,"records_affected":514,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in the MOVEit Transfer platform used by Paycor to obtain files transferred through it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27281.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27281.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in the MOVEit Transfer platform used by Paycor, exposing Orchard employees’ birth dates and Social Security numbers.","supporting_quote":"The analysis shows the incident’s scope with regard to Paycor was limited to the third-party MOVEit platform and involved an unauthorized third-party exploiting the cyber vulnerability on the MOVEit platform to obtain certain files transferred through the software.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Paycor"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"cb6a8e4fc2ca","name":"Paycor"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9530a41568acba4feb6b3a97636b43bfd00d5c73","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-19645%20Kirkland%20Mi%201y%20r2prf_0.pdf"},"notes":null,"org_country":"US","org_id":"a37675fe2bb7","org_name":"Riverside County Office of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously unknown vulnerability in Progress Software's MOVEit Transfer allowed unauthorized access to files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578039"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-19645%20Kirkland%20Mi%201y%20r2prf_0.pdf"}],"summary":"An unauthorized third party obtained files transferred through Riverside County Office of Education's MOVEit Transfer tool after exploiting a previously unknown vulnerability.","supporting_quote":"According to Progress Software, unauthorized actors discovered a previously unknown cybersecurity vulnerability in the MOVEit Transfer software that could be exploited to gain unauthorized access to files being transferred using the tool.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-15","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"52c40ac926775dceee8976e627cfb6c92dae8143","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16507.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ec6dad6289a9","org_name":"Reyes Holdings, LLC","org_type":"technology_saas","ransomware":null,"records_affected":543,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16507.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16507.pdf"}],"summary":"An unknown actor exploited vulnerabilities in the MOVEit Transfer server and accessed and removed data, including personal information.","supporting_quote":"After a full reconstruction of our systems and historical data, we determined on August 11, 2023 that an unknown actor had exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and accessed and removed certain data from the MOVEit Transfer server during that time .","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-15","discovered_date":"2023-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bfa4db305c59b69dcc6881ff49fd80b820127f43","impact_type":"data_theft","incident_date":"2023-10-30","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27279.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"84a3b1176919","org_name":"Nationstar Mortgage LLC","org_type":"financial","ransomware":null,"records_affected":228259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nationstar%20Mortgage%20LLC%20%28dba%20Mr.%20Cooper%29-2023-12-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27279.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NationstarMortgageLLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27279.pdf"}],"summary":"Nationstar Mortgage LLC reported unauthorized access to certain systems between October 30 and November 1, 2023, during which files containing personal information were obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-15","discovered_date":"2023-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1aae9cd46d80bb6ced6c16618f1bae3c0576b1f","impact_type":"data_theft","incident_date":"2023-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mr.%20Cooper%20Individual%20Notice%20-%20Proof%20-%20Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"ad4eac1546ef","org_name":"Mr. Cooper","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582926"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mr.%20Cooper%20Individual%20Notice%20-%20Proof%20-%20Redacted_0.pdf"}],"summary":"Mr. Cooper reported that an unauthorized party obtained files containing customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"ce35d416de947834a41a7d213073375f469fdcd8","impact_type":"data_theft","imported_from":null,"incident_date":"2023-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"ad4eac1546ef","org_name":"Mr. Cooper Group Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K 8-K/A","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/933136/000093313623000109/nsm-20231102.htm"}],"summary":"Mr. Cooper Group Inc. reported that an unauthorized third party accessed certain technology systems and obtained personal information relating to substantially all current and former customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"41ffe7826dcb8a29434cf063e7671f063d6a6265","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16506.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana","org_type":"healthcare","ransomware":null,"records_affected":33193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16506.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16506.pdf"}],"summary":"Humana notified affected people about a Welltok incident involving their personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Welltok, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"4d5751531773","name":"Welltok, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-15","discovered_date":"2023-04-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"535ab7ed494695078852c290ad39c24406a4712d","impact_type":"unknown","incident_date":"2023-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1848e3fc259","org_name":"Coos Health & Wellness","org_type":"unknown","ransomware":null,"records_affected":14040,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Coos%20Health%20%26%20Wellness-2023-12-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-15","discovered_date":"2023-08-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56fa8c75497d2e37cc55f42c752460f9e1d5be24","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16499.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"281ebc4901ca","org_name":"Cohere Health","org_type":"technology_saas","ransomware":null,"records_affected":2299,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16499.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16499.pdf"}],"summary":"An unknown actor exploited vulnerabilities in Cohere Health’s MOVEit Transfer server and removed data that included personal information.","supporting_quote":"an unknown actor had exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and accessed and removed certain data from the MOVEit Transfer server during that time .","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-15","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3f4148ad4cbfe0730ef706da98e6167d1e559378","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16500.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"57732cdb5b29","org_name":"Centerwell Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":12222,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16500.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16500.pdf"}],"summary":"An unknown actor exploited software vulnerabilities to access the MOVEit Transfer server and remove data related to Centerwell Pharmacy customers.","supporting_quote":"After a full reconstruction of our systems and historical data, we determined on August 11, 2023 that an unknown actor had exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and accessed and removed certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2023-12-15","discovered_date":"2023-11-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5bcaac7dc89dd505e8bfce582240ae6a0609d0f3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27275.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"21efbe7a6787","org_name":"Berkshire Production Supply, LLC","org_type":"unknown","ransomware":null,"records_affected":712,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27275.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27274.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27275.pdf"}],"summary":"Berkshire Production Supply reported that information entered on SignatureIT’s e-commerce platforms may have been accessed after unauthorized access to the third-party platform.","supporting_quote":"According to a forensic preliminary report that was obtained by SignatureIT, the experts identified the Confluence collaboration platform as the probable penetration point into SignatureIT’s system.","technology_involved":["Confluence collaboration platform","e-commerce platforms"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"SignatureIT Ltd."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"9b6fd47f6308","name":"SignatureIT Ltd"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-14","discovered_date":"2023-11-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"641c1e3ba17a6d7cbb29cd2c75447cc24a372f53","impact_type":"unknown","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63405abb717e","org_name":"Rogue Credit Union","org_type":"unknown","ransomware":null,"records_affected":1380,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rogue%20Credit%20Union-2023-12-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2023-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b2a4941fcb569a753780077b7b72451381de9df7","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Dentegra.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"859ca067bbdf","org_name":"Dentegra Insurance Company","org_type":"unknown","ransomware":null,"records_affected":1156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Dentegra.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27264.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-14","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6a4b1cf140265b2f2c81018e565f07cbb739826","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27266.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7254a8a0bbd0","org_name":"Delta Dental of California","org_type":"financial","ransomware":null,"records_affected":106098,"reviewed":false,"root_cause":"Unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Delta%20Dental%20of%20California%20and%20its%20affiliates-2023-12-14"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27266.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27266.pdf"}],"summary":"Delta Dental of California reported that attackers exploited a vulnerability in MOVEit file-transfer software and acquired personal information.","supporting_quote":"On June 1, 2023, the Company learned unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","technology_involved":["Progress Software","MOVEit file transfer software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-14","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9044e68b377fb2fe247574081fcb721413b110ff","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Supplemental%20Regulatory%20Notification%204891-4706-1419%20v.5_0.pdf"},"notes":null,"org_country":"US","org_id":"7254a8a0bbd0","org_name":"Delta Dental of California","org_type":"financial","ransomware":null,"records_affected":33030,"reviewed":false,"root_cause":"A vulnerability in the MOVEit file-transfer software was exploited to access information on the platform.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582446"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Supplemental%20Regulatory%20Notification%204891-4706-1419%20v.5_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/DeltaDentalofCaliforniaandAffiliatesCompany.pdf"}],"summary":"Delta Dental of California reported that attackers exploited a vulnerability in MOVEit file-transfer software and acquired personal information from the platform.","supporting_quote":"On June 1, 2023, the Company learned unauthorized actors exploited a vulnerability affecting the MOVEit file transfer software application.","technology_involved":["MOVEit file-transfer software","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c7571f04f6e688d0054c7d1c2fe27202da705d9","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"ae3bf22e1a20","org_name":"DC Health Link","org_type":"government","ransomware":null,"records_affected":48145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DC Health Link","type":"hibp","url":"https://haveibeenpwned.com/Breach/DCHealth"}],"summary":"DC Health Link discovered a data breach in March 2023, and the exposed data was later posted to a data breach forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-14","discovered_date":"2023-05-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"83d420dd52fc42f785d36906d0bb67443d61be54","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Talus%20Pay%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d3dba38f4d56","org_name":"AMCP Payments Intermediate Company LLC","org_type":"financial","ransomware":null,"records_affected":7292,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AMCP%20Payments%20Intermediate%20Company%20LLC%20d/b/a%20Talus%20Pay-2023-12-14"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577925"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Talus%20Pay%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Talus%20Pay%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"An unauthorized actor accessed employee email accounts and may have accessed or acquired personal information stored in them.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"078b186da5e15974693f7ad0b722635e454ce2b8","impact_type":"unknown","incident_date":"2023-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/The%20Jacmar%20Companies%20Notice%20-%20SSN%20%5Bredacted%5D.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89d0c183c83e","org_name":"The Jacmar Companies, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577892"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de5bc39dc5f426b1fc9bcdeafc899ba32fe7921c","impact_type":"data_theft","incident_date":"2023-08-24","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a51e63ad0694","org_name":"TaxPlus","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577840"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice.pdf"}],"summary":"Hackers used stolen credentials to access TaxPlus’s tax preparation software and copy client data.","supporting_quote":"Despite multiple layers of security, the hackers were able to use stolen credentials to access and create copies of client data across a period of days from 8/24/23 to 8/26/23.","technology_involved":["tax preparation software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-13","discovered_date":"2023-08-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92f2934043ae17005d2c328f80567294c27af9b1","impact_type":"data_theft","imported_from":null,"incident_date":"2023-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/649016%20-%20PMH%20Breach%20Notification%20DRAFT.pdf"},"notes":null,"org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577827"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/649016%20-%20PMH%20Breach%20Notification%20DRAFT.pdf"}],"summary":"Prospect Medical reported unauthorized access to its IT environment and files containing information belonging to Humana Inc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Prospect Medical"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3d08d29af419","name":"Prospect Medical"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b7adbb7cb8e45da656c1b50bd2d561ddbc7065a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"80b3ac947ab0","org_name":"InflateVids","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: InflateVids","type":"hibp","url":"https://haveibeenpwned.com/Breach/InflateVids"}],"summary":"InflateVids suffered a data breach that exposed email addresses, usernames, IP addresses, genders and SHA-1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-12","discovered_date":"2023-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"760dd4ba10020631db032d611ba279493c19fa5c","impact_type":"unknown","incident_date":"2023-11-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6c2e6826b21","org_name":"Idaho National Laboratory operated by Battelle Energy Alliance, LLC","org_type":"unknown","ransomware":null,"records_affected":45047,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Idaho%20National%20Laboratory%20operated%20by%20Battelle%20Energy%20Alliance%2C%20LLC-2023-12-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-11","discovered_date":"2022-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"732bf5d22b6972fa605dc33a5b1fac72fe25857f","impact_type":"data_theft","incident_date":"2022-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TRISTAR%20Insurance%20Group%2C%20Inc.%20-%20CA%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"e8bf4659f327","org_name":"TRISTAR Insurance Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580348"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TRISTAR%20Insurance%20Group%2C%20Inc.%20-%20CA%20-%20Exhibit%20A.pdf"}],"summary":"TRISTAR reported unauthorized access to its email environment and systems, and said customer information may have been exfiltrated.","supporting_quote":null,"technology_involved":["email environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-11","discovered_date":"2023-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e18ed1bc09a0c01c92ee57cb703ff2e107d761f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-20","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pandol%20Brothers%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-CA-Exhibit%201_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"fd7e34036c8c","org_name":"Pandol Brothers, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577719"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pandol%20Brothers%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-CA-Exhibit%201_Redacted.pdf"}],"summary":"Pandol Brothers reported that files on its systems may have been accessed or copied without authorization, and that names and other information were affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-11","discovered_date":"2023-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"543b911950de5281f336cd9dee5c29ae2b0cee85","impact_type":"data_theft","incident_date":"2023-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27717.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1756d70cfe95","org_name":"Keenan & Associates","org_type":"professional_services","ransomware":null,"records_affected":5889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Keenan%20%26%20Associates-2024-01-26"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27717.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter%20-%20L01_Redacted.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27717.pdf"}],"summary":"Keenan & Associates reported that an unauthorized party accessed internal systems and obtained data containing personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-11","discovered_date":"2023-11-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda305c4550cbdfef3b252e27afeed3f5d8f662e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_35.pdf"},"notes":null,"org_country":"US","org_id":"7c286cb1dd61","org_name":"Idaho National Laboratory","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577728"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_35.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16070.pdf"}],"summary":"A breach at an off-site data center exposed personal and financial information concerning Idaho National Laboratory employees, former employees, spouses, and dependents.","supporting_quote":null,"technology_involved":["off-site data center"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb7e4bfe61230d62a02e0df07f695789ce369394","impact_type":"both","incident_date":"2023-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FWP%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"f58763442a30","org_name":"Florida Water Products","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577763"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FWP%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor may have accessed and acquired files from Florida Water Products’ legacy data repository, which was temporarily affected in availability and functionality.","supporting_quote":null,"technology_involved":["legacy data repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-12-11","discovered_date":"2023-08-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72531ba2b42d133be9234dfa2f08cf87be6d9c6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Supplemental%20Data%20Event%20-%20CareTree%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b87a294b87bd","org_name":"CareTree, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581016"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577738"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Supplemental%20Data%20Event%20-%20CareTree%20-%20CA_0.pdf"}],"summary":"CareTree reported that an unauthorized actor accessed limited information on its platform, potentially including personal, financial, and medical information.","supporting_quote":null,"technology_involved":["CareTree platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a4975d43cac0c743826052931f2e6f093758a6a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0cf495bd75e5","org_name":"Kaneva","org_type":"technology_saas","ransomware":null,"records_affected":3901179,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kaneva","type":"hibp","url":"https://haveibeenpwned.com/Breach/Kaneva"}],"summary":"Kaneva's breach exposed user records containing email addresses, usernames, dates of birth, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"001fd581b32302a76e2780ff2250f05baf5070ec","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"64c84fa6fbca","org_name":"Gemplex","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gemplex","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gemplex"}],"summary":"A February 2021 breach exposed Gemplex user account data, including names, contact details, device information, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-12-08","discovered_date":"2023-05-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"459c5453308352885602b25651a5635edaa3e45e","impact_type":"disruption_or_ransomware","incident_date":"2023-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Norton%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"92d655b6498e","org_name":"Norton Healthcare","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577640"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Norton%20-%20CA_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NortonHealthcareInc..pdf"}],"summary":"Norton Healthcare reported a ransomware incident in which an unauthorized individual accessed network storage devices and patient, employee, and dependent information may have been impacted.","supporting_quote":null,"technology_involved":["network storage devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48c2d5da5ffe2ce0732414662c6455e3d77afe92","impact_type":"data_theft","imported_from":null,"incident_date":"2022-11-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e04531f4d691","org_name":"Movie Forums","org_type":"other","ransomware":null,"records_affected":39914,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Movie Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/MovieForums"}],"summary":"A breach of the Movie Forums website exposed users’ personal information and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"LockBit Group","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-12-08","discovered_date":"2023-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acc640169934beb64613c0757284ff6a9e984262","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CVC%20Holding%20Corp%20-%20Sample%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b7257a709169","org_name":"CVC Holding Corp","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CVC%20Holding%20Corp%20-%20Sample%20Notification%20Letter_Redacted.pdf"}],"summary":"CVC reported that the LockBit Group may have accessed files containing personal and medical information during a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"lockbitgroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-12-08","discovered_date":"2023-04-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5142d4a569699755a6cc1cae4070b91b24d835cf","impact_type":"data_theft","incident_date":"2023-04-26","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Americold%20%E2%80%93%20CA%20Individual%20Notice%20Letters%20%E2%80%93%2012.8.23.pdf"},"notes":null,"org_country":"US","org_id":"a818b666172b","org_name":"Americold Logistics LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577648"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Americold%20%E2%80%93%20CA%20Individual%20Notice%20Letters%20%E2%80%93%2012.8.23.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Americold%20Logistics%20LLC-2023-12-08"}],"summary":"Americold reported that an unauthorized party removed data from its network, potentially including personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21fec9626d77537d6546917198963f6d9333cd06","impact_type":"data_theft","imported_from":null,"incident_date":"2019-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2904d341fc5f","org_name":"JoyGames","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JoyGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/JoyGames"}],"summary":"A data breach of the JoyGames website forum exposed email addresses, usernames, IP addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-07","discovered_date":"2023-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9ca314262079d09d1119c08810589a779f0d918","impact_type":"data_theft","incident_date":"2023-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Financial%20Risk%20Mitigation%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"dea7491bf13c","org_name":"Financial Risk Mitigation, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577567"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Financial%20Risk%20Mitigation%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Financial Risk Mitigation, Inc. reported unauthorized access to certain systems and said some files containing personal information were copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"8555679ec2205acd062a0fd918d555ffb2401c73","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"76b498b2818f","org_name":"LivaNova PLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1639691/000110465923123806/tm2332251d1_8k.htm"},{"fetched_at":null,"title":"8-K FORM 8-K","type":"sec_8k","url":"https://www.sec.gov/Archives/edgar/data/1639691/000110465923125585/tm2332716d1_8k.htm"}],"summary":"LivaNova reported that U.S. sites had largely returned to normal operations and that it had begun restarting European manufacturing sites following a cybersecurity incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"af6be18fc473d7a439c92624da8b6c5f8fb1cd07","impact_type":"data_theft","incident_date":"2023-11-02","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27188.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"32a4b8e04075","org_name":"Hi-School Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":3695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hi-School%20Pharmacy-2023-12-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27188.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27188.pdf"}],"summary":"Hi-School Pharmacy reported a computer network disruption during which personal information may have been acquired without authorization; the method of access was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-12-06","discovered_date":"2023-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f26bea5e1b07af79de24091e336107486488ead","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"8611d6b1df67","org_name":"Henry Schein, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577534"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian%20Sample.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/HenryScheinInc.pdf"}],"summary":"Henry Schein reported a cybersecurity incident that disrupted some business operations and may have exposed employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e12b74ab13dd02f9dc1eb14d2bb53e6ae341d7f","impact_type":"unknown","incident_date":"2023-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification%20Samples.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d8c0e54991a","org_name":"DePauw University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577537"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-05","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b876cb30ab99f74c51b47ee5f2560e78be56422","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_1_0.pdf"},"notes":null,"org_country":"US","org_id":"4d5751531773","org_name":"Welltok","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577467"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578029"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578388"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_1_0.pdf"}],"summary":"An unknown actor exploited software vulnerabilities to access Welltok’s MOVEit Transfer server and exfiltrate data on May 30, 2023.","supporting_quote":"On July 26, 2023, we were alerted to an earlier alleged compromise of our MOVEit Transfer server in connection with software vulnerabilities made public by the developer of the MOVEit Transfer tool.","technology_involved":["MOVEit Transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b8ae48e2f29e7150f9cd2938554d0b1aade28d0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"6fc32bf4aa2e","org_name":"RailYatri","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RailYatri","type":"hibp","url":"https://haveibeenpwned.com/Breach/RailYatri"}],"summary":"RailYatri reported a December 2022 data breach exposing customer contact details, names, genders, and ticket purchase information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-12-05","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a214d496a2f90db7a620a33f480e57928c344c39","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16399.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbb721459229","org_name":"Elixir RX Solutions","org_type":"healthcare","ransomware":null,"records_affected":544,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16399.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16399.pdf"}],"summary":"An unknown actor exploited software vulnerabilities to access Elixir RX Solutions’ MOVEit Transfer server and exfiltrate data.","supporting_quote":"our investigation determined on August 11, 2023 that an unknown actor exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96f4a6d0a8e6bf8071cea4d1e26e9839cbbd685e","impact_type":"unknown","incident_date":"2022-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_AG_Notice_-_General_32935534v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6dd78826a2ae","org_name":"Advantis Global, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577456"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-04","discovered_date":"2023-02-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47687bf32719e619cdde88a41ff5934488d78587","impact_type":"disruption_or_ransomware","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TPHS-_CA_Sample_Letter_Redacted_32930685v1.pdf"},"notes":null,"org_country":"US","org_id":"2360f1534d02","org_name":"Troutman Pepper Hamilton Sanders LLP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577407"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TPHS-_CA_Sample_Letter_Redacted_32930685v1.pdf"}],"summary":"Troutman Pepper detected unauthorized network access in a ransomware incident that resulted in exposure of data it maintained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b6219e8317e906e208a5a2e8497d99705a74739","impact_type":"unknown","incident_date":"2023-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Taylor_U%20Redacted%20Notice%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29a505b9449b","org_name":"Taylor University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577415"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27177.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-12-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afb9dae2f3d8533be24429dc54a55fcb66df1d10","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PALIG%20MOVEit%20Indiv%20Notice%20Letter%20-%20Sample%20-%20California.pdf"},"notes":null,"org_country":"US","org_id":"e66651c0fbb2","org_name":"Pan-American Life Insurance Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to take files containing personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PALIG%20MOVEit%20Indiv%20Notice%20Letter%20-%20Sample%20-%20California.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pan-American%20Life%20Insurance%20Group-2023-12-04"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to take files containing personal information from Pan-American Life Insurance Group.","supporting_quote":"Our investigation revealed that an unauthorized third party used the vulnerability in MOVEit to take files that contain personal information, including yours.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2023-12-04","discovered_date":"2022-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0c55243e2d81ddc8a622555f12913f6d6aeb8ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gunster%20-%20California%20Appendix.pdf"},"notes":null,"org_country":"US","org_id":"9778753a6483","org_name":"Gunster, Yoakley & Steward, PA","org_type":"professional_services","ransomware":null,"records_affected":8605,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577421"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gunster%20-%20California%20Appendix.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gunster%2C%20Yoakley%20%26%20Steward%2C%20PA-2023-12-04"}],"summary":"Gunster detected unauthorized access to its document management file system, where files contained personal, financial, medical, and credential information.","supporting_quote":null,"technology_involved":["document management file system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-04","discovered_date":"2022-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d3512f3dc14e42b59c44bb9d4449a8643504dbc","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4%20Over%2C%20LLC%20-%20Notice%20of%20Data%20Event-%20CA-Exhibit%201.pdf"},"notes":null,"org_country":"US","org_id":"2d2d97de19e7","org_name":"4 Over LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4%20Over%2C%20LLC%20-%20Notice%20of%20Data%20Event-%20CA-Exhibit%201.pdf"}],"summary":"4 Over reported that certain files on its systems may have been accessed or copied without authorization between November 16 and November 19, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58d067024e46bf24613fd0f4b31c0d8d5c8e952c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f93db048ecb8","org_name":"SoarGames","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SoarGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/SoarGames"}],"summary":"A breach at SoarGames exposed user email addresses, IP addresses, usernames and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["gaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-12-02","discovered_date":"2023-11-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"763ce45a613664a7100f6cb878a57160a460334e","impact_type":"unknown","incident_date":"2023-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5ba4a313afe","org_name":"•\tNeuromusculoskeletal Center of the Cascades, PC","org_type":"unknown","ransomware":null,"records_affected":22796,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#%E2%80%A2%09Neuromusculoskeletal%20Center%20of%20the%20Cascades%2C%20PC-2023-12-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2023-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3674a95a29d049fa719d097994cc12bfee1a7621","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27154.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"baa7ff322865","org_name":"Washington State Employees Credit Union  (WSECU)","org_type":"unknown","ransomware":null,"records_affected":1216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27154.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2023-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0569df80aed3bfddaca7deee52266643944b9687","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6994E65-5EB6-449B-BEAC-6EB48A1BB4EF"},"incident_date":"2023-12-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0943af7dff72","org_name":"General Informatics LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govtech.com/security/louisiana-fire-district-sues-cybersecurity-firm-after-hack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theadvocate.com/baton_rouge/news/courts/st-george-fire-general-informatics-hack/article_832a6a0a-749f-4842-9eec-0f00da998be6.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.firerescue1.com/cybersecurity/la-fd-sues-cybersecurity-firm-after-hackers-infiltrate-network;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wbrz.com/news/st-george-fire-sues-cybersecurity-company-alleging-negligence-left-network-open-to-2023-cyberattack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wafb.com/2026/06/09/st-george-fire-district-sues-it-company-over-cyberattack/"}],"summary":"Attackers compromised the network of General Informatics, a Baton Rouge IT/cybersecurity managed-services firm, by way of remote-access credentials the firm reused across multiple clients and kept using after learning in November 2023 they were breached. Using the shared access a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-11-30","discovered_date":"2023-10-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8593b92a9e0f17c8b36ca86df797df97dde3bd31","impact_type":"data_theft","incident_date":"2021-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Valrhona_ALL%20STATES%2012%20months.pdf"},"notes":null,"org_country":"US","org_id":"cfa2ec536303","org_name":"Valrhona Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577291"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Valrhona_ALL%20STATES%2012%20months.pdf"}],"summary":"Valrhona reported that malicious software on its website collected customer credit card information from its payment portal.","supporting_quote":null,"technology_involved":["Valrhona Chocolate website","payment portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-30","discovered_date":"2023-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60fa901ecc45b884359356d90e1ee4ef02241fff","impact_type":"data_theft","incident_date":"2023-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Livermore%20Amador%20Valley%20Transit%20Authority%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"f25138631702","org_name":"Livermore Amador Valley Transit Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577264"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Livermore%20Amador%20Valley%20Transit%20Authority%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Livermore Amador Valley Transit Authority reported that personal and medical information was accessed without authorization and potentially taken from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b84d9d0c36af0e2cac01a99ae5d0c44970457e9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-19683%20KNCH%20AD%20No%20CM%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"d7dc199d6dba","org_name":"Koeller Nebeker Calrson & Haluk LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577284"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-19683%20KNCH%20AD%20No%20CM%20r2prf.pdf"}],"summary":"Koeller Nebeker Calrson & Haluk LLP reported unauthorized access to data accessible through one user's device.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85a607c154be53fba9a140a4bc3eaab6b1dc3cf8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"c213a7baec8b","org_name":"Go Ninja","org_type":"other","ransomware":null,"records_affected":4999001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Go Ninja","type":"hibp","url":"https://haveibeenpwned.com/Breach/GoNinja"}],"summary":"Go Ninja suffered a data breach that exposed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a455b033437717e3f5f24f9d2b25789f08f979a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Aetna%20Life%20Insurance%20Company-Supplemental%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"019b3669ffff","org_name":"Aetna Life Insurance","org_type":"unknown","ransomware":null,"records_affected":5202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Aetna%20Life%20Insurance%20Company-Supplemental%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38f3fb370a4688590d2e92dda67a0ab15bbc114a","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BR","org_id":"479208399a7a","org_name":"Estante Virtual","org_type":"retail_ecommerce","ransomware":null,"records_affected":5412603,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Estante Virtual","type":"hibp","url":"https://haveibeenpwned.com/Breach/EstanteVirtual"}],"summary":"Estante Virtual suffered a data breach in February 2019 that exposed customer personal information and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acbb011f748e52ae67aa30aa8901ac1a41d3f782","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bb5db5f645ed","org_name":"Bleach Anime Forum","org_type":"other","ransomware":null,"records_affected":143711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bleach Anime Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/BleachAnime"}],"summary":"The Bleach Anime Forum breach exposed usernames, email addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-28","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33b20cd47e6ccec232802fbf4bc8cb347de71447","impact_type":"unknown","incident_date":"2023-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MidwestGaming%26EnterainmentLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cca29353976e","org_name":"Midwest Gaming & Entertainment, LLC.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/MidwestGaming%26EnterainmentLLC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16004.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Midwest%20Gaming%20%26%20Entertainment%2C%20LLC-2023-12-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":"2023-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5bd80b76b732089779c23311667716834ca55ffc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27109.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1763f402076e","org_name":"Zeroed-In Technologies, LLC","org_type":"unknown","ransomware":null,"records_affected":61088,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27109.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27109.pdf"}],"summary":"Zeroed-In Technologies discovered suspicious activity affecting certain systems, where an unauthorized actor had access and personal information was present.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":"2023-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c10491f67c72dbaa09da1793e3281c2b6e1fc0e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Zeroed%20In%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"1763f402076e","org_name":"Zeroed-In Technologies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Zeroed%20In%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Zeroed-In%20Technologies%2C%20LLC-2023-11-27"}],"summary":"Zeroed-In Technologies discovered unauthorized access to certain systems, where personal information including names, dates of birth, and Social Security numbers was present.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7becd8bfa1f49bcbbc101291f96a8e67007b2cca","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27105.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1bea02c40e6e","org_name":"World Learning, Inc.","org_type":"unknown","ransomware":null,"records_affected":1331,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27105.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27105.pdf"}],"summary":"World Learning discovered unauthorized access to certain systems, where information relating to affected individuals may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b00f027540158f3bb8e550acc717cc728a0bd4f","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/State%20of%20Maine_Notice%20Template_CM.pdf"},"notes":null,"org_country":"US","org_id":"2707098bb1c5","org_name":"State of Maine","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A software vulnerability in MOVEit was exploited to access and download files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577070"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/State%20of%20Maine_Notice%20Template_CM.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27009.pdf"}],"summary":"A vulnerability in the State of Maine’s MOVEit server was exploited to access and download files belonging to certain state agencies.","supporting_quote":"As it pertains to the State, the software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28, 2023, and May 29, 2023.","technology_involved":["MOVEit","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8c2aa81e1cc6387c3e69637209789fd8e697e04","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ThePinalCountySuperintendentsOffice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"997dc941b690","org_name":"Pinal County Superintendent's Office","org_type":"unknown","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ThePinalCountySuperintendentsOffice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e62d5734ad193b56d058e0346bedb07f70844b02","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nonstop%20Admin%20-%20LifeLong%20-%20CA%20Cover%20Letter%20-%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"48f7c4246479","org_name":"Nonstop Administration and Insurance Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577042"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nonstop%20Admin%20-%20LifeLong%20-%20CA%20Cover%20Letter%20-%20FINAL_0.pdf"}],"summary":"An unknown party accessed Nonstop’s cloud services platform without authorization on December 22, 2022, and the investigation could not rule out access to specific information.","supporting_quote":null,"technology_involved":["cloud services platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"432d4fe69c704e453e46c4a28c6d0d0b42dd99c2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/KyoceraAVXComponentsCorp.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f173993d47f","org_name":"Kyocera AVX Components","org_type":"unknown","ransomware":null,"records_affected":1844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/KyoceraAVXComponentsCorp.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d064c6e5f73801754d23ca1bbeb79c9bc935d014","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ID","org_id":"ba77eae530d8","org_name":"Jam Tangan","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Jam Tangan","type":"hibp","url":"https://haveibeenpwned.com/Breach/JamTangan"}],"summary":"Jam Tangan suffered a data breach in July 2021 that exposed customer records, including personal information and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1fd2718b9fdcf9e0cf82ae51399c76387b7ad5b","impact_type":"data_theft","imported_from":null,"incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ID","org_id":"95d396a653c3","org_name":"IndiHome","org_type":"telecom","ransomware":null,"records_affected":12629245,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: IndiHome","type":"hibp","url":"https://haveibeenpwned.com/Breach/IndiHome"}],"summary":"Data allegedly sourced from IndiHome was posted to a hacking forum and included personal information such as email addresses, names, IP addresses, genders and geographic locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f9c68524e70d7c8472e5e116ad9e9eeccceae9d7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheCharlesLeaCenter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7f85b0161420","org_name":"Charles Lea Center","org_type":"unknown","ransomware":null,"records_affected":2286,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheCharlesLeaCenter.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1a7448d7fef71162f210fb09c0afab4414ffd57","impact_type":"unknown","incident_date":"2023-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42811d7_AlpsAlpine_L01_SAS_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0af94d31d1bb","org_name":"Alps Alpine North America, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577029"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"062c30bd48dfe6ccfcc4cd2a0fc75703422b935b","impact_type":"data_theft","imported_from":null,"incident_date":"2023-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"dca6f4137355","org_name":"KitchenPal","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KitchenPal","type":"hibp","url":"https://haveibeenpwned.com/Breach/KitchenPal"}],"summary":"A breach of KitchenPal exposed data from a staging environment, including personal information and bcrypt password hashes.","supporting_quote":null,"technology_involved":["staging environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-22","discovered_date":"2023-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0d3c7c61a8fa12a671caeaa1a15e21d5d03dc8b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rivers%20Casino%20-%20CA%20AG%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"d728000a9ef2","org_name":"Rivers Casino Des Plaines","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576965"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rivers%20Casino%20-%20CA%20AG%20Notice%20Letter_0.pdf"}],"summary":"Rivers Casino Des Plaines reported that files containing personal information may have been accessed or removed following unauthorized access to its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-22","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e484146f6e72b9bda09b9b2d10ceea2e36a09d1b","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27099.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9e37ed568869","org_name":"Graphic Packaging International","org_type":"manufacturing","ransomware":null,"records_affected":554,"reviewed":false,"root_cause":"The MOVEit Transfer server was compromised in connection with publicly disclosed software vulnerabilities.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27099.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27099.pdf"}],"summary":"An unknown actor accessed Graphic Packaging International's MOVEit Transfer server through vulnerabilities and exfiltrated data.","supporting_quote":"On July 26, 2023, we were alerted to an earlier alleged compromise of our MOVEit Transfer server in connection with software vulnerabilities made public by the developer of the MOVEit Transfer tool.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2023-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3862fce2972c52e53c797322177c996acf34006","impact_type":"both","imported_from":null,"incident_date":"2023-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20-%20Brodart%201-year_Personal_Info_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"38bd8cf2447f","org_name":"Brodart Co.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576917"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20-%20Brodart%201-year_Personal_Info_Redacted_0.pdf"}],"summary":"Brodart reported a malware-related data security attack that caused an outage and resulted in personal and financial information being accessed and disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcefc39e60bb2655a7bb958d96d24c73a165e9ca","impact_type":"unknown","incident_date":"2023-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Big_Brothers_Big_Sisters_of_America_-_Notice_to_CA_AG_32892762v1_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d479470326e4","org_name":"Big Brothers Big Sisters of America","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576946"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27095.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-11-21","discovered_date":"2023-03-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfb9036891b9a0773be3b39dfdbf6788fa361ec9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sierra%20Notice%20Template%20CM%20.pdf"},"notes":null,"org_country":"US","org_id":"5383c72c1980","org_name":"Sierra County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sierra%20Notice%20Template%20CM%20.pdf"}],"summary":"Sierra County reported that a cybersecurity incident may have exposed personal information, with no evidence that the information was used for fraud or identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-21","discovered_date":"2023-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e79d6179dbc9a70cbcc0667fc5572da85dfe46b","impact_type":"data_theft","incident_date":"2023-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NSC%20Technologies%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9604226b8744","org_name":"NSC Technologies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NSC%20Technologies%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27085.pdf"}],"summary":"NSC Technologies reported that an unauthorized actor likely acquired files containing personal information from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c1433154703e481d0d8e5002c489014ea7ae953","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Hejaz%20Shrine%20Circus.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"857b51d37c30","org_name":"Hejaz Shrine Circus","org_type":"unknown","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Hejaz%20Shrine%20Circus.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7d56686c601c9e466c7a816bd1051c6f386e34f7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/EnstarInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"925ee1c8b9b3","org_name":"Enstar, Inc.","org_type":"unknown","ransomware":null,"records_affected":1274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/EnstarInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b27e65aa5f5d6b4d348711b882ecfc335aa3c00c","impact_type":"unknown","incident_date":"2023-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MVH%20-%20California%20Notification_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7ed448a5770f","org_name":"Deanco Healthcare LLC dba Mission Community Hospital","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576874"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-21","discovered_date":"2023-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d24b3fc4e41ab661e447b3be650d7ce0f508cdf6","impact_type":"both","incident_date":"2022-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSLAC%20Policyholder%20Notice_0_0.pdf"},"notes":null,"org_country":"US","org_id":"74ff1e53a424","org_name":"Clear Spring Life and Annuity Insurance Company","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576841"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576839"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSLAC%20Policyholder%20Notice_0_0.pdf"}],"summary":"Clear Spring Life and Annuity Insurance Company reported ransomware on its infrastructure and unauthorized access to and acquisition of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2023-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"18e0a76d05aa847532cb04d46fa9221cd62d86ea","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-11","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27075.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"98abb88c58ff","org_name":"Proliance Surgeons","org_type":"healthcare","ransomware":null,"records_affected":329291,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27075.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27075.pdf"}],"summary":"Proliance Surgeons reported potential unauthorized access to or acquisition of files from its network on February 11, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a69c465e5cb4bb915de3d9c6fd3136c1187275c","impact_type":"data_theft","imported_from":null,"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c7cdb2e7f287","org_name":"OMGPOP","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OMGPOP","type":"hibp","url":"https://haveibeenpwned.com/Breach/OMGPOP"}],"summary":"A breach of OMGPOP exposed email addresses and plain-text passwords, which were later leaked in 2019.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-20","discovered_date":"2023-07-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a814616a9362ddc3264865fd207e40528b78bdae","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15946.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"26bec3eb487e","org_name":"MasTec, Inc.","org_type":"other","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15946.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15946.pdf"}],"summary":"MasTec, Inc. reported that personal information belonging to Plan members was downloaded from Delta Dental’s MOVEit application by an unauthorized actor.","supporting_quote":"We recently learned that a vendor to the Plan, Delta Dental, experienced a security incident involving the MOVEit file transfer application used by Delta Dental in its provision of administrative services for the Plan.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Delta Dental"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"fcc9b32ceaee","name":"Delta Dental"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f07269629d45741506f12e0d2537ee5a7d2bb0b5","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok-International%20Paper%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ec06acac20b6","org_name":"International Paper","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software's MOVEit Transfer software was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576801"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok-International%20Paper%20Consumer%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27055.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in Progress Software's MOVEit Transfer software and exfiltrated data that included International Paper participants' personal information.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer tool, disclosed that a vulnerability in their software had been exploited by an unauthorized actor.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-20","discovered_date":"2023-10-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"2451f0d26d09bacbde8215c8e15bc3417c0a1cb1","impact_type":"unknown","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://oag.ca.gov/system/files/Enstar%20%28US%29%20Inc.%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5bb36e01fb5","org_name":"Enstar (US), Inc.","org_type":"unknown","ransomware":null,"records_affected":75101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Enstar%20%28US%29%2C%20Inc.-2024-05-03"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584833"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576823"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578349"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5053ccec504f0c7e62f817003bca9bb9d2327088","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AZ_Individual%20Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"232ef0be538b","org_name":"AutoZone, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability associated with MOVEit.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576800"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AZ_Individual%20Notice%20Letter%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AutoZone%2C%20Inc.-2023-11-21"}],"summary":"An unauthorized third party exploited a MOVEit vulnerability and exfiltrated data from an AutoZone system supporting the application.","supporting_quote":"AutoZone became aware that an unauthorized third party exploited a vulnerability associated with MOVEit and exfiltrated certain data from an AutoZone system that supports the MOVEit application.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03a2c0c709c4e5adf6217b6042dd327b824073db","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SBHC%20-%20General%20Notice%20Letter%20Proof%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"383465de8ebb","org_name":"Southwest Behavioral Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576762"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SBHC%20-%20General%20Notice%20Letter%20Proof%20FINAL.pdf"}],"summary":"Southwest Behavioral Health Center reported that a cybersecurity attack may have affected personal and medical information of some clients, patients, and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-18","discovered_date":"2023-08-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"89edfaf2e6681e72dd07fbd9c6a5423d521431fc","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27060.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4d5751531773","org_name":"Welltok","org_type":"technology_saas","ransomware":null,"records_affected":1606,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities on the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27060.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27060.pdf"}],"summary":"An unknown actor exploited vulnerabilities in Welltok's MOVEit Transfer server and exfiltrated personal and medical data.","supporting_quote":"our investigation determined on August 11, 2023, that an unknown actor exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-17","discovered_date":"2023-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06cd8da03fc27bce9e6e4088551b7ecf7ea9cf65","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"4d5751531773","org_name":"Welltok, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576748"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Welltok%2C%20Inc.-2023-11-18"}],"summary":"Welltok reported that an unknown actor exploited vulnerabilities in its MOVEit Transfer server and exfiltrated personal and medication information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-17","discovered_date":"2023-06-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f431b0206d213b0f340b46188e500432264ed5c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08137_PahlMcCay_Notice_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"180d3c6b6f13","org_name":"Pahl & McCay","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576749"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/csi.edtout.dgk10525.DB08137_PahlMcCay_Notice_Redacted_0.pdf"}],"summary":"Pahl & McCay reported unauthorized access to several corporate email accounts, and personal information may have been present in them.","supporting_quote":null,"technology_involved":["corporate email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-11-17","discovered_date":"2023-08-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5b093dab6815702abd09d13adbeb990b477444b8","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27052.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1d9811f71350","org_name":"Medical Eye Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2962,"reviewed":false,"root_cause":"An unauthorized third party exploited an unknown vulnerability in MOVEit's system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27052.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27052.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in a vendor’s MOVEit server and exfiltrated information associated with Medical Eye Services, Inc.","supporting_quote":"On August 23, 2023, Blue Shield’s vendor discovered that an unauthorized third party had accessed information on its MOVEit server by exploiting an unknown vulnerability in MOVEit’s system.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-17","discovered_date":"2023-08-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df976abc23be207c72f14527ca5c94ed2e8cbf97","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_Notification_11-15-2023.pdf"},"notes":null,"org_country":"US","org_id":"15865ff8805e","org_name":"Gerber Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual accessed information on the MOVEit server by exploiting a vulnerability in MOVEit's system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576675"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_Notification_11-15-2023.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GerberLifeInsuranceCompany.pdf"}],"summary":"Information about Gerber Life Insurance Company plan members was exfiltrated from MESVision’s MOVEit server after an attacker exploited a vulnerability.","supporting_quote":"On August 23, 2023, MESVision discovered that an unauthorized individual had accessed information on its MOVEit server by exploiting a vulnerability in MOVEit’s system.","technology_involved":["MOVEit SFTP server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MESVision"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7c72134bef74","name":"MESVision"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47e6dd3c7af6d7ee7191006d37b442ac90f29ed1","impact_type":"data_theft","incident_date":"2023-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Systems%20East%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"82167319ab2a","org_name":"Systems East, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Systems%20East%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Systems%20East%2C%20Inc.-2023-11-16"}],"summary":"An unknown individual accessed Systems East, Inc.'s systems and copied an encrypted database file containing names and payment card information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34f143a3347bcaf0d0590e47aa5c93ff7b044c26","impact_type":"unknown","incident_date":"2023-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Rusnak_-_redaction_32855038v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da2b94060890","org_name":"Rusnak","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576669"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18c03c71006d270f58db91fd54c1d0d81e8a3a28","impact_type":"unknown","incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Westside_Community_Services_-_SSN_%5Bredacted%5D_32863494v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85923b3bfeb5","org_name":"Westside Community Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576551"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-15","discovered_date":"2023-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0487ae44e4dbdf0f30d2214838b7afa9f2d1a249","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stanley%20Steemer%20International%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b95a739d3882","org_name":"Stanley Steemer International, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576569"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577414"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stanley%20Steemer%20International%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27018.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Stanley%20Steemer%20International%2C%20Inc.-2023-11-15"}],"summary":"Stanley Steemer reported unauthorized access to its network and identified files containing information related to affected individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-15","discovered_date":"2023-08-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8d13adec6d6ac5f30af4d9993b66dda7aa0cae6","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27016.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1d9811f71350","org_name":"Medical Eye Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":35746,"reviewed":false,"root_cause":"An unauthorized individual exploited a vulnerability in MOVEit’s system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27016.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27016.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in Medical Eye Services’ MOVEit server and exfiltrated information about vision benefit plan enrollees.","supporting_quote":"MESVision discovered that an unauthorized individual had accessed information on its MOVEit server by exploiting a vulnerability in MOVEit’s system.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60b25ca7ed476b0f7b51512faad0f71419de66fc","impact_type":"data_theft","incident_date":"2023-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AUA%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"b44705d125f3","org_name":"American University of Antigua College of Medicine","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576559"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AUA%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor accessed and acquired files from the college’s computer systems between August 30 and September 6, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-14","discovered_date":"2023-08-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce0401c17d4bfd2c3222b77b2b6668cf470ae0c0","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MES%202%20-%20Individual%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"1d9811f71350","org_name":"Medical Eye Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual exploited a vulnerability in MOVEit’s system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580194"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576536"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576743"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MES%202%20-%20Individual%20Notice%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medical%20Eye%20Services%2C%20Inc.-2023-11-14"}],"summary":"Medical Eye Services reported that an unauthorized individual exploited a vulnerability in its MOVEit server and exfiltrated information.","supporting_quote":"MESVision discovered that an unauthorized individual had accessed information on its MOVEit server by exploiting a vulnerability in MOVEit’s system.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"480b4cfd0ea1b0ee22632eaec36bc92444a0b11f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"MA","org_id":"ef4bd14904cf","org_name":"Avito","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Avito","type":"hibp","url":"https://haveibeenpwned.com/Breach/Avito"}],"summary":"A November 2022 data breach exposed personal information of Avito customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-13","discovered_date":"2023-09-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"426531780e20e6cd0d4a34bf18c9e8afdfd0cf1f","impact_type":"unknown","incident_date":"2023-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d7c2cfa3e0f","org_name":"MD2 International","org_type":"unknown","ransomware":null,"records_affected":364,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MD2%20International-2023-11-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-13","discovered_date":"2023-10-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"40a95871f61a34d9a09865682acc45f1c2e0e448","impact_type":"unknown","incident_date":"2023-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"90f48bb5df3f","org_name":"International Association of Sheet Metal Air Rail Transportation Workers","org_type":"unknown","ransomware":null,"records_affected":62939,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Association%20of%20Sheet%20Metal%20Air%20Rail%20Transportation%20Workers-2023-11-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-11-10","discovered_date":"2023-10-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80a507600dbdf6ad1d1e41109311e665a34615c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SIS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a94b98fd395e","org_name":"Southland Integrated Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SIS%20-%20California%20Notification.pdf"}],"summary":"Southland Integrated Services identified unauthorized access to its computer network, during which some documents were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-11-10","discovered_date":"2023-10-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2cb04bf741a06d9087bf6136d238b8ff4a904f55","impact_type":"data_theft","incident_date":"2023-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26988.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"81049f4b422a","org_name":"Seattle Housing Authority","org_type":"government","ransomware":null,"records_affected":32007,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26988.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26988.pdf"}],"summary":"Seattle Housing Authority reported that an unknown actor accessed its systems and took or viewed files containing personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3b96d8ad9fd48b0ff5fa139990c0cc5d737d2f9","impact_type":"unknown","incident_date":"2023-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SMART%20-%20Regulatory%20Notice_CA_Consumer_Combined_0.pdf"},"notes":null,"org_country":"US","org_id":"b1b13509c15b","org_name":"International Association of Sheet Metal, Air, Rail and Transportation Workers","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SMART%20-%20Regulatory%20Notice_CA_Consumer_Combined_0.pdf"}],"summary":"SMART reported that certain data may have been acquired without authorization and that some individuals’ information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad544b99bb1f65a0d9661d697637a216e1f51452","impact_type":"data_theft","imported_from":null,"incident_date":"2023-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fd807ef3142f","org_name":"Chess.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chess.com (2023)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Chess"}],"summary":"Over 1.27 million records scraped from the Chess.com website were posted to a hacking forum.","supporting_quote":null,"technology_involved":["Chess.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-09","discovered_date":"2023-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14970c4431b0ea8e4990ed4623c70469977c2b52","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Refresco-Letter-US_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"d42028ee1ecb","org_name":"Refresco Beverages US Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Refresco-Letter-US_Redacted_0.pdf"}],"summary":"Refresco reported unauthorized third-party access to portions of its North American systems, potentially affecting employees’ and dependents’ personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-09","discovered_date":"2023-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e23a785717fb1d1d21b35858476d75e16764e12","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McLaren%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2472bf464e2a","org_name":"McLaren Health Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McLaren%20-%20Notice%20of%20Data%20Breach%20-%20CA_0.pdf"}],"summary":"McLaren Health Care reported unauthorized access to its network and said potentially impacted files may have contained personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-11-09","discovered_date":"2023-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d81d7ca225a464e2c8eddf2589442bd50bbfe34","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Data%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c6007e39edbe","org_name":"Lobel Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"CBIZ experienced unauthorized access through the MOVEit zero-day vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576333"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Data%20Breach%20Notification.pdf"}],"summary":"Lobel Financial Corporation reported that information in files affected by unauthorized access to its supplier CBIZ through the MOVEit zero-day vulnerability included personal and financial information.","supporting_quote":"CBIZ experienced unauthor ized access as a result of this vulnerability.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9193a0a3e5ca97fa0266a91c7105fe01eb82c0b","impact_type":"unknown","incident_date":"2023-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ELN-19846%20Hill%20Intl%20Ad%20r4prf.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91714a404056","org_name":"Hill International, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576299"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42f4bea0cc87344a5b1d2eb66c959ccb8f953a4a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Patients_Rev1.pdf"},"notes":null,"org_country":"US","org_id":"a5f9fead0dbb","org_name":"Western Washington Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576241"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Patients_Rev1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26960.pdf"}],"summary":"Western Washington Medical Group reported that an unauthorized party may have accessed personal information during a network security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dc2897248c44b28c2ad14c7a917dc8153d67e2a","impact_type":"unknown","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MoveIT_Kirkland_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a37675fe2bb7","org_name":"Riverside County Office of Education","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576190"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4688f490dd8df9548521a112342320a24f2fc007","impact_type":"unknown","incident_date":"2023-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pacific%20Union%20College%20-%20SSN%20%5Bredacted%5D%2832825403.1%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d66704799064","org_name":"Pacific Union College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576181"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20Union%20College-2023-11-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28f353d88b1a71bde49ac17f01e518d497ee9aba","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Sun%20Life%20Supplemental%20AG%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f63e3b1f663e","org_name":"Sun Life Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software allowed unauthorized access to a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576152"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Sun%20Life%20Supplemental%20AG%20Notice_0.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a Sun Life-related server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-11-05","discovered_date":"2023-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a00af5ac6881e689eb2f9aa3ae232e3b387c584e","impact_type":"both","incident_date":"2023-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-19913%20Growers%20Express%20LLC%20Ad%20CM%202Y%201BM%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"1b3cdd2d5214","org_name":"Growers Express, LLC","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576114"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-19913%20Growers%20Express%20LLC%20Ad%20CM%202Y%201BM%20r1prf.pdf"}],"summary":"Growers Express reported that attackers accessed former employees’ personal information and exfiltrated data in an incident involving an extortion attempt.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b62ee5af90662a29e2845a4db40b9cbd86faf2d5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"9dcd391b3672","org_name":"GamingMonk","org_type":"technology_saas","ransomware":null,"records_affected":654510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GamingMonk","type":"hibp","url":"https://haveibeenpwned.com/Breach/GamingMonk"}],"summary":"A December 2020 breach exposed GamingMonk users’ email addresses, names, usernames, phone numbers, dates of birth and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-03","discovered_date":"2023-07-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a7edecdcccaf14fba775824a114a1169e3c876d","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welltok%20Patient%20Notification%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited software vulnerabilities in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576106"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welltok%20Patient%20Notification%20Letter_Redacted.pdf"}],"summary":"An unknown actor exploited vulnerabilities in the MOVEit Transfer server and exfiltrated data related to Sutter Health.","supporting_quote":"our investigation determined on August 11, 2023 that an unknown actor exploited software vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-03","discovered_date":"2023-05-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96ee290a55febf05be0d85675aa3d662fde51b3a","impact_type":"data_theft","incident_date":"2023-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26929.pdf"},"notes":null,"org_country":"US","org_id":"c0a87caddb75","org_name":"Perry Johnson & Associates","org_type":"professional_services","ransomware":null,"records_affected":1013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26929.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26929.pdf"}],"summary":"Perry Johnson & Associates reported that an unauthorized party accessed its systems and downloaded files containing Northwell patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-03","discovered_date":"2023-05-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"3891648bc3271dfdc7f95b03d34cb04f643f3431","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB08366-PJA-SBC-L01-adult_v5__.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c0a87caddb75","org_name":"Perry Johnson & Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":3891565,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perry%20Johnson%20%26%20Associates%2C%20Inc.%20%28PJ%26A%29-2023-11-03"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580550"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580744"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB08366-PJA-SBC-L01-adult_v5__.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/PerryJohnson%26Associates.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB08366-PJA-SBC-L01-adult_v5__.pdf"}],"summary":"Perry Johnson & Associates reported unauthorized access to systems and personal health information, including information in a database.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-03","discovered_date":"2023-10-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4084e7e6ea41ae26a63e89558ce9af92677b0456","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"00843b03a7f6","org_name":"Oregon Public Employees Retirement System","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Public%20Employees%20Retirement%20System-2023-11-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e78824453e043d5a14c9c21f3612e62277d49da","impact_type":"unknown","incident_date":"2023-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ELN-19892%20Life%20Generations%20Ad%20CM%201y%20Temp%20A%20r3prf.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9257f0ee8e82","org_name":"Life Generations Healthcare LLC (\"LGH\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576077"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"513e18a10c09e87e02512d0197277d72ff3da00c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26923.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"66897bf00052","org_name":"Holiday by Atria","org_type":"healthcare","ransomware":null,"records_affected":656,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26923.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26923.pdf"}],"summary":"An unauthorized party accessed two Holiday by Atria employees’ email accounts, which may have exposed emails and attachments containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c70098ee09a9b45a2aedeb7dffef35f97956ae21","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheHilbGroupOperatingCompanyLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9adc5e563df5","org_name":"Hilb Group Operating Company, LLC.","org_type":"unknown","ransomware":null,"records_affected":6254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheHilbGroupOperatingCompanyLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6142ffa6505f51e2579f5e64e6648a28e5518600","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"fa93daed506d","org_name":"Fitmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":214492,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fitmart","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fitmart"}],"summary":"Data from Fitmart, including email addresses and plain-text passwords, was obtained in October 2021 and later redistributed online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-11-03","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"981dcffef9ef6fbea02fdde61ce333e468522e8b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AlohaCare%20-%20CA%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"80b821918604","org_name":"AlohaCare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AlohaCare%20-%20CA%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"AlohaCare learned on May 31, 2023, that it was part of an incident involving the MOVEit file transfer tool, and determined that personal information may have been impacted.","supporting_quote":"The incident was called a \"zero-day vulnerability.\"","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fa12af6b29bfd098d6d5121a139d6a8fc8958bb","impact_type":"unknown","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DB08072-Hilb1-letter-Individual_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"54867b9d61e2","org_name":"The Hilb Group Operating Company, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576009"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-11-01","discovered_date":"2023-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e6699f28eba79a96294eefe762d2f3e2b33697f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Okta%20-%20Individual%20Notice%20%28General%29.pdf"},"notes":null,"org_country":"US","org_id":"de33bfdeb201","org_name":"Okta","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Okta%20-%20Individual%20Notice%20%28General%29.pdf"}],"summary":"An unauthorized actor accessed an eligibility census file maintained by Rightway for Okta, containing personal and health insurance information.","supporting_quote":null,"technology_involved":["Rightway","eligibility census file"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Rightway"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"c477d69afa2b","name":"Rightway"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-11-01","discovered_date":"2023-03-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0df8174eaab48e41bf968d3b9013033be4380817","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-21","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26907.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"faa1dcff6122","org_name":"Mt. Hood Meadows Oreg LLC","org_type":"other","ransomware":null,"records_affected":2482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26907.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26907.pdf"}],"summary":"An unauthorized third party attempted to infiltrate Mt. Hood Meadows’ network through code modification on its web server, potentially impacting personal and credit card information.","supporting_quote":null,"technology_involved":["website","web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eff1b82def52ff5688f4b755cc8a57f9f253c4c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26899.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e9fb9fa9f6aa","org_name":"Nature’s Path Foods, Inc. (“Nature’s Path”)","org_type":"unknown","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26899.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88c0de455bae2e885d430cf65008507f622a81f5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ResourceSevenIncorporated.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83bbc69fbf1f","org_name":"Resource Seven Inc.","org_type":"unknown","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ResourceSevenIncorporated.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-10-30","discovered_date":"2023-08-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2332873f796f5415764186cc5b9173b1c0665db5","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Postmeds%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e5b498790efd","org_name":"Postmeds, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575883"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Postmeds%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Postmeds%2C%20Inc.-2023-10-30"}],"summary":"Postmeds reported that a bad actor accessed files containing names and prescription information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae65c8be2ce2304c7d4e109819ec6672749b12d0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"65f8606e5a39","org_name":"GameSprite","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GameSprite","type":"hibp","url":"https://haveibeenpwned.com/Breach/GameSprite"}],"summary":"GameSprite exposed email addresses, usernames, IP addresses and salted MD5 password hashes in a December 2019 data breach.","supporting_quote":null,"technology_involved":["gaming platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5dd1f1ac51c952dfa33bdda125d4aa655e766bb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9be6b89d4bfb","org_name":"MemeChat","org_type":"technology_saas","ransomware":null,"records_affected":7400000,"reviewed":false,"root_cause":"The breach was alleged to have resulted from a misconfigured Elasticsearch instance.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MemeChat","type":"hibp","url":"https://haveibeenpwned.com/Breach/MemeChat"}],"summary":"MemeChat exposed 7.4 million records, including email addresses and usernames, in a breach allegedly related to a misconfigured Elasticsearch instance.","supporting_quote":"Alleged to be due to a misconfigured Elasticsearch instance, the data contained 4.3M unique email addresses alongside usernames.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7201698ee44a3ae6eff4cda903775436e73472c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"de4773048fb8","org_name":"Toumei","org_type":"professional_services","ransomware":null,"records_affected":76682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Toumei","type":"hibp","url":"https://haveibeenpwned.com/Breach/Toumei"}],"summary":"Toumei suffered a data breach that exposed email addresses, names, phone numbers, and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-27","discovered_date":"2023-09-22","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8096dd97a90f4bf879fe3b346f5f1dce63933a96","impact_type":"data_theft","incident_date":"2022-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26869.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"204eb011e85c","org_name":"Resort Data Processing, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":2319,"reviewed":false,"root_cause":"A vulnerability in the reservation booking application allowed an unauthorized actor to download payment card information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26869.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26869.pdf"}],"summary":"Resort Data Processing reported that an unauthorized actor exploited a vulnerability in its reservation booking application to download payment card information.","supporting_quote":"RDP recently learned that an unauthorized actor used a vulnerability in our reservation booking application at some of our customers’ locations to download payment card information.","technology_involved":["reservation booking application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-27","discovered_date":"2023-09-22","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64618636d8c058e47300157bbe972bbe173773b9","impact_type":"data_theft","incident_date":"2022-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"204eb011e85c","org_name":"Resort Data Processing, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the reservation booking application allowed an unauthorized actor to download payment card information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575755"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Resort%20Data%20Processing%2C%20Inc.-2023-10-27"}],"summary":"An unauthorized actor exploited a vulnerability in Resort Data Processing’s reservation booking application to download payment card information.","supporting_quote":"RDP recently learned that an unauthorized actor used a vulnerability in our reservation booking application at some of our customers’ locations to download payment card information.","technology_involved":["reservation booking application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-27","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d006c11667182c064287f80ec9ad3d238976fd17","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PA%20General%20Store%20-%20Version%20A%20-%20General_static%20proof%20r1.pdf"},"notes":null,"org_country":"US","org_id":"4f3ebfdcb016","org_name":"Pennsylvania General Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575814"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PA%20General%20Store%20-%20Version%20A%20-%20General_static%20proof%20r1.pdf"}],"summary":"A CommerceV3 incident may have affected Pennsylvania General Store customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["CommerceV3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-27","discovered_date":"2023-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"549c4be702675913a0e16a6506d78ce83139353e","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NASCO%20-%20Individual%20Notification%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"feeb2e31ba9c","org_name":"NASCO","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579196"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NASCO%20-%20Individual%20Notification%20Letter%20Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NASCO-2023-10-27"}],"summary":"A threat actor acquired data from NASCO’s MOVEit Transfer instance, including some personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":null,"involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c06f3a37776a9b3487d32e1679791fa74e48209f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mattson%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"41857121b29b","org_name":"Mattson Technology","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Mattson%20-%20CA_0.pdf"}],"summary":"An unauthorized individual accessed Mattson Technology's network and files containing some individuals' personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"593502a9cb2b7e61cf49c3fd79fc8ba41c2a5cda","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Five%20Guys%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c9cd5e8fc1cf","org_name":"Five Guys","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575754"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Five%20Guys%20-%20California%20Notification.pdf"}],"summary":"Five Guys reported unauthorized access to two employees’ email accounts, where an email or attachment contained the affected person’s name.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a0eb040998cc040a0654954f548458b308d09e7","impact_type":"unknown","incident_date":"2023-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Drug%20Free%20Workplaces%20-%20SSN%20%5Bredacted%5D.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d22ef2a99ff","org_name":"Drug Free Workplaces USA, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575794"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-25","discovered_date":"2023-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18df40431271e337d343e98fa81b93e1cb6fb53a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20Letters_0.pdf"},"notes":null,"org_country":"US","org_id":"732e18ae8c46","org_name":"University of Missouri","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575638"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20Letters_0.pdf"}],"summary":"The University of Missouri identified personal information in an affected data set on the MOVEit platform.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-24","discovered_date":"2023-09-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6372834fb6a15726080468d1d1f0e90cd9340fa5","impact_type":"unknown","incident_date":"2023-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a0202c0f261","org_name":"GPD Holdings LLC","org_type":"unknown","ransomware":null,"records_affected":36646,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GPD%20Holdings%20LLC%20d/b/a%20CoinFlip-2023-10-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39ee5e270938433b9562988747f186295fe7ff4b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Victorville%20CA%20APP%20%26%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"d3463d26aff5","org_name":"City of Victorville","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-589938"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575576"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Victorville%20CA%20APP%20%26%20Sample_0.pdf"}],"summary":"The City of Victorville reported that an unauthorized actor accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca9d77ba23ac0364e9cd58060cd56887e07dd7db","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26827.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"38dd402086a1","org_name":"New York Life","org_type":"financial","ransomware":null,"records_affected":519,"reviewed":false,"root_cause":"An unknown actor exploited a vulnerability in Progress Software's MOVEit Transfer tool to access data on the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20York%20Life-2023-10-23"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26827.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26827.pdf"}],"summary":"An unknown actor exploited a vulnerability in the MOVEit Transfer server and accessed personal information held on it.","supporting_quote":"We have determined that an unknown actor exploited the vulnerab ility, accessed the MOVEit Transfer server between May 30, 2023 and May 31, 2023, and obtained a ccess to certain data from the MOVEit Transfer server during that time.","technology_involved":["Progress Software","MOVEit Transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corp."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-23","discovered_date":"2023-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa9474b805ef6c9404d6c52c0c0715e0eacd1fee","impact_type":"data_theft","incident_date":"2023-08-07","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CoinFlip%20-%20California%20Draft%20Notice%20Letter%20to%20Individuals.pdf"},"notes":null,"org_country":"US","org_id":"3e5a1115643f","org_name":"CoinFlip","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A CoinFlip employee’s account was compromised through social engineering.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575527"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CoinFlip%20-%20California%20Draft%20Notice%20Letter%20to%20Individuals.pdf"}],"summary":"An unauthorized party used social engineering to compromise a CoinFlip employee’s account and may have accessed and acquired personal information.","supporting_quote":"On August 7, 2023, an unauthorized third -party utilized sophisticated social engineering tactics to access certain CoinFlip systems by compromising a CoinFlip employee’s account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3c4ca3483cfd2c24621c8be6e5f7dfeb4fd5691","impact_type":"data_theft","incident_date":"2023-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Progressive%20Leasing%20Experian%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"5a45f2fd297c","org_name":"Progressive Leasing","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575510"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Progressive%20Leasing%20Experian%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Progressive%20Leasing-2023-10-23"}],"summary":"An unauthorized third party accessed Progressive Leasing’s network and acquired documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc4393acbb011b748b033f5e165e6aa94606e640","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wescom%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"403594552e5b","org_name":"Wescom Central Credit Union","org_type":"financial","ransomware":null,"records_affected":557,"reviewed":false,"root_cause":"A vulnerability affecting Barracuda Network, Inc. allowed unauthorized third-party access to some of its data, and Wescom emails were potentially accessed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584611"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575506"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wescom%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28922.pdf"}],"summary":"Wescom Central Credit Union reported that emails originating from its core systems were potentially accessed through a vulnerability affecting its network protection partner.","supporting_quote":"On May 19, 2023, our network protection partner, Barracuda Network, Inc., announced a vulnerability that allowed unauthorized third-party access to a subset of its data between October 30, 2022, and May 30, 2023.","technology_involved":["Barracuda Network, Inc."],"third_party":{"archetype":null,"involved":true,"vendor":"Barracuda Network, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5f900759f395","name":"Barracuda Networks"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc20b2852b2dea43f98486dc15fb25c1fa9da0a0","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ffd6ea6e05ab","org_name":"Tunngle","org_type":"technology_saas","ransomware":null,"records_affected":8192928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tunngle","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tunngle"}],"summary":"Tunngle suffered a data breach that exposed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["LAN gaming network"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b4e7910823b7b7b676a3ed07ec80c6e4cbbc2b3","impact_type":"data_theft","imported_from":null,"incident_date":"2023-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d36fcd0e0724","org_name":"Sphero","org_type":"manufacturing","ransomware":null,"records_affected":832255,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sphero","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sphero"}],"summary":"Data associated with Sphero, including email addresses, names, usernames, dates of birth and geographic locations, was posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-19","discovered_date":"2023-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3fdca14aa4bb8aaf2f081b3e10353745230e918","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TBT%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"952713f3c290","org_name":"Trust Benefit Technologies, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TBT%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Trust Benefit Technologies reported that an unauthorized actor accessed certain computer systems and may have accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"445cd04fd3b5737a4199f7e4c4701999d719b60a","impact_type":"unknown","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Revival%20Animal%20Health%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"860666287afe","org_name":"Revival Animal Health","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575366"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Revival%20Animal%20Health%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Revival%20Animal%20Health-2023-10-19"}],"summary":"Revival Animal Health notified affected individuals of a CommerceV3 data event.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14b77db8d5a3c0da86b4f1d5bc1d793b9053ac68","impact_type":"unknown","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pisenti%20%26%20Brinker%20-%20Notice%20Letter_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d098446e1b0d","org_name":"Pisenti & Brinker LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575409"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-10-19","discovered_date":"2023-07-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd6a796c687c49ce12bb24f199ded4723eb1cdfc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26812.pdf"},"notes":null,"org_country":"US","org_id":"08886c1a3c99","org_name":"Chartis Group and Greeley Company, LLC","org_type":"professional_services","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26812.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26812.pdf"}],"summary":"Chartis reported unauthorized access to a network used by its Clinical Quality Solutions division, where an unauthorized actor could view or acquire information including personal and medical data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7e3370ace0a4e78f62f35ca22a8f2d664e088ce","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ChartisGroupandGreeleyCompanyLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6cdb473c72e7","org_name":"Chartis Group","org_type":"unknown","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ChartisGroupandGreeleyCompanyLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"103103e77be67115fd54151610753e0e037b9f45","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BHIEnergySpecialtyServicesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d6b3b90d43e","org_name":"BHI Energy Specialty Services, LLC.","org_type":"unknown","ransomware":null,"records_affected":6329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BHIEnergySpecialtyServicesLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-18","discovered_date":"2023-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"baf56b04d7bbc65971186c635ddc6035afd2165e","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26807.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ed12bf0785b3","org_name":"The Estée Lauder Companies Inc.","org_type":"manufacturing","ransomware":null,"records_affected":1453,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26807.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26807.pdf"}],"summary":"The Estée Lauder Companies reported that an issue involving Progress Software’s MOVEit Transfer solution led to unauthorized access to files containing consumers’ personal information.","supporting_quote":"We were informed by our third-party software provider, Progress Software, of a cybersecurity issue involving the provider’s MOVEit Transfer solution.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07fddf5b3caad17ddf054027bdd114199ef40922","impact_type":"unknown","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BHI%20Adult%20PII%20Letter%20Template%20%282YR%29_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31048fe98979","org_name":"BHI Energy I Specialty Services LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575323"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BHI%20Energy%20I%20Specialty%20Services%20LLC-2023-10-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2023-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ae2fc581772d6391dc0f35c3ad7a6c01e92cac","impact_type":"unknown","incident_date":"2021-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"89abef0954b2","org_name":"Phoenix","org_type":"unknown","ransomware":null,"records_affected":74776,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Phoenix","type":"hibp","url":"https://haveibeenpwned.com/Breach/Phoenix"}],"summary":"In mid-2021, the \"vintage messaging reborn\" service Phoenix suffered a data breach that exposed 75k unique email addresses. The breach also exposed IP addresses, usernames and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc8d7c16116fe2eb31d611c3b2017281603a5fe4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-09-07","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28986.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"869a02df31d1","org_name":"Greenpoint Technologies, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":1017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28986.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26795.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28986.pdf"}],"summary":"Greenpoint Technologies detected unauthorized activity, and files that may have contained personal information were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ccb356c372352271d3bb1ec2a0a5bcd2cdd6b9f","impact_type":"data_theft","imported_from":null,"incident_date":"2021-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"550593f00660","org_name":"AndroidLista","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AndroidLista","type":"hibp","url":"https://haveibeenpwned.com/Breach/AndroidLista"}],"summary":"AndroidLista user records containing personal information and salted SHA-1 password hashes were exposed and later posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e2a7344dc1a8e261b509d9a8bddd97bf35711b2c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/WestatInc110323.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"43f60f53d6e3","org_name":"Westat, Inc.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/WestatInc110323.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26925.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-16","discovered_date":"2023-07-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ccf7f543347840f8f6ba96a385ae626599858a43","impact_type":"unknown","incident_date":"2023-03-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cba800ff9a4","org_name":"Pacific ClearVision Institute","org_type":"unknown","ransomware":null,"records_affected":626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20ClearVision%20Institute-2023-10-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-10-13","discovered_date":"2023-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cc302bb5f722959ea53c8fc407c70cbcf9d2cbe","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Newtron%20-%20Standard%201yr%20CM_Rev1.pdf"},"notes":null,"org_country":"US","org_id":"d96f6472b5e3","org_name":"The Newtron Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575117"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Newtron%20-%20Standard%201yr%20CM_Rev1.pdf"}],"summary":"The Newtron Group reported that an unauthorized third party accessed its computer systems and may have accessed documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"409c65b75fe255acb66c7ce565acec72416b4183","impact_type":"unknown","incident_date":"2023-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_K1891_Yusen%20Logistics%20%28Americas%29%20Inc_L01_SAS_0_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3fccadd1e92","org_name":"Taylored Service Parent Co.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575081"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576121"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-10-13","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1df4750f47b011c4e7e132d9338f6868556add11","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/San%20Diego%20PACE%20Notice%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"23bab9b47a0c","org_name":"San Diego PACE","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575084"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/San%20Diego%20PACE%20Notice%20Proof.pdf"}],"summary":"San Diego PACE reported that files were taken from its MOVEit server and that names and protected health information may have been affected.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-13","discovered_date":"2022-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8896f15b0bda8742e2169453686ecb1c666fa52c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/D_%28OrthoAlaska%20LLC%29%20-%20Notice%20Letter%20Template%20-%20Wave%203%20-%20Patients%20-%20Enrollment%20%28PROOF%29.pdf"},"notes":null,"org_country":"US","org_id":"6f229482c034","org_name":"OrthoAlaska, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575079"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/D_%28OrthoAlaska%20LLC%29%20-%20Notice%20Letter%20Template%20-%20Wave%203%20-%20Patients%20-%20Enrollment%20%28PROOF%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OrthoAlaska%2C%20LLC-2023-10-13"}],"summary":"OrthoAlaska discovered unauthorized activity and determined that files containing patient information had been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-12","discovered_date":"2023-09-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e8131a8da2307e2500138da2c8eb7c97d1268e32","impact_type":"unknown","incident_date":"2023-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3316c2fa2438","org_name":"Willamette Falls Paper Company","org_type":"unknown","ransomware":null,"records_affected":607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Willamette%20Falls%20Paper%20Company-2023-10-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-12","discovered_date":"2023-02-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9582131789523411aaff518b73d16d6532c2aea","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Tri%20Counties%20Bank%20-%20CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b22f0466a97b","org_name":"Tri Counties Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575067"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Tri%20Counties%20Bank%20-%20CA_Redacted.pdf"}],"summary":"Tri Counties Bank reported malware on its internal bank network and possible unauthorized access to systems storing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e91fcd0fd17c654c91665a39ea061346410776dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Frazier%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"7e8fc6b520e1","org_name":"Frazier & Deeter, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574998"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Frazier%20-%20California%20Notification.pdf"}],"summary":"Frazier & Deeter identified unauthorized access on May 19, 2023, to folders containing files with personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d9cea2cbc015257eebb47af6164c0ede543f33d","impact_type":"unknown","incident_date":"2021-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Crum%20-%20SSN%20rev2%20%5Bredacted%5D.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bbdef0e70994","org_name":"Crum & Forster","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574973"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf694ba41cfba6cbfd32d552e3575bc8921c1b3d","impact_type":"data_theft","imported_from":null,"incident_date":"2023-08-23","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Caesars%20-%20AG%20Notice%20-%20Sample%20Notice%20%28Online%20Forms%29.pdf"},"notes":null,"org_country":"US","org_id":"dcdd5cd64a5d","org_name":"Caesars Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574969"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Caesars%20-%20AG%20Notice%20-%20Sample%20Notice%20%28Online%20Forms%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26724.pdf"}],"summary":"Caesars Entertainment said an attack on an IT support vendor led to suspicious activity and unauthorized access to data in its loyalty program database.","supporting_quote":"Caesars Entertainment, Inc. (the “Company,” “we,” or “our”) identified suspicious activity in our information technology network resulting from an attack on an IT support vendor used by the Company.","technology_involved":["loyalty program database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-10","discovered_date":"2023-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9adbf5f629d572a3df1fe5e51184651f02074f66","impact_type":"both","incident_date":"2023-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer_Notice.pdf"},"notes":null,"org_country":"US","org_id":"b1d36daf1bfd","org_name":"West Texas Gas","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574894"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer_Notice.pdf"}],"summary":"West Texas Gas reported that an unauthorized third party accessed systems, copied some files, and deleted others; personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e562ee8fd67b13a6e9ee65921bdeace3c7dd7a2d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"fbfa662fee18","org_name":"Lennar Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574896"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lennar%20Corporation-2023-10-10"}],"summary":"Lennar Corporation detected unauthorized activity in its IT system, and an investigation indicated that a party may have accessed some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-10","discovered_date":"2023-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"b9238401381cb149ea785078a6c822ff8f558f4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20%28Copy%29%20%289.22.23%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e3c2530fa639","org_name":"Frax Outsourcing","org_type":"professional_services","ransomware":null,"records_affected":12005,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Frax%20Outsourcing%2C%20a%20subsidiary%20of%20TheKey%2C%20LLC-2023-10-10"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20%28Copy%29%20%289.22.23%29.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20%28Copy%29%20%289.22.23%29.pdf"}],"summary":"Frax Outsourcing reported unauthorized access to a limited set of email accounts and a SharePoint drive that may have contained personal information.","supporting_quote":null,"technology_involved":["email accounts","SharePoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-10","discovered_date":"2022-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6292532bf91d601e8ead6df331cf1ae541b0ab11","impact_type":"data_theft","incident_date":"2022-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26745.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a71f9526bd8a","org_name":"City of Lakewood","org_type":"government","ransomware":null,"records_affected":24219,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26745.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26745.pdf"}],"summary":"An unknown individual accessed City of Lakewood systems and viewed or downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-09","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c12b272018c986052e13b59036062bc19e78e3f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UFCU-_Sample_Letter_SSN_-_CA_32648834v1.pdf"},"notes":null,"org_country":"US","org_id":"f3eecd2e76db","org_name":"University Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574827"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UFCU-_Sample_Letter_SSN_-_CA_32648834v1.pdf"}],"summary":"University Federal Credit Union reported that unauthorized users accessed data stored on MOVEit’s software platform.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b63586cc8c9519d408546279f351a0340a874b2","impact_type":"data_theft","incident_date":"2021-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4554191caacb","org_name":"Public Business Data","org_type":"unknown","ransomware":null,"records_affected":27917714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Public Business Data","type":"hibp","url":"https://haveibeenpwned.com/Breach/BVD"}],"summary":"Business data obtained from public sources and associated with a customer of Bureau van Dijk’s Orbis product was published to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bfc6d73fd46bb4c3af6b4f2fe93dab4cbc718ea","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"33e8a86ca19a","org_name":"PaySystem.tech","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PaySystem.tech","type":"hibp","url":"https://haveibeenpwned.com/Breach/PaySystemTech"}],"summary":"Data alleged to be from PaySystem.tech was made publicly available for download, but it could not be independently attributed to the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba1b6a1989bbabfe65b52cb202d394ad994336ac","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FlagstarBank.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"763a2a23518f","org_name":"Flagstar Bank","org_type":"unknown","ransomware":null,"records_affected":1643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FlagstarBank.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2023-10-06","discovered_date":"2023-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"381cc206f976ffc0d44304c90fc0f4932825f25a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19940.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f43605ccfe8e","org_name":"Edmonds School District No. 15","org_type":"education","ransomware":null,"records_affected":143536,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19940.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19940.pdf"}],"summary":"Edmonds School District reported that an unauthorized actor could view and acquire personal information stored on its network between January 16 and January 31, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-05","discovered_date":"2023-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfb8cb4ab48b9553484e1cff15758680cd8b4355","impact_type":"data_theft","incident_date":"2023-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MGM%20-%20Regulator%20Update%20Enclosures.pdf"},"notes":null,"org_country":"US","org_id":"6e44b10bc3e3","org_name":"MGM Resorts International","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577483"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MGM%20-%20Regulator%20Update%20Enclosures.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MGM%20Resorts%20International-2023-10-05"}],"summary":"MGM Resorts International reported that an unauthorized third party obtained some customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29026f50e41faa8483311260196d57b22360bfc5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-07-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"240b49a18809","org_name":"Hjedd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hjedd","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hjedd"}],"summary":"Hjedd customer records, including email and IP addresses, usernames, and bcrypt-hashed passwords, were found exposed and later appeared on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"872a85af913d50b77702a0d5b2354837fffbd0c6","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-19965_Flagstar_3_Ad_CM_2Y_FIS_CA_r4prf.PDF"},"notes":null,"org_country":"US","org_id":"936414404bea","org_name":"Flagstar Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The incident involved vulnerabilities in MOVEit Transfer used by the vendor.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578019"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574719"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-19965_Flagstar_3_Ad_CM_2Y_FIS_CA_r4prf.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Flagstar%20Bank%2C%20N.A.-2023-10-06"}],"summary":"Unauthorized actors obtained vendor files transferred via MOVEit Transfer that included Flagstar Bank customer information.","supporting_quote":"The incident involved vulnerabilities discovered in MOVEit Transfer, a file transfer software used by our vendor to support services it provides to Flagstar Bank and its related institutions.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Fidelity Information Services, LLC"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ec4686317151","name":"Fidelity Information Services, LLC"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"230be7c104a4ae3d0fdb03b587087ab46cc236a2","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26704.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"763a2a23518f","org_name":"Flagstar Bank","org_type":"financial","ransomware":null,"records_affected":2412,"reviewed":false,"root_cause":"The incident involved vulnerabilities in MOVEit Transfer used by Fiserv.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26704.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26704.pdf"}],"summary":"Unauthorized actors obtained Flagstar Bank customer information from files transferred through Fiserv using MOVEit Transfer.","supporting_quote":"The incident involved vulnerabilities discovered in MOVEit Transfer, a file transfer software used by our vendor to support services it provides to Flagstar and its related institutions.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fiserv"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"638d4ef582e5","name":"Fiserv"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-10-04","discovered_date":"2023-07-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d1ec88cf4d6bcde3e5c51b3a380514cccd211002","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16338.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6de2f785fd18","org_name":"Emerald Financial Services","org_type":"financial","ransomware":null,"records_affected":15776,"reviewed":false,"root_cause":"A vulnerability in the MOVEit Transfer tool was exploited at the service provider.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16338.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16338.pdf"}],"summary":"Emerald Financial Services customers’ personal information was acquired through exploitation of a vulnerability in the MOVEit Transfer tool at a service provider.","supporting_quote":"Unfortunately, a vulnerability was exploited in the MOVEit Transfer tool, resulting in a data security incident with our service provider.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-10-04","discovered_date":"2023-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"12c9c3d23abcd3d39750a6ce439e9e90b3637a63","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26684.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"14930a0e4842","org_name":"DMS Health Technologies","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26684.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26684.pdf"}],"summary":"DMS Health Technologies reported unauthorized access to its systems, but its investigation found no definitive proof that information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-04","discovered_date":"2023-04-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73324c4c2bf93c7b65666090ef4de8c1faf98980","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arcadia%20Publishing%20Inc.%20-Notice%20of%20Data%20Event-CA-Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"10d79cf6d5e7","org_name":"Arcadia Publishing","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arcadia%20Publishing%20Inc.%20-Notice%20of%20Data%20Event-CA-Exhibit%201_0.pdf"}],"summary":"Arcadia Publishing reported unauthorized access to certain files and folders from March 6 through April 19, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-03","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"508c2910720adb7df0ab73020c99c66014b7cca6","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%2810.03.2023%29.pdf"},"notes":null,"org_country":"US","org_id":"efc967bcefbf","org_name":"Sony Interactive Entertainment LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor exploited a vulnerability in the MOVEit platform to download files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574585"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%2810.03.2023%29.pdf"}],"summary":"An unauthorized actor exploited a vulnerability in Sony Interactive Entertainment's MOVEit platform to download files containing personal information.","supporting_quote":"On May 28, 2023, before Progress Software announced the vulnerability and we became aware of it, an unauthorized actor used the vulnerability to download some SIE files stored on our MOVEit platform.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-03","discovered_date":"2023-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7a930d9b0c6102d153e4c0e68b0dc5e9015f6f8","impact_type":"disruption_or_ransomware","incident_date":"2023-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26672.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"350fac2a6312","org_name":"Coffee Meets Bagel","org_type":"technology_saas","ransomware":null,"records_affected":7455,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26672.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26672.pdf"}],"summary":"An outside actor maliciously deleted company data and files from the CMB platform, affecting records that included personal information.","supporting_quote":null,"technology_involved":["CMB platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e06ead01c2aa9b372c43ed7ae65af678ef62f656","impact_type":"data_theft","imported_from":null,"incident_date":"2022-12-04","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3ca3d747dbf2","org_name":"Activision","org_type":"other","ransomware":null,"records_affected":16006,"reviewed":false,"root_cause":"Attackers socially engineered an Activision HR employee into disclosing information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Activision","type":"hibp","url":"https://haveibeenpwned.com/Breach/Activision"}],"summary":"Attackers socially engineered an Activision HR employee into disclosing information, resulting in the exposure of employee records.","supporting_quote":"In December 2022, attackers socially engineered an Activision HR employee into disclosing information which led to the breach of almost 20k employee records .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15f651fe2933a89c4ba0f983cd6408251b0a999a","impact_type":"data_theft","imported_from":null,"incident_date":"2020-09-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"aabb169af170","org_name":"Horse Isle","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Horse Isle","type":"hibp","url":"https://haveibeenpwned.com/Breach/HorseIsle"}],"summary":"A breach exposed Horse Isle users’ email addresses, names, usernames, IP addresses, genders, purchases, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-10-02","discovered_date":"2023-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f60c5e5812fa588b55e6ec9666ae9c7e6f2079c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GEDC%20-%20Example%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"79bdb3d51404","org_name":"Great Expressions Dental Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574554"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GEDC%20-%20Example%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26697.pdf"}],"summary":"Great Expressions Dental Centers reported that an unauthorized party accessed some of its systems and that patient information may have been accessed or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f471eb3909bd67918ea5ce25b2f2778cb3f50164","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BuildersMutualInsuranceCompany122923.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99bc906c99db","org_name":"Builders Mutual Insurance Company","org_type":"unknown","ransomware":null,"records_affected":2601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/BuildersMutualInsuranceCompany122923.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-29","discovered_date":"2023-08-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa906ac8f3a58934c96e3c980aa1348e8ed19cb3","impact_type":"disruption_or_ransomware","incident_date":"2023-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prospect%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3d08d29af419","org_name":"Prospect Medical Holdings","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prospect%20-%20California%20Notification.pdf"}],"summary":"Prospect Medical reported disruption to some IT systems and unauthorized access to files containing employee and dependent information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0376cf14d0c61115581246c69d8829fa8f6f91fa","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FAMS-%20Navient-%20Exhibit%20A%20%28%20letter%29.pdf"},"notes":null,"org_country":"US","org_id":"6725bfd4c29d","org_name":"Financial Asset Management Systems","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574493"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FAMS-%20Navient-%20Exhibit%20A%20%28%20letter%29.pdf"}],"summary":"Financial Asset Management Systems reported that an unauthorized party acquired information stored on its network, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-29","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee2217e59d2b38daa067cb67724e434389e65527","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_3.pdf"},"notes":null,"org_country":"US","org_id":"7b39f0d64e61","org_name":"Classic Residence Management Limited Partnership d/b/a Vi Senior Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-582033"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-578336"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574448"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_3.pdf"}],"summary":"An unauthorized third party accessed files on Vi Senior Living’s corporate office data server that contained some individuals’ personal information.","supporting_quote":null,"technology_involved":["data server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-27","discovered_date":"2023-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06507d054ccc623b47c531351e5b0f9c797ac1f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tutor%20Doctor%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f8818a6b129a","org_name":"Tutor Doctor Learning Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574297"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tutor%20Doctor%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tutor%20Doctor%20Learning%20Solutions%2C%20Inc-2023-09-22"}],"summary":"Tutor Doctor Learning Solutions, Inc. reported that an unauthorized third party accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-27","discovered_date":"2023-07-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"79983c221533fc39fe9042eaa31fd4977ba37967","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b9d56d7eb771","org_name":"Consolidated Edison Company of New York LLC (“ConEd”)","org_type":"unknown","ransomware":null,"records_affected":24247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Consolidated%20Edison%20Company%20of%20New%20York%20LLC%20%28%E2%80%9CConEd%E2%80%9D%29-2023-09-27"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Consolidated%20Edison%20Company%20of%20New%20York%20LLC%20%28%E2%80%9CConEd%E2%80%9D%29-2023-09-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-27","discovered_date":"2023-08-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17ebf949901622053e98e3148ba6971181cb782c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BHN%20Customer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"9f2713caed4b","org_name":"Blackhawk Engagement Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574287"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BHN%20Customer%20Notification%20Letter.pdf"}],"summary":"An unauthorized party used a malicious exploit on Blackhawk Engagement Solutions’ MyPrepaidCenter.com website, potentially accessing profile and prepaid card information.","supporting_quote":"Based on our investigation, an unauthorized party used a malicious exploit on the website that potentially could have provided access to certain information in your MyPrepaidCenter.com profile and your Prepaid Card information.","technology_involved":["MyPrepaidCenter.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f63e6e1e6f72b68024d50fc9380135598d29ec9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/USWaffleInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecef3e2e3386","org_name":"U.S. Waffle, Inc.","org_type":"unknown","ransomware":null,"records_affected":2558,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/USWaffleInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":["CVE-2023-34362"],"data_types":["personal","financial"],"disclosed_date":"2023-09-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4318a50588b5f1071cb19686ee10ef845ffdea84","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Huntington%20IDX%20Breach%20Notification%20Letter%20-%20Customer.pdf"},"notes":"Letter cites CVE-2023-3462, a typo for CVE-2023-34362 (MOVEit Transfer); corrected 2026-10-12.","org_country":"US","org_id":"a418400d105d","org_name":"Alogent","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Alogent was compromised through a zero-day vulnerability in Progress Software’s MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574245"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Huntington%20IDX%20Breach%20Notification%20Letter%20-%20Customer.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alogent%20Holdings%20Inc-2023-09-18"}],"summary":"Alogent reported that a zero-day vulnerability in Progress Software’s MOVEit Transfer application exposed files containing account and personal information.","supporting_quote":"This letter is written to inform you that between May 30, 2023 and June 1, 2023, Alogent Holdings, Inc. (“Alogent”), was victim of a zero-day vulnerability within one of their vendors software, Progress Software’s MOVEit Transfer application (CVE-2023-3462).","technology_involved":["Progress Software MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}],"kev":[{"cve":"CVE-2023-34362","kev_added":"2023-06-02","name":"Progress MOVEit Transfer SQL Injection Vulnerability","days_listed_before_incident":-2,"product":"Progress MOVEit Transfer"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-09-25","discovered_date":"2023-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a202635a92f2985880aed0b1bafd87d6bde25e7c","impact_type":"disruption_or_ransomware","incident_date":"2023-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15676.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4535142f65ba","org_name":"Spinal and Sports Care Clinic","org_type":"healthcare","ransomware":true,"records_affected":1089,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15676.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15676.pdf"}],"summary":"Spinal and Sports Care Clinic reported a ransomware attack that may have exposed files containing personal, treatment, and health insurance information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e47f03e94b6be214ae39aa8d948609273206c70d","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20PBI%20-%206.22.23.pdf"},"notes":null,"org_country":"US","org_id":"bd306e610501","org_name":"PHH Mortgage Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574137"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20PBI%20-%206.22.23.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PHH%20Mortgage%20Corporation-2023-09-26"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability to access a PHH Mortgage Corporation server and download data.","supporting_quote":"Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-25","discovered_date":"2023-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7006ffdefc3019bea2384cd35ecc066d70ba28f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notice%20Letter%20Proof%20%2812%20months%29%20-%20Francesca%27s.pdf"},"notes":null,"org_country":"US","org_id":"196788ae35c4","org_name":"Francesca’s Acquisition, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notice%20Letter%20Proof%20%2812%20months%29%20-%20Francesca%27s.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Francesca%27s%20Acquisition%2C%20LLC-2023-09-25"}],"summary":"Francesca’s reported that a January 2023 network disruption may have affected personal information, including names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-24","discovered_date":"2023-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a20fa189b7ab78b4694915e4144eb2d93e3cb5e4","impact_type":"both","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Johnson%20Controls%20-%20Consumer%20Notice%20South%20Carolina.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c7ebdedad7fd","org_name":"Johnson Controls","org_type":"manufacturing","ransomware":null,"records_affected":12134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Johnson%20Controls%20-%20Consumer%20Notice%20South%20Carolina.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Johnson%20Controls%20-%20Consumer%20Notice%20South%20Carolina.pdf"}],"summary":"Johnson Controls reported unauthorized access to its systems and the taking of personal information, along with disruption to its information technology infrastructure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b0a44dd51af7d2604c5e26e2f9e6d540b2aeafe","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26578.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"719ccf123b8f","org_name":"Sovos Compliance","org_type":"technology_saas","ransomware":null,"records_affected":1450,"reviewed":false,"root_cause":"Unauthorized actors exploited a then-unknown vulnerability in MOVEit Transfer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26578.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26578.pdf"}],"summary":"Unauthorized actors exploited a then-unknown MOVEit vulnerability to download a file containing personal information related to Sovos Compliance.","supporting_quote":"We recently determined that unauthorized actors exploited the then-unknown MOVEit vulnerability to download a file containing some of your personal information.","technology_involved":["Progress Software","MOVEit Transfer application (SecureFT)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-22","discovered_date":"2023-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdeb79ec4ff5db914452087b3df155f90fe2fa13","impact_type":"both","incident_date":"2023-02-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LCS%20Financial%20-%20Regulatory%20Notification%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6d42792505ef","org_name":"LCS Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574116"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574728"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575620"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LCS%20Financial%20-%20Regulatory%20Notification%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LCS%20Financial%20Services-2023-09-22"}],"summary":"LCS Financial Services reported unusual activity that disrupted access to certain systems and an investigation found personal information had been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other"],"disclosed_date":"2023-09-22","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b2bef7834122840e3733df738f5673732b96f3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Attorney%20General%20Notice%20-%20Kannact_0.pdf"},"notes":null,"org_country":"US","org_id":"a9b1ba4f6dcf","org_name":"Kannact","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The unauthorized access was caused by third-party file transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574117"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Attorney%20General%20Notice%20-%20Kannact_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kannact%2C%20Inc.-2023-09-22"}],"summary":"Kannact discovered unauthorized access to its system, and its investigation attributed the access to third-party file transfer software.","supporting_quote":"The preliminary findings determined that the cause of the unauthorized access was a third party file transfer software.","technology_involved":["third-party file transfer software"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-22","discovered_date":"2023-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b37a3d4421c12b074830de2db488e5c90bbf785e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"5c5107231f82","org_name":"International Business Machines Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574033"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20Letter_0.pdf"}],"summary":"IBM reported unauthorized access to personal information in a database, but its investigation could not determine the scope of the access.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-09-22","discovered_date":"2023-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"777604890b4e6db0b10e464221b4cd55b59285ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_Rev3.pdf"},"notes":null,"org_country":"US","org_id":"52f3b55ceec5","org_name":"First Team Real Estate","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574109"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_Rev3.pdf"}],"summary":"First Team Real Estate reported that information in its systems was accessed without authorization around June 29, 2023, and the potentially affected information may have included personal, financial, and health insurance data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32fdf8402519c3516193f7f4e20a65977ca247a0","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Financial%20Institution%20Service%20Corporation%20-%20Exhibit%20A_1.pdf"},"notes":null,"org_country":"US","org_id":"a8df55a2018c","org_name":"Financial Institution Service Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited zero-day vulnerabilities affecting the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574111"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574338"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574654"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Financial%20Institution%20Service%20Corporation%20-%20Exhibit%20A_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Financial%20Institution%20Service%20Corporation-2023-09-22"}],"summary":"Financial Institution Service Corporation reported that an unknown actor exploited vulnerabilities to access and exfiltrate data from its MOVEit Transfer server.","supporting_quote":"Our investigation determined that an unknown actor exploited vulnerabilities, accessed the MOVEit Transfer server between May 30, 2023 to May 31, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corp."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8274893615f2ac0163d5001772ea0721533e41a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bassett%20Furniture%20Industries%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"79c591c74d79","org_name":"Bassett Furniture Industries, Incorporated","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574059"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bassett%20Furniture%20Industries%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed Bassett Furniture's e-commerce website and added code potentially capable of capturing information entered during online orders.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2023-09-21","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84dafa31173e424cbaa9b7cbca94068e3e6f707c","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_7_0.pdf"},"notes":null,"org_country":"US","org_id":"1705c8d80b7a","org_name":"National Student Clearinghouse","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577820"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_7_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20Student%20Clearinghouse-2023-09-21"}],"summary":"The National Student Clearinghouse reported that an unauthorized party obtained files from its MOVEit Transfer tool, including personal and school-related information.","supporting_quote":"On May 31, 2023, the Clearinghouse was informed by our third-party software provider, Progress Software, of a cybersecurity issue involving the provider’s MOVEit Transfer solution.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeef6adf468be7e3d90c11aefa0c26782100e2e1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hasz%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8d0c3dbb960f","org_name":"Hasz Fund Control, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573966"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hasz%20Individual%20Notification%20Letter.pdf"}],"summary":"Hasz Fund Control reported that a security incident disrupted access to critical systems and involved some individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-21","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e194b63140647a5830b3209ed8ce2bfba99dd15","impact_type":"data_theft","incident_date":"2023-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dana%20Innovations%20-%20Exhibit%20A%20-%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"033d921d596c","org_name":"Dana Innovations","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573985"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dana%20Innovations%20-%20Exhibit%20A%20-%20CA_1.pdf"}],"summary":"Dana Innovations reported that an unknown actor accessed certain computer systems and viewed or downloaded information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-20","discovered_date":"2023-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e6074daad7e15daec6f3551ec8a243a6604f395","impact_type":"unknown","incident_date":"2023-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1954f01bca23","org_name":"Murphy Company","org_type":"unknown","ransomware":null,"records_affected":1733,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Murphy%20Company-2023-09-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb0f7cfa37c7a9ce18e7fa9d16774da7b01160e0","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"76f018721fd1","org_name":"dBforums","org_type":"technology_saas","ransomware":null,"records_affected":363468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: dBforums","type":"hibp","url":"https://haveibeenpwned.com/Breach/dBforums"}],"summary":"A 2016 breach of dBforums exposed email addresses, usernames, IP addresses, dates of birth, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-20","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"67c792e5aa35b42e747a97c901ff3d737ce5ace2","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26540.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"984eb3afe2e2","org_name":"Aristocrat Technologies","org_type":"manufacturing","ransomware":null,"records_affected":978,"reviewed":false,"root_cause":"A criminal group exploited a previously unknown vulnerability in MOVEit Transfer to extract information from an Aristocrat server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26540.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26540.pdf"}],"summary":"A criminal group exploited a vulnerability in MOVEit Transfer to extract personal data from an Aristocrat server.","supporting_quote":"After a thorough investigation, we determined that, between 29-31 May 2023, a criminal group exploited the vulnerability to extract information from an Aristocrat server, including certain personal data belonging to some individuals.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-20","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"144bb64d17098cc7aa69611b07f4cf6c2239041a","impact_type":"data_theft","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20%28Final%29%20%2802445178x9C82B%29.pdf"},"notes":null,"org_country":"US","org_id":"ca18ee5bf6fd","org_name":"Amana Meat Shop & Smokehouse","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573904"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20%28Final%29%20%2802445178x9C82B%29.pdf"}],"summary":"An unauthorized party accessed CommerceV3’s systems and obtained personal and payment card information associated with Amana Meat Shop & Smokehouse online purchases.","supporting_quote":null,"technology_involved":["CommerceV3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff50435a59052729e0c9960176a3d314ca37a530","impact_type":"unknown","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter%20-%20Unum_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"322eadaee46b","org_name":"Unum Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573867"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26267.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0a624c9738ff740f29e95063c75318fd57e6f07","impact_type":"unknown","imported_from":null,"incident_date":"2023-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rotoco%20HoldCo%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"7d0263580e67","org_name":"RotoCo HoldCo LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rotoco%20HoldCo%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"RotoCo HoldCo LLC sent a data-event notice offering affected individuals identity-monitoring services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-19","discovered_date":"2023-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bf93879c96c526083883b36d5c3b3e234b518b9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Grant%20Thornton%20-%20Template%20Notification%20Letter%20-%201Yr%20CM%20w%20Kroll%2031%20Aug%20-%20General.pdf"},"notes":null,"org_country":"US","org_id":"1deff35d96a1","org_name":"Grant Thornton LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Grant%20Thornton%20-%20Template%20Notification%20Letter%20-%201Yr%20CM%20w%20Kroll%2031%20Aug%20-%20General.pdf"}],"summary":"An unauthorized third party accessed emails and attachments in an employee's email account at Grant Thornton LLP.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-18","discovered_date":"2023-08-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44b15cce350571e926399fc64cf513a6b21fe96a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/_Wahl%20-%20Model_Notice_Letter_static%20proof%20r4.pdf"},"notes":null,"org_country":"US","org_id":"0d01f4e581c5","org_name":"Wahl, Willemse & Wilson LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573739"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/_Wahl%20-%20Model_Notice_Letter_static%20proof%20r4.pdf"}],"summary":"Unauthorized access to folders in the firm's tax-return filing software exposed files containing clients' personal information, including names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":["tax-return filing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"659d531bc2ef0b7efd4836db93a92dee9fb86430","impact_type":"disruption_or_ransomware","incident_date":"2023-05-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_K0170_San%20Francisco%20Jazz%20Organization%202_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"9521da2ec66b","org_name":"San Francisco Jazz Organization","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573460"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576019"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_K0170_San%20Francisco%20Jazz%20Organization%202_L01_SAS_0.pdf"}],"summary":"A ransomware attack detected on May 23, 2023, encrypted several systems, and employee personal information may have been accessed.","supporting_quote":null,"technology_involved":["file servers","accounting workstations","backup servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-18","discovered_date":"2023-06-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"026b2722fa60b6ef23a3983ff5c69c641c558075","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a32b42c148b","org_name":"Athene Annuity and Life Company and its affiliates","org_type":"unknown","ransomware":null,"records_affected":149384,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Athene%20Annuity%20and%20Life%20Company%20and%20its%20affiliates-2023-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5b257eb6a6fd36daf72e0121a41bd6ca2d65204","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Upstream%20RollCo%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"418783e759c5","org_name":"Upstream RollCo, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573416"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Upstream%20RollCo%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26493.pdf"}],"summary":"Upstream RollCo reported that an unauthorized party may have accessed files in certain employee email accounts.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d49ff853878aadf74e9be69272f1b49eebe93479","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18540%20PBI%20Longevity%20Portal%202%20Ad%20CM%201y%20Consumer%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"f41710e060ae","org_name":"United Association National Pension Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573364"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18540%20PBI%20Longevity%20Portal%202%20Ad%20CM%201y%20Consumer%20r4prf.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software and downloaded data from a MOVEit Transfer server containing information related to the Fund.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-09-15","discovered_date":"2023-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1348f9edfdf505f8493008fe28da99ba62ffab82","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OVHD%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"1a6150cfa8e1","org_name":"Oak Valley Hospital District","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OVHD%20-%20California%20Notification.pdf"}],"summary":"Oak Valley Hospital District reported unauthorized access to its systems and said files used for billing or treatment might have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-09-15","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"093392095905968102b29311ba48cd24a99de911","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nuance%20Notice%20Template%20%28PS%29.pdf"},"notes":null,"org_country":"US","org_id":"0a6408965996","org_name":"Nuance Communications","org_type":"technology_saas","ransomware":null,"records_affected":7993,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software to take information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573426"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nuance%20Notice%20Template%20%28PS%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nuance%20Communications%20Inc-2023-09-19"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26497.pdf"}],"summary":"Nuance Communications reported that an unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software and took personal information from audit logs.","supporting_quote":"On May 31, 2023, Progress Software told us about a previously unknown vulnerability in their software that allowed an unauthorized third party to take information from the MOVEit Transfer software.","technology_involved":["MOVEit Transfer","Progress Software Corporation"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-09-15","discovered_date":"2023-06-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e18abb2ed168e31f50b151a9324a4e211d69d776","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2024-01-26%20-%20Individual%20Notice%20Templates%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"4bd00533e6f2","org_name":"Cadence Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a zero-day vulnerability in the MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579992"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576943"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573352"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2024-01-26%20-%20Individual%20Notice%20Templates%20-%20CA.pdf"}],"summary":"An unauthorized third party exploited a zero-day vulnerability in Cadence Bank’s MOVEit Transfer application and downloaded information stored there.","supporting_quote":"Through the investigation, on June 18, 2023, Cadence Bank determined that an unauthorized third-party exploited the zero-day vulnerability and accessed and downloaded information being stored within the MOVEit application between May 28-31, 2023.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1ecac644dde867567afc5e36c61bf11fa763ed4","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023.09.14%20CA%20Sample%20PBI-MMA%20Adult%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d56db63997f7","org_name":"MassMutual Ascend Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software enabled access to a MOVEit Transfer server used by PBI.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023.09.14%20CA%20Sample%20PBI-MMA%20Adult%20Consumer%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26163.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MassMutual%20Ascend%20Life%20Insurance%20Company-2023-09-13"}],"summary":"A third party exploited a MOVEit Transfer vulnerability and downloaded personal information from a server used by PBI.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a \nvulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PBI"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc855e4bfb0eabc95c01125d1eb4df7424712181","impact_type":"data_theft","imported_from":null,"incident_date":"2019-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"MY","org_id":"1ae451fecfd2","org_name":"Malindo Air","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MalindoAir","type":"hibp","url":"https://haveibeenpwned.com/Breach/MalindoAir"}],"summary":"A breach exposed Malindo Air customer information, including email addresses and personal details, which was later shared on hacking forums.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a9be72a36a32e6c2ed1d24036496ccb0991c164","impact_type":"unknown","incident_date":"2023-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0855ec8918e1","org_name":"Garnett & Garnett Tax Service","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573337"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-13","discovered_date":"2023-06-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6553983cb05fb8f7e0919a679527889a52b6eca0","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Honeywell%20US%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"418620fdb8c2","org_name":"Honeywell International Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in third-party Progress MOVEit Transfer was involved in the incident.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Honeywell%20US%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Honeywell%20International%20Inc.-2023-09-13"}],"summary":"Honeywell said a vulnerability in Progress MOVEit Transfer led to unauthorized access to information related to a pension plan it administered, including names and Social Security numbers.","supporting_quote":"On June 3, 2023, Honeywell International Inc. (“Honeywell”), 855 Mint St., Charlotte, NC 28202, became aware that it was one of the many companies impacted by a vulnerability in a third -party tool, Progress MOVEit Transfer, which Honeywell uses for certain business operations.","technology_involved":["Progress MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-12","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bb5686031a1b993c6ff7c12cbdb316a00fd0af6","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB07879-MarketplaceIndia-letter-general%20%282%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"3c34bc226ecd","org_name":"MarketPlace Handwork of India","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB07879-MarketplaceIndia-letter-general%20%282%29_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MarketPlace%20Handwork%20of%20India-2023-09-11"}],"summary":"MarketPlace Handwork of India said a limited amount of customers’ personal information may have been accessed in an incident involving CommerceV3 systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d53d085c3f477b7203af845877f10cf1d31d6e6","impact_type":"both","imported_from":null,"incident_date":"2022-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CO","org_id":"00b24f496eac","org_name":"Viva Air","org_type":"transportation_logistics","ransomware":true,"records_affected":932232,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Viva Air","type":"hibp","url":"https://haveibeenpwned.com/Breach/VivaAir"}],"summary":"Viva Air suffered a data breach and ransomware attack that exposed transaction records and personal and partial credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-09-11","discovered_date":"2022-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e5ec12781eeb2236717561e846d8b0f284026af","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Texas%20Medical%20Liability%20Trust%20-%20Notice%20of%20Data%20Event-%20CA-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"884f25c27613","org_name":"Texas Medical Liability Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573094"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Texas%20Medical%20Liability%20Trust%20-%20Notice%20of%20Data%20Event-%20CA-%20Exhibit%201_0.pdf"}],"summary":"Texas Medical Liability Trust reported that an unauthorized actor may have accessed or acquired files containing personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20fef8fae275d5a60830ffe66035f3ed7b51963b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J9751_FN_CELLARS.pdf"},"notes":null,"org_country":"US","org_id":"df870157d769","org_name":"Far Niente","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573106"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J9751_FN_CELLARS.pdf"}],"summary":"An unauthorized individual accessed certain Far Niente email accounts and internal documents, potentially affecting individuals’ names, addresses, and contact information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6728693efb8dd666fc73ae9cf4a5675fbc626e6a","impact_type":"data_theft","incident_date":"2023-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Commerce%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"123842948ec1","org_name":"The Commerce Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573043"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575478"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Commerce%20-%20California%20Notification.pdf"}],"summary":"An unknown party used information already in its possession to access driver’s license and vehicle information through MAPFRE’s Massachusetts online quoting platform.","supporting_quote":null,"technology_involved":["MAPFRE Massachusetts online quoting platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2023-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"943e10edd237e289f08a71ba05f6a42ac7db70d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Letter%20-%20Sightpath.pdf"},"notes":null,"org_country":"US","org_id":"e0090103000f","org_name":"Sutter North Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573050"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Letter%20-%20Sightpath.pdf"}],"summary":"An unauthorized actor accessed files and data stored in the organization’s systems, and protected health information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-08","discovered_date":"2023-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa60207e52f1b7334d20a14fa761324000fb157d","impact_type":"data_theft","incident_date":"2023-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26784.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"110faee49261","org_name":"Pierce College District","org_type":"education","ransomware":null,"records_affected":155811,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26784.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26784.pdf"}],"summary":"Pierce College District reported that unauthorized actors accessed its network and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76ea0d12a3d6f378cd0fdb216d805d35a5095aeb","impact_type":"data_theft","imported_from":null,"incident_date":"2023-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"6587a0aa7af2","org_name":"Dymocks","org_type":"retail_ecommerce","ransomware":null,"records_affected":1200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dymocks","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dymocks"}],"summary":"Dymocks reported a data breach involving customer records that dated back to June 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2244f005bb6661797c63f27f1843435d7edeac48","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15652.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89306bf22e5e","org_name":"MedMinder Systems, Inc.","org_type":"unknown","ransomware":null,"records_affected":1252,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15652.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-07","discovered_date":"2022-08-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a051902459a10a2c2b27b0063ed2b68363e21e1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lifeline%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f0ec0a8dc78b","org_name":"Lifeline Systems Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lifeline%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26443.pdf"}],"summary":"Lifeline Systems Company reported that an unauthorized person accessed its network and documents between July 27 and August 6, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"593435dd0b0b1958fa4c25044db2b45e07e98bfe","impact_type":"data_theft","incident_date":"2023-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20applicants.pdf"},"notes":null,"org_country":"US","org_id":"83acf6c9a03f","org_name":"The UPS Store #3270","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20applicants.pdf"}],"summary":"The UPS Store #3270 reported that documents containing customers’ personal information were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-06","discovered_date":"2023-05-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25adfd17922a307f9d407a6519eb9e019c27129b","impact_type":"data_theft","incident_date":"2023-04-18","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lyon%20Real%20Estate.pdf"},"notes":null,"org_country":"US","org_id":"aabc975db53b","org_name":"Lyon Real Estate","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown individual accessed Lyon’s systems via a software vulnerability in a vendor application program used by Lyon.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572927"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lyon%20Real%20Estate.pdf"}],"summary":"An unknown individual accessed Lyon Real Estate’s systems through a vulnerability in a vendor application and obtained information stored in its systems.","supporting_quote":"Through our investigation , we learned that an unknown individual accessed Lyon’s systems via a software vulnerability in a vendor application program used by Lyon.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-06","discovered_date":"2023-02-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"57c50f3176f159b6404c20e5fd04edc823cbc2da","impact_type":"both","imported_from":null,"incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26429.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"68ca18b918a0","org_name":"Advance America","org_type":"financial","ransomware":null,"records_affected":3143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26429.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advance%20America%2C%20Cash%20Advance%20Centers%20of%20Washington%2C%20LLC-2023-09-07"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26429.pdf"}],"summary":"An unauthorized actor accessed or acquired corporate business records on Advance America’s network during an incident that also caused a temporary systems outage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb5b601f5b97ef63671481befeaecc534ffca151","impact_type":"unknown","incident_date":"2023-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63066fe2ecfd","org_name":"Vivendi Ticketing US LLC d/b/a See Tickets","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572868"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vivendi%20Ticketing%20US%20LLC%20d/b/a%20See%20Tickets-2023-09-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-05","discovered_date":"2023-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f1f9a1b82cb784ae422ee95fdd52cbd491c69bb","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26421.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7e63be7ceaa6","org_name":"North Star Tax & Accounting","org_type":"professional_services","ransomware":null,"records_affected":1979,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26421.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26421.pdf"}],"summary":"North Star Tax & Accounting identified files that may have been accessed and copied, including files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-05","discovered_date":"2023-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1ca22792942d37b71ae6f6ac57c38b3ed8f0c669","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26424.pdf"},"notes":null,"org_country":"US","org_id":"8d7d69fc2e00","org_name":"Johnson & Johnson Health Care Systems Inc.","org_type":"healthcare","ransomware":null,"records_affected":4142215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26424.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Johnson%20%26%20Johnson%20Health%20Care%20Systems%20Inc.%20%28%E2%80%9CJanssen%E2%80%9D%29-2023-09-15"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26424.pdf"}],"summary":"Johnson & Johnson Health Care Systems Inc. reported unauthorized access to personal information in a database provided by IBM, with the scope of access undetermined.","supporting_quote":null,"technology_involved":["IBM database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IBM"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"0cb4d917e4a0","name":"IBM"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-09-05","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55005e312ff5b780386b37eda2b9832d3bbf0253","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amerita%20-%20Letter%20Proof%20%2891113676v1%29.pdf"},"notes":null,"org_country":"US","org_id":"4bbb624358b5","org_name":"Amerita","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572862"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amerita%20-%20Letter%20Proof%20%2891113676v1%29.pdf"}],"summary":"An unknown third party accessed Amerita and its parent company’s computer systems, and personal and patient information may have been obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d6261a404f3a121d155373b46624a441ab4fbae","impact_type":"unknown","incident_date":"2022-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26405.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2666d18d2a4d","org_name":"Centralia College","org_type":"education","ransomware":null,"records_affected":11459,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26405.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26405.pdf"}],"summary":"Centralia College notified individuals of an internal data security issue and offered identity-protection services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-01","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9ff36dbf82c38945d4637c11cbe342d7b934b18","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Radius%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a8976589e745","org_name":"Radius Global Solutions, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized actors accessed documents through exploitation of a vulnerability in the MOVEit web transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572775"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Radius%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Radius%20Global%20Solutions%2C%20LLC-2023-09-15"}],"summary":"Radius Global Solutions reported that unauthorized actors accessed documents through exploitation of a vulnerability in the MOVEit web transfer application.","supporting_quote":"Upon learning cybercriminals exploited the vulnerability, Radius immediately investigated its MOVEit database to assess its security and to identify any documents that may have been accessed by unauthorized actors.","technology_involved":["MOVEit web transfer application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-01","discovered_date":"2023-08-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8c62f4cde6e837ce2e7788a78c8818ae1f8f07ce","impact_type":"unknown","incident_date":"2023-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cacf1677037a","org_name":"Mortgage Industry Advisory Corporation","org_type":"unknown","ransomware":null,"records_affected":856,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mortgage%20Industry%20Advisory%20Corporation-2023-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-01","discovered_date":"2023-02-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"963d7f82c185189cc5d9fac89b7d69032fbcb27b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CM_AJ199_v03.pdf"},"notes":null,"org_country":"US","org_id":"bf841bf2c797","org_name":"La Clinica de La Raza, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572739"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CM_AJ199_v03.pdf"}],"summary":"La Clinica de La Raza reported unauthorized access to employee email accounts, where some individuals’ personal information may have been viewed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-09-01","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eff96871d2f30eb213786a646596afc704797019","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20%28Privileged%20and%20Confidential%29%20%28Final%208.31.23%20v2%29%20no%20watermark.pdf"},"notes":null,"org_country":"US","org_id":"c06ad4527eec","org_name":"Charter Communications","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The third party used log-in credentials acquired from a data breach where the same username and password combination had been used.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20%28Privileged%20and%20Confidential%29%20%28Final%208.31.23%20v2%29%20no%20watermark.pdf"}],"summary":"A third party used reused credentials to access limited Spectrum.net accounts and add new email identities.","supporting_quote":"Spectrum believes the third party acquired your log-in credentials from a third-party data breach where you used the same combination of usernames/passwords.","technology_involved":["Spectrum.net"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c678df7e1f8fe0513e8d678fb3c78d3df6ae342","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CBIZ%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"afb73252db76","org_name":"CBIZ, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572787"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CBIZ%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CBIZInc.pdf"}],"summary":"An unauthorized party exploited a vulnerability in CBIZ's MOVEit Transfer server and downloaded files containing names, dates of birth, and Social Security numbers.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software, which is used by global organizations, disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","MOVEit Transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-09-01","discovered_date":"2023-07-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"381e397ef1c933934e91f0a3c8935706c0a7d319","impact_type":"data_theft","incident_date":"2023-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Caleres_Sample.pdf"},"notes":null,"org_country":"US","org_id":"cacbd1d3b4d8","org_name":"Caleres, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572780"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Caleres_Sample.pdf"}],"summary":"Caleres reported that an unauthorized party accessed certain websites and may have acquired customers’ payment card and personal information.","supporting_quote":null,"technology_involved":["websites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7949b969df4237b59c9bbd0b92aa443513a7802","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/eln-18540-pbi-longevity-portal-2-ad-cm-1y-consumer-r2prf.pdf"},"notes":null,"org_country":"US","org_id":"019b3669ffff","org_name":"Aetna Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572760"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/eln-18540-pbi-longevity-portal-2-ad-cm-1y-consumer-r2prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26444.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer and downloaded data from a server used by PBI in an incident affecting Aetna Life Insurance Company.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-31","discovered_date":"2022-12-29","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"125a02ae0c69ed71b623a72fc93a015292b504a7","impact_type":"data_theft","incident_date":"2022-12-01","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15653.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1657","org_country":"US","org_id":"2bf2914f4fba","org_name":"UnitedHealthcare","org_type":"healthcare","ransomware":null,"records_affected":18418,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15653.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15653.pdf"}],"summary":"An unauthorized party accessed information in UnitedHealthcare’s broker portal while attempting to divert funds intended for agents or brokers.","supporting_quote":null,"technology_involved":["UHC broker portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-31","discovered_date":"2022-12-29","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ac8234d8c38a8835d0a4fdf78dbde6cf8b823f8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1657","org_country":"US","org_id":"2bf2914f4fba","org_name":"UnitedHealthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UnitedHealthcare-2023-08-31"}],"summary":"An unauthorized party accessed the UHC broker portal and information related to members while attempting to divert funds intended for agents or brokers.","supporting_quote":null,"technology_involved":["UHC broker portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"294f85231f469d34ad03095ab7a9af5eda50aa11","impact_type":"unknown","incident_date":"2023-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Topgolf%20Callaway-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"327ac3fdee6d","org_name":"Topgolf Callaway Brands Corp.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572700"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Topgolf%20Callaway%20Brands%20Corp.-2023-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2023-08-31","discovered_date":"2023-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ede14ab49cdf69ee4faf8e890e6e25f17076e0f6","impact_type":"data_theft","incident_date":"2023-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26398.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ed12bf0785b3","org_name":"The Estée Lauder Companies Inc.","org_type":"manufacturing","ransomware":null,"records_affected":150535,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26398.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26398.pdf"}],"summary":"An unauthorized third party accessed Estée Lauder Companies’ systems and obtained company directory data, including employee and consultant information and system passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9ebd315fe3cc945be92c3c37792d23c1ae093d9","impact_type":"data_theft","imported_from":null,"incident_date":"2023-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fbb8e45ebca3","org_name":"PlayCyberGames","org_type":"technology_saas","ransomware":null,"records_affected":3681753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PlayCyberGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/PlayCyberGames"}],"summary":"A breach exposed customer email addresses, usernames, and MD5 password hashes from PlayCyberGames.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8560ea7d2ad9a488368f91cb2c4c7643eec1ec0","impact_type":"data_theft","incident_date":"2023-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"cf4fcd20e048","org_name":"Phished Data via CERT Poland","org_type":"unknown","ransomware":null,"records_affected":67943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Phished Data via CERT Poland","type":"hibp","url":"https://haveibeenpwned.com/Breach/CERTPolandPhish"}],"summary":"In August 2023, CERT Poland observed a phishing campaign that collected credentials from 68k victims . The campaign collected email addresses and passwords via a phishing email masquerading as a purchase order confirmation. CERT Poland identified a further 202 other phishing camp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd6a1ec565dba7d7e0c51e3488d87b694e168807","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b424d897437a","org_name":"Pampling","org_type":"retail_ecommerce","ransomware":null,"records_affected":383468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pampling","type":"hibp","url":"https://haveibeenpwned.com/Breach/Pampling"}],"summary":"Pampling suffered a data breach in January 2020 that exposed customer email addresses, names, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"35f2cf9b8dfda45743311d1b5d233a05261b313d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NassauLifeandAnnuityCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbf681fec82e","org_name":"Nassaul Life and Annuity Company","org_type":"unknown","ransomware":null,"records_affected":2815,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NassauLifeandAnnuityCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf3c89e04aeffc19d1c9b2e868326fea76e85378","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18936%20PBI%20Longevity%20Ad%20Nassau%20CM%202yr%20L06%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"c1a0d4f0cdc1","org_name":"Nassau Life and Annuity Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software MOVEit Transfer allowed unauthorized access to the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572690"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18936%20PBI%20Longevity%20Ad%20Nassau%20CM%202yr%20L06%20r1prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nassau%20Life%20and%20Annuity%20Company-2023-08-31"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-31","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb640223d4d30edb4dcb483534636085d098e00c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted_AG_Proof%2832462811.1%29_Redacted_32463054v1.pdf"},"notes":null,"org_country":"US","org_id":"61d9b8c67322","org_name":"Jackson Lewis","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572692"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted_AG_Proof%2832462811.1%29_Redacted_32463054v1.pdf"}],"summary":"Jackson Lewis reported that two hard drives containing confidential information about personnel and clients were stolen from a locked storage room.","supporting_quote":"Earlier this year, Jackson Lewis was the victim of a theft of two hard drives from a locked storage room in one of our offices.","technology_involved":["hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82f09c9907915e426889fbd1b14e8fe32a68c721","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ThirtyOneGiftsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"143da8d65d83","org_name":"Thirty One Gifts, LLC","org_type":"unknown","ransomware":null,"records_affected":1431,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ThirtyOneGiftsLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"010131a13a704096258f0a3423fabf79ede912e2","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Loyal%20American%20Template%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"fefb1d421ba2","org_name":"Loyal American Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Loyal%20American%20Template%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/LoyalAmericanLifeInsuranceCompany.pdf"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability, accessed a MOVEit Transfer server, and downloaded data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-30","discovered_date":"2023-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbc99fa0d7e97e1bb2b07c006bf521061026a3e5","impact_type":"data_theft","incident_date":"2023-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BHPS%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"96eff703daf3","org_name":"Beverly Hills Plastic Surgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BHPS%20-%20Sample%20Notice.pdf"}],"summary":"Beverly Hills Plastic Surgery reported that an unauthorized actor may have acquired files and data, including personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a40d14b8b8a2d386859f9c6058d5e4976ad4875b","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/eln-18111-sovos-compliance-impacted-indv-ad-cm-24m-r2prf.pdf"},"notes":null,"org_country":"US","org_id":"15e2bdca321c","org_name":"RoundPoint Mortgage Servicing LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized actors exploited a then-unknown vulnerability in Progress Software's MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/eln-18111-sovos-compliance-impacted-indv-ad-cm-24m-r2prf.pdf"}],"summary":"RoundPoint Mortgage Servicing LLC reported that unauthorized actors exploited a then-unknown MOVEit Transfer vulnerability to download a file containing personal information.","supporting_quote":"We recently determined that unauthorized actors exploited the then-unknown MOVEit vulnerability to download a file containing some of your personal information.","technology_involved":["Progress Software MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a69d705194ee0939626a850e4da1312acda7d0f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GastonCollege.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68aedfa38fb5","org_name":"Gaston College","org_type":"unknown","ransomware":null,"records_affected":5496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GastonCollege.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-08-29","discovered_date":"2023-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f67709b2e428c40e77c78b1bf70683d108c004a1","impact_type":"data_theft","incident_date":"2023-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/1Y%20F21%20Master%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"da9e4c59f28d","org_name":"Forever 21","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572568"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/1Y%20F21%20Master%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Forever21.pdf"}],"summary":"Forever 21 reported that an unauthorized third party accessed certain systems and obtained select files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-08-29","discovered_date":"2023-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"54cd185b8c9f0ba42dba522b38d4b306a17a575e","impact_type":"data_theft","incident_date":"2023-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26373.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"183a8692c987","org_name":"F21 OpCo LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":9855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#F21%20OpCo%20LLC%20%28d/b/a%20Forever%2021%29-2023-08-29"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26373.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26373.pdf"}],"summary":"An unauthorized third party accessed Forever 21 systems and obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-29","discovered_date":"2022-09-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c46bb2547a5eae386fe92251b107fa38936a275a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cornwell%20Quality%20Tools%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"edc31ea7cb66","org_name":"Cornwell Quality Tools","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572592"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cornwell%20Quality%20Tools%20-%20Sample%20Notice.pdf"}],"summary":"Cornwell Quality Tools reported that files potentially containing borrower-related personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-29","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6499dfcd627c5a6ee80b95bbbffdf7f902a7a06a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d31f6411c722","org_name":"CONISIGHT LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CONISIGHT%20LLC-2023-08-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-28","discovered_date":"2023-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c6032b560d47a804a7537919ed867a663de877d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SERRV%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"dd012575e04b","org_name":"SERRV International","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SERRV%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SERRV%20International-2023-08-29"}],"summary":"An unauthorized party accessed CommerceV3 systems, and SERRV was notified that some SERRV customers may have been impacted.","supporting_quote":null,"technology_involved":["CommerceV3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-28","discovered_date":"2023-05-31","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff4192deee321007066a2af7dd9ffa9c0479cf00","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18818%20Sovos%20Impacted%20Indv%20Ad%20CM%2024m%20Penny%20Mac%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"518564f07602","org_name":"PennyMac Loan Services LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized actors exploited a then-unknown vulnerability in MOVEit Transfer to download a file.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18818%20Sovos%20Impacted%20Indv%20Ad%20CM%2024m%20Penny%20Mac%20r4prf.pdf"}],"summary":"Unauthorized actors exploited a then-unknown vulnerability in MOVEit Transfer to download a file containing PennyMac Loan Services LLC customer personal information.","supporting_quote":"We recently determined that unauthorized actors exploited the then-unknown MOVEit vulnerability to download a file containing some of your personal information.","technology_involved":["MOVEit Transfer (SecureFT)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c05ab69ffe8ded200370ec696359b7ce9a940952","impact_type":"unknown","incident_date":"2023-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification_KIPP%20NorCal.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c2515e6a5ef","org_name":"KIPP Public Schools Northern California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572507"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3343abdc0eca5343c7580682d8d51d5d51898a60","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CareSource%20Notification%20Ltr.pdf"},"notes":null,"org_country":"US","org_id":"e5bc679b4b68","org_name":"CareSource","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572498"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CareSource%20Notification%20Ltr.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26378.pdf"}],"summary":"CareSource reported that a bad actor accessed its vendor’s MOVEit software and copied data that included protected health information.","supporting_quote":"On May 31, 2023, the software of one of our vendors (MOVEit) was hacked by a bad actor.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"418bea64460aa49afa96f5867e83d90992cf5f61","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SAMPLE%20-%20ELN-18930%20Thirty%20One%20Gifts%20Ad%20CM%20r5prf.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d9c62730151f","org_name":"TOG Hold Co. & Thirty One Gifts","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572457"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26339.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-25","discovered_date":"2023-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"196a78b31102a1c4515164375ef4949e6ca811d3","impact_type":"both","incident_date":"2023-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26348.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2bf2914f4fba","org_name":"UnitedHealthcare","org_type":"healthcare","ransomware":true,"records_affected":1025,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26348.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26348.pdf"}],"summary":"A ransomware incident affecting Harvard Pilgrim systems resulted in personal and health information associated with UnitedHealthcare being copied and taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Harvard Pilgrim Health Care"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"38f0cddcbabf","name":"Harvard Pilgrim Health Care"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-25","discovered_date":"2023-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee6fa7a173a27513c7f75519b740aa8fb705cf82","impact_type":"disruption_or_ransomware","incident_date":"2023-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PurFoods%20Holdings%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c63f61569121","org_name":"PurFoods, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572428"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PurFoods%20Holdings%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/PurFoodsLLC.pdf"}],"summary":"PurFoods, LLC reported a cyberattack that encrypted certain files and said it could not rule out data being taken from a file server.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0a58ec7624810c3a1cfadd3e60075ce4daabd51a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SovosComplianceLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"717f93100242","org_name":"SOVOS Complaince, LLC","org_type":"unknown","ransomware":null,"records_affected":63,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SovosComplianceLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f24ce0842edf2d42d0bf3084e91488ece609ba3c","impact_type":"data_theft","imported_from":null,"incident_date":"2022-12-11","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e6a9e76299bf","org_name":"SevenRooms","org_type":"technology_saas","ransomware":null,"records_affected":1205385,"reviewed":false,"root_cause":"The breach was due to unauthorized access of a third-party vendor's file transfer interface.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SevenRooms","type":"hibp","url":"https://haveibeenpwned.com/Breach/SevenRooms"}],"summary":"SevenRooms data, including email addresses, names, and purchases, was posted for sale after unauthorized access to a third-party vendor's file transfer interface.","supporting_quote":"SevenRooms advised that the breach was due to unauthorised access of \"a file transfer interface of a third-party vendor\".","technology_involved":["third-party file transfer interface"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"784469ee49e30309976a680d6262b4b33f1f501c","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI-NTT%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ac992bdcc720","org_name":"PBI Research Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in MOVEit Transfer allowed a third party to access PBI's MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572330"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI-NTT%20California%20Notification.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer to access PBI Research Services' server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software, disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"24518c0bc115f0eae0f5710d84688ddc0c099405","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26326.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a42236d26c2f","org_name":"NTT DATA Americas, Inc.","org_type":"professional_services","ransomware":null,"records_affected":4485,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software allowed unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NTT%20DATA%20Americas%2C%20Inc.%20on%20behalf%20of%20PBI%20Research%20Services-2023-08-24"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26326.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NTTDATAAmericasInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26326.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software, disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"254e1900827daedaadfae7459ba2f8421e3a2aaa","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26337.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82b9de082c74","org_name":"Edmonds College","org_type":"unknown","ransomware":null,"records_affected":12415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26337.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"658c1aa32b1c08ee2a7d31aa5e68254449c3cc46","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI-MMA-CGIC%20Adult%20Consumer%20Notice%20of%20Security%20Incident%20Letter%20-%202023.pdf"},"notes":null,"org_country":"US","org_id":"452af1001184","org_name":"Continental General Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572319"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI-MMA-CGIC%20Adult%20Consumer%20Notice%20of%20Security%20Incident%20Letter%20-%202023.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Continental%20General%20Insurance%20Company-2023-08-24"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a Continental General Insurance Company server and download personal information.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-24","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dacab5aa727b135caf97556ed66f8e500c9c300e","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26329.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"90bf5ba14d8f","org_name":"Cognisight","org_type":"professional_services","ransomware":null,"records_affected":542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26329.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26329.pdf"}],"summary":"Cognisight reported that an unauthorized actor took files from its MOVEit server, affecting some protected health information.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-24","discovered_date":"2023-08-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9f18d61bc5198011579c020a9ad326d6e989388","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chevron%20Adult%201Yr.pdf"},"notes":null,"org_country":"US","org_id":"0ce08beb2ac5","org_name":"Chevron Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":947,"reviewed":false,"root_cause":"An unauthorized party exploited a vulnerability in the MOVEit application to decrypt and download data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572364"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chevron%20Adult%201Yr.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Chevron%20Federal%20Credit%20Union%20%28%22CFCU%22%29-2023-08-24"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26335.pdf"}],"summary":"Chevron Federal Credit Union reported that an unauthorized party exploited a vulnerability in its MOVEit application and downloaded files containing personal information.","supporting_quote":"On August 1, 2023, we determined that an unauthorized party was able to decrypt and download some of the data in our MOVEit application by exploiting this vulnerability between May 3 0, 2023 and May 31, 2023.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e5dd0bdacb30e22806df96f8c805ba3b8390f3e9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d6e6d30a0f3","org_name":"TMX Finance Corporate Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":4895817,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TMX%20Finance%20Corporate%20Services%2C%20Inc.%2C%20on%20behalf%20of%20itself%2C%20its%20parent%20TMX%20Finance%20LLC%20%26%20affiliates-2023-08-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a5212883b9cb5b3a2214877d144c0241c9b20a9d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26313.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"719ccf123b8f","org_name":"Sovos Compliance","org_type":"technology_saas","ransomware":null,"records_affected":11103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26313.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26313.pdf"}],"summary":"Sovos Compliance reported that an incident involving MOVEit Transfer affected personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-23","discovered_date":"2023-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b8bc6440ef14280cc363a3a05b6b49602e9bd22","impact_type":"data_theft","incident_date":"2023-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26302.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"62b16dba1d68","org_name":"R&B Corporation of Virginia","org_type":"unknown","ransomware":null,"records_affected":1564,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26302.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26302.pdf"}],"summary":"The organization reported that files were copied from certain systems during a data security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2023-08-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bc9b823b62af1408790763335ce17ada09b2f94","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f786b91768e7","org_name":"Duolingo","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Data was obtained by enumerating a vulnerable API.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Duolingo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Duolingo"}],"summary":"Data scraped from Duolingo by enumerating a vulnerable API was distributed on a hacking forum.","supporting_quote":"Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo.","technology_involved":["Duolingo API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68cb82504d0d30c749225290d2db465f3814a8c0","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DMA%20-%20California%20-%20Notification%20Letter%20Samples.pdf"},"notes":null,"org_country":"US","org_id":"dbc7da0b7960","org_name":"Data Media Associates, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572311"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DMA%20-%20California%20-%20Notification%20Letter%20Samples.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Data%20Media%20Associates%2C%20LLC-2023-08-23"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15677.pdf"}],"summary":"Data Media Associates reported that data stored in MOVEit Transfer may have been acquired without authorization.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-22","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8936f0f6725319dccbfc89f1e0fd3bde637a1fc1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Portfolio%20Escrow%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7e4ae6121c48","org_name":"Portfolio Escrow Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572198"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Portfolio%20Escrow%20-%20Sample%20Notice.pdf"}],"summary":"Portfolio Escrow reported that devices were stolen from its office and personal information may have been stored on them.","supporting_quote":"Portfolio Escrow then began a review of files utilized by the individuals whose devices were stolen in an effort to determine if any sensitive or personal information was potentially accessible.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":["CVE-2023-3462"],"data_types":["personal","financial"],"disclosed_date":"2023-08-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e91a2dcf3ef647dc5b304a0c3597e8e042c9af03","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15678.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"62b1a5270b13","org_name":"Huntington Bank","org_type":"financial","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":"Alogent's MOVEit Transfer application was exploited through a zero-day vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15678.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15678.pdf"}],"summary":"An attacker exploited a zero-day vulnerability in Alogent's MOVEit Transfer application and stole images of checks processed for Huntington Bank.","supporting_quote":"An unauthorized third party exploited this vulnerability to steal from Alogent images of certain checks processed by Alogent on behalf of Huntington.","technology_involved":["Progress Software MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Alogent"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"a418400d105d","name":"Alogent"}],"kev":[{"cve":"CVE-2023-3462","kev_added":null,"name":null,"days_listed_before_incident":null,"product":"hashicorp vault"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2961d8e355aed7956f758940ed2af708e22a9cd3","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"c97567066288","org_name":"Atmeltomo","org_type":"technology_saas","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Atmeltomo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Atmeltomo"}],"summary":"Atmeltomo suffered a data breach in April 2021 that exposed records containing email addresses, usernames, IP addresses, and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c692c7a063976057cc8db6bdd4a9f92a428faf3","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecfd1128c743","org_name":"Sun Life","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572148"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sun%20Life-2023-08-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-21","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"975fce41923864e205526f1a7f502a01fcab813d","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ORAU%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"390bbcd62729","org_name":"Oak Ridge Associated Universities","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer allowed a criminal organization to access ORAU's data without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ORAU%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oak%20Ridge%20Associated%20Universities-2023-08-21"}],"summary":"A vulnerability in MOVEit Transfer allowed a criminal organization to access and download ORAU data containing personal information.","supporting_quote":"a global vulnerability in the MOVEit software platform resulted in a criminal organization being able to appear as an authorized user, access information on the MOVEit environment, and obtain an unencrypted copy without authorization.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c188793f6d1185b9d270ab9c0e12d761807a3788","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Sample%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a50dd8fbc16e","org_name":"MidFirst Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572155"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26105.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d19f6af4bd45635457f6931a328183f549d73a78","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GlobalAtlanticFinancial%20GroupLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1480c9c19a3e","org_name":"Global Atlantic Financial Group, LLC","org_type":"unknown","ransomware":null,"records_affected":14913,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GlobalAtlanticFinancial%20GroupLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1a9ff20b60fb8f74e6bc7647f69dd13a7cdb9ae","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5e78d07eae25","org_name":"ECCIE","org_type":"other","ransomware":null,"records_affected":536923,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ECCIE","type":"hibp","url":"https://haveibeenpwned.com/Breach/ECCIE"}],"summary":"ECCIE suffered a data breach involving 536,923 user records with email and IP addresses, usernames, dates of birth and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-21","discovered_date":"2022-12-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1303d10536d2db8dfdd861f085f0e71c284ab793","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-19","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AC%202023-19817_2022-19615%20%20ENGLISH%204.19.23.pdf"},"notes":null,"org_country":"US","org_id":"40ab2fc24485","org_name":"County of Los Angeles Department of Public Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A County employee accessed personal information without a legitimate business reason.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AC%202023-19817_2022-19615%20%20ENGLISH%204.19.23.pdf"}],"summary":"A County employee accessed personal information in the County's electronic systems without a legitimate business reason.","supporting_quote":"A County employee accessed your personal information contained in our electronic systems without a legitimate business reason.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2023-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"977bb4b6621e12e0881f90167df0ccf1877744ac","impact_type":"both","incident_date":"2023-02-07","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18661%20Purpose%20Financial%202%20Ad%20CM%2012m%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"68ca18b918a0","org_name":"Advance America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18661%20Purpose%20Financial%202%20Ad%20CM%2012m%20r3prf.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AdvanceAmerica.pdf"}],"summary":"Advance America reported a temporary corporate systems outage and unauthorized access to or acquisition of corporate business records containing individuals’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2023-08-18","discovered_date":"2023-05-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74b5c2a3bf8346176705ac4a7181f051a3298de4","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tesla%20-%20Template%20Notice%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"e0fe62051342","org_name":"Tesla","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Two former employees misappropriated Tesla information in violation of the company’s IT security and data protection policies.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572078"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tesla%20-%20Template%20Notice%20%28CA%29.pdf"}],"summary":"Two former Tesla employees misappropriated confidential information, including employee-related records, and shared it with a media outlet.","supporting_quote":"The investigation revealed that two former Tesla employees misappropriated the information in violation of Tesla’s IT security and data protection policies and shared it with the media outlet.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a00c667ae696c7cee026041ad8cebd3f505ad16d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Orrick%20Herrington%20Sutcliffe%20LLP-Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5acbf6a2ed89","org_name":"Orrick, Herrington & Sutcliffe LLP","org_type":"unknown","ransomware":null,"records_affected":2297,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP-2023-08-18"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Orrick%20Herrington%20Sutcliffe%20LLP-Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2023-08-18","discovered_date":"2023-08-14","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd5f08459a504028e43a2f2500f3f7ea3330c7f7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTICE-OF-DATA-INCIDENT.pdf"},"notes":null,"org_country":"US","org_id":"7436bf440ac4","org_name":"Mitsuwa Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572081"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTICE-OF-DATA-INCIDENT.pdf"}],"summary":"Mitsuwa discovered a credit card skimmer on a San Diego store point-of-sale device that may have collected customers’ credit card numbers and security codes.","supporting_quote":"On August 14, 2023, Mitsuwa’s San Diego store discovered that a credit card skimmer was installed on the point-of-sale (“POS”) device at one of its checkout stands.","technology_involved":["point-of-sale device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-18","discovered_date":"2023-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1879b3aa3fe118bd69f8c6c8493b8117a3e9c96a","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Maximus%20Human%20Services%2C%20Inc%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"25c2484c18ec","org_name":"Maximus, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously unknown vulnerability in Progress MOVEit software allowed an unauthorized party to access files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Maximus%20Human%20Services%2C%20Inc%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15654.pdf"}],"summary":"An unauthorized party exploited a previously unknown vulnerability in Maximus’s MOVEit environment and obtained copies of files containing personal information.","supporting_quote":"Later that same day, Progress first publicly announced a previously unknown vulnerability in _it_s MOVEit software, which an unauthorized party used to gain access to files of many MOVEit . customers.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-18","discovered_date":"2023-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"44fe4a13a0f9190933b164a7ac448a154c1c1211","impact_type":"data_theft","incident_date":"2023-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2023/Everside%20Health%20-%20Consumer%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2e1fb7bb14ee","org_name":"Everside Health","org_type":"healthcare","ransomware":null,"records_affected":16107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2023/Everside%20Health%20-%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2023/Everside%20Health%20-%20Consumer%20Notice.pdf"}],"summary":"Everside Health identified suspicious activity and determined that an unauthorized party accessed its network and copied documents between April 22 and April 28, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"245345708acc5d8dfcd325c0a22b3c4ca068bd24","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20National%20Sample%20Notification%20Letter%20August%2011%202023%20V2.pdf"},"notes":null,"org_country":"US","org_id":"326b4996eb99","org_name":"American National Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software Corporation's MOVEit Transfer application affected American National's systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20National%20Sample%20Notification%20Letter%20August%2011%202023%20V2.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AmericanNationalInsuranceCompany.pdf"}],"summary":"An unauthorized third party accessed American National MOVEit systems and acquired files containing customers' personal information.","supporting_quote":"Many organizations globally, including American National, were affected by this vulnerability because of the widespread use of MOVEit for va rious business purposes.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a0c6cc3546e26d1e27f9a7fb4f4984aeb1a03ee","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20of%20Data%20Event%20-%20PBI.pdf"},"notes":null,"org_country":"US","org_id":"d2f70b65af85","org_name":"The Colorado State University System","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software enabled a third party to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572036"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20of%20Data%20Event%20-%20PBI.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25854.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer, accessed a server, and downloaded data that included names.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-17","discovered_date":"2023-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08badcb872a1d3fbd49f4db1a2fd8ff64ebf36a6","impact_type":"both","incident_date":"2023-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Pathways%20to%20Wellness_Redacted.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"d9a4852df9f5","org_name":"Pathways to Wellness Medication Clinics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Pathways%20to%20Wellness_Redacted.pdf"}],"summary":"Pathways to Wellness reported an unauthorized party accessed its network environment, disabled systems, and may have acquired personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1306d7e59b4dc173ed1941e1a46adc43f0798509","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Osiac%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"62aa8e0a8868","org_name":"Osiac","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572025"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Osiac%20-%20California%20Notification.pdf"}],"summary":"Osiac reported that personal information provided to RRD was included in data exfiltrated from RRD’s corporate data system.","supporting_quote":null,"technology_involved":["RRD corporate data system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"RRD"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7e81cb57abc8","name":"RRD"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-08-17","discovered_date":"2023-04-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a90ac1e194feddb1696df534c07086ed05eafe","impact_type":"data_theft","incident_date":"2023-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J8746_MORRIS_HOSPITAL_L02_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"2a5484cbd2a3","org_name":"Morris Hospital & Healthcare Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571977"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J8746_MORRIS_HOSPITAL_L02_SAS_1.pdf"}],"summary":"Morris Hospital reported that an unauthorized party exported files containing information about employees, dependents, beneficiaries, and patients to an external cloud storage platform.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"232134a0417c509de64b4a5564850ec7eeecb150","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"584e59107d1f","org_name":"iMenu360","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: iMenu360","type":"hibp","url":"https://haveibeenpwned.com/Breach/iMenu360"}],"summary":"Customer records from iMenu360 ordering systems were exposed, including names, contact details, and location data.","supporting_quote":null,"technology_involved":["iMenu360"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3dd07da3850d030515db7787d6d7d6f2ac7f956f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26224.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e35ef2c9560e","org_name":"Everett Community College","org_type":"education","ransomware":null,"records_affected":9078,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26224.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26224.pdf"}],"summary":"Everett Community College said student and alumni personal information held by the National Student Clearinghouse may have been exposed in a MOVEit-related data breach.","supporting_quote":"But the National Student Clearinghouse (NSC), a third-party service provider that EvCC works with, notified EvCC in June that personally identifiable information from some students and alumni may have been exposed.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"National Student Clearinghouse"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"1705c8d80b7a","name":"National Student Clearinghouse"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5acad78b88fb84e2b769c48f49bcd97ff11d1482","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18631%20Regal%20Securities%20Ad%20CM%2024m%20r8prf.pdf"},"notes":null,"org_country":"US","org_id":"33db1a518059","org_name":"Regal Securities, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571962"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18631%20Regal%20Securities%20Ad%20CM%2024m%20r8prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26214.pdf"}],"summary":"Regal Securities reported that suspicious activity affected access to some systems and personal information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-16","discovered_date":"2023-06-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eba4257cf38f9b6d24f6a591e91b212ea85ab43d","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_CatchAll_PHTECH_Member_Notification_static%20proof%20r4%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"ef1a167d6961","org_name":"PH TECH","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited a previously unidentified weakness in Progress MOVEit software to download PH TECH information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571925"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_CatchAll_PHTECH_Member_Notification_static%20proof%20r4%20%282%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25746.pdf"}],"summary":"An unknown actor exploited a weakness in Progress MOVEit and downloaded personal and medical information stored by PH TECH.","supporting_quote":"An unknown actor took advantage of this weakness and downloaded certain personal information stored by PH TECH.","technology_involved":["Progress MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85d5c93ba496c9ce3eb7ad05619bffea0807182e","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20Sample%20-%20PBI%20Nassau_CNA%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"a82162093f5d","org_name":"Jackson","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Letter%20Sample%20-%20PBI%20Nassau_CNA%20%281%29.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access Jackson's server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-16","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dc5350984055c9f2254b85ffff7e17fa12b54de","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BankCard%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fff53b419a3b","org_name":"BankCard USA Merchant Services Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571961"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BankCard%20-%20Sample%20Notice.pdf"}],"summary":"BankCard USA Merchant Services reported that an unauthorized party accessed and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-15","discovered_date":"2023-05-31","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20f6f3c4de4c422ed017bd9ece5dcae305d31206","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42611d25_FirstsunCapitalBancorp%232_L01_SAS_2.pdf"},"notes":null,"org_country":"US","org_id":"66321af02c40","org_name":"Sunflower Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software’s MOVEit file transfer software was the source of the incident.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574636"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571902"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42611d25_FirstsunCapitalBancorp%232_L01_SAS_2.pdf"}],"summary":"Sunflower Bank reported that a vulnerability in Progress Software’s MOVEit software may have affected files containing personal and financial information.","supporting_quote":"As this incident originated from and was limited to a vulnerability within Progress Software’s MOVEit software, we worked closely with Progress Software to identify the potentially impacted files for sensitive information.","technology_involved":["Progress Software MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c81dded060e72126faf6cc6996bd53a5a213f91b","impact_type":"data_theft","imported_from":null,"incident_date":"2023-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IL","org_id":"bdaf12d1bb33","org_name":"Jobzone","org_type":"technology_saas","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Jobzone","type":"hibp","url":"https://haveibeenpwned.com/Breach/Jobzone"}],"summary":"Data from Jobzone was posted online in April 2023, including personal information from 30,000 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dd269cbf93a10c8e23eb0a8ac48add5bea157b02","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GerberChildrenswearLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"93bcce6568f0","org_name":"Gerber Childrenswear, LLC","org_type":"unknown","ransomware":null,"records_affected":1020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GerberChildrenswearLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de4316c77709891b0eeb8f860879e3ff560ab61f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CAPMC%20-%20Consumer%20Notification%20Letter%20%28Adult%29.pdf"},"notes":null,"org_country":"US","org_id":"51ac4d61bf9f","org_name":"Community Action Partnership of Madera County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571894"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CAPMC%20-%20Consumer%20Notification%20Letter%20%28Adult%29.pdf"}],"summary":"Community Action Partnership of Madera County reported that a December 2022 network disruption may have impacted personal information, including health insurance information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b6c5f4d9ac08efb5f86b7ac09da26e682877151b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TiftRegionalHealthSystemInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"128324dce045","org_name":"Tift Regional Health System, Inc.","org_type":"unknown","ransomware":null,"records_affected":356,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TiftRegionalHealthSystemInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f590d2b5a7692bfb0dc91ca813f297110cb9c0e4","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ffe5144e82d8","org_name":"The Global Atlantic Financial Group LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571816"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26023.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ab8f66cce53c8c7f0a2f961d1142e0b37f4b4af","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_2.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"c79188a91445","org_name":"Milliman, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software's MOVEit Transfer software was exploited by an unauthorized third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571830"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Milliman%2C%20Inc.-2023-08-14"}],"summary":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software, affecting Milliman data.","supporting_quote":"On or around May 29, 2023, Progress Software, the provider of MOVEit Transfer software, disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bf4f1f6d6069b4e57174bffb3769d62661a1040f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ColoradoDepartmentofHealthCarePolicyFinancing.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84d8c961005e","org_name":"Colorado Department of Health Care Policy and Financing","org_type":"unknown","ransomware":null,"records_affected":3683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ColoradoDepartmentofHealthCarePolicyFinancing.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-11","discovered_date":"2023-06-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"202265ee1c6db05f27cb7fe921385a2ddf506e62","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15493.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b7dc42882b50","org_name":"Umpqua Bank","org_type":"financial","ransomware":null,"records_affected":145274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15493.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15493.pdf"}],"summary":"A third-party vendor notified Umpqua Bank that an unauthorized party may have accessed files transferred through MOVEit Transfer containing customer names and Social Security numbers.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"400ed2c932d6a2f67e91fd4bb2623d120f9987e4","impact_type":"both","incident_date":"2022-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Interface%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b26cae8338db","org_name":"Interface, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571695"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Interface%20-%20Sample%20Notice.pdf"}],"summary":"Interface reported a data security incident that temporarily disrupted operations and may have exposed minors’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-11","discovered_date":"2023-01-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ecaa0f62523ec8154ab9f14d6e12836952dfa06","impact_type":"data_theft","incident_date":"2022-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20W6_R1_Source.pdf"},"notes":null,"org_country":"US","org_id":"8ba17831b4cd","org_name":"Hub International Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-584048"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20W6_R1_Source.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hub%20International%20Limited-2023-08-11"}],"summary":"Hub International identified unauthorized access to certain systems and determined that files were copied without authorization between December 2022 and January 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-11","discovered_date":"2023-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"ef8ccfe6c5ab7d75f342d8b9771ff99518c2e39e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letters.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f1d9cf27e569","org_name":"Fidelity National Information Services, Inc.","org_type":"financial","ransomware":null,"records_affected":793626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fidelity%20National%20Information%20Services%2C%20Inc.-2023-10-04"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576312"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571656"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573842"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letters.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fidelity%20National%20Information%20Services%2C%20Inc.-2023-08-11"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letters.pdf"}],"summary":"Fidelity National Information Services reported that an unauthorized third party accessed files containing personal information transferred through MOVEit Transfer by its service provider.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-11","discovered_date":"2023-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69615651fe92dac6e66392ea70d10f7f79add960","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"58c1c78fcfb0","org_name":"EP Global Production Solutions, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571704"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#EP%20Global%20Production%20Solutions%2C%20LLC-2023-08-11"}],"summary":"EP Global Production Solutions detected suspicious activity on June 30, 2023, and later determined that database files containing personal information had been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8e549052af3d54447260207be4a1db3276a6bf7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/EMSManagementandConsultantsInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02bf6497c8c7","org_name":"EMS Management and Consultants Inc.","org_type":"unknown","ransomware":null,"records_affected":7352,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/EMSManagementandConsultantsInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-08-11","discovered_date":"2023-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01ea7f253379f38d9f374650b0f96e199eab05f8","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Colorado%20Department%20of%20Health%20Care%20Policy%20%26%20Financing%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"a22383c8b53c","org_name":"Colorado Department of Health Care Policy & Financing","org_type":"government","ransomware":null,"records_affected":4662668,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581211"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574615"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571694"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Colorado%20Department%20of%20Health%20Care%20Policy%20%26%20Financing%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colorado%20Department%20of%20Health%20Care%20Policy%20%26%20Financing-2024-02-19"}],"summary":"An unauthorized actor accessed HCPF files containing members’ information on IBM’s MOVEit Transfer application.","supporting_quote":"On June 13, 2023, the investigation identified that certain HCPF files on the MOVEit application used by IBM were accessed by the unauthorized actor on or about May 28, 2023.","technology_involved":["MOVEit Transfer","IBM"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IBM"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"0cb4d917e4a0","name":"IBM"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-11","discovered_date":"2023-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5ce02aece48f7b66f26b8a062819a8889881c66","impact_type":"data_theft","incident_date":"2023-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BrightSpring%20-%20%28Adult%20-%201%20Year%20CM%29%20-%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"19cd8208777d","org_name":"BrightSpring Health Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BrightSpring%20-%20%28Adult%20-%201%20Year%20CM%29%20-%20PROOF.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BrightSpring%20Health%20Services-2023-08-11"}],"summary":"BrightSpring Health Services reported that an unknown third party accessed its computer systems and that files containing personal information were involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ef9377d829871b404d711c20b4bdf0ef02527c8","impact_type":"data_theft","imported_from":null,"incident_date":"2023-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"GB","org_id":"798d7ef6d46f","org_name":"Rightbiz","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Rightbiz","type":"hibp","url":"https://haveibeenpwned.com/Breach/Rightbiz"}],"summary":"Data associated with Rightbiz appeared on a hacking forum, including email addresses, names, phone numbers and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29ab859825137a1b4b945ea52caab298022ab84d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42811d22_AndesaServices.pdf"},"notes":null,"org_country":"US","org_id":"05134183f56d","org_name":"New York Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown actor exploited a vulnerability in the MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-575514"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571593"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571651"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572327"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42811d22_AndesaServices.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20York%20Life%20Insurance%20Company-2023-08-24"}],"summary":"An unknown actor exploited a vulnerability to access data on New York Life Insurance Company’s MOVEit Transfer server.","supporting_quote":"We have determined that an unknown actor exploited the vulnerab ility, accessed the MOVEit Transfer server between May 30, 2023 and May 31, 2023, and obtained a ccess to certain data from the MOVEit Transfer server during that time.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"776df749923f62ed1fab55cf9950b052075513c5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26166.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2877641ac1fd","org_name":"IEC Group Inc.","org_type":"unknown","ransomware":null,"records_affected":662,"reviewed":false,"root_cause":"A filtered claims spreadsheet was emailed to members and could be unfiltered to reveal other members’ information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26166.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26166.pdf"}],"summary":"IEC Group Inc. disclosed that an emailed filtered claims spreadsheet could be unfiltered to reveal other members’ personal information.","supporting_quote":"That spreadsheet contained portions of a claims report . It was filtered to show only the recipient’s information.","technology_involved":["Excel","email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5f1f61a2d87a881ebeab8bfb573a88fd4d1f5f5","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI%20Adult%20CM%201Y%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"04711a344d4f","org_name":"County of Santa Clara","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571591"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI%20Adult%20CM%201Y%20Consumer%20Letter.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer and downloaded data from a server used by the County of Santa Clara.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"823c1a5b6b808d4d4dc15bd94764c76234721108","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vermont%20Christmas%20Company%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8a0371491339","org_name":"Vermont Christmas Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571554"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vermont%20Christmas%20Company%20-%20Sample%20Notice.pdf"}],"summary":"Unauthorized access to CommerceV3 systems potentially affected Vermont Christmas Company customer information.","supporting_quote":null,"technology_involved":["CommerceV3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2023-08-09","discovered_date":"2023-04-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca4252da8e8d7f152c23fb4bfa36e16a6ccdd1a1","impact_type":"both","imported_from":null,"incident_date":"2023-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J6395_PAUL_MARTIN%27S_AMERICAN_GRILL_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"ef499d6f0748","org_name":"Paul Martin’s American Grill","org_type":"other","ransomware":true,"records_affected":1066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571521"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J6395_PAUL_MARTIN%27S_AMERICAN_GRILL_L01_SAS_0.pdf"}],"summary":"Paul Martin’s American Grill reported that a threat actor accessed its systems, encrypted data on corporate-office servers with ransomware, and claimed to have acquired data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"698f3ff887e87e7d4e75e5c121507c14d214d84c","impact_type":"data_theft","incident_date":"2023-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gensler%20CA%20-%20Letter%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"d3c7273a2dda","org_name":"M. Arthur Gensler, Jr. & Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gensler%20CA%20-%20Letter%20Proof.pdf"}],"summary":"An unauthorized party accessed and copied Gensler files on the Progress MOVEit platform, including a file containing personal information.","supporting_quote":null,"technology_involved":["Progress MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-09","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36d46775f9bc499a2933248d5f17fffcd5286703","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b252ab975f4d","org_name":"Ernst & Young LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the third-party MOVEit Transfer solution was used to compromise files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-587852"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571532"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Letter_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26147.pdf"}],"summary":"Ernst & Young LLP reported that files in the third-party MOVEit Transfer solution were compromised through a software vulnerability.","supporting_quote":"Certain files within the third-party software solution have been compromised through this software vulnerability.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-09","discovered_date":"2023-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d6ad8e6bc55691981d89df41fc0f0f4fa3baac9","impact_type":"disruption_or_ransomware","incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26152.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"730404ed3581","org_name":"Associated Materials, LLC","org_type":"manufacturing","ransomware":null,"records_affected":660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26152.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26152.pdf"}],"summary":"Associated Materials reported that an unauthorized party encrypted systems at a manufacturing plant and may have accessed and copied files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca1d83460aa05600202df0be8aa64eb4ffc0e38c","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26146.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0116355131be","org_name":"American National Group, LLC","org_type":"financial","ransomware":null,"records_affected":24345,"reviewed":false,"root_cause":"A vulnerability in Progress Software's MOVEit Transfer application was used to gain access to American National MOVEit systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26146.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26146.pdf"}],"summary":"An unauthorized third party accessed American National MOVEit systems through a vulnerability in MOVEit Transfer and acquired files containing customers' personal information.","supporting_quote":"Many organizations globally, including American National, were affected by this vulnerability because of the widespread use of MOVEit for va rious business purposes.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bc6b0ce3d95415a0ae9300a356704a6b5efa3c1","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20National%20Sample%20Notification%20Letter%20v2.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"0116355131be","org_name":"American National Group, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited a previously unknown vulnerability affecting the MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571563"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20National%20Sample%20Notification%20Letter%20v2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20National%20Group%20LLC-2023-08-09"}],"summary":"American National said an unauthorized third party accessed its MOVEit systems and acquired files containing customers’ personal information.","supporting_quote":"Many organizations globally, including American National, were affected by this vulnerability because of the widespread use of MOVEit for various business purposes.","technology_involved":["MOVEit Transfer","Progress Software Corporation"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-08","discovered_date":"2023-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59aecc09c0f083f08956b3b58d139bd09d951972","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"278e10661455","org_name":"The Global Atlantic Financial Group LLC (“Global Atlantic”)","org_type":"unknown","ransomware":null,"records_affected":972485,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Global%20Atlantic%20Financial%20Group%20LLC%20%28%E2%80%9CGlobal%20Atlantic%E2%80%9D%29-2023-08-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-08","discovered_date":"2023-05-30","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"0ef9768217d68d320f49f717a5ad24f423b07456","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ltr%20from%20FeinA%20to%20CA%20OAG%208-8-2023_Enclosure.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ad65158a8722","org_name":"TD Ameritrade","org_type":"financial","ransomware":null,"records_affected":61160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TD%20Ameritrade%2C%20Inc.%20and%20Charles%20Schwab%20%26%20Co.%2C%20Inc.%2C%20a%20TD%20Ameritrade%20affiliate.-2023-08-08"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ltr%20from%20FeinA%20to%20CA%20OAG%208-8-2023_Enclosure.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ltr%20from%20FeinA%20to%20CA%20OAG%208-8-2023_Enclosure.pdf"}],"summary":"Unauthorized individuals accessed a TD Ameritrade application of MOVEit Transfer and stole data that included personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-08","discovered_date":"2023-05-30","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02cc27e8ff436a6a19558f81cf2d3f58dc2f52b9","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26139.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ad65158a8722","org_name":"TD Ameritrade","org_type":"financial","ransomware":null,"records_affected":1662,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26139.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26139.pdf"}],"summary":"Unauthorized individuals accessed a TD Ameritrade application of MOVEit Transfer and stole data, including some affected individuals’ personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97d1da1a57096751d822ce0979bde657c92ec962","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Auths%20Letter%20REDACTED.pdf"},"notes":null,"org_country":"US","org_id":"3183f7bb7006","org_name":"Redwood Coast Regional Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Auths%20Letter%20REDACTED.pdf"}],"summary":"Redwood Coast Regional Center reported that an email encryption failure during a system outage led to personal and health information being shared via email.","supporting_quote":null,"technology_involved":["mail server","email encryption software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16b6b4353396ead6170ffdf24801cf2024f8610b","impact_type":"data_theft","imported_from":null,"incident_date":"2022-03-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"TR","org_id":"6a18c2e7c91a","org_name":"CraftRise","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CraftRise","type":"hibp","url":"https://haveibeenpwned.com/Breach/CraftRise"}],"summary":"CraftRise user data, including email addresses, usernames, geographic locations and plain text passwords, was shared on a hacking forum.","supporting_quote":null,"technology_involved":["Minecraft server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-08-07","discovered_date":"2022-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"772ec77b030e93e7885fcfc18ffdd21e74881a21","impact_type":"disruption_or_ransomware","incident_date":"2022-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VALENCIA%20NOTICE_6pager_No%20Data%20Proof_Rev1.pdf"},"notes":null,"org_country":"US","org_id":"d8d0d78bab2e","org_name":"Valencia Wilberding & Romero","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571434"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VALENCIA%20NOTICE_6pager_No%20Data%20Proof_Rev1.pdf"}],"summary":"Valencia Wilberding & Romero took its systems offline after a security incident, and files containing personal and medical information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-07","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6e37d80d0bbe96a3e08305bd583179492eb6507","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-02","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HSS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c98c3b4270a2","org_name":"Hospitality Staffing Solutions LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571430"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HSS%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/HospitalityStaffingSolutionsLLC.pdf"}],"summary":"Hospitality Staffing Solutions LLC reported that an unauthorized third party accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d71fa02e0d0e8e32b99cf269fa4177b4394de41","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20PBI.pdf"},"notes":null,"org_country":"US","org_id":"7dbccc3fbd3b","org_name":"Transamerica Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited by an unauthorized third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571343"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20PBI.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15308.pdf"}],"summary":"A third party exploited a MOVEit Transfer vulnerability to access a server and download data related to Transamerica Life Insurance Company.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38a81bb552f6065bb61f56abf4db1c6598210f1e","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stark_Impacted_Individual_Notice_final_proof_32340084v1.pdf"},"notes":null,"org_country":"US","org_id":"f07ce9e86918","org_name":"Loren D. Stark Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stark_Impacted_Individual_Notice_final_proof_32340084v1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/LorenDStarkCompany.pdf"}],"summary":"Loren D. Stark Company reported potential unauthorized access to or acquisition of files from portions of its network on October 18, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-04","discovered_date":"2023-05-02","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5aba6074468466cb66cac2e8b24c4ab6a76b7220","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_4.pdf"},"notes":null,"org_country":"US","org_id":"0aebadfbd956","org_name":"Lendio Partners, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the website loan application platform allowed an unauthorized third party to access borrower information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571333"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_4.pdf"}],"summary":"Lendio reported that an unauthorized third party exploited a vulnerability in its website loan application platform and accessed borrower information.","supporting_quote":"It was subsequently determined that an unauthorized third party exploited a vulnerability within its website loan application platform to gain access to certain borrower information.","technology_involved":["website loan application platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2afc12d4ab4fc83e8b248d33e66b17ba90ab66c3","impact_type":"unknown","incident_date":"2023-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Capital_Neurological_Surgeons_SSN_6pager_No_Copy_Proof_Rev1_32333863v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"14264bf0a1c2","org_name":"Capital Neurological Surgeons","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571338"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7f657e1256493840a97f32570e1f0ae30e448fa","impact_type":"unknown","incident_date":"2023-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SSN_Proof_%5Bredacted%5D_32326194v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3fb75d2b0bc","org_name":"Cambridge College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571363"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6486eb4790575a71040eb2c6232c82c1dce0efb2","impact_type":"data_theft","incident_date":"2023-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CA%20Notice_Source_4pager_No%20Copy%20Proof_Rev1%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"0d1f7d2144a3","org_name":"University of Hawai'i - Hawai'i Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571261"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CA%20Notice_Source_4pager_No%20Copy%20Proof_Rev1%20%28002%29.pdf"}],"summary":"Hawai'i Community College reported that an unauthorized party may have accessed or exfiltrated information, including names, Social Security numbers, and financial aid information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-03","discovered_date":"2022-04-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2c175f3d8dd34e25e47ae014f41e894899fe532","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Notice%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"9f0cbbf4aa5e","org_name":"Reliance Steel & Aluminum Co.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Notice%20Proof.pdf"}],"summary":"Reliance Steel & Aluminum Co. reported unauthorized access to certain systems and files between April 3 and April 4, 2022, potentially affecting personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d219f92d8e3e04b28ddea29563be5780581f410","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20Hartford%20Final-c.pdf"},"notes":null,"org_country":"US","org_id":"b401ef1420f7","org_name":"Hartford Life and Accident Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software allowed unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571270"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template%20%28Consumers%29%20-%20Hartford%20Final-c.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hartford%20Life%20and%20Accident%20Insurance%20Company-2023-08-04"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a server and download data related to Hartford Life and Accident Insurance Company.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-03","discovered_date":"2023-07-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb686b142167da7a64886b8804c5608e1583bd6a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26076.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f5a94e096398","org_name":"Etz Hayim Holdings, S.P.C.","org_type":"retail_ecommerce","ransomware":null,"records_affected":42000,"reviewed":false,"root_cause":"Malicious actors exploited a software vulnerability on the organization's website to insert malicious code.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26076.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Etz%20Hayim%20Holdings%2C%20S.P.C.%20d/b/a%20Lazarus%20Naturals-2023-08-07"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26076.pdf"}],"summary":"Etz Hayim Holdings reported that malicious actors exploited a website vulnerability, potentially exposing personal and financial information.","supporting_quote":"The Incident was caused by one or more malicious actors who exploited a software vulnerability on our website allowing them to insert malicious code facilitating the compromise.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59fff90cce6e7cd48dd34eb7b34afa3c4c1c336b","impact_type":"unknown","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter%20-%201-XX%20-%208.1.23.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d753c4121e6c","org_name":"Serco, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571234"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2023-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec5b599675aff199a7a0b9017296748af37d70f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26067.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0cd75f324ddd","org_name":"REC CANOE CREDIT UNION","org_type":"unknown","ransomware":null,"records_affected":598,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26067.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2023-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef94f821202be5715df6e2543654ee4ac4eba827","impact_type":"unknown","incident_date":"2023-08-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"2ee1e15a15e9","org_name":"MagicDuel","org_type":"unknown","ransomware":null,"records_affected":138443,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MagicDuel","type":"hibp","url":"https://haveibeenpwned.com/Breach/MagicDuel"}],"summary":"In August 2023, the MagicDuel Adventure website suffered a data breach that exposed 138k user records . The data included player names, email and IP addresses and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-08-02","discovered_date":"2023-07-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2177671b4ea04abbac280361895d777ebce04449","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice_Source_No%20Data%20Proof%208-2-2023.pdf"},"notes":null,"org_country":"US","org_id":"6ba636e1770e","org_name":"Lazarus Naturals","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Malicious actors exploited a software vulnerability on the website to insert malicious code.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571232"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice_Source_No%20Data%20Proof%208-2-2023.pdf"}],"summary":"Lazarus Naturals reported that malicious actors exploited a vulnerability on its website, potentially exposing personal and payment-card information.","supporting_quote":"The Incident was caused by one or more malicious actors who exploited a software vulnerability on our website allowing them to insert malicious code facilitating the compromise.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"504d51f7ffbd188edbbc3765534399c91d0b4bdb","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIAA%20Life%20PBI%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"dafc1decd3ec","org_name":"TIAA-CREF Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software's MOVEit Transfer software was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571157"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIAA%20Life%20PBI%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26058.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a TIAA-CREF Life Insurance Company server and download personal information.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2023-08-01","discovered_date":"2023-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77110afddbf48519934f0162220ce9f7f34af1ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian%20sample%20letter%20California.pdf"},"notes":null,"org_country":"US","org_id":"67b7340c53ba","org_name":"Progressive Casualty Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Third-party service provider employees improperly shared their Progressive access credentials with unauthorized individuals.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian%20sample%20letter%20California.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Progressive%20Casualty%20Insurance%20Company-2023-08-01"}],"summary":"Progressive determined that unauthorized individuals used access credentials improperly shared by third-party call center provider employees to access some customers’ personal information.","supporting_quote":"We subsequently learned that some of the third-party service provider’s employees improperly shared their Progressive access credentials with unauthorized individuals who performed the employees’ call center job duties.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190","T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-01","discovered_date":"2023-06-19","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfb17c5474d0ed8eaf34b431a87cdabdae233472","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lumico_Sample%20Consumer%20Notice%20%2807.28.2023%29.PDF"},"notes":null,"org_country":"US","org_id":"e79615bdd360","org_name":"Lumico Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer on Pension Benefits Information's systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lumico_Sample%20Consumer%20Notice%20%2807.28.2023%29.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Lumico.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer at Pension Benefits Information and acquired some Lumico policyholder information.","supporting_quote":"Progress Software disclosed that cyber criminals actively exploited a vulnerability in the MOVEit Transfer application.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Pension Benefits Information, LLC"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-08-01","discovered_date":"2023-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"893e7d890150a4c86babdeb5bad54ec0af43353a","impact_type":"data_theft","incident_date":"2023-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HCA%20-%20General%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cdd37ef6f485","org_name":"HCA Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571162"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HCA%20-%20General%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26050.pdf"}],"summary":"HCA Healthcare reported that an unauthorized party obtained files containing patients’ personal information from an external storage location and made them available online.","supporting_quote":null,"technology_involved":["external storage location"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0527df2a0b4060b1cffa39e8381e643dc66793a2","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prudential%20PBI%20Longevity%20Ad%20CM.pdf"},"notes":null,"org_country":"US","org_id":"0c20434d9e3b","org_name":"The Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software used by PBI.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prudential%20PBI%20Longevity%20Ad%20CM.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26008.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer at PBI and downloaded data related to Prudential.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PBI"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"51a3dc181271f67c4343bdc39c646efe64262b25","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SpartanburgCounty.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d700a511a2a","org_name":"Spartanburg County","org_type":"unknown","ransomware":null,"records_affected":12209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SpartanburgCounty.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d2b4382d5d79bd092e7428938f18a9a0a75d5892","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Humana.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana","org_type":"unknown","ransomware":null,"records_affected":17660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Humana.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","other"],"disclosed_date":"2023-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66b9188ee392a665f6fa2518bceb546d5ac1672a","impact_type":"unknown","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hot%20Topic%20Inc.%20-%20Notice%20to%20Consumers.pdf"},"notes":null,"org_country":"US","org_id":"334d136d34ba","org_name":"Hot Topic, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571054"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hot%20Topic%20Inc.%20-%20Notice%20to%20Consumers.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15371.pdf"}],"summary":"Hot Topic reported automated attacks against Hot Topic Rewards accounts using valid credentials, but could not determine which logins were unauthorized or what information was accessed.","supporting_quote":null,"technology_involved":["Hot Topic Rewards","website","mobile application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"994c58650226944e9d88880834f15c4e2baea05c","impact_type":"unknown","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REDACTED_University_of_Rochester__Version_A__Adult_SSN_%28All_States_except_MA_and_RI%29_32300770v1.pdf"},"notes":null,"org_country":"US","org_id":"53ba10970775","org_name":"University of Rochester","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit File Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570999"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REDACTED_University_of_Rochester__Version_A__Adult_SSN_%28All_States_except_MA_and_RI%29_32300770v1.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit File Transfer software to access University of Rochester data.","supporting_quote":"Progress Software disclosed that on May 27, 2023 an unauthorized third-party exploited a vulnerability in their MOVEit File Transfer software to gain access to University of Rochester data.","technology_involved":["MOVEit File Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ed885d83a61706180bfcae7357a3fe2e3ee3138","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26014.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4f3cdcc1112c","org_name":"TIAA Kaspick, LLC","org_type":"financial","ransomware":null,"records_affected":1235,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26014.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26014.pdf"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability to access a server and download data including names, Social Security numbers, and dates of birth.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"831656c72e6988df39bf03ed40f681b223514e28","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26018.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9b0fface8388","org_name":"Peninsula College","org_type":"unknown","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26018.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":"2023-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a678b102fe17258bd89ed6f0dd4ba4d943494dfc","impact_type":"disruption_or_ransomware","incident_date":"2023-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MW%20Components.%20Adult%201%20Year%20CM.pdf"},"notes":null,"org_country":"US","org_id":"2b5c02b774ce","org_name":"MW Components","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570984"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572538"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MW%20Components.%20Adult%201%20Year%20CM.pdf"}],"summary":"MW Components discovered a ransomware attack in March 2023, and an investigation found that an unauthorized third party accessed its computer systems and may have acquired documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"c88f5cb664e2294211696b6dac21ae8fd339426f","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GenworthNorth%20AmericaCorporation.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1e7678813646","org_name":"Genworth North American Corporation","org_type":"financial","ransomware":null,"records_affected":60743,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software enabled access to a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GenworthNorth%20AmericaCorporation.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/GenworthNorth%20AmericaCorporation.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer to access a server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aabb02f2aaf754e7ff80696581007535b5c52307","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Fidelity%26GuarantyLifeInsuranceCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c78d302a088e","org_name":"Fidelity & Guaranty Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":13854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Fidelity%26GuarantyLifeInsuranceCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dae87ce4b0702b84cddc8e5d30ef6517b433bf40","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI%20Adult%20Consumer%20Letter%2012%20mths.pdf"},"notes":null,"org_country":"US","org_id":"d519ad38618b","org_name":"F&G Annuities & Life","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570974"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI%20Adult%20Consumer%20Letter%2012%20mths.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer software and downloaded data from a MOVEit Transfer server.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":"2023-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"92327fe887b87cc8523781c550d979852f3b2eee","impact_type":"both","incident_date":"2022-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27084.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d0f0e9eec3f3","org_name":"Delaware Life Insurance Company","org_type":"financial","ransomware":true,"records_affected":7252,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Delaware%20Life%20Insurance%20Company-2023-11-21"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27084.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576840"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571005"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572874"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DLIC%20Agent%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/DelawareLifeInsuranceCompany.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27084.pdf"}],"summary":"Delaware Life Insurance Company reported that ransomware was found on its information technology infrastructure and an unauthorized actor accessed and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":"2023-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7bc20b710b91e08b09f0827bc74bb34eb5556ef","impact_type":"data_theft","incident_date":"2023-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cupertino%20Electric%20Inc.%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"08fa3ee187fb","org_name":"Cupertino Electric, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570998"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cupertino%20Electric%20Inc.%20-Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cupertino%20Electric%2C%20Inc.-2023-07-28"}],"summary":"Cupertino Electric determined that an unauthorized third party accessed and acquired information on certain internal systems between June 14 and June 24, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":"2023-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"fd8e68a371aafb73b29e1caeb1aeb5c2776b7f29","impact_type":"both","incident_date":"2022-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Agent%20Notification.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e571ca63fb64","org_name":"Clear Spring Life and Annuity Company","org_type":"financial","ransomware":true,"records_affected":64786,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clear%20Spring%20Life%20and%20Annuity%20Company-2023-11-21"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Agent%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clear%20Spring%20Life%20and%20Annuity%20Company-2023-07-28"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Agent%20Notification.pdf"}],"summary":"Clear Spring Life and Annuity Company reported that an unauthorized actor accessed and acquired files from its systems, and ransomware was found on its IT infrastructure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7fb8b50492c83e5ec1001617435231262049ab2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26019.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9e94ab3724d0","org_name":"Bellingham Technical College","org_type":"education","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26019.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26019.pdf"}],"summary":"Bellingham Technical College was notified that files maintained by the National Student Clearinghouse were accessed or taken in a MOVEit-related incident.","supporting_quote":"The exposure was part of a global data security incident involving MOVEit, a file transfer software used by thousands of organizations around the globe, including the National Student Clearinghouse.","technology_involved":["MOVEit","National Student Clearinghouse"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"National Student Clearinghouse"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"1705c8d80b7a","name":"National Student Clearinghouse"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05e06309e8f511376d21769bcccd56a1692e463c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice-Home.pdf"},"notes":null,"org_country":"US","org_id":"0679df7b30f4","org_name":"Aven Financial, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571023"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice-Home.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aven%20Financial%2C%20Inc.-2023-07-29"}],"summary":"Aven Financial reported that a security researcher accessed an in-development storage system containing personal information through a temporary vulnerability.","supporting_quote":null,"technology_involved":["in-development storage system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b964bc067e34b1d0811951d354ea7ec7130202b","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIAA%20Kaspick%20PBI%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4f3cdcc1112c","org_name":"TIAA Kaspick, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in MOVEit Transfer allowed unauthorized access to PBI's MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIAA%20Kaspick%20PBI%20Individual%20Notification%20Letter.pdf"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability to access a TIAA Kaspick server and download personal information.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8cd80ccfae8696ff2bb99b3e865fe047c8991ed","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26004.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d8386262a492","org_name":"Teachers Insurance and Annuity Association of America","org_type":"financial","ransomware":null,"records_affected":56331,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26004.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26004.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer and downloaded personal information associated with TIAA.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c2f0670cfe7f13851aabef1973aa9022914cf574","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26007.pdf"},"notes":null,"org_country":"US","org_id":"a4bc11a3b1f0","org_name":"Tacoma Community College","org_type":"education","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26007.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26007.pdf"}],"summary":"Tacoma Community College reported that a cybersecurity incident involving third-party vendors using MOVEit Transfer may have exposed students’ and employees’ personally identifiable information.","supporting_quote":"This incident is localized to our third-party vendors, which includes MOVEit Transfer, NSC and TIAA.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"National Student Clearinghouse and Teachers Insurance and Annuity Association"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"d8dc2f8cc84e","name":"National Student Clearinghouse and TIAA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-27","discovered_date":"2023-06-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7128b82abd422f7127a37e0a99f67f1a774ec527","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f959fc2e425","org_name":"Pension Benefit Information, LLC (PBI)","org_type":"unknown","ransomware":null,"records_affected":42922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Benefit%20Information%2C%20LLC%20%28PBI%29-2023-07-27"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Benefit%20Information%2C%20LLC%20%28%22PBI%22%29-2023-07-31"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Benefit%20Information%2C%20LLC%20%28%22PBI%22%29-2023-08-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":"2023-06-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"909d922f48d9343861ac6905b425fa45a8367c9c","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26002.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"178e8224fe72","org_name":"Lumico Life Insurance Company and Elips Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":374675,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer at Pension Benefits Information, LLC.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26002.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lumico%20Life%20Insurance%20Company%2C%20Elips%20Life%20Insurance%20Company-2023-08-14"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26002.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer at Pension Benefits Information, LLC and acquired policyholder information belonging to Lumico Life Insurance Company and Elips Life Insurance Company.","supporting_quote":"On June 19, 2023, NTT informed us that, between May 29 and 30 of this year, an unauthorized third party exploited the vulnerability in the MOVEit application, which NTT’s external vendor Pension Benefits Information, LLC (“PBI”) uses, and may have acquired some of our policyholder information.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-27","discovered_date":"2022-09-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d70ba36e2d2da936b6c2ef8676b33e94529bb6b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMX%20Claimant%20Notification%20Letter%20-%20TEMPLATE.pdf"},"notes":null,"org_country":"US","org_id":"369dc4e08c7c","org_name":"IMX Medical Management Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMX%20Claimant%20Notification%20Letter%20-%20TEMPLATE.pdf"}],"summary":"IMX reported that a threat actor accessed email message bodies associated with certain user accounts and may have accessed folders containing claimant personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":"2023-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"eed3ea87be6f8f92ab10fd05c77f94fcc340e212","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16326.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1ad0671bf0ee","org_name":"HopSkipDrive","org_type":"transportation_logistics","ransomware":null,"records_affected":14757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16326.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HopSkipDrive%20-%20Sample%20Notice%20Letter%20-%20California.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16326.pdf"}],"summary":"HopSkipDrive reported that an unknown threat actor claimed to have accessed third-party applications, and personal information may have been affected.","supporting_quote":null,"technology_involved":["third-party applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd471e2636222cb00dc9bb51f702e3b3652ca455","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice_3.pdf"},"notes":null,"org_country":"US","org_id":"425156353ee1","org_name":"Genworth North America Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software enabled access to the server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice_3.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Genworth%20North%20America%20Corporation-2023-07-28"}],"summary":"Genworth North America Corporation reported that a third party exploited a vulnerability in MOVEit Transfer to access a server and download data.","supporting_quote":"Through the investigation, we learned that the third party accessed one of our MOVEit Transfer servers on May 29, 2023 and May 30, 2023 and downloaded your data.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":"2023-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8d368f6c1cbedb56aa0d91065b291734cd93594","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FMFCU%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4abceb536178","org_name":"Franklin Mint Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A critical vulnerability affecting FMFCU's MOVEit Transfer system was involved in the unauthorized acquisition of member data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570959"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FMFCU%20-%20Sample%20Notice.pdf"}],"summary":"Franklin Mint Federal Credit Union reported that member data may have been acquired without authorization in connection with a vulnerability affecting MOVEit Transfer.","supporting_quote":"On June 19, 2023, the investigation revealed that data belonging to FMFCU members may have been acquired without authorization in connection with this issue.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2919365609d961b876856f003a16309705be08c0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FamilyVisionofAndersonPA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48b741974aca","org_name":"Family Vision of Anderson","org_type":"unknown","ransomware":null,"records_affected":53861,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/FamilyVisionofAndersonPA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42c8289e268b6818cf6a721f679bb4e2d4035684","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a8933dd07bbe","org_name":"Corebridge Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570927"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25976.pdf"}],"summary":"Corebridge Financial reported that an unauthorized third party accessed a MOVEit Transfer server and downloaded data containing personal information.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca0dab377c9dd07aa14f413d00b7707f52c5f84b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CitiTrendsInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15f015bd596b","org_name":"CitiTrends, Inc.","org_type":"unknown","ransomware":null,"records_affected":14381,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CitiTrendsInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"07942069f746f65a47898183e09117d65d602ce4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25989.pdf"},"notes":null,"org_country":"US","org_id":"8faf11bf649f","org_name":"Western Washington University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25989.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25989.pdf"}],"summary":"Western Washington University was awaiting information from the National Student Clearinghouse and TIAA about confidential or sensitive data they were responsible for releasing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"National Student Clearinghouse and TIAA"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"d8dc2f8cc84e","name":"National Student Clearinghouse and TIAA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ffa2b6d51355015727c7db985d4eb8d9b96b9c90","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ObHospitalistGroup.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe5249ffb677","org_name":"Ob Hospitalist Group","org_type":"unknown","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ObHospitalistGroup.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-26","discovered_date":"2023-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aee5deaa64476aae1a450829b70a09710b07cb77","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HRM%20Enterprises%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0180bb351bef","org_name":"HRM Enterprises, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570884"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HRM%20Enterprises%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#HRM%20Enterprises%2C%20Inc.-2023-07-26"}],"summary":"An unauthorized actor accessed CommerceV3 systems, potentially exposing payment information associated with HRM Enterprises customers.","supporting_quote":"CommerceV3 advised it conducted a forensic investigation alongside third-party cybersecurity professionals and discovered an unauthorized actor accessed its systems between November 24, 2021, and December 14, 2022.","technology_involved":["CommerceV3","payment platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-26","discovered_date":"2023-01-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8dc541a1040dc9fc613a913c0c4e9d540ffadbb","impact_type":"data_theft","incident_date":"2023-01-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4de90e20d67a","org_name":"CRC Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577671"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570861"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification.pdf"}],"summary":"CRC Insurance Services reported that phishing emails led to unauthorized access to employee email accounts and exfiltration of some emails.","supporting_quote":"CRC Insurance Services, LLC (“CRC”) determined that through a series of phishing emails, an unknown third-party gained unauthorized access for a limited period of time to a small number of employee email accounts and exfiltrated a small percentage of emails in those accounts.","technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2023-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa7417283fc0d3349306461537ee292cb96ebcfe","impact_type":"data_theft","imported_from":null,"incident_date":"2022-11-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"640cde254fdf","org_name":"BreachForums","org_type":"technology_saas","ransomware":null,"records_affected":212156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BreachForums","type":"hibp","url":"https://haveibeenpwned.com/Breach/BreachForums"}],"summary":"A breach of BreachForums exposed 212,156 records, including usernames, IP and email addresses, private messages, and password hashes.","supporting_quote":null,"technology_involved":["BreachForums"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e0e91586f143de5e869e3c7e5f77773c7cdbf14","impact_type":"unknown","incident_date":"2023-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Bayside_Redacted_AG_Notice%2832286686.1%29_Redacted_32286713v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"33d371044b20","org_name":"Bayside Interiors, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570863"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-25","discovered_date":"2023-05-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"372a2828d9f391a939035e2120c27bcfb808455d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20notice_emailcompromise%20ADULT_FINAL.pdf"},"notes":null,"org_country":"US","org_id":"beadc0008701","org_name":"UC Davis Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570834"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20notice_emailcompromise%20ADULT_FINAL.pdf"}],"summary":"An unauthorized external individual accessed a UC Davis Health employee's work email account, potentially exposing patient information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-25","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0450ca529b0cc80e7df3c594a315223f6212d2","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hopkins%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"9fb1f4e83da9","org_name":"The Johns Hopkins University and The Johns Hopkins Health System Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570847"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hopkins%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party accessed a Johns Hopkins server hosting MOVEit and downloaded documents containing Johns Hopkins information.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-07-25","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d5909f0a3d8da020043ebc446f58c29bc119e757","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25977.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2bbb1ac04acc","org_name":"The Johns Hopkins University","org_type":"education","ransomware":null,"records_affected":608,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25977.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25977.pdf"}],"summary":"An unauthorized party accessed a Johns Hopkins server hosting MOVEit software and downloaded documents containing Johns Hopkins information.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1b0ecd4a16c23b701684be9505ea0902e4e070b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MCOE-%20CA%20AG-%20Exhibit%20A-%20notice%20letter.pdf"},"notes":null,"org_country":"US","org_id":"5459d0335109","org_name":"Mendocino County Office of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570831"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572519"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MCOE-%20CA%20AG-%20Exhibit%20A-%20notice%20letter.pdf"}],"summary":"Mendocino County Office of Education reported that an unauthorized individual accessed portions of its network, and a review found names and other information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b0187473e317ba1c68d3cb95d5e34f3a6c39148","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"632035be113a","org_name":"Jackson National Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25960.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer and downloaded personal data from a server used for Jackson National Life Insurance Company customers.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaa7302ef1d4f3bdf9ef8311c918cab6345bd035","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4.%20Draft%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9e745cdc955e","org_name":"Fidelity Life Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Progress Software's MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570809"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4.%20Draft%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fidelity%20Life%20Association-2023-07-25"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer to access a server used by Fidelity Life Association and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89db8e306898821db519a1bf17c407ecd37409e9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2012-11-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"48121b739cf7","org_name":"BookCrossing","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BookCrossing","type":"hibp","url":"https://haveibeenpwned.com/Breach/BookCrossing"}],"summary":"A database backup associated with BookCrossing from November 2012 exposed personal information and plain-text passwords.","supporting_quote":null,"technology_involved":["database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-25","discovered_date":"2023-02-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68a4216d347e6aa0f107818c56d17a6a56914278","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"e459cccb96cf","org_name":"Bi-Bett Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570824"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20%20-%20CA.pdf"}],"summary":"Bi-Bett reported that an unauthorized actor compromised a single email account containing personal and protected health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e7592d08b01eb1f7fea5e47b4b6db6e06398b8b3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AtheneAnnuityandLifeInsurance.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ebff3f4a69c","org_name":"Athene Annuity and Life Insurance","org_type":"unknown","ransomware":null,"records_affected":3023,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/AtheneAnnuityandLifeInsurance.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72b2e188aa4c3036d29753a317e6ff90bf812d03","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ABIM%20-%20US%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"53e36a6d8779","org_name":"American Board of Internal Medicine","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ABIM%20-%20US%20Notification%20Letter.pdf"}],"summary":"The American Board of Internal Medicine detected suspicious activity in its network environment, and names and mailing addresses may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-07-24","discovered_date":"2023-07-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ea3b0c3c1637798bc70b8ea31a88f88357eca5a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20%28final%29.pdf"},"notes":null,"org_country":"US","org_id":"be9e73989c84","org_name":"Togetherwork Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570718"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20%28final%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Togetherwork%20Holdings%2C%20LLC-2023-07-24"}],"summary":"Togetherwork reported that personal information collected by MassageBook was viewable in the source code of its client website, with no reports of unauthorized access or use.","supporting_quote":null,"technology_involved":["MassageBook website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MassageBook"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"1f213798a3cb","name":"MassageBook"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1a1586a3d8755d2ac8d3b962a22726fd1c980c6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"cb5c7c3faa47","org_name":"Tigo","org_type":"technology_saas","ransomware":null,"records_affected":700394,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tigo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tigo"}],"summary":"Data associated with Tigo, including personal information and private messages, was discovered in mid-2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fdd8f4dbd2a34941a078c226799726c5ec8e7c3","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TRS%20NYC%20-%20adult%20notification%20letter.PDF"},"notes":null,"org_country":"US","org_id":"f15aafd3583d","org_name":"Teachers' Retirement System of the City of New York","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously unknown vulnerability in PBI's MOVEit Transfer application allowed an unauthorized third party to download TRS data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570789"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TRS%20NYC%20-%20adult%20notification%20letter.PDF"}],"summary":"A vulnerability in PBI’s MOVEit Transfer application allowed an unauthorized third party to download data related to Teachers' Retirement System of the City of New York.","supporting_quote":"PBI recently confirmed with TRS that a previously unknown vulnerability in the MOVEit Transfer application, which is used by thousands of organizations worldwide, allowed TRS data to be downloaded by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PBI"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4527b556b5491d96a4eb8751f9b54ee9a7998a5d","impact_type":"unknown","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Ja-Del%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f48e7d37e21c","org_name":"Jack Stack Barbecue","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570734"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c0ab9e9f4584fe9f5f6021c6316f9127a01f5ff","impact_type":"data_theft","incident_date":"2022-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AMU%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"50a3f9f31325","org_name":"Andrews McMeel Universal","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570755"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AMU%20-%20Sample%20Notice.pdf"}],"summary":"Andrews McMeel Universal reported that an unknown actor accessed its network and obtained certain data between November 17 and 18, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5af153e187377a692f5fa65b8b46144ff6362b07","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"789827dbd35c","org_name":"Roblox","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Roblox","type":"hibp","url":"https://haveibeenpwned.com/Breach/Roblox"}],"summary":"Roblox disclosed that users’ email and IP addresses, usernames, purchases, and Robux balances were left exposed on a test server.","supporting_quote":null,"technology_involved":["test server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-22","discovered_date":"2023-05-31","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8210db645f55ca055de5a919cc8793375187be1","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"7a45f1c09947","org_name":"Sutter Senior Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exploit of the MOVEit file transfer tool resulted in files being taken from the MOVEit server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Letter%20Template.pdf"}],"summary":"Files containing Sutter Senior Care patients’ personal and health information were taken from a MOVEit server after an exploit of the file transfer tool.","supporting_quote":"On May 31, 2023, we learned of the global exploit of the file transfer tool called MOVEit.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d28983bdc0b1904a958a9cddb62b53000b3da21","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Sovos%20Client%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"0b85cced1d67","org_name":"Northwestern Mutual","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized actors exploited a then-unknown vulnerability in Progress Software's MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Sovos%20Client%20Notification%20Letter.pdf"}],"summary":"Northwestern Mutual reported that unauthorized actors exploited a then-unknown MOVEit vulnerability to download a file containing personal information.","supporting_quote":"We recently determined that unauthorized actors exploited the then-unknown MOVEit vulnerability to download a file containing some of your personal information.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-07-21","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a7c00473ce548872e3f494e738214973ea2bc4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MOVEiT%20SR%20-%20Sample%20Member%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"881e99db955b","org_name":"UnitedHealthcare Student Resources","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An attacker exploited a previously unknown vulnerability in the MOVEit software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MOVEiT%20SR%20-%20Sample%20Member%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UnitedHealthcare%20Student%20Resources-2023-07-21"}],"summary":"UnitedHealthcare Student Resources reported that an attacker exploited a zero-day vulnerability in MOVEit Transfer, affecting personal, medical, and financial information.","supporting_quote":"On May 31, 2023, Progress Software, announced it discovered a previously unknown (“zero-day”) vulnerability in the MOVEit software that could allow an unauthorized third party to access files sent with the software .","technology_involved":["MOVEit Transfer","file transfer server"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ca21d138e1d8d532a74a7dd453242e7dd15060c","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIAA%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d8386262a492","org_name":"Teachers Insurance and Annuity Association of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570666"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570764"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIAA%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TeachersInsuranceandAnnuityAssociationofAmerica.pdf"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability and downloaded personal information from a MOVEit Transfer server.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c77a89bea0ae031a4e08d881a359c519fc2e2f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-13","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J7036_Quinn%20Emanuel%20Urquhart%20%26%20Sullivan%20LLP.pdf"},"notes":null,"org_country":"US","org_id":"fdd5a68b980f","org_name":"Quinn Emanuel Urquhart & Sullivan, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570642"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J7036_Quinn%20Emanuel%20Urquhart%20%26%20Sullivan%20LLP.pdf"}],"summary":"An unknown party accessed or may have acquired personal information held in data center segments during an incident involving an electronic discovery vendor.","supporting_quote":"On or around May 14, 2022, an electronic discovery vendor that collects and processes QEUS ’s electronic discovery data suffered a cybersecurity incident.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-21","discovered_date":"2023-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f53dfb52cfdd7cc8a3b4be5d7e70a1dc10b5c4b9","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Creedmoor-Letter.pdf"},"notes":null,"org_country":"US","org_id":"35d2a9d44ebe","org_name":"Creedmoor Sports, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570656"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Creedmoor-Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Creedmoor%20Sports%2C%20Inc.-2023-07-21"}],"summary":"CommerceV3 informed Creedmoor Sports that an unauthorized party accessed CommerceV3 systems and may have accessed or acquired customer payment card information collected on Creedmoor’s behalf.","supporting_quote":null,"technology_involved":["CommerceV3 systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-21","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4309b9eb579a5665518ff446809bc7f978f5e8b5","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aurora%20Consumer%20Notification%20Letter%20%2812%20months%29.pdf"},"notes":null,"org_country":"US","org_id":"706ac9398cc7","org_name":"Aurora National Life Assurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aurora%20Consumer%20Notification%20Letter%20%2812%20months%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aurora%20National%20Life%20Assurance%20Company-2023-07-21"}],"summary":"An unauthorized third party downloaded Aurora policyholder information from Pension Benefits Information, LLC systems after exploiting a MOVEit vulnerability.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Pension Benefits Information, LLC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91a1599d80ea23c989fc094202cfb793acaef2ff","impact_type":"unknown","incident_date":"2023-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MEG%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5e8cce2c4308","org_name":"The Mission Essential Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570584"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MEG%20-%20Sample%20Notice.pdf"}],"summary":"Mission Essential notified individuals of a potential incident involving email accounts but said it could not validate unauthorized access.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-20","discovered_date":"2023-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf1309c77191c8a87c275ed63d8934451f81e83e","impact_type":"both","incident_date":"2023-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Harvard%20Pilgrim%20Health%20Care%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_3_0.pdf"},"notes":null,"org_country":"US","org_id":"38f0cddcbabf","org_name":"Harvard Pilgrim Health Care","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-597598"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-592846"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-583130"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581092"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570608"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572410"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Harvard%20Pilgrim%20Health%20Care%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_3_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Harvard%20Pilgrim%20Health%20Care-2023-06-15"}],"summary":"Harvard Pilgrim Health Care reported a ransomware incident in which data was copied from its systems between March 28 and April 17, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-20","discovered_date":"2023-06-20","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc783f62d906f21c70364a6e20258cd85c546d18","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25927.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c78d302a088e","org_name":"Fidelity & Guaranty Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":873000,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25927.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fidelity%20%26%20Guaranty%20Life%20Insurance%20Company%20%28%E2%80%9CF%26G%E2%80%9D%29-2023-07-28"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25927.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer to access a server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40ce0d5e32018f77e7fa1340c99f85cd362d58f8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Move-It%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"341959542f95","org_name":"CoastHills Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570599"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Move-It%20Breach%20Notification.pdf"}],"summary":"CoastHills Credit Union filed a consumer notification letter concerning a security incident.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"379a87e0c1bdf6bcc176bc9544aebb9c92b018d6","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20-%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6a32b42c148b","org_name":"Athene Annuity and Life Company","org_type":"financial","ransomware":null,"records_affected":3814,"reviewed":false,"root_cause":"An attacker exploited a vulnerability in MOVEit Transfer software to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-573471"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570576"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20-%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Athene%20Annuity%20and%20Life%20Company%20and%20its%20affiliates-2023-07-20"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25920.pdf"}],"summary":"Athene Annuity and Life Company reported that an attacker accessed a MOVEit Transfer server and downloaded data after exploiting a vulnerability in MOVEit Transfer.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-19","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2064a3ba183b040507b9e162ed47b608b92a26fb","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18439%20Rite%20Aid%2083%20Ad%20CM%201y%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in a vendor partner’s software was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18439%20Rite%20Aid%2083%20Ad%20CM%201y%20r1prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25894.pdf"}],"summary":"Rite Aid discovered that a third party had accessed company files after exploiting a vulnerability in a vendor partner’s software; the files included personal and health information.","supporting_quote":"On May 31, 2023, we were informed by a vendor partner of ours that there was a vulnerability in their software and it had been exploited by an unknown third party.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-19","discovered_date":"2023-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52845a1dea6b3c2e254626ebe627faed9b783509","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MSXI%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7cac5b787b21","org_name":"MSX International Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570539"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MSXI%20-%20Sample%20Notification%20Letter.pdf"}],"summary":"MSX International identified unusual activity affecting certain systems, and its investigation found an unauthorized party accessed systems and may have taken information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b36b7a9a55c427e7421f1cebda7afe759b88b9ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice%20-%20Template.pdf"},"notes":null,"org_country":"US","org_id":"d006e4e89bcc","org_name":"Dr. Gary Motykie, M.D., a Medical Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570562"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice%20-%20Template.pdf"}],"summary":"Dr. Gary Motykie, M.D., a Medical Corporation, notified people that a third party may possess their information and that data including personal, financial, and medical information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-19","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f883ea3aa05bab1bf19d47d1ad0a92ab72fe4167","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-20262%201st%20Source%20Bank%20Ad%20CM%201y%20Retail%202nd%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"cbe5457ea5df","org_name":"1st Source Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the MOVEit software was connected to unauthorized acquisition of a file containing the customer's data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-577160"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570547"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-20262%201st%20Source%20Bank%20Ad%20CM%201y%20Retail%202nd%20r1prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#1st%20Source%20Bank-2023-07-20"}],"summary":"1st Source Bank reported that a file containing customer data may have been acquired without authorization in connection with a MOVEit software vulnerability.","supporting_quote":"We later learned that your data was contained within a file that may have been acquired without authorization in connection with the MOVEit software vulnerability.","technology_involved":["MOVEit","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e453ce937d18d8951e165b92a88b01c60eb6479","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2327b46e1fd7","org_name":"Roblox Developer Conference","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Roblox Developer Conference (2023)","type":"hibp","url":"https://haveibeenpwned.com/Breach/RobloxDeveloperConference"}],"summary":"A list of alleged attendees from the 2017–2020 Roblox Developers Conferences containing personal information was circulated on a forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"206a0ee712de9f177c72d45abdae444ef739f0b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-07-17_BreachNotice.pdf"},"notes":null,"org_country":"US","org_id":"bc28bb94feb0","org_name":"Westamerica Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570427"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-07-17_BreachNotice.pdf"}],"summary":"A processing vendor informed Westamerica Bank of a potential compromise involving customers’ personal information.","supporting_quote":null,"technology_involved":["file transfer software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-17","discovered_date":"2023-07-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"338f5af1e62da3d60b9d3a2f761d6f2434a6d348","impact_type":"unknown","incident_date":"2022-11-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f1a0567c76a","org_name":"South Coast Education Service District","org_type":"unknown","ransomware":null,"records_affected":3226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#South%20Coast%20Education%20Service%20District-2023-07-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"CL0P Ransomware Gang","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-17","discovered_date":"2023-06-13","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f691c8c3605e86ba3c8f477d0c7d0b69db3c7049","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15357.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"17c82003c100","org_name":"Sound Community Bank","org_type":"financial","ransomware":null,"records_affected":13795,"reviewed":false,"root_cause":"A vulnerability in MOVEit was exploited at a trusted vendor that used the service to transfer the bank's information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15357.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15357.pdf"}],"summary":"Sound Community Bank said a trusted vendor's MOVEit file transfer service was affected by a vulnerability exploited by CL0P, but the bank had no indication that customer banking information was taken.","supporting_quote":"On June 7, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Invesfigafion (FBI) published a joint Cybersecurity Advisory (CSA) regarding a CL0P Ransomware Gang exploitafion of a MOVEit vulnerability.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"actor_id":"cl0pransomwaregang"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63ecffece984214e7d859985f6df658b0f86dd60","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quorum%20CA.pdf"},"notes":null,"org_country":"US","org_id":"3953adb96a7c","org_name":"Quorum Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quorum%20CA.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25864.pdf"}],"summary":"Quorum Federal Credit Union found unauthorized access to files containing personal information between May 28 and May 31, 2023.","supporting_quote":null,"technology_involved":["MOVEit"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97afa99dc8dcee8961b0fc9d4468221dcfbf179a","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d345e6e44f14","org_name":"Milliman Solutions, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI%20-%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Milliman%20Solutions%20LLC-2023-07-17"}],"summary":"An unauthorized third party exploited a MOVEit Transfer vulnerability and downloaded data from a Milliman Solutions, LLC server.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e9f3edf289de5227b12c0698e3c61b322c6d77a","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PBI%20EBS%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ee527b3943b8","org_name":"EBS Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited to access a MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570388"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PBI%20EBS%20Consumer%20Letter.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer to access an EBS Services server and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by a n unauthorized third party.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-14","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c188597a2cba375c0fecdde5dbd01433547df2c2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72ac1d48c352","org_name":"Sapiens Americas Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sapiens%20Americas%20Corporation-2023-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190","T1195"],"confidence":"medium","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-14","discovered_date":"2023-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d167849a08a3528220af78ba2d6e56cca0ca58b3","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PlainsCapital%20Bank%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9cc32cf4d778","org_name":"PlainsCapital Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day cyberattack affected MOVEit software used by the third-party vendor that processed the bank's information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570311"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PlainsCapital%20Bank%20-%20Sample%20Notice.pdf"}],"summary":"PlainsCapital Bank reported that customer information was likely obtained in an incident involving its third-party vendor's use of MOVEit.","supporting_quote":"A large number of these organizations globally have been impacted by this zero-day cyberattack.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6b30c59adbf6295f1c1921fd9d33c617d70aecf","impact_type":"unknown","incident_date":"2023-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Idea%20Financial%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9f907985ae7","org_name":"Idea 247 Inc. (d/b/a Idea Financial)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570259"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5d7ea05f8f916d619c99bf20c958e4eced6021fd","impact_type":"unknown","incident_date":"2023-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25815.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"71933445c405","org_name":"Idea 247 Inc.","org_type":"unknown","ransomware":null,"records_affected":671,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25815.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25815.pdf"}],"summary":"An unauthorized party accessed a database containing some individuals’ personal information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e153c0d6a01c2d26970d74a0d20857ceb147bd64","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25814.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"425156353ee1","org_name":"Genworth North America Corporation","org_type":"professional_services","ransomware":null,"records_affected":60695,"reviewed":false,"root_cause":"A vulnerability in MOVEit Transfer software was exploited by an unauthorized third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25814.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25814.pdf"}],"summary":"A third party exploited a vulnerability in MOVEit Transfer to access a server used by Genworth North America Corporation and download data.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2023-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bd29a2c7f5642d85ac016567ab5325dc919c696","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42179d15_AlatusAeroSystems_Adult_SSN_SAS_2.pdf"},"notes":null,"org_country":"US","org_id":"195086b7982e","org_name":"Alatus Aerosystems LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570267"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42179d15_AlatusAeroSystems_Adult_SSN_SAS_2.pdf"}],"summary":"An unauthorized user accessed Alatus network storage devices that contained personal information, including information that may have been disclosed.","supporting_quote":null,"technology_involved":["network storage devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b594de2d00157aecf4ac674892c6d97c859e523c","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sovos%20Sample%20Individual%20Notice%20%2807%2012%2023%29.pdf"},"notes":null,"org_country":"US","org_id":"719ccf123b8f","org_name":"Sovos Compliance","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited a then-unknown vulnerability in Progress Software's MOVEit Transfer application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570206"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572310"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sovos%20Sample%20Individual%20Notice%20%2807%2012%2023%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sovos%20Compliance%20LLC-2023-08-23"}],"summary":"Attackers exploited a then-unknown MOVEit Transfer vulnerability to download a file containing personal information from Sovos.","supporting_quote":"Sovos recently determined that on May 30, 2023, unauthorized actors exploited the then-unknown MOVEit vulnerability to download a file containing some of your personal information.","technology_involved":["MOVEit Transfer (SecureFT)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eda206f1e5f39f685b1d3cb01dcdb18a594d64b","impact_type":"unknown","incident_date":"2021-11-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LEM%20-%20CA%20Notice%20Letter%204874-9378-9550%20v2.pdf"},"notes":null,"org_country":"US","org_id":"8ebac5f31898","org_name":"LEM Products Direct LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570247"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LEM%20-%20CA%20Notice%20Letter%204874-9378-9550%20v2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24721.pdf"}],"summary":"CommerceV3 reported that an unauthorized party accessed its systems between November 24, 2021 and December 14, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"565c118f97d93753bf347b2caf3a245508c521fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ChildNet_Standard_Letter_final_Redacted_32236618v1.pdf"},"notes":null,"org_country":"US","org_id":"ccf75f4f2fe4","org_name":"ChildNet Youth and Family Services, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570251"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ChildNet_Standard_Letter_final_Redacted_32236618v1.pdf"}],"summary":"An unauthorized individual accessed data maintained by ChildNet Youth and Family Services, Inc.’s vendor Paycom.","supporting_quote":null,"technology_involved":["Paycom"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Paycom"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"bef69999b2c0","name":"Paycom"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00654c9dd8b08936044b0410621634fb7b141cfd","impact_type":"unknown","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AMC%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"880089ca85da","org_name":"AMC Theatres","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570230"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AMC%20Letter%20Template.pdf"}],"summary":"AMC Theatres sent a consumer notification letter concerning a security incident dated May 28, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9fef7577e8e9a4f783624591ec7494e5aa06b437","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ReventicsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d6696d4dd41","org_name":"Reventics, LLC","org_type":"unknown","ransomware":null,"records_affected":77883,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ReventicsLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3825ed293632eb9692d32321d9bdc6025806fb4c","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25777.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"15f70a32aeb5","org_name":"Pension Benefit Information","org_type":"professional_services","ransomware":null,"records_affected":18856,"reviewed":false,"root_cause":"An exploited vulnerability in Progress Software's MOVEit Transfer software allowed access to PBI's MOVEit Transfer server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25777.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25777.pdf"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer and downloaded data from a Pension Benefit Information server.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["Progress Software","MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5260a0479b7c9fc76fee033008a4ee6b28b6910b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DRAFT%20Notification%20Letter%20-%20Hahn%20Loeser%20v4.pdf"},"notes":null,"org_country":"US","org_id":"f2e832117c73","org_name":"Hahn Loeser & Parks, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570075"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DRAFT%20Notification%20Letter%20-%20Hahn%20Loeser%20v4.pdf"}],"summary":"Hahn Loeser & Parks detected unauthorized access to its network environment, and an investigation found that personal information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80f1046fec7fd18ad7f5c318ba16be1fde92c6a2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6dc97fd2a911","org_name":"Vermillion","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vermillion","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vermillion"}],"summary":"A breach of Vermillion's MyBB forum exposed subscriber records containing personal information and salted password hashes.","supporting_quote":null,"technology_involved":["MyBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"699f92d2878d2bce6c3f146bd75492dd961f89d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25748.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab8852cb28a2","org_name":"Tacoma-Pierce County Health Department","org_type":"unknown","ransomware":null,"records_affected":9500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25748.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"720ca08c9f0d23f7957446511d0f6b24c028a375","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_3.pdf"},"notes":null,"org_country":"US","org_id":"15f70a32aeb5","org_name":"Pension Benefit Information, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570029"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571371"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_3.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Benefit%20Information%2C%20LLC-2023-07-12"}],"summary":"An unauthorized third party accessed Pension Benefit Information's MOVEit Transfer server and downloaded data.","supporting_quote":null,"technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"298817eb781b3362dec2f9bc079af6249628c77b","impact_type":"unknown","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Whitleys%20-%20CA%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cf6785164cb0","org_name":"Whitley's Peanut Factory","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569943"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Whitleys%20-%20CA%20Sample%20Letter.pdf"}],"summary":"An unauthorized party accessed CommerceV3's systems between November 24, 2021 and December 14, 2022.","supporting_quote":null,"technology_involved":["CommerceV3"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fd1757142de2048ecabdaaaee3adaac3e34ec54","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af78af33f457","org_name":"The Union Labor Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569935"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-10","discovered_date":"2023-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65cd1802e879656fa48c42b32ba7c0cce62d3d17","impact_type":"data_theft","incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"08c846955439","org_name":"Revance Therapeutics","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569913"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice%20Letter.pdf"}],"summary":"An unauthorized third party accessed and exfiltrated personal information from Revance systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-10","discovered_date":"2023-06-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b032a16e952fe36002e914abc0966d716387a4ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25736.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":33237,"reviewed":false,"root_cause":"The attack was attributed to a weak spot in Kern Agency’s MOVEit software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25736.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25736.pdf"}],"summary":"Premera Blue Cross members’ personal and health information held by Kern Agency was exposed in an attack attributed to a weak spot in Kern’s MOVEit software.","supporting_quote":"On June 3, 2023, Premera was notified by Kern they had an electronic information security attack, due to a weak spot in their MOVEit software (used for secure data transfer), on May 31, 2023.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Kern Agency"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"445b761052fd","name":"Kern Agency"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2023-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ea414a09dee769575f29b3c2d3fea613b8fd46c","impact_type":"data_theft","imported_from":null,"incident_date":"2022-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e10a9c3c87aa","org_name":"Locally","org_type":"technology_saas","ransomware":null,"records_affected":362619,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Locally","type":"hibp","url":"https://haveibeenpwned.com/Breach/Locally"}],"summary":"Locally suffered a data breach in October 2022 that exposed customer contact details, purchase information, partial credit card data, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80f3003e61ab57caf2fb07993d278dc94750c0ae","impact_type":"data_theft","incident_date":"2023-05-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42179d07_PearTreeAdvisors_SAS_2%2816203667.1%29.pdf"},"notes":null,"org_country":"US","org_id":"61f997a238e5","org_name":"Pear Tree Advisors, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the MOVEit application was exploited to access PTA shareholder information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job42179d07_PearTreeAdvisors_SAS_2%2816203667.1%29.pdf"}],"summary":"Attackers exploited a vulnerability in MOVEit to access files containing PTF shareholder information in a private cloud environment managed by ISCorp.","supporting_quote":"We now understand that one or more unauthorized individuals exploited a vulnerability in the MOVEit application and were able to access the data of hundreds of government agencies and businesses, including PTA’s.","technology_involved":["MOVEit","private cloud environment"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-07","discovered_date":"2022-12-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f0244139219e99372ea3a77e3952f681081c802","impact_type":"unknown","incident_date":"2022-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3cb76f509726","org_name":"Highmark Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Highmark%20Health-2023-07-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4196589dae8cd8443d16a63e7687ebf24e090132","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"3480cdba68cc","org_name":"Gibson, Dunn & Crutcher LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sample.pdf"}],"summary":"Gibson, Dunn & Crutcher LLP reported that a third party accessed files related to its legal services, which may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","medical"],"disclosed_date":"2023-07-07","discovered_date":"2023-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af3d6a2dc3e0eab95b4e6742b7ff22421a08380d","impact_type":"disruption_or_ransomware","incident_date":"2023-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-06_databreach.pdf"},"notes":null,"org_country":"US","org_id":"5c58d9671e6f","org_name":"American Federation of Musicians Local 47","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-06_databreach.pdf"}],"summary":"American Federation of Musicians Local 47 discovered a ransomware attack that disrupted access to its computers and email, with member and non-member information potentially involved.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-06","discovered_date":"2022-12-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d09252b2cdff3ed517bb436d7218cb52e5425f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ventura%20County%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"2152c33aa871","org_name":"Ventura County Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-579832"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569315"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ventura%20County%20Credit%20Union%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ventura%20County%20Credit%20Union-2023-07-06"}],"summary":"Ventura County Credit Union reported unauthorized access to certain employee email accounts containing information related to affected individuals.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"972baa14cc4ca97ff5a78666f6c6508b4fbbe095","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Law%20Foundation%20Minor%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b1ab22190a95","org_name":"The Law Foundation of Silicon Valley","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Law%20Foundation%20Minor%20Notice%20Letter.pdf"}],"summary":"The Law Foundation of Silicon Valley reported unauthorized access to information within its systems after a network disruption on February 18, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-07-06","discovered_date":"2023-05-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa4ebcb8d13c21964843d290b87fdf1bbb1d46c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/_edgeMED%20SAMPLE%20LETTER.pdf"},"notes":null,"org_country":"US","org_id":"49a9882388aa","org_name":"edgeMED Healthcare, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569201"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/_edgeMED%20SAMPLE%20LETTER.pdf"}],"summary":"edgeMED Healthcare, LLC reported that an unauthorized party accessed files containing personal and medical information on a medical billing system.","supporting_quote":null,"technology_involved":["medical billing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-05","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb91019234810b8736e54abe26c6de67e75ba13d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Silicon%20Valley%20Mechanical%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f9cb0b5cba3c","org_name":"Silicon Valley Mechanical, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Silicon%20Valley%20Mechanical%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Silicon Valley Mechanical reported unauthorized access to or acquisition of data on certain systems between May 30 and June 6, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc7f5c7fee84d7f91ca06837ff483dfaf0041feb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CommerceV3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"042690b13697","org_name":"CommerceV3","org_type":"unknown","ransomware":null,"records_affected":5001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CommerceV3.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-03","discovered_date":"2023-06-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f000439906b553ffa744f2a60c6326c1087aa5bc","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Von%20Housen%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2862bc6c7209","org_name":"Von Housen Management Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Von%20Housen%20-Sample%20Notice.pdf"}],"summary":"Von Housen Management Inc. reported that an unauthorized actor may have accessed files and stored data in one email account, potentially affecting personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d2beea27679a585036263ec6e25be4dfaf19745","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NucorCorporation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01233c0d3ed5","org_name":"Nucor","org_type":"unknown","ransomware":null,"records_affected":1330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/NucorCorporation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11fea37c3c2081daec1a9bc07cb2ebef1ac9329d","impact_type":"unknown","incident_date":"2023-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dole%20-%20Individual%20Notice%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"eb1b2ec493e7","org_name":"Dole plc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568779"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dole%20-%20Individual%20Notice%20-%20CA.pdf"}],"summary":"Dole plc reported a cybersecurity incident affecting systems containing employee personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-06-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"047b34439765274d45b93a7797002e761f4ac915","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Draft%20Individual%20Notification%20-%20Valley%20Power%20adult.pdf"},"notes":null,"org_country":"US","org_id":"dfcec6761d89","org_name":"Valley Power Systems, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568729"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Draft%20Individual%20Notification%20-%20Valley%20Power%20adult.pdf"}],"summary":"Valley Power Systems reported that personal information may have been accessible to an unauthorized actor around June 9, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-30","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d653a61609caae7c8ff1c7733037ad111b9ee4f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Union%20Bank%20and%20Trust%20Company%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"aa27dddd41e4","org_name":"Union Bank and Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A zero-day vulnerability in Progress Software's MOVEit Transfer software was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Union%20Bank%20and%20Trust%20Company%20-%20Sample%20Notice.pdf"}],"summary":"Union Bank and Trust Company reported unauthorized access to customer information in its MOVEit Transfer application after a zero-day vulnerability was exploited.","supporting_quote":"The investigation determined the vulnerability identified by Progress Software was exploited and certain customer information being stored within UBT’s MOVEit Transfer application was subject to unauthorized access on May 29, 2023.","technology_involved":["MOVEit Transfer"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c757ff9c0ab198f361643bfe104a5b8dabcdca45","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L02%20Brookfield_VG_CA_final%2029062023.pdf"},"notes":null,"org_country":"US","org_id":"7814e37457bb","org_name":"The Vitality Group, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A security vulnerability in the third-party MOVEit file transfer program allowed unauthorized access to Vitality's server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568724"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L02%20Brookfield_VG_CA_final%2029062023.pdf"}],"summary":"A vulnerability in the third-party MOVEit file transfer program allowed unauthorized access to a Vitality server, potentially putting personal information at risk.","supporting_quote":"MOVEit experienced a security vulnerability on May 30, 2023, which allowed an unauthorized third party to access the Vitality server that utilizes the MOVEit software.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"MOVEit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-02-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87daae4c7b0150fb04ad20ebd9a5ae10b0e0ba2a","impact_type":"both","incident_date":"2023-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sweetwater%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a6eb9cba1cdf","org_name":"Sweetwater Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568733"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sweetwater%20-%20California%20Notification.pdf"}],"summary":"Sweetwater Union High School District reported unauthorized access to its computer network, files taken, and disruption to computer-system availability and functionality.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1133","T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4b2027a26416b6d2eac2ba7ab4b9e328a93a635","impact_type":"data_theft","incident_date":"2023-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24669.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5acbf6a2ed89","org_name":"Orrick, Herrington & Sutcliffe LLP","org_type":"professional_services","ransomware":null,"records_affected":6376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24669.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24669.pdf"}],"summary":"An unauthorized third party remotely accessed an Orrick file share and obtained files containing personal information.","supporting_quote":null,"technology_involved":["file share"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3f9d49fb3ecf9028c7d7b4dc25f4688deebd41","impact_type":"data_theft","incident_date":"2023-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP%20%E2%80%93%20Sample%20Individual%20Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"5acbf6a2ed89","org_name":"Orrick, Herrington & Sutcliffe LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-576355"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568767"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570592"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570591"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571110"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP%20%E2%80%93%20Sample%20Individual%20Notice_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Orrick%2C%20Herrington%20%26%20Sutcliffe%20LLP-2023-06-30"}],"summary":"Orrick reported that an unauthorized third party remotely accessed part of its network and obtained files containing personal information.","supporting_quote":null,"technology_involved":["file share"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-30","discovered_date":"2023-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae399997954addbcc2d1cc7173cca5f046c4faea","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lansing%20Community%20College%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7ed8b9a963bc","org_name":"Lansing Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568741"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lansing%20Community%20College%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lansing%20Community%20College-2023-06-30"}],"summary":"Lansing Community College reported that an unauthorized actor may have accessed certain systems containing information related to affected people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3b4735a41e1f9b999349928d2cb576a53918a38","impact_type":"data_theft","incident_date":"2023-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Imagine360%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"778f061d2481","org_name":"Imagine360","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568756"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570680"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Imagine360%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Imagine360-2023-06-30"}],"summary":"Imagine360 determined that an unauthorized actor copied files containing personal information from two externally hosted file-sharing platforms.","supporting_quote":null,"technology_involved":["Citrix","Fortra","third-party file-sharing platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Citrix and Fortra"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"6ff730cf6d53","name":"Citrix"},{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"06b1220eebca1c5601d8b40fec149a02c914785a","impact_type":"data_theft","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24664.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7c8a6a608365","org_name":"Clearwater Credit Union","org_type":"financial","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":"A previously unknown vulnerability in MOVEit was exploited to access files on MOVEit systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24664.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24664.pdf"}],"summary":"A vendor’s MOVEit systems were exploited, allowing third parties to access Clearwater documents containing personal information.","supporting_quote":"On June 14, 2023, we learned that unauthorized third parties exploited a previously unknown vulnerability in MOVEit that allowed those third parties to gain access to files on MOVEit systems at the end of May 2023.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-30","discovered_date":"2023-06-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d10510fac526914f16f7892c7c16c480f2695033","impact_type":"unknown","incident_date":"2023-05-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7c8a6a608365","org_name":"Clearwater Credit Union","org_type":"unknown","ransomware":null,"records_affected":25660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clearwater%20Credit%20Union-2023-06-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-30","discovered_date":"2023-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e39bf4e6ab6c11e449588e11033c8008a7bbd93d","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15307.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9f1d55f7ffc4","org_name":"Bristol Myers Squibb","org_type":"other","ransomware":null,"records_affected":2231,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15307.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15307.pdf"}],"summary":"Bristol Myers Squibb reported that confidential data was accessed and downloaded without authorization in connection with a vulnerability in Progress Software Corporation's MOVEit SFTP tool.","supporting_quote":null,"technology_involved":["MOVEit","SFTP tool"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software Corporation"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"468f3ac84f398912f2ca084a01a6def7705555e5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_2.pdf"},"notes":null,"org_country":"US","org_id":"f06b0be7bb05","org_name":"ARx Patient Solutions","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568708"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25741.pdf"}],"summary":"An unauthorized third party accessed an ARx Patient Solutions employee email account containing files with personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-29","discovered_date":"2023-06-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"726897d7514a312c0f8b2cfbd585a4103544c385","impact_type":"data_theft","incident_date":"2021-11-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Smithfield%20Specialty%20Foods%20Group%20LLC%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4dbf80fa8b32","org_name":"Smithfield Specialty Foods Group LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568673"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Smithfield%20Specialty%20Foods%20Group%20LLC%20Individual%20Notice.pdf"}],"summary":"A cyberattack targeting CV3’s web hosting service exposed Smithfield customers’ personal and payment card information.","supporting_quote":"An investigation has determined that this issue resulted from a cyberattack targeting CV3’s web hosting service used by Smithfield to support two websites: smithfieldmarketplace.com and thepeanutshop.com.","technology_involved":["CV3 web hosting service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CV3"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-29","discovered_date":"2023-08-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d773a235e82a2d5b01cadba6f3ce13780259e9bd","impact_type":"unknown","incident_date":"2022-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"49925413afd9","org_name":"KBF CPAs","org_type":"unknown","ransomware":null,"records_affected":1292,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#KBF%20CPAs-2023-09-13"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#KBF%20CPAs-2023-06-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2023-06-29","discovered_date":"2022-10-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b99032ea0f55a72c27e1551364fcde79b429d953","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CRF%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0e78532faec7","org_name":"Community Research Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568653"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CRF%20-%20Sample%20Notice.pdf"}],"summary":"Community Research Foundation discovered unusual activity in its digital environment, and an investigation found that an unauthorized actor accessed files and data that may have included protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-29","discovered_date":"2023-06-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c5f5be2d11a5854b22636f844faebd6aba6ccc2","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AltMedHealthServicesCorp_VitalityGroup_SampleBreachNotificationLetter%20-%206-29-23.pdf"},"notes":null,"org_country":"US","org_id":"6e4ad28bac69","org_name":"AltaMed Health Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in MOVEit allowed an unauthorized third party to access the server using the software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568687"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AltMedHealthServicesCorp_VitalityGroup_SampleBreachNotificationLetter%20-%206-29-23.pdf"}],"summary":"Personal information associated with AltaMed was potentially exposed after an unauthorized party accessed a MOVEit server at Vitality.","supporting_quote":"After reviewing the incident, Vitality identified a two-hour span in which the vulnerability allowed the unauthorized third party to access the server that utilizes the MOVEit software.","technology_involved":["MOVEit"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Vitality"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"347d29c54317","name":"Vitality"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7548e1d2255382ff8a63acf83bcfa19d2bc83a2c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24654.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7b41c35c3c22","org_name":"Sebastian Kanczugowski","org_type":"financial","ransomware":null,"records_affected":994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24654.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24654.pdf"}],"summary":"An unauthorized individual accessed Sebastian Kanczugowski’s email account, which contained messages or attachments that may have included personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"776e89aa004069f5282c215497505de11a407eec","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Roosevelt%20University%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6a6c9e7fa604","org_name":"Roosevelt University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568605"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Roosevelt%20University%20-%20Sample%20Notice.pdf"}],"summary":"Roosevelt University reported that an unknown actor accessed parts of its network, and information relating to a FAFSA may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-28","discovered_date":"2022-10-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75e265d59447d6a4efb98783989f55d75b2e2cd2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6e2f11ccfc4f","org_name":"IMA Financial Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568622"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMA%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#IMA%20Financial%20Group%2C%20Inc.-2023-06-28"}],"summary":"IMA Financial Group reported that certain data may have been accessed or acquired without authorization, and identified the recipient’s information in the potentially affected dataset.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-27","discovered_date":"2023-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88b82c9dcd2f5065ac1fefdbd84f417b56ddc942","impact_type":"data_theft","incident_date":"2023-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-06-27%20-%20Wubbels%20Duffy%20-%20Sample%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"2873c2648cee","org_name":"Wubbels & Duffy, CPA, RLLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568571"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-06-27%20-%20Wubbels%20Duffy%20-%20Sample%20Consumer%20Notification%20Letter.pdf"}],"summary":"Wubbels & Duffy discovered unauthorized access to its GoFileRoom document management platform, and later confirmed personal information had been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":["GoFileRoom"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97653029ddb7774599b069525b5b03ad1dfcf03a","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"951616775887","org_name":"Talcott Resolution Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568564"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570802"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Talcott%20Resolution%20Life%20Insurance%20Company-2023-06-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-27","discovered_date":"2022-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4f9e41a1cb843f966dd14421f4eae8ec567f952a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-14","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24620.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"20ef9613a330","org_name":"Clallam County Public Utility District","org_type":"energy_utilities","ransomware":null,"records_affected":1140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24620.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24620.pdf"}],"summary":"An unknown third party accessed Clallam County Public Utility District’s computer and email systems, where personal and medical information was present.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1117387d26fb91ef92601bd3e86e31382b5585f","impact_type":"data_theft","incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CalSTRS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2264fa7f9497","org_name":"California State Teachers' Retirement System","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in PBI Research Services' secure file transfer application was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CalSTRS%20-%20California%20Notification.pdf"}],"summary":"A vulnerability in PBI Research Services' secure file transfer application was exploited, and files containing CalSTRS members’ personal information were acquired.","supporting_quote":"PBI recently informed CalSTRS that a vulnerability in the secure file transfer application wa s exploited and an unauthorized party acquired files containing certain CalSTRS members’ information.","technology_involved":["PBI Research Services","secure file transfer application"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PBI Research Services"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ac992bdcc720","name":"PBI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6e20658ed47c8dc7ea764715c532555457f5e3b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-06-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"553a85a53eed","org_name":"BreachForums Clone","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exposed backup of the MyBB database exposed the records.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BreachForums Clone","type":"hibp","url":"https://haveibeenpwned.com/Breach/BreachForumsClone"}],"summary":"BreachForums Clone exposed records from a backup of its MyBB database.","supporting_quote":"The breach was due to an exposed backup of the MyBB database which included email and IP addresses, usernames and Argon2 password hashes.","technology_involved":["MyBB database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-23","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"950ea15753fee6fa065295f2c1865684135bf312","impact_type":"data_theft","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN%20UCLA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"637d4716fb4e","org_name":"University of California Los Angeles","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN%20UCLA%20Sample%20Notice.pdf"}],"summary":"University of California Los Angeles reported that files containing personal information were accessed in an incident involving Progress Software’s MOVEit Transfer.","supporting_quote":null,"technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"291345d27959c70873380d8526b6c7cdb60bb3c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24599.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"43abf0644a79","org_name":"David Douglas School District","org_type":"education","ransomware":null,"records_affected":1148,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24599.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24599.pdf"}],"summary":"An unknown individual burglarized a David Douglas School District office and stole a hard drive that contained personal information related to current and former employees.","supporting_quote":"On January 29, 2023, an unknown individual burglarized a DDSD office and stole a number of electronic devices, including a physical hard drive.","technology_involved":["physical hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d371c97a105437dbb1a047b22147b7b741fbc06","impact_type":"data_theft","incident_date":"2023-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18501%20PBI%20Longevity%20Ad%20Wilton%20Re%20CM%201YR%2048%20L9%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"0b5469200cc5","org_name":"Wilton Reassurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571551"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568311"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18501%20PBI%20Longevity%20Ad%20Wilton%20Re%20CM%201YR%2048%20L9%20r1prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wilton%20Reassurance%20Company-2023-06-23"}],"summary":"An unauthorized third party exploited a vulnerability in MOVEit Transfer and downloaded data from a Wilton Re MOVEit Transfer server.","supporting_quote":"On or around May 31, 2023, Progress Software, the provider of MOVEit Transfer software disclosed a vulnerability in their software that had been exploited by an unauthorized third party.","technology_involved":["MOVEit Transfer","Progress Software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Progress Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3a5ffb5ec8f0","name":"Progress Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df875d3422666d6c50444208a31c987008321208","impact_type":"data_theft","incident_date":"2023-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Choice%20-%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"bfbaaf5c8712","org_name":"Desert Physicians Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572857"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568345"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Choice%20-%20Notification.pdf"}],"summary":"Desert Physicians Management reported that files containing personal information were copied from its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf447c4a2bb7f02121d7750f4d4233b5211cdeb0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J5799_Citi%20Trends%20Inc_L02_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"df174d221e74","org_name":"Citi Trends, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J5799_Citi%20Trends%20Inc_L02_SAS_1.pdf"}],"summary":"A third party entered and disrupted Citi Trends' IT network and may have been able to extract files containing employee and prospective employee information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d941f6c81c2040fa20b6db21fa1bf6931a6a0af","impact_type":"unknown","incident_date":"2023-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_J5981_Orrick%20Herrington%20%26%20Sutcliffe%20LLP%20%28CALPERS%29_L01_SAS_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a538c51fb57","org_name":"CalPERS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568347"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1199"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2023-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e01dbf87f18bd596e015fff7be74f5ed1c0a8d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20All%20State.pdf"},"notes":null,"org_country":"US","org_id":"e932719285c5","org_name":"USAA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Third-party service-provider call center representatives shared their USAA access credentials with unauthorized individuals.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568287"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20All%20State.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24555.pdf"}],"summary":"Unauthorized individuals used USAA access credentials shared by third-party service-provider call center representatives to access some members’ personal information.","supporting_quote":"We recently learned that a limited number of call center representatives employed by one of our third-party service providers improperly shared their USAA access credentials with unauthorized individuals.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1a21b67212ad78ae74fa86914d19826ed0e5ab0","impact_type":"data_theft","incident_date":"2023-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Patient%20Letter_English.Palomar%20Health.pdf"},"notes":null,"org_country":"US","org_id":"b9736278d02e","org_name":"Palomar Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Patient%20Letter_English.Palomar%20Health.pdf"}],"summary":"Palomar Health notified affected people that PharMerica’s investigation found patient information may have been obtained from its systems.","supporting_quote":null,"technology_involved":["PharMerica computer systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PharMerica"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"f4a96ddcc70c","name":"PharMerica"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-20","discovered_date":"2023-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02efd05893fb2c7eca98a582b01fabe8d4aff0ae","impact_type":"data_theft","incident_date":"2023-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J5767_Mondelez%20Global%20LLC_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"2862ff329cf0","org_name":"Mondelez Global LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568259"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J5767_Mondelez%20Global%20LLC_L01_SAS_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mondelez%20Global%20LLC-2023-06-19"}],"summary":"Unauthorized access to Bryan Cave Leighton Paisner LLP systems resulted in acquisition of certain data belonging to current and former Mondelez employees.","supporting_quote":null,"technology_involved":["customer file storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Bryan Cave Leighton Paisner LLP"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5313e88e6d29","name":"Bryan Cave Leighton Paisner LLP"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-19","discovered_date":"2023-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57bd3097f614ccd2f9026a7e1e3f78acb03d3c8f","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PharMerica%20-%20Notification%20Letter%20%28Adult%20-%201%20Year%20CM%29%20%2889846629v1%29.pdf"},"notes":null,"org_country":"US","org_id":"f4a96ddcc70c","org_name":"PharMerica Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568177"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PharMerica%20-%20Notification%20Letter%20%28Adult%20-%201%20Year%20CM%29%20%2889846629v1%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PharMerica%20Corporation-2023-05-12"}],"summary":"PharMerica reported that an unknown third party accessed its computer systems and may have obtained personal information, including health-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-16","discovered_date":"2023-06-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"24a658932870040b1150557676c794087c86f67b","impact_type":"unknown","incident_date":"2023-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"faa8d5e76d29","org_name":"Oregon Department of Transportation","org_type":"unknown","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Department%20of%20Transportation-2023-06-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed59c55123b8983827387253eb522375d7d7f51e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/AllenTate.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fccbf850be43","org_name":"Allen Tate Mortgage Partners, LLC","org_type":"unknown","ransomware":null,"records_affected":77,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/AllenTate.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcf08e2e934298c5b7af79853bf7e02f84d26e9c","impact_type":"data_theft","incident_date":"2021-11-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20Customers%20from%20J%26K%20with%20Consumer%20Notice%20from%20CV3.docx_.pdf"},"notes":null,"org_country":"US","org_id":"3abd7e5bfe6a","org_name":"John & Kira’s","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-568098"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20Customers%20from%20J%26K%20with%20Consumer%20Notice%20from%20CV3.docx_.pdf"}],"summary":"An unauthorized party accessed CommerceV3’s systems and may have obtained customer order and payment information processed for John & Kira’s.","supporting_quote":"CommerceV3 recently notified us to indicate that an unauthorized party had gained access to theirsystems and may have obtained the customer order information they process for stores like ours.","technology_involved":["CommerceV3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CommerceV3"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"042690b13697","name":"CommerceV3"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"878df06931b43388bc6bfa861e48c4d2d10b8fb7","impact_type":"disruption_or_ransomware","incident_date":"2023-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/03040879.PDF"},"notes":null,"org_country":"US","org_id":"7c9914732ea1","org_name":"International Chapter P.E.O. Sisterhood","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567981"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/03040879.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Chapter%20P.E.O.%20Sisterhood-2023-06-14"}],"summary":"P.E.O. experienced a ransomware attack that shut down and locked its systems, and investigators could not confirm whether attackers stole data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5dadeecc3ea418637e881c111acc2965a4d2b9c9","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2023-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24497.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1d47cfb2c8ec","org_name":"International Chapter of the P.E.O. Sisterhood","org_type":"nonprofit","ransomware":true,"records_affected":3450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24497.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24497.pdf"}],"summary":"A ransomware attack shut down P.E.O.’s systems, and an investigation could not confirm whether attackers stole data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-14","discovered_date":"2023-05-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69712881f89b4af1faec61d54db0aea65b59a526","impact_type":"unknown","incident_date":"2022-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e57d0f0fa3a6","org_name":"Dallas School District #2","org_type":"unknown","ransomware":null,"records_affected":2061,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dallas%20School%20District%20%232-2023-06-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-06-14","discovered_date":"2022-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7754a8455eeb2f92d4cdd4ee300e7dfcc71b6945","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15712.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"498f65d6b48a","org_name":"Connexin Software Inc.","org_type":"technology_saas","ransomware":null,"records_affected":29600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15712.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15712.pdf"}],"summary":"Connexin Software reported that an unauthorized party accessed and removed some data from an offline set of patient data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-13","discovered_date":"2023-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01bc9989fbbd5ea399897248660da24206e11d0b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18012%20Markwins%20Beauty%20Brands%20Adult%20CM%2012%20Mo%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"172bee9e3c89","org_name":"Markwins Beauty Brands, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567921"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18012%20Markwins%20Beauty%20Brands%20Adult%20CM%2012%20Mo%20r1prf.pdf"}],"summary":"Markwins Beauty Brands reported a network disruption and unauthorized access to limited information maintained on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-13","discovered_date":"2022-06-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a64b8ca0d40f4c5d0720e8b2933aa865d4356c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Loeb%20%26%20Loeb-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8d04bd6d789c","org_name":"Loeb & Loeb, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567936"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-569940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Loeb%20%26%20Loeb-%20Sample%20Notice.pdf"}],"summary":"Loeb & Loeb identified unauthorized access to certain network systems on or about June 7, 2022, and said information related to clients and employees was impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2023-06-13","discovered_date":"2023-06-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84e5ddf857d8d83b21f6660a731039571108e284","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GGS%20-%20Security%20Incident%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"78a411ff07fb","org_name":"GreenGeeks LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567904"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GGS%20-%20Security%20Incident%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24476.pdf"}],"summary":"GreenGeeks reported that a security incident may have exposed personal information, credentials, and encrypted payment information in GreenGeeks Dashboard Profiles.","supporting_quote":null,"technology_involved":["GreenGeeks Dashboard Profiles"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-13","discovered_date":"2023-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c65029ab93857c527e57c03580eaee1bd1f9ed1","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Credit%20Control%20Corporation%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4be3cf77c3b2","org_name":"Credit Control Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567955"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Credit%20Control%20Corporation%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Credit%20Control%20Corporation-2023-06-13"}],"summary":"Credit Control Corporation determined that files were copied from its network during a data security incident between March 2 and March 7, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-13","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70cc7a03e0108f32818e1fbc88276391092529ca","impact_type":"data_theft","incident_date":"2023-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Boot%20World%20Security%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"857efbb9c49d","org_name":"Boot World Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567947"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Boot%20World%20Security%20Breach%20Notification.pdf"}],"summary":"Unauthorized parties accessed Boot World’s Paycom payroll program and exported a file containing employee information.","supporting_quote":null,"technology_involved":["Paycom"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Paycom"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bef69999b2c0","name":"Paycom"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68982b843d8a6ecc8f68235d526953dc4496f1fd","impact_type":"data_theft","imported_from":null,"incident_date":"2020-05-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d85cc2edfbed","org_name":"Zacks","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zacks","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zacks"}],"summary":"A corpus containing Zacks customer names, contact details, usernames, and hashed passwords was circulated in June 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-09","discovered_date":"2023-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"47acc3d283e60a7938a0675b3943181135d1d14d","impact_type":"unknown","incident_date":"2023-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bf2914f4fba","org_name":"UnitedHealthcare","org_type":"unknown","ransomware":null,"records_affected":16844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UnitedHealthcare-2023-06-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-09","discovered_date":"2023-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ad6250e895d70d9a34129e362a889dca8e2c011","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Momentum%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4dd1f2f208d1","org_name":"Momentum WORK, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Momentum%20-%20California%20Notification.pdf"}],"summary":"Momentum WORK, Inc. identified unauthorized access to some systems, and information that may have been accessed included personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-06-08","discovered_date":"2023-05-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cc8ad98eb3818414ee33ca13f2da84607967855","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Data%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"13e93457176d","org_name":"Water Resources Control Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567743"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Data%20Breach%20Notification%20Letter.pdf"}],"summary":"The Water Resources Control Board disclosed that a document shared with attorneys contained water-right holder information, including identifiers that could be used to access accounts.","supporting_quote":null,"technology_involved":["RMS","Survey Portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb879c3ab4edcc516fab060901940f235f02da08","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/IntellihartxLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"407bbb0c03a0","org_name":"Intellihartx, LLC","org_type":"unknown","ransomware":null,"records_affected":1802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/IntellihartxLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5177135376bdecd87bfdbf1d3c0e2acd9c91c1c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CIBT%2C%20Inc.%20-%20%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9d156c028181","org_name":"CIBT, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CIBT%2C%20Inc.%20-%20%20Sample%20Notice.pdf"}],"summary":"CIBT reported that a security incident may have resulted in unauthorized access to or acquisition of a limited amount of data, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"075db008ae685d85628b23ef2d66e366cb65778a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DCI-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"3c295913e505","org_name":"Door Components, Inc. d/b/a DCI Hollow Metal on Demand","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DCI-%20Sample%20Notice.pdf"}],"summary":"DCI reported unauthorized access to certain files and folders in its systems between April 2 and April 17, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-07","discovered_date":"2022-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"821a0f34e48d7c484268baae2b1dba9d167f0f38","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CGM%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b193ea44bfc8","org_name":"CGM, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-581040"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CGM%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CGM%2C%20Inc.-2023-06-07"}],"summary":"CGM, Inc. reported that an unknown actor accessed its network and that the affected systems contained individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f702396bc89ab6cb52f4e972e19dea1ce04fd68","impact_type":"unknown","incident_date":"2023-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ALDI%20-%20Website%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a6f0ee869f6","org_name":"ALDI, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567712"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfb9d5ede9ae59e6dd4a611c42a97509bb556d78","impact_type":"both","incident_date":"2023-04-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multi-state%20Notification%20%20-%20Heavy%20Hammer.pdf"},"notes":null,"org_country":"US","org_id":"e5e86997aac0","org_name":"Heavy Hammer","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"Several employees were victims of a phishing attack before the ransomware attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multi-state%20Notification%20%20-%20Heavy%20Hammer.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24180.pdf"}],"summary":"Heavy Hammer reported a ransomware attack following employee phishing, with personal and payment information that may have been accessed and acquired.","supporting_quote":"At the present time, we believe this ransomware attack occurred after several of our employees were victims of a phishing attack.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a39c6edb4883ac38e4d0f088f6881b51bc0d7fa2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-05-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"70c5889a1358","org_name":"JD Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":521878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JD Group","type":"hibp","url":"https://haveibeenpwned.com/Breach/JDGroup"}],"summary":"JD Group reported a breach affecting several online assets that exposed 521,878 customer records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-02","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca10aea06c38c48f0f4ab5f1c3cdd4acff45d561","impact_type":"data_theft","incident_date":"2023-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24318.pdf"},"notes":null,"org_country":"US","org_id":"6597a74a7126","org_name":"T. Rowe Price Group","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24318.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24318.pdf"}],"summary":"An unauthorized third party remotely accessed Orrick’s network and obtained client files containing PHI.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Orrick"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"f6aed65f8610","name":"Orrick"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-06-02","discovered_date":"2023-02-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4014bf6ab892a550c81162083713254174bb576d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EpiSource%20Notice%20Letter%20%285.27.23%29.pdf"},"notes":null,"org_country":"US","org_id":"278504f30c49","org_name":"EpiSource","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EpiSource%20Notice%20Letter%20%285.27.23%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#EpiSource-2023-06-09"}],"summary":"EpiSource reported suspicious access to its AWS environment, where health and personal information may have been involved.","supporting_quote":null,"technology_involved":["Amazon Web Services (AWS)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"89b6d8c73e41a03dd3b672490489434478bd62d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15158.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b9602f2a0ed","org_name":"Stanford, Munko, & Co. PLLC","org_type":"unknown","ransomware":null,"records_affected":3086,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15158.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"546bfe1b7e8286d98b5efb97cbdb81a55497aef5","impact_type":"data_theft","imported_from":null,"incident_date":"2020-09-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3501a21489cb","org_name":"RaidForums","org_type":"other","ransomware":null,"records_affected":478604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RaidForums","type":"hibp","url":"https://haveibeenpwned.com/Breach/RaidForums"}],"summary":"In May 2023, 478,604 RaidForums user records containing personal information and password hashes were posted to another hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-31","discovered_date":"2023-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d8b347730f01f38329e5e97be2d2abdb279fe49","impact_type":"data_theft","incident_date":"2023-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/iSpace-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8ece56198a10","org_name":"iSpace, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/iSpace-%20Sample%20Notice.pdf"}],"summary":"iSpace determined that an unauthorized individual accessed and copied documents from its environment between January 30 and February 5, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6e0a27d4f2fee19661089b186406ca636737519","impact_type":"unknown","incident_date":"2023-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2023.05.31%20C-P%20Flexible%20Notification%20Letter%20Template.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf4915b82c19","org_name":"C-P Flexible Packaging, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567424"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5467e0033fd463e7848aa6b1600008bf31c564b","impact_type":"data_theft","imported_from":null,"incident_date":"2023-05-29","initial_access":"malware_other","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b8afd5ef59ab","org_name":"Polish Credentials","org_type":"unknown","ransomware":null,"records_affected":1204870,"reviewed":false,"root_cause":"The credentials were likely obtained by malware running on victims' machines.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Polish Credentials","type":"hibp","url":"https://haveibeenpwned.com/Breach/PolishCredentials"}],"summary":"A list of Polish email addresses and plain-text passwords, likely collected by malware on victims' machines, appeared on a local forum.","supporting_quote":"Likely obtained by malware running on victims' machines, each record included an email address and plain text password alongside the website the credentials were used on.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2023-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6a7183a8e03401e178b0fd36f842b19c33574537","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24276.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b210b424a1f7","org_name":"Over The Top (OTT)","org_type":"unknown","ransomware":null,"records_affected":22723,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24276.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-26","discovered_date":"2023-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"495385f1f1595568be3d8fa4689da39158696cd3","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Burton%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6c241cd11ed7","org_name":"The Burton Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":10452,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Burton%20Corporation-2024-02-06"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-580610"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567297"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Burton%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Burton%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA_0.pdf"}],"summary":"Burton discovered suspicious activity affecting certain systems, and an investigation found some information in files and folders that may have been accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2692c33969b4245680e676edccd5dc7fcadd870","impact_type":"both","incident_date":"2023-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"c4d666de4dd5","org_name":"Shasta Community Health Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567290"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Proof.pdf"}],"summary":"A ransomware attack on Alvaria's customer environment exposed data associated with Shasta Community Health Center, including names, phone numbers, and addresses.","supporting_quote":null,"technology_involved":["Alvaria"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Alvaria"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"50c3801b9892","name":"Alvaria"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-26","discovered_date":"2022-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b732d125ec5c384de8006fc0f8862465173d953b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nonstop%20Admin%20-%20Eisner%20Health%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"48f7c4246479","org_name":"Nonstop Administration and Insurance Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nonstop%20Admin%20-%20Eisner%20Health%20-%20Sample%20Notice.pdf"}],"summary":"An unknown party accessed Nonstop Administration and Insurance Services' cloud services platform without authorization, and the investigation could not rule out access to specific information.","supporting_quote":null,"technology_involved":["cloud services platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-26","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"09df9deae2ce5f056fb80d2ea857605b2b302548","impact_type":"data_theft","incident_date":"2023-02-01","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24250.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b0c18924c6c4","org_name":"NCB Management Services","org_type":"financial","ransomware":null,"records_affected":605,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Capital%20One-2023-05-26"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24250.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24250.pdf"}],"summary":"NCB Management Services reported that an unauthorized third party accessed its systems and some credit-card account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e085b9af47c589f1d71d67e7b5668880e01a3edd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/MercerUniversity.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d612c23f92e","org_name":"Mercer University","org_type":"unknown","ransomware":null,"records_affected":1182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/MercerUniversity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-26","discovered_date":"2023-05-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a775857bf227efa4ddb484e78e78c9bcc0e599b9","impact_type":"unknown","incident_date":"2023-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9680191a11a4","org_name":"Managed Care of North America, Inc. (MCNA)","org_type":"unknown","ransomware":null,"records_affected":8923662,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Managed%20Care%20of%20North%20America%2C%20Inc.%20%28MCNA%29-2023-05-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-05-26","discovered_date":"2023-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdf5913b45cae6c46629bb10193b93f991616e17","impact_type":"data_theft","imported_from":null,"incident_date":"2023-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MCNA%20-%20CA%20Letter%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"a687746fb5f2","org_name":"Managed Care of North America, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567260"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MCNA%20-%20CA%20Letter%20Templates.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/ManagedCareNA.pdf"}],"summary":"Managed Care of North America reported that a cybercriminal accessed its computer system and copied information between February 26 and March 7, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-26","discovered_date":"2023-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c365d329c9845ad2e2526ce53a80e8b25502d610","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24257.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"048932f09fa9","org_name":"City of Woodland","org_type":"government","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24257.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24257.pdf"}],"summary":"A data incident affected the City of Woodland’s Minol-managed utility billing portal, which was discovered on April 14, 2023, and resulted in service disruption and potentially impacted customer information.","supporting_quote":null,"technology_involved":["utility billing portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Minol USA Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"85eb6ec60f37","name":"Minol USA Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2023-05-25","discovered_date":"2023-04-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2a1cc4835fcb1db71eea8f89ad997307efcac020","impact_type":"data_theft","incident_date":"2023-04-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24241.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e1467dcb563","org_name":"European Wax Center, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1592,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24241.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24241.pdf"}],"summary":"European Wax Center reported that an attacker used stolen credentials to access an EWC account managed by Zenoti and exfiltrated files from a compromised staging website.","supporting_quote":"The threat actor had utilized stolen credentials to gain access to an EWC account managed by our point-of-sale provider, Zenoti.","technology_involved":["Zenoti","staging website"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Zenoti"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"0044f47fc9ee","name":"Zenoti"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-24","discovered_date":"2023-03-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86a4f6c40fa092a0fd54ef548c15d64c3d3b4d5b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vascular%20Center%20of%20Intervention%2C%20Inc.%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"c9eff23a0701","org_name":"Vascular Center of Intervention, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567187"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vascular%20Center%20of%20Intervention%2C%20Inc.%20-%20Exhibit%20A.pdf"}],"summary":"Vascular Center of Intervention, Inc. reported that documents in its environment may have been copied or viewed by an unauthorized person between February 25 and March 29, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f832c4fc809ba34df8d2b97066c1c0ba53fd9f86","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SLT%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ad02ab619707","org_name":"SLT Lending SPV, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SLT%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SLT%20Lending%20SPV%2C%20Inc.-2023-05-24"}],"summary":"An unauthorized actor accessed folders on SLT Lending SPV, Inc.'s devices, and the files included personal and/or health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-24","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37b0643306545151f4d38ae74cd797f597b2cf85","impact_type":"both","incident_date":"2023-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kline%20%26%20Specter%20-%20AD%20Vendors%20CM.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"d13923e14be6","org_name":"Kline & Specter, P.C.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567172"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kline%20%26%20Specter%20-%20AD%20Vendors%20CM.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/KlineSpecterPC.pdf"}],"summary":"Kline & Specter, P.C. reported a ransomware attack that disabled portions of its network and involved the copying of data that may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5db0ff6202a503c214ff8740fad9d5a11b90394","impact_type":"both","incident_date":"2023-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Template%202.pdf"},"notes":null,"org_country":"US","org_id":"09038073c50f","org_name":"Populus Financial Group","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Template%202.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Populus%20Financial%20Group%2C%20Inc.-2023-05-23"}],"summary":"Alvaria reported a ransomware attack affecting a customer environment and access to data associated with Populus Financial Group.","supporting_quote":null,"technology_involved":["Alvaria","workforce management system","outbound dialer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Alvaria"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"50c3801b9892","name":"Alvaria"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"631207f540f64b30244017f8c6b8d82fc6e50010","impact_type":"data_theft","incident_date":"2023-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Polished%20CA%20Sample%20APCON-ADT-CA.pdf"},"notes":null,"org_country":"US","org_id":"9c3d47abc805","org_name":"Polished.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Polished%20CA%20Sample%20APCON-ADT-CA.pdf"}],"summary":"An unauthorized party accessed Polished.com’s AppliancesConnection.com website and acquired customer payment-card and personal information.","supporting_quote":null,"technology_involved":["AppliancesConnnection.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-22","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a11035ccd1007dfac0a6d976990202e212020edd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24178.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b0c18924c6c4","org_name":"NCB Management Services, Inc.","org_type":"financial","ransomware":null,"records_affected":31484,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NCB%20Management%20Services%2C%20Inc.-2023-05-22"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24178.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/NCBManagementServicesInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24178.pdf"}],"summary":"NCB Management Services discovered that an unauthorized party accessed its systems and confirmed that some personal information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a5473999193131c6e436ebcc8b5186bdb1b42ce","impact_type":"unknown","incident_date":"2023-03-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cardholder%20Rewards%20Notification%20May%202023.pdf"},"notes":null,"org_country":"US","org_id":"8a197aa22a88","org_name":"Bread Financial Payments, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567072"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cardholder%20Rewards%20Notification%20May%202023.pdf"}],"summary":"An individual used information obtained from an unknown source to set up access to cardholders’ accounts through the Account Center portal and redeem Cash Back rewards.","supporting_quote":"Your [AAA Brand Credit Card] account was compromised, and your information, obtained from an unknown source, was used to set up access to your account through the online Account Center portal.","technology_involved":["Account Center"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-22","discovered_date":"2021-09-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56ec56e9e980ee0354ec5597ad006da7a99c7d13","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Apria%20HIPAA%20Notification%20Letter%20PDF.pdf"},"notes":null,"org_country":"US","org_id":"758bc92383cf","org_name":"Apria Healthcare LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567100"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Apria%20HIPAA%20Notification%20Letter%20PDF.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Apria%20Healthcare%20LLC-2023-05-22"}],"summary":"Apria Healthcare reported unauthorized access to systems containing personal information, with no proof that data was taken or funds were removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b234bc6922d6c04f0d5dc16daffd2d272592458","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15130.pdf"},"notes":null,"org_country":"US","org_id":"acdf82b2440a","org_name":"University of Puget Sound","org_type":"education","ransomware":null,"records_affected":623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15130.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15130.pdf"}],"summary":"The University of Puget Sound notified 623 users of a data security incident that occurred through a vendor.","supporting_quote":"We regret that this incident occurred through one of our vendors and regret any inconvenience it may cause you.","technology_involved":["Brightly","SchoolDude"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Brightly"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"eb7ed385baee","name":"Brightly"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7995ef170fbc9697b0e991d66b66970bd00f5a8c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/PerformanceFriction.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff9487ea30f1","org_name":"Performance Friction Corporation","org_type":"unknown","ransomware":null,"records_affected":1111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/PerformanceFriction.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a0b45044a06d10a5cf7cb81f926a95d9498821","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-16","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a3da22388af1","org_name":"Luxottica","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Luxottica","type":"hibp","url":"https://haveibeenpwned.com/Breach/Luxottica"}],"summary":"Luxottica suffered a data breach via a partner in March 2021 that exposed personal information.","supporting_quote":"In March 2021, the world's largest eyewear company Luxoticca suffered a data breach via one of their partners that exposed the personal information of more than 70M people .","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf78bd1cb9a15cace96888c1d9a337bc12493e7b","impact_type":"both","incident_date":"2023-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"26f933732605","org_name":"DISH Network","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DISH%20Network%2C%20LLC-2023-05-18"}],"summary":"DISH Network reported a cybersecurity incident involving an outage and the extraction of employee-related records and personal information from its IT systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-18","discovered_date":"2023-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40486244402d75f189675c7d672187a05d68d7cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Credit%20Union%20of%20Southern%20California%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"91bdfb76e89f","org_name":"Credit Union of Southern California","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566920"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567478"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Credit%20Union%20of%20Southern%20California%20-Sample%20Notice.pdf"}],"summary":"An employee email account belonging to CalBear was accessed without authorization, but CU SoCal could not confirm whether emails or attachments were accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-17","discovered_date":"2023-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20a8a0f90077090e9f9c35e4a8e51dfb3734c196","impact_type":"data_theft","incident_date":"2023-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Young%27s%20Commercial%20Transfer%20-%20Letter%20Attachment.pdf"},"notes":null,"org_country":"US","org_id":"6105b23b32b8","org_name":"Young’s Commercial Transfer","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Young%27s%20Commercial%20Transfer%20-%20Letter%20Attachment.pdf"}],"summary":"An unknown individual accessed some of Young’s Commercial Transfer’s systems and viewed or downloaded files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-17","discovered_date":"2022-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bda49de3f59c2e812166e5bcd833e59e1eb6285","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Puma%20Biotechnology%20Inc-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"225b1a2d565d","org_name":"Puma Biotechnology, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Puma%20Biotechnology%20Inc-%20Sample%20Notice.pdf"}],"summary":"Puma Biotechnology reported that files containing individuals’ names may have been subject to unauthorized access or acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b0bcbdd10abc4dff4ec77b1fb7b2063fde9eb3e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Carvin%20Software%20-%20MA%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87890766d8b9","org_name":"On Demand Staffing, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566821"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-17","discovered_date":"2023-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"504ddfa226d1dc1e4830848221aacf1844f1dd53","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jaco%20Oil%20Company%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"87869417e487","org_name":"Jaco Oil Company","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572735"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jaco%20Oil%20Company%20-%20Exhibit%20A.pdf"}],"summary":"Jaco Oil Company discovered that files containing personal and financial information had been copied from its computer network without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-17","discovered_date":"2023-01-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"954210cea223a007ad569fa7857ec97680fb3d7f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e26f5bb5c0a8","org_name":"Advisor Group Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":10761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advisor%20Group%20Holdings%2C%20Inc.-2023-05-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-16","discovered_date":"2023-03-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"206d598770d93f837fe191c1947a127c7d847ed8","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J4283_Sysco%20%232_L04_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"edd90876e6bb","org_name":"Sysco Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566795"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J4283_Sysco%20%232_L04_SAS_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sysco%20Corporation-2023-05-16"}],"summary":"Sysco reported unauthorized access to its systems and said personal information for some current and former colleagues may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-16","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"13f53d932a646bded86e161891c0c636435ebe43","impact_type":"data_theft","incident_date":"2023-01-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23085.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"460d3f474dd1","org_name":"HumanGood Washington","org_type":"unknown","ransomware":null,"records_affected":1411,"reviewed":false,"root_cause":"An attacker exploited a previously unknown software vulnerability in GoAnywhere to access accounts and take data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23085.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23085.pdf"}],"summary":"An attacker exploited a previously unknown vulnerability to access HumanGood data stored in GoAnywhere and take team member census information.","supporting_quote":"On February 4, 2023, GoAnywhere notified HumanGood that an unauthorized actor leveraged a previously unknown software vulnerability to gain access to certain GoAnywhere accounts between January 29 and 31, 2023, including HumanGood’s, and take data stored therein.","technology_involved":["GoAnywhere"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-16","discovered_date":"2023-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5c8e0b9d0d1b0607881f69331075db8a6452cf5","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Proof%20-FSMG-letter_1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"ae1868ae7146","org_name":"Fertility Specialists Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566749"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Proof%20-FSMG-letter_1_Redacted.pdf"}],"summary":"Fertility Specialists Medical Group reported that an unauthorized party accessed its network environment and may have acquired personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b201e851f6e97f575a1b36699332e16fe9460f3","impact_type":"unknown","incident_date":"2023-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/B.R.%20Funsten%20%26%20Company%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87d7359aa258","org_name":"B.R. Funsten & Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566782"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"134c8ba20d1f49de6e3e4fb5d12fe9b236a22179","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NPA%20Notification%20-%20Attachment%20A.pdf"},"notes":null,"org_country":"US","org_id":"46dfc0e28110","org_name":"National Powersport Auctions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566729"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NPA%20Notification%20-%20Attachment%20A.pdf"}],"summary":"National Powersport Auctions reported unauthorized access to some systems in late February 2023 and said affected files may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-13","discovered_date":"2022-07-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2a41c3c996cb3fe344c813fb6f5dd180f1a55dd","impact_type":"disruption_or_ransomware","incident_date":"2022-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/1.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"e2736a7bfe55","org_name":"Whitworth University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566692"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Whitworth%20University-2023-05-13"}],"summary":"Whitworth University detected and stopped a ransomware attack that disabled some systems, and its investigation found that personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-12","discovered_date":"2023-04-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4d55d7b8d1f9f63752f6b19d27f0ada4d22e5011","impact_type":"unknown","incident_date":"2022-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"33b53077e25e","org_name":"Uintah Basin Healthcare","org_type":"unknown","ransomware":null,"records_affected":103974,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Uintah%20Basin%20Healthcare-2023-05-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fce689f0aa0e31c45f0fc82da5680c63c491debb","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Retirement%20Clearinghouse%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"af95df0bfb34","org_name":"Retirement Clearinghouse","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Retirement%20Clearinghouse%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Retirement%20Clearinghouse-2023-05-12"}],"summary":"Retirement Clearinghouse reported that files containing names, IRA account numbers, and Social Security numbers were at risk of unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2023-05-12","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a6b12629c4e2edd41fc41c40d1c6adb8b40e384","impact_type":"data_theft","incident_date":"2023-04-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23069.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b6469f699be5","org_name":"Fibre Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23069.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA23069.pdf"}],"summary":"Card skimmers at Kelso ITMs compromised card data.","supporting_quote":"Card skimmers at Kelso ITMs compromised card data April 20-April 22.","technology_involved":["ITMs"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3782c9add5aa8dbcf8b17314f10e61934f80f728","impact_type":"unknown","incident_date":"2023-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Brown%20_%20Streza%20LLP%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5349765becf","org_name":"Brown & Streza LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566676"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f89c7414c4314e83846256f3c71cac3c5fffb3a0","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Val%20Verde%20Adult%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4b3a06fa65b7","org_name":"Val Verde Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566612"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Val%20Verde%20Adult%20Notice%20Letter.pdf"}],"summary":"Val Verde Unified School District reported that an unauthorized actor may have accessed limited information maintained on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05631e19db470f34551722d2016acb28390fb6fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Contra%20Costa%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"067c3a65c17d","org_name":"County of Contra Costa","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566621"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Contra%20Costa%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party accessed two County email accounts, and emails or attachments containing personal and medical information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc829e9b6098d606325b3b12c340e5a089a68b89","impact_type":"unknown","incident_date":"2023-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Incident%20Email_User_5.11.2023_Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a374ff2a6865","org_name":"Brightly Software, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566626"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brightly%20Software%2C%20Inc-2023-05-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-11","discovered_date":"2023-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6061b7e832c24b2f9b7f93a7e8c78b36c46d61ad","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ARC%20Document%20Solutions%2C%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b396ca9fcc74","org_name":"ARC Document Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566603"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ARC%20Document%20Solutions%2C%20LLC%20-%20Sample%20Notice.pdf"}],"summary":"ARC Document Solutions reported that an unauthorized actor accessed files within its systems between January 12 and January 18, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"755bf720f5d6c4746c2c67c2f1201c8eb994c413","impact_type":"data_theft","imported_from":null,"incident_date":"2023-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"dac4896e33ca","org_name":"RentoMojo","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RentoMojo","type":"hibp","url":"https://haveibeenpwned.com/Breach/RentoMojo"}],"summary":"RentoMojo reported a breach in April 2023 that exposed personal information and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d37fb4c47ff689bdf625a9ea0cdaa6fcd17f21b","impact_type":"data_theft","incident_date":"2023-05-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%285.5.2023%29.pdf"},"notes":null,"org_country":"US","org_id":"2bc2bc515ec4","org_name":"Orcutt Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566554"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%285.5.2023%29.pdf"}],"summary":"A student used a teacher’s username and password to access Orcutt Academy High School student information in Aeries, which may have been shared on Discord.","supporting_quote":"On May 4, 2023, we learned that a student obtained a teachers user name and password to the student information system, Aeries.","technology_involved":["Aeries"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-10","discovered_date":"2022-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aae64df061140034a6de6df16733118f0083f108","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kinetic%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2505d6467a2d","org_name":"Kinetic Investment Mangement, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566587"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kinetic%20-%20Sample%20Notice.pdf"}],"summary":"Kinetic Investment Mangement, Inc. reported that personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-08","discovered_date":"2022-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b181ed08f8d7e53f90db908417291b31c621a446","impact_type":"both","incident_date":"2022-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRGX%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f5b90506ce6c","org_name":"PRGX Global, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566469"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRGX%20Sample%20Notice.pdf"}],"summary":"PRGX Global, Inc. reported that an unknown actor accessed its systems and took or viewed files containing personal information, while some systems were inaccessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-05","discovered_date":"2023-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bce0eaaae3ade611c18297344e855913e286d82","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RoadSafe%20Traffic%20Systems%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0b8efdeb5dc4","org_name":"RoadSafe Traffic Systems, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566381"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RoadSafe%20Traffic%20Systems%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"RoadSafe Traffic Systems identified suspicious activity and unauthorized access to its network, with names, Social Security numbers, and financial account information potentially affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-05","discovered_date":"2023-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b4f998d57cfeead98001543a73564a56656a041","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NextGen%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7a873058e0b6","org_name":"NextGen Healthcare","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NextGen%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22991.pdf"}],"summary":"An unknown third party gained unauthorized access to personal information stored in NextGen Office.","supporting_quote":null,"technology_involved":["NextGen Office"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-05-05","discovered_date":"2023-02-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df288a804c2de59f6f0b4ebbb888fbdde031412c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AHS%20notice%20letter%20sample.pdf"},"notes":null,"org_country":"US","org_id":"20fca0f965c8","org_name":"Asian Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHS%20notice%20letter%20sample.pdf"}],"summary":"An unauthorized person accessed an Asian Health Services employee’s email account, which contained some individuals’ personal and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-04","discovered_date":"2023-03-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c0300910b5d854e3d1fee9b618c9cf9c4273584","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Copia_General%20Notice%20PROOF_FINAL.pdf"},"notes":null,"org_country":"US","org_id":"e3ce4418051a","org_name":"Copia Scientific LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566324"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Copia_General%20Notice%20PROOF_FINAL.pdf"}],"summary":"Copia Scientific reported that an unauthorized third party may have accessed limited business information during a network intrusion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-05-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b77d4ae76a357b86eb46e1939bdcd42c730df0e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CALIFORNIA%20-%20Veridian%20Data%20Security%20Breach%20Notice%20Letter%20-%20Non-Members%20IDX%20Upload%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"36d8376dccda","org_name":"Veridian Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566299"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CALIFORNIA%20-%20Veridian%20Data%20Security%20Breach%20Notice%20Letter%20-%20Non-Members%20IDX%20Upload%20%282%29.pdf"}],"summary":"An unauthorized party used information it already possessed to begin applications in Veridian Credit Union’s online membership application system and may have accessed credit-report information.","supporting_quote":null,"technology_involved":["online membership application system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-03","discovered_date":"2022-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bcc5b56af34512b3cfe1f2f6a1340090667c600","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Metropolitan%20Opera%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"19c27ef518ba","org_name":"The Metropolitan Opera","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566283"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567098"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Metropolitan%20Opera%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Metropolitan%20Opera-2023-05-03"}],"summary":"The Metropolitan Opera reported that an unknown actor accessed its systems and potentially impacted files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bbe7ccdd3de51a0e44f233d5e6dfcd6c8c70ee0","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Delano%20Union%20School%20District%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f8075cf7ada3","org_name":"Delano Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566308"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Delano%20Union%20School%20District%20Sample%20Notice.pdf"}],"summary":"Delano Union School District detected unusual activity on November 7, 2021, and found that files containing names and Social Security numbers may have been accessed or acquired by an unknown actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"704a1ac7083dff052cf9e5c26278e26eae4e23ca","impact_type":"unknown","incident_date":"2023-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SCFHP%20Nations%20security%20breach%20letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c66807cf7097","org_name":"Santa Clara Family Health Plan","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566223"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-05-02","discovered_date":"2023-03-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a10d4347523ba984816692bf7d21ab6b462a6fe7","impact_type":"data_theft","incident_date":"2023-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Carvin%20Software%2C%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5544f76f573f","org_name":"Carvin Software, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566252"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carvin%20Software%2C%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carvin%20Software%2C%20LLC-2023-05-02"}],"summary":"Carvin Software identified unusual activity and determined that files containing personal information were copied without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-04-29","discovered_date":"2023-02-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e27057dcf708fa1dd2707588692f387ee30fbde","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/F%20Example%20IOC%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"49b8f8a57128","org_name":"Welding Supplies from IOC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/F%20Example%20IOC%20Breach%20Notification%20Letter.pdf"}],"summary":"Malicious code was found in IOC's eCommerce platform, potentially exposing customers' payment and personal information.","supporting_quote":null,"technology_involved":["eCommerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a462e664d5b0dc7ecc10f289b8ead7035e606fb0","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22936.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6b8b109ee6a","org_name":"Cadence Innovations Group","org_type":"unknown","ransomware":null,"records_affected":541,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22936.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-04-28","discovered_date":"2023-02-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b910e88574438cb124f5c4fc66032c0f1b0146a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22934.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2c434e129e94","org_name":"Pierce Transit","org_type":"transportation_logistics","ransomware":null,"records_affected":4813,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22934.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22934.pdf"}],"summary":"Pierce Transit discovered unusual activity and later determined that an unauthorized actor had accessed files and data stored within its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2102e0fe1eeb51a969b0e8f8a679560b74b2ac0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_Letter_Current_Employees__Petaluma_Health_.pdf-blank%20proof.pdf"},"notes":null,"org_country":"US","org_id":"533ea7844239","org_name":"Petaluma Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566080"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567493"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_Letter_Current_Employees__Petaluma_Health_.pdf-blank%20proof.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Petaluma%20Health%20Center-2023-06-02"}],"summary":"Petaluma Health Center reported unauthorized access to its network environment and said personal information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87af774d88440b55f4112f75a6b048f11263f941","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HPS_Final_Member_letter_proof_Redacted_31968262v1_0.pdf"},"notes":null,"org_country":"US","org_id":"0d6febf0c713","org_name":"HealthPlan Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566124"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HPS_Final_Member_letter_proof_Redacted_31968262v1_0.pdf"}],"summary":"HealthPlan Services, Inc. detected malware affecting elements of its network, and an unauthorized party accessed and/or acquired certain files or folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-27","discovered_date":"2023-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a77e6d1825a4bab23cc3db0c6d2e79ab06d05ec5","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2022-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Moody%20National%20Companies%2C%20LP%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2cf72c9a4cad","org_name":"Moody National Companies, LP","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566050"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Moody%20National%20Companies%2C%20LP%20-%20Sample%20Notice.pdf"}],"summary":"Moody National Companies discovered ransomware activity after certain systems were accessed by an unknown actor, and notified individuals about potential exposure of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-27","discovered_date":"2023-02-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e6ebbdcb9bcdea9992b90e3aa2cfb2e6c946450","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REDACTED%20Client%20Notification%20Letter%2004272023.pdf"},"notes":null,"org_country":"US","org_id":"fd91b4e72aef","org_name":"MassMutual","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566036"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REDACTED%20Client%20Notification%20Letter%2004272023.pdf"}],"summary":"MassMutual reported unauthorized access to an independent agency employee’s online account, after which emails and files containing personal information may have been affected.","supporting_quote":null,"technology_involved":["Microsoft Outlook"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"674ecc75e7f5d058d9d3180e2c5ad7e2ac854991","impact_type":"data_theft","imported_from":null,"incident_date":"2023-02-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5ad2694cd944","org_name":"CityJerks","org_type":"other","ransomware":null,"records_affected":177554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CityJerks","type":"hibp","url":"https://haveibeenpwned.com/Breach/CityJerks"}],"summary":"A breach exposed CityJerks and TruckerSucker user data, including email addresses, profile information, private messages, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-27","discovered_date":"2021-11-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d675ab71e4ccba122127ce7557036e5d2a0c5315","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arroyo%20Insurance%20Services%2C%20Inc.pdf"},"notes":null,"org_country":"US","org_id":"03dce2d25a7b","org_name":"Arroyo Insurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566064"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arroyo%20Insurance%20Services%2C%20Inc.pdf"}],"summary":"Arroyo Insurance Services reported that an unauthorized party accessed sensitive personal information after a business email compromise event.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dceacb2729a22a6db288392d6b9eef653e281413","impact_type":"unknown","incident_date":"2023-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/breach%20notification%20sample_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California, San Francisco","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566010"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/breach%20notification%20sample_Redacted.pdf"}],"summary":"The University of California, San Francisco notified affected people of an incident involving personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ca29f0d75b6242a436a7355c32929474b34aaa7","impact_type":"unknown","incident_date":"2023-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d9d4e2c7037","org_name":"MedsNow","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566020"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"071b193cd9b7d1967ccba9b11464c2a95689844d","impact_type":"data_theft","incident_date":"2022-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kal%20Krishnan%20Consulting%20Services%2C%20Inc.%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"0bbe131ce91c","org_name":"Kal Krishnan Consulting Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566012"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kal%20Krishnan%20Consulting%20Services%2C%20Inc.%20-%20Exhibit%20A.pdf"}],"summary":"Kal Krishnan Consulting Services reported unauthorized copying of files and access to email accounts containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd4fdd8ddff0153dfa38e37f339f004c5f6e1797","impact_type":"both","incident_date":"2023-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Version%202%20-%20Alvaria%20Individual%20Notification%20-%20On%20Behalf%20of%20Customers.pdf"},"notes":null,"org_country":"US","org_id":"1fadcaf05739","org_name":"Carrington Mortgage Services, LLC","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Version%202%20-%20Alvaria%20Individual%20Notification%20-%20On%20Behalf%20of%20Customers.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22905.pdf"}],"summary":"Carrington Mortgage Services data held in Alvaria’s customer environment was affected by a ransomware attack, and some associated data may have included personal information.","supporting_quote":null,"technology_involved":["Alvaria","workforce management system","outbound dialer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Alvaria"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"50c3801b9892","name":"Alvaria"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-26","discovered_date":"2023-03-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b46e7f1cab4ec11669bcc9bda17daececb9dc82","impact_type":"unknown","incident_date":"2023-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2216155d4e97","org_name":"Bennington & Moshofsky, PC","org_type":"unknown","ransomware":null,"records_affected":484,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bennington%20%26%20Moshofsky%2C%20PC-2023-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-04-25","discovered_date":"2023-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c372b08c3ebb554c43229417b78881c33e544de8","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LaborLawCenter%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a3d59261fdf2","org_name":"LaborLawCenter, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LaborLawCenter%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"LaborLawCenter reported unauthorized code on its website payment platform that could have captured customer payment card information.","supporting_quote":null,"technology_involved":["website payment platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f745e912c9e0541ec6eb75ecab4f63561aa15f98","impact_type":"data_theft","incident_date":"2020-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"NZ","org_id":"aa32bbd59e49","org_name":"MEO","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MEO","type":"hibp","url":"https://haveibeenpwned.com/Breach/MEO"}],"summary":"A corpus containing 8,227 MEO customer records, including personal information and password hashes, was discovered in early 2023.","supporting_quote":null,"technology_involved":["WordPress"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30b0f8b386acacb86dcb03d7ce8d72b4d74c0da7","impact_type":"data_theft","imported_from":null,"incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ab6b43c8c894","org_name":"Terravision","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Terravision","type":"hibp","url":"https://haveibeenpwned.com/Breach/Terravision"}],"summary":"A February 2023 breach of Terravision exposed customer personal information and salted password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ecea01790671da5b4636d55e509457ff2685ab57","impact_type":"data_theft","incident_date":"2023-03-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21861.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a127d010a2e8","org_name":"Sno-Isle Regional Library System","org_type":"government","ransomware":null,"records_affected":531,"reviewed":false,"root_cause":"An employee was deceived by a phishing-type request into providing a file containing employee information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21861.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21861.pdf"}],"summary":"Sno-Isle Regional Library System reported that an employee was deceived into providing a file containing employee information, including names, Social Security numbers, and wage information.","supporting_quote":"This access was through a phishing-type attack in which an outside party posing as an Sno Isle employee convinced an employee to provide a file containing information about certain individuals who worked for Sno-Isle during 2022.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-21","discovered_date":"2023-03-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d94f1e242201542670c4171f480d984d96b4c5b3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"faa1dcff6122","org_name":"Mt. Hood Meadows Oreg., LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mt.%20Hood%20Meadows%20Oreg.%2C%20LLC-2023-04-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1485","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-21","discovered_date":"2023-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a25600d6fa9da3d4d501d94f038f68eadb39221","impact_type":"both","incident_date":"2023-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CIC%20-%20Form%20Data%20Breach%20Notice%20Letter%20%28General%29.pdf"},"notes":null,"org_country":"US","org_id":"d54d0e81a594","org_name":"CIC Group, Inc.","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CIC%20-%20Form%20Data%20Breach%20Notice%20Letter%20%28General%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CIC%20Group%2C%20Inc.-2023-04-23"}],"summary":"CIC Group reported that a ransomware attack encrypted or destroyed data and that personal information may have been taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-20","discovered_date":"2023-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3aabc65e72c6eae740bfc1d424b04fab0b3f72c2","impact_type":"data_theft","imported_from":null,"incident_date":"2023-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20ABA%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"5a94a0632e65","org_name":"American Bar Association","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20ABA%20Consumer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Bar%20Association-2023-04-21"}],"summary":"The American Bar Association reported that an unauthorized third party accessed its network and acquired usernames and hashed, salted passwords for certain online accounts.","supporting_quote":null,"technology_involved":["ABA website","ABA Career Center"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-20","discovered_date":"2022-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859d6b2a7d9c1d44cd045b05152000508c6ba7e4","impact_type":"data_theft","imported_from":null,"incident_date":"2022-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-04-21%20-%20Albertsons%20-%20Individual%20Notification%20Letter%20Template.pdf"},"notes":"attack_techniques without supporting words dropped: T1041, T1213","org_country":"US","org_id":"e409e7fe7472","org_name":"Albertsons Companies","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565794"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-04-21%20-%20Albertsons%20-%20Individual%20Notification%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21832.pdf"}],"summary":"Albertsons determined that an unauthorized party accessed and removed copies of data from certain file servers, and personal information may have been accessed.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-04-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27cad147b1cae53d2bbef32ae83d48c7a7a31a3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Insight_NoticeAdult_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"1c4e94f90615","org_name":"Wanda L. Delgado DBA Insight Financial Advisors","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565706"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Insight_NoticeAdult_Redacted.pdf"}],"summary":"Insight Financial Advisors found unauthorized access to a corporate email account but could not determine whether emails or documents were viewed or taken.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83d47c8d76ecee35524214f7907c95b8adcf0e4d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN%20Template%2012%20month%2872112803.1%29.pdf"},"notes":null,"org_country":"US","org_id":"0829af964d5d","org_name":"Huntington Ingalls Industries","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN%20Template%2012%20month%2872112803.1%29.pdf"}],"summary":"An unauthorized party may have accessed files containing personal information on certain Huntington Ingalls Industries file storage systems.","supporting_quote":null,"technology_involved":["file storage systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-18","discovered_date":"2022-12-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c4da9532a0b0e3b121f434e2f8e4b551b47a760f","impact_type":"unknown","incident_date":"2022-11-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b75143e7e19","org_name":"Advanced Health Media (“AHM”), an IQVIA company and notice","org_type":"unknown","ransomware":null,"records_affected":35145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advanced%20Health%20Media%20%28%E2%80%9CAHM%E2%80%9D%29%2C%20an%20IQVIA%20company%20and%20notice%20on%20behalf%20of%20clients%20of%20AHM.-2023-04-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce06a0309b5a712a8cd643f85876107d202130ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21785.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62d286ba05ba","org_name":"Advanced Health Media","org_type":"unknown","ransomware":null,"records_affected":587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21785.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2023-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"017a43c78f3ff63877eb7e3de5f7c7974c45c26f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21715.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5ebf4c78ff5","org_name":"Shoreline Community College","org_type":"unknown","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21715.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4219441daa693bcce36a88d0efdc88a7e3c35aa4","impact_type":"data_theft","imported_from":null,"incident_date":"2022-07-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"dcafbbf5b995","org_name":"OGUsers","org_type":"other","ransomware":null,"records_affected":529020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OGUsers (2022 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/OGUsers2022"}],"summary":"OGUsers suffered a data breach in July 2022 that exposed usernames, email and IP addresses, and passwords stored as Argon2 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-14","discovered_date":"2023-02-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"662bc9fba7c810f9b782ac27c815139a27b3a45a","impact_type":"data_theft","incident_date":"2023-01-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NationsBenefits%20LLC%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"d3d8eda92ed1","org_name":"NationsBenefits Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565565"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NationsBenefits%20LLC%20Notice%20Template.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/NationsBenefitsHoldingsLLC.pdf"}],"summary":"A data security incident at Fortra affected personal information associated with NationsBenefits.","supporting_quote":"On or around January 30, 2023, Fortra experienced a data security incident in which a malicious actor(s) accessed or acquired the data of multiple organizations, including NationsBenefits.","technology_involved":["Fortra file-exchange software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-14","discovered_date":"2023-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4e000c20ce5f82e68c3342f3945da1f5f47a5b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Email%20Notice%20%28Adults%29%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"41c29dd569fb","org_name":"MiniMed Distribution Corp","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Email%20Notice%20%28Adults%29%20FINAL.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MiniMed%20Distribution%20Corp-2023-04-14"}],"summary":"Information about users of the InPen App was transmitted to Google through Google services.","supporting_quote":null,"technology_involved":["InPen App","Google Analytics for Firebase","Crashlytics for Firebase","Firebase Authentication"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Google"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0e9f335c7c68","name":"Google"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-14","discovered_date":"2023-02-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8f5a7491021582aa8412987c469fafc12def0cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General.pdf"},"notes":null,"org_country":"US","org_id":"8350074e219c","org_name":"EarthLite, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565549"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General.pdf"}],"summary":"EarthLite reported that an unauthorized third party may have accessed a limited amount of business information during a network intrusion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10ee4d80d9d96ba4847b75f6dc513ac3b2268560","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yum%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c633e409fd15","org_name":"Yum! Brands","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565517"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yum%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20594.pdf"}],"summary":"Yum! Brands reported unauthorized access to some systems, and its review found that affected files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39c4a011d8006cf42b2bf8cfe4ddfec5b4b7f31a","impact_type":"data_theft","imported_from":null,"incident_date":"2023-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"db0fb641ab61","org_name":"The Kodi Foundation","org_type":"technology_saas","ransomware":null,"records_affected":400635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Kodi Foundation","type":"hibp","url":"https://haveibeenpwned.com/Breach/KodiFoundation"}],"summary":"The Kodi Foundation reported that a database backup containing user records was downloaded and exposed in a February 2023 data breach.","supporting_quote":null,"technology_involved":["MyBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"41b4fcc5773a3f05c1b3b4dd9980dc6c8d9c5c0a","impact_type":"unknown","incident_date":"2023-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14954.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e42644898398","org_name":"Nations Benefit Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":39020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14954.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14954.pdf"}],"summary":"Nations Benefit Holdings, LLC filed a breach notification concerning an incident dated January 30, 2023.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-04-13","discovered_date":"2023-03-22","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffb24673ed4307577083ce49461d83e91530e93d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JMH%20Sample%20of%20Notice%20-%20Security%20Breach%20Notification%2020230412_1.pdf"},"notes":null,"org_country":"US","org_id":"d88b7b1990fc","org_name":"John Muir Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A staff-created website linked to an external Excel file containing identifiable patient information that could have been accessible to people outside the organization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565519"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JMH%20Sample%20of%20Notice%20-%20Security%20Breach%20Notification%2020230412_1.pdf"}],"summary":"John Muir Health reported that a staff-created website linked to an external Excel file containing patient information that may have been accessible outside the organization.","supporting_quote":"The staff member did not realize that the information could have been accessible to individuals outside of JMH.","technology_involved":["website","Excel file"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-04-13","discovered_date":"2023-02-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2456b339efbd6a7111ec317493cc8264ea93707","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IOC%20Breach%20Notification%20Letter%20-%20final%20example.pdf"},"notes":null,"org_country":"US","org_id":"7a6c9bec8e66","org_name":"Indiana Oxygen Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IOC%20Breach%20Notification%20Letter%20-%20final%20example.pdf"}],"summary":"Malicious code was found in Indiana Oxygen Company's eCommerce platform, potentially exposing customers' payment and personal information.","supporting_quote":null,"technology_involved":["eCommerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0bebd02e49790e4b1d3bb22af4818981438bd6d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GISCC%20General%20Notice%20Letter_Draft%2003272023_v02_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"d6ac3dee3d5c","org_name":"Goodwill Industries of South Central California","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565477"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GISCC%20General%20Notice%20Letter_Draft%2003272023_v02_PROOF.pdf"}],"summary":"Goodwill Industries of South Central California reported unauthorized access to an employee email account and said personal information may have been accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d88bd9daad7346ced341a85bcb02ef52269b5c6","impact_type":"unknown","incident_date":"2023-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TuneIn%20Notification%20Section%201%20and%20Section%202.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6419ff02078","org_name":"TuneIn, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565474"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-12","discovered_date":"2023-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9dd24c6e4f68dbc607a5b314ac2f70b100818c1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pennsylvania%20College%20of%20Technology%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a826241293f4","org_name":"Pennsylvania College of Technology","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pennsylvania%20College%20of%20Technology%20-%20Sample%20Notice.pdf"}],"summary":"Pennsylvania College of Technology discovered that alumni Social Security numbers had been inadvertently printed on magazine mailing labels.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2023-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89548325741f2f999621c80d9fa9c82058e208b1","impact_type":"unknown","imported_from":null,"incident_date":"2023-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Milpitas%20ATM%20Skimming%20Incident%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"949731d667cf","org_name":"Patelco Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567784"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Milpitas%20ATM%20Skimming%20Incident%20Sample%20Notice.pdf"}],"summary":"Patelco Credit Union reported a compromise at its Milpitas ATM involving a member’s card.","supporting_quote":null,"technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-12","discovered_date":"2023-03-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25d8490d4409689312f04170fca1884bb6782a7a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9b1ba4f6dcf","org_name":"Kannact, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kannact%2C%20Inc-2023-04-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-12","discovered_date":"2023-02-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c2e95f84813c9b7a6aec3e72a43532de13ef4f9","impact_type":"data_theft","incident_date":"2023-01-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Brightline%2C%20Inc.%20-%20SSI%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"9d5a54ead5b5","org_name":"Brightline, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Fortra's GoAnywhere MFT SaaS was used to access customer accounts and download files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565472"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565859"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566585"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566637"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566866"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Brightline%2C%20Inc.%20-%20SSI%20-%20Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21630.pdf"}],"summary":"An unauthorized party exploited a vulnerability in Fortra's GoAnywhere MFT SaaS and acquired files containing Brightline customers' personal information.","supporting_quote":"Through its investigation, Fortra states that it identified a previously-unknown vulnerability which an unauthorized party used to access certain GoAnywhere customers’ accounts and download files.","technology_involved":["Fortra","GoAnywhere MFT SaaS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-11","discovered_date":"2022-12-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3713a815877ef0adf9c183b38c135f50d36b140a","impact_type":"unknown","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe7ade110b58","org_name":"Regal Medical Group, Inc. (“RMG”)","org_type":"unknown","ransomware":null,"records_affected":3685626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Regal%20Medical%20Group%2C%20Inc.%20%28%E2%80%9CRMG%E2%80%9D%29-2023-04-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-07","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c47318999a46d448aac42f014b6de2de60975436","impact_type":"unknown","imported_from":null,"incident_date":"2022-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HawaiiUSA%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f2ee087ae480","org_name":"HawaiiUSA Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565250"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HawaiiUSA%20-%20California%20Notification.pdf"}],"summary":"HawaiiUSA Federal Credit Union reported unauthorized access to an employee’s email account on December 12, 2022.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-04-07","discovered_date":"2022-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f9dbed2c47c3cc3782c092d17db48a8e21ec9c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/90%20Degree%20Benefit-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"de285f4bf1c3","org_name":"90 Degree Benefits Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565259"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/90%20Degree%20Benefit-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#90%20Degree%20Benefits%2C%20Inc.%20-%20Wisconsin-2023-04-07"}],"summary":"90 Degree Benefits-Wisconsin reported unauthorized access to certain systems and files containing individuals’ information between December 5 and December 11, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"776ee630b881134a5836dbc2dd08cb8a503cf269","impact_type":"data_theft","imported_from":null,"incident_date":"2022-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cadwalader%20Wickersham%20Taft%20-%20Notice%20to%20Consumers.pdf"},"notes":null,"org_country":"US","org_id":"6a66039b6cd4","org_name":"Cadwalader, Wickersham, & Taft LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570468"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565199"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cadwalader%20Wickersham%20Taft%20-%20Notice%20to%20Consumers.pdf"}],"summary":"An unauthorized third party remotely accessed Cadwalader, Wickersham, & Taft LLP’s systems and acquired information including documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"959b954827c8c299ca0713a6d0120bd400c978a5","impact_type":"data_theft","imported_from":null,"incident_date":"2022-01-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-17087%20University%20of%20the%20People%20Ad%20CM%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"653f65ea499c","org_name":"University of the People","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-17087%20University%20of%20the%20People%20Ad%20CM%20r2prf.pdf"}],"summary":"University of the People reported that unauthorized third parties may have accessed or exfiltrated files from its SharePoint platform that may have contained personal information.","supporting_quote":null,"technology_involved":["SharePoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c78a6b07d85bb92ae2fe5c253c677004d27b81d","impact_type":"unknown","incident_date":"2022-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DB07297-PrescottCollege-letter_second_SSN_Example%2831608921.1%29_Redacted_31608992v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2f9d0ebbee77","org_name":"Prescott College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565136"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15221.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a341fcc51f4697359da57cb9361fbd0983ecc65","impact_type":"data_theft","incident_date":"2023-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/iD%20Tech%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"01d587360178","org_name":"internalDrive, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565157"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/iD%20Tech%20-%20Sample%20Notice.pdf"}],"summary":"An unknown actor accessed a limited portion of internalDrive, Inc.'s data network and downloaded a file containing information related to some iD Tech accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","other"],"disclosed_date":"2023-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff13d2539a5ea07dc6aabcd74f0371a1f91c4c17","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2ba9d56e7b3b","org_name":"Genesis Market","org_type":"other","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Genesis Market","type":"hibp","url":"https://haveibeenpwned.com/Breach/GenesisMarket"}],"summary":"Genesis Market was shut down in April 2023 after its service traded in browser fingerprints and other personal data used to impersonate victims and access online accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-04","discovered_date":"2022-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af7b72b6bb41777e8042434d02f5cc910dec98c5","impact_type":"data_theft","incident_date":"2022-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cal-Ore%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"46cc0b503f31","org_name":"California-Oregon Telecommunications Company","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cal-Ore%20Sample%20Notice.pdf"}],"summary":"Cal-Ore reported that files may have been accessed or removed without authorization, and that names may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"550ae4249c2f52d895797294c2ec986377d152fc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/BankofAmerica.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"146437a4a012","org_name":"Bank of America, N.A.","org_type":"unknown","ransomware":null,"records_affected":9357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/BankofAmerica.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91f7a497f8ae9b39d9f8d75b476e029f2c951e0e","impact_type":"unknown","incident_date":"2022-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter_B_-_REDACTED_31597326v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9da2c7c46342","org_name":"PGT INNOVATIONS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565056"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-04-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f94318200518f8b179f9b9340888e2ca080f643","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aspire%20-%20Template%20A.pdf"},"notes":null,"org_country":"US","org_id":"b9290f8140bd","org_name":"Aspire Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aspire%20-%20Template%20A.pdf"}],"summary":"An unauthorized party accessed one Aspire email account at various times between February and August 2022; the account contained personal information, but the investigation found no evidence that it was viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f33c8c1e4ff984c289c2302030c40b14a818ab08","impact_type":"data_theft","imported_from":null,"incident_date":"2022-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"395d572e8d12","org_name":"Sundry Files","org_type":"technology_saas","ransomware":null,"records_affected":274461,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sundry Files","type":"hibp","url":"https://haveibeenpwned.com/Breach/SundryFiles"}],"summary":"Sundry Files suffered a data breach that exposed email addresses, usernames, IP addresses, and salted SHA-256 password hashes.","supporting_quote":null,"technology_involved":["file upload service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"375fa89b16ec0fe5a20a658f60045bc13aa46507","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20506.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b26c3913a15f","org_name":"Southwest Healthcare Services","org_type":"unknown","ransomware":null,"records_affected":1225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20506.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce748d3e32016aedab58806430708b25fc7c9a5d","impact_type":"both","incident_date":"2022-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"76ed0be4241e","org_name":"Peter Brasseler Holdings, LLC","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564958"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter.pdf"}],"summary":"Peter Brasseler Holdings, LLC reported a ransomware cyberattack and discovered that files containing personal, financial, and medical information may have been obtained without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1acff26f97e691717fa5774471a275e5e675a28","impact_type":"unknown","incident_date":"2022-11-07","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J2409_ONEAL_INDUSTRIES_%233_L01_SAS_3.pdf"},"notes":null,"org_country":"US","org_id":"095d72ddb077","org_name":"O'Neal Industries, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J2409_ONEAL_INDUSTRIES_%233_L01_SAS_3.pdf"}],"summary":"O'Neal Industries reported that malware was used to access its computer systems in November 2022.","supporting_quote":"Through our investigation, we have learned that computer systems within our network were accessed in November 2022 using a highly sophisticated type of malware that evaded virus detection by our security tools.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bae52b2e32c8922a54e36165c9b5d3a3d7fe7d0","impact_type":"unknown","incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Monument%20-%20Sample%20Notification%20Letter%204888-3653-0266%20v.2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0012fa9ffcea","org_name":"Monument, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564977"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Monument%2C%20Inc.-2023-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cd99500b672a022ba28398e03a094fa5a256137","impact_type":"data_theft","imported_from":null,"incident_date":"2022-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"057ca374f836","org_name":"Leaked Reality","org_type":"other","ransomware":null,"records_affected":114907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Leaked Reality","type":"hibp","url":"https://haveibeenpwned.com/Breach/LeakedReality"}],"summary":"A January 2022 breach of Leaked Reality exposed email addresses, usernames, IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-31","discovered_date":"2023-02-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"431bccda8494eb169597ae9ea625f950dfcf860b","impact_type":"unknown","incident_date":"2022-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a67edcf927b","org_name":"Doty Pruett Wilson PC","org_type":"unknown","ransomware":null,"records_affected":2241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Doty%20Pruett%20Wilson%20PC-2023-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-31","discovered_date":"2023-02-05","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8496cc28682219a2de179e211e5682ca57d8865","impact_type":"data_theft","incident_date":"2023-01-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J2010_BLUE_SHIELD_OF_CALIFORNIA_Fortra_Brightline_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564978"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J2010_BLUE_SHIELD_OF_CALIFORNIA_Fortra_Brightline_L01_SAS_0.pdf"}],"summary":"An unauthorized individual accessed Fortra’s MFTaaS application and downloaded files Brightline maintained there, potentially exposing Blue Shield members’ personal information.","supporting_quote":"The forensic investigation being conducted by Fortra revealed that an unauthorized individual gained access to Fortra’s GoAnywhere Managed File Transfer -as-a-service (MFTaaS) application and was able to download files that Brightline maintained on that system.","technology_involved":["GoAnywhere Managed File Transfer -as-a-service (MFTaaS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra, LLC"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-30","discovered_date":"2023-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"069e55ca3479252ac746432d3c1d5add20fcbfbe","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-08-23%20-%20TMX%20Finance%20-%20Sample%20Copy%20of%20Individual%20Notice%20%28L01%29.pdf"},"notes":null,"org_country":"US","org_id":"4d6e6d30a0f3","org_name":"TMX Finance Corporate Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572306"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-08-23%20-%20TMX%20Finance%20-%20Sample%20Copy%20of%20Individual%20Notice%20%28L01%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TMX%20Finance%20Corporate%20Services%2C%20Inc.%2C%20on%20behalf%20of%20itself%2C%20its%20parent%20TMX%20Finance%20LLC%20%26%20affiliates-2023-03-30"}],"summary":"TMX Finance detected suspicious activity in February 2023 and determined that personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-30","discovered_date":"2023-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1361ea7bc18c139050077c7bd95cbe8b9540573c","impact_type":"data_theft","incident_date":"2022-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20493.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e64017ca47f4","org_name":"TMX Finance","org_type":"financial","ransomware":null,"records_affected":571,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20493.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20493.pdf"}],"summary":"TMX Finance reported that an investigation found personal information may have been acquired during an incident affecting its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0c1a20ea7f86fdf906d09b7c2e8d973c1473df9c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/TMX.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e64017ca47f4","org_name":"TMX Finance LLC","org_type":"unknown","ransomware":null,"records_affected":382586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/TMX.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-30","discovered_date":"2023-03-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a57dc0adb6762428604b786f556a4caf29fde67c","impact_type":"unknown","incident_date":"2022-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/SvanacoInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f4d0a28aabe7","org_name":"Svanaco, Inc.","org_type":"unknown","ransomware":null,"records_affected":105008,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Svanaco%2C%20Inc.%20dba%20Americaneagle.com-2023-03-30"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/SvanacoInc.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20486.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Svanaco%2C%20Inc.%20dba%20Americaneagle.com-2023-04-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-30","discovered_date":"2023-02-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2eb48a2c810538fd75ff8134d03e8cfef7f7a7dd","impact_type":"data_theft","incident_date":"2023-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AudienceView%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c1046351d7cc","org_name":"AudienceView Ticketing Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564936"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AudienceView%20-%20Sample%20Notice.pdf"}],"summary":"AudienceView reported that malware affected its Campus product and that individuals' personal and payment card information may have been subject to unauthorized access and acquisition.","supporting_quote":null,"technology_involved":["Campus product"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-30","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3051e912f0d4116e14a3ac69576a36389f0292d4","impact_type":"data_theft","incident_date":"2023-02-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ara%20Haddadian%20CPA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"00a15bfbb2d6","org_name":"Ara Haddadian CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564920"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ara%20Haddadian%20CPA%20-%20Sample%20Notice.pdf"}],"summary":"Portable hard drives containing backups of Ara Haddadian CPA’s computer system were stolen from a vehicle.","supporting_quote":"On February 15, 2023, portable hard drives containing data backups of my firm’s computer system were stolen from my personal vehicle.","technology_involved":["portable hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-29","discovered_date":"2023-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c8a78631c0f6b6f421796ebd079083c11c4339ce","impact_type":"unknown","incident_date":"2023-03-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"edfd5168a2cb","org_name":"Swanson Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":2415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Swanson%20Group%2C%20Inc.-2023-03-29"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Swanson%20Group%2C%20Inc.-2023-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b8e7e3198044787d559fd9b0882df15c577adc","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Americaneagle%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"cf6bdf0dd3c0","org_name":"Americaneagle.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564886"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Americaneagle%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor used compromised employee credentials to access the Nueske’s online store and install code designed to capture payment card information.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b13626518fc16d03fb9f2e266a3d5158a79c12fc","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tenney%20%26%20Company%20CPA%27s%20-%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"c064754a1836","org_name":"Tenney and Company CPA’s","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567065"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564774"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tenney%20%26%20Company%20CPA%27s%20-%20Sample%20Notice_0.pdf"}],"summary":"Tenney and Company CPA’s reported that an unknown actor accessed certain systems between April 13 and May 19, 2022, potentially exposing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"077f9ccdfcb85004e11457989cb1c4683a1c76b9","impact_type":"both","incident_date":"2022-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letter%20-%20OCU%20-%20IDX%20Upload___Static_Proof_R3.pdf"},"notes":null,"org_country":"US","org_id":"b8d745229694","org_name":"Oklahoma City University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letter%20-%20OCU%20-%20IDX%20Upload___Static_Proof_R3.pdf"}],"summary":"Oklahoma City University detected and stopped an incident in which an unauthorized party encrypted some data and obtained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caf0067822314b762e7ab20cfefddf8aae2c36b6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c9337dc63754","org_name":"TheGradCafe","org_type":"other","ransomware":null,"records_affected":310975,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TheGradCafe","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheGradCafe"}],"summary":"A February 2023 breach at TheGradCafe disclosed personal records and bcrypt-hashed passwords belonging to 310,975 users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-24","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd97c7fda47ddf0cd806d279d8aead4bfc521106","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCB%20Notification%20Letters%20-Forms%20A%2C%20B%2C%20D.pdf"},"notes":null,"org_country":"US","org_id":"b0c18924c6c4","org_name":"NCB Management Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567101"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCB%20Notification%20Letters%20-Forms%20A%2C%20B%2C%20D.pdf"}],"summary":"NCB discovered unauthorized access to its systems on February 4, 2023, and later confirmed that some personal information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-24","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c27ec8d3d5463ca48462767aa9276a3a882c528","impact_type":"unknown","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c296baf02b1c","org_name":"NCB Management Service, Inc.","org_type":"unknown","ransomware":null,"records_affected":494969,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NCB%20Management%20Service%2C%20Inc.-2023-03-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bc42fbdf7f1d4106ac592d483deb277d71cc53bf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/Goodwill.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3204d0e26301","org_name":"Goodwill Industries of the Southern Piedmont, Inc.","org_type":"unknown","ransomware":null,"records_affected":4687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/Goodwill.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-24","discovered_date":"2023-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a8aa8648a8b21c04b276df3238b7c9fb347158f","impact_type":"unknown","incident_date":"2022-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3da64f797dbe","org_name":"Frideres Dental LLC","org_type":"unknown","ransomware":null,"records_affected":1596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Frideres%20Dental%20LLC-2023-03-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-24","discovered_date":"2023-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d34f00d10b76a372d9a3463bb3e71675169612c","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20418.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America","org_type":"financial","ransomware":null,"records_affected":12510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20418.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20418.pdf"}],"summary":"NCB reported that an unauthorized party accessed its systems and potentially obtained client information related to Bank of America credit card accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"NCB"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"0d104601ff3d","name":"NCB"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-23","discovered_date":"2022-12-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"200540e29e33242f9c760c53f3dfcff43aeb383b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Guidecraft%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d353a82f1a66","org_name":"Guidecraft, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Guidecraft%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Guidecraft reported unauthorized code on its e-commerce website that may have exposed customer checkout information, along with possible exposure of some credit card purchases due to a vendor error.","supporting_quote":"Additionally, due to a vendor error, credit card purchases from February 7 to February 8, 2023 were also potentially exposed.","technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-23","discovered_date":"2023-03-10","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ec8e2102eeaa3b3235707449690366942e1a4eb","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DTSC_Breach_Notification-Signed.pdf"},"notes":null,"org_country":"US","org_id":"7853221aac12","org_name":"Department of Toxic Substances Control","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564680"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DTSC_Breach_Notification-Signed.pdf"}],"summary":"An attacker briefly accessed a DTSC email account and may have seen messages and attachments containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e60a9191b03d751b602b5acdebd638e71b5af7d1","impact_type":"both","incident_date":"2022-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/1FFC%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c5c759c4a64d","org_name":"1st Franklin Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564676"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/1FFC%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/1stFranklinFinancialCorporation.pdf"}],"summary":"1st Franklin Financial Corporation reported an IT security incident that disrupted its network and may have involved access to or exfiltration of personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-22","discovered_date":"2023-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd11894b362c49a2fd84b07b39e0ee0130240bf1","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Wellness%20-%20Adult%20Notification%20Letter%20%28General%29.pdf"},"notes":null,"org_country":"US","org_id":"c18adb6c8b2c","org_name":"US Wellness Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Wellness%20-%20Adult%20Notification%20Letter%20%28General%29.pdf"}],"summary":"US Wellness Inc. reported that a vendor incident disrupted access to some systems and may have affected individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-22","discovered_date":"2023-02-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4cf74d0456c06d4a1c71deda25338f832af1dcf2","impact_type":"unknown","incident_date":"2023-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26f5454257f5","org_name":"SEIU Local 503","org_type":"unknown","ransomware":null,"records_affected":390,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SEIU%20Local%20503-2023-03-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-21","discovered_date":"2023-01-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b809f9c88aa1553a593006f1f5f90bbc8448bf1","impact_type":"unknown","incident_date":"2022-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7bf099f278ba","org_name":"Integrated Supports for Living, Inc.","org_type":"unknown","ransomware":null,"records_affected":2862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integrated%20Supports%20for%20Living%2C%20Inc.-2023-03-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5885df8d1cd6391c57dc840d7f38c10c14556a2d","impact_type":"unknown","incident_date":"2022-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult%20Non-SSN%20Notice%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c16511f9dfa","org_name":"Merritt Healthcare Advisors","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564568"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-20","discovered_date":"2023-01-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a88fdaa1826f75127382c0cae645e6fc9940223d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DHCS%20Breach%20Notice%201095-B%203.13.23.pdf"},"notes":null,"org_country":"US","org_id":"94ea5b01b93b","org_name":"Department of Health Care Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564534"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DHCS%20Breach%20Notice%201095-B%203.13.23.pdf"}],"summary":"The Department of Health Care Services found that some IRS Form 1095-B mailings contained another person's personal information.","supporting_quote":"On January 12, 2023, DHCS found that IRS Form 1095-B mailings to multiple individuals included a form with personal information belonging to someone other than the intended recipient.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96e15c79061395f7c0ab581614ed070c67857c3a","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Law%20Offices%20of%20John%20A%20Guthrie.pdf"},"notes":"attack_techniques without supporting words dropped: T1566, T1598","org_country":"US","org_id":"793a8659afec","org_name":"Law Offices of John A. Guthrie","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564515"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Law%20Offices%20of%20John%20A%20Guthrie.pdf"}],"summary":"An imposter sent scam emails from addresses associated with the law office, linking to a fake Microsoft login page intended to steal recipients’ credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1bceb73e97d41d340a14d81c072e0268b76ec9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HPSM%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"032bc489b5d0","org_name":"Health Plan of San Mateo","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HPSM%20-%20California%20Notification.pdf"}],"summary":"Health Plan of San Mateo reported unauthorized access to an employee email account containing a spreadsheet with member personal information and limited nurse advice line call information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"723e179a739ac2143c84b4aafb8b849a0ed72ea8","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter%20for%20Regulator.pdf"},"notes":null,"org_country":"US","org_id":"b5c3e169fc62","org_name":"UC San Diego Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter%20for%20Regulator.pdf"}],"summary":"Analytics tools on Solv Health-hosted UC San Diego Health scheduling websites may have captured and transmitted appointment and personal information to third-party service providers.","supporting_quote":null,"technology_involved":["Solv Health scheduling websites","analytics tools"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Solv Health"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"52ff96743c34","name":"Solv Health"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-16","discovered_date":"2023-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ea04ff7bcb90457b4fa34649d9cd97aa078b337","impact_type":"both","incident_date":"2023-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Myers%20Power%20Products%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fb8ef0438c70","org_name":"Myers Power Products, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564416"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Myers%20Power%20Products%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Myers Power Products discovered unusual network activity that disrupted access to certain systems, and its investigation found that personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","medical"],"disclosed_date":"2023-03-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c219080718e6aab88a17a99e6a017fb1eaae6f56","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Regulator%20Submission%20-%20Individual%20Notice%20Letter%20-%20Login%20Exposure.pdf"},"notes":null,"org_country":"US","org_id":"a2cdf7bffbeb","org_name":"The Olympic Club","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Regulator%20Submission%20-%20Individual%20Notice%20Letter%20-%20Login%20Exposure.pdf"}],"summary":"An unknown third party accessed certain Olympic Club employees’ email accounts, where personal information was present; the investigation could not confirm whether it was acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-15","discovered_date":"2023-02-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff9c238dcfee64c309b5587f8c46053be0993f06","impact_type":"both","incident_date":"2023-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-18852%20City%20of%20Oakland%20W4%20Adult%2012%20Mo%20CM%20Resident%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"b9b2a53117ab","org_name":"City of Oakland","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572825"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564385"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-18852%20City%20of%20Oakland%20W4%20Adult%2012%20Mo%20CM%20Resident%20r2prf.pdf"}],"summary":"The City of Oakland reported that malware encrypted some systems and an unauthorized actor accessed and/or took files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-14","discovered_date":"2022-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d22024dcaf477f0c3424910009fc9ab3ad865b6f","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/mscripts%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"43f6702973e4","org_name":"mscripts, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Files held in cloud storage were accessible from the Internet without authentication.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564325"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/mscripts%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#mscripts%2C%20LLC-2023-03-14"}],"summary":"Files containing prescription order summaries and prescription bottle images in mscripts’ cloud storage were accessible from the Internet without authentication.","supporting_quote":"On November 18, 2022, mscripts® learned that certain files held in its cloud storage were accessible from the Internet without the need for authentication between September 30, 2016 and November 18, 2022.","technology_involved":["cloud storage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-14","discovered_date":"2023-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33aaaa6037b0aa23fa8e9757a82aaf7b00aa121d","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20266.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"5d174ee0228e","org_name":"Inland Technologies Holdings Inc.","org_type":"unknown","ransomware":null,"records_affected":256,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20266.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20266.pdf"}],"summary":"An unauthorized third party accessed Inland systems, temporarily rendering some systems inaccessible; the investigation found that the data involved contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-14","discovered_date":"2022-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7937cbe5a13416ff5efd2b2dc493e6fee0a1034a","impact_type":"both","incident_date":"2022-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ILS%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"3d3a1ead80f9","org_name":"Independent Living Systems, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564316"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ILS%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Independent%20Living%20Systems%2C%20LLC-2023-03-14"}],"summary":"Independent Living Systems reported that an unauthorized actor accessed ILS systems, acquired some information, and could potentially view other information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-14","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"23496094165a5761cae05715171eda37f4330b83","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20260.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"068b8d9bf58c","org_name":"Art Center Inc.","org_type":"education","ransomware":null,"records_affected":1081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20260.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20260.pdf"}],"summary":"A device containing personal and student information was stolen, and the organization notified affected individuals after determining their information may have been impacted.","supporting_quote":"On October 27, 2022, a device containing certain individuals’ personal and student information was \nstolen by an unknown individual .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-14","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33a541b2121b7f650e9c0ef19619a238047b279e","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20261.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"f453c5f59832","org_name":"Allstate Insurance Company","org_type":"financial","ransomware":null,"records_affected":561,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20261.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20261.pdf"}],"summary":"An unauthorized user may have used account credentials to access information in Allstate MyAccount, though Allstate had no indication that the information was acquired.","supporting_quote":"An unauthorized user may have used your username and password to access certain information from your Allstate MyAccount between Jan. 8 and Feb. 28, 2023.","technology_involved":["Allstate MyAccount"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43806c085079b8b1f105e85bfb682e8ff52cfcb0","impact_type":"unknown","incident_date":"2022-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2023.03.13%20Consumer%20Incident%20Attachment.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40fa79db2126","org_name":"AllCare Plus Pharmacy, Inc. (\"AllCare\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564311"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-13","discovered_date":"2023-02-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9efb78c4026590338e2d4c60766d721edb56fec7","impact_type":"unknown","incident_date":"2023-01-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ac9ba9056e3","org_name":"Mitchell Lewis and Staver","org_type":"unknown","ransomware":null,"records_affected":1096,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mitchell%20Lewis%20and%20Staver-2023-03-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-13","discovered_date":"2022-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5aab77fbfc8528ac0881a0ec140702b8ccb9768","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MoneyMailer%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f7a808d70740","org_name":"Local Marketing Solutions Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564285"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MoneyMailer%20-%20Sample%20Notice.pdf"}],"summary":"Money Mailer reported unauthorized access to its environment from May 31 to June 2, 2022, and said documents containing personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff22e24603c0b326b57b63b3d8e94edb1bcdca05","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-09-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CA","org_id":"d467815ebcf1","org_name":"Shopper+","org_type":"retail_ecommerce","ransomware":null,"records_affected":878290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shopper+","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShopperPlus"}],"summary":"Shopper+ reported a breach dating to September 2020 involving 878,290 customer records containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"170e726622ce09579035ccb40605eb2e0b3f7a32","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"ff6aeea6b688","org_name":"HDB Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HDB Financial Services","type":"hibp","url":"https://haveibeenpwned.com/Breach/HDBFinancialServices"}],"summary":"HDB Financial Services suffered a data breach that disclosed customer records, including personal details and loan information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16615f816cde9cd8a44bb6ffc57951077068897f","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/P2.pdf"},"notes":null,"org_country":"US","org_id":"11e41912d68c","org_name":"ZOLL Medical Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564214"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/P2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ZOLL%20Medical%20Corporation-2023-03-10"}],"summary":"ZOLL Medical Corporation reported that personal information may have been affected in an incident involving unusual activity on its internal network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-10","discovered_date":"2022-12-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e5fbf586b28dbbfc1ccd1749fea77ea224c2e7f","impact_type":"disruption_or_ransomware","incident_date":"2022-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_J1405_HOUSING_AUTHORITY_OF_THE_CITY_OF_LOS_ANGELES_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"b60748e3cfb6","org_name":"The Housing Authority of the City of Los Angeles","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_J1405_HOUSING_AUTHORITY_OF_THE_CITY_OF_LOS_ANGELES_L01_SAS_1.pdf"}],"summary":"HACLA discovered encrypted files and unauthorized access to certain servers, and determined that data relating to affected individuals was included on those servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-10","discovered_date":"2022-11-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a02da91826a0a8d676ee12d9ca11d25990eb9683","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SMT-%20California%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"83c4bb4d2922","org_name":"Spaulding McCullough & Tansil LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564224"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SMT-%20California%20Exhibit%20A.pdf"}],"summary":"Spaulding McCullough & Tansil LLP reported that an unauthorized individual accessed portions of its network and that names and address information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2023-03-09","discovered_date":"2022-07-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"253a5a123127e5d4c70cadbaa55c26dafabc5ce0","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kiefer%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"59e1a968359f","org_name":"Kiefer Aquatics","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564129"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kiefer%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"}],"summary":"Kiefer Aquatics reported that an unknown actor accessed or could have accessed payment card information on three of its websites.","supporting_quote":null,"technology_involved":["kiefer.com","thelifeguardstore.com","allamericanswim.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-08","discovered_date":"2022-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9daec12a5906acd405c6233d7a88ab978e740f8","impact_type":"disruption_or_ransomware","incident_date":"2022-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Merced%20College%20-%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"0087bd2ba098","org_name":"Merced College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564094"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Merced%20College%20-%20Notification%20Letter%20Template.pdf"}],"summary":"Merced College reported that malware encrypted some systems and an unauthorized party may have accessed data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dd23ce05473df7bd3d6cd5f43865f7dee3f8a88","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMG-EPIC%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"5cd4f691c431","org_name":"EPIC Management LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized third party gained access through a targeted phishing attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564084"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMG-EPIC%20Individual%20Notification%20Letter.pdf"}],"summary":"EPIC Management LLC reported that a targeted phishing attack gave an unauthorized third party temporary access to certain emails and records on an employee’s account.","supporting_quote":"We discovered that an unauthorized third-party launched a targeted phishing attack and temporarily gained access to certain emails and records on the employee’s account.","technology_involved":["email account","employee workstation"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-08","discovered_date":"2023-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d71f8809b0473df8c9643af966bac7c5bb55b262","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Modesto_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"b9fb24a17cba","org_name":"City of Modesto","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564065"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Modesto_CA%20Sample.pdf"}],"summary":"The City of Modesto reported that data, potentially including personal and medical information, was accessed during a cybersecurity incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fbec6024299f8d83ece173547288097f4a8b816","impact_type":"unknown","incident_date":"2023-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NorCal%20-%20Letter%20A%20-%20Adult%20SSN%2012%20%5BRedacted%5D%20%2811050462x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d29754c1a3b6","org_name":"Nor-Cal Beverage Co., Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564028"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-03-07","discovered_date":"2023-02-02","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f06961bc123a4cf362e04545cee6a7b8ba19beb","impact_type":"data_theft","incident_date":"2023-01-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/www-chs-net-notice-of-third-party-security-incident-impacting-chspsc-affiliate-d.pdf"},"notes":null,"org_country":"US","org_id":"e3d92e8617f2","org_name":"CHSPSC, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A previously unknown vulnerability in Fortra’s GoAnywhere file transfer service platform was used to gain access to Fortra’s systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564032"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/www-chs-net-notice-of-third-party-security-incident-impacting-chspsc-affiliate-d.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CHSPSC%2C%20LLC-2023-03-07"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CHSPSC%2C%20LLC-2023-04-17"}],"summary":"CHSPSC reported that a vulnerability in Fortra’s GoAnywhere platform was exploited, potentially disclosing CHSPSC Affiliate personal and medical information.","supporting_quote":"According to Fortra, the unauthorized party used a previously unknown vulnerability to gain access to Fortra’s systems, specifically Fortra’s GoAnywhere file transfer service platform, compromising sets of files throughout Fortra’s platform.","technology_involved":["Fortra","GoAnywhere"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-06","discovered_date":"2022-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e968fcfe0e87d1527d1e74971f826cba88dd577b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Squishable%20-%20Notificaiton%20Template.pdf"},"notes":null,"org_country":"US","org_id":"e5e929eca4b8","org_name":"Squishable.com, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563972"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Squishable%20-%20Notificaiton%20Template.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20110.pdf"}],"summary":"Squishable found unauthorized code on its website that could allow a third party to view and potentially capture information entered on the checkout page.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2023-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b2030f83a32f06aa4285d8e97448bb7636d251db","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14909.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0efd203a4c19","org_name":"South Whidbey Fire & EMS","org_type":"unknown","ransomware":null,"records_affected":582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14909.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66b638d75b7b6c64691495052af074c91a6fcb50","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b6945d8dc6f9","org_name":"iD Tech","org_type":"education","ransomware":null,"records_affected":415121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: iD Tech","type":"hibp","url":"https://haveibeenpwned.com/Breach/iDTech"}],"summary":"iD Tech records containing email addresses, names, dates of birth, and plain-text passwords were posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-03-06","discovered_date":"2023-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4667ff23c3e0c219af1e9a27d480e55e1a8d3776","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2%20Corrected%20Email%20Ntc%20to%20Client%202023%2003-02.pdf"},"notes":null,"org_country":"US","org_id":"38668d30c8ae","org_name":"Fleming, Nolen & Jez, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2%20Corrected%20Email%20Ntc%20to%20Client%202023%2003-02.pdf"}],"summary":"Fleming, Nolen & Jez, LLP reported that an unknown third party accessed its systems and that personal information, including medical records in some cases, may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2023-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6c9c7a54f2eb4d5a9b6756a832562d58d23e269","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a792891617d0","org_name":"Eye4Fraud","org_type":"technology_saas","ransomware":null,"records_affected":16000591,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Eye4Fraud","type":"hibp","url":"https://haveibeenpwned.com/Breach/Eye4Fraud"}],"summary":"Data allegedly taken from Eye4Fraud was listed for sale on a hacking forum and included personal information, password hashes, and partial credit card data.","supporting_quote":null,"technology_involved":["Eye4Fraud"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-03-06","discovered_date":"2023-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"541f2a89f8af7e2529bfb80dbd9522ffa2b75bf4","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20BREACH%20NOTIFICATION%20LETTER%203.1.2023.pdf"},"notes":null,"org_country":"US","org_id":"a22505a43fcb","org_name":"Cerebral","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Cerebral disclosed information to third-party platforms and subcontractors without obtaining HIPAA-required assurances.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563910"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20BREACH%20NOTIFICATION%20LETTER%203.1.2023.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20136.pdf"}],"summary":"Cerebral disclosed personal and health information through tracking technologies to third-party platforms and subcontractors without obtaining HIPAA-required assurances.","supporting_quote":"On January 3, 2023 Cerebral determined that it had disclosed certain information that may be regulated as protected health information (“PHI”) under HIPAA to certain Third Party Platforms and some Subcontractors without having obtained HIPAA-required assurances.","technology_involved":["Tracking Technologies","Google","Meta (Facebook)","TikTok"],"third_party":{"archetype":null,"involved":true,"vendor":"Google, Meta, TikTok, and other third parties"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0e9f335c7c68","name":"Google"},{"id":"c13344b4d4bd","name":"Meta"},{"id":"4ee181dfcb48","name":"TikTok"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-05","discovered_date":"2023-02-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"22251d3ffe87704deaa783f2612a9741f4b0f212","impact_type":"data_theft","incident_date":"2023-01-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20143.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":36211,"reviewed":false,"root_cause":"A previously unknown vulnerability in Fortra’s GoAnywhere MFT SaaS was used to access customer accounts and download files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20143.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20143.pdf"}],"summary":"An unauthorized party exploited a previously unknown vulnerability in Fortra’s GoAnywhere MFT SaaS to access customer accounts and download files containing personal information.","supporting_quote":"Through its investigation, Fortra states that it identified a previously-unknown vulnerability which an unauthorized party used to access certain GoAnywhere customers’ accounts and download files.","technology_involved":["GoAnywhere MFT SaaS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fec0401370fcc30e028ae903f08d89b1b130b10b","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"9d726e8132a7","org_name":"LBB","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LBB","type":"hibp","url":"https://haveibeenpwned.com/Breach/LBB"}],"summary":"LBB customer data was posted to a hacking forum after being exposed through a third-party service.","supporting_quote":"LBB advised they believe the data was exposed by a third party service and whilst it contained information they retain on their customers, it had also been enriched with additional data attributes.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-03","discovered_date":"2023-01-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"679a914f3c1fd5627bc18601edf0826f40d446a9","impact_type":"unknown","incident_date":"2023-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AI273_v04%20-%20Letter%20A%20-%20REDACTED%20%2811042724x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"22adfa822b3d","org_name":"Sterling Bank and Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563870"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AI273_v04%20-%20Letter%20A%20-%20REDACTED%20%2811042724x7AB84%29.pdf"}],"summary":"Sterling Bank and Trust reported that a package containing 1099 tax forms was damaged while with FedEx, resulting in files being lost or destroyed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"FedEx"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c1919051a163","name":"FedEx"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5790ec787328061a0523ffd77dfc19790d1423d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Saltzman%20%26%20Johnson%20Law%20Corp%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"748ff9f874f7","org_name":"Saltzman & Johnson Law Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563864"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Saltzman%20%26%20Johnson%20Law%20Corp%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized party accessed an employee email account used to propagate a phishing campaign, and personal information stored in the account may have been exposed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3ce94626483c424b5587ea8d7569ebd68ba31ab","impact_type":"unknown","incident_date":"2023-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a050a77018a0","org_name":"Mendoza Income Tax","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563866"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-03","discovered_date":"2023-01-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92a6a3c74e9adad4d33e18662e90639b8a13ae57","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crystal%20Creamery%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b9dd4ca2568a","org_name":"Crystal Creamery, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crystal%20Creamery%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Crystal Creamery identified unusual computer-network activity, and an investigation found that certain files may have been viewed or downloaded without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f634380db891f3746c1aae506e6313ca1604a609","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/B%20-%20Adult%20One%20Year_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"7a6ac1c892ec","org_name":"Vocality Community Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/B%20-%20Adult%20One%20Year_Redacted.pdf"}],"summary":"An unauthorized third party accessed a VCCU email account containing personal information, but the investigation found no evidence that the information was viewed or misused.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31e0e012f4bacc1c904d4ca43438c2fcbc4b342d","impact_type":"unknown","incident_date":"2023-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8f14dc768774","org_name":"SNP ENTERPRISES INC.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563823"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2023-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ba58dd01fd9d7af39b895bcb4a01d2d1833e209","impact_type":"data_theft","imported_from":null,"incident_date":"2022-12-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a47e621dd653","org_name":"GunAuction.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":565470,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GunAuction.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/GunAuction"}],"summary":"GunAuction.com suffered a data breach in December 2022 involving user records that included personal information, partial credit card data, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-02","discovered_date":"2023-02-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d36fa921bd72bfb0b9fdc689a8d7e18454b27a00","impact_type":"data_theft","incident_date":"2022-12-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-03-02%20-%20CFA%20-%20Individual%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"318ee40d2198","org_name":"Chick-fil-A, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized parties used account credentials obtained from a third-party source to access Chick-fil-A One accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563781"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-03-02%20-%20CFA%20-%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/ChickfilA.pdf"}],"summary":"Unauthorized parties used credentials obtained from a third-party source to access information in Chick-fil-A One accounts.","supporting_quote":"Following a careful investigation, we determined that unauthorized parties launched an automated attack against our website and mobile application between December 18, 2022 and February 12, 2023 using account credentials (e.g., email addresses and passwords) obtained from a third-party source.","technology_involved":["Chick-fil-A One","website","mobile application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-01","discovered_date":"2022-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c0d7e978af3fdf969ca111801d36486e0070d56","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-SSN%20%281%29%20Sample%20Notice%20Letter%20-%20Redacted%20%2811029137-2x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"7f317d3744da","org_name":"Tenant, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563745"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-SSN%20%281%29%20Sample%20Notice%20Letter%20-%20Redacted%20%2811029137-2x7AB84%29.pdf"}],"summary":"A 2020 incident copied one table from the Storagefront.com database, and the file was later leaked online; the letter says there was no evidence that tables containing personal information were accessed or copied.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3071c51e169ae42c38bb004f801ccf1799024aee","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSN_AI190_v03%20%5Bredaction%5D%20%2811017818x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"b66a5a8ec320","org_name":"Lincoln Families","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563773"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSN_AI190_v03%20%5Bredaction%5D%20%2811017818x7AB84%29.pdf"}],"summary":"Lincoln Families reported unauthorized access to its network between January 17 and February 11, 2022, and said information was exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-03-01","discovered_date":"2023-01-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"873797383102926dec175103b043bbf9c7deb7a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-02","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/COD_Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"e05098a336a3","org_name":"College of the Desert","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563778"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/COD_Sample%20Notice%20Letter.pdf"}],"summary":"College of the Desert reported that a network intrusion affected some systems and that a limited amount of information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-03-01","discovered_date":"2022-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0039a40c758be72a50e3645c0370919b44dbc379","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C.%20Overaa%20%26%20Co.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c746cd1bd45e","org_name":"C. Overaa & Co.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C.%20Overaa%20%26%20Co.%20-%20Sample%20Notice.pdf"}],"summary":"C. Overaa & Co. reported unauthorized access to its environment, where an actor could acquire information that may have included personal and financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d9295cf78475e5b19fa9507c0a74296dbf14a80f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14906.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bf62b152b04d","org_name":"REC Silicon","org_type":"manufacturing","ransomware":null,"records_affected":647,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14906.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14906.pdf"}],"summary":"REC Silicon reported that unauthorized parties accessed employee benefits and pension information, potentially including names, Social Security numbers, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-28","discovered_date":"2023-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f1b75738f6f1533d7663353aa86da1728c56c77","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hatch%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"537d33195d5e","org_name":"Hatch Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563714"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hatch%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hatch%20Bank-2023-02-28"}],"summary":"Hatch Bank reported that files containing customer information stored on Fortra’s GoAnywhere site were accessed without authorization.","supporting_quote":null,"technology_involved":["Fortra GoAnywhere"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fortra"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"47bf2d50a237","name":"Fortra"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-27","discovered_date":"2023-01-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af83a0800ec361ef56661267f2bcdbf6d73ce9fb","impact_type":"data_theft","incident_date":"2023-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WWP%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"d036f0017d0a","org_name":"William Warren Properties","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563665"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WWP%20-%20California%20Notification.pdf"}],"summary":"An unauthorized actor accessed folders on William Warren Properties’ servers and viewed or obtained files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac4e144c6ac5d54687ffa26218e55107b0576e13","impact_type":"unknown","incident_date":"2022-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2023.02.24%20Consumer%20Notification%20of%20Incident.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"36272dba3849","org_name":"Advanced Health Media (“AHM”), an IQVIA company, and clients of AHM.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563632"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6dee291a99c9a0731d5eb7d1cd938aad70e3303","impact_type":"data_theft","imported_from":null,"incident_date":"2023-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"155ffb1711c7","org_name":"Convex","org_type":"telecom","ransomware":null,"records_affected":150129,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Convex","type":"hibp","url":"https://haveibeenpwned.com/Breach/Convex"}],"summary":"Convex was hacked, and data attributed to the incident was released publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"anonymous"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-02-24","discovered_date":"2022-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"41aecd75ca05f082a3e78d0f3aa15e86deec0dbb","impact_type":"both","incident_date":"2022-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24338.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3d6696d4dd41","org_name":"Reventics, LLC","org_type":"professional_services","ransomware":null,"records_affected":3900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24338.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Reventics%2C%20LLC-2023-06-20"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567606"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563598"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reventics%2C%20LLC%20Sample%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24338.pdf"}],"summary":"Reventics reported that an intruder encrypted and potentially accessed information on its servers, and that unauthorized acquisition of information occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-24","discovered_date":"2023-01-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"547bd0a06db11ea25f16f13a9e68b2adc65ecbcd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"43abf0644a79","org_name":"David Douglas School District","org_type":"unknown","ransomware":null,"records_affected":3428,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#David%20Douglas%20School%20District-2023-02-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7b295943b409b0578dc401ae3880043fc0d8cde","impact_type":"data_theft","incident_date":"2022-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crystal%20Bay%20Casino%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e03378ae6a44","org_name":"Crystal Bay Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563594"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564885"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crystal%20Bay%20Casino%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Crystal%20Bay%20Casino-2023-02-24"}],"summary":"Crystal Bay Casino reported that files and database information may have been copied during an incident, including information such as names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bb5f5cbf8253a678304a56938fcfe92adcbeece","impact_type":"unknown","imported_from":null,"incident_date":"2021-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Flagstar%20Standard%20Notification%20Letter%20-%2006-17-2022.pdf"},"notes":null,"org_country":"US","org_id":"d4395d7cba1d","org_name":"Aurora Financial Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Flagstar%20Standard%20Notification%20Letter%20-%2006-17-2022.pdf"}],"summary":"Flagstar reported unauthorized access to its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d520d9a4cd6f3e783714ffc6ba14ba1e7e185eed","impact_type":"unknown","incident_date":"2014-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a2f88ccab71","org_name":"Asante","org_type":"unknown","ransomware":null,"records_affected":8834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Asante-2023-02-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2023-02-21","discovered_date":"2022-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c32997995890b2f1d839da1274a4c49668df46b6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19972.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2f4bb5ae2bf5","org_name":"TIAA, FSB","org_type":"financial","ransomware":null,"records_affected":53,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19972.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19972.pdf"}],"summary":"TIAA, FSB reported suspicious activity potentially implicating a former employee who had access to customers’ personal information, though it had no indication of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b7e65cffef489b506961c15cfeda01d1be3c00b","impact_type":"data_theft","imported_from":null,"incident_date":"2022-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ed4ece63cd7b","org_name":"RealDudesInc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RealDudesInc","type":"hibp","url":"https://haveibeenpwned.com/Breach/RealDudesInc"}],"summary":"A breach at RealDudesInc exposed email addresses, usernames, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical","other"],"disclosed_date":"2023-02-17","discovered_date":"2022-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ababc08644b5b81027285457c52a441af9c527cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19947.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4fb10896e2ca","org_name":"University of Washington","org_type":"education","ransomware":null,"records_affected":534,"reviewed":false,"root_cause":"A research data file containing personal information was inadvertently uploaded to a public website and was viewable there.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19947.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19947.pdf"}],"summary":"The University of Washington inadvertently uploaded a research data file containing personal and medical information to a public website, where it was viewable for approximately 30 minutes.","supporting_quote":"On February 4, 2022, a research data file that contained your personal information was inadvertently uploaded by the research team to a public website.","technology_involved":["public website","research study repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-17","discovered_date":"2022-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93397e30c1c1f17067748eac36a22568dc00c98c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Everest%20-%20Notice%20Letter%20to%20Employees%20of%20Entities%20%28Adult%29%28270101836.1%29_v2%20%28static%20proof%20r1%29%20%28002%29_2.pdf"},"notes":null,"org_country":"US","org_id":"e8adfe2a1252","org_name":"TempsPlus Staffing Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563376"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Everest%20-%20Notice%20Letter%20to%20Employees%20of%20Entities%20%28Adult%29%28270101836.1%29_v2%20%28static%20proof%20r1%29%20%28002%29_2.pdf"}],"summary":"TempsPlus Staffing Services reported unauthorized access to five email accounts, where a customer’s name may have been affected.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-17","discovered_date":"2022-06-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c450edb4f9816190aa5f2b84ddc89e10f6f6568","impact_type":"data_theft","incident_date":"2022-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult-%201%20Year.pdf"},"notes":null,"org_country":"US","org_id":"42b3c0bc25cf","org_name":"Steven Engineering, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563377"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult-%201%20Year.pdf"}],"summary":"An unauthorized third party accessed Steven Engineering’s computer network and acquired copies of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-17","discovered_date":"2022-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3ed8a373ef2b3a4aabe17a9dd08586bea5c7e369","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-13","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19942.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7cd6be59847d","org_name":"Rockler Companies, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1835,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19942.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19942.pdf"}],"summary":"An unauthorized actor accessed certain files and folders in Rockler’s system, where personal information was present; the company reported no evidence of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a1c84ef62def404e984c256b3e784bc7406c2f8","impact_type":"both","incident_date":"2022-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mesquite%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"44ec37d9c7e5","org_name":"Rancho Mesquite Casino, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563380"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mesquite%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rancho%20Mesquite%20Casino%2C%20Inc.-2023-02-17"}],"summary":"An unauthorized actor encrypted some of the organization’s systems and accessed certain data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-17","discovered_date":"2022-06-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f9d0dbb49e9e3603aeaa28996afa1bfa811acce","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patriot%20Growth%20Insurance%20Services%2C%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ec0423f2607c","org_name":"Brooks Jucha & Associates Insurance Services, Inc. d/b/a BJA Partners","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patriot%20Growth%20Insurance%20Services%2C%20LLC%20-%20Sample%20Notice.pdf"}],"summary":"BJA reported possible unauthorized access to an employee email account containing personal information, with no evidence of actual or attempted misuse.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2023-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d7de096f9efb5a1c6809e1589c944f1567c5667b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19909.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac42e59e98dd","org_name":"Integrative Dentistry","org_type":"healthcare","ransomware":null,"records_affected":2281,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19909.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19909.pdf"}],"summary":"Integrative Dentistry notified patients of unauthorized access to dental records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6c4927f8dd9926f229ca82cbf8489e82098e90d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CIR-113950-Letter%20for%20OAG.pdf"},"notes":null,"org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563292"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CIR-113950-Letter%20for%20OAG.pdf"}],"summary":"A CDSS employee emailed a document containing personal information to the employee’s personal email account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfeae5060ca6f757299932252bebc86a9dd91ef6","impact_type":"disruption_or_ransomware","incident_date":"2022-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Penhall_Sample.pdf"},"notes":null,"org_country":"US","org_id":"a893f85f3209","org_name":"Penhall Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563245"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Penhall_Sample.pdf"}],"summary":"Penhall Company reported that some systems were encrypted and an unauthorized individual accessed a computer system containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-15","discovered_date":"2023-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d301e10c37f0a1307f155dc7d9e71f10593083f3","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification%20to%20Affected%20Data%20Subjects%20-%20MKS.pdf"},"notes":null,"org_country":"US","org_id":"3ff95e08452a","org_name":"MKS Instruments, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563255"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%20to%20Affected%20Data%20Subjects%20-%20MKS.pdf"}],"summary":"MKS Instruments reported a ransomware event that encrypted business and manufacturing systems and may have involved exfiltration of personal data, which was not confirmed.","supporting_quote":null,"technology_involved":["business systems","manufacturing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3face05d9bb38443c594aa9389b72cea5f1341f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19891.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6a8e59143b49","org_name":"Asotin County Public Facilities District","org_type":"government","ransomware":null,"records_affected":1090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19891.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19891.pdf"}],"summary":"An unauthorized actor may have accessed or acquired personal information from Asotin County Public Facilities District systems during an incident that temporarily disrupted Aquatic Center IT services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-14","discovered_date":"2022-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e65b8a7754c0ff428713ace88d4f000bbaf2cbe","impact_type":"disruption_or_ransomware","incident_date":"2022-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_Adults_TDC%2002142023.pdf"},"notes":null,"org_country":"US","org_id":"c818cd29a678","org_name":"The Donovan Company","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563172"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_Adults_TDC%2002142023.pdf"}],"summary":"The Donovan Company detected and stopped a ransomware attack that encrypted files and disabled computer systems; personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6164b52c4a12f3ca24ea6469c436cdc82dce4648","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20230203%20Horizon%20DS%20Notification%20v1.0%20FINAL%20%28003%29.pdf"},"notes":null,"org_country":"US","org_id":"35965ea2aebc","org_name":"Credit Suisse Group AG","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee copied personal data without authorization onto their personal device.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563142"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20230203%20Horizon%20DS%20Notification%20v1.0%20FINAL%20%28003%29.pdf"}],"summary":"A former Credit Suisse employee copied personal data onto a personal device without authorization.","supporting_quote":"An individual employee, who has since left the firm and had legitimate access to your personal data at the time for their daily work, inappropriately copied this information without Credit Suisse’s authorisation onto their personal device.","technology_involved":["personal device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7dda8880ba818aeac0ea22932a076b002a556f17","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19847.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bf5d19600d56","org_name":"Evergreen Treatment Services","org_type":"healthcare","ransomware":null,"records_affected":11247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19847.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19847.pdf"}],"summary":"Evergreen Treatment Services reported that an external party temporarily accessed its network environment and that personal and treatment information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c69017093cbdd9bcc206f6eac8296e8d7894eed8","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Xavier%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d0fa947b4121","org_name":"Xavier University of Louisiana","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563055"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Xavier%20-%20Sample%20Notice.pdf"}],"summary":"Xavier University of Louisiana reported a network disruption during which personal information may have been acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"930dfb26a9d698ee596593d67c17eb50e56d2196","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/PepsiBottlingVenturesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a63d39fb4ec","org_name":"Pepsi Bottling Ventures LLC","org_type":"unknown","ransomware":null,"records_affected":1048,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/PepsiBottlingVenturesLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8563fa494d5360da2ae5dc2c92cc78f74e387b5","impact_type":"unknown","imported_from":null,"incident_date":"2022-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Suspicious%20Account%20Activity%20Letter%20v5.pdf"},"notes":null,"org_country":"US","org_id":"c06ad4527eec","org_name":"Charter Communications","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563019"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Suspicious%20Account%20Activity%20Letter%20v5.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Charter%20Communications-2023-02-10"}],"summary":"Charter Communications reported suspicious activity on a customer’s Spectrum account and required a password reset.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-02-09","discovered_date":"2022-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3191734c38a43c6b8443dda6d2ed5019a294fc8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6479d9a40f5a","org_name":"Zacks Investment Research","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562933"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19545.pdf"}],"summary":"Zacks Investment Research reported unauthorized access to customer records in an older database, including names, contact details, and Zacks.com passwords.","supporting_quote":null,"technology_involved":["customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-02-09","discovered_date":"2023-01-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"30c779496896079599fc660c081e997a20692d8e","impact_type":"data_theft","incident_date":"2022-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19803.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3db0ee1348da","org_name":"Northwest Mothers Milk Bank","org_type":"healthcare","ransomware":null,"records_affected":1153,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Mothers%20Milk%20Bank-2023-02-09"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19803.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19803.pdf"}],"summary":"Files containing personal and medical information related to Northwest Mothers Milk Bank were acquired from TMS’s network after unauthorized access to a TMS application.","supporting_quote":null,"technology_involved":["TMS application"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TMS"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"b9a034f74cc2","name":"TMS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-09","discovered_date":"2022-11-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c46a1ac724cef38cc2f4bf5e69aee322eaf44f31","impact_type":"unknown","incident_date":"2022-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51705d08ccaa","org_name":"DraftKings Inc.","org_type":"unknown","ransomware":null,"records_affected":67995,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DraftKings%20Inc.-2023-02-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2023-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4676e10781e2db49ee6718486df92498c672902e","impact_type":"data_theft","imported_from":null,"incident_date":"2022-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"976fea6ea056","org_name":"Weee","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Weee","type":"hibp","url":"https://haveibeenpwned.com/Breach/Weee"}],"summary":"Weee customer order data, including names, phone numbers, delivery instructions, and email addresses, appeared on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-02-08","discovered_date":"2022-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0fe72cd50c3e62b08ff76a73c967976f7cc08dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-16971%20Sonder%20Ad%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"d18fcf4f649f","org_name":"Sonder Holdings Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-16971%20Sonder%20Ad%20r1prf.pdf"}],"summary":"Sonder Holdings Inc. reported unauthorized access to an AWS account, with personal and financial information potentially accessible.","supporting_quote":null,"technology_involved":["Amazon Web Services (AWS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Amazon Web Services"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"788a62660e2f","name":"Amazon Web Services"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0e99a87ce49270453608c73d2e00e27a462ad4e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/HighmarkHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ba18c21c03d","org_name":"Healthmark Health","org_type":"unknown","ransomware":null,"records_affected":1693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/HighmarkHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-02-06","discovered_date":"2023-01-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce639eaa9e23b9d79413987f3b544d631c6ba888","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sharp%20-%20Adult_Patient%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"12af51fa73bf","org_name":"Sharp HealthCare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562755"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sharp%20-%20Adult_Patient%20Proof.pdf"}],"summary":"An unauthorized person accessed Sharp HealthCare’s website server and obtained a file containing names and payment-related information.","supporting_quote":null,"technology_involved":["Sharp.com website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d876efc2fb14542aab32666bf4b632fc04b90497","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"96715a20c8b7","org_name":"LimeVPN","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LimeVPN","type":"hibp","url":"https://haveibeenpwned.com/Breach/LimeVPN"}],"summary":"A breach of LimeVPN exposed customer personal information and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2cf4f6172ea331bd1d27722d41ece19be679e4c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19718.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5fc2cc834df","org_name":"Mutual of America Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":1043,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19718.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01f5c8087e00c003152d7cdadedde3e51ebe1bcd","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bb54de85c0a5","org_name":"TruthFinder","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Truth Finder","type":"hibp","url":"https://haveibeenpwned.com/Breach/TruthFinder"}],"summary":"TruthFinder suffered a data breach in 2019 involving customer email addresses, names, phone numbers, and scrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac126cb1dd1972d1838958a8b219a69c742af78d","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5564d7f58da1","org_name":"Instant Checkmate","org_type":"technology_saas","ransomware":null,"records_affected":11943887,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Instant Checkmate","type":"hibp","url":"https://haveibeenpwned.com/Breach/InstantCheckmate"}],"summary":"Instant Checkmate suffered a 2019 data breach involving customer email addresses, names, phone numbers, and scrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2023-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"845413f95352b8addc25e7115d7422af484898d9","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IDX%20The%20Center%20For%20Autism%20and%20Related%20Disorders%20%20Notification%20Letter%201%20V.2%20Print%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"0b5b5c7feb92","org_name":"Center for Autism and Related Disorders","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party invoice-generation vendor made a computer error that sent caregivers invoices for unrelated patients.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562735"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IDX%20The%20Center%20For%20Autism%20and%20Related%20Disorders%20%20Notification%20Letter%201%20V.2%20Print%20Proof.pdf"}],"summary":"A vendor error in the patient billing process caused some caregivers to receive invoices containing information about unrelated patients.","supporting_quote":"CARD recently discovered that, as part of a recent update to its patient billing systems, the third-party vendor responsible for generating patient invoices incorrectly made a computer error which resulted in certain caregivers receiving an invoice for services for an unrelated patient.","technology_involved":["patient billing systems"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbc060327d85703ba973f3bd6aa49bb0e198e277","impact_type":"unknown","incident_date":"2022-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Let...eeman_California%20V.2%20%28Print%20Proof%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e70ded6664c","org_name":"S.R. Freeman Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562697"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3135f86845d78a35376879c5f44d7107c5f8c2e9","impact_type":"data_theft","incident_date":"2022-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rise%20Edgepark%20Adult%20Notice%20Letter%20%2810959098x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"f2b52c34eb96","org_name":"Rise Interactive Media & Analytics, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562709"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rise%20Edgepark%20Adult%20Notice%20Letter%20%2810959098x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19707.pdf"}],"summary":"Rise reported that files on its systems may have been accessed or acquired, including a file containing Edgepark patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6e1aa6145ad12e7bc79c3e2bab7f0a3bff00ef2","impact_type":"unknown","incident_date":"2022-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notice_12.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"476357214037","org_name":"RBC Ministries dba Our Daily Bread Ministries","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562684"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-02-03","discovered_date":"2022-12-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acce48d96d83e74b5aca7d5137124a9dfd42a244","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yes%20SSN%20Experian%20Notification%20Letter%20-%20Adult-Minor%20Credit%20Plus%201B%20020223.pdf"},"notes":null,"org_country":"US","org_id":"643173013a58","org_name":"Highmark","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yes%20SSN%20Experian%20Notification%20Letter%20-%20Adult-Minor%20Credit%20Plus%201B%20020223.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19731.pdf"}],"summary":"Highmark reported that a malicious email link compromised an employee’s email account, where emails containing protected health information may have been accessed.","supporting_quote":"On December 15, 2022, Highmark discovered that a Cyber Security Incident occurred whereby an employee was sent a malicious email link that led to their email account being compromised.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2023-02-03","discovered_date":"2022-12-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"441ec72fc4226b65055c96a9288ff28d525ffd40","impact_type":"data_theft","imported_from":null,"incident_date":"2022-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2023-02-03%20-%20CVA%20Individual%20Notice%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"397de8f60383","org_name":"Cardiovascular Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562686"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2023-02-03%20-%20CVA%20Individual%20Notice%20Templates.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/CardiovascularAssociates.pdf"}],"summary":"Cardiovascular Associates reported that an unauthorized third party accessed systems containing personal information and removed a copy of some data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcc353ee8934efb8d951f853815580c84233af23","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CA","org_id":"265b2547eb0c","org_name":"Pitt Meadows School District 42","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: School District 42","type":"hibp","url":"https://haveibeenpwned.com/Breach/SchoolDistrict42"}],"summary":"Pitt Meadows School District 42 had a January 2023 data breach that exposed names and email addresses of students and staff, which were redistributed on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"c058c6abdce43fb51ed8f10c0ed5503021e94589","impact_type":"unknown","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21649.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5955d7162c11","org_name":"Regal Medical Group","org_type":"healthcare","ransomware":null,"records_affected":2224,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21649.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564890"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562555"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regal%20John%20Doe%20Letter%20Feb%201%202023_1.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21649.pdf"}],"summary":"Regal Medical Group notified affected individuals that their personal information may have been compromised in a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-02-01","discovered_date":"2022-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ac04a60a5e85113fa137716029702345b159b20","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Diligent%20-%20Combined%20Sample%20Individual%20Notice%20Letters%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"c80b7454828f","org_name":"Diligent Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Diligent%20-%20Combined%20Sample%20Individual%20Notice%20Letters%20%28US%29.pdf"}],"summary":"An unauthorized actor accessed a network supporting Steele Compliance, and human resources records may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c5c701fed0d0d7476262467920aa27ab5758013","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"66837aebb424","org_name":"Planet Ice","org_type":"other","ransomware":null,"records_affected":240488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Planet Ice","type":"hibp","url":"https://haveibeenpwned.com/Breach/PlanetIce"}],"summary":"Planet Ice exposed personal information, including passwords stored as MD5 hashes, belonging to 240,488 people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-01-31","discovered_date":"2022-09-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbcdfdabadd47a38d8830444dfa748d013721242","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bell-Carter%20Foods_Consumer%20Notification%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"d4fa37f97f17","org_name":"Bell-Carter Foods, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562515"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bell-Carter%20Foods_Consumer%20Notification%20Sample.pdf"}],"summary":"Bell-Carter Foods reported that an unauthorized actor accessed certain systems containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d42653196c6224e5f63d3da27f7e65f1e15c478","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/Aarons.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2abf04206761","org_name":"Aaron's, LLC","org_type":"unknown","ransomware":null,"records_affected":1764,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/Aarons.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"101aff9937bc1a816dd2e8c05c84d562874f10d5","impact_type":"unknown","incident_date":"2022-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MHUSHD_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"f7735c906a6a","org_name":"Morgan Hill Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MHUSHD_CA%20Sample.pdf"}],"summary":"Morgan Hill Unified School District reported unauthorized connections to an employee’s email account between September 11 and October 11, 2022.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-27","discovered_date":"2022-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"246b06128516e6551cccdfc70f78f1f161f48528","impact_type":"data_theft","incident_date":"2022-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BAS_sample_breach_letter.pdf"},"notes":null,"org_country":"US","org_id":"d30e9b2fe9a5","org_name":"Benefit Administrative Systems, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562401"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BAS_sample_breach_letter.pdf"}],"summary":"Benefit Administrative Systems confirmed that an electronic file containing members’ personal information was exfiltrated by unauthorized individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1ec9f3c00887e407818aa5096ca2ee8e73064a6","impact_type":"data_theft","incident_date":"2022-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Matco_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"2429465aeb8b","org_name":"Matco Tools","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562295"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Matco_CA%20Sample.pdf"}],"summary":"Matco Tools reported unauthorized access to its network and suspicious activity in which a server copied data outside the network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4544fc826605286d29ffff9fcc7cf0199b5efc08","impact_type":"unknown","incident_date":"2023-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2023-01-20%200801%20-%20Incident%20Notification%20Memo%20-%20TRUCRS%20Incident%20-%20Final.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1388b0d0df31","org_name":"Air Resources Board","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562283"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-25","discovered_date":"2023-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c70a88153f2902bee7d70b67db277c22c84e0b9b","impact_type":"exposure_no_theft_confirmed","incident_date":"2023-01-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spiraledge%20Inc.pdf"},"notes":null,"org_country":"US","org_id":"3de2111fa4cf","org_name":"SwimOutlet.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee accidentally created a code repository and did not notice that it was public.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spiraledge%20Inc.pdf"}],"summary":"SwimOutlet.com disclosed that an employee accidentally created a public code repository containing customer names, phone numbers, and email addresses.","supporting_quote":"The investigation identified that an employee created the repository accidentally and had not noticed it was public.","technology_involved":["public code repository"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-01-25","discovered_date":"2022-11-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a31fd74a2a8ff44e856a474e14f774e4c80ed54","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19575.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ab46b29006c5","org_name":"Quality Behavioral Health","org_type":"healthcare","ransomware":null,"records_affected":2752,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19575.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19575.pdf"}],"summary":"Quality Behavioral Health reported a cyber incident affecting a system that contained personal, financial, and medical information; it could not conclusively rule out that information was viewed or copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-24","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e5f06244577b00d70767c1c18cde889c87d8c375","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc08ca0f0296","org_name":"New Narrative","org_type":"unknown","ransomware":null,"records_affected":443,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20Narrative-2023-01-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"305d8ed45bdb45fc45a688285bf6e42b558e8313","impact_type":"disruption_or_ransomware","incident_date":"2022-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB06592-LM-Letter-General_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"83506ce3e6ae","org_name":"Livingston Memorial VNA Health Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB06592-LM-Letter-General_Redacted.pdf"}],"summary":"An unauthorized party accessed Livingston Memorial's computer systems and encrypted information stored on them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4fa0d301971b9491b4e0cc7241064860b39d68f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"NO","org_id":"279787b708ec","org_name":"KomplettFritid","org_type":"retail_ecommerce","ransomware":null,"records_affected":139401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KomplettFritid","type":"hibp","url":"https://haveibeenpwned.com/Breach/KomplettFritid"}],"summary":"A data breach at the Norwegian online store KomplettFritid exposed customer records containing personal information and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2023-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11fc5e1a8cd94122f980ae24dae0c151c1e1bc65","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"019a8c144fa2","org_name":"Autotrader","org_type":"retail_ecommerce","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Autotrader","type":"hibp","url":"https://haveibeenpwned.com/Breach/Autotrader"}],"summary":"Records from Autotrader's online vehicle marketplace appeared on a hacking forum, including contact details and vehicle information.","supporting_quote":null,"technology_involved":["Autotrader online vehicle marketplace"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cf557006dc746ee73c734f022583e0183a413c5","impact_type":"data_theft","imported_from":null,"incident_date":"2023-01-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"758458bfec49","org_name":"Zurich","org_type":"financial","ransomware":null,"records_affected":2600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zurich","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zurich"}],"summary":"Zurich's Japanese arm suffered a data breach that exposed customer records, which were subsequently posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-20","discovered_date":"2023-01-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dfff80b8dadaac3a807657c56ee1c3e49b56f03a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2023-01-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19490.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8601fadebaff","org_name":"Pacific Lutheran University","org_type":"education","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19490.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19490.pdf"}],"summary":"A billing automation error caused some bills to include another student's name and PLU ID number.","supporting_quote":null,"technology_involved":["billing automation process"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other"],"disclosed_date":"2023-01-20","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f52382556e152f7c5144ac1e2a884af7d0f19048","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JL%20PHASE%203%20-%20NL%2012%20MONTH-%20REDACTED%20%2811075072x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"61d9b8c67322","org_name":"Jackson Lewis PC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564432"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562033"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JL%20PHASE%203%20-%20NL%2012%20MONTH-%20REDACTED%20%2811075072x7AB84%29.pdf"}],"summary":"Jackson Lewis reported that two hard drives containing confidential information of personnel and some clients were stolen from a locked storage room.","supporting_quote":"Earlier last year, Jackson Lewis was the victim of a theft of two hard drives from a locked storage room in one of our offices despite multiple levels of security.","technology_involved":["hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-20","discovered_date":"2023-01-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a50f18999587fa32bd63741b0729a183c8a92ec3","impact_type":"unknown","incident_date":"2022-09-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63e8a18fd94e","org_name":"Bank of Eastern Oregon","org_type":"unknown","ransomware":null,"records_affected":1968,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bank%20of%20Eastern%20Oregon-2023-01-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"853602f2438ef357202c6c2a2b3eb0f4dc0a3710","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17480.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd7db84b9052","org_name":"T-Mobile USA","org_type":"unknown","ransomware":null,"records_affected":772593,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17480.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-19","discovered_date":"2023-01-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"55055fed06e870fbd1db40fc3438ad6a2b6e95e0","impact_type":"unknown","incident_date":"2022-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20939e24c141","org_name":"Ferguson Wellman Capital Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":1751,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ferguson%20Wellman%20Capital%20Management%2C%20Inc.-2023-01-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2802e7fbc2dd7b806a8e4073ac3c61e035ea6555","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17448.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"60ea57a9ff3a","org_name":"Pierce County Auditor's Office","org_type":"government","ransomware":null,"records_affected":463000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17448.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17448.pdf"}],"summary":"An employee mistakenly provided a requester with voter registration data that included the last four digits of voters’ Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2023-01-18","discovered_date":"2022-12-20","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f165cb446b1d1baa4b93aa037b77b37521088a57","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Individual%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"9e452a5d67b7","org_name":"PayPal","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PayPal%2C%20Inc.-2023-01-18"}],"summary":"Unauthorized parties accessed PayPal customer accounts using login credentials and could view or potentially acquire some users’ personal information.","supporting_quote":"On December 20, 2022, we confirmed that unauthorized parties were able to access your PayPal customer account using your login credentials.","technology_involved":["PayPal customer account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2023-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"153cdf935f38f19e839a40e90ef5d59642965102","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17451.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8b10a28d5d93","org_name":"Morgan Industrial, Inc.","org_type":"unknown","ransomware":null,"records_affected":933,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morgan%20Industrial%2C%20Inc.%20dba%20Omega%20Morgan-2023-01-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17451.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d638e345aa385240638c5dbb04e27db4c46c0fc0","impact_type":"data_theft","incident_date":"2023-01-10","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/23-01-17%20-%20ODIN%20Intelligence%20-%20Data%20Security%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"3bac71b06209","org_name":"ODIN Intelligence, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561872"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/23-01-17%20-%20ODIN%20Intelligence%20-%20Data%20Security%20Breach%20Notice%20Letter.pdf"}],"summary":"ODIN Intelligence reported claims of unauthorized access to the SweepWizard app and stated that accessed data included personal information.","supporting_quote":null,"technology_involved":["SweepWizard"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b2ef14e4b5eca4fb73029e63e86d10bf184d2b1","impact_type":"data_theft","incident_date":"2022-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LAUSD%20California%20Notifications.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"42aff6237c6f","org_name":"Los Angeles Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564719"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561863"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LAUSD%20California%20Notifications.pdf"}],"summary":"An unauthorized actor accessed Los Angeles Unified School District systems, obtained data, and posted some of it to the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7fcec3d40836cb03c841020ebe102e6add9418e","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rundle%20Notification%20Letter%20-%20CA%20-_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f8d7b98ae20d","org_name":"Drs. Keith and Herman Rundle","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561856"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rundle%20Notification%20Letter%20-%20CA%20-_Redacted.pdf"}],"summary":"An unauthorized third party temporarily accessed Drs. Keith and Herman Rundle’s network environment, and an investigation found that personal and treatment information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"151617ec31839f294e07548c5543a64c6859a1a9","impact_type":"unknown","incident_date":"2023-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4656e975294","org_name":"Crist Biorn Shepherd Roskoph APC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561799"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3b8e42ddd63da67e71af851c5f64b5b6fa31180","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-26","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ind%20Notice%20Letter%20%28CA%29%2051372%20-%20Draft.pdf"},"notes":null,"org_country":"US","org_id":"0c20434d9e3b","org_name":"The Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561730"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ind%20Notice%20Letter%20%28CA%29%2051372%20-%20Draft.pdf"}],"summary":"The Prudential Insurance Company of America mistakenly emailed a spreadsheet containing personal information to internal and external contacts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f01c648f76feb02727fb1975c1375da5e3eb21fb","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elephant%20Insurance%20Services%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4993ec1ea345","org_name":"Elephant Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561734"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elephant%20Insurance%20Services%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Elephant%20Insurance%20Services%2C%20LLC-2023-02-27"}],"summary":"Elephant Insurance Services reported unauthorized access to certain employee email accounts on separate occasions between September 2021 and March 2022, with potentially affected personal information present in relevant emails.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-12","discovered_date":"2022-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1638145faae30d8ba4fe6ddbc1bff527f78110b","impact_type":"data_theft","incident_date":"2022-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/St.%20Rose%20Hospital%20-%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"3264c7ce9762","org_name":"St. Rose Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-571278"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561653"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/St.%20Rose%20Hospital%20-%20Sample%20Notice_0.pdf"}],"summary":"St. Rose Hospital reported that an unknown actor accessed computer systems and acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2023-01-12","discovered_date":"2023-01-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"219e6f73ac7f9b0ccbf2c923ef47f1358f360cf6","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17394.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"799263789250","org_name":"General Mills","org_type":"manufacturing","ransomware":null,"records_affected":18268,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17394.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17394.pdf"}],"summary":"General Mills reported that an unauthorized party used credentials obtained outside its systems to access BettyCrocker.com and may have accessed or acquired users’ personal information.","supporting_quote":"Our investigation determined that an unauthorized party likely obtained usernames (email addresses) and passwords from outside of General Mills’ sites and systems and, at certain times between November 18 and December 31, 2022, used these credentials to log into our BettyCrocker.com website.","technology_involved":["BettyCrocker.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5850ecb373d13bcddd7b8ef8b09dc13ffb4538a","impact_type":"unknown","incident_date":"2021-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LTR%20A%20Adult%20SSN%20-%20REDACTED%20%2810902811x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dcb3686d4afd","org_name":"TruConnect","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561594"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17370.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2023-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8ffea2b380557a8c2a0591a3def795e9c45df21","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Sample%20Notice%20Letters%20-%20MFHS.pdf"},"notes":null,"org_country":"US","org_id":"04530b3ec440","org_name":"Maternal and Family Health Services","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561479"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample%20Notice%20Letters%20-%20MFHS.pdf"}],"summary":"Maternal and Family Health Services reported a ransomware incident in which personal, financial, and medical information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7424414e5cf5dc9b7cac84dcbe1b0894f88b8e11","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20Customers.pdf"},"notes":null,"org_country":"US","org_id":"48fd4f4113a5","org_name":"Insulet Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20Customers.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17272.pdf"}],"summary":"Insulet reported that personal information in Omnipod DASH acknowledgment-page URLs was exposed to website performance and marketing partners through cookies or trackers.","supporting_quote":null,"technology_involved":["omnipod.com website","website cookies/trackers"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2023-01-10","discovered_date":"2022-07-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e92d2dd8d2c56151cd5eaf70ac8f250190a92876","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Community%20Psych_HIPAA%20General%20Notice%20Letter%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"fd903b96089b","org_name":"Community Psychiatry Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561512"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Community%20Psych_HIPAA%20General%20Notice%20Letter%20%28CA%29.pdf"}],"summary":"Community Psychiatry Management discovered unauthorized access to two employee email accounts, and protected health information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-09","discovered_date":"2022-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ffb0e21f8261765a369ce88cd5457af31fb5513","impact_type":"data_theft","incident_date":"2021-11-17","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Meriplex%20Communications%2C%20Ltd.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1b4bc0d4a0dd","org_name":"Meriplex Communications, Ltd.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee downloaded customer information without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561473"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Meriplex%20Communications%2C%20Ltd.%20-%20Sample%20Notice.pdf"}],"summary":"A former Meriplex employee downloaded customer information, including names and Social Security numbers, without authorization.","supporting_quote":"As a result of that investigation, Meriplex learned that certain information about some customers of Malaga Bank was downloaded by Meriplex’s former employee without authorization.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39e6e7190e442ee581f0d6154bbdb64b42211677","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"60e572f46c70","org_name":"SlideTeam","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SlideTeam","type":"hibp","url":"https://haveibeenpwned.com/Breach/SlideTeam"}],"summary":"SlideTeam records containing names, email addresses, and salted password hashes were breached in April 2021 and later published on a hacking forum.","supporting_quote":null,"technology_involved":["Magento"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2023-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0351d644b8971ceb97ebfd2cb62134b9616d4205","impact_type":"data_theft","imported_from":null,"incident_date":"2022-08-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":null,"org_country":"unknown","org_id":"2afce3505241","org_name":"DoorDash","org_type":"retail_ecommerce","ransomware":null,"records_affected":367476,"reviewed":false,"root_cause":"An unnamed third-party vendor was victim of a phishing campaign.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DoorDash","type":"hibp","url":"https://haveibeenpwned.com/Breach/DoorDash"}],"summary":"DoorDash reported that a phishing campaign targeting an unnamed third-party vendor led to exposure of customer personal and partial payment-card data.","supporting_quote":"DoorDash attributed the breach to an unnamed \"third-party vendor\" they stated was the victim of a phishing campaign.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":null,"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-05","discovered_date":null,"entry_asset":"api_or_integration_token","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3080987c6b5cae56191282ee9e7bc08053afc70","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Twitter (200M)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Twitter200M"}],"summary":"Data obtained by abusing a Twitter API in 2021 appeared on a hacking forum in early 2023.","supporting_quote":null,"technology_involved":["Twitter API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-05","discovered_date":"2022-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e7f4d098b3ecf8dc23acd83c125a27098d5a98","impact_type":"both","incident_date":"2022-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Knox%20College%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8d2945cae196","org_name":"Knox College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561334"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Knox%20College%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14508.pdf"}],"summary":"Knox College reported that an unknown actor accessed its network and obtained data in a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-03","discovered_date":"2022-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51a539851c8d176c7d2adcb0e3aa6df74fb7b7a0","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chula%20Vista%20-%20Letter%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"1f066b16de28","org_name":"City of Chula Vista","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561251"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chula%20Vista%20-%20Letter%20Proof.pdf"}],"summary":"The City of Chula Vista identified unauthorized access to certain systems and said data including names and addresses may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2023-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3756bedaa90a28c6350486be2e93ea96f9c50528","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-22","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8528f1387459","org_name":"Deezer","org_type":"technology_saas","ransomware":null,"records_affected":229037936,"reviewed":false,"root_cause":"A mid-2019 backup was exposed by a third-party partner.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Deezer","type":"hibp","url":"https://haveibeenpwned.com/Breach/Deezer"}],"summary":"Deezer customer data from a mid-2019 backup exposed by a third-party partner was later sold and redistributed.","supporting_quote":"The breach dated back to a mid-2019 backup exposed by a 3rd party partner which was subsequently sold and then broadly redistributed on a popular hacking forum.","technology_involved":["backup"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2023-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b70ed05df5336f95a3dc0086ca6c1243d23248c","impact_type":"unknown","incident_date":"2023-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55deabcc3635","org_name":"FIX'D Inc Veteran Service Organization","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561198"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2023-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37053c5a4bc7efe534b273fe6b6f850e66e1c330","impact_type":"data_theft","imported_from":null,"incident_date":"2019-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"RS","org_id":"d3455f926548","org_name":"Benchmark","org_type":"technology_saas","ransomware":null,"records_affected":93343,"reviewed":false,"root_cause":"The forum administrator attributed the breach to the forum running an outdated vBulletin instance.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Benchmark","type":"hibp","url":"https://haveibeenpwned.com/Breach/Benchmark"}],"summary":"Benchmark's forum breach exposed 93,343 records containing email and IP addresses, usernames, and salted-MD5-hashed passwords.","supporting_quote":"A forum administrator subsequently advised that the breach was due to the forum previously running on an outdated vBulletin instance .","technology_involved":["vBulletin","forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a30a0fb9204c007d79e00aa052c37aee7072f8cf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach.12.29.22_SAFE_Credit_Union.pdf"},"notes":null,"org_country":"US","org_id":"56b0f1d23116","org_name":"SAFE Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560555"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach.12.29.22_SAFE_Credit_Union.pdf"}],"summary":"SAFE Credit Union notified customers that debit or credit card information may have been exposed during ATM transactions in West Sacramento from October 1 through November 23, 2022.","supporting_quote":null,"technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2022-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9752878ab7648d047304bdf81b95e64206738de","impact_type":"data_theft","incident_date":"2022-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Notice_Dec2022.pdf"},"notes":null,"org_country":"US","org_id":"02b55c8991a9","org_name":"California Department of Finance","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560562"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Notice_Dec2022.pdf"}],"summary":"The California Department of Finance reported an intrusion in which data may have been obtained, including personnel information and credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d6aaecec2ae0124358a314dc7ae43ae0f8e9581","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Five%20Guys_CA%20Sample.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"c9cd5e8fc1cf","org_name":"Five Guys","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Five%20Guys_CA%20Sample.pdf"}],"summary":"Five Guys identified unauthorized access to files on a file server containing information submitted during the employment process.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-29","discovered_date":"2022-09-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3a19cd3e0abb15080b70c2ecc7d43b7b763ac8c","impact_type":"both","incident_date":"2022-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bay%20Bridge%20Administrators%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7ad1e24e3c91","org_name":"Bay Bridge Administrators, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560525"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bay%20Bridge%20Administrators%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bay%20Bridge%20Administrators%2C%20LLC-2022-12-29"}],"summary":"Bay Bridge Administrators experienced a network disruption and an unknown actor obtained data from its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd11a67d536bfe7f158a2fb29448ac6c1226cbda","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Information%20Governance%20-%202022%2012%2022%20-%20Benefit%20Wallet%20Data%20Breach%20Notification.pdf%20-%20All%20Documents.pdf"},"notes":null,"org_country":"US","org_id":"6d75496e6a48","org_name":"Southern California Edison Co.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Information%20Governance%20-%202022%2012%2022%20-%20Benefit%20Wallet%20Data%20Breach%20Notification.pdf%20-%20All%20Documents.pdf"}],"summary":"A Benefit Wallet representative inadvertently emailed a Southern California Edison retiree health reimbursement account report to another client, whose representative deleted it and attested to not using or sharing it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Benefit Wallet"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"2a829761aac1","name":"Benefit Wallet"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2022-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"db00c360aa87089331623e6846ed3256d47d761f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17130.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ceb222c94066","org_name":"Robert S Miller, LICSW, ACSW, PLLC","org_type":"unknown","ransomware":null,"records_affected":902,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17130.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-12-28","discovered_date":"2022-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01587ad3ce4319634a68b0e219e14ac940186787","impact_type":"both","incident_date":"2022-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elevate%20Services%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"383fbbb0aea7","org_name":"Elevate Services, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563989"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560470"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elevate%20Services%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"}],"summary":"Elevate Services reported that an unknown actor accessed and downloaded files from some of its systems, which were also rendered inaccessible by malicious file encryption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d424630fdc77c41ca856304512559609b85c0ae4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17136.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4d3539b91eec","org_name":"CellNetix Pathology and Laboratories","org_type":"healthcare","ransomware":null,"records_affected":1936,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17136.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17136.pdf"}],"summary":"CellNetix reported that an unauthorized party accessed a single employee’s business email account, potentially affecting personal and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27b945e0e70b07d626d5ce4f7296b5a5bcb342a1","impact_type":"unknown","incident_date":"2022-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSN%20Notice%20%28redacted%29%20%2810866948x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"df23dcd23fd4","org_name":"Sequoia Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560392"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSN%20Notice%20%28redacted%29%20%2810866948x7AB84%29.pdf"}],"summary":"An unauthorized individual may have accessed a Sequoia Federal Credit Union employee email account between July 13 and August 16, 2022.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-23","discovered_date":"2021-09-30","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a0d233e0f5b11172e27be6f6cc84386dfdc81b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-30","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IBW%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"33afa5c62267","org_name":"IBW Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560369"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IBW%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed an employee’s computer and opened files containing information relating to certain individuals.","supporting_quote":null,"technology_involved":["employee computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"066c2f8ce0c4d077514eb546d3f456cd0875f3a5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/03.23_Emtec%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"aabf7f56986a","org_name":"Emtec, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-564526"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563364"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560371"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/03.23_Emtec%20Sample%20Letter.pdf"}],"summary":"Emtec reported that personal information in certain data files was accessible to unauthorized third parties from September 7 to September 14, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-23","discovered_date":"2022-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f65a031980ee9dc4b78d7c93c34e25a9bb3b41d5","impact_type":"data_theft","incident_date":"2022-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20SSN%2012%20-%20REDACTED%20%2810868279x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"e38cd68d23fc","org_name":"Cincinnati State Technical Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560373"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20SSN%2012%20-%20REDACTED%20%2810868279x7AB84%29.pdf"}],"summary":"Cincinnati State Technical Community College reported that files containing personal information were removed from its network between October 30 and November 2, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"675e0368fdcae52875cdbd9941bc014083b64f62","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Your%20Patient%20Advisor%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e3aea0818be4","org_name":"Your Patient Advisor by Captify Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560354"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Your%20Patient%20Advisor%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15100.pdf"}],"summary":"Your Patient Advisor reported that its online customer ordering platform was compromised and customer information, including payment card details, may have been exposed.","supporting_quote":null,"technology_involved":["online customer ordering platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-22","discovered_date":"2022-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00694bb98af88df030635ad28e5d75f3b192baea","impact_type":"unknown","imported_from":null,"incident_date":"2022-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Steel%20River%20Systems%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d84e5c918880","org_name":"Steel River Systems, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560331"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Steel%20River%20Systems%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Steel%20River%20Systems%2C%20LLC-2022-12-22"}],"summary":"Steel River Systems reported unauthorized access and/or acquisition of data on certain systems between May 25 and July 16, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49ccbf7fd9dbfe033f0718ea3cc683e342c2da24","impact_type":"unknown","incident_date":"2022-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/IEM%20Final%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"814bfc106845","org_name":"Innovative Education Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560348"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86119a37f9b9516c0b533c6533607ffad5466f8d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Human%20Investing%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"d5435e895da2","org_name":"Human Investing","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560334"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Human%20Investing%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Human%20Investing-2022-12-22"}],"summary":"An unauthorized actor accessed a Human Investing employee’s email account, but the investigation could not determine whether any emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5abd0d674e6abf667b57ad3b8ccb924fbb80580a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_i7736_Blue%20Shield%20of%20California%20%234_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i7736_Blue%20Shield%20of%20California%20%234_L01_SAS_1.pdf"}],"summary":"A Blue Shield employee emailed a spreadsheet containing broker personal information to a personal email address.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-21","discovered_date":"2022-12-08","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec4867004e48481c7338db24f76b3148bf69a30a","impact_type":"data_theft","incident_date":"2022-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_job42179d06_EthosTechnologies%233_L02_SAS_1_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"bd73968c726c","org_name":"Ethos Technologies Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-574634"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_job42179d06_EthosTechnologies%233_L02_SAS_1_Redacted.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17035.pdf"}],"summary":"Unauthorized actors used Ethos’s online insurance application flow to obtain Social Security numbers through the website’s page source code.","supporting_quote":null,"technology_involved":["online insurance application","website","third-party integrated service"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"ad88493c74d264223626c5b7f85234d12357b42c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17058.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9bcef84f0a63","org_name":"BetMGM, LLC (\"BetMGM\")","org_type":"other","ransomware":null,"records_affected":2022,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BetMGM%2C%20LLC%20%28%22BetMGM%22%29-2022-12-21"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17058.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560309"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BetMGM%20-%20Individual%20Notice_California.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/BetMGMLLC.pdf"}],"summary":"BetMGM reported that patron records containing personal and transaction information were obtained in an unauthorized manner.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15af40a0573576b915255b08487eb62d94401eb0","impact_type":"both","incident_date":"2022-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20of%20Data%20Security%20Incident%20-%20December%20%2015%2C%202022%20%5BSample%20for%20CA%20DOJ%5D.pdf"},"notes":null,"org_country":"US","org_id":"370283aff251","org_name":"JAKKS Pacific, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560270"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20of%20Data%20Security%20Incident%20-%20December%20%2015%2C%202022%20%5BSample%20for%20CA%20DOJ%5D.pdf"}],"summary":"A ransomware attack locked JAKKS Pacific’s servers, and someone accessed at least some employee records without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-19","discovered_date":"2021-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72f53e673fce8503209523237b1ea90a09afac89","impact_type":"data_theft","incident_date":"2021-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/P2%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a8b5e1cd0c5b","org_name":"P2 Energy Solutions","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560230"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/P2%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA17016.pdf"}],"summary":"P2 Energy Solutions determined that an unauthorized party accessed and acquired files containing individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc046f4675b130822c3dbc348ced6c98269bca81","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MedStar%20Template%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2fcd53e40e63","org_name":"MedStar Mobile Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560237"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MedStar%20Template%20Notice.pdf"}],"summary":"MedStar Mobile Healthcare reported that an unauthorized third party accessed a restricted location containing files with personal health information, but it could not confirm the files were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-16","discovered_date":"2022-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d77ac8dca7707119dcc41fb050fbdb82a501e9b","impact_type":"unknown","incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16965.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1413fae50396","org_name":"Snohomish County Public Utility District No. 1","org_type":"energy_utilities","ransomware":null,"records_affected":1132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16965.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16965.pdf"}],"summary":"Snohomish County Public Utility District investigated fraudulent credit card applications reported by employees and a possible compromise of employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-16","discovered_date":"2022-09-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34a2680adfd6c23d873c82fd30e8a1beffa1556e","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keck%20Medicine%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5e2152498053","org_name":"Keck Medicine of USC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560177"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keck%20Medicine%20-%20Sample%20Notice.pdf"}],"summary":"Keck Medicine of USC reported unauthorized access to a provider’s work email account on September 30, 2022, which may have contained personal or protected health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf84be3204e899ca8b9390a514e44702960b88b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult_redeactedcopy.pdf"},"notes":null,"org_country":"US","org_id":"6df757fafd61","org_name":"Hope College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult_redeactedcopy.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hope%20College-2022-12-16"}],"summary":"Hope College reported potential unauthorized access to its network and said personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d2561c2304071259e74122584591d9297f09a04","impact_type":"data_theft","imported_from":null,"incident_date":"2022-12-13","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"41a5914d8f98","org_name":"Gemini","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A social engineering attack targeting Twilio employees was designed to steal employee credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gemini","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gemini"}],"summary":"Data attributed to Gemini customers was traced to a Twilio incident involving data processed through its Authy service.","supporting_quote":"Twilio described the incident as stemming from a sophisticated social engineering attack designed to steal employee credentials .","technology_involved":["Twilio","Authy"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Twilio"},"updated_at":null,"veris_action":"social","derived":{"vendors":[{"id":"12440b41f0c4","name":"Twilio"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-16","discovered_date":"2022-08-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"847814d041aa2ea6469f93a2f3d706474bc6fdad","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20Individuals%20%28272344852.1%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4ffa32468e96","org_name":"Everest Global Services, Inc.","org_type":"financial","ransomware":null,"records_affected":5871,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Everest%20Global%20Services%2C%20Inc.-2022-12-16"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20Individuals%20%28272344852.1%29.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20Individuals%20%28272344852.1%29.pdf"}],"summary":"Everest Global Services identified unauthorized access to five email accounts, and a review found that personal information may have been present in a compromised account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-15","discovered_date":"2022-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c189103b17a95d6becc448960c9324b8e2d064d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Order%20Express%20Notice%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"2ecfb49c37e1","org_name":"Order Express, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560121"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20Order%20Express%20Notice%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16959.pdf"}],"summary":"Order Express, Inc. reported that an unknown party accessed parts of its computer network without authorization between July 29 and September 7, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-14","discovered_date":"2022-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b53ef8e56c42e2d5367a9d58d58aea160e65da5e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TEH%20-%20Ex.%20A.pdf"},"notes":null,"org_country":"US","org_id":"567c1fbe61f7","org_name":"The Elizabeth Hospice","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560055"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TEH%20-%20Ex.%20A.pdf"}],"summary":"The Elizabeth Hospice reported that a former employee forwarded emails from her business account to a personal account, potentially exposing patient information.","supporting_quote":null,"technology_involved":["business email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c433f7fc20f08a9e211c156fbb11d20b3db621dd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/KEMETElectronicsCorporation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b19b737bd1a","org_name":"KEMET Electronics Corporation","org_type":"unknown","ransomware":null,"records_affected":1670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/KEMETElectronicsCorporation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a555068cdbcf836437d487c15945b3181da3197","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HRAllenInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c00638ace83","org_name":"H.R. Allen, Inc.","org_type":"unknown","ransomware":null,"records_affected":1585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HRAllenInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-13","discovered_date":"2022-12-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3a4d54a275e91b8a098b852932dc754ff985f2e","impact_type":"unknown","incident_date":"2022-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"74e278c29a8d","org_name":"Pine Ridge Investment Corp","org_type":"unknown","ransomware":null,"records_affected":873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pine%20Ridge%20Investment%20Corp%20dba%20General%20Tree%20Service-2022-12-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6111b237640153a3b767ab1e715381af51e0fdbf","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hartnell%20College-%20Exhibits%20for%20CA%20AG-%20final.pdf"},"notes":null,"org_country":"US","org_id":"7e6783c6462c","org_name":"Hartnell Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560017"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hartnell%20College-%20Exhibits%20for%20CA%20AG-%20final.pdf"}],"summary":"Hartnell Community College District reported that network segments were accessed and potentially impacted files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-12","discovered_date":"2022-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee883e49957a6bd95ad5b9e342b1d943bcc49ddd","impact_type":"data_theft","incident_date":"2021-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sophia%20Institute%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0f565b7e0c0a","org_name":"Sophia Institute Press","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sophia%20Institute%20-%20Sample%20Notice.pdf"}],"summary":"Sophia Institute Press reported that malware may have stolen customers’ payment card information from its e-commerce websites.","supporting_quote":null,"technology_involved":["e-commerce websites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef18543631e570b609a4f44878bebc9d5a461ac8","impact_type":"unknown","incident_date":"2022-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cf543c3d462","org_name":"Sequoia One PEO LLC and delivering notice","org_type":"unknown","ransomware":null,"records_affected":580818,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sequoia%20One%20PEO%20LLC%20and%20delivering%20notice%20on%20behalf%20of%20clients%20of%20Sequoia%20Benefits%20and%20Insurance%20LLC-2022-12-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1530"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a978683adac1a0bed1e6f9c446d1cafca1718c73","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sequoia%20-%20Sample%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"45f39d9abdba","org_name":"Sequoia One PEO LLC","org_type":"professional_services","ransomware":false,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sequoia%20-%20Sample%20Notices.pdf"}],"summary":"An unauthorized party accessed information in a cloud storage system used by Sequoia One PEO LLC, with no evidence that data was misused or distributed.","supporting_quote":null,"technology_involved":["cloud storage system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-12-12","discovered_date":"2022-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a2e9b058f60a1be19deef5adc3ac103d1361d3d","impact_type":"data_theft","incident_date":"2022-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SDUSD_Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"474a8309abe2","org_name":"San Diego Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-572286"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559947"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SDUSD_Sample%20Notice.pdf"}],"summary":"San Diego Unified School District discovered unauthorized access to some systems, and an investigation determined that files containing potentially personal, health plan, and direct deposit information were taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdff5dcc1426b69d0888fe69c6fc428256987a15","impact_type":"data_theft","incident_date":"2022-12-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d419106927ff","org_name":"CoinTracker","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"CoinTracker attributed the breach to a compromise of SendGrid, its email provider.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CoinTracker","type":"hibp","url":"https://haveibeenpwned.com/Breach/CoinTracker"}],"summary":"CoinTracker reported a breach involving customer email addresses and partially redacted phone numbers attributed to a compromise of SendGrid.","supporting_quote":"The company later attributed the breach to a compromise SendGrid in an attack that targeted multiple customers of the email provider.","technology_involved":["SendGrid"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"SendGrid"},"veris_action":"hacking","derived":{"vendors":[{"id":"e0807e06316c","name":"SendGrid"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a6a1ab587b6fffb44938ce317f1a989905e24dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SequoiaBenefitsandInsuranceServicesLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a4ae1e2bfa6","org_name":"Sequoia Benefits and Insurance Services LLC","org_type":"unknown","ransomware":null,"records_affected":20949,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SequoiaBenefitsandInsuranceServicesLLC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16856.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7dc32c4186a8dd0fdeed3488942fdb9d89ced4f","impact_type":"disruption_or_ransomware","incident_date":"2022-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RFI%20AG%20Notice%20Letter_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"c2604edd84d7","org_name":"RFI Communications","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559907"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RFI%20AG%20Notice%20Letter_Redacted.pdf"}],"summary":"RFI Communications reported that a ransomware incident affected its computer systems and may have exposed personal information of current and former customers and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ebd62c61179b4af71030ca32f5cd01b3e4777d6","impact_type":"data_theft","incident_date":"2022-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bargain%20Balloons%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"02e4642d55d6","org_name":"Bargain Balloons","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559898"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561985"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bargain%20Balloons%20Sample%20Notice.pdf"}],"summary":"Bargain Balloons said malicious code on its website skimmed customer information entered at checkout.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"339d706b78f194faabc3da810cb2e674fbcf8339","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Veros%20Credit-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"eaf70235bea1","org_name":"Veros Credit","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Veros%20Credit-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16783.pdf"}],"summary":"Veros Credit reported a cybersecurity incident in which personal information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-12-07","discovered_date":"2022-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a5ef3f2adb5b90579e007ad67ec9fe737279e8d","impact_type":"data_theft","incident_date":"2022-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SGMH%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"be8676eb1799","org_name":"San Gorgonio Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559803"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SGMH%20-%20California%20Notification.pdf"}],"summary":"San Gorgonio Memorial Hospital reported that an unauthorized party accessed its network and copied documents containing patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-12-07","discovered_date":"2022-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"958f52808e60734820f1168360d6164a218e5081","impact_type":"data_theft","incident_date":"2022-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16766.pdf"},"notes":null,"org_country":"US","org_id":"0275cd013a57","org_name":"SAIF Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SAIF%20Corporation-2022-12-07"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16766.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16766.pdf"}],"summary":"SAIF Corporation reported that an unauthorized third party accessed its network and may have acquired files containing policyholder and claimant information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2693d5d4e93f60566cd356c46a4d841b3a86f137","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"38514ee07e9c","org_name":"Abandonia","org_type":"other","ransomware":null,"records_affected":919790,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Abandonia (2022)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Abandonia2022"}],"summary":"Abandonia reported exposure of 919,790 user records containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-06","discovered_date":"2022-11-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec27cb984ba88d90ed426cfa967284ceaf226237","impact_type":"unknown","incident_date":"2022-09-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a43739fb5146","org_name":"JPCCPA LLC","org_type":"unknown","ransomware":null,"records_affected":450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JPCCPA%20LLC-2022-12-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb82bd12196ba6a59ecbfde89c38486ad8052bf1","impact_type":"data_theft","incident_date":"2020-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Acuity%20-%20CA%20AG%20SAMPLE%20LETTER.pdf"},"notes":null,"org_country":"US","org_id":"d9b63966fe27","org_name":"Acuity Brands, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559772"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Acuity%20-%20CA%20AG%20SAMPLE%20LETTER.pdf"}],"summary":"Acuity Brands reported that an unauthorized person copied files containing personal information during an incident in October 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b9b9e8b527383937263bc9a19766858098fb7884","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SnapFinanceLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd3109f54cf3","org_name":"Snap Finance LLC | Snap RTO LLC","org_type":"unknown","ransomware":null,"records_affected":2863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SnapFinanceLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-05","discovered_date":"2022-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"882201635a7def29a8554003e88b5dcd2f9841c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BGA%20Holdings%20Co.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e306a31f61ad","org_name":"Black, Gould & Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559733"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BGA%20Holdings%20Co.%20-%20Sample%20Notice.pdf"}],"summary":"Black, Gould & Associates, Inc. discovered unauthorized access to its environment, and files containing individuals’ names were present during the access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25ab4fb8e226d0d705ed2ae430c27b1746727ce6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16692.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e228192a8850","org_name":"Snap Finance LLC and Snap RTO LLC","org_type":"financial","ransomware":null,"records_affected":1266,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Snap%20Finance%20LLC%20and%20Snap%20RTO%20LLC-2022-12-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16692.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16692.pdf"}],"summary":"Snap reported unauthorized access to its environment from June 23 through September 8, 2022, during which an actor could access information including personal and financial details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ad78663aa3d67e43bd80215e05277ba61698ba4","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Snap%20RTO%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a1ae0c3179b0","org_name":"Snap Finance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Snap%20RTO%20LLC%20-%20Sample%20Notice.pdf"}],"summary":"Snap discovered unauthorized access to its environment, where an actor could access information including names, Social Security numbers, identification numbers, and financial account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-01","discovered_date":"2022-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31359995077da444b5e7536cf3da8257ae88baff","impact_type":"both","incident_date":"2022-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Macmillan-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6b434b0ed0a6","org_name":"Macmillan","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559661"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Macmillan-%20Sample%20Notice.pdf"}],"summary":"Macmillan reported that information including personal information was accessed and taken from its U.S. systems while certain files were encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"222755e8a21b1567efbaa2135e8b7526faf23f9c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DataPath%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"945cd5087e66","org_name":"DataPath, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559656"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DataPath%20-%20Sample%20Notice.pdf"}],"summary":"DataPath reported that an unauthorized party accessed certain systems and may have accessed or acquired data including individuals’ names and addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-12-01","discovered_date":"2022-10-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"72b9a5f5d85c33ea9126adb92b2fe1fed44a3921","impact_type":"both","incident_date":"2022-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16622.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"067a0f05d90e","org_name":"CommonSpirit Health","org_type":"healthcare","ransomware":true,"records_affected":581968,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16622.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16622.pdf"}],"summary":"CommonSpirit Health detected a ransomware attack, and an unauthorized third party obtained copies of data from file share servers.","supporting_quote":null,"technology_involved":["file share servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad90878abeec543f4e196893ec3f4320007b1b49","impact_type":"unknown","incident_date":"2022-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted_-_Letter_B_32064296v1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1bce3dd5e8b4","org_name":"Suffolk University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-567241"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559608"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-29","discovered_date":"2022-10-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9027c03b9064c89e5eb984435826794dc6f57ae","impact_type":"unknown","incident_date":"2022-01-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af9ec124e653","org_name":"Klamath County","org_type":"unknown","ransomware":null,"records_affected":547,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Klamath%20County-2022-11-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-29","discovered_date":"2022-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56b90d664c781d94d615dffd0cd217ab3891068c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ATS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0ae1cf02128c","org_name":"Alvarez Tax Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559578"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ATS%20-%20California%20Notification.pdf"}],"summary":"Alvarez Tax Services reported that an unauthorized party accessed and may have acquired files during an incident that temporarily affected computer-system availability.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-28","discovered_date":"2022-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c10024f35eade8809f7e38a86d1e59a7d1588f55","impact_type":"unknown","incident_date":"2022-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16463.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"11fc9d466218","org_name":"Vaupell Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":1009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16463.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16463.pdf"}],"summary":"Vaupell Holdings identified malware on certain computer systems, and its investigation found that personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2022-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f998bdb1edf58514537ec695b9f7b23e876612fe","impact_type":"data_theft","incident_date":"2020-11-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16427.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fadd8805aa7d","org_name":"loanDepot.com, LLC","org_type":"financial","ransomware":null,"records_affected":801,"reviewed":false,"root_cause":"A then-current employee unauthorizedly acquired mortgage loan data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16427.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16427.pdf"}],"summary":"A then-current loanDepot employee unauthorizedly acquired mortgage loan data for a small subset of customers.","supporting_quote":"What happened? loanDepot recently became aware of the unauthorized acquisition of mortgage loan data for a small subset of customers by a then-current, now former, employee.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-11-23","discovered_date":"2022-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33376578cd414268aa154a3ba759515dc5716b1d","impact_type":"data_theft","incident_date":"2022-07-25","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16418.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6f5460ee37bd","org_name":"Legacy Health","org_type":"healthcare","ransomware":null,"records_affected":1608,"reviewed":false,"root_cause":"An employee transferred Legacy Health files to personal storage without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16418.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16418.pdf"}],"summary":"A Legacy Health employee transferred files containing personal and medical information to personal storage without authorization.","supporting_quote":"On July 25, 2022, our Privacy Office learned that an employee in our cytogenetics lab had saved Legacy Health files to external devices without authorization.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-23","discovered_date":"2022-07-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f14cab0460943ca4d305021dfd3c9bb820eb152a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Johnson%20County%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8ede16b7010a","org_name":"Johnson County, Texas","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A County file was inadvertently left publicly available during a data migration project.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Johnson%20County%20-%20Sample%20Notice.pdf"}],"summary":"Johnson County reported that a file left publicly available on a third-party website during a data migration project may have been accessed without authorization.","supporting_quote":"This investigation determined that one file belonging to the County was inadvertently left publicly available during a data migration project and may have been accessed without authorization as a result.","technology_involved":["third-party website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-23","discovered_date":"2022-08-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5cf67b49c7e67db1797d8d0a23e281c8a6677425","impact_type":"unknown","incident_date":"2022-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2272946b1b2d","org_name":"Columbia Grain International, LLC","org_type":"unknown","ransomware":null,"records_affected":3710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20Grain%20International%2C%20LLC-2022-11-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a9bf21089929d27c350fb9c5b2426c99dbfdb5d","impact_type":"data_theft","incident_date":"2020-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"6ee6c32785d0","org_name":"Not Acxiom","org_type":"unknown","ransomware":null,"records_affected":51730831,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Not Acxiom","type":"hibp","url":"https://haveibeenpwned.com/Breach/NotAcxiom"}],"summary":"In 2020, a corpus of data containing almost a quarter of a billion records spanning over 400 different fields was misattributed to database marketing company Acxiom and subsequently circulated within the hacking community. On review, Acxiom concluded that \"the claims are indeed f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"add2a3873dce238dc8d3c666a3df1502770e7841","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CenturyAluminumCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff98684d1101","org_name":"Century Aluminum Company","org_type":"unknown","ransomware":null,"records_affected":2916,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CenturyAluminumCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-21","discovered_date":"2021-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de88de2ca2fb70cd310f0dea6fba75c5d4ff542c","impact_type":"disruption_or_ransomware","incident_date":"2021-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"64a877650eb2","org_name":"Receivables Performance Management LLC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Receivables%20Performance%20Management%20LLC-2022-11-21"}],"summary":"Receivables Performance Management LLC reported ransomware that took its systems offline, and its review found personal information including Social Security numbers in files that may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-11-18","discovered_date":"2022-05-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e05c597cde36051cd4e170bbd06d26961e39b95","impact_type":"disruption_or_ransomware","incident_date":"2022-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WF%20-%20Individual%20Notification%20Letter%20-%20Patient%20Multistate%20FINAL%2011.11.22_1.pdf"},"notes":null,"org_country":"US","org_id":"13c35ad84e6c","org_name":"Wright & Filippis","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559337"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WF%20-%20Individual%20Notification%20Letter%20-%20Patient%20Multistate%20FINAL%2011.11.22_1.pdf"}],"summary":"Wright & Filippis detected and terminated ransomware in January 2022, and later discovered that files or accounting records may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8c803b019850293f0f8a8a830813ffda57abd14","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCHCS%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559342"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCHCS%20-%20Sample%20Notice.pdf"}],"summary":"California Correctional Health Care Services reported that a seniority list containing staff names and truncated Social Security numbers was posted on an internal nursing shared drive and in a nursing operations office.","supporting_quote":null,"technology_involved":["internal nursing shared drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cef100d854fb527704f3ab8e16e88d68d58ab994","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559336"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Letter.pdf"}],"summary":"A third-party service provider reported a cyberattack, and American Express later confirmed that some customer information was impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-17","discovered_date":"2022-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d264cd3341a1a5775a11a8629ef27a00f78da121","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tehama%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"6634b6cab2b8","org_name":"County of Tehama","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559306"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tehama%20-%20California%20Notification.pdf"}],"summary":"The County of Tehama reported that an unauthorized party accessed files on its Department of Social Services systems containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-16","discovered_date":"2022-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ec08990b6172c91a8be5c5393ff8a0af1466bf8","impact_type":"both","incident_date":"2022-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_i6104_IST%20Management%20Services_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"a4b23fae169e","org_name":"Innovative Service Technology Management Services, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559256"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i6104_IST%20Management%20Services_L01_SAS_0.pdf"}],"summary":"Innovative Service Technology Management Services, Inc. reported a ransomware attack in which an unauthorized actor accessed its computer system and may have acquired files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-15","discovered_date":"2022-09-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cf57b92aca87c7e7a160bfd4db58f6706d2f38a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f6551281fb18","org_name":"Simmons Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559207"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification.pdf"}],"summary":"Simmons Bank said customer data may have been accessed or acquired during an incident affecting its vendor’s file-sharing provider, AMS Collaborator.","supporting_quote":"On September 21, 2022, Simmons Bank was informed by its vendor, Mayer Brown LLP, of a cybersecurity incident affecting Mayer Brown’s vendor, AMS Collaborator, which provides a file sharing service.","technology_involved":["AMS Collaborator","file sharing service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMS Collaborator"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"85c29cb475d3","name":"AMS Collaborator"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-15","discovered_date":"2022-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"2a8084cf6915c466abd192714b12e01ebf61771b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16232.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"63b4a9d84270","org_name":"Pro-Tem, Inc.","org_type":"unknown","ransomware":null,"records_affected":677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pro-Tem%2C%20Inc.%20dba%20PTI%20Systems-2022-11-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16232.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559230"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PTI%20Systems%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16232.pdf"}],"summary":"Pro-Tem, Inc. reported that an unknown actor accessed files on PTI Systems’ network, including a file containing sensitive personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a6b6a1d842e28e6d6d3880c483f18b7ab142a4c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-06","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pacific%20Union%20College%20-%20SSN%20%5Bredacted%5D%20%2810787858x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"d66704799064","org_name":"Pacific Union College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559239"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pacific%20Union%20College%20-%20SSN%20%5Bredacted%5D%20%2810787858x7AB84%29.pdf"}],"summary":"Pacific Union College reported that an unauthorized individual may have accessed a limited number of employee email accounts between July 6, 2021 and February 25, 2022.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2022-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e97c27b02b05f4795139314bbe874cd2aad8c62a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"01e426854a3c","org_name":"Get Revenge On Your Ex","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Get Revenge On Your Ex","type":"hibp","url":"https://haveibeenpwned.com/Breach/GetRevengeOnYourEx"}],"summary":"A data breach at Get Revenge On Your Ex exposed personal information, purchase histories and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb659ba714006154beb0f3826ee45868354cb72b","impact_type":"unknown","incident_date":"2022-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Commonwealth_CA%20Sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae6164357970","org_name":"CCA Health Plans of California, Inc. d/b/a CCA Health California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559229"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-11-14","discovered_date":"2022-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bf33bd6b7d386548fe48db08475ea8b1dd7c2459","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16211.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1b7380cb2ff6","org_name":"Yakima Neighborhood Health Services","org_type":"healthcare","ransomware":null,"records_affected":2664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16211.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16211.pdf"}],"summary":"Yakima Neighborhood Health Services reported that a file containing personal and protected health information was inadvertently distributed to one individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-11-14","discovered_date":"2022-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21a3e1b143d22ee5acc082b99f0b717990757e97","impact_type":"data_theft","incident_date":"2022-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HIPAA%20Individual%20Notification%20Letter%20%28IM%29.pdf"},"notes":null,"org_country":"US","org_id":"498f65d6b48a","org_name":"Connexin Software, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559176"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HIPAA%20Individual%20Notification%20Letter%20%28IM%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Connexin%20Software%2C%20Inc.-2022-11-14"}],"summary":"Connexin Software reported that an unauthorized party accessed and removed some patient data from an offline dataset used for data conversion and troubleshooting.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":["T1213"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a07768025ad3f3fe43c06bc48b4d2d1f9e953076","impact_type":"data_theft","incident_date":"2022-04-14","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BAH%20-%20Consumer%20Notification%20Template%20-%20CA.PDF"},"notes":null,"org_country":"US","org_id":"6f9c3523d563","org_name":"Booz Allen Hamilton","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee obtained and downloaded the internal report in direct contradiction of company policies.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BAH%20-%20Consumer%20Notification%20Template%20-%20CA.PDF"}],"summary":"A former Booz Allen Hamilton employee downloaded an internal report from a SharePoint site that contained personal information.","supporting_quote":"We recently learned that a former employee, while still employed at the Company and in direct contradiction of Booz Allen’s policies, training, purpose, and values, obtained and downloaded a copy of an internal report that was improperly stored on an internal SharePoint site.","technology_involved":["SharePoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7ad32ca322fb298db6c73e2020c015417917125","impact_type":"disruption_or_ransomware","incident_date":"2022-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sierra%20College%20-%20Notification%20Letter%20Phase%20Two%20%28CA%29_static%20proof%20r1.pdf"},"notes":null,"org_country":"US","org_id":"29b040f216c6","org_name":"Sierra College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562724"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559135"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sierra%20College%20-%20Notification%20Letter%20Phase%20Two%20%28CA%29_static%20proof%20r1.pdf"}],"summary":"Sierra College reported that ransomware encrypted some systems and that an unauthorized individual accessed a computer system storing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"acf1abb40ef370ac9243e25a02e39a573d61d73b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0773cd562d1","org_name":"Duke Energy Carolinas, LLC","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Duke%20Energy%20Carolinas%2C%20LLC-2022-11-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85caa9faf3168bc8860002febabf7251ddb79c5f","impact_type":"unknown","incident_date":"2022-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Work%20Health%20Solutions%20-%20CA%20SSN%20%28redacted%29%20%2810780698x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91f98d041fc0","org_name":"Work Health Solutions","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559087"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-11-09","discovered_date":"2022-08-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1938f787fd70992337da15460fca3eef8fec1de5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TRPN_Sample_Notification_Letter_10.15.2022.pdf"},"notes":null,"org_country":"US","org_id":"44e9d7e5f3e0","org_name":"Three Rivers Provider Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-570682"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559086"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TRPN_Sample_Notification_Letter_10.15.2022.pdf"}],"summary":"Three Rivers Provider Network identified unauthorized access to an employee email account, and personal information may have been accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6ac0299f6be009b85b21b5e116b7a4ac726a987","impact_type":"disruption_or_ransomware","incident_date":"2022-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Notice%20of%20Data%20Breach%20-%20Pitman%20Farms%20%28CA%2C%20UT%20and%20ID%29%20%28662116%29.pdf"},"notes":null,"org_country":"US","org_id":"c1713f22af46","org_name":"Pitman Farms","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559047"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Notice%20of%20Data%20Breach%20-%20Pitman%20Farms%20%28CA%2C%20UT%20and%20ID%29%20%28662116%29.pdf"}],"summary":"Pitman Farms reported an attempted ransomware attack that may have affected system availability and involved files claimed to contain personal and bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc31a858b553065bcfd7c91138b3c55b9ffcb683","impact_type":"unknown","incident_date":"2022-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"ba5c1f16a8cf","org_name":"GGCorp","org_type":"unknown","ransomware":null,"records_affected":2376330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GGCorp","type":"hibp","url":"https://haveibeenpwned.com/Breach/GGCorp"}],"summary":"In August 2022, the MMORPG website GGCorp suffered a data breach that exposed almost 2.4M unique email addresses . The data also included IP addresses, usernames and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"732c7b871c56c83d42ea402c8d438f57155ed58c","impact_type":"unknown","incident_date":"2022-09-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sweetwater%20Union%20High%20School%20District%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6eb9cba1cdf","org_name":"Sweetwater Union High School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559027"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-07","discovered_date":"2022-07-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"132677c02b4e661644abbbb2e30360c0daedb207","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Camping%20World%20-%20Adult%201%20Yr%20CM%20Letter%20Template.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbafc691838d","org_name":"CWGS Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":30172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CWGS%20Group%20%28%E2%80%9CCWGS%E2%80%9D%29-2022-11-07"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Camping%20World%20-%20Adult%201%20Yr%20CM%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Camping%20World%20-%20Adult%201%20Yr%20CM%20Letter%20Template.pdf"}],"summary":"CWGS Group reported that an unknown third party accessed its systems and that personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b173438f4b8998dcebf6bcebc8d056302277f165","impact_type":"data_theft","imported_from":null,"incident_date":"2018-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"ca4d344332cb","org_name":"Lolzteam","org_type":"other","ransomware":null,"records_affected":398011,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lolzteam","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lolzteam"}],"summary":"A breach of the Lolzteam forum exposed member usernames and email addresses, which were later redistributed on another forum.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials","other"],"disclosed_date":"2022-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd6dbfcee759c499d47b5ec5ef7cf0aee91bddc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Salud%20Family%20Health%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ab79d4bbc9e0","org_name":"Salud Family Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558958"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Salud%20Family%20Health%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Salud%20Family%20Health-2022-11-04"}],"summary":"Salud Family Health reported unauthorized access to systems on September 5, 2022, and said certain data may have been accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-03","discovered_date":"2022-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d28a0e2d2c112758a7dc72a13cda274a33f1b1c2","impact_type":"data_theft","incident_date":"2022-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sanford%20Heisler%20Sharp%2C%20LLP%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"240d0362859a","org_name":"Sanford Heisler Sharp, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-562226"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sanford%20Heisler%20Sharp%2C%20LLP%20-%20Sample%20Notice_1.pdf"}],"summary":"Sanford Heisler Sharp, LLP reported unauthorized access to computer systems and access to or acquisition of files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-02","discovered_date":"2022-09-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e5217e20121f2a25f5a1a3b090283c1cfd16ac6f","impact_type":"unknown","incident_date":"2021-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"df9d5ba8c90b","org_name":"Wasco Title Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wasco%20Title%20Inc-2022-11-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e23eb6a166195ab9d54810e48d58975c8c6cb19d","impact_type":"data_theft","imported_from":null,"incident_date":"2021-09-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20to%20Employees%20Letterhead%20%28DB%20edits%29%28AHS%20edits%29%2872859190.2%29%20-%20V3%20Proof.pdf"},"notes":"actor name 'Tim DeHaven and Erik Duzell, Sr.' not in source; cleared","org_country":"US","org_id":"c5eb08c6bb77","org_name":"My Life Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees used their positions and access to provide 3D Supports, LLC unauthorized access to company files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558839"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20to%20Employees%20Letterhead%20%28DB%20edits%29%28AHS%20edits%29%2872859190.2%29%20-%20V3%20Proof.pdf"}],"summary":"My Life Foundation reported that employees accessed and downloaded company files, including personal and financial information, and provided 3D Supports, LLC unauthorized access.","supporting_quote":"My team and I suspected that a former employee, Tim DeHaven, and then-current employee, Erik Duzell, Sr., were conspiring to steal company files from My Life Foundation by improperly using their position and access to illegally provide 3D Supports, LLC unauthorized access to employee information.","technology_involved":["Yahoo account"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"3D Supports, LLC"},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"vendors":[{"id":"241c1e2dc601","name":"3D Supports, LLC"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-11-02","discovered_date":"2022-08-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"218a8b70278ef8c5a2a6aef6783d2ec0a47d4f35","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ethos%20Group%20-%20Regulator%20Notice%20-%20Ex.%20A%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"1b3123f4632d","org_name":"Ethos Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ethos%20Group%20-%20Regulator%20Notice%20-%20Ex.%20A%20-%20CA.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ethos%20Group%2C%20Inc.-2022-11-02"}],"summary":"Ethos Group determined that consumer information, including names and driver’s license numbers, was accessed between July 30 and July 31, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2022-11-01","discovered_date":"2022-09-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"fc6f3a4d38886b89f6079202ecc36d40caac646c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PathwardN.A..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb39fff7ff39","org_name":"Pathward, N.A.","org_type":"financial","ransomware":null,"records_affected":2639,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pathward%2C%20N.A.-2022-11-01"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PathwardN.A..pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15980.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558767"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Sample%20Letter%20%28Non-MA%2010.31.2022%29.pdf"}],"summary":"Unauthorized acquisition of Pathward Prepaid Card profile and card information occurred through MyPrepaidCenter.com.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-11-01","discovered_date":"2022-08-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"311b3378983e4c715f1442e7b6b5bbc588501a42","impact_type":"unknown","incident_date":"2022-08-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2178ba261590","org_name":"Native American Rehabilitation Association of the NW","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Native%20American%20Rehabilitation%20Association%20of%20the%20NW-2022-11-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e5d65380ef3d5c951afb296c8f92f07134bc287","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lodi-%20Exhibit%20A-%20CA%20AG.pdf"},"notes":null,"org_country":"US","org_id":"e495538ee4a7","org_name":"Lodi Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lodi-%20Exhibit%20A-%20CA%20AG.pdf"}],"summary":"Lodi Unified School District reported unauthorized access to an account in its Aeries student record management application, potentially exposing names and medical information.","supporting_quote":null,"technology_involved":["Aeries"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93a5b92f1efe9662d4237b15728d752987872483","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2022-06-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Project%20Wolf%20-%20FINAL%20-%20Gen-1%20Gen-2%20Combined.pdf"},"notes":null,"org_country":"US","org_id":"66cba6e6cd66","org_name":"Convergent Outsourcing, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558788"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Project%20Wolf%20-%20FINAL%20-%20Gen-1%20Gen-2%20Combined.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Convergent%20Outsourcing%2C%20Inc.-2022-11-02"}],"summary":"Convergent Outsourcing reported that an external actor accessed its systems, deployed ransomware, and placed data extraction tools on an internal storage drive.","supporting_quote":null,"technology_involved":["internal file storage drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-11-01","discovered_date":"2022-09-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c53c04a0db43a36f04b7e822d257c81d6ad84a0","impact_type":"data_theft","incident_date":"2022-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13994.pdf"},"notes":null,"org_country":"US","org_id":"fab15c12eaba","org_name":"Alta Forest Products, LLC","org_type":"manufacturing","ransomware":null,"records_affected":1635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13994.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13994.pdf"}],"summary":"Alta Forest Products reported that an unauthorized actor accessed and/or acquired files on its servers containing personal, financial, and health plan information.","supporting_quote":null,"technology_involved":["servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-31","discovered_date":"2022-07-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82f925a6eb10c2aa2406fc0a9a56eeffaad1e4b9","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CorrectCare%20Website%20Communication%20-%2010.31.2022%28final%29.pdf"},"notes":null,"org_country":"US","org_id":"5cf67009847d","org_name":"CorrectCare Integrated Health, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfigured web server exposed patient information in file directories to the public internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558759"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CorrectCare%20Website%20Communication%20-%2010.31.2022%28final%29.pdf"}],"summary":"CorrectCare reported that a misconfigured web server exposed file directories containing patients’ personal and health information to the public internet.","supporting_quote":"Further, investigation revealed that a misconfigured web server led to exposure of patient information contained in these file directories as early as January 22, 2022, and thereby subject to unauthorized access.","technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-31","discovered_date":"2022-09-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"564c9e050fa8d9b387716f8a1cd6f4fa40ce9269","impact_type":"unknown","incident_date":"2022-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6ec411212436","org_name":"Beyond 79, LLC (“Beyond 79”)","org_type":"unknown","ransomware":null,"records_affected":73141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Beyond%2079%2C%20LLC%20%28%E2%80%9CBeyond%2079%E2%80%9D%29-2022-10-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"472208248a8bb8b6a2bfc4496c8feebd01bba67f","impact_type":"disruption_or_ransomware","incident_date":"2022-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20A%20-%201%20Yr%20%28Beyond%2079%29.pdf"},"notes":null,"org_country":"US","org_id":"782c9bb7e60a","org_name":"Beyond 79, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558760"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20A%20-%201%20Yr%20%28Beyond%2079%29.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/Beyond79.pdf"}],"summary":"Unauthorized persons accessed Beyond 79’s systems and deleted some customer personal information from certain file folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2022-10-29","discovered_date":"2022-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d98aa7d1766be5f0bbc414bab475e3fc004770a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MCC%20Notification%20Template%20with%20credit%20monitoring.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"c285b4d8ce23","org_name":"Multi-Color Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558726"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MCC%20Notification%20Template%20with%20credit%20monitoring.pdf"}],"summary":"Multi-Color Corporation discovered unauthorized access to its information technology environment and found that files and records containing employee and related personal data had been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-28","discovered_date":"2022-08-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcf46b4ac05aaa9704a2bc0009c407f11797a365","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20-%20%281%20YR%20CM%29%20TaxSquad%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"856a7a24e27d","org_name":"TaxSquad","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20-%20%281%20YR%20CM%29%20TaxSquad%20-%20Sample%20Notification%20Letter.pdf"}],"summary":"TaxSquad reported unauthorized access to certain employee email accounts, which may have contained clients’ personal and tax-related information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-10-28","discovered_date":"2021-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0f805c17baa973d8be8ec4c32940c960222a15c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-10-28%20%E2%80%93%20CA%20Individual%20Notice%20Templates_1.pdf"},"notes":null,"org_country":"US","org_id":"8f1f84314a84","org_name":"SightCare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-10-28%20%E2%80%93%20CA%20Individual%20Notice%20Templates_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SightCare%2C%20Inc.-2022-10-28"}],"summary":"U.S. Vision reported unauthorized access to its network, and files containing SightCare patient information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"U.S. Vision"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c998964ff205","name":"U.S. Vision"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-10-28","discovered_date":"2021-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc3c9fe8bf7d67143cbaee020cc6e27fa07a3ffc","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-10-28%20%E2%80%93%20CA%20Individual%20Notice%20Templates.pdf"},"notes":null,"org_country":"US","org_id":"de12dafef276","org_name":"Nationwide Optometry, P.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558714"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559594"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-10-28%20%E2%80%93%20CA%20Individual%20Notice%20Templates.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nationwide%20Optometry%2C%20P.C.-2022-10-28"}],"summary":"An unauthorized individual accessed U.S. Vision's network, and files containing information about Nationwide Optometry patients may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"U.S. Vision"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"c998964ff205","name":"U.S. Vision"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18934cd8ad44d2c7bf84fb45ee3460708513a6d7","impact_type":"both","incident_date":"2022-08-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Core%20Conditioning%20%28A%20-%20Adult%201%20Year%20CM%29.pdf"},"notes":null,"org_country":"US","org_id":"623ac5bbe76a","org_name":"Core Conditioning","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Core%20Conditioning%20%28A%20-%20Adult%201%20Year%20CM%29.pdf"}],"summary":"Core Conditioning discovered encrypted data on its servers on August 29, 2022, and later learned that an unauthorized third party had obtained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"828bd1d9db79ff25972722126d005bade99a3f98","impact_type":"unknown","incident_date":"2022-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/USB%20-%20Open.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"463e760a08e4","org_name":"U.S. Bank, N.A.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558659"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-27","discovered_date":"2022-07-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a525e88ca56ba963e4cd5cab50215348de45ecfa","impact_type":"data_theft","incident_date":"2022-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-16083%20Ferguson%20Ad%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"c61f3e1c3f69","org_name":"Minka Lighting LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558694"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-16083%20Ferguson%20Ad%20r2prf.pdf"}],"summary":"Minka Lighting reported that unauthorized third parties accessed information between June 27 and June 29, 2022, and samples of confidential information were posted on a web-based forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-25","discovered_date":"2022-09-20","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f5a4d16e0ed3ec4d3408dc215eac4c762f609a2","impact_type":"data_theft","incident_date":"2022-06-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WCF_Sample.pdf"},"notes":null,"org_country":"US","org_id":"250fc81e5c8a","org_name":"WCF National Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfiguration with the website allowed unauthorized users to view reports they were not authorized to access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558582"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WCF_Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#WCF%20National%20Insurance%20Company-2022-10-25"}],"summary":"A website misconfiguration at WCF National Insurance Company allowed unauthorized users to access workers’ compensation claim reports containing personal and generalized medical information.","supporting_quote":"On September 20, 2022, we discovered that a misconfiguration with our website allowed some workers’ compensation claimants and policyholders to view reports related to workers’ compensation claims they were not authorized to access.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-25","discovered_date":"2021-07-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b02c338b74aedfd30706a1da4f13c55ab7aa671c","impact_type":"disruption_or_ransomware","incident_date":"2021-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Individual%20Notice%20Letter%20%2810.17.22%29%20v2_static%20proof%20r01.pdf"},"notes":null,"org_country":"US","org_id":"4c490e097d6e","org_name":"Symbia Logistics","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558586"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Individual%20Notice%20Letter%20%2810.17.22%29%20v2_static%20proof%20r01.pdf"}],"summary":"Symbia Logistics reported a ransomware incident and unauthorized access to files potentially containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-10-25","discovered_date":"2022-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49bd01172fe75c75a0b60cc3267e0aeacf3f7397","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Resource%20Anesthesiology%20Associates%20of%20CA%20A%20Medical%20Corporation%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0378fa8bfdc3","org_name":"Resource Anesthesiology Associates of CA A Medical Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Resource%20Anesthesiology%20Associates%20of%20CA%20A%20Medical%20Corporation%20-%20Sample%20Notice.pdf"}],"summary":"The organization reported that suspicious activity was identified on its management company’s systems and that protected health information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"57a83cbabd5e63e78d6eeff42137d941e9fb235b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15812.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9988c317bd7d","org_name":"Providence WA Anesthesia Services PC","org_type":"unknown","ransomware":null,"records_affected":56578,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15812.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-10-25","discovered_date":"2022-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6246e2ec902c46f13f83a71a52be6c1ad1c1907","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Primary%20Anetsthesia%20Services%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2a715df7088d","org_name":"Primary Anesthesia Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558565"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Primary%20Anetsthesia%20Services%20-%20Sample%20Notice.pdf"}],"summary":"Primary Anesthesia Services reported that a security incident affected information that may have included personal, financial, and medical data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce35af156804b2bb9516cffcd33bb08b02cf51d5","impact_type":"data_theft","incident_date":"2022-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PCMI%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5429005320ea","org_name":"Pinnacle Claims Management, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PCMI%20Sample%20Notice.pdf"}],"summary":"Pinnacle Claims Management reported that an unauthorized actor may have acquired PCMI data, potentially including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dbcfa79958297a745365c04372c590ea29bbd555","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HumanTechnologiesInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71d751635d08","org_name":"Human Technologies, Inc.","org_type":"unknown","ransomware":null,"records_affected":1097,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HumanTechnologiesInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-10-25","discovered_date":"2022-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa57fab5135e716c6152584012a6550fccac8c6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Anesthesia%20Services%20of%20San%20Joaquin%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c52c25a50970","org_name":"Anesthesia Services Of San Joaquin PC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558563"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Anesthesia%20Services%20of%20San%20Joaquin%20-%20Sample%20Notice.pdf"}],"summary":"Anesthesia Services Of San Joaquin PC reported that an investigation found protected health information may have been compromised on its management company's systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30b9aeb1df3a41d69cc3dc790ec3eb414f9356b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/See%20Tickets%20-%202022.10.21%20U.S.%20Consumer%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"63066fe2ecfd","org_name":"Vivendi Ticketing US LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/See%20Tickets%20-%202022.10.21%20U.S.%20Consumer%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vivendi%20Ticketing%20US%20LLC%20%28d/b/a%20See%20Tickets%20US%29-2022-10-24"}],"summary":"Vivendi Ticketing US LLC reported potential unauthorized access to event checkout pages on the See Tickets website, which may have exposed customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["See Tickets website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2022-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e69578cd884dc9bd72b16ce61b2a8fb532b633fb","impact_type":"data_theft","imported_from":null,"incident_date":"2022-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"919e0ba0e980","org_name":"E-Pal","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: E-Pal","type":"hibp","url":"https://haveibeenpwned.com/Breach/EPal"}],"summary":"E-Pal disclosed that a breach exposed email addresses, usernames, and purchase data, which were later distributed on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a089c02735cf8ca94917669ab1edc476f4eb7f9e","impact_type":"unknown","incident_date":"2022-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"8d656af49d9a","org_name":"Doomworld","org_type":"unknown","ransomware":null,"records_affected":34478,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Doomworld","type":"hibp","url":"https://haveibeenpwned.com/Breach/Doomworld"}],"summary":"In October 2022, the Doomworld fourm suffered a data breach that exposed 34k member records. The data included email and IP addresses, usernames and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7af20c17d1962dcb1a2dff76626e0b4a610a70d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14012.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"63066fe2ecfd","org_name":"Vivendi Ticketing US LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":7841,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14012.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14012.pdf"}],"summary":"Unauthorized activity on event checkout pages of the See Tickets website may have exposed customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["See Tickets website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-21","discovered_date":"2022-09-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df040054741b37735d27dc5f28a6e0996e4f0294","impact_type":"unknown","incident_date":"2022-05-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"09c96338b028","org_name":"KeyBank","org_type":"unknown","ransomware":null,"records_affected":510553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#KeyBank-2022-10-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb080196db3a68edc06728e2fb328acbd1d9ddbd","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ippolito%20International%20LP%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"82c237656974","org_name":"Ippolito International LP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558459"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ippolito%20International%20LP%20-%20Exhibit%20A.pdf"}],"summary":"Ippolito International LP reported unauthorized access to systems and files, including files containing names and Social Security numbers, and encryption of certain files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-19","discovered_date":"2022-01-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d321f57f6ccfdafa55b05ddecabd23dbc0dbb35e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15726.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ff1f2b9ba2e9","org_name":"Country Doctor Community Health Clinic","org_type":"healthcare","ransomware":null,"records_affected":21600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15726.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15726.pdf"}],"summary":"Country Doctor Community Health Clinic reported that an unauthorized actor accessed files and stored data within its systems, potentially affecting personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-17","discovered_date":"2022-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"97420ce672d4789df29fc8c03b95a198aaebcc06","impact_type":"data_theft","incident_date":"2022-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15688.pdf"},"notes":null,"org_country":"US","org_id":"481a4a1a76a9","org_name":"North Pacific Paper Company","org_type":"manufacturing","ransomware":null,"records_affected":972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15688.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15688.pdf"}],"summary":"North Pacific Paper Company reported that a cyberattack resulted in the exfiltration of employee and dependent data, including personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d40f55fcd11a9b31a3207aeba7b72e7be74ba9d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13997.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc9b80b77198","org_name":"BARRAN LIEBMAN LLP","org_type":"unknown","ransomware":null,"records_affected":2707,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BARRAN%20LIEBMAN%20LLP-2022-10-17"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13997.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-14","discovered_date":"2022-05-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9a90b5f71ac8758d863030abe2399c21c1c0a28","impact_type":"both","incident_date":"2022-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"a428cb236170","org_name":"Glenn County Office of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558275"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Sample.pdf"}],"summary":"Glenn County Office of Education reported that an unauthorized party copied files containing names and Social Security numbers, while its computer systems were also affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a128d0de5f4e1ea62ca78ad16a86ff04075565c2","impact_type":"unknown","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Breach%20Notification%20Letter%20Sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0fee54dbbdf","org_name":"M Green and Company LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558188"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0c09a087b7d6711879e88eb62cd91732651baee","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LifePlans%20-%20CA%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"c1ca4f7ba248","org_name":"LifePlans Financial & Insurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558183"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LifePlans%20-%20CA%20Proof.pdf"}],"summary":"An unauthorized individual accessed a LifePlans Financial employee’s email account, which contained messages or attachments that may have included personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17c86a4c2301f8790be049f59f280fc3ffd8635b","impact_type":"unknown","incident_date":"2022-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/A-Adult%20SSN%20-%20Redacted%20%2810713680x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"56c38702d556","org_name":"Legacy Post Acute Care","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558178"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b567b643a1b392d965286a617f2cf4073c0f6a95","impact_type":"unknown","incident_date":"2022-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Creative%20Capital%20-%20Client%20Notification%20Letter_Proof_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22337c1ecc51","org_name":"Creative Capital Management Investments, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558097"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fd4d941f35241f4b4aaadf54ae3a75ea7ec4ddff","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/UnitedHealthcare.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95a0cf9d4a5e","org_name":"United Healthcare","org_type":"unknown","ransomware":null,"records_affected":1212,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/UnitedHealthcare.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-10","discovered_date":"2022-04-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1291b648d77ca33b27923d21baa11320d61f40da","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15592.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1b1e422c2f8d","org_name":"Bellevue School District No. 405","org_type":"education","ransomware":null,"records_affected":573,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15592.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15592.pdf"}],"summary":"Certain students gained access to an administrative folder, and files were accessed without authorization between March 30 and April 25, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9911d12f1f2e43a3791de8c63691c4f9be08b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAMPLE%20NOTICE_ReleaseProof_r2.html_.pdf"},"notes":null,"org_country":"US","org_id":"9111adc6d07e","org_name":"The State Bar of Georgia","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20NOTICE_ReleaseProof_r2.html_.pdf"}],"summary":"The State Bar of Georgia reported unauthorized access to its systems and said personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-07","discovered_date":"2021-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"250e2f2f793639717257bcc108e522d05e661395","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rad%20Ltd_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"1ed8490b0684","org_name":"Radiology Ltd.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557994"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rad%20Ltd_CA%20Sample.pdf"}],"summary":"An unauthorized party accessed Radiology Ltd.'s network, which contained systems with patient information, between December 17 and December 24, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a176a1e8bd2fe68302ff456255c1e36a261e547f","impact_type":"data_theft","imported_from":null,"incident_date":"2022-08-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a1449db2e925","org_name":"Wakanim","org_type":"technology_saas","ransomware":null,"records_affected":6706951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wakanim","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wakanim"}],"summary":"Wakanim customer records containing email, IP and physical addresses, names, and usernames were exposed and advertised for sale on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-06","discovered_date":"2022-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"507c91c86bed83d776a79341a9b03a8fc3712aee","impact_type":"unknown","incident_date":"2022-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ef7244e03e6f","org_name":"Mount Vernon Mills, Inc.","org_type":"unknown","ransomware":null,"records_affected":22859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mount%20Vernon%20Mills%2C%20Inc.-2022-10-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-06","discovered_date":"2022-10-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"72945e82b4d85ce223f51128604fce8df24a2f40","impact_type":"unknown","incident_date":"2022-10-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4f7103264ce","org_name":"jaderosinamccutcheon.com","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#jaderosinamccutcheon.com-2022-10-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fdd88cd61384a02bb0dd6b6774c9300baa155f5","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ID","org_id":"71660558ebf8","org_name":"Bhinneka","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bhinneka","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bhinneka"}],"summary":"Bhinneka suffered a data breach in early 2020 that exposed customer records containing personal information and salted password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"032d840825ac821af24867dcc854336234bf1d5e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-18","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/32%20Bar%20Blues%20General%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7eeaf398e0df","org_name":"32 Bar Blues LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/32%20Bar%20Blues%20General%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#32%20Bar%20Blues%20LLC-2022-10-06"}],"summary":"32 Bar Blues LLC reported that payment card and personal information on its e-commerce site may have been accessed without authorization in an incident involving its shopping cart vendor, Freestyle Solutions.","supporting_quote":"32 Bar Blues recently learned that a Payment Card Industry (PCI)-certified vendor that it uses as its website shopping cart solution (Freestyle Solutions) was the victim of a data security incident.","technology_involved":["Freestyle Solutions","e-commerce website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c6bedc5d2cb7e1f82af4eaae511d153f32f8957","impact_type":"unknown","incident_date":"2022-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29c4fa720c03","org_name":"EPAL, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557915"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-10-05","discovered_date":"2022-09-30","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4420e556f47f517dc3caae19c60d13e5e64396f0","impact_type":"data_theft","incident_date":"2022-09-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15539.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7095699923b7","org_name":"CORE Health","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15539.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15539.pdf"}],"summary":"A staff member’s car was broken into and a laptop and files containing personal and health information were stolen.","supporting_quote":"On September 29, 2022, a staff member’s car was broken into, and a laptop and files were stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"906e6e50056b36809e6d8143efa6723d467e4ac8","impact_type":"unknown","incident_date":"2022-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/calnotice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e8b1957bd374","org_name":"CHRISTENSEN ACCOUNTANCY CORPORATION","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557891"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-05","discovered_date":"2022-08-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"213d7fe823560ed6efd8f64d6dbd23ea7929d28a","impact_type":"unknown","incident_date":"2022-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"114e6a8accd1","org_name":"CareOregon","org_type":"unknown","ransomware":null,"records_affected":8022,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CareOregon-2022-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8e0f1145c9988e9b4eaf99d4e97b0c305851d46","impact_type":"disruption_or_ransomware","incident_date":"2022-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13865.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"e2736a7bfe55","org_name":"Whitworth University","org_type":"education","ransomware":true,"records_affected":41746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13865.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13865.pdf"}],"summary":"Whitworth University detected and stopped a ransomware attack in which an unauthorized third party accessed and disabled some systems, and personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-04","discovered_date":"2022-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c3e2daecb554f0b012c6c6637540e594951d608","impact_type":"data_theft","incident_date":"2022-06-04","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reel%20FX%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f80ef6b637d8","org_name":"Reel FX, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reel%20FX%20-%20Sample%20Notice.pdf"}],"summary":"Reel FX reported that an unknown actor accessed its network without authorization and obtained data, including personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2fbdd9202e008b3ce622fd129d22c39a22437ae2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15512.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9bd07bacde2","org_name":"Philippine Airlines, Inc.","org_type":"unknown","ransomware":null,"records_affected":505,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15512.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-04","discovered_date":"2022-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b53b3008f2ed0bd514c1a40405f751768c6cad2","impact_type":"unknown","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d71ee31470c4","org_name":"Columbia State Bank","org_type":"unknown","ransomware":null,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20State%20Bank-2022-10-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-10-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82638ff50dcbae32a7d711c3f4b5e8c18a72e23c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15522.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c03b48bd9878","org_name":"Columbia River Mental Health Services","org_type":"healthcare","ransomware":null,"records_affected":17020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20River%20Mental%20Health%20Services-2022-10-04"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15522.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15522.pdf"}],"summary":"Columbia River Mental Health Services reported unauthorized access to certain email accounts that contained personal information, although its investigation could not confirm that the information was accessed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1657"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-10-03","discovered_date":"2022-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb13d0b74a0c891a6e1a3326af6de37f8cb1608d","impact_type":"data_theft","incident_date":"2017-11-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13901.pdf"},"notes":null,"org_country":"US","org_id":"0d7aa3ae3f76","org_name":"Boca Ventures Ltd","org_type":"manufacturing","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":"An accounting employee improperly accessed customer credit card information and diverted customer payments into her personal bank account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13901.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13901.pdf"}],"summary":"An accounting employee accessed customer credit card information and diverted customer payments to her personal bank account.","supporting_quote":"On September 2nd, 2022, we determined that an accounting employee at Kent Bath Systems Inc o/a Bath Fitter improperly accessed customer credit card numbers and misappropriated customer deposits and final payments by diverting the money into her own personal bank account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-10-02","discovered_date":"2021-09-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36c0e4e551029717f04152c40d89ef2e260ffaf1","impact_type":"unknown","incident_date":"2021-08-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"86beb010733c","org_name":"Bend FC Timbers","org_type":"unknown","ransomware":null,"records_affected":3007,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bend%20FC%20Timbers-2022-10-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-09-30","discovered_date":"2022-04-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3c33cd5b829a7837df3b18153225d7042d4f4b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USC%20Keck%20%28Conifer%29%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5e2152498053","org_name":"Keck Medicine of USC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557818"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USC%20Keck%20%28Conifer%29%20-Sample%20Notice.pdf"}],"summary":"An unauthorized party accessed a Conifer business email account containing personal information associated with Keck Medicine of USC.","supporting_quote":null,"technology_involved":["Microsoft Office 365","business email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Conifer"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ca2c8754f69e","name":"Conifer"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-30","discovered_date":"2022-05-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f9e4f543f84a3efddde95f7431f204cfb81e15b3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbadd3050dac","org_name":"Hanesbrand Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hanesbrand%20Inc.-2022-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-30","discovered_date":"2022-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e71316e416b7c4ac4a0db3d8413eb272d4e46a0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/focusIT%20-%20General-Redacted.pdf"},"notes":null,"org_country":"US","org_id":"5169d2865700","org_name":"focusIT, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557773"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/focusIT%20-%20General-Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#focusIT%2C%20Inc.-2022-09-30"}],"summary":"focusIT, Inc. reported that unknown threat actors potentially compromised a third-party system in its environment, possibly accessing applicants’ or account holders’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-29","discovered_date":"2022-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f41561242abb73a9c1f4b5ea0a7b25b40b16098e","impact_type":"disruption_or_ransomware","incident_date":"2022-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15453.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"943a3d71b15b","org_name":"Swissport North America, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":1131,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15453.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15453.pdf"}],"summary":"An unauthorized individual accessed Swissport systems between February 1 and February 3, 2022, encrypting some networks and servers; the investigation found personal information in impacted data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-29","discovered_date":"2022-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f7262d188f1c408aa3e44e537be7a0b5c01fd6","impact_type":"disruption_or_ransomware","incident_date":"2022-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hallmark%20-%20Notification%20Letter%20SAMPLE%20%28L01%29.pdf"},"notes":null,"org_country":"US","org_id":"716171e871bd","org_name":"Hallmark Aviation Services, LP","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557749"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hallmark%20-%20Notification%20Letter%20SAMPLE%20%28L01%29.pdf"}],"summary":"An unauthorized individual accessed systems at Hallmark Aviation Services’ vendor, encrypting some systems and affecting data that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2022-09-29","discovered_date":"2022-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"118be29a4f877e5f3a5f85b3e5c0e2dce642f75b","impact_type":"data_theft","incident_date":"2022-05-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Tucson%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fb95ea2bf190","org_name":"City of Tucson","org_type":"government","ransomware":null,"records_affected":664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557763"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Tucson%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20Tucson%2C%20AZ-2022-09-29"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15459.pdf"}],"summary":"The City of Tucson reported suspicious activity involving a user’s network account credential and later determined that files containing personal information may have been copied and taken.","supporting_quote":"On May 29, 2022, the City learned of suspicious activity involving a user’s network account credential.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-28","discovered_date":"2022-09-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe01e300a93ddec3777f214fa85a2251aa515b4f","impact_type":"unknown","incident_date":"2022-09-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Compromised%20Email%20Account%20AIRANIPOURnusdorg%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"132e82df808b","org_name":"Novato Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Compromised%20Email%20Account%20AIRANIPOURnusdorg%20%281%29.pdf"}],"summary":"A phishing attack compromised a Novato Unified School District employee’s email account, which was then used to send additional phishing emails.","supporting_quote":"On September 20, 2022, it was discovered by the Novato Unified School District (NUSD) IT Department that the e-mail account assigned to Arezu Iranipour, airanipour@nusd.org, had been compromised through an e-mail phishing attack.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21ae5ba753180458a3e4f1080fa92df3a03f0224","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB06848BNCFMC-final%20letter_NewSample%20-%20redacted.pdf"},"notes":null,"org_country":"US","org_id":"88bd695d0c88","org_name":"Northern California Fertility Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB06848BNCFMC-final%20letter_NewSample%20-%20redacted.pdf"}],"summary":"Northern California Fertility Medical Center reported that an unauthorized third party infiltrated its network, attempted to encrypt data, and may have exposed personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-28","discovered_date":"2022-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18d69f7a65cda4666256be283ed3ed8d6f52d0c2","impact_type":"data_theft","incident_date":"2022-05-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LETTER%20%232-%20CA%20Privacy%20Breach%20Non%20Credit%20Monitoring%20Letter_Medi-Cal_ENG%20FINAL%20%201029354.pdf"},"notes":null,"org_country":"US","org_id":"fb9c47480263","org_name":"Anthem Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LETTER%20%232-%20CA%20Privacy%20Breach%20Non%20Credit%20Monitoring%20Letter_Medi-Cal_ENG%20FINAL%20%201029354.pdf"}],"summary":"An unauthorized person accessed data held by Anthem vendor Choice Health and downloaded a file containing protected health information.","supporting_quote":"On August 5, 2022, Anthem learned that on May 7, 2022, an unauthorized person gained access to data from Choice Health, a vendor who we do business with, and downloaded a file that contained your PHI.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Choice Health"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"d456393b3dc2","name":"Choice Health"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-09-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39a002ed93e00544faabacae791c7cbe20a2b724","impact_type":"data_theft","incident_date":"2021-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fesmire%20and%20Williams_Mail%20Final_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"b13db67e40e1","org_name":"Fesmire & Williams","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557653"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fesmire%20and%20Williams_Mail%20Final_Redacted.pdf"}],"summary":"Fesmire reported that an unauthorized party accessed personal information, including social security numbers and, for some individuals, financial and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Ragnar Locker","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc57174dab083dd1dacaee31a77cd673d5ad10d3","impact_type":"both","imported_from":null,"incident_date":"2022-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"PT","org_id":"559d7fa78c1c","org_name":"TAP Air Portugal","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TAP Air Portugal","type":"hibp","url":"https://haveibeenpwned.com/Breach/TAPAirPortugal"}],"summary":"TAP Air Portugal was targeted in a ransomware attack, and personal data was exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"ragnarlocker"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c8e2ce0fd80733cef2d2429ff5300f50dcf74ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Physicians%20Business%20Office%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0f12766f245d","org_name":"Physician's Business Office","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Physicians%20Business%20Office%20Sample%20Notice.pdf"}],"summary":"Physician's Business Office reported that personal and protected health information on its computer systems may have been accessed or acquired by an unknown individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87ddab95daa2abfdbb5fe59a6cdd25db1071abc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_i3587_OneMain_L01_SAS_1_1.pdf"},"notes":null,"org_country":"US","org_id":"ede9a71ca2de","org_name":"OneMain Financial Group, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557549"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i3587_OneMain_L01_SAS_1_1.pdf"}],"summary":"A vendor accidentally shared BrightWay credit card transaction reports containing cardholder information with other financial institution clients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31b8d70f0d3896ea8fa53f7d5ab26dc0c6b25888","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-15665%20Family%20Medicine%20Centers%20Adult%20CM%2012%20Months%20Patient%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"667ef1b5291f","org_name":"FMC Services, LLC","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557584"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-15665%20Family%20Medicine%20Centers%20Adult%20CM%2012%20Months%20Patient%20r2prf.pdf"}],"summary":"FMC Services detected a cybersecurity attack and reported that personal and health information may have been exposed; the attacker demanded a ransom payment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"17687362b8f39aec202b89bd6b809ec6e10bfe05","impact_type":"disruption_or_ransomware","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15357.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9066fa7480d1","org_name":"UW Medicine","org_type":"healthcare","ransomware":true,"records_affected":3707,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15357.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15357.pdf"}],"summary":"Files containing UW Medicine billing-related information held in Kaye-Smith’s operating environment were compromised in a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Kaye-Smith"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"7fb12e618ea5","name":"Kaye-Smith"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c17d1202b27dc5ea132ba348316451f12e2488a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15338.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7f5451ff4c4","org_name":"Seattle Children's Hospital","org_type":"unknown","ransomware":null,"records_affected":6240,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15338.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-21","discovered_date":"2022-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"243a3b0f235851c92403088faf91ab81f1c734c5","impact_type":"data_theft","imported_from":null,"incident_date":"2022-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCAD%20CA%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"fcbee62187a2","org_name":"Savannah College of Art and Design","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCAD%20CA%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14511.pdf"}],"summary":"An unauthorized person accessed SCAD’s computer network and acquired copies of certain files on August 22, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-21","discovered_date":"2022-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61b9ee16fdcf48e0a124c5c5dd386cacb7097dc1","impact_type":"data_theft","imported_from":null,"incident_date":"2022-05-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/502712%20Choice%20Health%20-%20MBR%20Letter%20-%20EXPERIAN_H9725_Alight%20Solutions%20LLC_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A technical security configuration issue caused by a third-party service provider left a Choice Health database accessible through the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/502712%20Choice%20Health%20-%20MBR%20Letter%20-%20EXPERIAN_H9725_Alight%20Solutions%20LLC_L01_SAS_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13823.pdf"}],"summary":"An unauthorized individual accessed a Choice Health database exposed through a technical configuration issue and obtained files containing personal and health insurance information.","supporting_quote":"On May 18, 2022, we determined that, due to a technical security configuration issue caused by a third -party service provider, a single Choice Health database was accessible through the Internet.","technology_involved":["database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6df5149dc1077fc75f23e3e8303cec3f5a1f4b13","impact_type":"disruption_or_ransomware","incident_date":"2021-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-15393%20ECL%20Wolfe%20Clinic%20Ad%201yr%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"a8c8557a4cae","org_name":"Wolfe Clinic, P.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557367"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-15393%20ECL%20Wolfe%20Clinic%20Ad%201yr%20r2prf.pdf"}],"summary":"An unauthorized party accessed myCare Integrity data and deleted databases and system configuration files, while potential exposure of personal and health information could not be ruled out.","supporting_quote":null,"technology_involved":["myCare Integrity","Eye Care Leaders"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Eye Care Leaders"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"af63637c8b22","name":"Eye Care Leaders"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-19","discovered_date":"2022-09-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d5057e8b9af3a36103a4c48377e6e75bb886908c","impact_type":"unknown","incident_date":"2022-09-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"895464e9bdfe","org_name":"Sunstone Psychiatric, LLC","org_type":"unknown","ransomware":null,"records_affected":333,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sunstone%20Psychiatric%2C%20LLC-2022-09-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-19","discovered_date":"2022-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7180d1023ee1c2734c2b95087af3fa9cc30587b8","impact_type":"data_theft","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chaney%20Electronics%2C%20Inc.%20Draft%20Indiv.%20Notification%20Letter_California.pdf"},"notes":null,"org_country":"US","org_id":"855ad7dccced","org_name":"Chaney Electronics, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557364"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chaney%20Electronics%2C%20Inc.%20Draft%20Indiv.%20Notification%20Letter_California.pdf"}],"summary":"Payment card and related information entered on Chaney Electronics’ website may have been acquired after malware was found on servers hosting the site.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-16","discovered_date":"2022-07-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be5d76ea29a89cd244e91e50837eb2ccff1b7d34","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-15555%20Tessie%20Ad%201y%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"5eac7a77e9a3","org_name":"Tessie Cleveland Community Services Corp.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557301"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-15555%20Tessie%20Ad%201y%20r3prf.pdf"}],"summary":"An unknown person accessed information from some of Tessie Cleveland Community Services Corp.'s employee email accounts between June 17 and June 30, 2022, in what the organization believed was likely an attempt at business fraud.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-16","discovered_date":"2022-07-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac50e951476ef528a3483e70dc79d8c4ebea6b22","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Draft%20Individual%20Notification%20-%20Employees_v2.pdf"},"notes":null,"org_country":"US","org_id":"c678b3221191","org_name":"San Luis Coastal Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557337"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Draft%20Individual%20Notification%20-%20Employees_v2.pdf"}],"summary":"San Luis Coastal Unified School District reported that employees’ and dependents’ personal information may have been accessible to an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","credentials"],"disclosed_date":"2022-09-16","discovered_date":"2022-08-03","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfaca3c1e59b5dcd75c5dd8818ac36e69f7dd5ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/First%20Tech%20Federal%20Credit%20Union%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c3e9ff67efce","org_name":"First Technology Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557312"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/First%20Tech%20Federal%20Credit%20Union%20-%20Sample%20Notice.pdf"}],"summary":"First Technology Federal Credit Union reported that a card skimmer and camera were installed at an ATM, potentially exposing payment card details and PINs.","supporting_quote":"On August 3, 2022, we learned that a card skimmer and small camera had been installed at our ATM in Cupertino, California.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16e6b0ba6d5cb56ba239c176d0e4d25b62fc06cd","impact_type":"data_theft","incident_date":"2020-09-18","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/35224380_1-Notice%20Letter%2C%20dated%20September%2016%2C%202022.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"30a9b7e99889","org_name":"Audio Advisor, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557335"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/35224380_1-Notice%20Letter%2C%20dated%20September%2016%2C%202022.pdf"}],"summary":"Malware on Freestyle-hosted e-commerce sites may have exposed payment card information used on Audio Advisor's website.","supporting_quote":"According to Freestyle, it commenced an investigation and identified and removed malware found on servers that hosted certain customers’ e-commerce sites, including AudioAdvisor.com.","technology_involved":["Freestyle","e-commerce website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-14","discovered_date":"2022-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef77471baa4ebcaca182d5110277784cf51fa344","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/M.C.%20Dean%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ee7aded2c482","org_name":"M.C. Dean, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557226"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/M.C.%20Dean%2C%20Inc.%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MCDeanInc.pdf"}],"summary":"M.C. Dean, Inc. discovered unauthorized access to its systems and found that files containing personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-13","discovered_date":"2022-08-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1e79e88d672b75e7dc1d05ea0021688913a59f10","impact_type":"unknown","incident_date":"2022-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6529ec63f1e7","org_name":"The Springs Living","org_type":"unknown","ransomware":null,"records_affected":630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Springs%20Living-2022-09-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4431dae96c3eae3fd9f6634f918c038921623aef","impact_type":"unknown","incident_date":"2022-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FTI_Letter_sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c6593a0d8e7","org_name":"DCSS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557181"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-13","discovered_date":"2022-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06b2f5ab0734175ce224808b1f9542b76345d252","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CORE%20-%20Notice%20Letter%20%28California%20Residents%29.pdf"},"notes":null,"org_country":"US","org_id":"da60bc85e6b1","org_name":"CORE Cashless, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557176"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CORE%20-%20Notice%20Letter%20%28California%20Residents%29.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/CORE%20Cashless%2C%20LLC-Consumer%20Notice.pdf"}],"summary":"CORE Cashless, LLC reported that an unauthorized individual accessed its environment and may have accessed personal and payment card information entered into certain online payment portals.","supporting_quote":null,"technology_involved":["online payment portals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4829e72fbabd9b110756e2f948acb9837bafce1","impact_type":"data_theft","incident_date":"2021-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blaze%20Solutions%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"ce1d16fec382","org_name":"Blaze Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559950"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557152"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blaze%20Solutions%20Sample%20Notice_1.pdf"}],"summary":"A separate business downloaded a consumer list hosted by Blaze Solutions, including names, identification numbers, and medical-use designations.","supporting_quote":null,"technology_involved":["point of sale software hosting services"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e1c89659b65ad3cadd1a4a5b50f7a208383f316","impact_type":"unknown","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Newcourse%20-%20First%20United%20Bank%20Notice%20Letter%20%5Bredacted%5D%20%2810748542x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64904bb27684","org_name":"Newcourse Communications","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558699"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557117"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13824.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb6885cb1676a14aaaf4f1ead2ac41bc86cb8ca9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/UpstateCarolinaRadiology.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c0d956b9a5d3","org_name":"Upstate Carolina Radiology, P.A.","org_type":"unknown","ransomware":null,"records_affected":1327,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/UpstateCarolinaRadiology.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e97aadcd667996d68ef6f3c87de7306aca37a058","impact_type":"data_theft","incident_date":"2021-11-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/U-Haul%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"b132592a029a","org_name":"U-Haul International, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557103"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/U-Haul%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#U-Haul%20International%2C%20Inc.-2022-09-09"}],"summary":"U-Haul International reported that compromised passwords were used to access its customer contract search tool and some rental contracts containing names and driver’s license or state identification numbers.","supporting_quote":"We detected a compromise of two unique passwords that were used to access a customer contract search tool that allows access to rental contracts for U-Haul customers.","technology_involved":["customer contract search tool"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-09","discovered_date":"2022-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"37409d719aa14efbe6f48ab8f6eed21ac675f29b","impact_type":"both","incident_date":"2022-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIC%20-%20Sample%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e6799b7f3a1e","org_name":"TIC International Corporation","org_type":"unknown","ransomware":null,"records_affected":187341,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TIC%20International%20Corporation-2022-09-09"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIC%20-%20Sample%20Notice.pdf"}],"summary":"TIC International Corporation experienced an encryption attack that disrupted its systems, and an investigation determined personal information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42e77a5f9e6724a7eca67ef1c5c534dbc0651d36","impact_type":"data_theft","incident_date":"2020-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20220830_Notification%20letter%20final_.pdf"},"notes":null,"org_country":"US","org_id":"f7d953fb83d9","org_name":"Silver Superstore","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557078"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20220830_Notification%20letter%20final_.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Silver%20Superstore-2022-09-11"}],"summary":"Malware on Freestyle Solutions servers hosting Silver Superstore’s website may have captured payment card and checkout information entered from September 20, 2020 through February 2, 2022.","supporting_quote":null,"technology_involved":["Freestyle Solutions","website hosting servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"60d3a7973d084270661330cc1185d6dbf8f7fdce","impact_type":"data_theft","incident_date":"2020-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15139.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2e2ff1ec2390","org_name":"Radiology Associates of Albuquerque and Advanced Imaging, LL","org_type":"healthcare","ransomware":null,"records_affected":882,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15139.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15139.pdf"}],"summary":"Radiology Associates of Albuquerque and Advanced Imaging reported that documents were copied from its systems and certain email accounts were accessed without authorization.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cce4fd57111b516eac1e5050a821d62e701f42a","impact_type":"data_theft","imported_from":null,"incident_date":"2020-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RAA%20-%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"d52dd8fa750e","org_name":"Radiology Associates of Albuquerque and Advanced Imaging, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557106"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558110"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RAA%20-%20Notice%20of%20Data%20Breach.pdf"}],"summary":"Radiology Associates of Albuquerque and Advanced Imaging reported unauthorized access to email accounts and copying of documents from its environment.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b06fbf5b86054083db7150608fde02014d03a773","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-18","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ballistic%20Products%20Notification%20Letter%20-%20Individual.pdf"},"notes":null,"org_country":"US","org_id":"ee4c60db6da1","org_name":"Ballistic Products, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557104"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ballistic%20Products%20Notification%20Letter%20-%20Individual.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14550.pdf"}],"summary":"Malware on a third-party vendor’s servers may have captured personal and payment information entered on Ballistic Products’ checkout page.","supporting_quote":"As we previously advised in April 2022, one of Ballistic Products, Inc.’s (“Ballistic”) third-party vendors (the “Vendor”) experienced a data security incident involving the presence of malware on their servers.","technology_involved":["e-commerce checkout page"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"275b6e4d37b80690ce68e3b49313eb1bedfdf7de","impact_type":"data_theft","incident_date":"2020-09-17","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wilson%20Customer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"dccf66babc7b","org_name":"Wilson's Gun Shop, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557029"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wilson%20Customer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wilson%27s%20Gun%20Shop%2C%20Inc.-2022-09-07"}],"summary":"Malware on a FreeStyle server hosting e-commerce websites may have captured payment card and other checkout information entered on Wilson Combat's website.","supporting_quote":"Earlier this year, FreeStyle learned that malware had been downloaded onto a server that hosts numerous e -commerce websites.","technology_involved":["FreeStyle","e-commerce website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"FreeStyle"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-08","discovered_date":"2022-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afc8b1e60e2f0faf3f940bb2d1d37d170765698d","impact_type":"disruption_or_ransomware","incident_date":"2022-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WAC%20Data%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"10706ab82025","org_name":"Williams Adams & Company","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557036"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WAC%20Data%20Breach%20Letter.pdf"}],"summary":"Williams Adams & Company discovered that an unauthorized user had encrypted its network servers, causing an operational outage, and paid a ransom to recover the data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e2ed344a2f1287190e392635764cdd7432d0838","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"134205372673","org_name":"Brand New Tube","org_type":"other","ransomware":null,"records_affected":349627,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Brand New Tube","type":"hibp","url":"https://haveibeenpwned.com/Breach/BrandNewTube"}],"summary":"Brand New Tube reported a breach that exposed subscriber information, including email and IP addresses, usernames, genders, password hashes, and private messages.","supporting_quote":null,"technology_involved":["streaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2022-09-06","discovered_date":"2022-08-20","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3484755a37ddca36e8d3dfed327606d10cb42520","impact_type":"data_theft","incident_date":"2022-08-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15011.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"43968caeb98e","org_name":"Vans","org_type":"retail_ecommerce","ransomware":null,"records_affected":1460,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15011.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15011.pdf"}],"summary":"An attacker used credential stuffing against vans.com and obtained affected users’ email addresses and passwords, with possible access to information stored in their accounts.","supporting_quote":"Following a careful investigation, we concluded that an attacker launched a credential stuffing attack against our website, vans.com, on August 19 and 20, 2022.","technology_involved":["vans.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1110"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-09-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cf87df4f52fe9dfe8ce44674971ce836ed284737","impact_type":"data_theft","incident_date":"2022-07-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1110","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15147.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; attack_techniques without supporting words dropped: T1078","org_country":"US","org_id":"3e913da5bce6","org_name":"The North Face","org_type":"retail_ecommerce","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15147.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15147.pdf"}],"summary":"Attackers used credential stuffing against The North Face website and obtained customers’ email addresses and passwords.","supporting_quote":"Following a careful investigation, we concluded that attackers launched a credential stuffing attack against our website between July 26 and August 5, 2022.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-06","discovered_date":"2022-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"223f5f5902ca1d543886b35b05ce617de2fc41b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DB-06696-NVC_California%20Notice%20Letter_BW.pdf"},"notes":null,"org_country":"US","org_id":"c1615d7b6bf7","org_name":"Napa Valley College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556938"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DB-06696-NVC_California%20Notice%20Letter_BW.pdf"}],"summary":"Napa Valley College reported a network intrusion in which personal information may have been accessed by an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-06","discovered_date":"2021-02-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8048f04d69b7f334dbfa210fec4ba35d97cf28","impact_type":"both","incident_date":"2021-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DPI%20Specialty%20Foods%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0e43a711b2c8","org_name":"DPI Specialty Foods, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556942"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DPI%20Specialty%20Foods%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"DPI Specialty Foods reported that an unknown actor accessed systems, downloaded files, and encrypted certain systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-09-05","discovered_date":"2022-08-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f7004b7b57d68512a17f995eca0fea1805a631b","impact_type":"data_theft","imported_from":null,"incident_date":"2022-07-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Template%20-%20PDF_North%20Face.pdf"},"notes":null,"org_country":"US","org_id":"8439f2c883a4","org_name":"VF Outdoor","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556917"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Template%20-%20PDF_North%20Face.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#VF%20Outdoor%2C%20LLC-2022-09-06"}],"summary":"Attackers used credential stuffing against VF Outdoor's thenorthface.com website and obtained account credentials, with possible access to information stored in affected accounts.","supporting_quote":"Following a careful investigation, we concluded that attackers launched a credential stuffing attack against our website, thenorthface.com, between July 26 and August 19, 2022.","technology_involved":["thenorthface.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"922be9ad7f54b12b041fba75b1fee43044fde01b","impact_type":"data_theft","incident_date":"2022-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14944.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e5919356e4fc","org_name":"Samsung Electronics America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":174929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14944.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14944.pdf"}],"summary":"An unauthorized third party acquired information from some of Samsung’s U.S. systems, affecting personal information of certain customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-09-02","discovered_date":"2022-07-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f8cf54aa4569e4fd9973b5b22b955ee9a16b0e6","impact_type":"both","incident_date":"2022-06-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"02107ae21184","org_name":"Reiter Affiliated Companies","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556889"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557491"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification_1.pdf"}],"summary":"Reiter Affiliated Companies reported unauthorized activity that made some systems unavailable and resulted in files containing personal and health-related information being obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-09-02","discovered_date":"2022-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32d9eec40dd53a8c744367d6fa8cb97dca6ffedb","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCBPTE%20-%20Notification%20Letter%20%28General%29%283592169.1%29-updated.pdf"},"notes":null,"org_country":"US","org_id":"71b953e2654d","org_name":"North Carolina Board of Physical Therapy Examiners","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556882"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCBPTE%20-%20Notification%20Letter%20%28General%29%283592169.1%29-updated.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NorthCarolinaBoardofPhysicalTherapy.pdf"}],"summary":"An unauthorized individual accessed a Board computer that may have contained names, addresses, dates of birth, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cbb5053332b35c7d181b5bf05d915d1ab0da6da","impact_type":"data_theft","incident_date":"2022-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-15513%20Legacy%20Supply%20Chain%20Holdings%20Ad%20CM%2024%20months%20US%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"5b8732118990","org_name":"Legacy Supply Chain","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556859"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-15513%20Legacy%20Supply%20Chain%20Holdings%20Ad%20CM%2024%20months%20US%20r2prf.pdf"}],"summary":"Legacy Supply Chain reported that attackers accessed its IT systems and exfiltrated data that included employees’ personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a316b23c038b183ed0533579f3282d55bb82a4c1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GenesisHealthCareInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4b60751dc83","org_name":"Genesis Health Care, Inc.","org_type":"unknown","ransomware":null,"records_affected":3862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GenesisHealthCareInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-02","discovered_date":"2022-08-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f1a9333764008e88aa8f18e2ff8ae093ea00dc1","impact_type":"unknown","incident_date":"2022-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a00ad34cee85","org_name":"Berries Northwest, LLC and Sandy Ridge Berry Farms, LLC","org_type":"unknown","ransomware":null,"records_affected":2925,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Berries%20Northwest%2C%20LLC%20and%20Sandy%20Ridge%20Berry%20Farms%2C%20LLC-2022-09-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-09-01","discovered_date":"2022-07-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1804805205175da9152d67ce82b04444d26f72e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vermont%20Nut%20Free%20Chocolates%20-%20CA%20Letter%20%28Redacted%29%20%2810630516x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"293e7148fa65","org_name":"Vermont Nut Free Chocolates","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vermont%20Nut%20Free%20Chocolates%20-%20CA%20Letter%20%28Redacted%29%20%2810630516x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14940.pdf"}],"summary":"Malware on Freestyle Solutions’ server may have exposed payment card information provided by customers who purchased through Vermont Nut Free Chocolates’ website.","supporting_quote":null,"technology_involved":["Freestyle Solutions server","shopping cart and payment processing"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle Solutions"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74c84f689af8e9e33526eac6af4829f658b2a40f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SF%2049ers%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0c86a497457f","org_name":"San Francisco 49ers","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SF%2049ers%20-%20California%20Notification.pdf"}],"summary":"The San Francisco 49ers reported unauthorized access to or acquisition of files on its corporate network containing some individuals’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67d95bcb9c139e0e5ae08033791c8895b61cf02f","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MMA_CA%20sample.pdf"},"notes":null,"org_country":"US","org_id":"98d74f20d8b4","org_name":"MMA Operations, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556803"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MMA_CA%20sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MMA%20Operations%2C%20Inc.-2022-09-01"}],"summary":"MMA Operations, Inc. investigated unauthorized access to its systems and determined that some affected individuals’ information was contained in the accessed systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-09-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"945bd82b394028ee2eef57c30e6737b87d07f3ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Grellas_CA%20sample.pdf"},"notes":null,"org_country":"US","org_id":"2f7b22fa166a","org_name":"Grellas Shah LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Grellas_CA%20sample.pdf"}],"summary":"An unauthorized party accessed certain employee email accounts, and the review found that emails or attachments contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-09-01","discovered_date":"2022-06-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"119557190fbe664f846417f02f0ab4087280af1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice_3.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558670"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice_3.pdf"}],"summary":"Covenant Care identified suspicious activity involving an employee email account and later determined that an unauthorized actor had accessed certain email accounts associated with Silver Hills Health Care Center.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f16ee56f6266c8f45c683cb328e92592300bf14d","impact_type":"data_theft","imported_from":null,"incident_date":"2021-11-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d3bff9b889b8","org_name":"Stripchat","org_type":"technology_saas","ransomware":null,"records_affected":10001355,"reviewed":false,"root_cause":"Stripchat left several databases exposed and unsecured.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Stripchat","type":"hibp","url":"https://haveibeenpwned.com/Breach/Stripchat"}],"summary":"Stripchat left several databases exposed and unsecured, and records containing usernames, email addresses and IP addresses later appeared on a hacking forum.","supporting_quote":"In November 2021, the live sex cams and adult chat website Stripchat left several databases exposed and unsecured .","technology_involved":["databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5cd61bbcad0db0a65a5afb3c8951858bd5dc5c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"1be5b51be8d6","org_name":"START","org_type":"technology_saas","ransomware":null,"records_affected":44000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: START","type":"hibp","url":"https://haveibeenpwned.com/Breach/Start"}],"summary":"START acknowledged an incident that exposed 44 million records, including email addresses, subscriber countries, names, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","credentials"],"disclosed_date":"2022-08-30","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78aa6229143889cd2aea39ccf41f586421041daa","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ATM_0822_Letter%20to%20members.pdf"},"notes":null,"org_country":"US","org_id":"38c3fd5d653a","org_name":"San Francisco Fire Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ATM_0822_Letter%20to%20members.pdf"}],"summary":"San Francisco Fire Credit Union reported that payment card information, including card details and PINs, was compromised when cards were used at a tampered ATM.","supporting_quote":"An investigation determined that your card was compromised when used at a tampered ATM at one of our locations.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bcf7d7a8f9714ef12fad08a0a810f27b8c6675d","impact_type":"unknown","incident_date":"2021-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Neopets%20-%202022.08.29%20Substitute%20Notice%20-%20Website%20%26%20Press%20Release%204136-6077-9325%201.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84d9f8ffd625","org_name":"Neopets, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556741"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13822.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-29","discovered_date":"2022-07-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0fcb8f2f03a81bae62058b166aa7bded630bb81","impact_type":"unknown","incident_date":"2022-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"60082a7253b3","org_name":"Saint Alphonsus Medical Group, member of Trinity Health","org_type":"unknown","ransomware":null,"records_affected":5378,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Saint%20Alphonsus%20Medical%20Group%2C%20member%20of%20Trinity%20Health-2022-08-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a2b6b320fe20c5b15582cf676b4c0f61c503683","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ff76dc281b59","org_name":"Sacramento County Employee Benefits Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556714"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Breach%20Notification%20Letter.pdf"}],"summary":"An email from the Sacramento County Employee Benefits Office disclosed personal information to county employees who were not authorized to receive it.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c2ca0579a9dd734f23d836eceaa87f8e143c20d","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AK%20Bank%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"07e0e0f08952","org_name":"Kaye-Smith Enterprises, Inc.","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556732"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AK%20Bank%20Notice.pdf"}],"summary":"Kaye-Smith Enterprises reported that a ransomware attack compromised files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2022-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dbb9dd3aa857d35a5d259bbdb72dbb967cc7a42c","impact_type":"both","incident_date":"2022-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14854.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"a16fdada8e3f","org_name":"Bridgestone Americas, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":1066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14854.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14854.pdf"}],"summary":"Bridgestone reported that unauthorized exports included business documents and a list of current and former employees, and that the incident rendered some systems inoperable.","supporting_quote":null,"technology_involved":["external cloud data storage platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-26","discovered_date":"2022-05-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a32e8b5749a56da9948003d261b37928a9bdb678","impact_type":"data_theft","incident_date":"2022-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Truly%20Nolen%20%28CA%29%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d4dcfada9527","org_name":"Truly Nolen of America","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556670"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Truly%20Nolen%20%28CA%29%20Sample%20Notice.pdf"}],"summary":"Truly Nolen identified unauthorized network access between April 29 and May 11, 2022, during which an unauthorized actor removed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-26","discovered_date":"2022-07-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"198c5d9401c56524f1909c14fcbca2089628c0eb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nelnet%20Servicing%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"25591a91aa90","org_name":"Nelnet Servicing","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nelnet%20Servicing%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nelnet%20Servicing%2C%20LLC-2022-08-26"}],"summary":"Information in Nelnet Servicing’s system was accessible to an unknown party from June 2022 through July 22, 2022.","supporting_quote":null,"technology_involved":["servicing system","customer website portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Nelnet Servicing"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"19fdbd46072a","name":"Nelnet Servicing"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-26","discovered_date":"2022-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9022d73c3e66db5008d22a7171bae929272ba08e","impact_type":"data_theft","incident_date":"2022-07-05","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KeyBank%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"09c96338b028","org_name":"KeyBank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558511"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KeyBank%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14812.pdf"}],"summary":"An unauthorized external party accessed information held by KeyBank’s mortgage insurance verification vendor, Overby-Seawell Company, including personal and mortgage-related information about KeyBank clients.","supporting_quote":"OSC informed us that an unauthorized external party had gained remote access to their network and on July 5, 2022, acquired certain information from a number of OSC clients, including certain personal information of KeyBank clients.","technology_involved":["Overby-Seawell Company"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Overby-Seawell Company"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"0472944e3c6d","name":"Overby-Seawell Company"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f107667523b2c9e4420e4ad8b2050b51940fae4d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HomesteadHospice%26PalliativeCare.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81e2144bdf08","org_name":"Homestead Hospice & Palliative Care","org_type":"unknown","ransomware":null,"records_affected":1497,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HomesteadHospice%26PalliativeCare.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-26","discovered_date":"2022-05-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7ab1d1b4b73be559453a3f8dead50201d63034d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Brown%20Rudnick%20LLC%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"e0e01e41874f","org_name":"Brown Rudnick LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556677"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Brown%20Rudnick%20LLC%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"Brown Rudnick reported unauthorized access to two Microsoft 365 email accounts, but could not determine whether emails were accessed or viewed.","supporting_quote":null,"technology_involved":["Microsoft 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-25","discovered_date":"2021-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3880d8e7b615f4990699b9ed056deef6f750fc4","impact_type":"both","incident_date":"2021-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample.pdf"},"notes":null,"org_country":"US","org_id":"bcec2367968c","org_name":"Valex Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556643"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample.pdf"}],"summary":"Valex Corporation identified malware that encrypted certain systems, and its investigation found that an unknown actor accessed systems and removed some data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-24","discovered_date":"2021-09-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24e7384bf7ce994aabdf936224625eec814b6716","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NRHN%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"cf02e9d67e78","org_name":"Neuro Rehab Associates, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556580"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NRHN%20Sample%20Notice.pdf"}],"summary":"Neuro Rehab Associates reported that an unauthorized individual accessed certain systems and information between September 30 and October 5, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d5282eb61f064514f7505e4fcd6de5e699d9cc2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LAC_DPH_Breach_Notice-8.24.22.pdf"},"notes":null,"org_country":"US","org_id":"b91c4bf5c832","org_name":"County of Los Angeles Department of Public Health","org_type":"government","ransomware":null,"records_affected":1942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556520"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LAC_DPH_Breach_Notice-8.24.22.pdf"}],"summary":"The department's website posted 1,942 inspection reports containing names and driver’s license or identification numbers.","supporting_quote":null,"technology_involved":["Environmental Health Division website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-22","discovered_date":"2022-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a03c2f27f829f168757ea23bb1186f66dfbdd07c","impact_type":"unknown","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbe6c1e85b10","org_name":"OnPoint Community Credit Union","org_type":"unknown","ransomware":null,"records_affected":379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#OnPoint%20Community%20Credit%20Union-2022-08-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa9e2affa53bca4366d7118ef8013c7784e13a84","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20EE%20HIPAA%20Final%208%201%2022.pdf"},"notes":null,"org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20EE%20HIPAA%20Final%208%201%2022.pdf"}],"summary":"The California Department of Corrections and Rehabilitation found that an unauthorized user accessed its password-protected file-sharing platform, with no evidence that data was copied or downloaded.","supporting_quote":null,"technology_involved":["file-sharing platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-19","discovered_date":"2022-06-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c70e83b91dcec9255f63a4e716968b71266f4e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Free%20Masons%20of%20California%20Notification%20Letter%20-%20General%20v3%20%28print%20proof%29.pdf"},"notes":null,"org_country":"US","org_id":"fe5a7c04cd2e","org_name":"Grand Lodge of Free & Accepted Masons of California","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556409"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Free%20Masons%20of%20California%20Notification%20Letter%20-%20General%20v3%20%28print%20proof%29.pdf"}],"summary":"An employee email account was accessed without authorization, and copies of donation checks containing personal and financial information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c27db62da7cc80092c7c168e7289513d5423695","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CLS_CA%20Sample.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"2aec84ad1390","org_name":"Community Loan Servicing LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556436"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CLS_CA%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Community%20Loan%20Servicing%2C%20LLC-2022-08-19"}],"summary":"Community Loan Servicing said an unauthorized person accessed files on its file storage servers, some of which contained names, Social Security numbers, and loan-related information.","supporting_quote":null,"technology_involved":["file storage servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df1a95160a5d3314846169df27824c59dfae71b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CIR-111624-Letter-2022-0811.pdf"},"notes":null,"org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556437"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CIR-111624-Letter-2022-0811.pdf"}],"summary":"The California Department of Social Services reported that an email containing personal information was sent to unauthorized individuals.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-18","discovered_date":"2022-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4823cb32a3f29ad3ebc7b7dfcc30dbf080594b6","impact_type":"data_theft","incident_date":"2022-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MAIC%20Ad%20CM%2012m-%20Template%20A.pdf"},"notes":null,"org_country":"US","org_id":"69970465310f","org_name":"Michigan Avenue Immediate Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MAIC%20Ad%20CM%2012m-%20Template%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Michigan%20Avenue%20Immediate%20Care-2022-08-18"}],"summary":"Michigan Avenue Immediate Care reported that an unauthorized third party accessed its network and obtained files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb49a16c614d1fa28bc610067ad4f711de99dc96","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"MX","org_id":"e02cd83b6881","org_name":"Banorte","org_type":"financial","ransomware":null,"records_affected":2107000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Banorte","type":"hibp","url":"https://haveibeenpwned.com/Breach/Banorte"}],"summary":"Records containing personal and financial information associated with Banorte were publicly dumped on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2915ca0b8556ba70512bc982a2e91f8da07007da","impact_type":"data_theft","incident_date":"2020-09-18","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ruger-Template%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7c4623b77b08","org_name":"Sturm, Ruger & Company, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ruger-Template%20Individual%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sturm%2C%20Ruger%20%26%20Company%2C%20Inc-2022-08-17"}],"summary":"Malware captured customers’ personal and payment information entered on the ShopRuger checkout page before it was stored in Freestyle’s database.","supporting_quote":null,"technology_involved":["ShopRuger checkout page","Freestyle database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle Solutions"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09f95be18f030a3c6d3bbc0efc7856ff32220454","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e28528e92eab","org_name":"SitePoint","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SitePoint","type":"hibp","url":"https://haveibeenpwned.com/Breach/SitePoint"}],"summary":"SitePoint suffered a data breach in June 2020 that exposed customer records including personal information and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2022-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdecb7bb6e7603c1f838abec2f8f39e8d8937b1e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8f29523ce785","org_name":"Shitexpress","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shitexpress","type":"hibp","url":"https://haveibeenpwned.com/Breach/Shitexpress"}],"summary":"A breach exposed Shitexpress customer contact details, physical addresses, IP addresses, private messages, and purchase-related records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-16","discovered_date":"2022-01-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63d50574318a24966e3fa43c58165991fa46bea1","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Service%20by%20Medallion%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6a4614b1e4f9","org_name":"Service by Medallion, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556313"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Service%20by%20Medallion%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed certain employee email accounts containing files with personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-08-16","discovered_date":"2022-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"33e16f12a40b5155c74eba4a5cff08241f7fa45c","impact_type":"disruption_or_ransomware","incident_date":"2022-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16426.pdf"},"notes":null,"org_country":"US","org_id":"162e695ddc95","org_name":"Hanesbrands Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16426.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hanesbrands%20Inc.-2022-11-29"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559566"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556309"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i2038_Hanesbrands%20Inc_L02_SAS_2_1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/HanesbrandsInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16426.pdf"}],"summary":"HanesBrands detected a ransomware incident affecting certain internal IT systems, and later identified that some individuals’ personal information was impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7014c1a502816a5bf16f7b05a15a0805a75e2ba3","impact_type":"data_theft","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach.PDF"},"notes":null,"org_country":"US","org_id":"5003ae9634c4","org_name":"Burnt Ridge Nursery and Orchards, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Burnt%20Ridge%20Nursery%20and%20Orchards%2C%20Inc.-2022-08-16"}],"summary":"Payment card information used on Burnt Ridge’s website may have been captured by malware on a vendor server hosting its ecommerce site.","supporting_quote":null,"technology_involved":["ecommerce website server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50918bb6478d6c2346a3b5516ec4007b1af1cc90","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-10-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14516.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7e28d2f4e7df","org_name":"Warner Norcross & Judd, LLP","org_type":"professional_services","ransomware":null,"records_affected":780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Warner%20Norcross%20%26%20Judd%2C%20LLP-2022-08-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14516.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/WarnerNorcross%26JuddLLP.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Warner%2C%20Norcross%20%26%20Judd%20LLP-2022-08-26"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14821.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14516.pdf"}],"summary":"Warner Norcross & Judd reported unauthorized activity involving some of its systems, and files containing individuals’ names may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9afef0e3cccad87f40c0b7128c758883772345d2","impact_type":"data_theft","incident_date":"2022-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SDAIHC%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"36241c1645ba","org_name":"San Diego American Indian Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559118"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556273"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SDAIHC%20Sample%20Notice.pdf"}],"summary":"An unknown actor accessed the organization’s network and obtained data that may have included personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbee8cfc7f802f8af809448c35600430164bf7cf","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"technology_saas","ransomware":null,"records_affected":6682453,"reviewed":false,"root_cause":"A bug introduced in June 2021 created a vulnerability in Twitter's platform that allowed an attacker to build a database of user information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Twitter","type":"hibp","url":"https://haveibeenpwned.com/Breach/Twitter"}],"summary":"A vulnerability in Twitter's platform allowed an attacker to build a database containing users' email addresses or phone numbers and other public profile information.","supporting_quote":"In January 2022, a vulnerability in Twitter's platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform .","technology_involved":["Twitter platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-08-12","discovered_date":"2022-06-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"474b005a7195dcbed4afe29c1ffc9857b6118dee","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14461.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8236d80e516a","org_name":"Overlake Medical Center & Clinics","org_type":"healthcare","ransomware":null,"records_affected":519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14461.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14461.pdf"}],"summary":"An unidentified third party obtained an Overlake staff member’s email credentials and accessed the account between June 13 and June 14, 2022, potentially exposing patient information.","supporting_quote":"On June 14, 2022, we learned that an unidentified third party obtained the login credentials for one Overlake staff member’s email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-12","discovered_date":"2022-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d7b72bedcef15737a026885b30638a4f8b72d89","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OneTouchPoint%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"40f1561f4638","org_name":"OneTouchPoint, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556196"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OneTouchPoint%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12996.pdf"}],"summary":"OneTouchPoint reported unauthorized access to certain servers beginning April 27, 2022, and said the impacted systems contained personal information whose access could not be confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-12","discovered_date":"2022-07-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc92442a45255d9309b03399daabdd3a7a542fd1","impact_type":"data_theft","incident_date":"2022-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14521.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2666d18d2a4d","org_name":"Centralia College","org_type":"education","ransomware":null,"records_affected":38418,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14521.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14521.pdf"}],"summary":"Centralia College reported unauthorized network access and said files containing personal information may have been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-08-11","discovered_date":"2021-10-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d314746e74613ab70b5a208ee2fafc7b1c6f0a98","impact_type":"disruption_or_ransomware","incident_date":"2021-10-14","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valent%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"aa7825c64cc4","org_name":"Valent U.S.A. LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556142"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valent%20-%20Sample%20Notification%20Letter.pdf"}],"summary":"A cyberattack encrypted some of Valent U.S.A. LLC’s systems, causing an outage and possibly affecting personal information held in electronic files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-11","discovered_date":"2021-09-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc843638ff8683606a506cf1b6b4bde27ed8dd70","impact_type":"both","incident_date":"2021-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UHC%20-%20Sample%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1486, T1489","org_country":"US","org_id":"01451f28bc3b","org_name":"United Health Centers of the San Joaquin Valley","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556161"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UHC%20-%20Sample%20Notice.pdf"}],"summary":"United Health Centers of the San Joaquin Valley reported a disruption caused by an encryption event and said that some patient information was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bd9bb44734b458b87875602a963cedb9cacf06d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Maywood%20-%20Adult%20Consumer%20Notification%20Letter%20-%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"02151eae5947","org_name":"City of Maywood","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556174"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Maywood%20-%20Adult%20Consumer%20Notification%20Letter%20-%20PROOF.pdf"}],"summary":"The City of Maywood reported that an employee email account may have been accessed without authorization and personal information may have been involved.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d9d7260d4fead297d79438291c3bf9d2bc5d11a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14445.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"afb60126d977","org_name":"Audience Rewards","org_type":"unknown","ransomware":null,"records_affected":545,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14445.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-09","discovered_date":"2022-12-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9ec01844dd1c88aaa3910d2939f72f48c033f9ca","impact_type":"unknown","incident_date":"2022-06-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e87e5720ba8","org_name":"Sierra Pacific Industries","org_type":"unknown","ransomware":null,"records_affected":3732,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sierra%20Pacific%20Industries-2023-01-11"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sierra%20Pacific%20Industries-2022-08-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-08","discovered_date":"2022-04-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b52e7e4a35634f54550e1c81eaeb2c9fec4f68","impact_type":"data_theft","incident_date":"2022-04-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_9.pdf"},"notes":null,"org_country":"US","org_id":"d0376a3dd28c","org_name":"Yellow Social Interactive Limited","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An API vulnerability allowed access to data from a supporting YSI database.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556034"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_9.pdf"}],"summary":"An individual used an API vulnerability to access and copy some data from a supporting YSI database.","supporting_quote":"Here, the individual told YSI that he found an application programmable interface (API) vulnerability that allowed him to access data from a supporting YSI database.","technology_involved":["API","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-08","discovered_date":"2021-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"5cb0bd8617c5ba2b974bd1f31ca3055ee7601580","impact_type":"data_theft","incident_date":"2021-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16881.pdf"},"notes":null,"org_country":"US","org_id":"96417a437208","org_name":"Smith, Gambrell & Russell, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16881.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SMITH%2C%20GAMBRELL%20%26%20%20RUSSELL%2C%20LLP-2023-01-11"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-563742"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA16881.pdf"}],"summary":"Documents potentially containing personal information were taken from part of Smith, Gambrell & Russell’s information technology systems by an unauthorized person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2022-08-05","discovered_date":"2021-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59414a8e6dd32ee87b0d1fd5159e36271cbc6745","impact_type":"data_theft","incident_date":"2021-11-29","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13645.pdf"},"notes":null,"org_country":"US","org_id":"688822b4d59b","org_name":"R. R. Donnelley & Sons Company","org_type":"manufacturing","ransomware":null,"records_affected":648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13645.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13645.pdf"}],"summary":"R. R. Donnelley & Sons Company reported that a threat actor accessed and exfiltrated corporate data after gaining access through a phishing attack.","supporting_quote":"RRD also determined that the Threat Actor gained access through a phishing attack that targeted several employees on or about November 29, 2021.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d12e17b91436670fbb7605e1baa7078df9590abb","impact_type":"unknown","incident_date":"2021-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RRD%20Multistate%20Proof.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"688822b4d59b","org_name":"R.R. Donnelley & Sons Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555995"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#R.R.%20Donnelley%20%26%20Sons%20Company-2022-08-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2022-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c02e811b4b4f19c9de61ceed07ebe1dacbe5d47c","impact_type":"both","incident_date":"2022-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bc8bd8d58280","org_name":"QuestionPro","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: QuestionPro","type":"hibp","url":"https://haveibeenpwned.com/Breach/QuestionPro"}],"summary":"QuestionPro was targeted in an extortion attempt involving the alleged extraction of email addresses, IP addresses, browser user agents and survey results.","supporting_quote":null,"technology_involved":["QuestionPro survey platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2022-08-05","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f25276f975059f9d255bcde6f3e653c242305559","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prof%20Assoc.%20-%20Letter%20B%20-%20Beneficiary%20SSN%20-%20REDACTED%20%2810584482x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"316a43fb735e","org_name":"Proformance Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prof%20Assoc.%20-%20Letter%20B%20-%20Beneficiary%20SSN%20-%20REDACTED%20%2810584482x7AB84%29.pdf"}],"summary":"An unknown individual broke into Proformance Associates Inc.'s office and may have viewed or accessed files containing 401k forms.","supporting_quote":"On June 29, 2022 an unknown individual broke into our Proformance Associates Inc. office and accessed files containing 401k forms for former and current employees of the following entities: Proformance Associates Inc., Parker Robb Body Shop, Walnut Creek Honda and Oakland Acura.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2022-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6aa1f5bcaf0c8db0dbda6fdf247398ab02f26a5e","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-29","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CNI%20Notice%20Letter%20%28Adult%29_static%20proof%20r3.pdf"},"notes":null,"org_country":"US","org_id":"39b5bf6005cf","org_name":"Cornerstone National Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556012"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CNI%20Notice%20Letter%20%28Adult%29_static%20proof%20r3.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cornerstone%20National%20Insurance%20Company-2022-08-05"}],"summary":"An unauthorized third party accessed agent user accounts to run searches in subscription databases, potentially exposing personal information including driver’s license numbers.","supporting_quote":"On November 29, 2021, Cornerstone became aware that an unauthorized third party gained access to certain agent user accounts and leveraged this access to run unauthorized searches in these subscription databases.","technology_involved":["subscription databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c76de058130f5a8e35a8fc2a73bb3cc706d3d044","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-04","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Sample%20Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a98e5590f7b6","org_name":"TransUnion","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Sample%20Consumer%20Letter.pdf"}],"summary":"TransUnion reported suspicious activity in which unauthorized actors may have used personal information from non-TransUnion sources to impersonate consumers and access TransUnion products.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-08-04","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b82fb29f8dd419d089831595495edcb28e305be7","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-07-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13255.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4d43b37f2e15","org_name":"Tally Technologies","org_type":"financial","ransomware":null,"records_affected":46,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13255.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13255.pdf"}],"summary":"Tally reported that an unauthorized party used customer credentials acquired from an unrelated source in attempts to access Tally accounts.","supporting_quote":"We believe that an unauthorized party acquired customer credentials, such as usernames and passwords, from an unrelated source and attempted to use such credentials to access Tally accounts.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ffb57cd733e909f8fe16672108d4af303d2c81","impact_type":"both","incident_date":"2022-04-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRL%20-%20Sample%20Incident%20Notice%20-%20Submitted%20to%20Agency.pdf"},"notes":null,"org_country":"US","org_id":"d7fd4e8a8543","org_name":"Practice Resources, LLC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRL%20-%20Sample%20Incident%20Notice%20-%20Submitted%20to%20Agency.pdf"}],"summary":"Practice Resources, LLC reported a ransomware attack that may have exposed personal and medical information related to people it served.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-04","discovered_date":"2022-07-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d347076979fc698f0a349e1ce7e37b11a858ff0","impact_type":"unknown","incident_date":"2022-07-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64f97087b259","org_name":"Penrith Home Loans LLC","org_type":"unknown","ransomware":null,"records_affected":570,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Penrith%20Home%20Loans%20LLC-2022-08-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"786136d9cc40f89f00a3cc6a8ce379212b4935d9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MolecularPathologyLaboratoryNetworkInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d74dadfb2156","org_name":"Molecular Pathology Laboratory Network, Inc.","org_type":"unknown","ransomware":null,"records_affected":1743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MolecularPathologyLaboratoryNetworkInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"784ae6184c640e863eca431864d001fb181fb3ad","impact_type":"data_theft","imported_from":null,"incident_date":"2016-03-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"62b85ef1f9ed","org_name":"Tuned Global","org_type":"unknown","ransomware":null,"records_affected":985586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tuned Global","type":"hibp","url":"https://haveibeenpwned.com/Breach/TunedGlobal"}],"summary":"Data associated with Tuned Global, including personal information and plain-text passwords, was released to a public hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-03","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f658d1fcd8d95ad57fba5daa8b108310f08a83e8","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SinglePoint_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"c6d877c62af4","org_name":"SinglePoint","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SinglePoint_CA%20Sample.pdf"}],"summary":"Two laptops were stolen during a break-in at SinglePoint’s office, and a laptop may have contained files with names and Social Security numbers.","supporting_quote":"On May 20, 2022, the SinglePoint office was broken into, and two laptops were stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-03","discovered_date":"2022-05-23","entry_asset":"vpn_or_edge_device","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad1eb92d51efd60d92cc99fe8426d0d80bc2cfe1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OBS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0d017a46929f","org_name":"Orange Business Services U.S., Inc.","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized access occurred by exploiting a vulnerability in a third-party firewall device.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555934"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OBS%20-%20California%20Notification.pdf"}],"summary":"An unauthorized individual accessed Orange Silicon Valley servers through a vulnerability in a third-party firewall device, and an accessed server contained employee personal information.","supporting_quote":"On March 17, 2022, Orange Silicon Valley (OSV), a nonsubsidiary affiliate of OBS, learned that an unauthorized individual accessed several OSV servers on January 4, 2022, by exploiting a vulnerability in a third-party firewall device.","technology_involved":["third-party firewall device"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-03","discovered_date":"2021-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51f659b711f9afba97bf8e673b1a5ae398b7bc1b","impact_type":"data_theft","incident_date":"2021-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marymount%20Manhattan%20College%20-%20Consumer%20Notification%20Letter%20%28General%29_1.pdf"},"notes":null,"org_country":"US","org_id":"c4acba682d33","org_name":"Marymount Manhattan College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marymount%20Manhattan%20College%20-%20Consumer%20Notification%20Letter%20%28General%29_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marymount%20Manhattan%20College-2022-08-03"}],"summary":"An unknown actor accessed the Marymount Manhattan College network without authorization and obtained data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d591b2e3d933c065771915d8838f030cc56666d0","impact_type":"both","incident_date":"2022-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gibson%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3361b7bd3ff4","org_name":"Gibson Overseas, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555936"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gibson%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party obtained copies of files containing names and Social Security numbers during an incident that affected Gibson Overseas, Inc.'s computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3fbef2914e1bd3507817945715fae5a611c33bf","impact_type":"both","incident_date":"2022-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Form%20of%20Notice%20%28English%20and%20Spanish%29%208.3.22.pdf"},"notes":null,"org_country":"US","org_id":"cc6d9accd797","org_name":"A. Duda & Sons Inc.","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20of%20Notice%20%28English%20and%20Spanish%29%208.3.22.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#A.%20Duda%20%26%20Sons%20Inc.-2022-08-03"}],"summary":"An unauthorized third party accessed DUDA’s systems, deployed ransomware, and downloaded files that included personally identifiable information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-02","discovered_date":"2022-07-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"74633977302d30a2ff8434b79236552185432972","impact_type":"unknown","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c7891b5b297b","org_name":"St. Luke’s Health System","org_type":"unknown","ransomware":null,"records_affected":31573,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Luke%E2%80%99s%20Health%20System-2022-08-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53570eaf268228fa629b1e8320a1dc64a9334efd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6003f9510724","org_name":"Mecho Download","org_type":"other","ransomware":null,"records_affected":437928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mecho Download","type":"hibp","url":"https://haveibeenpwned.com/Breach/MechoDownload"}],"summary":"A breach of Mecho Download exposed email and IP addresses, usernames, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-02","discovered_date":"2021-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea85c5f021ced11bda4c071d9dee1ce222ed598d","impact_type":"data_theft","incident_date":"2021-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lower%20LLC-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1d3f4aaa8324","org_name":"Lower LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lower%20LLC-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lower%20LLC-2022-08-02"}],"summary":"Lower reported that an unauthorized actor accessed its systems and removed files containing names and Social Security numbers.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08622b4a9cd1af1bfb883b94528f24ab4072e664","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RINA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"54687f354e95","org_name":"RINA Accountants & Advisors","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560199"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555826"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RINA%20-%20Sample%20Notice.pdf"}],"summary":"RINA reported that an unauthorized actor may have accessed client information on its systems between February 28 and June 6, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-08-01","discovered_date":"2022-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b36aaf1a7de656b68294736936d52fbb536cc19f","impact_type":"disruption_or_ransomware","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"e5bc679b4b68","org_name":"CareSource","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notice%20Letter.pdf"}],"summary":"The filed notice reports that an attacker locked files containing personal and medical information, disrupting access to them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-08-01","discovered_date":"2022-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"68e4f5c0ca267795f2766cf888bc13d234809c61","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14044.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"de7dd8b05c28","org_name":"Camping World / Good Sam","org_type":"retail_ecommerce","ransomware":null,"records_affected":549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14044.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14044.pdf"}],"summary":"Camping World / Good Sam reported that an unknown third party accessed its systems and may have accessed or acquired personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d128b158bfdd61b0adf648742b85b67fc8a9f3dc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/BehavioralHealthGroupHoldingsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eadae2a3a04a","org_name":"Behavioral Health Group Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":2563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/BehavioralHealthGroupHoldingsLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2022-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92d924465c122efecbeeaa85cdaf91d744d95fb4","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_5.pdf"},"notes":null,"org_country":"US","org_id":"592a6a0e6043","org_name":"California Department of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555783"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_5.pdf"}],"summary":"The California Department of Justice exposed personal information through its Firearms Dashboard Portal during an update, and the information was publicly available for less than 24 hours.","supporting_quote":null,"technology_involved":["Firearms Dashboard Portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-07-29","discovered_date":"2022-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"42ff5f6eb4918b04e3aea09898e252b525606e24","impact_type":"both","imported_from":null,"incident_date":"2022-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-09-26_NHC_CA_Sample_Letters_1.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2da56fd15681","org_name":"The North Highland Company LLC","org_type":"professional_services","ransomware":true,"records_affected":14761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20North%20Highland%20Company%20LLC-2022-09-26"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20North%20Highland%20Company%2C%20LLC-2022-07-29"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557632"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-09-26_NHC_CA_Sample_Letters_1.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-09-26_NHC_CA_Sample_Letters_1.pdf"}],"summary":"The North Highland Company reported a ransomware attack on on-premises servers and confirmed that attackers exfiltrated personal information.","supporting_quote":null,"technology_involved":["on-premises servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-29","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93f80e4e997d54c618128639f0cea0c0ad8cfdce","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20from%20San%20Gabriel%20Unified%20School%20District%20English%20Minor%20Final%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"5ef8254e95e6","org_name":"San Gabriel Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555775"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20from%20San%20Gabriel%20Unified%20School%20District%20English%20Minor%20Final%20Letters.pdf"}],"summary":"San Gabriel Unified School District student information was contained in Illuminate Education databases that were subject to unauthorized access.","supporting_quote":null,"technology_involved":["Illuminate Education","databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Illuminate Education"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"676e3112d898","name":"Illuminate Education"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a17491131e5bbae129faa7b163d0348de9106be2","impact_type":"data_theft","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mall%20Services%20Group%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1f1c7c0283d4","org_name":"Mall Services Group LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mall%20Services%20Group%20Sample%20Notice.pdf"}],"summary":"Malware on servers hosting customer e-commerce sites may have captured payment card and related personal information entered at checkout.","supporting_quote":null,"technology_involved":["e-commerce sites","checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-29","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97fcaa9f1b9bb17b4efba48d946271ffe420ed95","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Greenfield%20Union%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9ddda9248dcf","org_name":"Greenfield Union School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555763"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Greenfield%20Union%20-%20Sample%20Notice.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information for Greenfield Union School District.","supporting_quote":null,"technology_involved":["isolated applications","databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Illuminate Education"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"676e3112d898","name":"Illuminate Education"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27eb075cb8760bce8615b95bf7315fd57774b848","impact_type":"unknown","incident_date":"2016-01-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"9ba06a3311c1","org_name":"Battlefy","org_type":"unknown","ransomware":null,"records_affected":83610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Battlefy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Battlefy"}],"summary":"In January 2016, the esports website Battlefy suffered a data breach that exposed 83k customer records . The impacted data included email addresses, usernames and passwords stored as bcrypt hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-28","discovered_date":"2022-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"547483be7759976eb5fd7980125fddc9f51537fb","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13062.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6b88f508fa2a","org_name":"Whatcom County Library System","org_type":"government","ransomware":null,"records_affected":630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13062.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13062.pdf"}],"summary":"Whatcom County Library System identified unusual activity, and an unknown actor downloaded files containing individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2c122e6daa699857de09af08d5325e24c6031b7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-11-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DGDG%20-%20Consumer%20Notice%20%286.22.22%29_static%20proof%20r1.pdf"},"notes":null,"org_country":"US","org_id":"5ef7201e459c","org_name":"Del Grande Dealer Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfiguration of a vendor's server allowed unauthorized parties a way to access personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DGDG%20-%20Consumer%20Notice%20%286.22.22%29_static%20proof%20r1.pdf"}],"summary":"A misconfiguration of a vendor's server created a way for unauthorized parties to access personal information, though the organization found no evidence that information was accessed, viewed, or exported.","supporting_quote":"due to a misconfiguration of a server on their system, a way existed for unauthorized parties to access certain personal information","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"004ba1fbdb7bbd45bad89e94885673069b2985ae","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/OneTouchPointInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4d5b8b8fdb6","org_name":"One Touchpoint, Inc.","org_type":"unknown","ransomware":null,"records_affected":86907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#One%20Touchpoint%2C%20Inc.-2022-07-27"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/OneTouchPointInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-27","discovered_date":"2022-06-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"471a54f682491f0c6902559c6826b53d173a3cf2","impact_type":"unknown","incident_date":"2022-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"76181f5599c6","org_name":"Heceta Water People's Utility District (HWPUD)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Heceta%20Water%20People%27s%20Utility%20District%20%28HWPUD%29-2022-07-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab6acead11cda7eb43685b274d791b8035e81063","impact_type":"data_theft","incident_date":"2022-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GPW%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5d136e6f4a16","org_name":"Gatto, Pope & Walwick, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GPW%20Sample%20Notice.pdf"}],"summary":"An unknown actor accessed a GPW employee’s work-related accounts and accessed and/or acquired files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-27","discovered_date":"2022-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe8a49efbd6d8fdba80e4f06115417f96ffd589f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aetna%20-%20Matrix%20Customer%20Notification%20Letter%20and%20FAQs%20-%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aetna%20-%20Matrix%20Customer%20Notification%20Letter%20and%20FAQs%20-%20FINAL.pdf"}],"summary":"Unauthorized access to OTP servers exposed information related to Aetna customers, but the specific files viewed could not be determined.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OTP"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"d4a9ecfe43c7","name":"OTP"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"698e6548108423518adc94765cca3b6eba7edbd0","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12975.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ef8cebbfba2d","org_name":"DigiPen Institute of Technology","org_type":"education","ransomware":null,"records_affected":5164,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12975.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12975.pdf"}],"summary":"DigiPen reported that an unauthorized party accessed files and data that may have contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2022-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c228a6d2edea53ccb0173d64edd82e8d75ad0459","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"skipped","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15790.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10f621609bf4","org_name":"Washington Federal Bank","org_type":"unknown","ransomware":null,"records_affected":36119,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15790.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-25","discovered_date":"2022-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eccbc9d471a9e366cea4fca81ff8bb419bd3c080","impact_type":"both","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15780.pdf"},"notes":null,"org_country":"US","org_id":"16a2b3352808","org_name":"Spokane Teachers Credit Union","org_type":"financial","ransomware":true,"records_affected":1517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15780.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15780.pdf"}],"summary":"Kaye-Smith Enterprises experienced a ransomware attack in which data that may have included Spokane Teachers Credit Union members’ personal and account information was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Kaye-Smith Enterprises, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"7fb12e618ea5","name":"Kaye-Smith"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b5a34ce7343166c6fdb857e75bbcf0fd291926c2","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15779.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ed07b34db9fe","org_name":"MultiCare Health System","org_type":"healthcare","ransomware":true,"records_affected":22679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15779.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15779.pdf"}],"summary":"MultiCare Health System reported that files were compromised in a ransomware attack and that names, addresses, and Social Security numbers may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d165cb5910a754fb1f5f0cba7867d23efc7d6787","impact_type":"disruption_or_ransomware","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15778.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ce361f461b13","org_name":"Kitsap Bank","org_type":"financial","ransomware":true,"records_affected":10154,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15778.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15778.pdf"}],"summary":"Kitsap Bank reported that files were compromised in a ransomware attack, potentially affecting names, addresses, and account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4806ef6777a171e1df49e335b98fb7edc3e1f7c","impact_type":"disruption_or_ransomware","incident_date":"2023-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15777.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"07e0e0f08952","org_name":"Kaye-Smith Enterprises, Inc.","org_type":"professional_services","ransomware":true,"records_affected":2262,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15777.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15777.pdf"}],"summary":"Kaye-Smith Enterprises reported that files were compromised in a ransomware attack, and that personal and financial information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-25","discovered_date":"2022-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"01d693ea54e8ce3b886e1dd1ee95430be7f99597","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13705.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"60eb5b5cd6b7","org_name":"Boeing Employees Credit Union","org_type":"financial","ransomware":null,"records_affected":305987,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13705.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13705.pdf"}],"summary":"Boeing Employees Credit Union reported that personal and financial information being processed by its printing vendor was involved in the vendor’s security incident.","supporting_quote":"On June 6, 2022, BECU was informed that its printing vendor had experienced a network security incident.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-25","discovered_date":"2022-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e96ea2079c4b87bceed98b7d36b00e2ce3ea1392","impact_type":"data_theft","incident_date":"2022-06-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13581.pdf"},"notes":null,"org_country":"US","org_id":"a55af8fa6d73","org_name":"Bellingham Public Library","org_type":"government","ransomware":null,"records_affected":735,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13581.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13581.pdf"}],"summary":"A file containing Bellingham Public Library patron data was downloaded without authorization from Whatcom County Library System’s computer network.","supporting_quote":null,"technology_involved":["shared library catalog and electronic management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Whatcom County Library System"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"6b88f508fa2a","name":"Whatcom County Library System"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-25","discovered_date":"2022-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97cdfdf0572a95687fecfea502aa3327095c5368","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"bb619e405ceb","org_name":"BECU","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BECU-2022-07-25"}],"summary":"BECU member information being processed by its printing vendor was potentially involved in the vendor's security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-22","discovered_date":"2022-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ade1ee735ffe2deab1040420a20544aac5b8bb7","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Zulily_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"0f7c64844f87","org_name":"Zulily, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555541"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Zulily_CA%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Zulily%2C%20LLC-2022-07-22"}],"summary":"A checkout-page code issue sent some customers’ transaction information to a payment processor that was not authorized to process payments for Zulily.","supporting_quote":null,"technology_involved":["website checkout page","payment card processor"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-22","discovered_date":"2022-06-28","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69f61a75fe34b3f175c84234cfc695abe7fd39b5","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12879.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8e9ad6bf73c4","org_name":"Sound Health & Wellness Trust","org_type":"healthcare","ransomware":null,"records_affected":36994,"reviewed":false,"root_cause":"The file used to prepare the mailing labels mistakenly included SSNs that were not necessary for the mailing.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12879.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12879.pdf"}],"summary":"A mailing sent by Zenith included recipients’ Social Security numbers on the mailing labels.","supporting_quote":"The file used to prepare the mailing labels mistakenly included your SSN.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"Zenith American Solutions"},"updated_at":"2026-10-12","veris_action":"error","derived":{"vendors":[{"id":"0110d07b9430","name":"Zenith American Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-22","discovered_date":"2022-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"767ee4fe82e3f081351f372a42207d875641e642","impact_type":"data_theft","incident_date":"2022-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Shields%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"b9ce0e377c7b","org_name":"Shields Health Care Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-565730"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555538"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Shields%20-%20Exhibit%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Shields%20Health%20Care%20Group%2C%20Inc.-2022-07-22"}],"summary":"An unknown actor accessed certain Shields systems and acquired data between March 7 and March 21, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-07-22","discovered_date":"2022-03-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a14cb1841eada9d227eeb020426c613f5aafc9e1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clinivate%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"64150d6722aa","org_name":"Clinivate, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555528"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clinivate%20Sample%20Notice.pdf"}],"summary":"Clinivate discovered unauthorized access to systems and files containing personal information, including medical and health-care payment information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e18461eac1280020594e3a1069b1fff248e6408","impact_type":"disruption_or_ransomware","incident_date":"2022-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jameco%20Final%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e41e41b16db2","org_name":"Arndt Electronics d/b/a Jameco Electronics","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555525"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jameco%20Final%20Notice.pdf"}],"summary":"Jameco reported a ransomware attack in which hackers accessed HR files related to current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-21","discovered_date":"2022-06-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d09dd1234d51897b8278a8a6811157b14360b72a","impact_type":"unknown","incident_date":"2022-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed27af1a47e1","org_name":"Alpha & Omega Semiconductor","org_type":"unknown","ransomware":null,"records_affected":692,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alpha%20%26%20Omega%20Semiconductor-2022-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0381d2a335877d324d1f221e97a1d7333459aaea","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2d43c1f3fbeb","org_name":"Shadi.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shadi.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Shadi"}],"summary":"A 2016 breach of Shadi.com exposed members' email addresses and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-20","discovered_date":"2022-06-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"da7371cf0e93cbe6f9cd79552f792c61e7e92a93","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ae060f2e03a","org_name":"Jet Industries, Inc.","org_type":"unknown","ransomware":null,"records_affected":2406,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jet%20Industries%2C%20Inc.-2022-07-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-07-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd84438a69578ff58eca1d51efa7d6333393df0d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General_AG838_v01.pdf"},"notes":null,"org_country":"US","org_id":"79cf54d809b6","org_name":"AllOne Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555461"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General_AG838_v01.pdf"}],"summary":"An unauthorized individual accessed an employee’s email account and accessed limited financial documents while attempting wire fraud; the organization reported no evidence that personal or sensitive information was acquired or sent outside its network.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-19","discovered_date":"2022-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c5af6b4e554368992dfdf7e8f2326185b2b17ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Filters%20Now%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"bdfa5547c628","org_name":"PPA Holdings, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555401"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Filters%20Now%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12800.pdf"}],"summary":"PPA Holdings reported unauthorized access to a database storing customer information from its e-commerce website, including payment card information.","supporting_quote":null,"technology_involved":["database","e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Black Basta","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14cdaa383c7cb50cdecbefad1e3448d453ba540a","impact_type":"disruption_or_ransomware","incident_date":"2022-04-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12742.pdf"},"notes":null,"org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"healthcare","ransomware":true,"records_affected":1303,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12742.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12742.pdf"}],"summary":"A ransomware attack on OneTouchPoint potentially affected Premera Blue Cross member information held at the vendor.","supporting_quote":"Matrix was notified on 4/29/2022 by OneTouchPoint, Inc. (“OTP”), their printing and mailing business associate that they were the target of a ransomware attack which initiated on 4/27/2022.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OneTouchPoint, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"40f1561f4638","name":"OneTouchPoint"}],"actor_id":"blackbasta"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1113e881278eaa0d26bc2f6c40880a2e9d8f9e97","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"80b3a245742b","org_name":"PPCGeeks","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PPCGeeks","type":"hibp","url":"https://haveibeenpwned.com/Breach/PPCGeeks"}],"summary":"A breach of PPCGeeks’ vBulletin forum exposed user records, including email and IP addresses, usernames, dates of birth, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6249850a4b971cb38dd3030f178fc22f30f84d88","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/LincareHoldingsInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"87b82605cc68","org_name":"Lincare Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":53358,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/LincareHoldingsInc.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2022-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c5d38cf8aad10a37e70d8c0660243125ae3a52d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d6d2d35f03c7","org_name":"Jukin Media","org_type":"other","ransomware":null,"records_affected":314290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JukinMedia","type":"hibp","url":"https://haveibeenpwned.com/Breach/JukinMedia"}],"summary":"Jukin Media suffered a data breach that exposed code, configuration, email addresses, names, phone numbers, IP addresses and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a6dd23be41e07a3251c1ec1b6d6e81ada090708","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"JP","org_id":"a8904d490d30","org_name":"Famm","org_type":"technology_saas","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Famm","type":"hibp","url":"https://haveibeenpwned.com/Breach/Famm"}],"summary":"Famm suffered a data breach in late 2020 that exposed customer records, including personal information and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52dcb48d3979fbe7504d06302b7127f94b52d532","impact_type":"data_theft","imported_from":null,"incident_date":"2020-09-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"45b48c551a89","org_name":"Eskimi","org_type":"technology_saas","ransomware":null,"records_affected":26000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Eskimi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Eskimi"}],"summary":"Eskimi suffered a breach that exposed 26 million records, including personal information and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-15","discovered_date":"2022-05-20","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f73b4d785f094a408258ce9d14098a4831203a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LAMC%20iPad%20Breach_Member%20Notification%20Letter_FINAL%20ADULT%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"a6d54a85341f","org_name":"Kaiser Foundation Health Plan, Inc., Southern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555311"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LAMC%20iPad%20Breach_Member%20Notification%20Letter_FINAL%20ADULT%20%281%29.pdf"}],"summary":"An individual broke into a locked storage area and stole an iPad containing photos of COVID-19 lab specimen labels and potentially health information.","supporting_quote":"On May 20, 2022, Kaiser Permanente discovered that an unknown individual broke into a locked storage area at the Kaiser Permanente Los Angeles Medical Center earlier that same day and stole a Kaiser Permanente iPad.","technology_involved":["iPad"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"LockBit","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfb55ebb11f39f8186ab3bcb7f9fa7794d7dea55","impact_type":"both","imported_from":null,"incident_date":"2022-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"fa3fed99fe65","org_name":"La Poste Mobile","org_type":"telecom","ransomware":true,"records_affected":533886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: La Poste Mobile","type":"hibp","url":"https://haveibeenpwned.com/Breach/LaPosteMobile"}],"summary":"LockBit ransomware targeted La Poste Mobile in July 2022, and company data was published publicly while its website remained offline.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"lockbit"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-14","discovered_date":"2022-03-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c4cf9e36656d2176c9f13c8b4a5a4d96175cee2","impact_type":"data_theft","incident_date":"2022-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d12208b7a42d","org_name":"Heritage Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559000"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555273"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12601.pdf"}],"summary":"Heritage Life Insurance Company reported that an unauthorized actor may have acquired customer data in an incident discovered on March 12, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-14","discovered_date":"2022-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f09ad3cf4a8f57ad8ba3d9139c3cbdbf34a4ee3","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12682.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d848158e5d2f","org_name":"Coordinated Care of Washington, Inc. & Coordinated Care Corp","org_type":"healthcare","ransomware":null,"records_affected":1021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12682.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12682.pdf"}],"summary":"Coordinated Care member data files stored on OTP’s systems were accessed by an unauthorized party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OTP"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"d4a9ecfe43c7","name":"OTP"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-13","discovered_date":"2022-01-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4feafd3da7f6c8e03840a098e42fbd4bdc716e96","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12658.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6a65afc9f071","org_name":"United Marketing, Inc.","org_type":"unknown","ransomware":null,"records_affected":4639,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12658.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12658.pdf"}],"summary":"An unauthorized actor accessed some employees’ email accounts, which may have contained personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-13","discovered_date":"2022-02-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"749da485f3863538ccfeeeff4f103e5851f1c502","impact_type":"unknown","incident_date":"2022-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"6e29d7637b5d","org_name":"Lawson Products, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555253"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification_1.pdf"}],"summary":"Lawson Products reported a cyber incident involving potentially unauthorized access, and said confidential information that may include personal information could have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-13","discovered_date":"2021-10-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"328b93399a810d7a0c753fcf8e612ec2cfbcf1fe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KMJ%20Corbin%20%26%20Co%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1bef4c33f6b8","org_name":"KMJ Corbin & Company LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555258"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KMJ%20Corbin%20%26%20Co%20-%20Sample%20Notice.pdf"}],"summary":"KMJ Corbin & Company LLP discovered suspicious activity involving an employee email account, and later determined that unauthorized access had occurred to certain employee email accounts.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-07-13","discovered_date":"2021-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84643ee868fb589f149a300a697077a4e9c853b5","impact_type":"data_theft","incident_date":"2021-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Klein%20Law%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d390ce5ed0d2","org_name":"Klein DeNatale Goldner","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555227"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Klein%20Law%20-%20Sample%20Notice.pdf"}],"summary":"Klein DeNatale Goldner reported that an unknown actor accessed its network and obtained data that included personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-12","discovered_date":"2022-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17c259e8b99dfdb7bcebb44f412b3d2a4b81b0d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_i0799_BSCA_L01_SAS_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555178"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i0799_BSCA_L01_SAS_0.pdf"}],"summary":"Blue Shield of California notified members that their protected health information may have been accessed after a ransomware event at subcontractor OneTouchPoint.","supporting_quote":"On April 28, 2022, Matrix’s subcontractor, OneTouchPoint (‘OTP’), detected suspicious network activity and confirmed a threat actor had infiltrated OTP’s servers.","technology_involved":["OneTouchPoint"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OneTouchPoint"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"40f1561f4638","name":"OneTouchPoint"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-11","discovered_date":"2021-10-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e841b8c755dd2e04ac550254e9ed39b49589d134","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WNJ%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"3a5a0cee077c","org_name":"Warner Norcross and Judd, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555153"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556316"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WNJ%20-%20Sample%20Notice.pdf"}],"summary":"Warner Norcross and Judd reported unauthorized activity involving some of its systems, and files containing individuals’ names may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73849db7faad3007e21bdd6f9b8c3f406d40bc54","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-10-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20%28Final%20PDF%29%20%2800415497xABDB4%29.pdf"},"notes":null,"org_country":"US","org_id":"f98b5a10e87d","org_name":"Spectrum Eye Physicians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the Alta Payment Portal allowed unauthorized access to patient payment receipts by modifying the website URL.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20%28Final%20PDF%29%20%2800415497xABDB4%29.pdf"}],"summary":"A vulnerability in Alta Billing’s payment portal allowed unauthorized access to Spectrum Eye Physicians patient payment receipts.","supporting_quote":"Upon investigation, the response team discovered that it was possible to alter the website URL for the Alta Payment Portal, which allowed for unauthorized access to the payment receipts for patients who paid through the portal.","technology_involved":["Alta Payment Portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Alta Billing (ECL)"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"20eefdfb8e97","name":"Alta Billing"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bf61e48f9f5634f1f7a1ea7af279ec5ec9878f7","impact_type":"unknown","incident_date":"2022-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LendingTree%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a8cba1ba0ae","org_name":"LendingTree, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555114"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-11","discovered_date":"2021-06-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c137a719b6884bd588d26f4310ef703be7e60433","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Afni%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0384662529ab","org_name":"Afni, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Afni%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Afni%20Inc-2022-07-11"}],"summary":"Afni reported that an unauthorized actor accessed certain systems and may have viewed or taken data that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-08","discovered_date":"2022-06-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3395c42a20fdc833d37bff3fe329bd43d6065189","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Form%20Notice%20to%20Residents%20%28US%20but%20not%20MA%20MT%20RI%29%20-%20PDF.pdf"},"notes":null,"org_country":"US","org_id":"05cfef1031b2","org_name":"Princeton University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Electronic files containing student information were publicly accessible on a Princeton-operated website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555062"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20Notice%20to%20Residents%20%28US%20but%20not%20MA%20MT%20RI%29%20-%20PDF.pdf"}],"summary":"Princeton University discovered that personal information in files on its website had been publicly accessible and accessed by third parties.","supporting_quote":"On June 6, 2022, Princeton University’s Office of Information Technology discovered that certain information about some former Princeton students was accessible in electronic files publicly available on a website operated by Princeton.","technology_involved":["Princeton-operated website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-08","discovered_date":"2022-03-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6a15d057f680245b5e7afaa18dd2f332d7ac91d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chefs%20Toys%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"4436d47ecc28","org_name":"Chefs' Toys, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555089"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chefs%20Toys%20-%20California%20Notification.pdf"}],"summary":"Chefs' Toys reported that hidden malicious code on its website may have accessed customers' payment card information entered between November 12, 2021 and April 26, 2022.","supporting_quote":null,"technology_involved":["ChefsToys.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2eb51c030086997ae8fe5760ba27befe87ff4878","impact_type":"disruption_or_ransomware","incident_date":"2021-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CLB%20-%20letter_Proof%20%282%29%20%28003%29_Redacted.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"5d700d24a9c1","org_name":"Central Licensing Bureau","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555083"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CLB%20-%20letter_Proof%20%282%29%20%28003%29_Redacted.pdf"}],"summary":"An unauthorized third party accessed and disabled some Central Licensing Bureau computer systems during a ransomware attack, and investigators found a data set that the party had accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a5c82abf91cd78209aa76aaa18b6da80638ec51","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-05-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notice%20-CHCF%20Final%20%20%207.5.2022.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555103"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notice%20-CHCF%20Final%20%20%207.5.2022.pdf"}],"summary":"An email containing personal and medical information was disclosed to five CCHCS employees who were not authorized or would not normally receive it.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"baeb3ec90c9a4c5e0050f9b52cace32668aa5a9e","impact_type":"both","incident_date":"2022-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sixt%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"b6cd95a40e03","org_name":"Sixt Rent-a-Car, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554982"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sixt%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party obtained files from Sixt’s file server during unauthorized activity that also caused certain systems to become unavailable.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-06","discovered_date":"2021-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4117c3be897a4590d41b0581df3e2f41026dcc88","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Peterson%20International%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"241b1d3d98f2","org_name":"Petersen International Underwriters","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Peterson%20International%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed documents stored on Petersen International Underwriters' systems, which may have included personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b421f662bccf65d8c9156d824fe89af600bf1d6","impact_type":"data_theft","imported_from":null,"incident_date":"2022-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"HK","org_id":"49888f3801c3","org_name":"Mangatoon","org_type":"technology_saas","ransomware":null,"records_affected":23040238,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mangatoon","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mangatoon"}],"summary":"A May 2022 breach exposed Mangatoon subscriber records, including personal information, social-login auth tokens, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0510fc33cea4a57c47f60b193c8b4184866d1253","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CarolinaBehavioralHealthAllianceLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"55d7fdb1b240","org_name":"Carolina Behavioral Health Alliance, LLC","org_type":"unknown","ransomware":null,"records_affected":6775,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CarolinaBehavioralHealthAllianceLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-04","discovered_date":"2022-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df705569fbf7139a8db005e090cf7865be6f71a1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ernest%20Packaging%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"58a2c44c4e9f","org_name":"Ernest Packaging Solutions","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554891"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ernest%20Packaging%20Breach%20Notice.pdf"}],"summary":"Ernest Packaging Solutions reported that attackers accessed its client portal and the data on it.","supporting_quote":null,"technology_involved":["client portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e1a8296f8ef1364db5402a565c07e849f4cc627","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6ac5313d7020","org_name":"Capital Economics","org_type":"professional_services","ransomware":null,"records_affected":263829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Capital Economics","type":"hibp","url":"https://haveibeenpwned.com/Breach/CapialEconomics"}],"summary":"Capital Economics exposed 263,829 customer records containing contact details, names, job titles, and employer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"843b0860bb63b241cd0e374dbd692d58a437ea09","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"1e0017e442e9","org_name":"Bourse des Vols","org_type":"retail_ecommerce","ransomware":null,"records_affected":1460130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bourse des Vols","type":"hibp","url":"https://haveibeenpwned.com/Breach/BourseDesVols"}],"summary":"A data breach at Bourse des Vols exposed personal information and travel histories.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"156cb135cbb321e8cb8a8a3209421729100e2865","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"e1f9c065023f","org_name":"Bookchor","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bookchor","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bookchor"}],"summary":"Bookchor customer records, including personal information and passwords stored as unsalted MD5 hashes, were exposed and later traded on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-01","discovered_date":"2021-12-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"f39feaadd357dd0a281af2223d6e54f8c9feaf15","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15236.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7dd6119d90ec","org_name":"WellDyneRx, LLC","org_type":"professional_services","ransomware":null,"records_affected":585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15236.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557286"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554879"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WellDyne%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15236.pdf"}],"summary":"Unauthorized access to a WellDyne email account occurred between October 30 and November 17, 2021, and the account contained information pertaining to affected individuals.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-07-01","discovered_date":"2022-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09a4b915c02f4a5756354e7015aeae6fecc6542f","impact_type":"both","incident_date":"2022-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Opt%20In%20Notification%20Proof%28272482109.1%29.pdf"},"notes":null,"org_country":"US","org_id":"266fce24117b","org_name":"Professional Finance Company, Inc.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554844"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Opt%20In%20Notification%20Proof%28272482109.1%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Professional%20Finance%20Company%2C%20Inc.-2022-07-01"}],"summary":"Professional Finance Company reported a ransomware attack that accessed personal information on its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-01","discovered_date":"2022-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"154915bf1e2ababee8d8189309ac5b7c1bcb461b","impact_type":"unknown","incident_date":"2022-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"851104578806","org_name":"MSS, Inc.","org_type":"unknown","ransomware":null,"records_affected":452,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MSS%2C%20Inc.-2022-07-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-01","discovered_date":"2022-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4cded2d73f9e50258c312a38f6ec9f99156f118d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13570.pdf"},"notes":null,"org_country":"US","org_id":"2a8cba1ba0ae","org_name":"LendingTree","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13570.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LENDING%20TREE%2C%20LLC-2022-07-18"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13570.pdf"}],"summary":"LendingTree reported that a code vulnerability likely resulted in unauthorized disclosure of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-07-01","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af0dafe6919557e8912c5539e93a8027a1c98953","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-Waterford%20Unified%20School%20Distric-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554829"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-Waterford%20Unified%20School%20Distric-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13162.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2022-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f4c637c00b231686ee2ff6d870162e3955cc2f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12444.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89cf7d461a74","org_name":"Fuller & Fuller","org_type":"unknown","ransomware":null,"records_affected":704,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12444.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13574.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-07-01","discovered_date":"2021-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2ea70c5c55f0ecffca7d085269b606b62ea33a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ATC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ce4b975e7e39","org_name":"ATC Healthcare Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554865"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ATC%20-%20Sample%20Notice.pdf"}],"summary":"ATC Healthcare Services discovered unauthorized access to certain employee email accounts, which may have exposed information in those accounts.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52ff72eda0425f3d5eb0305338e9c1269fd0f8e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20People%20Concern%20-%20CA%20Notification%20Letter_v03%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"9a9ae0baf4b4","org_name":"The People Concern","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554824"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20People%20Concern%20-%20CA%20Notification%20Letter_v03%20Proof.pdf"}],"summary":"The People Concern reported unauthorized access to some employees’ email accounts, with personal and medical information potentially involved.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-30","discovered_date":"2022-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"792d512bb758bdc7114f38dd3b3110e44ddcaff6","impact_type":"data_theft","incident_date":"2021-11-11","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28A%29%20MAIC%20Ad%20CM%2012m-%20Template%20A.pdf"},"notes":null,"org_country":"US","org_id":"69970465310f","org_name":"Michigan Avenue Immediate Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554783"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28A%29%20MAIC%20Ad%20CM%2012m-%20Template%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Michigan%20Avenue%20Immediate%20Care-2022-06-30"}],"summary":"Michigan Avenue Immediate Care reported that an unauthorized third party accessed its network and obtained files containing personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-30","discovered_date":"2022-05-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"63821f439bedc635fb997a51aef7e70a6506407e","impact_type":"unknown","incident_date":"2022-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb9770d405ad","org_name":"Avamere Health Ser Bvices, LLC","org_type":"unknown","ransomware":null,"records_affected":25672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Avamere%20Health%20Ser%20Bvices%2C%20LLC-2022-06-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc8191e7ea846adb35facff32db29f623bb7bd09","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/BenefitPlanAdministratorsInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25c99d933156","org_name":"Benefit Plan Administrators, Inc.","org_type":"unknown","ransomware":null,"records_affected":2841,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/BenefitPlanAdministratorsInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3580469ada1e80e82f05ffb23c5c0e05c83b49c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20notice%20template%20FINAL_ADULT_static%20proof%20r4.pdf"},"notes":null,"org_country":"US","org_id":"578130630d46","org_name":"MCG Health","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554687"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20notice%20template%20FINAL_ADULT_static%20proof%20r4.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11903.pdf"}],"summary":"MCG Health notified affected people of an incident and offered identity protection services; the provided excerpt does not state how the incident occurred or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-06-28","discovered_date":"2022-03-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d0de30ead1ce743d083c651fcf2eb2bb0e036f0","impact_type":"data_theft","incident_date":"2022-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_i0241_Bill%20Pollard%20Jr%20CPA_L01_SAS_0_1.pdf"},"notes":null,"org_country":"US","org_id":"f883e449a359","org_name":"Bill Pollard CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554702"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_i0241_Bill%20Pollard%20Jr%20CPA_L01_SAS_0_1.pdf"}],"summary":"Bill Pollard CPA reported that attackers exfiltrated a file containing personal information from company software.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2835e36ecfc5c88bb0c6a480c5912fd71193db29","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13622.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3017736ea5b3","org_name":"Avamere Health Services, LLC  (Signature Healthcare at Home (Signature), Premere Rehab, LLC (Infinity Rehab))","org_type":"unknown","ransomware":null,"records_affected":65076,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13622.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-24","discovered_date":"2022-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa1362c05f50ee390a296d27e021ada6909099d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pandemic%20Response%20Lab%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"310b10625e93","org_name":"Pandemic Response Lab","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554585"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pandemic%20Response%20Lab%20Notification%20Template.pdf"}],"summary":"Pandemic Response Lab reported that a document containing personal and medical information may have been accessible to people with its link.","supporting_quote":"On or about March 2, 2022 PRL discovered that a document may have been accessible to individuals that had the link to the document, even if they were not authorized to see it.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a6f7d66da62120fe9914108f856866952b3def5","impact_type":"unknown","incident_date":"2020-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AHS-%20Adult%201%20Year%20CM.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc95ab3cd7bc","org_name":"Alameda Health System","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554583"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb901d238c714de9757596af826068499a642362","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12250.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5b38f8479410","org_name":"New Schryver, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12250.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12250.pdf"}],"summary":"Unauthorized persons entered a New Schryver facility and physically accessed hard drives that may have contained names and dates of birth.","supporting_quote":"On April 17, 2022, unauthorized persons entered one of our facilities and gained physical access to a set of hard drives and other equipment.","technology_involved":["hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-06-23","discovered_date":"2021-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dd0fa69ccbeefacca034435e9a081c43dd25c8d7","impact_type":"data_theft","incident_date":"2021-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13498.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a74c74592ecb","org_name":"Great Smoky Mountains Association","org_type":"nonprofit","ransomware":null,"records_affected":2862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13498.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13498.pdf"}],"summary":"Great Smoky Mountains Association reported that unauthorized code on part of its e-commerce platform collected customers’ payment card information.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-06-23","discovered_date":"2021-11-10","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58af1d5cc8b9696129b1718e7bde9da05118d4d7","impact_type":"data_theft","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LS%200622-096%20ATM%20Skimming-GLBA%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554547"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LS%200622-096%20ATM%20Skimming-GLBA%20Incident.pdf"}],"summary":"Bank of the West found skimming devices installed on several ATMs, allowing card numbers, PINs, and possibly names and addresses to be stolen.","supporting_quote":"Our review found that a device known as an “ATM skimming device” had been installed on several of our ATMs.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-22","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c51a2796f968d15a6c870ac8471fe12f2d34565c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13493.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e25fe662712","org_name":"Renton School District","org_type":"education","ransomware":null,"records_affected":20509,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13493.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13493.pdf"}],"summary":"Renton School District student information was contained in databases accessed without authorization at Illuminate Education.","supporting_quote":null,"technology_involved":["Illuminate Education","databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Illuminate Education"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"676e3112d898","name":"Illuminate Education"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda3ff4ffa7a4649216c9c095f2cd5bf3b9c3830","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice_1.pdf"}],"summary":"Covenant Care California identified unauthorized access to email accounts associated with its Home Health services.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-19","discovered_date":"2022-04-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd243195da4e9f4695c20de4315008fb0caeab60","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SilverStreak%20Solutions%20-%20Consumer%20Notification%20Letter%20California%20%28Adult%20-%2012%20months%29%20V2%20PROOF%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"b158c88fe3bd","org_name":"Silver Streak, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An inadvertently misconfigured web application made personal information accessible on the organization's website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554402"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SilverStreak%20Solutions%20-%20Consumer%20Notification%20Letter%20California%20%28Adult%20-%2012%20months%29%20V2%20PROOF%20%281%29.pdf"}],"summary":"SilverStreak reported that a misconfigured web application made personal information accessible on its website.","supporting_quote":"On April 6, 2022, SilverStreak discovered an inadvertently misconfigured web application that caused personal information to be accessible on our web site.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-17","discovered_date":"2022-04-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f6f726e672ef21d5f8f70f6fd7e3b44dd2a4980","impact_type":"unknown","incident_date":"2022-04-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d49132f4bd1d","org_name":"Tosoh America, Inc.","org_type":"unknown","ransomware":null,"records_affected":880,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tosoh%20America%2C%20Inc.-2022-06-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56ba9496de87e34636a7ba53ec3dba34ca70eadf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/StokesRegionalEyeCenters.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78d3f7276998","org_name":"Stokes Regional Eye Centers","org_type":"unknown","ransomware":null,"records_affected":259527,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/StokesRegionalEyeCenters.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2022-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"fca3ca8fd00362e8385b683d6b00442c8d063b76","impact_type":"unknown","incident_date":"2021-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13499.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"763a2a23518f","org_name":"Flagstar Bank","org_type":"financial","ransomware":null,"records_affected":34026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Flagstar%20Bank%2C%20FSB-2022-06-17"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13499.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554369"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Flagstar%20Standard%20Notification%20Letter%20%28CA%29%20-%2006-17-2022.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13499.pdf"}],"summary":"Flagstar Bank reported unauthorized access to its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d2be6dd6d70fd852ad0e7ba57efc37c18eeed6d","impact_type":"disruption_or_ransomware","incident_date":"2021-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELN-14255%20Harvey%20Abraham%20Fishman%20Ad%201yr%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"835ea7e7bd18","org_name":"Fishman Vision","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554366"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELN-14255%20Harvey%20Abraham%20Fishman%20Ad%201yr%20r1prf.pdf"}],"summary":"An unauthorized party accessed myCare Integrity data and deleted databases and system configuration files; Fishman Vision reported no evidence that its patient records were accessed.","supporting_quote":null,"technology_involved":["myCare Integrity"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Eye Care Leaders"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"af63637c8b22","name":"Eye Care Leaders"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-17","discovered_date":"2022-04-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"51689325188d456a40c7eceb450a893d5cb316d7","impact_type":"unknown","incident_date":"2022-04-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72fd134b5215","org_name":"Epson Portland Inc.","org_type":"unknown","ransomware":null,"records_affected":6250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Epson%20Portland%20Inc.-2022-06-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-16","discovered_date":"2022-04-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"215e64b60569866929d347a737a20812789dbbce","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Greenheart%20-%20CA%20Exhibit.pdf"},"notes":null,"org_country":"US","org_id":"36194bab99e6","org_name":"Greenheart Farms Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Greenheart%20-%20CA%20Exhibit.pdf"}],"summary":"An unauthorized party accessed an employee’s email account, which may have contained individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-15","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"abf0e7469ea87a0925c6ce08a0ad35bc414a524a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12056.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9066fa7480d1","org_name":"UW Medicine","org_type":"healthcare","ransomware":null,"records_affected":739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12056.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12056.pdf"}],"summary":"A laptop containing patient EMG reports and personal information was stolen during a burglary at a UW Medicine clinic.","supporting_quote":"On approximately April 16, 2022, the UW Medicine Neurology Clinic at Meridian Pavilion (previously called Northwest Neurology) was burglarized, and a laptop used to create and store electromyography (EMG) reports was stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-15","discovered_date":"2022-05-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"28f7af432fcfe0584d26d085180c37a9f264a7b3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3a8934e79291","org_name":"The Allison Inn & Spa","org_type":"unknown","ransomware":null,"records_affected":1665,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Allison%20Inn%20%26%20Spa-2022-06-15"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Allison%20Inn%20%26%20Spa-2022-07-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-06-15","discovered_date":"2022-04-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90db1e720c7d32220da18e1d31b27c0e98840b0a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-06-15%20-%20CA%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7419bec26bd5","org_name":"Baptist Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554297"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554593"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-06-15%20-%20CA%20Individual%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baptist%20Medical%20Center-2022-06-15"}],"summary":"An unauthorized third party accessed systems containing personal information and removed some data from Baptist Medical Center’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-15","discovered_date":"2021-09-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8407ced68c5f2a9d3af5e066c0ab65f9ce84a8f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"e48e979a13c3","org_name":"ADM Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554304"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20%282%29.pdf"}],"summary":"ADM Associates detected a cyber event affecting internal systems, and an investigation found that information may have been accessed or acquired by an unauthorized person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-14","discovered_date":"2022-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76f7d9ec543fbe1341781c0c733a5e463c51dc70","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12042.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ebffecd38a26","org_name":"Sight Partners Physicians, P.C.","org_type":"healthcare","ransomware":null,"records_affected":83848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12042.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12042.pdf"}],"summary":"Sight Partners said a cyberattack on ECL’s Integrity EHR system may have affected patient information, but ECL could not determine whether files were viewed or taken.","supporting_quote":null,"technology_involved":["Integrity EHR system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ECL"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"0d7e032510bc","name":"ECL"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f9653be2517c4f31a1ae5d30d339e55ce6aff72","impact_type":"unknown","incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"2a3928b62a5c","org_name":"DivX SubTitles","org_type":"unknown","ransomware":null,"records_affected":783058,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DivX SubTitles","type":"hibp","url":"https://haveibeenpwned.com/Breach/DivXSubTitles"}],"summary":"In approximately 2010, the now defunct website DivX SubTitles suffered a data breach that exposed 783k user accounts including email addresses, usernames and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-06-14","discovered_date":"2022-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c83201345e05724a38a751174c09eee0ce82ba60","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Comstar%2C%20LLC%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"c3280410a0df","org_name":"Comstar, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556479"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554280"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554800"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Comstar%2C%20LLC%20-%20Sample%20Notice_1.pdf"}],"summary":"Comstar discovered suspicious activity affecting its environment, and files containing personal information were subject to unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec052ffdff27732a0365ee5a280eaeabde367c4e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/AugustaUniversityMedicalCenter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1b425dae1045","org_name":"Augusta University Medical Center","org_type":"unknown","ransomware":null,"records_affected":11181,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/AugustaUniversityMedicalCenter.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd7b5f5c4f1c3945e2813ba4092163902d79cc7d","impact_type":"data_theft","imported_from":null,"incident_date":"2022-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Shapiro%20Tax%20Group_Proof%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"204919a17bdb","org_name":"Shapiro Tax Group LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554229"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Shapiro%20Tax%20Group_Proof%20%282%29.pdf"}],"summary":"Shapiro Tax Group reported that one of its emails may have been compromised, resulting in data theft that may have involved personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82f78e7532498df378bc715fde94f582b18f9799","impact_type":"unknown","incident_date":"2021-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eac1a4ff6c7a","org_name":"Delta Group Electronics Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554218"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2022-06-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2a68fab162fbd7b87281a51aed5fa739e0d19cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Simpson%20-%20Template%20A%20-%20Adult%201%20Year%20CM%20%2883644838v2%29.pdf"},"notes":null,"org_country":"US","org_id":"2c64ef7dc95c","org_name":"Simpson University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Simpson%20-%20Template%20A%20-%20Adult%201%20Year%20CM%20%2883644838v2%29.pdf"}],"summary":"An unauthorized party accessed certain Simpson University employee email accounts between July 29 and September 17, 2021; the university found no evidence confirming that the party viewed the information in them.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"83fad3bd92fff5aef60d5a6eae7b0aa463518aee","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PracticeMax.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"766ea0256762","org_name":"PracticeMax","org_type":"unknown","ransomware":null,"records_affected":3079,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PracticeMax-2022-06-10"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PracticeMax.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-10","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4708d91ae3e5dee7d5aedec1179f65a9035fc310","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Ventura%20Unified%20School%20District.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Ventura%20Unified%20School%20District.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information between December 28, 2021, and January 8, 2022.","supporting_quote":null,"technology_involved":["databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98aa01e6e1ab1ac5557d1ce409d38495cc46331b","impact_type":"unknown","incident_date":"2020-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/Data%20Subject%20Notification%20Letter%20%28DanaherCorp%206-13-22%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"018bdea2e15c","org_name":"Danaher Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554212"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-10","discovered_date":"2021-12-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb545bcb7bd5e51fc04a9dd7f16f7e26f90a1f89","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/APTG%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9cb8759d4744","org_name":"Alliance Physical Therapy Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554200"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/APTG%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11892.pdf"}],"summary":"Alliance Physical Therapy Partners reported that personal information on its systems may have been accessed without authorization between December 23 and December 27, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b2e99f9242c4e1a53a8e5a4c7dc8ff586c5a1ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/90%20Degree%20Benefits%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"de285f4bf1c3","org_name":"90 Degree Benefits, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554203"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/90%20Degree%20Benefits%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/90DegreeBenefitsInc.pdf"}],"summary":"90 Degree Benefits reported that unauthorized access affected systems and files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bee69890c0c8fde67b5ecca8cd4a0d01c25c4228","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NortheasternTechnicalCollege.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4e9a02b32a37","org_name":"Northeastern Technical College","org_type":"unknown","ransomware":null,"records_affected":20195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NortheasternTechnicalCollege.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7daf7b9bbed514294ccd6757cae5a0b3dc12e23c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13477.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"de285f4bf1c3","org_name":"90 Degree Benefits","org_type":"professional_services","ransomware":null,"records_affected":2211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13477.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13477.pdf"}],"summary":"90 Degree Benefits reported unauthorized access to systems and files containing personal information, but could not determine whether the information was viewed or accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-08","discovered_date":"2022-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c30600addd10915a1adadb303f55e5c243d6cd52","impact_type":"data_theft","incident_date":"2022-05-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Choice%20Health%20-%20Template%20Notification%20Letter%20to%20Affected%20Individuals.pdf"},"notes":null,"org_country":"US","org_id":"29fa0c0a4474","org_name":"Choice Health Insurance, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party service provider caused a technical security configuration issue that made a Choice Health database accessible through the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554136"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Choice%20Health%20-%20Template%20Notification%20Letter%20to%20Affected%20Individuals.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Choice%20Health%20Insurance%2C%20LLC-2022-06-08"}],"summary":"An unauthorized individual accessed a Choice Health database exposed through a technical configuration issue caused by a third-party service provider and obtained database files containing personal and health insurance information.","supporting_quote":"On May 18, 2022, we determined that, due to a technical security configuration issue caused by a third -party service provider, a single Choice Health database was accessible through the Internet.","technology_involved":["database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2022-06-07","discovered_date":"2022-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ded19ae94bcd7de2ab193183cb9fcc93db0cf63","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-06-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Survival%20Servers%20Sample%20Email%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7d127b205891","org_name":"Survival Servers, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A public policy rule for Amazon Web Services storage was incorrectly set, exposing a database backup file.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554087"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Survival%20Servers%20Sample%20Email%20Notice.pdf"}],"summary":"Survival Servers disclosed that a misconfigured public policy rule exposed a database backup file stored with Amazon Web Services.","supporting_quote":"On June 4, 2022, we became aware that one of our database backup files from January 2022 was exposed due to a public policy rule for Amazon web services (where our off-site backups are stored) that was incorrectly set.","technology_involved":["Amazon Web Services","database backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Amazon Web Services"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"788a62660e2f","name":"Amazon Web Services"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82be5aba392b59bc9f4bf3ea0c8bd9ceb4e6eb46","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MUSCHealthAlliance.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83ae9eb51798","org_name":"MUSC Health Alliance","org_type":"unknown","ransomware":null,"records_affected":3685,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MUSCHealthAlliance.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cd0e8b4a2ce7c9c75df957df88c7bef0db548828","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/TTUHSC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"efc6f6e66962","org_name":"Texas Tech University Health Sciences Center","org_type":"unknown","ransomware":null,"records_affected":537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/TTUHSC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-06-06","discovered_date":"2022-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94ffce1cb05f48797a0771325ec848e0ff3eb24c","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Numrich%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7ca38f2637f9","org_name":"Numrich Gun Parts Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554080"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Numrich%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Numrich%20Gun%20Parts%20Corporation-2022-06-06"}],"summary":"Numrich Gun Parts Corporation reported that an unknown individual accessed customer payment information entered on its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-03","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"787e66b2cdb2166983f6fe396dc575e516ec1466","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Varsity%20Tutors%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e985792c12be","org_name":"Varsity Tutors LLC","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An AWS S3 bucket may have been misconfigured so information in it was publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554040"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Varsity%20Tutors%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Varsity%20Tutors%20LLC-2022-06-03"}],"summary":"Varsity Tutors reported that a potentially misconfigured AWS S3 bucket may have exposed government-issued identification, though unauthorized access or acquisition could not be confirmed.","supporting_quote":"The misconfiguration was promptly remediated.","technology_involved":["Amazon Web Services S3 storage bucket"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-06-03","discovered_date":"2022-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6b9c1e34ecc70a5cab9a701dde3be06b3775b77","impact_type":"data_theft","incident_date":"2020-09-21","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d5384c472190","org_name":"Rennline Automotive","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554004"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Individual%20Notification%20Letter.pdf"}],"summary":"Payment card information submitted by some Rennline customers may have been acquired by an unauthorized party after malware was identified on Freestyle’s systems.","supporting_quote":"On March 2, 2022, Freestyle notified Rennline that it had identified malware on Freestyle’s systems and had retained outside data security experts to conduct an investigation to determine what information may have been affected.","technology_involved":["Freestyle","payment processing systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-06-03","discovered_date":"2022-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28a3b2efe2dbf44204ec24dab2a777336749fe40","impact_type":"data_theft","incident_date":"2022-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_H9366_On%20Deck%20Capital%20Inc_L01_SAS_2.pdf"},"notes":null,"org_country":"US","org_id":"d6e0832c0db9","org_name":"On Deck Capital, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_H9366_On%20Deck%20Capital%20Inc_L01_SAS_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#On%20Deck%20Capital%2C%20Inc.-2022-06-03"}],"summary":"OnDeck Capital reported that an unauthorized actor copied data to a private cloud storage account, including personal information about affected individuals.","supporting_quote":null,"technology_involved":["private cloud storage account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e6d14985272dc92e977ce30417b3360d959389df","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11624.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"826324e05dba","org_name":"Kaiser Foundation Health Plan of Washington","org_type":"healthcare","ransomware":null,"records_affected":69589,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11624.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11624.pdf"}],"summary":"An unauthorized party accessed an employee’s emails at Kaiser Foundation Health Plan of Washington, which contained protected health information that may have been exposed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-06-03","discovered_date":"2022-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cfdb3b3bc3eed00ee9704b07beafb76f4414a3a","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ESI%20Mobile%20App%20Cred%20Stuff%20-%20Member%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"e5a28ecf2041","org_name":"Express Scripts, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The login credentials were obtained from publicly available data from another entity’s breach and used to access the mobile application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554045"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ESI%20Mobile%20App%20Cred%20Stuff%20-%20Member%20Notification%20Template.pdf"}],"summary":"Express Scripts identified suspicious logins to its mobile application using credentials obtained from publicly available data, and the account’s prescription history may have been accessed.","supporting_quote":"We believe this may have been a bad actor who was able to obtain your user ID and password in publicly available data from another entity’s breach to use to login to the mobile application between April 30, 2022 and May 3, 2022.","technology_involved":["Express Scripts mobile application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2995f0ac71254e7e5227ee6a4281ed0516d1c58c","impact_type":"disruption_or_ransomware","incident_date":"2021-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Lanier%20Law%20Firm%20PPLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c64f960f7576","org_name":"The Lanier Law Firm PLLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553985"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Lanier%20Law%20Firm%20PPLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Lanier%20Law%20Firm-2022-06-02"}],"summary":"The Lanier Law Firm reported that an unknown actor accessed certain systems during a malware attack that encrypted systems, and the impacted information may have included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-06-02","discovered_date":"2022-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a17d904aba6370ab6ca21fe8f7d31f49c33a466","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rainier%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"1af960903930","org_name":"Rainier Arms","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553998"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rainier%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rainier%20Arms-2022-06-02"}],"summary":"Rainier Arms reported that malicious code on its website may have allowed an unauthorized party to access names and payment card information entered on the site.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3423cd43efcf25640877066dc75bd3815be9f7ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13490.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfc564aa7ba3","org_name":"Stephen Sims, MD, PA","org_type":"unknown","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13490.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","credentials"],"disclosed_date":"2022-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ece5637c2e4a002f4c8958435699ef02115a28d7","impact_type":"data_theft","imported_from":null,"incident_date":"2021-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"019680c0759e","org_name":"CTARS","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CTARS","type":"hibp","url":"https://haveibeenpwned.com/Breach/CTARS"}],"summary":"A breach of the CTARS cloud platform exposed participant information, including personal, medical, and credential data.","supporting_quote":null,"technology_involved":["CTARS cloud platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"276df4e86c8defde453b60bd97478cebf6fdeb9a","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9e7b31304045","org_name":"Adecco","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adecco","type":"hibp","url":"https://haveibeenpwned.com/Breach/Adecco"}],"summary":"A breach of Adecco customer data in South America exposed email addresses, personal details, phone numbers and bcrypt-hashed passwords, and the data was sold on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"940b043e0d535fa8d48b8bad4e911588a069d73e","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"03b49f1b849d","org_name":"MGM Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MGM Resorts (2022 Update)","type":"hibp","url":"https://haveibeenpwned.com/Breach/MGM2022Update"}],"summary":"MGM Resorts reported a 2019 data breach of a cloud service, and exposed guest information was later shared online.","supporting_quote":null,"technology_involved":["cloud service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-27","discovered_date":"2021-11-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"378a6b8a1657095f8277457e449f4d8920db6248","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10465.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6c3eb4d11e31","org_name":"Private Client Services, LLC","org_type":"unknown","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10465.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10465.pdf"}],"summary":"Private Client Services discovered unauthorized access to an employee email account and could not rule out that information in the account was viewed or acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-27","discovered_date":"2020-12-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38b7f22dffe9af9017340363fadbfb7e7cd88226","impact_type":"both","incident_date":"2020-11-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Perkins%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"190c6bee035c","org_name":"Perkins & Company, PC","org_type":"professional_services","ransomware":true,"records_affected":23018,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556212"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553857"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Perkins%20-%20Sample%20Notice_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co-2021-03-11"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10422.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co.-2021-03-26"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co.-2021-04-04"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co-2021-04-10"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co-2021-04-23"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Co-2021-05-04"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Perkins%20%26%20Company%20PC-2022-05-27"}],"summary":"An attacker accessed files on servers hosted by Netgain, stole some files, and encrypted files in a ransomware attack.","supporting_quote":"Between November 8, 2020, and December 3, 2020, an attacker accessed servers storing Perkins’ files, some of which they copied and stole.","technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-27","discovered_date":"2021-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"559a365ce215809ea03f2a8963d544818c33fa85","impact_type":"data_theft","incident_date":"2021-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lower%20LLC%20-Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1d3f4aaa8324","org_name":"Lower LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557947"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lower%20LLC%20-Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10466.pdf"}],"summary":"Lower identified unauthorized access to its network and removal of files, with activity also identified in a limited number of employee email accounts.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-27","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fceba20c47bc2eca3ad7265558e452735f69b8dd","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553833"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Sample%20Notice_1.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information, including names.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-05-27","discovered_date":"2022-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"987d296441879dd71ea081711ab8e040831b3af9","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_5.pdf"},"notes":null,"org_country":"US","org_id":"0a1b711e41ce","org_name":"Capsule","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555781"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553843"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_5.pdf"}],"summary":"Unauthorized threat actors accessed certain Capsule accounts, potentially exposing personal, health, payment, insurance, order-history, and chat information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ed47a4a3f9adaf8cc191481ed5c16429683f898","impact_type":"both","imported_from":null,"incident_date":"2020-05-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"085a795bbb66","org_name":"Preen.Me","org_type":"technology_saas","ransomware":true,"records_affected":236105,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Preen.Me","type":"hibp","url":"https://haveibeenpwned.com/Breach/PreenMe"}],"summary":"Preen.Me was the target of a ransom attack in May 2020, and records containing email addresses, names, usernames, and social media profile links were publicly posted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99c8aec5643bf9a9d4d8e619884ae97c7e52e0ab","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ceres%20Unified%20School%20District%20Notice%20of%20Data%20Breach%20_Final_Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"aabf3c0e0aa6","org_name":"Ceres Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553814"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ceres%20Unified%20School%20District%20Notice%20of%20Data%20Breach%20_Final_Letter%20Template.pdf"}],"summary":"Ceres Unified School District reported that databases containing student information in Illuminate applications were accessed without authorization.","supporting_quote":null,"technology_involved":["applications","databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Illuminate, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"676e3112d898","name":"Illuminate Education"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-26","discovered_date":"2022-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e314fc16ca0bb1f09bc6973b65d550ca912118a","impact_type":"data_theft","imported_from":null,"incident_date":"2020-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTICE%20TEMPLATE.pdf"},"notes":null,"org_country":"US","org_id":"d072eb72af7f","org_name":"Aon","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553817"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTICE%20TEMPLATE.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aon%20Plc-2022-05-26"}],"summary":"Aon reported that an unauthorized third party accessed certain systems and temporarily obtained documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-25","discovered_date":"2022-03-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"447731fea5fbf51ad66673490f7b0d8c6be2d413","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10380.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c2db023ba353","org_name":"Fred Hutchinson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":89111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fred%20Hutchinson%20Cancer%20Center-2022-10-21"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10380.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-558466"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28AD%20CM%2012M%29%20ELN-15938%20Fred%20Hutchinson%20CC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10380.pdf"}],"summary":"An unauthorized individual accessed an employee’s business email account between March 25 and March 26, 2022; the account contained sensitive information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db8fda2bcd6a3f6c73fe1043e3a52608a5d61657","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elephant%20Insurance%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4993ec1ea345","org_name":"Elephant Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553749"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elephant%20Insurance%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/ElephantInsuranceServicesLLC.pdf"}],"summary":"Elephant Insurance Services determined that consumer information may have been viewed or copied from its network between March 26 and April 1, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4e0223c5231ef9536c39ca35ca81cb4dc728f40","impact_type":"data_theft","imported_from":null,"incident_date":"2022-05-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"d815846d2038","org_name":"Amart Furniture","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Amart Furniture","type":"hibp","url":"https://haveibeenpwned.com/Breach/AmartFurniture"}],"summary":"Amart Furniture's warranty claims database hosted on Amazon Web Services was targeted in a cyber attack, and records were exposed and shared online.","supporting_quote":null,"technology_involved":["Amazon Web Services","warranty claims database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b205c9656ab5860160246f0114650255d7f146f4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"PH","org_id":"4216003614d4","org_name":"Wendy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wendy's","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wendys"}],"summary":"A March 2018 breach involving Wendy's in the Philippines exposed personal information and passwords belonging to customers and job applicants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fe5e4913d98ef7d969cc63922862c6c3c9c4160","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"78bb6d28af5b","org_name":"SirHurt","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SirHurt","type":"hibp","url":"https://haveibeenpwned.com/Breach/SirHurt"}],"summary":"SirHurt suffered a data breach in April 2021 that exposed customer records including email and IP addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-24","discovered_date":"2021-10-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63502b4dcee94bf224543012808266b9cacfe653","impact_type":"data_theft","incident_date":"2021-10-03","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Singleton%20Schreiber%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1cc1ec555987","org_name":"Singleton Schreiber, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553670"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Singleton%20Schreiber%20-%20Sample%20Notice.pdf"}],"summary":"Singleton Schreiber discovered a data security incident in October 2021 and found that some files were acquired from its network environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4883b6b52fb3b6e29824417cd03ac6f0a717796c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-04-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"376666ae4945","org_name":"Fanpass","org_type":"retail_ecommerce","ransomware":null,"records_affected":112251,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fanpass","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fanpass"}],"summary":"Fanpass exposed 112,251 customer records, including personal information and salted password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-24","discovered_date":"2021-10-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f46cf51f48d20ab028ce2d47d8aaa8868f24862d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C.R.%20England%20-%20Consumer%20Notification%20Letter%20-%20Adults_v2_static%20proof%20r2.pdf"},"notes":null,"org_country":"US","org_id":"744df1761924","org_name":"C.R. England, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553683"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C.R.%20England%20-%20Consumer%20Notification%20Letter%20-%20Adults_v2_static%20proof%20r2.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/C.R.EnglandInc..pdf"}],"summary":"C.R. England discovered unauthorized activity on its systems and found that certain files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a197c133e226501cd4eb6c84a2ad59b2ca8f647","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13401.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9361b808bd79","org_name":"Bryan County Ambulance","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13401.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-24","discovered_date":"2022-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51a88afffdcf567808370c6965090f1ff1dc1a7d","impact_type":"data_theft","incident_date":"2022-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Andrew%20Lundholm%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a2ec0a6fcc5a","org_name":"Andrew Lundholm CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Andrew%20Lundholm%20-%20Sample%20Notice.pdf"}],"summary":"Andrew Lundholm CPA reported that an unknown actor accessed its network without authorization and obtained data, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94d8279065b04382bdd0d1739eca14668c2f84f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SMCTD%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ff3eb0cc835c","org_name":"San Mateo County Transit District","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553645"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SMCTD%20-%20Sample%20Notice.pdf"}],"summary":"San Mateo County Transit District reported unauthorized access to employee email accounts, where some affected individuals’ personal information was located.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-05-23","discovered_date":"2022-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac9e888690c5eb1298795d4bc5c0b83a4f3868da","impact_type":"data_theft","incident_date":"2022-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Leiters%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"c5019866535d","org_name":"Leiters, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553639"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Leiters%20-%20California%20Notification.pdf"}],"summary":"Leiters determined that an unauthorized person accessed its systems and obtained files containing invoice and prescription information between April 6 and April 8, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0bbc5aef16c0f8619f7ad30ca894dc8028820f91","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CreativeHospiceCareInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e7c0af3c62a","org_name":"Creative Hospice Care, Inc.","org_type":"unknown","ransomware":null,"records_affected":1798,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CreativeHospiceCareInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-23","discovered_date":"2021-12-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8720d74a9015ef60e354861497757388e912afb","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Biolase%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"46648eb6a6ac","org_name":"Biolase, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556160"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Biolase%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Biolase reported that an unauthorized actor accessed its network and removed files containing information that may have included individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-20","discovered_date":"2021-11-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1823ae6a6b533c04ac5caa9a0d60f6b307c600b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nederlander%20Theatrical%20Corp.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6b407586ebef","org_name":"Nederlander Theatrical Corp.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-560368"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nederlander%20Theatrical%20Corp.%20-%20Sample%20Notice.pdf"}],"summary":"Nederlander Theatrical Corp. reported suspicious activity in its environment and unauthorized access to files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-05-20","discovered_date":"2022-03-23","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90b8ca9a6db754b0a37d67dd55bec6506d842f75","impact_type":"data_theft","incident_date":"2022-03-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Julieta%20Y.%20Echeverria%20D.D.S.%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0752c0044c3a","org_name":"Julieta Y. Echeverria D.D.S., Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Julieta%20Y.%20Echeverria%20D.D.S.%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized individual accessed Dr. Echeverria’s office, and paper patient records were found to have been stolen.","supporting_quote":"On March 23, 2022, Dr. Echeverria discovered that an unauthorized individual accessed her office overnight.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1bedda9849932bf887b6965002a5db60666ff026","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/InglisFoundation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"644ade05997a","org_name":"Inglis Foundation","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/InglisFoundation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-20","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66142a164fcddba2fd88da98307fc489f4a26576","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Los%20Angeles%20Unified%20School%20District%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553589"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Los%20Angeles%20Unified%20School%20District%20Sample%20Notice.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb769705326a005822341ccc80677c240b39b348","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/D%26HCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57260be443d7","org_name":"D & H Company","org_type":"unknown","ransomware":null,"records_affected":3652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/D%26HCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-19","discovered_date":"2022-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"575a19dc2aa725e4c6f29ca62f4cd5951cdfc02c","impact_type":"unknown","incident_date":"2021-11-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"17026c91a110","org_name":"Massachusetts Cannabis Control Commission","org_type":"unknown","ransomware":null,"records_affected":2016,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Massachusetts%20Cannabis%20Control%20Commission-2022-05-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77983f1488feb13fad6732ef519f44e570e80dfb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/FredetteSankowski.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b19650305183","org_name":"Fredette, Sankowski, Woodcock & Co.","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/FredetteSankowski.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-05-18","discovered_date":"2022-03-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"30a0e65821d0b15b08a5a902261a9662a2398b11","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/FFCU%20Primary%20Mailing%20Notification%20Template.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ccf0c2207302","org_name":"First Financial Credit Union","org_type":"financial","ransomware":null,"records_affected":229748,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#First%20Financial%20Credit%20Union%20%28%22FFCU%22%29-2022-05-18"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553514"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FFCU%20Primary%20Mailing%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FFCU%20Primary%20Mailing%20Notification%20Template.pdf"}],"summary":"First Financial Credit Union reported that an unauthorized third party accessed files containing members’ personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8706b7aa23e271c71e75137453f8627331e7f75c","impact_type":"data_theft","incident_date":"2022-01-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VBH%20-%20Consumer%20Notification%20Letter%20%28System%20IPS%29%20DRAFT%20%28004%29.pdf"},"notes":null,"org_country":"US","org_id":"fb9c47480263","org_name":"Anthem Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553524"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VBH%20-%20Consumer%20Notification%20Letter%20%28System%20IPS%29%20DRAFT%20%28004%29.pdf"}],"summary":"The incident involved unauthorized access to an environment, and the organization confirmed that certain data was accessed and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2022-05-17","discovered_date":"2022-03-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e554be8291606da351f42a4d9c20b9091549c0d","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Notice.pdf"}],"summary":"An unauthorized actor accessed a Focus Health employee’s Microsoft 365 email account via a phishing email, and patient records were present in the account.","supporting_quote":"Working with our Information Technology Director and third-party forensic investigators, we determined that an unauthorized actor(s) gained access to the employee’s email account via a phishing email between February 24, 2022 and March 4, 2022.","technology_involved":["Microsoft 365 email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b026a2e853597290c510cd1e035a5a0c512a3f4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"f25ce8635e16","org_name":"Read Novel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Read Novel","type":"hibp","url":"https://haveibeenpwned.com/Breach/ReadNovel"}],"summary":"Read Novel allegedly had a breach in May 2019 that exposed email addresses, usernames, genders, phone numbers, and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e94d54582d5336710b5237201284150941257fd","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"dcafbbf5b995","org_name":"OGUsers","org_type":"other","ransomware":null,"records_affected":348302,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OGUsers (2021 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/OGUsers2021"}],"summary":"OGUsers suffered a data breach in April 2021 that exposed usernames, email and IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1657"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-05-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67af049e4a12275b4d0d831e4f7b2633120b8df5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-04-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-05-16%20-%20version%20A%20notice%20to%20individuals.pdf"},"notes":null,"org_country":"US","org_id":"3cf218033e20","org_name":"General Motors Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Previously compromised credentials from non-GM sites were reused to access GM customer accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553442"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-05-16%20-%20version%20A%20notice%20to%20individuals.pdf"}],"summary":"Unauthorized parties reused credentials compromised on non-GM sites to access GM customer accounts and redeem reward points.","supporting_quote":"We believe that unauthorized parties gained access to customer login credentials that were previously compromised on other non-GM sites and then reused those credentials on the customer’s GM account.","technology_involved":["GM online customer accounts","GM mobile application accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-16","discovered_date":"2022-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c335edffce40a96df1ca69bf3d625395e59579ea","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-05","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Can%20Lines%20Engineering%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f6aa5beb7fef","org_name":"Can Lines Engineering, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Can%20Lines%20Engineering%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Can Lines Engineering identified suspicious activity and determined that an unknown actor accessed files containing individuals’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c3f597d2cb5b7885a31e7c2cace29e1f65faff8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"7bc8cbacdb4e","org_name":"BlackBerry Fans","org_type":"other","ransomware":null,"records_affected":174168,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BlackBerry Fans","type":"hibp","url":"https://haveibeenpwned.com/Breach/BlackBerryFans"}],"summary":"BlackBerry Fans suffered a breach that exposed 174,168 member records containing usernames, email and IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e33dfd48e2a0e132325d21c3fab4287391be5904","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cc51d03999c4","org_name":"Paragon Cheats","org_type":"technology_saas","ransomware":null,"records_affected":188089,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Paragon Cheats","type":"hibp","url":"https://haveibeenpwned.com/Breach/ParagonCheats"}],"summary":"A data breach at the Paragon Cheats website exposed 188,089 customer records and led to the service shutting down.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-13","discovered_date":"2022-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b8b0fba865c120aadd05744efbbee97cdf0fdf4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"676e3112d898","org_name":"Illuminate Education","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA8160.pdf"}],"summary":"Illuminate Education reported unauthorized access to databases containing potentially protected student information.","supporting_quote":null,"technology_involved":["databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46bfb3b1721ff782ac3b08990c20e5554285385a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20General%20Consumer%20Notification%20Wave%202.PDF"},"notes":null,"org_country":"US","org_id":"03a756774193","org_name":"Assurance IQ","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-559553"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553397"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20General%20Consumer%20Notification%20Wave%202.PDF"}],"summary":"An unauthorized third party used Assurance’s online life insurance application, where a driver’s license number was displayed.","supporting_quote":null,"technology_involved":["online life insurance application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2967898864d962474e751c6eb6a436a4ee707193","impact_type":"data_theft","incident_date":"2021-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/48forty%20Solutions%2C%20LLC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"690557c2aae0","org_name":"48forty Solutions, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553381"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/48forty%20Solutions%2C%20LLC%20-%20Sample%20Notice.pdf"}],"summary":"48forty Solutions reported that certain files were downloaded on or about December 31, 2021, and reviewed them to identify affected individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49819cad14e5231382004faefa9ec02ee1d115cf","impact_type":"unknown","incident_date":"2022-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Parker%20Hannifin%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29083aca9e1a","org_name":"Parker-Hannifin Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553351"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Parker-Hannifin%20Corporation-2022-05-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-05-10","discovered_date":"2021-10-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ef2ef26536b1283392eec6e2c0f183cc4b222e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MX%20Holding%20-%20Adult%201Yr%20SSN_1.pdf"},"notes":null,"org_country":"US","org_id":"0a118ba4f51f","org_name":"MX Holdings US, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553265"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MX%20Holding%20-%20Adult%201Yr%20SSN_1.pdf"}],"summary":"An unauthorized third party temporarily accessed several email accounts containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-10","discovered_date":"2021-11-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7f9b4081a90d6f9494f58cdeaf4c5ae7e66959a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AWP_Sample%20Notice_Print%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"a8fd08b123b5","org_name":"Area Wide Protective","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553258"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AWP_Sample%20Notice_Print%20Proof.pdf"}],"summary":"Area Wide Protective confirmed unauthorized access to multiple employee email accounts and said personal information may have been accessed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-10","discovered_date":"2022-04-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"668e67b2dc1987e3b205e7eaba7abc6ed0a51ebf","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter%205.12.22.pdf"},"notes":null,"org_country":"US","org_id":"2bf457e3b7fa","org_name":"Acuity International","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter%205.12.22.pdf"}],"summary":"Acuity International reported that personal information of current and former employees may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-05-09","discovered_date":"2022-02-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9dda0308bd0e6c90684aa8ed3dfa2aadd00c0a68","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor gained access to an employee's email account via a phishing email.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553239"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20Sample%20Notice.pdf"}],"summary":"Covenant Care California reported that an employee’s email account was accessed via a phishing email, and patient records were present in the account.","supporting_quote":"an unauthorized actor(s) gained access to the employee’s email account for several hours via a phishing email on February 24, 2022.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-05-06","discovered_date":"2022-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2153709a1564452e6a1cbdb59986dfe0d8cfe6c9","impact_type":"disruption_or_ransomware","incident_date":"2022-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FPS%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e6768d548b9f","org_name":"FPS Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553197"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FPS%20Sample%20Notice.pdf"}],"summary":"FPS Medical Center reported that an unknown actor deployed malware that encrypted systems, and patient information in affected systems may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9deba65da2237bfa47957feea80b3ccb5a3a9804","impact_type":"unknown","incident_date":"2021-06-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCA%20Adult%20SSN-%20redacted%20%2810341361x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"75614f78feae","org_name":"Cornish College of the Arts","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553185"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA9546.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edea3e8845e2b9fa11dc959dd1781b96c71a0fc8","impact_type":"unknown","incident_date":"2021-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/421286_final_redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"754bc26ecd2a","org_name":"Wells Fargo Bank, N.A.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553127"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA9361.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9888737792d22793879bdf1e20d39127e248cf5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Paramit%20Sample%20Letter%20Redacted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"248ef8e41f74","org_name":"Paramit Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553130"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e88218b3d3f34449f5171ee1a026ff6ae804ca00","impact_type":"data_theft","imported_from":null,"incident_date":"2022-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/El%20Monte%20RV%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6a6b0c9d050a","org_name":"El Monte RV Rental and Sales","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/El%20Monte%20RV%20Sample%20Notice.pdf"}],"summary":"El Monte RV reported that an unauthorized actor acquired files from its environment between January 22 and January 24, 2022, including files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"521d2735f0708cf971f7193169a8db2db209d8de","impact_type":"unknown","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Illuminate%20Education%20-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e89d51468c4","org_name":"Rocklin Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553077"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"852ed96ffa68bbbfcf021fe14e69057e3cfbad80","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-03-27","initial_access":"unknown","notes":"records_affected not found in source; cleared","org_country":"LK","org_id":"d2fb00575e4b","org_name":"PayHere","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PayHere","type":"hibp","url":"https://haveibeenpwned.com/Breach/PayHere"}],"summary":"A breach at PayHere exposed payment records containing personal information and partially obfuscated credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2022-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"873e5cf2f13e4e3a50d5ebc4ce5e5300f08c5827","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a447989fc1b0","org_name":"Aimware","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aimware","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aimware"}],"summary":"Aimware suffered a data breach that exposed subscribers’ personal information, including email and IP addresses, private messages, website activity, and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":["Aimware website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2022-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5059efe7269a4b29aa381d4fa265c01eeb3d2687","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70d7f020-0788-11ed-8fd4-9be359ef207c"},"incident_date":"2022-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"f978dea5a70b","org_name":"Mangaton","org_type":"technology_saas","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techradar.com/news/millions-of-comic-book-fans-have-data-leaked-after-mangatoon-breach"}],"summary":"Mangaton was compromised via a weak set of credentials on their elasticsearch server over 23m user records were compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de20a8c5eb405d13da7e9fc885fcc62cf899fcb3","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"PL","org_id":"5eeadf59f22d","org_name":"Devil-Torrents.pl","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Devil-Torrents.pl","type":"hibp","url":"https://haveibeenpwned.com/Breach/DevilTorrents"}],"summary":"Devil-Torrents.pl suffered a data breach involving email addresses and cracked passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-04-29","discovered_date":"2022-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5972f324efad665330bd6a68b0c28ecbb1b08022","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Salusive%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"77874de18fd0","org_name":"Salusive Health Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552978"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Salusive%20Sample%20Notice.pdf"}],"summary":"An unauthorized individual accessed files containing personal, protected health, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2022-04-28","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"abe2ca0b2e868899635891ea10fa6fca5b2b212c","impact_type":"data_theft","incident_date":"2022-03-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA9234.pdf"},"notes":null,"org_country":"US","org_id":"69277f3242cb","org_name":"Washington Department of Labor & Industries","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA9234.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA9234.pdf"}],"summary":"A burglary at a Washington Department of Labor & Industries regional office resulted in the theft of hard drives containing sensitive information.","supporting_quote":"The incident is the result of a burglary at one of L&I’s regional offices.","technology_involved":["hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"004cc99e36f4fbbc5f79921c9107e24b07cd54fc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13448.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a2804f9cdbfe","org_name":"Medscan Laboratory, Inc. (Adaptive Health Integrations","org_type":"unknown","ransomware":null,"records_affected":2968,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13448.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-26","discovered_date":"2022-02-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"045b191c09d5ae31030d10d41fa70369f80e1fe0","impact_type":"both","incident_date":"2022-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TSG%20California%20for%20AG.pdf"},"notes":null,"org_country":"US","org_id":"eb9125babb18","org_name":"AUTOPAY Direct, Inc.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TSG%20California%20for%20AG.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/AUTOPAYDirectInc..pdf"}],"summary":"AUTOPAY Direct, Inc. reported that a threat actor group exfiltrated customer personal information and demanded a ransom.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"268597fbb97cfbf232ccf7bdfe43e1a7cd8217a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Liberty%20Partners-%20Sample%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"d33b8166a7ee","org_name":"Liberty Partners Financial Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552861"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Liberty%20Partners-%20Sample%20Notices.pdf"}],"summary":"Liberty Partners Financial Services identified unusual activity in an employee email account and found unauthorized access to additional employee email accounts.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9183d5d96dfe7d383ca22890c8fbe6b6b4c336f","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JFCS%20-%20letter_Proof2__Redacted.pdf"},"notes":null,"org_country":"US","org_id":"32f626d9c5f5","org_name":"Jewish Family and Children’s Services","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552850"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JFCS%20-%20letter_Proof2__Redacted.pdf"}],"summary":"A JFCS employee inadvertently emailed employee tax-form information, including names and Social Security numbers, to a former employee.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-04-22","discovered_date":"2022-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86fd22fad71c1a6601cd56a1600851a267c95cd2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NIA%20PCR%20Breach%20Member%20Notification%20Letter%20FInal%20For%20Mailing%20Ready%20-%20BSC.pdf"},"notes":null,"org_country":"US","org_id":"3297e9cb31b7","org_name":"National Imaging Associates, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552781"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NIA%20PCR%20Breach%20Member%20Notification%20Letter%20FInal%20For%20Mailing%20Ready%20-%20BSC.pdf"}],"summary":"A National Imaging Associates physician reviewer shared a member’s case and clinical records with a non-employee guest during a Zoom session.","supporting_quote":null,"technology_involved":["Zoom"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7694311e44d4eabcf7e3e643bee56a144494c8c1","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA8878.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7e88b7dd8387","org_name":"King County Public Hospital District No. 2","org_type":"healthcare","ransomware":null,"records_affected":19092,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA8878.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA8878.pdf"}],"summary":"An unauthorized party accessed Eye Care Leaders’ myCare Integrity platform and deleted databases and configuration files; EvergreenHealth patient information may have been involved.","supporting_quote":null,"technology_involved":["myCare Integrity"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Eye Care Leaders"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"af63637c8b22","name":"Eye Care Leaders"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-21","discovered_date":"2022-02-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9c35d75b55cf139d039a700aca7ed638bb29291","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rialto%20Markets%20Individual%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"3e6d9422bebd","org_name":"Rialto Markets LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rialto%20Markets%20Individual%20Notification%20Letter_1.pdf"}],"summary":"An unauthorized third party accessed an employee’s email account containing files with personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a2a16768c2af2bd92997fbf4c122e141f7f878c","impact_type":"unknown","incident_date":"2022-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Dial%20America%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dc1c91128a53","org_name":"DialAmerica Marketing, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552749"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DialAmerica%20Marketing%2C%20Inc.-2022-04-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-04-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"603b74596911fb9573a6ccafd8574544cd18e614","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-18","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/County%20of%20Los%20Angeles%20Ad%20r10prf.pdf"},"notes":null,"org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees were deceived by phishing emails and clicked a link they believed led to legitimate secure emails.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552740"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/County%20of%20Los%20Angeles%20Ad%20r10prf.pdf"}],"summary":"Phishing emails led employees of the Los Angeles County Department of Mental Health to click a link, potentially impacting personal, medical, and financial information.","supporting_quote":"In this case, the DMH employees clicked on the link located in the body of the email, thinking that they were accessing legitimate secure emails from the senders.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d0c247ad2fdac06185ba774dbe647c68564fb9d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MedscanLaboratoryInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf74c3361dbe","org_name":"Medscan Laboratory, Inc.","org_type":"unknown","ransomware":null,"records_affected":1404,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MedscanLaboratoryInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a4538b9a8be3f4a3341ffbf2adb900c24772c819","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13367.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7415c0e44499","org_name":"UNITE HERE Retirement Fund","org_type":"financial","ransomware":null,"records_affected":584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13367.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13367.pdf"}],"summary":"Information provided by the Fund to Horizon Actuarial Services was accessed in a data privacy incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Horizon Actuarial Services, LLC"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"8956fc10f4c9","name":"Horizon Actuarial"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40ea80d28d35eafa50f87bad4ffb1539785a70d9","impact_type":"unknown","incident_date":"2021-11-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letters.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7415c0e44499","org_name":"UNITE HERE Retirement Fund","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552671"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-04-15","discovered_date":"2022-03-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7627e0e2c49d6bfad5409bec19238a225cf9637","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PlanMember%20Individual%20Breach%20Notifcation%20Letter%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"dc17eca6c6cb","org_name":"PlanMember Securities Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554732"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PlanMember%20Individual%20Breach%20Notifcation%20Letter%20CA_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PlanMember%20Securities%20Corporation-2022-04-15"}],"summary":"Criminal actors accessed a PlanMember executive’s email account and unsuccessfully attempted to route company funds, while documents containing personal and account information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d81f78752f038f50cfafe44e405cc2ea58e7f5b0","impact_type":"unknown","incident_date":"2021-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MedScan%20Laboratory%20-%20Adult%20CM%20SSN%201yr%20%28redacted%29%20%2810232630x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c8d2d2ec674b","org_name":"Medscan Labratory, Inc. (\"Adaptive Health Integrations\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552608"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30e7f4684867af85f07e2b5530451869f233209a","impact_type":"disruption_or_ransomware","incident_date":"2021-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kingsley%20%26%20Kingsley%20Ad%20CA.pdf"},"notes":null,"org_country":"US","org_id":"87f8a7f28220","org_name":"Kingsley and Kingsley Lawyers","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552632"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kingsley%20%26%20Kingsley%20Ad%20CA.pdf"}],"summary":"An unknown attacker conducted a ransomware attack on two computer servers, and some personal information may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4e65b25b83e60285db4779d423eaf6be1c3edd7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Adult%201%20Yr_AG100_v05.pdf"},"notes":null,"org_country":"US","org_id":"eb2c7f8e5b9c","org_name":"Contra Costa County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552642"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Adult%201%20Yr_AG100_v05.pdf"}],"summary":"An unauthorized person accessed certain Contra Costa County employee email accounts, and the county could not rule out access to or download of emails or attachments.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-15","discovered_date":"2022-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2879dfcb8043028d00203006bbaeb1265e80a179","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20breach.pdf"},"notes":null,"org_country":"US","org_id":"074350e7d692","org_name":"Chiropractique, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee with access to contact information appears to have obtained patient data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552626"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20breach.pdf"}],"summary":"Chiropractique, Inc. reported that a former employee obtained patient contact information.","supporting_quote":"At this time it appears the breach was through a former employee with access to contact information, making detection and prevention of breaches of this nature difficult.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e9cee52317b77ad3b7ad4975d7d0e4fa8376ac","impact_type":"both","imported_from":null,"incident_date":"2019-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e18a9313f0ba","org_name":"Avvo","org_type":"technology_saas","ransomware":true,"records_affected":4101101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Avvo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Avvo"}],"summary":"Avvo user email addresses and password hashes were published online and used in an extortion scam.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddcf2cb8182f14e419388d889b0a11e2de274558","impact_type":"unknown","incident_date":"2022-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CARB_Phase%204_CA%20Letter%20-%20V2___Static_Proof_R1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"88edf0714615","org_name":"Center for Sustainable Energy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552591"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-13","discovered_date":"2022-02-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b6af40cff5545016b3e22f2ccdfef224283b307","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-08","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Confidential_Sample%20Individual%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"fd1eadb63df5","org_name":"TransNational Bankcard L.L.C.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552554"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Confidential_Sample%20Individual%20Notice_1.pdf"}],"summary":"TransNational reported that a security incident impacted personal information belonging to some individual owners or officers of its enterprise customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2030c9ca3af599aac8e0baa50d7bbf4f0dfea4b2","impact_type":"data_theft","imported_from":null,"incident_date":"2021-11-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ID","org_id":"109908ed1102","org_name":"Travelio","org_type":"other","ransomware":null,"records_affected":471376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Travelio","type":"hibp","url":"https://haveibeenpwned.com/Breach/Travelio"}],"summary":"A November 2021 breach of Travelio exposed customer account data, including contact details, password hashes and Facebook auth tokens.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-08","discovered_date":"2021-06-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1481e78d6c7ee7986a739c2aa6fc48eaa52221b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stevens%20%26%20Lee%20-%20CA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ce5204fc969b","org_name":"Stevens & Lee","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stevens%20%26%20Lee%20-%20CA%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7850.pdf"}],"summary":"Stevens & Lee discovered interference with some of its systems and later found that files potentially accessed in the incident contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5703dad8741266afef9924f77b972abd896dbdc","impact_type":"unknown","incident_date":"2021-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Shoring%20-%20Redacted%20CA%20SSN%20Notice%20Letter%20%2810250512x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b861f1a2260","org_name":"Shoring Engineers, Inc., Structural Shotcrete Systems, Inc. and Santa Fe Building and Equipment","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552410"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"775b94b2388819cb2099d3242cb3f45b1a342981","impact_type":"both","incident_date":"2021-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Plumas_Other%20Individual%20-%20CM.pdf"},"notes":null,"org_country":"US","org_id":"cee00a0aa91e","org_name":"Plumas County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552399"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Plumas_Other%20Individual%20-%20CM.pdf"}],"summary":"An unauthorized party accessed Plumas County systems and acquired files, disrupting IT operations; the files contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2087e503d37dd95e5d40e80389a2facdb9dbaca0","impact_type":"unknown","incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSN%20%5Bredacted%5D%20%2810243903x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"60d57b3d514c","org_name":"EMC National Life Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552392"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSN%20%5Bredacted%5D%20%2810243903x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13407.pdf"}],"summary":"EMC National Life Company detected potential unauthorized access to its network, contained the threat, and said it had no reason to believe personal information would be misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45f6ce9e41d4a3e69ae7dc3d58ec77e1bf469064","impact_type":"data_theft","incident_date":"2022-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Notice%20.pdf"},"notes":null,"org_country":"US","org_id":"a6930549b4d8","org_name":"Snap-on, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552390"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Notice%20.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13329.pdf"}],"summary":"Snap-on reported that an unauthorized third party took personal data relating to associates and franchisees between March 1 and March 3, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-07","discovered_date":"2022-02-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f33cdd34112d33e31c59a5e3a9194b9ff9f8fd94","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"59aa17883435","org_name":"Rick L. Hug CPA & Associates","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rick%20L.%20Hug%20CPA%20%26%20Associates-2022-04-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-07","discovered_date":"2022-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2ee928f35c535633f0bf78a22811475bc772c1c4","impact_type":"disruption_or_ransomware","incident_date":"2022-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7827.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8be3fb325697","org_name":"PBS Engineering and Environmental","org_type":"professional_services","ransomware":null,"records_affected":691,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7827.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7827.pdf"}],"summary":"PBS discovered an incident that disrupted access to some systems, and later learned that personal information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-07","discovered_date":"2021-08-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"35b837a04e4c9a6e64480f7e74d2ab98533604ff","impact_type":"unknown","incident_date":"2021-08-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8f1686fecc6","org_name":"Kingsley & Kingsley Lawyers","org_type":"unknown","ransomware":null,"records_affected":29204,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kingsley%20%26%20Kingsley%20Lawyers-2022-04-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2022-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"13f34fd2f56896f24b2db991c721062bf03c0780","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13328.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b0471150c5a","org_name":"IMCO General Construction, Inc.","org_type":"unknown","ransomware":null,"records_affected":1442,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13328.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"132b22ae7d69c1948ac86bffa1b8c0b349b21910","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pingora_Sample.pdf"},"notes":null,"org_country":"US","org_id":"aca2c292b788","org_name":"Pingora Loan Servicing, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pingora_Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pingora%20Loan%20Servicing%2C%20LLC-2022-04-06"}],"summary":"An unauthorized person accessed Pingora file storage servers and viewed files containing individuals’ personal and loan-related information.","supporting_quote":null,"technology_involved":["file storage servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-06","discovered_date":"2022-03-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"710155f1da66f8df56a874a5da2b59c62b198a05","impact_type":"unknown","incident_date":"2022-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc3bb173ee84","org_name":"PBS Environmental and Engineering Inc.","org_type":"unknown","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PBS%20Environmental%20and%20Engineering%20Inc.-2022-04-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77dbe7fafaad8fae344bebf22553f89c5d76731f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/DialAmericaMarketing%2CInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc1c121d182a","org_name":"Dial America Marketing, Inc.","org_type":"unknown","ransomware":null,"records_affected":13178,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/DialAmericaMarketing%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-04-05","discovered_date":"2022-01-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0658f9b587c0f0a5b6c921c2da0851b4beb70b87","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13325.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e5528f058748","org_name":"Texas Department of Insurance","org_type":"government","ransomware":null,"records_affected":104,"reviewed":false,"root_cause":"Programming code allowed internet access to a protected area of the application.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13325.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Texas%20Department%20of%20Insurance-2022-04-07"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://www.tdi.texas.gov/data-security-event/index.html "},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13325.pdf"}],"summary":"A programming code issue made a Texas Department of Insurance web application accessible from the internet, potentially exposing personal and workers’ compensation information.","supporting_quote":"We found the issue was due to programming code that allowed internet access to a protected area of the application.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2022-04-05","discovered_date":"2022-02-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1181335136032b6893338a5ff8d36439fcf7d573","impact_type":"data_theft","incident_date":"2021-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Inntopia-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"00eebf8a6652","org_name":"Sterling Valley Systems d/b/a Inntopia","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553641"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Inntopia-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7622.pdf"}],"summary":"An unknown actor gained access to payment card information within Inntopia’s platform between October 9, 2021 and February 18, 2022.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"507cef3ee3f426ffdabcbc6d029ad95d367112a4","impact_type":"unknown","incident_date":"2021-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e9fe8fb5866","org_name":"NHS Management LLC","org_type":"unknown","ransomware":null,"records_affected":126334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NHS%20Management%20LLC-2022-04-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-04","discovered_date":"2021-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d85c2ff5599185e516ced605f6443be1b138f22","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hercules%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"37eba6096628","org_name":"City of Hercules","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552302"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hercules%20-%20California%20Notification.pdf"}],"summary":"The City of Hercules reported that an unauthorized party accessed files containing personal information, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-04-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b32459dc5ddf3458b18d814fc2f7c14c723c56af","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VMRF%20Ad%20CA%20CM%20r2prf%204883-9499-7018%20v.1.pdf"},"notes":null,"org_country":"US","org_id":"81779530ef46","org_name":"Veterans Medical Research Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VMRF%20Ad%20CA%20CM%20r2prf%204883-9499-7018%20v.1.pdf"}],"summary":"An unauthorized party accessed a Veterans Medical Research Foundation employee’s email account, but the investigation could not determine which emails or attachments were accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-31","discovered_date":"2021-10-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05ae73aa3e8a1346935e4e278a5e7b5065077704","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Adult.pdf"},"notes":null,"org_country":"US","org_id":"95cfa503b8a5","org_name":"Tangible Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Adult.pdf"}],"summary":"Tangible Solutions reported unauthorized access to files and data on a server, potentially involving names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2022-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdbb2396bfa04d92de935b62b03ef8df3648c25b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"020ee308f3e0","org_name":"Royal Enfield","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Royal Enfield left a database publicly exposed, resulting in the inadvertent publication of customer data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Royal Enfield","type":"hibp","url":"https://haveibeenpwned.com/Breach/RoyalEnfield"}],"summary":"Royal Enfield left a database publicly exposed, resulting in the publication of customer data.","supporting_quote":"In January 2020, motorcycle maker Royal Enfield left a database publicly exposed that resulted in the inadvertent publication of over 400k customers .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e31a583acce9e676ca6c1a14ed6c066b7c6d0277","impact_type":"unknown","incident_date":"2022-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/IRA%20Financial%20Trust%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b440f646b27","org_name":"IRA Financial Trust","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552121"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552322"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-28","discovered_date":"2021-07-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ac397d50218725b35db5eb36fe5c0090349942a1","impact_type":"unknown","incident_date":"2021-07-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c9b2bec96b7","org_name":"Super Care, Inc.","org_type":"unknown","ransomware":null,"records_affected":318379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Super%20Care%2C%20Inc.-2022-03-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-25","discovered_date":"2021-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eb481dba7170c270263c6383fc26e085c0f2ece","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SuperCare%20-%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"592e7051a608","org_name":"SuperCare Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552023"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SuperCare%20-%20Consumer%20Notification%20Letter.pdf"}],"summary":"SuperCare Health reported that an unknown party accessed certain systems from July 23 to July 27, 2021, and that potentially impacted files contained some individuals’ information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-25","discovered_date":"2022-01-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23aff8084a395f9c67f81613e31173423fa917cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOCCCD%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"7b0b3828c5c8","org_name":"North Orange County Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553691"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551998"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOCCCD%20-%20Sample%20Notice_1.pdf"}],"summary":"North Orange County Community College District reported unauthorized access to certain systems, and files containing sensitive information may have been taken or viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-25","discovered_date":"2021-09-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bb180872ea138bf7bae151ed7cba3d6143e0749","impact_type":"both","incident_date":"2021-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Medsurant%20Holdings%2C%20LLC%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"aa51745da3b0","org_name":"Medsurant Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Medsurant%20Holdings%2C%20LLC%20-%20Sample%20Notice_1.pdf"}],"summary":"Medsurant reported that an unknown actor accessed its systems, exfiltrated some data, and encrypted limited data during a later access period.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-25","discovered_date":"2021-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"994b19fb4df9786db5478786346a80964285aa79","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marten%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"936a575f323e","org_name":"Marten Transport, Ltd.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551995"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marten%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marten%20Transport%2C%20Ltd.-2022-03-25"}],"summary":"Marten Transport identified unauthorized access to certain company systems, where an unknown actor viewed or downloaded information that included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-03-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"84bdf3ac93a2d15ecdde7f3d74fa842d7238805f","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-14","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6410.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4a9a5555d336","org_name":"Christie Business Holdings Company, P.C.","org_type":"healthcare","ransomware":null,"records_affected":694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6410.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6410.pdf"}],"summary":"Christie Clinic reported unauthorized access to a business email account that may have contained personal and medical information.","supporting_quote":null,"technology_involved":["business email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-03-23","discovered_date":"2021-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"ca05bb2ea126c7d0fa10a1589819c45c9bd9419c","impact_type":"both","incident_date":"2021-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10443.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d7872bfaf7a8","org_name":"Shutterfly, LLC","org_type":"retail_ecommerce","ransomware":true,"records_affected":1273,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Shutterfly%2C%20LLC-2022-05-26"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10443.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553999"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Shutterfly%20Sample%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10443.pdf"}],"summary":"An unauthorized third party accessed some Shutterfly systems and data in a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-23","discovered_date":"2021-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bd64bf8169306cd6ba9939c355abf6eff179144","impact_type":"data_theft","incident_date":"2020-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Leerburg%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"15b60c75d6dd","org_name":"Leerburg Enterprises, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551926"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Leerburg%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Leerburg%20Enterprises%2C%20Inc.-2022-03-23"}],"summary":"Leerburg reported that customer payment card information used on its e-commerce website was subject to unauthorized access and/or acquisition.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-03-23","discovered_date":"2021-12-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf8ce2781d859fbc91f11cb6ba148249a24e7ec5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALC117684-00_6498368_T001DomesticSSN_DirectMail.pdf"},"notes":null,"org_country":"US","org_id":"1779e7a63f6c","org_name":"Charles Schwab & Co., Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551924"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALC117684-00_6498368_T001DomesticSSN_DirectMail.pdf"}],"summary":"Charles Schwab determined that chat and email messages sent through Schwab.com were inadvertently sent to external email systems, potentially exposing personal information and credentials.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-22","discovered_date":"2021-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d93fcdc29492ec4b294328875ac2dd0e8ec793e","impact_type":"data_theft","incident_date":"2021-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"c3e399db3e20","org_name":"Major League Baseball Players Benefit Plan","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551904"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20Letters.pdf"}],"summary":"Personal information related to the Major League Baseball Players Benefit Plan was located in files on Horizon Actuarial servers accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Horizon Actuarial"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"8956fc10f4c9","name":"Horizon Actuarial"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d91481b9935f854ca4e009143d4e082c8eaac849","impact_type":"unknown","incident_date":"2021-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Citadel%20-%20Adult%20SSN%20%5Bredacted%5D%20%2810206703x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d13500151c7","org_name":"Citadel Servicing Corporation dba Acra Lending","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551893"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-22","discovered_date":"2021-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f260cc7d084843a48b2681eeacb9818d4aff0e7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alacrity%20Solutions%20Group%2C%20LLC%20-%20Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"e2a324b21337","org_name":"Alacrity Solutions Group, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alacrity%20Solutions%20Group%2C%20LLC%20-%20Sample%20Notice%20Letter.pdf"}],"summary":"Alacrity Solutions reported that files on its systems may have been subject to unauthorized access or acquisition between March 1 and March 3, 2021, and that potentially affected information included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c4e54f1f1007977923c507acb0f9064fe58a275","impact_type":"unknown","incident_date":"2022-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5397.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"080246cacba8","org_name":"Spokane Regional Health District","org_type":"healthcare","ransomware":null,"records_affected":1260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5397.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5397.pdf"}],"summary":"Spokane Regional Health District reported a security incident dated February 23, 2022, affecting 1,260 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-21","discovered_date":"2021-11-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a485db0e5e69a78c7624411085b17cfb2e9a03d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5171818c42f6","org_name":"Harney District Hospital","org_type":"unknown","ransomware":null,"records_affected":1126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Harney%20District%20Hospital-2022-03-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2022-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5355d8566cb4f1495296ccae93fabe33dc67fe64","impact_type":"data_theft","imported_from":null,"incident_date":"2021-11-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"498821e2a077","org_name":"ZAP-Hosting","org_type":"technology_saas","ransomware":null,"records_affected":746682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ZAP-Hosting","type":"hibp","url":"https://haveibeenpwned.com/Breach/ZAPHosting"}],"summary":"A November 2021 breach at ZAP-Hosting exposed data that included 746,682 unique email addresses and other personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Hive","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2022-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf76edc99e42883c6da441d82e50524ad9f75060","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a78a9840-078b-11ed-8fd4-9be359ef207c"},"incident_date":"2022-03-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0bcb10f3f543","org_name":"Partnership HealthPlan of California","org_type":"healthcare","ransomware":true,"records_affected":850000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/analysis/breach/after-hive-cyberattack-partnership-healthplan-confirms-data-theft-affecting-855k"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553531"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Partnership%20HealthPlan%20of%20California-2022-05-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA10083.pdf"}],"summary":"Partnership HealthPlan of California was impacted by the Hive Ransomware group that resulted in downtime and the theft of over 800k patient records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"actor_id":"hive"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2022-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9249bc64b8a90ede9c3e3a57eadfa34a90ce45c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ded9a9b0-06d9-11ed-b8df-1de13bb43386"},"incident_date":"2022-03-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55d7fdb1b240","org_name":"Carolina Behavioral Health Alliance, LLC","org_type":"healthcare","ransomware":true,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.jdsupra.com/legalnews/carolina-behavioral-health-alliance-llc-2147259/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/vendor-breach-affects-130-000-medical-records-including-wake-forest-employees.html"}],"summary":"A data breach involving a third-party benefits administrator affected 130,922 health plan members, including employees of Wake Forest Baptist Medical Center and Wake Forest University, according to a July 1 submission to the HHS Office of Civil Rights.  On March 20, Carolina Beha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"485ad015327e499240a4f6943ccdb8fe5dfe91d5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lakeview%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f0fa926244fe","org_name":"Lakeview Loan Servicing, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551822"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lakeview%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lakeview%20Loan%20Servicing%2C%20LLC-2022-03-18"}],"summary":"An unauthorized person accessed files on Lakeview Loan Servicing's file storage servers containing personal and loan-related information.","supporting_quote":null,"technology_involved":["file storage servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0edbb3ff9f5e7f341271c34484387f590d27a972","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Payroc%20Ad%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"5a71b01aab52","org_name":"First Financial Merchant Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Payroc%20Ad%20CA%20r2prf.pdf"}],"summary":"An unauthorized person accessed the Billing Orchard system between May 2017 and May 2019 and may have accessed files containing names and payment card information.","supporting_quote":null,"technology_involved":["Billing Orchard system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-03-18","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e82fa8b12eb67eb1a68318c87282adb92ebd8a41","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clinic%20of%20North%20Texas--%20Patient%20Notice%20Letter%20%28Adult%29%28265959659.%28%28268316854.1%29.pdf"},"notes":null,"org_country":"US","org_id":"52c4d4c9fa34","org_name":"Clinic of North Texas LLP","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551806"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clinic%20of%20North%20Texas--%20Patient%20Notice%20Letter%20%28Adult%29%28265959659.%28%28268316854.1%29.pdf"}],"summary":"Clinic of North Texas reported that patient information in a folder on one of its systems may have been subject to unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-17","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"48a86278713c59c67817ef5ad7acf8aaf802483c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/WaterfrontEmployers.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a4552b52f8f3","org_name":"Waterfront Employers","org_type":"unknown","ransomware":null,"records_affected":1149,"reviewed":false,"root_cause":"An error with the automated printing system placed four different individuals’ W2 information on one page.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/WaterfrontEmployers.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/WaterfrontEmployers.pdf"}],"summary":"Waterfront Employers mailed W2s containing other individuals’ information to current members and retirees after an automated printing error.","supporting_quote":"On the week of January 24th, the Fund mailed W2s to current members and retirees that included the information of individuals who were not the intended recipients.","technology_involved":["automated printing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"IT Army","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c175f0628d142e3cccfa14d6d0a826c2bc5e120b","impact_type":"data_theft","incident_date":"2022-03-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"67bf03dba9d9","org_name":"CDEK","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CDEK","type":"hibp","url":"https://haveibeenpwned.com/Breach/CDEK"}],"summary":"IT Army published data allegedly sourced from CDEK, but the breach's authenticity could not be independently established.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"itarmy"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-16","discovered_date":"2022-01-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9708151452d8d1c46b707c2cffe36fc89c611a9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice.pdf"},"notes":null,"org_country":"US","org_id":"50b9ae2d66fc","org_name":"Wolff-ST, LLC d/b/a Marmi and Wolff Shoe","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551754"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice.pdf"}],"summary":"An unauthorized party added malicious code to the Marmi Shoes website to capture customers’ payment card information.","supporting_quote":null,"technology_involved":["marmishoes.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-16","discovered_date":"2022-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af18be85be0a2cb1a91a8a08ed6fd19c18344b3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2022-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sarku%20Japan%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"64ce7be2244b","org_name":"Sarku Japan","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-556046"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551740"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sarku%20Japan%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sarku%20Japan-2022-03-16"}],"summary":"Sarku Japan discovered unauthorized access to certain systems, where personal information may have been viewed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b117d03d4514e6debae14ad90d90af95782d03c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13163.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7c6b85952d03","org_name":"Chelan Douglas Health District","org_type":"unknown","ransomware":null,"records_affected":108906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13163.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-15","discovered_date":"2021-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c0eed5c8c2922cafe6c3fd316342c20fb4dc1e7","impact_type":"disruption_or_ransomware","incident_date":"2021-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Caddo%20DA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f26aeb7882d7","org_name":"Caddo Parish District Attorney’s Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Caddo%20DA%20-%20Sample%20Notice.pdf"}],"summary":"The Caddo Parish District Attorney’s Office discovered malware on certain computer systems and could not rule out unauthorized access to or taking of information stored on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c78aa4cb916a9fafc8ce3a8a93f35ce7d7e8b732","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MarkerGroupInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20800851836a","org_name":"Marker Group Inc.","org_type":"unknown","ransomware":null,"records_affected":1493,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marker%20Group%20Inc.-2022-03-14"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MarkerGroupInc..pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5374.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-11","discovered_date":"2021-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b503b7a961bfda09771d4d683be28a6c25835ca6","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ritchie%20Bros%20Sample%20Individual%20Notice%20%28002%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"ead605a8b6dd","org_name":"Ritchie Bros. Auctioneers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ritchie%20Bros%20Sample%20Individual%20Notice%20%28002%29.pdf"}],"summary":"Ritchie Bros. reported unauthorized access to portions of its IT systems, with files from its internal network misappropriated and made available online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a9a6d6c5fc1d5dafde75a893c21e362f01d596a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AFR_California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ff94a02326c4","org_name":"American Financial Resources Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551643"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AFR_California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Financial%20Resources%20Inc.-2022-03-11"}],"summary":"American Financial Resources Inc. determined that certain files were accessed without authorization between December 6 and 20, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-09","discovered_date":"2021-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9708b9b65359ecb681b32fbe2df94910eee553af","impact_type":"disruption_or_ransomware","incident_date":"2021-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Horizon%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ed56efcbcf75","org_name":"Horizon Actuarial Services, LLC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553532"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553697"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554163"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551582"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551909"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552016"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552482"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Horizon%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Horizon%20Actuarial%20Services%2C%20LLC-2022-03-22"}],"summary":"Horizon Actuarial Services reported unauthorized access to two computer servers and paid a group that claimed to have stolen personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-03-09","discovered_date":"2021-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ba738e1d2e38862988025d622497ce087e340cf","impact_type":"data_theft","incident_date":"2021-12-10","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_1.PDF"},"notes":null,"org_country":"US","org_id":"a82ed2405210","org_name":"GreenSlate LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee stole scanned paperwork and electronic documents while employed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551587"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_1.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GreenSlate%20LLC-2022-03-09"}],"summary":"A former GreenSlate employee stole scanned paperwork and electronic documents containing clients’ employees’ personal information.","supporting_quote":"The individual stole the scanned paperwork and electronic documents while they were an employee.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"730fdc19c7d85f5c9ea94f606a26d41e017269b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5362.pdf"},"notes":null,"org_country":"US","org_id":"74434988cb30","org_name":"Guardian Life Insurance","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5362.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5362.pdf"}],"summary":"Guardian Life Insurance reported a data security incident involving personal information affecting two individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-04","discovered_date":"2021-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1fb0f4250bf99a21f55aa46170bf6292078b7aa7","impact_type":"disruption_or_ransomware","incident_date":"2021-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5359.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"96405fe96eee","org_name":"Wagstaff, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":2028,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5359.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5359.pdf"}],"summary":"Wagstaff discovered encrypted files and a ransom demand after a ransomware attack; personal information may have been exfiltrated, but Wagstaff could not confirm whether it was.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18a06a3da191a8c34cac3aabed2105999c8ff822","impact_type":"data_theft","imported_from":null,"incident_date":"2021-11-03","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6647100236cc","org_name":"Robinhood","org_type":"financial","ransomware":null,"records_affected":5003937,"reviewed":false,"root_cause":"A customer service representative was socially engineered.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Robinhood","type":"hibp","url":"https://haveibeenpwned.com/Breach/Robinhood"}],"summary":"Robinhood reported a November 2021 data breach after a customer service representative was socially engineered, exposing customer email addresses and names.","supporting_quote":"In November 2021, the online trading platform Robinhood suffered a data breach after a customer service representative was socially engineered.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6dcf1cf813b369d7eb145a9c8508f04bf2dde6e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-01-29","initial_access":"unknown","notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"2f88d6037d6b","org_name":"MacGeneration","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MacGeneration","type":"hibp","url":"https://haveibeenpwned.com/Breach/MacGeneration"}],"summary":"MacGeneration reported a breach exposing usernames, email addresses, and salted SHA-512 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2022-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cb1c4f496546cbd28375addcd84a0d2068f9f1a","impact_type":"data_theft","incident_date":"2022-02-23","initial_access":"unknown","notes":"records_affected not found in source; cleared","org_id":"1cc0b0f316e6","org_name":"NVIDIA","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NVIDIA","type":"hibp","url":"https://haveibeenpwned.com/Breach/NVIDIA"}],"summary":"A February 2022 breach exposed NVIDIA employee email addresses, NTLM password hashes, and proprietary code.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-03-01","discovered_date":"2021-12-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e6c79ba267ff5a3837ac4051f34f9f00712ab116","impact_type":"unknown","incident_date":"2021-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e3d8610a747","org_name":"LGAA, LLC","org_type":"unknown","ransomware":null,"records_affected":11837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LGAA%2C%20LLC-2022-03-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"IR","motive":"financial","name":"Sharp Boys","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"707b26fb58adf06c41432d24507a8acd5543410e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccd60b70-02d6-11ed-8b5b-6134b3849169"},"incident_date":"2022-03-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"773258af745a","org_name":"Gol Tours LTD","org_type":"other","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/privacy-protection-agency-seizes-servers-of-hacked-travel-company/"}],"summary":"Gol Tours LTD had over 300k customer records stolen due to vulnerabilities in their web application","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"sharpboys"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f8bd8fe2c61bdf32060f1d8d6d74fa0cdfba9ff","impact_type":"unknown","incident_date":"2021-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Mon%20Health%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"10839d4e2d78","org_name":"Monongalia Health System, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551316"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MonongaliaHealthSystem%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-28","discovered_date":"2021-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"201bd4c11fd06c997e541be06de2c2c736517cbf","impact_type":"both","incident_date":"2021-11-03","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DataHEALTH%20Ad%20Wave%204%20%28Dual%20Language%20ESP%29%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"51a71b30f0e3","org_name":"Compton Eye Care Optometry","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551300"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DataHEALTH%20Ad%20Wave%204%20%28Dual%20Language%20ESP%29%20r1prf.pdf"}],"summary":"A ransomware attack on DataHEALTH exposed some personal information belonging to Compton Eye Care Optometry through third-party software used by customers.","supporting_quote":"On December 30, 2021, DataHEALTH learned that the unauthorized party obtained data from DataHEALTH’s servers through a third-party software used by some DataHEALTH customers and that some of your personal information was compromised.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-25","discovered_date":"2022-01-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"691b2f2b22dca00310923abdf28d67eee73df2e7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WA%20DOL%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d65678b2682a","org_name":"Washington State Department of Licensing","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551232"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WA%20DOL%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Washington%20State%20Department%20of%20Licensing-2022-02-24"}],"summary":"The Department of Licensing learned that data apparently from its B&P System had been accessed without authorization, and personal information in professional or business license records may have been obtained.","supporting_quote":null,"technology_involved":["B&P System"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-25","discovered_date":"2021-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e30dc43ca5ce249cd14116a82e15f2390d156a2","impact_type":"data_theft","imported_from":null,"incident_date":"2021-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JDC%20Healthcare%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"3f55b2081ec2","org_name":"JDC Healthcare Management LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553566"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JDC%20Healthcare%20-%20Sample%20Notice_1.pdf"}],"summary":"JDC Healthcare Management LLC reported that malware affected certain company systems and that JDC data was subject to unauthorized access and/or acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-02-25","discovered_date":"2021-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5911597acc0bf46388b4efec6f9dbcc6f9fd62e","impact_type":"data_theft","incident_date":"2021-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bako-CA%20Individual%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"5ef100ff7a9b","org_name":"Bako Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551229"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bako-CA%20Individual%20Notices.pdf"}],"summary":"Bako Diagnostics reported that an unauthorized third party accessed systems containing personal information and removed some data between December 21 and 28, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-23","discovered_date":"2022-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c086c00435069b5d6ecc9b5400f050d80cda44d2","impact_type":"unknown","incident_date":"2021-11-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9565d48f465b","org_name":"Creative Services, Inc., on its behalf and","org_type":"unknown","ransomware":null,"records_affected":164673,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Creative%20Services%2C%20Inc.%2C%20on%20its%20behalf%20and%20on%20behalf%20of%20relevant%20data%20owners-2022-02-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-23","discovered_date":"2021-11-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f01797cea23a79f7371902e9f892c76e0ebe2515","impact_type":"data_theft","incident_date":"2021-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Creative%20Services%2C%20Inc.%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"5fc25edb86bc","org_name":"Creative Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552680"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Creative%20Services%2C%20Inc.%20-%20Sample%20Notice_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5347.pdf"}],"summary":"Creative Services, Inc. reported that files containing personal information may have been copied from its systems during a cyber-attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2022-02-22","discovered_date":"2022-01-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2a10da74b0e9f6c51bba6884a41b8604afe97be","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pekin%20Ins%20Letter%20General_Proof.pdf"},"notes":null,"org_country":"US","org_id":"b5d50d364303","org_name":"Pekin Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pekin%20Ins%20Letter%20General_Proof.pdf"}],"summary":"An unauthorized party used stolen login information for the Pekin Insurance agent website to view driver information hosted on a third-party tool.","supporting_quote":"The unauthorized third party used the stolen login information to view driver information hosted on an authorized third-party tool used by Pekin Insurance.","technology_involved":["Pekin Insurance agent website","authorized third-party tool"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-02-22","discovered_date":"2021-11-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6569cc0dc5ef66ee774e4d9fa0ac384c861cf18","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-18","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Logan%20-%20Sample%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"94445dfa66b7","org_name":"Logan Health Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Logan%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Logan%20Health%20Medical%20Center-2022-02-22"}],"summary":"Logan Health Medical Center discovered unauthorized access to a file server, and an investigation found that files containing patient information had been accessed.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2022-02-22","discovered_date":"2021-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52467d7ae501497b98d775e701d449c7657d3f73","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JMA-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ca7fcd915965","org_name":"JMA Energy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551116"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JMA-%20Sample%20Notice.pdf"}],"summary":"JMA Energy reported that an incident discovered on December 6, 2021 may have allowed an attacker to access, copy, or use personal, financial, and confidential information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-02-18","discovered_date":"2021-07-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69540c234e768c97cc2b1aca80d82b95965ccc2d","impact_type":"disruption_or_ransomware","incident_date":"2021-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5343.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"db04c9835403","org_name":"Welfare & Pension Administration Service, Inc.","org_type":"professional_services","ransomware":null,"records_affected":103557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Welfare%20%26%20Pension%20Administration%20Service%2C%20Inc.%20%28WPAS%29-2022-02-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5343.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5343.pdf"}],"summary":"WPAS discovered malware that encrypted certain systems, and an investigation found that certain folders may have been accessed or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2022-02-18","discovered_date":"2022-01-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2e5ceacdfb37b79987bf6531e84c6ac6c7b4cb5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5341.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4b2b89a42bca","org_name":"Virginia Mason Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5341.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5341.pdf"}],"summary":"An unauthorized person may have accessed staff email accounts through phishing, exposing emails containing patient information.","supporting_quote":"An unauthorized person may have accessed some of VMMC’s staff email accounts between December 21, 2021 and January 3, 2022 through an email Phishing event.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"460f87d91f2100477d256905e301364ca00bbbb4","impact_type":"unknown","incident_date":"2022-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1ea76f1a439","org_name":"Nelnet Campus Commerce","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551081"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-02-18","discovered_date":"2021-12-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2d0f4020cf2afa30fc5674ef6f5524a245f3827","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MCorp%20U.S.%20Sample%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"dec956658f56","org_name":"Meyer Corporation, U.S.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551092"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MCorp%20U.S.%20Sample%20Letters.pdf"}],"summary":"Meyer Corporation, U.S. reported a cybersecurity attack that potentially exposed employee information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3f6257dc7aed3a49a63ee8aef31837de10181a8","impact_type":"unknown","incident_date":"2020-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Eichenbaum%20-%20SSN%20-%20Redacted%20%2810149322x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72d0c74c0cf7","org_name":"Eichenbaum Comer & Ratynets AAC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551061"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2022-02-16","discovered_date":"2022-01-13","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53391505b67ce57bb610d036c7c5c2bd26929cd6","impact_type":"data_theft","incident_date":"2022-01-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Scripps_CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"8a2638efc451","org_name":"The E. W. Scripps Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown party exploited a vulnerability associated with a corporate-owned administrative website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550981"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Scripps_CA%20Sample.pdf"}],"summary":"An unknown party exploited a vulnerability in a corporate-owned administrative website and obtained credentials used to log into spellingbee.com.","supporting_quote":"The investigation determined that, on Jan. 12, 2022, an unknown party exploited the vulnerability and obtained the username and password that you use to log into spellingbee.com.","technology_involved":["corporate-owned administrative website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-02-16","discovered_date":"2021-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"c39cea880ea62b6ab6a709183ebd25f83f05246f","impact_type":"both","incident_date":"2021-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/ExtendFertility.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c59a66324ab7","org_name":"Extend Fertility","org_type":"healthcare","ransomware":true,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/ExtendFertility.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/ExtendFertility.pdf"}],"summary":"Extend Fertility reported a ransomware incident in which an unauthorized individual accessed its systems and likely obtained personal, clinical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-02-15","discovered_date":"2021-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bc06bbf08461998531377e58a19b321a49b267e","impact_type":"both","incident_date":"2021-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OAH-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"56c4b78b3841","org_name":"Orthopedic Associates of Hawaii","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550962"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OAH-%20Sample%20Notice.pdf"}],"summary":"Orthopedic Associates of Hawaii reported that ransomware encrypted systems and an unknown actor accessed certain systems and downloaded limited patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9167a7dfddf040b157fd31f440cca4f6a1153f0a","impact_type":"data_theft","imported_from":null,"incident_date":"2022-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a2fa2464abde","org_name":"GiveSendGo","org_type":"technology_saas","ransomware":null,"records_affected":89966,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GiveSendGo","type":"hibp","url":"https://haveibeenpwned.com/Breach/GiveSendGo"}],"summary":"A data breach at GiveSendGo exposed donor names, email addresses, post codes, donation amounts and comments.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-15","discovered_date":"2021-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a50df8f5c2326b5c84ecc56ed2d38c5427bf9c40","impact_type":"unknown","incident_date":"2020-04-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Consumer%20Notification%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"ab744b01eb18","org_name":"Comprehensive Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550966"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551741"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Consumer%20Notification%20Letter%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Comprehensive%20Health%20Services-2022-02-15"}],"summary":"Comprehensive Health Services reported suspicious network activity after which personal information in invoicing files may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-11","discovered_date":"2021-04-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6773351751dff79293ff2a3ce49d8e2bd825edc","impact_type":"data_theft","incident_date":"2021-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UTM%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a43bbeaebdec","org_name":"Utility Trailer Manufacturing Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550898"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UTM%20-%20Sample%20Notice.pdf"}],"summary":"Utility Trailer Manufacturing Company reported that an unknown actor may have viewed and taken personal information during unauthorized access to its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-11","discovered_date":"2022-01-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19aaf4177a0f30419a10676c6cc912f51bfa9fe1","impact_type":"data_theft","incident_date":"2021-07-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L02%20Template%20Individual%20Notice%20-%20FINAL.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"bd73968c726c","org_name":"Ethos Technologies Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L02%20Template%20Individual%20Notice%20-%20FINAL.pdf"}],"summary":"Ethos Technologies said unauthorized actors exploited its online insurance application flow to access driver’s license numbers.","supporting_quote":"EĞdžƚ͕\u0003ƚŚĞ\u0003ƵŶĂƵƚŚŽƌŝnjĞĚ\u0003ĂĐƚŽƌƐ\u0003ƵƐĞĚ\u0003ƐƉĞĐŝĂůŝnjĞĚ\u0003ǁĞď\u0003ƚŽŽůƐ\u0003ƚŽ\u0003ĂĐĐĞƐƐ\u0003ĚƌŝǀĞƌ͛Ɛ\u0003ůŝĐĞŶƐĞ\u0003ŶƵŵďĞƌƐ\u0003ĨƌŽŵ\u0003ƚŚĞ\u0003ƉĂŐĞ\u0003ƐŽƵƌĐĞ\u0003ĐŽĚĞ\u0003ŽĨ\u0003ŽƵƌ\u0003ǁĞďƐŝƚĞ.","technology_involved":["online insurance application flow"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-11","discovered_date":"2021-02-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1079256e5c17b7f47b7a4f4673aa0191d0e212f7","impact_type":"both","incident_date":"2021-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DPI%20Specialty%20Foods%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0e43a711b2c8","org_name":"DPI Specialty Foods, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550899"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DPI%20Specialty%20Foods%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DPI%20Specialty%20Foods%2C%20Inc.-2022-02-11"}],"summary":"DPI Specialty Foods said an unknown actor accessed certain systems, downloaded files, and encrypted some systems in a malware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1110"],"confidence":"medium","control_failure":"unknown","credential_source":"brute_force","cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-02-11","discovered_date":"2022-01-25","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7aab57d712da315fcf99b67af326e93516d8dd7","impact_type":"data_theft","incident_date":"2022-01-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1110","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Password%20Spray%20Individual%20Notice%20Template%20final_v2___Static_Proof.pdf"},"notes":null,"org_country":"US","org_id":"e90b1c9cc099","org_name":"CVS Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550888"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Password%20Spray%20Individual%20Notice%20Template%20final_v2___Static_Proof.pdf"}],"summary":"CVS Pharmacy detected password-spraying attempts against customer accounts on CVS.com, and personal information may have been obtained.","supporting_quote":"We recently detected automated attempts to fraudulently log in to certain customer accounts on our retail website (www.CVS.com), using common passwords (a practice known as “password spraying”).","technology_involved":["CVS.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-09","discovered_date":"2021-12-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8b19143619a1d42d825ea8444804093677ec69e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5323.pdf"},"notes":null,"org_country":"US","org_id":"94c3eeab6b0d","org_name":"Washington State Department of Transportation","org_type":"government","ransomware":null,"records_affected":2249,"reviewed":false,"root_cause":"An older WSDOT data system could be manipulated to extract information from its database.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5323.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5323.pdf"}],"summary":"A vulnerability in a WSDOT system may have exposed names and the last four digits of Social Security numbers for 2,249 people; the agency said it was not known whether anyone obtained the information for illegal use.","supporting_quote":"WSDOT learned on Dec. 29, 2021, that an older data system maintained by the agency was able to be manipulated in a way to extract information from the database.","technology_involved":["internal database","Construction Contract Information System"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-09","discovered_date":"2021-09-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88ac3138b23e7abb48d376ca62e9bbe682e49d5f","impact_type":"unknown","incident_date":"2021-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e13d714756bf","org_name":"Trillium Community Health Plan  Health Net Health Plan of Oregon","org_type":"unknown","ransomware":null,"records_affected":94977,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trillium%20Community%20Health%20Plan%20%20Health%20Net%20Health%20Plan%20of%20Oregon-2022-02-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"bf21f64633c10d481d89c946880d4f8315da15ee","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NationalMathandScienceInitiative.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3c66050f5453","org_name":"National Math & Science Initiative","org_type":"nonprofit","ransomware":null,"records_affected":1899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NationalMathandScienceInitiative.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NationalMathandScienceInitiative.pdf"}],"summary":"A state attorney general filing records a security incident affecting 1,899 people at the National Math & Science Initiative.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ebd04c6e1582388a1e44bf2c9a545ece9dd414f","impact_type":"unknown","incident_date":"2022-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SIR_Notice_Final_Signed.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550791"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-07","discovered_date":"2021-10-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"106754c80f9b20458f13e94a333110d700c2a0e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NMSI%20-%20Sample%20Notice-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"b39baa686d97","org_name":"National Math and Science Initiative","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NMSI%20-%20Sample%20Notice-%20CA.pdf"}],"summary":"National Math and Science Initiative reported that an unauthorized actor may have accessed certain systems containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-02-07","discovered_date":"2021-11-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"0c2e843dad394fe6728b4dba8dd6d64ef7ba009e","impact_type":"disruption_or_ransomware","incident_date":"2021-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/KMGPrestigeInc.pdf"},"notes":null,"org_country":"US","org_id":"db79436990d6","org_name":"KMG Prestige, Inc.","org_type":"professional_services","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/KMGPrestigeInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/KMGPrestigeInc.pdf"}],"summary":"KMG Prestige reported a ransomware incident discovered on November 28, 2021, and said a data breach likely occurred the previous day, potentially involving personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-07","discovered_date":"2021-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d23f9077c3ab88094b6108f151caecebf8a021b1","impact_type":"both","incident_date":"2021-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job39643d01_Faneuil_L01-Gen_SAS_1_1.pdf"},"notes":null,"org_country":"US","org_id":"49c6628ef40d","org_name":"Faneuil, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550731"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job39643d01_Faneuil_L01-Gen_SAS_1_1.pdf"}],"summary":"Faneuil reported that ransomware attackers accessed and copied employee records during an attack, and the company paid the attackers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d2c37708c967f428711900a5bf343dbb9989b1e","impact_type":"unknown","incident_date":"2021-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult%20No%20SSN%20-%20Redacted%20%2810130152x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e829db020ca5","org_name":"City of Hesperia","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550752"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-04","discovered_date":"2022-01-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fce60b3f2f1ad14066618ab662870f16de3839ee","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2022-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OCCD-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"582cc8b8035a","org_name":"Ohlone Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OCCD-%20Exhibit%20A.pdf"}],"summary":"Ohlone Community College District reported that an outside party accessed certain information on its network during an incident involving network disruption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3a7e4a7f8b2c8814010dd030cf1ca1143362997","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2022-02-04%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"1572eb5c16a2","org_name":"Mortgage Connect LP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2022-02-04%20Individual%20Notice%20Letter.pdf"}],"summary":"Mortgage Connect reported that an unauthorized party accessed certain Microsoft Outlook business email accounts between August 24 and October 14, 2021, potentially exposing personal information.","supporting_quote":null,"technology_involved":["Microsoft Outlook","business email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-04","discovered_date":"2022-01-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"74c6fae38e74468a77c41ab9583278bbf5a296a9","impact_type":"unknown","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c49e74b4e54f","org_name":"All Service Moving","org_type":"unknown","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#All%20Service%20Moving-2022-02-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b387df47ff07e799c84c93774957ca0f38dea6b","impact_type":"both","incident_date":"2021-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_H4870_UKG-Puma_L01_Proof%20CA.pdf"},"notes":null,"org_country":"US","org_id":"43620009eee8","org_name":"PUMA North America, Inc.","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550655"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_H4870_UKG-Puma_L01_Proof%20CA.pdf"}],"summary":"A ransomware attack on Kronos’s cloud-based environment exposed personal information belonging to PUMA employees.","supporting_quote":null,"technology_involved":["Kronos cloud-based environment"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Kronos"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"ae6d284a24da","name":"Kronos"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-03","discovered_date":"2021-10-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43e78182a2c80bf87ddd078a7d8dd2ce008a221e","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JSF%20-%20CA%20Sample%20LTR.pdf"},"notes":null,"org_country":"US","org_id":"2dfacde2258c","org_name":"John Stokes Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JSF%20-%20CA%20Sample%20LTR.pdf"}],"summary":"An unauthorized individual accessed a John Stokes Financial employee’s email account, and the organization could not determine which emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-02-03","discovered_date":"2021-12-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c02d6c5ad2277763c45cfa5e8707388d34fc9466","impact_type":"unknown","incident_date":"2021-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1da4f4b13fb2","org_name":"Injured Workers Pharmacy","org_type":"unknown","ransomware":null,"records_affected":75771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Injured%20Workers%20Pharmacy-2022-02-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-02-01","discovered_date":"2021-10-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b472645fd82fd11eeb7a1c64904ed186b9c5212","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-21","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Romeo%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"871a6fc28e61","org_name":"Romeo Power, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550603"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Romeo%20-%20California%20Notification.pdf"}],"summary":"An unauthorized individual accessed an employee’s email account, which contained personal information, but the investigation could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"410cc907f55b5b8a5fe52a9996f84a31fddfa24b","impact_type":"disruption_or_ransomware","incident_date":"2021-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NotificationText-send-to-AG.pdf"},"notes":null,"org_country":"US","org_id":"24d2190ac098","org_name":"Pellissippi State Community College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550601"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NotificationText-send-to-AG.pdf"}],"summary":"Pellissippi State Community College confirmed unauthorized access to its Active Directory database during a ransomware cyberattack.","supporting_quote":null,"technology_involved":["Active Directory"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"21cc443ca389c8b414c2cb21c819f4ee9b19661f","impact_type":"both","incident_date":"2021-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6398.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"50a9da348aa8","org_name":"Morley Companies, Inc.","org_type":"professional_services","ransomware":true,"records_affected":42633,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6398.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551860"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550610"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Morley%20-%20Sample%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/MorleyCompaniesInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6398.pdf"}],"summary":"Morley Companies reported ransomware-type malware that blocked access to some data files and unauthorized access to files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-01","discovered_date":"2021-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53edfbf88ae5693463018f266c2af25a9d9ba10b","impact_type":"disruption_or_ransomware","incident_date":"2021-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Luttrell%20Staffing%20-CA.pdf"},"notes":null,"org_country":"US","org_id":"2ecd7d8090c4","org_name":"Luttrell Staffing Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Luttrell%20Staffing%20-CA.pdf"}],"summary":"Luttrell Staffing reported that malware encrypted files and an unauthorized actor accessed its systems, where employee and associate information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-02-01","discovered_date":"2021-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8a6ae6463e0325960ddf0ba84a434129ca51bf6","impact_type":"data_theft","incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSI%20Notice_AF564_v02.pdf"},"notes":null,"org_country":"US","org_id":"13dd287adc8d","org_name":"Kenyon Companies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSI%20Notice_AF564_v02.pdf"}],"summary":"Kenyon Companies, Inc. reported that an unauthorized actor exfiltrated personal information, including names and Social Security numbers, from a system server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-31","discovered_date":"2021-06-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"7aa9194b58addc39a7819f4f186baffe6891015e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/FarmersTelephone.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ff95c041b1ab","org_name":"Farmers Telephone Cooperative","org_type":"telecom","ransomware":null,"records_affected":7636,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/FarmersTelephone.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/FarmersTelephone.pdf"}],"summary":"Farmers Telephone Cooperative discovered a data security incident affecting certain systems, and its investigation found that some files containing personal information were accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"30ab32f53c0afc218de008423826671cba6e67b2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5298.pdf"},"notes":null,"org_country":"US","org_id":"e104db01981d","org_name":"American Marriage Ministries","org_type":"nonprofit","ransomware":null,"records_affected":16727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5298.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5298.pdf"}],"summary":"American Marriage Ministries reported that ministers’ names in combination with dates of birth may have been accessible on the internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2022-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1ad3864fc1e0849766647440637f582aaf9a045a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5295.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c6b26f9e1187","org_name":"Fairmount Memorial Association","org_type":"unknown","ransomware":null,"records_affected":6909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5295.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"830fd1f164d084f1f10e5000bb3a4b9959c59999","impact_type":"unknown","incident_date":"2021-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Accutech%20Systems%20Corporation%20-%20SSN%20%28redacted%29%20%2810112845x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2af6a980e97","org_name":"Accutech Systems Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550527"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5292.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2022-01-28","discovered_date":"2021-11-23","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"d5cf3d79254a3ed3401aec80d5d7cab14f6e5de8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5296.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"322eadaee46b","org_name":"Unum Group","org_type":"financial","ransomware":null,"records_affected":1610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Unum%20Group%20%28%22Unum%22%29-2022-01-28"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5296.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550509"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Unum%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5296.pdf"}],"summary":"Unum reported that an unknown actor accessed the contents of an employee’s email account, which may have included information about affected individuals.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c0ba5391bab4d25aed5d6a58c26d0027b87e106","impact_type":"data_theft","imported_from":null,"incident_date":"2020-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ad75030bbac9","org_name":"RedDoorz","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: RedDoorz","type":"hibp","url":"https://haveibeenpwned.com/Breach/RedDoorz"}],"summary":"RedDoorz suffered a data breach that exposed user account information, including personal details and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":["hotel management and booking platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-28","discovered_date":"2021-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f12d18bf33493e9636fe7cdb68d4ccff7161831","impact_type":"both","incident_date":"2021-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keller%20Supply%20Adult%20CM%201%20Yr%20Letter%20A%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"99c9be12b6b6","org_name":"Keller Supply Company","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550516"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keller%20Supply%20Adult%20CM%201%20Yr%20Letter%20A%20r2prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Keller%20Supply%20Company-2022-01-28"}],"summary":"Keller Supply Company reported that ransomware encrypted certain systems and files related to employee benefits were copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"702ab9ce784f7ce29781352754e70a5a050b9f70","impact_type":"both","imported_from":null,"incident_date":"2021-11-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1b196b61954d","org_name":"BTC-Alpha","org_type":"financial","ransomware":true,"records_affected":362426,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BTC-Alpha","type":"hibp","url":"https://haveibeenpwned.com/Breach/BTCAlpha"}],"summary":"BTC-Alpha suffered a ransomware attack in November 2021, and customer data was publicly dumped.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-01-26","discovered_date":"2022-01-16","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3192d404d63d59526b948275d1d990f5a7d9b1f8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_TracyATM_01.19.21.pdf"},"notes":null,"org_country":"US","org_id":"caca7ac039d9","org_name":"UNCLE Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550395"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_TracyATM_01.19.21.pdf"}],"summary":"UNCLE Credit Union learned that a card skimmer had been installed at ATMs at its Tracy Financial Center, potentially recording cardholder names, card numbers, and expiration dates.","supporting_quote":"On January 16, 2022, we learned a card skimmer had been installed at our ATMs at our Tracy Financial Center.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"49ca7acfa6b611e410ec8a46f68c01cbf9c29e4e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SC-DNR.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b203ab24af98","org_name":"South Carolina Department of Natural Resources (DNR)","org_type":"unknown","ransomware":null,"records_affected":1243,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SC-DNR.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-26","discovered_date":"2021-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"410b65c1bedc66eac5c733cf95b56186f30689e4","impact_type":"both","imported_from":null,"incident_date":"2021-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GirlScoutsofConnecticut.pdf"},"notes":null,"org_country":"US","org_id":"ccc156ea69a2","org_name":"Girl Scouts of Connecticut","org_type":"nonprofit","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GirlScoutsofConnecticut.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GirlScoutsofConnecticut.pdf"}],"summary":"An unauthorized individual accessed Girl Scouts of Connecticut's systems and obtained information during a ransomware incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"8652b3768243d17eac06b18bd416910e87d0a94a","impact_type":"disruption_or_ransomware","incident_date":"2021-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CTHRentalsLLC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5f838ef2e929","org_name":"CTH Rentals, LLC","org_type":"other","ransomware":null,"records_affected":27725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CTHRentalsLLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CTHRentalsLLC.pdf"}],"summary":"CTH Rentals reported that unauthorized individuals deployed malware that encrypted network drives and backups; the investigation found no evidence that personal information was downloaded.","supporting_quote":null,"technology_involved":["network drives","backups"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc5fb24868a93adaba6c05e34bf2c3344631b0a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20PII%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0174e338a4db","org_name":"Sacramento County Department of Child, Family & Adult Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A malicious phishing campaign obtained employees’ credentials, which were used to access their Webmail.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550329"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20PII%20Breach%20Notification.pdf"}],"summary":"A phishing campaign compromised employee credentials that were used to access Sacramento County users’ Webmail, where emails contained personally identifiable and medical information.","supporting_quote":"On June 22, 2021, Sacramento County was the target of a malicious phishing campaign in an unknown threat actor obtained access to several employees’ credentials and began using those credentials to access the users’ Webmail.","technology_involved":["Webmail"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-01-25","discovered_date":"2022-02-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1544aa88ebd1f9b63c071cf9c9ad1f05293bb98","impact_type":"data_theft","incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PulseTV%20Ad%20Repeat%20Notice%20r3prf_FINAL%20PROOF%20ROUND%20II.pdf"},"notes":null,"org_country":"US","org_id":"fc66ac519eef","org_name":"Penn LLC d/b/a Pulse TV","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551702"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550280"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PulseTV%20Ad%20Repeat%20Notice%20r3prf_FINAL%20PROOF%20ROUND%20II.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11304.pdf"}],"summary":"Penn LLC d/b/a Pulse TV reported that malware on a webserver hosted by Freestyle Solutions captured customers’ payment card data.","supporting_quote":null,"technology_involved":["Freestyle Solutions","webserver"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Freestyle Solutions, Inc."},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"838a2f77aac5","name":"Freestyle Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-25","discovered_date":"2021-01-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15ace56e390b166559a7dfb0f4c17893b64911e1","impact_type":"both","incident_date":"2021-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Midland%20University%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"43d51600e6fe","org_name":"Midland University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550343"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Midland%20University%20-%20Sample%20Notice.pdf"}],"summary":"Midland University reported that malware encrypted files and an unknown actor accessed and downloaded a subset of files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-25","discovered_date":"2021-12-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6701b50983847b470536f69ca02a02f339b9ef89","impact_type":"unknown","incident_date":"2021-11-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f16c8b5f035","org_name":"Hospital Authority of Valdosta and Lowndes County Georgia","org_type":"unknown","ransomware":null,"records_affected":41692,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hospital%20Authority%20of%20Valdosta%20and%20Lowndes%20County%20Georgia-2022-01-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-25","discovered_date":"2021-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"168b70885cfcf34bb1f0bc692c54e47a94d11092","impact_type":"data_theft","incident_date":"2021-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aditi%20Consulting%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6ba8a9aae3de","org_name":"Aditi Consulting","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aditi%20Consulting%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5282.pdf"}],"summary":"Aditi Consulting reported that an unauthorized actor took documents containing current and former employees’ and consultants’ information, including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"25c647186fed427de57b5165fa7fd93b037b5db3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/Startek.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bdadbecb9c64","org_name":"Startek, Inc.","org_type":"professional_services","ransomware":null,"records_affected":1281,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/Startek.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/Startek.pdf"}],"summary":"Startek sent a security incident notification to affected individuals; the provided text does not describe how the incident occurred or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-01-24","discovered_date":"2021-11-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecbff295083c2955bca9eacd0fa33dfccaa86fed","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spencer%20Gifts%20-%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e004216df708","org_name":"Spencer Gifts LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550257"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spencer%20Gifts%20-%20California%20Notice.pdf"}],"summary":"An unauthorized actor accessed Spencer Gifts LLC's network, affecting its availability and functionality, and may have accessed files containing employee personal, health plan, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-01-24","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a662a16771af20450ea7f0bff2f89bf6cbb0657e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PEBA.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cb69d7bafb0c","org_name":"South Carolina Public Employee Benefit Authority","org_type":"government","ransomware":null,"records_affected":1006,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PEBA.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PEBA.pdf"}],"summary":"Information provided by the South Carolina Public Employee Benefit Authority to MRIoA was involved in an unauthorized acquisition.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MRIoA"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"530057175ca5","name":"MRIoA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-01-24","discovered_date":"2021-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"220d42a855274244fbefa5ed260044a2140434d2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calitho%20-%20CA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"55b5595f3b94","org_name":"Acme Press, Inc. dba Calitho","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550250"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calitho%20-%20CA%20Sample%20Notice.pdf"}],"summary":"Calitho discovered suspicious activity and could not access certain files and folders; its investigation could not rule out unauthorized access to or taking of information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8991bab4c01bfe87aa3d4baa9716dfaac78a5df1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SniderTire.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"acbf1af54d85","org_name":"Snider Tire, Inc.","org_type":"unknown","ransomware":null,"records_affected":1159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SniderTire.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-01-21","discovered_date":"2021-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddb66d4a52ba447c48c7df14fdf20f608780ebed","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nuna%20Baby%20Template%20Individual%20Notice%20--%20California.pdf"},"notes":null,"org_country":"US","org_id":"8941d1d2d1e6","org_name":"Nuna Baby Essentials, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550190"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nuna%20Baby%20Template%20Individual%20Notice%20--%20California.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nuna%20Baby%20Essentials%2C%20Inc.-2022-01-21"}],"summary":"Nuna reported that malicious code was present on its website and payment card information submitted there may have been compromised.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c960d66f46ed96bf1bc3711da4b0faf725723c33","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5273.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dcaa29ff1cb0","org_name":"Hörmann Northwest Door, LLC","org_type":"manufacturing","ransomware":null,"records_affected":552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5273.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5273.pdf"}],"summary":"Hörmann Northwest Door reported that an unauthorized actor accessed files that may have contained personal information.","supporting_quote":null,"technology_involved":["email systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb7da162b19b462b6ecb018014b6394f48a783a2","impact_type":"unknown","incident_date":"2021-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Kings%20County%20Sample%20notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a5e41a12437","org_name":"County of Kings, a political subdivision of the State of California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550203"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2022-01-21","discovered_date":"2021-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9578bdaba0cc912050300ea0e11166287bcd35b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5271.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"60eb5b5cd6b7","org_name":"Boeing Employees' Credit Union","org_type":"financial","ransomware":null,"records_affected":2187,"reviewed":false,"root_cause":"A system-generated error caused a duplicate loan advance voucher to be mailed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5271.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5271.pdf"}],"summary":"Boeing Employees' Credit Union mailed a duplicate loan advance voucher to a member's previous address after a system-generated error.","supporting_quote":"Our records indicate that you have moved since opening the personal line of credit, and the duplicate voucher was sent to your previous address.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2022-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02d7615e657e4249546748684eb5eb5ad058b0e9","impact_type":"data_theft","imported_from":null,"incident_date":"2020-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"105c0aa96c16","org_name":"ShockGore","org_type":"other","ransomware":null,"records_affected":73944,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ShockGore","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShockGore"}],"summary":"A 2020 breach of ShockGore exposed user email addresses, usernames, IP addresses, genders, password hashes, and private messages.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5adab78801b16b3b7bbb4544bbb64344f1d3e20","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"94eb57f379d5","org_name":"Upstox","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Upstox","type":"hibp","url":"https://haveibeenpwned.com/Breach/Upstox"}],"summary":"Upstox disclosed a breach that exposed personal, financial, and password information belonging to customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1213","T1530","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-19","discovered_date":"2021-12-21","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"12bbccb9685bd085f6df388fe0543686890b16da","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-12-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5268.pdf"},"notes":null,"org_country":"US","org_id":"080246cacba8","org_name":"Spokane Regional Health District","org_type":"healthcare","ransomware":null,"records_affected":1058,"reviewed":false,"root_cause":"An employee entered Office 365 credentials on a phishing page and authenticated an MFA prompt.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5268.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5268.pdf"}],"summary":"A phishing email led an employee to provide Office 365 credentials and authenticate an MFA prompt, after which an unauthorized actor accessed SharePoint and OneDrive files.","supporting_quote":"The employee accessed the link, provided their credentials, and authenticated a multifactor authentication (MFA) prompt.","technology_involved":["Microsoft 365","SharePoint","OneDrive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fbd58c9f77cf9b0cda4e30bb229cce07ae7e5bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pitco%20Foods%20%28CA%29%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4ca0b5a1ea6f","org_name":"Pitco Foods","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550147"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pitco%20Foods%20%28CA%29%20Sample%20Notice.pdf"}],"summary":"Pitco Foods identified unusual network activity and could not rule out that an unauthorized third party viewed or took files containing names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ef9e1a9b8e99150cd5b715d4079960d75badfa9","impact_type":"both","imported_from":null,"incident_date":"2021-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ed09ad206d86","org_name":"Open Subtitles","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Open Subtitles","type":"hibp","url":"https://haveibeenpwned.com/Breach/OpenSubtitles"}],"summary":"Open Subtitles suffered a data breach in August 2021 that exposed subscriber data and was followed by a ransom demand.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b485a09c1ead32da2fcab7ed168a1d69185c69","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/001%20LendUS%20CA%20Adult%20CA%20CM%201%20YR_AF443_v02.pdf"},"notes":null,"org_country":"US","org_id":"92b2ec315db9","org_name":"LendUS, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550153"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/001%20LendUS%20CA%20Adult%20CA%20CM%201%20YR_AF443_v02.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LendUS%2C%20LLC-2022-01-19"}],"summary":"An unauthorized person accessed certain LendUS employee email accounts between February 2 and March 22, 2021, and the organization could not rule out access to or download of emails or attachments.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-18","discovered_date":"2021-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55011b4d7f26107870857693fe008e4ce3f1a910","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/92Y%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"433762f11b07","org_name":"92nd Street Y","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/92Y%20-%20Sample%20Notice.pdf"}],"summary":"92nd Street Y identified unusual activity and later determined that files may have been accessed and downloaded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7973332390be88ebbb7481365d7ca7c223e44321","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"23453dfc77a2","org_name":"Carding Mafia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Carding Mafia (December 2021)","type":"hibp","url":"https://haveibeenpwned.com/Breach/CardingMafiaDec2021"}],"summary":"A December 2021 breach of the Carding Mafia forum exposed member email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2022-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"074bf30558a5421bce776c614acc48077f49a4f0","impact_type":"both","incident_date":"2021-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"bca10a274b31","org_name":"Aditya Birla Fashion and Retail","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aditya Birla Fashion and Retail","type":"hibp","url":"https://haveibeenpwned.com/Breach/ABFRL"}],"summary":"Aditya Birla Fashion and Retail was breached and ransomed in December 2021, and customer and employee data was later dumped publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2022-01-14","discovered_date":"2021-11-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32b2cc317c82ed11444f15311f467a083dc41a35","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-16","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20website.pdf"},"notes":null,"org_country":"US","org_id":"de69603bba72","org_name":"Volunteers of America Southwest","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee followed a link in a deceptive voicemail-service email and entered email credentials on a fraudulent website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550020"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20website.pdf"}],"summary":"Volunteers of America Southwest said an employee entered credentials on a fraudulent voicemail website, allowing criminals to access emails containing internal financial information and limited client information.","supporting_quote":"That email was from a criminal, however, and when the employee clicked on the link, he was redirected to a website that purported to store his voicemail.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da6bf6f5bd6f538f1492848b5de7452c547d7a54","impact_type":"disruption_or_ransomware","incident_date":"2021-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jim%20Koons%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"48ca9b04c38c","org_name":"Jim Koons Automotive Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jim%20Koons%20-%20Sample%20Notice.pdf"}],"summary":"Jim Koons Automotive Company reported that an unauthorized actor accessed part of its network and encrypted network files, and that the affected systems contained individuals’ names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2022-01-14","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce4229c0ae5702c6ae4188076f3f38db2d3e7e83","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FCI%20-%20Sample%20Notice%20.pdf"},"notes":null,"org_country":"US","org_id":"f78729513cd6","org_name":"Fluid Components International LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550007"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FCI%20-%20Sample%20Notice%20.pdf"}],"summary":"Fluid Components International reported that information may have been viewed or copied without authorization during a cyberattack between September 17 and November 8, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2144d2ae25a0ad39272709e21cda060d7d676eac","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Caring%20Communities%20-%20Individual%20Data%20Breach%20Notification%20Letter%20%28Final%29_v04%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"c1915fedbea5","org_name":"Caring Communities","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550002"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Caring%20Communities%20-%20Individual%20Data%20Breach%20Notification%20Letter%20%28Final%29_v04%20PROOF.pdf"}],"summary":"Caring Communities reported that information including names, addresses, Social Security numbers, and limited medical history may have been accessed during a cybersecurity incident involving Netgain.","supporting_quote":"We have also stayed in close communication with Netgain and its breach counsel regarding Netgain’s incident response and forensic investigation.","technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db56f382cd02a69f064ce9482cd57e1e2fa455bf","impact_type":"data_theft","incident_date":"2021-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AFLIC%20Consumer%20letter%202022.01.14.pdf"},"notes":null,"org_country":"US","org_id":"aee9a0d51cff","org_name":"American Family Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550021"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AFLIC%20Consumer%20letter%202022.01.14.pdf"}],"summary":"Unauthorized parties may have used an automated bot process on the AFLIC online quoting platform to obtain customers’ driver’s license numbers.","supporting_quote":null,"technology_involved":["AFLIC online quoting platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f79660c8e5b093a414b9d703f6be739af3bef7","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1f7a32cfa0c9","org_name":"Guns.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":375928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Guns.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/GunsDotCom"}],"summary":"A breach of Guns.com exposed personal information, gun purchases, partial credit card data, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":["Guns.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"696a0e985ba7ec6e8ea45833649e6462aef7ea9c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Entira_Patient%20Breach%20Notification_Static_Proof.pdf"},"notes":null,"org_country":"US","org_id":"4a85ac2c125b","org_name":"Entira Family Clinics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549954"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Entira_Patient%20Breach%20Notification_Static_Proof.pdf"}],"summary":"Entira Family Clinics reported that personal and medical information was accessed by an unauthorized party following a cybersecurity incident at its hosting provider, Netgain.","supporting_quote":null,"technology_involved":["Netgain","cloud services","email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-13","discovered_date":"2021-09-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed24a6ae1acbc48bf8af5178474c5f044e99aad6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bet%20Tzedek-%20California%20%28CM%29%20with%20spanish%20-%20V3%20Print%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"02fda93de39b","org_name":"Bet Tzedek Legal Services","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549979"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bet%20Tzedek-%20California%20%28CM%29%20with%20spanish%20-%20V3%20Print%20Proof.pdf"}],"summary":"Unauthorized access to six Bet Tzedek employees’ email accounts was discovered, and personal information was found in the accounts.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7116fc19c10d7eeecb76abd078171d3ef2d095fc","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Harder%2BCompany%20Community%20Research%20Notification%20Letter-General.pdf"},"notes":null,"org_country":"US","org_id":"7f687f7c964a","org_name":"Harder + Company Community Research, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549883"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Harder%2BCompany%20Community%20Research%20Notification%20Letter-General.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Harder%2BCompany%20Community%20Research-2022-01-12"}],"summary":"An unauthorized user accessed some of Harder + Company Community Research’s business email accounts containing client information.","supporting_quote":null,"technology_involved":["business email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2022-01-11","discovered_date":"2021-10-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21e4fdf9195822927871c430e028f9d50ceab0db","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACU%20Notice%20of%20Data%20Breach%20Template%201%20-%20January%202022.pdf"},"notes":null,"org_country":"US","org_id":"205d7844e4b2","org_name":"Altura Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549896"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACU%20Notice%20of%20Data%20Breach%20Template%201%20-%20January%202022.pdf"}],"summary":"An attacker accessed Altura Credit Union’s website and installed malicious code that may have allowed access to members’ account numbers.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d73a56428b051033e3f6fead210f40b5703ba29e","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Minnesota%20Statewide%20Limited%20Energy%20J.A.T.C%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"51094de5cf9e","org_name":"Minnesota Statewide Limited Energy J.A.T.C.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549824"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Minnesota%20Statewide%20Limited%20Energy%20J.A.T.C%20-%20Sample%20Notice.pdf"}],"summary":"Minnesota Statewide Limited Energy J.A.T.C. reported unauthorized access to a computer system on September 15, 2021, that contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-10","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3f437df03dff6d164d0e26da9748cb6f5d60830","impact_type":"unknown","incident_date":"2021-11-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5f5304009da","org_name":"Medical Review Institute of America (MRIoA)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medical%20Review%20Institute%20of%20America%20%28MRIoA%29-2022-01-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35d736c34072e76909dda700994d1fe6c462dc75","impact_type":"data_theft","imported_from":null,"incident_date":"2022-01-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e7ac617299f9","org_name":"Doxbin","org_type":"other","ransomware":null,"records_affected":370794,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Doxbin","type":"hibp","url":"https://haveibeenpwned.com/Breach/Doxbin"}],"summary":"Doxbin suffered a data breach, and leaked data included email addresses, usernames, password hashes, browser user agents, and personal information from doxes.","supporting_quote":null,"technology_involved":["Doxbin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-07","discovered_date":"2021-09-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0ff877123c32505720d0ba2f59fa2bec16deaaf","impact_type":"unknown","incident_date":"2021-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c4b2ae97981","org_name":"Trillium Community Health Plan","org_type":"unknown","ransomware":null,"records_affected":7958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trillium%20Community%20Health%20Plan-2022-01-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-01-07","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b00d3e27a5d3e9db7d4b690f76e48e3fa0d56f49","impact_type":"data_theft","incident_date":"2021-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXH%20A%20%2810354150x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"73d67e3b0bd6","org_name":"Medical Review Institute of America","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-557846"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-555249"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553273"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549771"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550043"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550665"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXH%20A%20%2810354150x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5248.pdf"}],"summary":"Medical Review Institute of America reported unauthorized acquisition of information that included protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-07","discovered_date":"2021-11-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7bc6ec56963caaaf3d6a490e97fffec9ceb9d68","impact_type":"unknown","incident_date":"2021-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08c66f8bc4e5","org_name":"Heart 'n Home Hospice","org_type":"unknown","ransomware":null,"records_affected":4769,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Heart%20%27n%20Home%20Hospice-2022-01-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-07","discovered_date":"2021-08-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a34953056806abadf71dc064d2da09e7dfa1767","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eden%20Housing%20-%20CA%20Notification%20Letter%20%28CM%29_v2%20%28PRINT%20PROOF%29.pdf"},"notes":null,"org_country":"US","org_id":"7728c5c24546","org_name":"Eden Housing","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eden%20Housing%20-%20CA%20Notification%20Letter%20%28CM%29_v2%20%28PRINT%20PROOF%29.pdf"}],"summary":"An unauthorized individual accessed Eden Housing employee email accounts, and the organization could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2022-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a085d7e1a27e182fde5e9c997abed9749389278a","impact_type":"data_theft","incident_date":"2021-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sub%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"de0502be703b","org_name":"City of Grass Valley","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549778"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sub%20Notice.pdf"}],"summary":"An unauthorized person accessed City of Grass Valley computer systems and transferred files containing personal information outside the city’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2022-01-06","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39531260e338ff477eb7c69eaa62cd9bd7a48141","impact_type":"data_theft","imported_from":null,"incident_date":"2021-12-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0f8ee70ef958","org_name":"FlexBooker","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The breach originated from a compromised account within FlexBooker's AWS infrastructure.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FlexBooker","type":"hibp","url":"https://haveibeenpwned.com/Breach/FlexBooker"}],"summary":"FlexBooker reported a breach originating from a compromised account in its AWS infrastructure, exposing account data that was later found being traded on a hacking forum.","supporting_quote":"FlexBooker has identified the breach as originating from a compromised account within their AWS infrastructure.","technology_involved":["AWS"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-06","discovered_date":"2021-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"585a2fa7d0d67cf579090ce78106521805993e0d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ebara%20Current%20Family%20Employee%20Notification%20Letter%20%28Privileged%20and%20Confidential%29.pdf"},"notes":null,"org_country":"US","org_id":"2f2eee846f01","org_name":"Ebara Technologies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549736"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ebara%20Current%20Family%20Employee%20Notification%20Letter%20%28Privileged%20and%20Confidential%29.pdf"}],"summary":"Ebara Technologies reported a security incident that potentially compromised part of its IT environment, with no forensic evidence confirming PII compromise.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28ed33ea87159755eea1e316de6160ee19870fa5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Advent%20Health%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e258d075870b","org_name":"Advent Health Partners, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552903"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Advent%20Health%20Sample%20Notice.pdf"}],"summary":"Advent Health Partners detected suspicious activity involving employee email accounts, and later determined that files containing individuals’ information may have been accessed by an unauthorized third party.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-05","discovered_date":"2021-09-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36b4f739cf7dea74e3234c4d553cf727e195b275","impact_type":"disruption_or_ransomware","incident_date":"2021-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MB%20International%20Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"dbc21cfcae84","org_name":"Marquez Brothers International, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549707"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MB%20International%20Notification%20Template.pdf"}],"summary":"Marquez Brothers International discovered an intrusion in which ransomware encrypted several systems and employee information may have been accessed or exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2022-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffa832ee0cfbceff42659ae63e6bc51f72f24615","impact_type":"disruption_or_ransomware","incident_date":"2021-05-27","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marlabs%20-%20Notice%20Letter%20%28General%29.pdf"},"notes":null,"org_country":"US","org_id":"e1ac84a85dd2","org_name":"Marlabs, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marlabs%20-%20Notice%20Letter%20%28General%29.pdf"}],"summary":"Marlabs reported a ransomware incident and said unauthorized access to personal information may have occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b2396dba65de953d2ba4c2eb4bd88f96f45f75cf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NorthBrowardHospitalDistrict.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b9a4e46cb24d","org_name":"North Broward Hospital","org_type":"unknown","ransomware":null,"records_affected":2802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/NorthBrowardHospitalDistrict.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-04","discovered_date":"2021-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ccdbab2fb221561c8f6e3507ffc94516bae03c04","impact_type":"data_theft","incident_date":"2021-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5245.pdf"},"notes":null,"org_country":"US","org_id":"b71c6b42e43c","org_name":"Fertility Centers of Illinois","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5245.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5245.pdf"}],"summary":"An unauthorized third party accessed internal files and acquired FCI data that included a person's name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2022-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b59f516c2e45627abd7400b9ae365ceaa24f64d","impact_type":"data_theft","imported_from":null,"incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0c05dbf394c8","org_name":"DatPiff","org_type":"other","ransomware":null,"records_affected":7476940,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DatPiff","type":"hibp","url":"https://haveibeenpwned.com/Breach/DatPiff"}],"summary":"DatPiff user email addresses, passwords, usernames, and security questions and answers appeared for sale on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2022-01-04","discovered_date":"2021-12-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c2b11282b21b6e4133f7b0464140a73ae2424172","impact_type":"unknown","incident_date":"2021-11-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d12318723d5b","org_name":"Bob’s Red Mill Natural Foods, Inc.","org_type":"unknown","ransomware":null,"records_affected":2585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bob%E2%80%99s%20Red%20Mill%20Natural%20Foods%2C%20Inc.-2022-01-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2022-01-03","discovered_date":"2021-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73c0ff3e8b2386c210c0aa1f380b7adbd5daded3","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pharmfood%20Ad%20CM%201%20YR%20Ravkoo%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"daf0910eff6e","org_name":"Ravkoo","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549655"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pharmfood%20Ad%20CM%201%20YR%20Ravkoo%20r3prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5242.pdf"}],"summary":"Ravkoo reported that an unauthorized third party targeted its prescription portal, where personal and limited medical information could have been exposed.","supporting_quote":null,"technology_involved":["AWS cloud services","prescription portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1199"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-01-02","discovered_date":"2021-10-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2025d832b4431128d88d7dd609078dee36570cc8","impact_type":"data_theft","incident_date":"2021-10-15","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5241.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6d64daa1d1b6","org_name":"North Broward Hospital District","org_type":"healthcare","ransomware":null,"records_affected":1168,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Broward%20Hospital%20District%20d/b/a%20Broward%20Health-2022-01-02"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5241.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5241.pdf"}],"summary":"An intruder accessed personal information at North Broward Hospital District through the office of a third-party medical provider, and information was exfiltrated.","supporting_quote":"The investigation determined the intrusion occurred through the office of a third-party medical provider who is permitted access to the system to provide healthcare services.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-09"},"first_seen":"2026-10-09","id":"c269609755deba1cc23f66517e34549fb86944f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89c70c60-078d-11ed-8fd4-9be359ef207c"},"incident_date":"2022-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"0dc186a90ca0","org_name":"Unknown Contractor","org_type":"technology_saas","ransomware":null,"records_affected":512000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/red-cross-supply-chain-data-breach/"}],"summary":"Hackers stole sensitive Red Cross data from an unnamed contractor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2022-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82c5b5848859bd2a47054a47124a3a09cbe28f3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"722f3660-02e0-11ed-8b5b-6134b3849169"},"incident_date":"2022-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"41979c69ffab","org_name":"National Registration Department","org_type":"government","ransomware":null,"records_affected":22500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techwireasia.com/2022/05/relax-or-panic-as-data-of-22-5-million-malaysians-leak-online/"}],"summary":"22.5 Malaysians personal data got taken from the government and put up for sale","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2022-01-01","discovered_date":"2021-10-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bca6132a04b22110204410950969737dbad1679","impact_type":"data_theft","incident_date":"2021-10-15","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Sample%20Notification%20Letter%20%28Jan.%201%2C%202022%29.pdf"},"notes":null,"org_country":"US","org_id":"7bde8ea23809","org_name":"Broward Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549603"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Sample%20Notification%20Letter%20%28Jan.%201%2C%202022%29.pdf"}],"summary":"An intruder accessed Broward Health systems through the office of a third-party medical provider and exfiltrated personal medical information.","supporting_quote":"The investigation determined the intrusion occurred through the office of a third-party medical provider who is permitted access to the system to provide healthcare services.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"third-party medical provider"},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8dcf1cbfd808d6c2ad5974670a7df4f6f8f7321","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-31","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Phase%20II%20-%20Draft%20Notice%20Letter%20-%20SSN%20%28redacted%29%20%2810046159x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"a6fbd6b4faf3","org_name":"Phase II Systems","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing incident resulted in unauthorized access to a PARS employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549033"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Phase%20II%20-%20Draft%20Notice%20Letter%20-%20SSN%20%28redacted%29%20%2810046159x7AB84%29.pdf"}],"summary":"A phishing incident gave an unauthorized party access to a PARS employee’s email account, which contained personal information.","supporting_quote":"As a result of a phishing incident, a n unauthorized party obtained access to a PARS employee’s email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-12-31","discovered_date":"2021-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66f7160f852db6e9ce2051224ec3cfe3d3b6986d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AnthemBC%20HITECH%20letter.pdf"},"notes":null,"org_country":"US","org_id":"c9dc15af44b2","org_name":"Anthem, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549043"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AnthemBC%20HITECH%20letter.pdf"}],"summary":"Information in OneDigital’s system may have been accessed without permission by an unknown party, and Anthem said there was no definitive evidence it was viewed or taken.","supporting_quote":null,"technology_involved":["OneDigital"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OneDigital"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"6d311a3c98e4","name":"OneDigital"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"719d8a92846ccc26f3d0de9a8c1d7dd83f326af1","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Xanitos%20Inc-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f7a5487bab99","org_name":"Xanitos, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549026"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Xanitos%20Inc-%20Sample%20Notice.pdf"}],"summary":"Xanitos reported unauthorized access to certain employee email accounts from May 6 to July 6, 2021, where personal information was accessible but not necessarily accessed or viewed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-30","discovered_date":"2021-06-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"996b88eddea8381a803956971977b4e04cd453a4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VUSD-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8e02258de00e","org_name":"Visalia Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VUSD-%20Sample%20Notice.pdf"}],"summary":"Visalia Unified School District identified unauthorized access to certain email accounts containing individuals’ names and other information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fee9f9d02c24e6d6a5c3aa77544144181d87ce1","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Marker%20Group%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"31bd41e1bbf8","org_name":"The Marker Group Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549011"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Marker%20Group%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"The Marker Group discovered suspicious activity on its systems, and an investigation found that files containing personal and medical information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2021-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e2c57272f27f02c4ac2b124dd6818b9a4a277eb","impact_type":"both","incident_date":"2021-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5240.pdf"},"notes":null,"org_country":"US","org_id":"fb80aa50273a","org_name":"McMenamins, Inc.","org_type":"other","ransomware":true,"records_affected":4693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#McMenamins%2C%20Inc.-2021-12-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5240.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5240.pdf"}],"summary":"McMenamins suffered a ransomware attack that disrupted its systems, and hackers stole business records containing employee information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1489"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2021-12-30","discovered_date":"2021-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d248fbae860e08b877eff09de893af2fd45c73c","impact_type":"both","incident_date":"2021-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Barlow%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2db45e5ff955","org_name":"Barlow Respiratory Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-551464"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549020"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Barlow%20-%20California%20Notification.pdf"}],"summary":"An unauthorized party accessed Barlow Respiratory Hospital systems, disrupted IT operations, and removed files containing information about employees and physicians.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a3c7ce01037a95ea950b291423be9276789d00b5","impact_type":"both","incident_date":"2021-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SIGroup.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1041, T1213","org_country":"US","org_id":"7e8c17f0991a","org_name":"SI Group","org_type":"manufacturing","ransomware":true,"records_affected":353,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SIGroup.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SIGroup.pdf"}],"summary":"SI Group reported a ransomware attack that infected its systems and involved access to and removal of files containing personal information.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials","internal"],"disclosed_date":"2021-12-29","discovered_date":"2021-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f3c5febcf3fc066aeb9b11d729b58c0660700b8","impact_type":"both","incident_date":"2021-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11423.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e0c8f068a1bd","org_name":"Innovations Group, Inc.","org_type":"healthcare","ransomware":true,"records_affected":39447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11423.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Innovations%20Group%20Inc-2022-01-03"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11423.pdf"}],"summary":"Innovations Group, Inc. reported that a ransomware attack encrypted twelve servers and accessed and exfiltrated personal and protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-28","discovered_date":"2021-12-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8660fd237e5963c0dd4bb578140807d0eff33ba8","impact_type":"unknown","incident_date":"2021-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e5154e1fcaed","org_name":"Portland Roasting","org_type":"unknown","ransomware":null,"records_affected":833,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Portland%20Roasting-2021-12-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6662421ba052dfeb44879f8874bf857242016be5","impact_type":"unknown","incident_date":"2021-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Version%20CA%20-%20Medical%20Info_DOB_SSN_Financials%20Final-1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9af4de171721","org_name":"Innovations Group, Inc., a subsidiary of UpHealth, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548872"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-23","discovered_date":"2021-09-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"264717bfdb53cc2dd42ef54e461ade5a9e3817d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FML%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"234ce695463b","org_name":"Fiondella, Milone & LaSaracina LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552091"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FML%20-%20Sample%20Notice.pdf"}],"summary":"Fiondella, Milone & LaSaracina LLP reported that folders containing personal information may have been copied during a cyberattack, but the investigation could not confirm which documents were copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6528d05b5e8d00c23bec4491423aa770e1872c0","impact_type":"both","incident_date":"2021-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/amclaw.com-Notice%20Of%20Cyber%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"1e4bb1329f48","org_name":"Anderson McPharlin & Conners, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548849"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/amclaw.com-Notice%20Of%20Cyber%20Incident.pdf"}],"summary":"Anderson McPharlin & Conners reported that an intrusion encrypted information on its computer systems and an unauthorized party accessed data that could include personal, financial, and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2021-12-22","discovered_date":"2021-10-01","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e312778af06d9b46c2a914221a131c6a37bd6609","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1a87bcdf650b","org_name":"University of Southern California","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-553141"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USC%20-%20Sample%20Notice.pdf"}],"summary":"A professor at the University of Southern California lost an external hard drive containing student academic information and potentially personal information.","supporting_quote":"On October 1, 2021, USC learned that a professor lost a n external hard drive on or about September 28, 2021.","technology_involved":["external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-22","discovered_date":"2021-11-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c1040aab4adf2e509e8bd8b1e751f2f4c3595afc","impact_type":"unknown","incident_date":"2021-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb130c280339","org_name":"Pro Wrestling Tees/Creative Ventures","org_type":"unknown","ransomware":null,"records_affected":31000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pro%20Wrestling%20Tees/Creative%20Ventures-2021-12-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-22","discovered_date":"2021-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08eac45cb8c8b4cca3eead0419b0b02e344e54cc","impact_type":"data_theft","incident_date":"2021-04-01","initial_access":"malware_other","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pro%20Wrestling%20Tees%20-%20All%20States%20Notice%20Letter%20V2_static%20proof.PDF"},"notes":null,"org_country":"US","org_id":"41c3bcec3d15","org_name":"Pro Wrestling Tees","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548787"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pro%20Wrestling%20Tees%20-%20All%20States%20Notice%20Letter%20V2_static%20proof.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5228.pdf"}],"summary":"Pro Wrestling Tees reported that malware was the source of a breach involving customers’ credit card information.","supporting_quote":"We immediately conducted an extensive investigation of our system and concluded that a malware virus was the source of breach.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-12-22","discovered_date":"2021-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfbe9bcd8a0962ee4217f5cffc44c24a9e789712","impact_type":"data_theft","imported_from":null,"incident_date":"2021-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Health%20Net%20-%20TTEC%20Notification%20Letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"4ef8516d0cd7","org_name":"Health Net","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548826"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Health%20Net%20-%20TTEC%20Notification%20Letter.pdf"}],"summary":"Health Net member information was viewed or downloaded from data files stored on TTEC systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"TTEC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"06134e073044","name":"TTEC"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-12-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e440b5af006ddd5a01eb22e3bd26756639c904b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20CM%201YR.pdf"},"notes":null,"org_country":"US","org_id":"ffbbb9b7109b","org_name":"City of Sebastopol","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548804"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20CM%201YR.pdf"}],"summary":"An unauthorized party accessed a City of Sebastopol employee’s email account, which may have contained personal, financial, and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb39570a743fd5a89dc1f46ed69b5d4570b52ced","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Monterey%20Peninsula%20USD-%20Notice%20Letter%20Submitted%20to%20CA%20AG.pdf"},"notes":null,"org_country":"US","org_id":"cd8b87b3d75f","org_name":"Monterey Peninsula Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548782"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Monterey%20Peninsula%20USD-%20Notice%20Letter%20Submitted%20to%20CA%20AG.pdf"}],"summary":"Monterey Peninsula Unified School District reported that some network segments may have been accessed and files containing current and former employee information were present in potentially impacted locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-21","discovered_date":"2021-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da843a7fa7324fa8e0a8df7ebc344224038c5bd0","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20MyTopo%20Security%20Incident%20%28Nov.%2020%202021%29.pdf"},"notes":null,"org_country":"US","org_id":"09cbdcd3bec5","org_name":"BearTooth Mapping, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20MyTopo%20Security%20Incident%20%28Nov.%2020%202021%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BearTooth%20Mapping%2C%20Inc.-2021-12-21"}],"summary":"An attacker may have accessed personal information, including login passwords, maintained in customer profiles on MyTopo.com.","supporting_quote":null,"technology_involved":["MyTopo.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33cecf5c1023ba724ccbfb40d2e47fcac3a701a7","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SG","org_id":"b64292e4cde1","org_name":"Protemps","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Protemps","type":"hibp","url":"https://haveibeenpwned.com/Breach/Protemps"}],"summary":"A data breach at the Singaporean recruitment website Protemps exposed personal information and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"750b90fe90422d20a426a122b4b7393d0d6cd26c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5220.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac14ba5851d5","org_name":"J.C. Penney Corporation, Inc. Pension Plan","org_type":"unknown","ransomware":null,"records_affected":1147,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5220.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-18","discovered_date":"2021-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6481552d72ec03ba08cca4fd12ea5952b2714592","impact_type":"data_theft","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tennis%20Warehouse%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c15ebc9beb71","org_name":"Tennis Warehouse, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552493"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tennis%20Warehouse%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tennis%20Warehouse%20LLC-2021-12-16"}],"summary":"Tennis Warehouse reported that information including names, email addresses, and retail website account passwords was obtained without authorization.","supporting_quote":null,"technology_involved":["retail website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-18","discovered_date":"2021-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"578eae3e8a3e169cfb331524fdfd79ad19e63ce3","impact_type":"data_theft","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tackle%20Warehouse%20-%20Regulatory%20Notification%20Update%20-%20California%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"12a156086ee3","org_name":"Tackle Warehouse, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552492"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tackle%20Warehouse%20-%20Regulatory%20Notification%20Update%20-%20California%20%28CA%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tackle%20Warehouse%20LLC-2021-12-16"}],"summary":"Tackle Warehouse reported that a password associated with a retail website account may have been obtained without authorization.","supporting_quote":null,"technology_involved":["retail website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-18","discovered_date":"2021-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c9766969d552121eeb50486d77a4714bc3c2265","impact_type":"data_theft","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Skate%20Warehouse%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"200d82edd4f8","org_name":"Skate Warehouse, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552491"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548690"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Skate%20Warehouse%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Skate%20Warehouse%20LLC-2021-12-16"}],"summary":"Skate Warehouse reported that personal information, including names, email addresses, and account passwords, was obtained without authorization.","supporting_quote":null,"technology_involved":["retail website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-12-18","discovered_date":"2021-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a0f4cf54ac61ac5a4761c01903fdd6e9679ae85","impact_type":"data_theft","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Running%20Warehouse%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c34e7cdcb0f3","org_name":"Running Warehouse, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552490"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Running%20Warehouse%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Running%20Warehouse%20LLC-2021-12-16"}],"summary":"Running Warehouse learned that information, including names, email addresses, and retail website account passwords, was obtained without authorization on October 1, 2021.","supporting_quote":null,"technology_involved":["retail website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d524cda04067a895f104696148fd6ff8d48b97a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11300.pdf"},"notes":null,"org_country":"US","org_id":"6d2a875bbfab","org_name":"Integrated Services of Kalamazoo","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integrated%20Services%20of%20Kalamazoo-2021-12-17"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11300.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11300.pdf"}],"summary":"Integrated Services of Kalamazoo reported that an unauthorized individual accessed a limited number of employee email accounts, potentially exposing personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-17","discovered_date":"2021-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a59482a7185738bfdce1630f56601bab040b4ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Index%20Fund%20Advisors%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"5f9e1474f830","org_name":"Index Fund Advisors, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548675"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Index%20Fund%20Advisors%20%28CA%29.pdf"}],"summary":"Index Fund Advisors detected possible unauthorized access to its systems on August 5, 2021, and files potentially containing personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-17","discovered_date":"2021-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4a55884ab57cf57881ada391db01a71e0c36a24","impact_type":"exposure_no_theft_confirmed","incident_date":"2007-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HFG%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"306e1ed9eef6","org_name":"Homeowners Financial Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HFG%20-%20Sample%20Notice.pdf"}],"summary":"Homeowners Financial Group detected unusual activity and found that files may have been accessed or acquired; the access method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-17","discovered_date":"2021-08-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab6525f787fe1ab309a1964435cec54f350256af","impact_type":"data_theft","incident_date":"2021-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Heirloom%20Roses%20Ad%2012%20month%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"df1d7fde7f1f","org_name":"Heirloom Roses","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548677"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Heirloom%20Roses%20Ad%2012%20month%20r3prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Heirloom%20Roses-2021-12-17"}],"summary":"Malicious code on the Heirloom Roses website captured customers’ credit card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-16","discovered_date":"2021-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73d088b90b466d53e31be0c3ad0afd1c5bf5664d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ghilotti%20-%20Adult%201%20Year%20CM.pdf"},"notes":null,"org_country":"US","org_id":"2e77e4c5e79d","org_name":"Ghilotti Bros., Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548621"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ghilotti%20-%20Adult%201%20Year%20CM.pdf"}],"summary":"An unauthorized third party temporarily accessed Ghilotti Bros.’ system and files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bde2a909ac6c6008ac564844bff7fa4765c2571d","impact_type":"disruption_or_ransomware","incident_date":"2021-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AG%20Notice%20Sample%20%28CA%29_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"2619b07b460b","org_name":"Sound Generations","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548599"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AG%20Notice%20Sample%20%28CA%29_Redacted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sound%20Generations-2021-12-13"}],"summary":"Sound Generations reported that an unauthorized party accessed its computer systems and encrypted information, with personal information potentially impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-12-15","discovered_date":"2021-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2e21408383c65e2e15c4ccd850dee0fc30f75f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MGRC%20Notif%20Ltr%201%20%28Emp-IC-Dependents%29%204854-6870-7330_v02_draft%204869-2577-6902%20v.1.pdf"},"notes":null,"org_country":"US","org_id":"fe06b2c3714b","org_name":"McGrath RentCorp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548615"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MGRC%20Notif%20Ltr%201%20%28Emp-IC-Dependents%29%204854-6870-7330_v02_draft%204869-2577-6902%20v.1.pdf"}],"summary":"McGrath RentCorp reported unauthorized activity on its systems that may have exposed files containing personal, medical, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-15","discovered_date":"2021-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9384767fc48bff9c47a09b624725f831e34d6f9a","impact_type":"both","incident_date":"2021-11-11","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20SSN%20%28REDACTED%29%20%2810021218x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"c35a9920a4f5","org_name":"Cirrus Asset Management, Inc.","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548588"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20SSN%20%28REDACTED%29%20%2810021218x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5216.pdf"}],"summary":"Cirrus detected a malware infection and said the criminals claimed to have removed data and demanded payment for its return.","supporting_quote":"On November 12, 2021, Cirrus detected that a malware infection began impacting our network.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-14","discovered_date":"2021-04-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b1fc0a7347d2594a118e842e615c700c7ce8a80","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lozano%20Smith%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ca771ca83f2e","org_name":"Lozano Smith","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548523"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lozano%20Smith%20-%20Sample%20Notice.pdf"}],"summary":"Lozano Smith reported that an unauthorized person accessed its systems in January 2020 and that information including names may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-14","discovered_date":"2021-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e335fb023e0ef38ac316cb8f3a0e96e86886fa1","impact_type":"data_theft","incident_date":"2021-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11422.pdf"},"notes":null,"org_country":"US","org_id":"19e8d759b5ba","org_name":"Cities Digital, Inc.","org_type":"professional_services","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11422.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11422.pdf"}],"summary":"Cities Digital reported that an unauthorized actor copied data belonging to its customers, including individuals’ names, addresses and birthdates.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"baa6dfa1423ac1340f4b0b01006a49be2429cdb2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/TTEC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"501815d14e49","org_name":"TTEC Services Corporation","org_type":"unknown","ransomware":null,"records_affected":1726,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/TTEC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-12-13","discovered_date":"2021-10-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc36b643d59242b75ebcb021182c2043cde69f4a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CORRECTED%20EXPERIAN_H1193_Blue%20Shield%20of%20California%20%232_L01_SAS_1%20CORRECTED.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CORRECTED%20EXPERIAN_H1193_Blue%20Shield%20of%20California%20%232_L01_SAS_1%20CORRECTED.pdf"}],"summary":"OneDigital reported a ransomware attack, and Blue Shield of California notified members that their personal and health plan information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"OneDigital"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"6d311a3c98e4","name":"OneDigital"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-10","discovered_date":"2021-11-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1ad21e003667a451950c35a11f61e3ebf4970a7","impact_type":"unknown","incident_date":"2021-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9fa0449f69aa","org_name":"Travelers Indemnity Company","org_type":"unknown","ransomware":null,"records_affected":88858,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Travelers%20Indemnity%20Company-2021-12-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2021-12-10","discovered_date":"2021-11-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bd51adf263b5c43ebf68206fcf76bf744c62676","impact_type":"data_theft","incident_date":"2021-04-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ADP-%20notice%20-%20adult%20-%20revised%20blank%20proof.pdf"},"notes":null,"org_country":"US","org_id":"56644917bc79","org_name":"The Travelers Indemnity Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ADP-%20notice%20-%20adult%20-%20revised%20blank%20proof.pdf"}],"summary":"An unauthorized party used agents’ credentials to access Travelers’ agency portal and obtain information sourced from a third party.","supporting_quote":"We immediately launched an investigation and determined that between April 2021 and November 17, 2021, an unauthorized party used the credentials of a limited number of agents to access the portal to obtain information sourced from a third party.","technology_involved":["agency portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-10","discovered_date":"2021-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc7a7448923c5728a4849f652bbe7598300a76a5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Example%20Letter%20Seneca.pdf"},"notes":null,"org_country":"US","org_id":"d4a0c9919e0f","org_name":"County of Monterey","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Example%20Letter%20Seneca.pdf"}],"summary":"The County of Monterey reported a network disruption and possible access to information that may have included minors’ names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-12-10","discovered_date":"2021-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34c5150fc99315ea9ec7ae167b98fae232c14285","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BioPlus-%20CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"687a1de2aad8","org_name":"BioPlus Specialty Pharmacy Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548450"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BioPlus-%20CA%20Sample.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5207.pdf"}],"summary":"BioPlus Specialty Pharmacy Services identified suspicious activity, and an investigation found that an unauthorized party accessed files containing information about certain patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9e030a43295df5267f15c233efa505b6b4400f1","impact_type":"both","incident_date":"2021-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5275.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"43b09e6dfc1c","org_name":"Title Guaranty Company of Lewis County","org_type":"financial","ransomware":true,"records_affected":1109,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5275.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5275.pdf"}],"summary":"Title Guaranty Company of Lewis County reported a ransomware attack in which attackers likely accessed and obtained records containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-09","discovered_date":"2021-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e61deb5932d18317260990c4bbb2a3467c2aaa02","impact_type":"both","incident_date":"2021-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mor%20Furniture%20Letter%20Version%202.pdf"},"notes":null,"org_country":"US","org_id":"695f312c96c2","org_name":"Mor Furniture for Less, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548392"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mor%20Furniture%20Letter%20Version%202.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mor%20Furniture%20for%20Less%2C%20Inc.-2021-12-09"}],"summary":"An unknown third party accessed Mor Furniture for Less, Inc.’s network and acquired files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-09","discovered_date":"2021-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de324fd2adb63ce5d937b1685899dbf41dba63b","impact_type":"data_theft","incident_date":"2021-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job39309d07_EastBayParatransit_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"99f6dbbdc7f4","org_name":"East Bay Paratransit","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548390"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job39309d07_EastBayParatransit_L01_SAS_1.pdf"}],"summary":"East Bay Paratransit reported unauthorized access to certain systems, during which files containing personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-09","discovered_date":"2021-10-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b4d22584b3feba40f697ae85a4fdf9602a3f3a3","impact_type":"unknown","incident_date":"2021-05-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e41dd01a1924","org_name":"DNA Diagnostics Center (DDC)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DNA%20Diagnostics%20Center%20%28DDC%29-2021-12-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-09","discovered_date":"2021-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4aa48c5e2305c89ada3d70d8803f531b9de4a536","impact_type":"data_theft","incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Allergy-%20CA%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"b4798ce85b88","org_name":"Allergy Partners, PLLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548401"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Allergy-%20CA%20Sample.pdf"}],"summary":"An unauthorized person accessed Allergy Partners’ network, deployed malware, and acquired copies of documents containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c06c45fbeaea0a0f549db5c8031c9faa33ae37c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_4.pdf"},"notes":null,"org_country":"US","org_id":"7e3885f1ae0b","org_name":"Green, Polack & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_4.pdf"}],"summary":"Green, Polack & Company reported that malware was downloaded to a computer containing personal information, which may have been exposed to an unauthorized intruder.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eb6f5612a10d553547565cb50863264df19b7b7f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11298.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3fb312af7767","org_name":"Payday America, Inc.","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11298.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/PaydayAmerica.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11298.pdf"}],"summary":"An unauthorized third party accessed data that included contact information, driver's license numbers, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5937de76a9ba0c706b1c9b349848f399ed860651","impact_type":"unknown","incident_date":"2021-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"30bf86944f7a","org_name":"Oregon Anesthesiology Group, P.C.","org_type":"unknown","ransomware":null,"records_affected":750500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Anesthesiology%20Group%2C%20P.C.-2021-12-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-12-06","discovered_date":"2021-08-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e04b068a9c8661b292cc952de9b3db4b7a203bc","impact_type":"disruption_or_ransomware","incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alvarez%20member%20notification_Nov2021-Reviewed%20-%20381152.pdf"},"notes":null,"org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alvarez%20member%20notification_Nov2021-Reviewed%20-%20381152.pdf"}],"summary":"Team Alvarez reported that ransomware encrypted several servers and personal information on insurance enrollment forms may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56bf6c14f79f88288590c0a7a33eb87d1ac8ca88","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"01a9f23a2014","org_name":"Gravatar","org_type":"technology_saas","ransomware":null,"records_affected":167000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gravatar","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gravatar"}],"summary":"Data scraped from Gravatar included names, usernames, and MD5 hashes of email addresses, some of which were cracked and distributed.","supporting_quote":null,"technology_involved":["Gravatar"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-03","discovered_date":"2021-10-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2bd21e5d33132be547fddccdc0a3cdcbdde6cdd","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A%20%28CA%20AG%29.pdf"},"notes":null,"org_country":"US","org_id":"73c60a75aa3e","org_name":"Nippon Life Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548222"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A%20%28CA%20AG%29.pdf"}],"summary":"An unauthorized party accessed an employee email account for a brief period on October 5, 2021, and the account may have contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-12-03","discovered_date":"2021-05-23","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a775b89d6875a69ddc5f8127ec8a73d6fb43422","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Keolis%20North%20America%20Ad%20CM%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"39ade902aa27","org_name":"Keolis Transit America","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Keolis%20North%20America%20Ad%20CM%20CA%20r2prf.pdf"}],"summary":"Two individuals found a Keolis-labeled thumb drive and viewed files containing employee personal information.","supporting_quote":"On approximately May 23, 2021, two individuals not connected to Keolis found a “Keolis” labeled thumb-drive in a laundromat.","technology_involved":["thumb drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-03","discovered_date":"2021-06-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b842f77efcb6e9850bba72226105a0b54f213895","impact_type":"both","incident_date":"2021-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Council%20For%20International%20Studies%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6b9d5ce7b26d","org_name":"American Council for International Studies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548177"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Council%20For%20International%20Studies%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Council%20for%20International%20Studies-2021-12-03"}],"summary":"An unknown actor accessed and downloaded information from certain systems, while malware encrypted some systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-12-02","discovered_date":"2021-10-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"61736cfeec84ab949444e6a4b8684d2d3b73fae8","impact_type":"unknown","incident_date":"2021-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e19cf08a7b46","org_name":"Department of Administrative Services","org_type":"unknown","ransomware":null,"records_affected":40098,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Department%20of%20Administrative%20Services-2021-12-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cef1612ae51c3f1e7a700c6c2a4ee17f0c3784b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BN%20211028003%20v7%20CDT%20Approved%20by%20CDT.11.18.21%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548141"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BN%20211028003%20v7%20CDT%20Approved%20by%20CDT.11.18.21%20FINAL.pdf"}],"summary":"California Correctional Health Care Services inadvertently emailed personal information to labor organizations outside the recipient's bargaining unit.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-01","discovered_date":"2021-11-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e147b3e8be4737a6c6b129206ab9f8c9a18c103","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA4193.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"85211ec41c63","org_name":"HealthCare, Inc.","org_type":"unknown","ransomware":null,"records_affected":625,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA4193.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA4193.pdf"}],"summary":"HealthCare, Inc. reported that a vendor’s systems were accessed by attackers and that personal information was affected.","supporting_quote":"One of HealthCare, Inc.’s vendors was recently the victim of a criminal cyber attack, involving HealthCare, Inc. data.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"795c6435da047f8e64cc9225e2aeccab3044fceb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6302210-02db-11ed-8b5b-6134b3849169"},"incident_date":"2021-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f15f7ac25322","org_name":"Battelle for Kids","org_type":"professional_services","ransomware":true,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://chicago.suntimes.com/education/2022/5/20/23132983/cps-public-schools-data-breach-students-employees-records-battelle-kids"}],"summary":"Battelle for Kids were impacted by ransomware which in resulted impacted many of their clients who were local school in IL","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-30","discovered_date":"2021-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bca4b22fe37b9df4a97c4e898df0e46ada05d51","impact_type":"data_theft","incident_date":"2021-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_H1202_Planned%20Parenthood%20of%20Los%20Angeles_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"cb2a21d9bab1","org_name":"Planned Parenthood Los Angeles","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548069"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_H1202_Planned%20Parenthood%20of%20Los%20Angeles_L01_SAS_1.pdf"}],"summary":"Planned Parenthood Los Angeles reported that an unauthorized person accessed its network and exfiltrated files containing personal and clinical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"21a3bf42d06bca5b611c6bd5345bf21d59976b1d","impact_type":"data_theft","incident_date":"2021-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3189.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ef43c8845a46","org_name":"Cedar Grove Composting, Inc.","org_type":"other","ransomware":null,"records_affected":1596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3189.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3189.pdf"}],"summary":"Cedar Grove Composting reported unauthorized access to files that may have been downloaded, and personal information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-30","discovered_date":"2020-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d02d9b370572f918a39f87c0ce0e85321b54f31d","impact_type":"both","incident_date":"2020-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bansley-%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"fec57ba5dc02","org_name":"Bansley and Kiener, L.L.P.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bansley-%20Sample.pdf"}],"summary":"Bansley and Kiener, L.L.P. reported that an incident encrypted certain systems and that information including names and Social Security numbers was later confirmed as accessed and exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-11-29","discovered_date":"2021-08-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73d4c25974311422e3c36356feef80bf220c83ed","impact_type":"data_theft","incident_date":"2021-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Security%20Incident%20Information%20Center%20-%20DDC.pdf"},"notes":null,"org_country":"US","org_id":"80ee680bd6b1","org_name":"DNA Diagnostics Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548031"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Security%20Incident%20Information%20Center%20-%20DDC.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3188.pdf"}],"summary":"DNA Diagnostics Center reported unauthorized access to an archived database and potential removal of files and folders containing personal information.","supporting_quote":null,"technology_involved":["archived database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-24","discovered_date":"2021-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"06714906b5c9513259d246f70f64f460fc258665","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13355.pdf"},"notes":null,"org_country":"US","org_id":"87b82605cc68","org_name":"Lincare Holdings Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lincare%20Holdings%20Inc.-2023-01-03"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lincare%20Holdings%20Inc.-2022-06-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13355.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lincare%20Holdings%20Inc.-2022-04-11"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-561235"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554083"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547919"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notices.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13355.pdf"}],"summary":"Lincare reported unauthorized access to certain systems, with individuals’ information including names involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2021-11-24","discovered_date":"2019-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c50d7cfaad7bbf0ab656a11c815431e1e20bfa5c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11280.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0c40c6d941d2","org_name":"Huntington Hospital","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":"A hospital employee improperly accessed electronic medical records without role-based authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11280.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11280.pdf"}],"summary":"A former Huntington Hospital employee improperly accessed patients’ electronic medical records without role-based authorization.","supporting_quote":"On February 25, 2019, we determined that an employee at Huntington Hospital improperly accessed certain electronic medical records without role-based authorization between October 2018 and February 2019.","technology_involved":["electronic medical record systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e3492314cef8bb07e21dc9a6e51c47f1cb58a30","impact_type":"unknown","incident_date":"2021-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20HITECH%20DTN%201020172.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb9c47480263","org_name":"Anthem Blue Cross","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547906"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"462cf233f7f60c91dae63f6452f95dda1bb38d5d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Sample%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"d05a57b97186","org_name":"ON24, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547902"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Sample%20Letter_2.pdf"}],"summary":"ON24 reported a June 2021 security incident affecting internal systems and data that included personal information of some current and former employees and their beneficiaries.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f9d16426b193c8c2604062b5e24fae38a6bc0d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"77f46e78e197","org_name":"Local 2/Hospitality Industry Child and Elder Care Plan","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547877"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter_1.pdf"}],"summary":"An intruder broke into the UNITE HERE Local 2 building and accessed an area containing Child and Elder Care Plan participant files, which may have included personal information.","supporting_quote":"The week of November 1st, the UNITE HERE Local 2 building was broken into and the intruder gained access into a locked area containing Child and Elder Care Plan participant files.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2021-11-23","discovered_date":"2021-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"8c9f799177d79724d0714b35cb3e5f6e1473892a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11279.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1fe7e487d0d9","org_name":"GoDaddy.com, LLC","org_type":"technology_saas","ransomware":null,"records_affected":9581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GoDaddy.com%2C%20LLC-2021-11-23"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11279.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547856"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GoDaddy%20Template%20Customer%20Email.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11279.pdf"}],"summary":"An unauthorized third party accessed authentication information associated with customers’ GoDaddy Managed WordPress hosting accounts.","supporting_quote":null,"technology_involved":["GoDaddy Managed WordPress hosting","WordPress","sFTP","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c0f9ac09c6e03a7ca4f4e6e75948967c6ac3b33","impact_type":"unknown","incident_date":"2021-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/One%20Community%20Health%20-%20Notice%20Letter%20-%20SSN%20Patient%20%28Redacted%29%20%289972368x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ccf100da13b2","org_name":"One Community Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547830"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#One%20Community%20Health-2021-11-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2021-11-22","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e45ea172665b7f8c53bef0f0a3d23bbc620b2477","impact_type":"data_theft","incident_date":"2021-10-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11238.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"60eb5b5cd6b7","org_name":"Boeing Employees Credit Union","org_type":"financial","ransomware":null,"records_affected":657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11238.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11238.pdf"}],"summary":"Boeing Employees Credit Union reported that skimming devices were installed on four ATMs and may have captured customers’ card information and PINs.","supporting_quote":"Based on our continued investigation, we believe that a skimming device was unlawfully installed on four ATMS in Washington state.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-22","discovered_date":"2021-02-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4574f5395f1f38c6fe554d60e924d99e422f6f0d","impact_type":"data_theft","incident_date":"2021-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Astoria%20Notice%20Letter%20%28General%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"060af12d0a1d","org_name":"Astoria Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Astoria%20Notice%20Letter%20%28General%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Astoria%20Company%20LLC-2021-11-22"}],"summary":"Astoria Company reported that two individuals gained unauthorized access to a system containing personal information and obtained a portion of the data.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-19","discovered_date":"2021-09-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1185dd0b5f9d2e6ea6f7068330b9b3947401c91","impact_type":"both","incident_date":"2021-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PAWN%20CM%2012.pdf"},"notes":null,"org_country":"US","org_id":"d2452fdbd70d","org_name":"Pawn America Minnesota, LLC","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PAWN%20CM%2012.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pawn%20America%20Minnesota%2C%20LLC-2021-11-22"}],"summary":"Pawn America Minnesota, LLC reported a ransomware attack that encrypted some computer systems and a cybercriminal’s claim to retain copies of data including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"432ac21723616fb9a447df49212a0cbe587af493","impact_type":"both","incident_date":"2021-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PAL%20COMBINED.pdf"},"notes":null,"org_country":"US","org_id":"64a0e44ae9a9","org_name":"PAL Card Minnesota, LLC","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547799"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PAL%20COMBINED.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PAL%20Card%20Minnesota%2C%20LLC-2021-11-22"}],"summary":"PAL Card Minnesota reported a ransomware attack that encrypted computer systems, and said the attacker retained copies of data including contact information and identification numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-19","discovered_date":"2021-06-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63a0b743e92615a4e1af9ee4b779dae0df80238b","impact_type":"data_theft","incident_date":"2021-06-29","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20and%20Attachment.pdf"},"notes":null,"org_country":"US","org_id":"12ee7fbc1a28","org_name":"ACE Surgical Supply Co., Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547800"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20and%20Attachment.pdf"}],"summary":"ACE Surgical Supply Co., Inc. reported that files containing names, contact information, and DEA and physician state license numbers were accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-18","discovered_date":"2021-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef7bbc2bb8bb466f05516c953d52a7efe80b2f27","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-08-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UIA%20-%20Notice%20Letter%20-%20Patients%20-%20General%20-%20IDX%20v2.pdf"},"notes":null,"org_country":"US","org_id":"426a18b583f3","org_name":"Utah Imaging Associates, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547748"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UIA%20-%20Notice%20Letter%20-%20Patients%20-%20General%20-%20IDX%20v2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Utah%20Imaging%20Associates%2C%20Inc.-2021-11-18"}],"summary":"Utah Imaging Associates detected a security incident, and an investigation found that files containing sensitive patient information may have been available to an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f11b6fc0e59167f442acb048e0cd5e4442d4ed65","impact_type":"unknown","incident_date":"2021-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Next%20Peak%20-%20SSN%20Notice%20%5Bredacted%5D%20%289953355x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6b413ac6a73","org_name":"Next Peak CPA, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547711"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-17","discovered_date":"2021-06-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"7992ce89ad32648f2d4ecaa2d9272eb88a421330","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SCLegalServices.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f1b5130dfbd","org_name":"South Carolina Legal Services","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SCLegalServices.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SCLegalServices.pdf"}],"summary":"South Carolina Legal Services discovered that its systems were encrypted and that names, Social Security numbers, and driver’s license numbers may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49cd450ff16f13fe01bdc3171157e25aa54be943","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"56eb137db397","org_name":"San Francisco Symphony","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter.pdf"}],"summary":"An unknown person accessed a San Francisco Symphony company email account, potentially exposing employees’ personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-17","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"438fb7539cdab38829878fbc27b516c4ac1bb596","impact_type":"data_theft","incident_date":"2021-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PUC%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"65ba3bdb2a44","org_name":"PUC National","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547680"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PUC%20-%20Sample%20Notice.pdf"}],"summary":"PUC National reported that an unauthorized actor downloaded information from some PUC email accounts.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2021-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bce2414381ac001e3b3843f149786e4304373188","impact_type":"unknown","incident_date":"2021-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"4ab984a673bd","org_name":"IDC Games","org_type":"unknown","ransomware":null,"records_affected":3966871,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: IDC Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/IDCGames"}],"summary":"In March 2021, 4 million records sourced from IDC Games were shared on a public hacking forum . The data included usernames, email addresses and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-11-16","discovered_date":"2021-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6771ef4be293841b419dc41d42b7d6900a2930ca","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Traffic%20Solutions%20Adult%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"5f674cc6d863","org_name":"Traffic Solutions Corporation","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Traffic%20Solutions%20Adult%20r2prf.pdf"}],"summary":"Statewide Safety Systems discovered a ransomware attack that resulted in cyber criminals acquiring files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e9f2dff9f0c93456a106cd1b912a62e67e214a1","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_H0833_Quest%20Diagnostics_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"2f8fecd6c390","org_name":"Quest Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee inadvertently emailed internal distribution lists a spreadsheet containing personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547623"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_H0833_Quest%20Diagnostics_L01_SAS_1.pdf"}],"summary":"An employee inadvertently emailed internal distribution lists a spreadsheet containing personal information of current and former Quest Diagnostics employees.","supporting_quote":"On October 29, 2021, an employee inadvertently sent an email to certain internal distribution lists which attached a spreadsheet that included personal information of a group of current and former Quest Diagnostics employees.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62b37a314913ece7bd1f519763038fd170d9138c","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"b535e4917aff","org_name":"Ducks Unlimited","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ducks Unlimited","type":"hibp","url":"https://haveibeenpwned.com/Breach/DucksUnlimited"}],"summary":"A database sourced from Ducks Unlimited containing personal information and unsalted MD5 password hashes was reported traded online.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-11-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdd02c81ed622c492e9b67734e9f41bf762dd0a2","impact_type":"data_theft","incident_date":"2020-09-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter%20to%20Customers.pdf"},"notes":null,"org_country":"US","org_id":"b1d0f2703c37","org_name":"Diode Dynamics, L.L.C.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the e-commerce platform used to process credit card transactions was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547621"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter%20to%20Customers.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Diode%20Dynamics%2C%20L.L.C.-2021-11-16"}],"summary":"Diode Dynamics reported that malicious code exploiting a vulnerability in its e-commerce platform accessed and transmitted customer information to bad actors.","supporting_quote":"On or about September 26, 2020, bad actors injected a piece of malicious code into Diode Dynamics’ databases , exploiting a vulnerability in the e-commerce platform used by Diode Dynamics to process credit card transactions .","technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"496e4d94c35e2be1b16047eb837602916210c91a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Letter_Formatted.pdf"},"notes":null,"org_country":"US","org_id":"e49b2516e415","org_name":"Alcon Vision, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Letter_Formatted.pdf"}],"summary":"A technical error caused an email to health care providers to include limited information about a broader set of Alcon intraocular lens patients.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-11-15","discovered_date":"2021-10-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6da788f535b96f2c37de6331453932d9b97dcaa4","impact_type":"disruption_or_ransomware","incident_date":"2021-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OCA_Employee%20HR%20Notice%20Letter_Nov%202021_Final%20.pdf"},"notes":"attack_techniques without supporting words dropped: T1485","org_country":"US","org_id":"867162ba35ec","org_name":"Olympus Corporation of the Americas","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547550"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OCA_Employee%20HR%20Notice%20Letter_Nov%202021_Final%20.pdf"}],"summary":"An unauthorized third party accessed Olympus Corporation of the Americas systems and corrupted files containing confidential company and employee information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-15","discovered_date":"2021-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eba7ec5058eaed6b5729a06df45067f95f92b3c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Pizza%20Kitchen%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"377880aad8c1","org_name":"California Pizza Kitchen","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Pizza%20Kitchen%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#California%20Pizza%20Kitchen-2021-11-15"}],"summary":"California Pizza Kitchen reported that files containing employee information, including names and Social Security numbers, may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c87bb4374dfeaa98b3e808d15141ca9d643388e","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SLO%20County%20YMCA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6e0f5e9d59a7","org_name":"San Luis Obispo County YMCA","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SLO%20County%20YMCA%20-%20Sample%20Notice.pdf"}],"summary":"An unauthorized actor accessed portions of the San Luis Obispo County YMCA’s network, and the organization could not rule out access to data, but reported no indication that information was copied or transferred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2021-11-11","discovered_date":"2021-06-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a440f8e1a1af77bb6dd94b0b17119f97529f619","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3168.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4bb6f021dac0","org_name":"Opportunity Council","org_type":"unknown","ransomware":null,"records_affected":664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3168.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3168.pdf"}],"summary":"An unauthorized person accessed certain employee email accounts, and the organization could not determine which emails or attachments were viewed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-11-10","discovered_date":"2021-09-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d56ee7d796d62dca9bc28abaf92dea1c9fd6e68d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A-%20CALIFORNIA%20Regulator%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b61854a93eb2","org_name":"The Urology Center of Colorado","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547437"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A-%20CALIFORNIA%20Regulator%20Notice.pdf"}],"summary":"An unauthorized individual may have accessed parts of The Urology Center of Colorado’s network between September 7 and September 8, 2021, exposing information that varied by individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-11-10","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1ee28c7651e7486390f320e1931b9c2db347337a","impact_type":"disruption_or_ransomware","incident_date":"2020-12-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3165.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c3733c67a6be","org_name":"Christensen O’Connor Johnson Kindness PLLC","org_type":"professional_services","ransomware":null,"records_affected":815,"reviewed":false,"root_cause":"A vulnerability involving the firm's VPN service provider enabled an unauthorized individual to access COJK servers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3165.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3165.pdf"}],"summary":"Christensen O’Connor Johnson Kindness PLLC reported that a vulnerability involving its VPN service provider allowed unauthorized access to some servers, which were encrypted by malware.","supporting_quote":"The firm found that an unauthorized individual was able to access some COJK servers and may have been able to view COJK data using a vulnerability against our VPN service provider.","technology_involved":["VPN service"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3b665697f9a4fc6087d373fbbedacebda3b3a55","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-15","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cal%20AG%20notification.pdf"},"notes":null,"org_country":"US","org_id":"fd6c2af821e1","org_name":"Valley Mountain Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547380"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cal%20AG%20notification.pdf"}],"summary":"Valley Mountain Regional Center reported that a phishing email was received and fourteen email boxes were compromised, potentially exposing personal and medical information.","supporting_quote":"On Wednesday, September 15, 2021, VMRC detected a malicious phishing e-mail received by several individuals.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"404ff78226755daf185a628958bd85c167483f88","impact_type":"disruption_or_ransomware","incident_date":"2021-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VRMG%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1ce48c7e27a7","org_name":"Retinal Consultants Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547374"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VRMG%20Sample%20Notice.pdf"}],"summary":"Retinal Consultants Medical Group reported a July 2021 cyberattack that disrupted service and may have made files containing personal information accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-09","discovered_date":"2021-09-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ecc192e53788c6aa8a7901b1c237906470488a40","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MoweryClinic.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d08ecb698be5","org_name":"Mowery Clinic","org_type":"healthcare","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MoweryClinic.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MoweryClinic.pdf"}],"summary":"Mowery Clinic reported that an unauthorized individual accessed or acquired documents containing patient information and deployed malware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"485768d978d203d6c826d6dd2e35fd0e962d6d9a","impact_type":"unknown","incident_date":"2021-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lab%20Logistics%20LLC%20-%20L01%20%5Bredacted%5D%20%289946513x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed49b2e6d80a","org_name":"Lab Logistics","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547358"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-11-09","discovered_date":"2020-08-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a9502f86c0d7e97948335fb44f0308610630360","impact_type":"both","incident_date":"2020-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3160.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cd816ab7607c","org_name":"Hoffman Construction Company","org_type":"other","ransomware":null,"records_affected":3078,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3160.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3160.pdf"}],"summary":"Hoffman Construction Company reported that an unauthorized person accessed its network, removed files, and encrypted certain systems; some personal information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2021-11-09","discovered_date":"2021-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad02d493d25ac9eae5d8465405b1570e76633784","impact_type":"data_theft","incident_date":"2021-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cambro%20-%20Sample%20notice.pdf"},"notes":null,"org_country":"US","org_id":"b96c0b5e2195","org_name":"Cambro Manufacturing","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cambro%20-%20Sample%20notice.pdf"}],"summary":"Cambro Manufacturing reported that an unauthorized actor accessed internal systems and acquired company data around August 11, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82371e98792957bb46410f502b31d27d94dfd30e","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"b18e03015bb6","org_name":"ActMobile","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An exposed database containing the data was attributed to ActMobile.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ActMobile","type":"hibp","url":"https://haveibeenpwned.com/Breach/ActMobile"}],"summary":"HIBP reported that an exposed database attributed to ActMobile contained email addresses, IP addresses, and password hashes that were later leaked.","supporting_quote":"In October 2021, security researcher Bob Diachenko discovered an exposed database he attributed to ActMobile, the operators of Dash VPN and FreeVPN .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-08","discovered_date":"2021-10-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2d46b5c2accdfe9ae449e1b4940c3a8b0acb4d8a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3159.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"50d2152c8908","org_name":"Insureon Holdings, LLC","org_type":"financial","ransomware":null,"records_affected":671,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3159.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3159.pdf"}],"summary":"Insureon Holdings identified unauthorized access to its systems, where personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-05","discovered_date":"2021-10-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd1968f92774169bd06b64618aa4dab0e15d54b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UMGC%20Notice%20of%20Data%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"f8d8f6408312","org_name":"University of Maryland Global Campus","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UMGC%20Notice%20of%20Data%20Incident.pdf"}],"summary":"University of Maryland Global Campus reported that a malware incident targeted a server and that personally identifiable information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-05","discovered_date":"2021-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c410c48254d598f5edf09544faf56b70842a4622","impact_type":"data_theft","incident_date":"2021-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SBA%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"7c9959cd6fa4","org_name":"Strategic Benefits Advisors, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547258"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SBA%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/StrategicBenefitsAdvisors.pdf"}],"summary":"Strategic Benefits Advisors, Inc. reported that a criminal cyberattack resulted in a limited number of files being accessed or acquired, including files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-05","discovered_date":"2021-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1bae5bf897b7e333de1d6f4a16d297e14c98972","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sea%20Mar%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2710683a6286","org_name":"Sea Mar Community Health Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-552278"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sea%20Mar%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sea%20Mar%20Community%20Health%20Centers-2021-11-01"}],"summary":"Sea Mar reported that data, potentially including personal and protected health information, may have been copied from its digital environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-05","discovered_date":"2021-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"592dcb2fdfffa9648b97479fb1a12ac5d3db6e2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LodiUSD-%20Exhibit%20A%20and%20B%20w%20cover%20pages.pdf"},"notes":null,"org_country":"US","org_id":"e495538ee4a7","org_name":"Lodi Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550370"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547269"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LodiUSD-%20Exhibit%20A%20and%20B%20w%20cover%20pages.pdf"}],"summary":"Lodi Unified School District reported that segments of its network were accessed and files potentially contained employee names, Social Security numbers, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-11-04","discovered_date":"2020-12-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"201e6055c0a0a869a48ad1862bb41f6c25579bc8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Maxim%20Healthcare%20Group%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4e0f259c7606","org_name":"Maxim Healthcare Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547204"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Maxim%20Healthcare%20Group%20Sample%20Letter.pdf"}],"summary":"Maxim Healthcare reported unauthorized access to several employees’ email accounts, but could not determine which messages or attachments may have been accessed or viewed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Black Shadow","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","credentials"],"disclosed_date":"2021-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb10064f29b688099f2f280f76886f276fa351ba","impact_type":"both","incident_date":"2021-10-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IL","org_id":"d1618091f00a","org_name":"CyberServe","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CyberServe","type":"hibp","url":"https://haveibeenpwned.com/Breach/CyberServe"}],"summary":"CyberServe was breached and ransomed, and customer data including personal, medical, and credential information was leaked publicly.","supporting_quote":null,"technology_involved":["CyberServe"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"blackshadow"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"c7fd68c39eb324948467b0e428d42a6ca9d3682c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ColumbiaCollege.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"abeb770042fe","org_name":"Columbia College of South Carolina","org_type":"education","ransomware":null,"records_affected":4189,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ColumbiaCollege.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ColumbiaCollege.pdf"}],"summary":"An unauthorized party accessed a Columbia College employee email account on March 15, 2021, which contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-11-02","discovered_date":"2021-08-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"118e3f1a886b075bbe6616503f26cb5c37086e4e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SumterCounty.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"aa94656939e9","org_name":"Sumter County","org_type":"government","ransomware":null,"records_affected":2241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SumterCounty.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SumterCounty.pdf"}],"summary":"Sumter County reported that a cybercriminal accessed and acquired the contents of an employee email account, which may have contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-11-02","discovered_date":"2020-12-21","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b71c20557bc6d5cd2eeb5ed2d6e25231a5afb4f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Garrett%20Mosier%20-letter-CM_Proof.pdf"},"notes":null,"org_country":"US","org_id":"cffafb14e63e","org_name":"GMGS Risk Management & Insurance Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Garrett%20Mosier%20-letter-CM_Proof.pdf"}],"summary":"GMGS reported that an unknown individual accessed an employee’s email account, and personal and medical information may have been viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e23c899c1a510cdd381918d8a0cd85d5a9d826a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GWB%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b1b2f4649b91","org_name":"Goldwater Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547024"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GWB%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3156.pdf"}],"summary":"Goldwater Bank reported unauthorized access to files containing customer contact and account information during an apparent attempted ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-10-29","discovered_date":"2021-09-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d8d0ec58ffaecbd27626a9ec0199cf9331b3869","impact_type":"both","incident_date":"2021-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AGI%20Publishing%20Inc%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"7717bb05ebda","org_name":"AGI Publishing, Inc.","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547020"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547329"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AGI%20Publishing%20Inc%20Sample%20Letter.pdf"}],"summary":"AGI Publishing reported a ransomware attack that disrupted its systems and may have involved personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"642c76a579c1307405af47bfd92edace0abd4347","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3153.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c5930e9622e2","org_name":"Terrier Media Buyer, Inc.","org_type":"professional_services","ransomware":null,"records_affected":693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3153.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3153.pdf"}],"summary":"An unauthorized third party accessed a server containing limited human-resources personal information and attempted to remove a copy, but the organization reported no evidence that the information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7be3a7e24f8370872931c3c01854d1668f8b9726","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gorilla%20Circuits-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"145d78a5a8c5","org_name":"Gorilla Circuits","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gorilla%20Circuits-%20Sample%20Letter.pdf"}],"summary":"Gorilla Circuits reported unauthorized access to some computer systems, and files containing names and Social Security numbers may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a97ca815f8cd7e73a483ee71c44086e917abc5d3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter_4.pdf"},"notes":null,"org_country":"US","org_id":"76afe02f8d36","org_name":"BPM LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547007"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_4.pdf"}],"summary":"BPM LLP reported suspicious activity on Gumbiner Savett’s legacy network that may have allowed an unauthorized individual to view personal and tax-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-27","discovered_date":"2021-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24625e92ede3e2bdc1440c3eb4bde00dde502109","impact_type":"data_theft","incident_date":"2021-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRMI%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"dbe7e157aeaa","org_name":"Primary Residential Mortgage, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRMI%20Sample.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11237.pdf"}],"summary":"Primary Residential Mortgage, Inc. reported unauthorized access to some of its systems and data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-10-27","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f73ecd12ce7b015a3d880e5664db579f38c8e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CalOptima%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9e29b2189881","org_name":"CalOptima","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"CalOptima failed to match some members’ names with the correct addresses in a mass mailing.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546955"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CalOptima%20Sample%20Notice.pdf"}],"summary":"CalOptima mailed COVID-19 vaccine reward letters and gift cards to some incorrect addresses after mismatching member names and addresses.","supporting_quote":"In CalOptima’s mass mailing of the COVID-19 Vaccine Health Reward Approval letter, we failed to match up the correct member address with the name of the member for some of the letters.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-10-27","discovered_date":"2021-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4aa18086444a89f1daad2e046d9337ae14228a9","impact_type":"disruption_or_ransomware","incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job38969d28_BlueShield_L01_SAS_2_1.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546938"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job38969d28_BlueShield_L01_SAS_2_1.pdf"}],"summary":"Blue Shield of California notified members that a ransomware attack on broker Team Alvarez systems may have exposed access to their enrollment forms.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Team Alvarez"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"f677b55ca621","name":"Team Alvarez"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-27","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45a2b1c394045f37ce61838a59349ada1548f6f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-08","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/sample%20letter%20doc.pdf"},"notes":null,"org_country":"US","org_id":"7b2d099df227","org_name":"Amin Dean, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email containing malware gave unauthorized individuals access to an office computer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546953"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/sample%20letter%20doc.pdf"}],"summary":"Amin Dean, CPA reported that an email containing malware gave unauthorized individuals access to an office computer, where personal information may have been exposed.","supporting_quote":"The email contained malware, which gave access to unknown individual(s) to my office computer.","technology_involved":["email","office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-26","discovered_date":"2021-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c41a61bc4a0012feb8aed636311d29140ba55038","impact_type":"unknown","incident_date":"2021-08-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHAA%20Adult%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6919fc466a6d","org_name":"Seneca Family of Agencies","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550213"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546886"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547276"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547814"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548287"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHAA%20Adult%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11281.pdf"}],"summary":"Seneca reported that information stored on its network was accessed between August 25 and August 27, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-10-26","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60524ad1cf97963c7d9497e91dc6cc1495fbb105","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Notification_Individual_20211019.pdf"},"notes":null,"org_country":"US","org_id":"b95d4a0162c3","org_name":"Foundation for Medical Care of Merced County","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546855"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Notification_Individual_20211019.pdf"}],"summary":"A physical break-in at the Foundation’s facility resulted in the theft of an external backup drive that may have contained information from medical and dental claims.","supporting_quote":"The unknown intruder entered the facility by punching a hole in the internal wall from an adjacent office suite.","technology_involved":["external backup drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-26","discovered_date":"2021-08-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e3df7cc014e0e8c6891e95783c7bd9ce679c5f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EBA%26M%20-%20Sample%20Notice.PDF"},"notes":null,"org_country":"US","org_id":"6a6151c83684","org_name":"Employee Benefits Administration & Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee inadvertently uploaded a data file to a publicly accessible website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546898"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EBA%26M%20-%20Sample%20Notice.PDF"}],"summary":"EBA&M reported that an employee inadvertently uploaded a file containing personal information to a publicly accessible website.","supporting_quote":"We determined that the file was publicly accessible from June 4, 2021, until August 16, 2021.","technology_involved":["public website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a2950a5d5d570cfbea27c95602926b53f77af89","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-10-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Community%20Medical%20Centers%20Ad%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"1e4de14c6265","org_name":"Community Medical Centers, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546879"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Community%20Medical%20Centers%20Ad%20r2prf.pdf"}],"summary":"Community Medical Centers reported evidence that an unauthorized third party accessed its network and that personal and medical information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2043a5a0918ecd36336dc7b1daa25c365f40115f","impact_type":"unknown","incident_date":"2021-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/1019255%20CA%20PRV%20HITECH%20Breach%20Notif%20%28003%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"97f0a83cb69f","org_name":"Blue Cross of California","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546858"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cf99ea4ca1f6e64a4b0bbd70c9cff03b9d5de98","impact_type":"unknown","incident_date":"2021-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sheridan%20Production%20Company%20-%20L01%20%5Bredacted%5D%20%289905195x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e1e22514aa9e","org_name":"Sheridan Production Company III, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546854"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sheridan%20Production%20Company%20III%20LLC-2021-11-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edb47871b6112214bca19ee4d33dfff8cf050c3e","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f1116e4ff58a","org_name":"CoinMarketCap","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CoinMarketCap","type":"hibp","url":"https://haveibeenpwned.com/Breach/CoinMarketCap"}],"summary":"Email addresses associated with CoinMarketCap accounts were found being traded on hacking forums, but how they were obtained is unclear.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1199"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-21","discovered_date":"2021-03-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c207fe7c3adcbf51d0f8554a783bef517f33b75","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Scuf%20Gaming%20International%2C%20LLC%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"51923a49fe58","org_name":"SCUF Gaming International, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Scuf%20Gaming%20International%2C%20LLC%20-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SCUF%20Gaming%20International%2C%20LLC-2021-10-21"}],"summary":"SCUF Gaming said third-party vendor login credentials were used to insert a script into its webstore, which may have exposed payment and personal information.","supporting_quote":"On February 3, 2021, login credentials for a third-party vendor were used to insert an unauthorized script onto the backend system of SCUF Gaming’s webstore.","technology_involved":["webstore"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91e02b1d4212ad594561c45497f56517a6f227d0","impact_type":"disruption_or_ransomware","incident_date":"2021-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CVUHSD%20-%20Notification%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"fc25f8ce13c3","org_name":"Centinela Valley Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546742"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CVUHSD%20-%20Notification%20Letter%20Sample.pdf"}],"summary":"Malware encrypted data on some Centinela Valley Union High School District systems, and an investigation found that an unauthorized person accessed systems storing employee and student information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-20","discovered_date":"2021-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b12025fa814bda254e0dd819ca147f1d48714d9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wallick%20Volk%20Ad%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"f21f49c76f7d","org_name":"Wallick & Volk, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546683"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wallick%20Volk%20Ad%20CA%20r1prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2143.pdf"}],"summary":"Wallick & Volk reported that malware encrypted some systems and an unauthorized party accessed data that included personal and account-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67c78f77baaa980f5e3346481e709f85d9683376","impact_type":"data_theft","incident_date":"2021-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valley%20Truck%20and%20Tractor%20Company%20%28Sample%20Consumer%20Letter%29.pdf"},"notes":null,"org_country":"US","org_id":"309d7b2287aa","org_name":"Valley Truck and Tractor Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valley%20Truck%20and%20Tractor%20Company%20%28Sample%20Consumer%20Letter%29.pdf"}],"summary":"Valley Truck and Tractor Company reported that personal information was acquired during an incident affecting certain systems between approximately May 13 and June 17, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f2ea2727eb4faea6250ba3f2405709e75899199f","impact_type":"unknown","incident_date":"2021-06-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d63f2b02033","org_name":"University Medical Center of Southern Nevada","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20Medical%20Center%20of%20Southern%20Nevada-2021-10-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7b489ddd461d36ffb2e1d47fc0c95a6748dda0f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JB%20Hunt-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f7a7ac0ef187","org_name":"J.B. Hunt Transport, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A configuration error in the Microsoft Power Apps portal allowed applicant information to be accessed by an unauthorized actor.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546658"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JB%20Hunt-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#J.B.%20Hunt%20Transport%2C%20Inc.-2021-10-20"}],"summary":"A configuration error in J.B. Hunt’s Microsoft Power Apps portal may have allowed an unauthorized actor to access driver applicants’ names and Social Security numbers.","supporting_quote":"J.B. Hunt has completed its investigation into a security incident involving a configuration error in the Microsoft Power Apps portal used by J.B. Hunt to create driver applications.","technology_involved":["Microsoft Power Apps"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-20","discovered_date":"2020-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"feaf2e35f6f26ac9f440f223907ac0288b37f0b2","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11235.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8ce742989520","org_name":"Abeo Solutions Inc.","org_type":"unknown","ransomware":true,"records_affected":6141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11235.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11235.pdf"}],"summary":"Abeo Solutions Inc. was notified that personal information maintained by Netgain was accessed or acquired during a ransomware incident.","supporting_quote":null,"technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-10-19","discovered_date":"2021-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d261f389bc282027f9c4973b480ecb039475fa5","impact_type":"disruption_or_ransomware","incident_date":"2021-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Supplemental%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%20A.pdf"},"notes":null,"org_country":"US","org_id":"766ea0256762","org_name":"PracticeMax","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-554209"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546631"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Supplemental%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%20A.pdf"}],"summary":"PracticeMax identified ransomware on certain systems, unauthorized access to a server and company email accounts, and possible removal of files.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-18","discovered_date":"2021-07-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c690d88af5ccb07565edb00a66550d1e7010d28c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WTH%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4c023ed26e23","org_name":"World Travel Holdings","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546572"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WTH%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/WorldTravelHoldings.pdf"}],"summary":"World Travel Holdings reported unauthorized access to certain computer systems beginning July 1, 2021, and later found information related to the recipient in those systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fb570e17e1d0f404fc2b1ef9cd50ea55313be1b","impact_type":"unknown","incident_date":"2021-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Carnival%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e56543b2a58","org_name":"Carnival Corporation and plc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546577"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carnival%20Corporation%20and%20plc-2021-10-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-18","discovered_date":"2021-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9425dac59f01fb8f9ba77b386c3823471231658","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Volunteers%20Notification%20letter%20-%20Buddhist%20Tzu%20Chi%20Foundation_v2_static%20proof%20r01.pdf"},"notes":null,"org_country":"US","org_id":"4d72efd21261","org_name":"Buddhist Tzu Chi Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Volunteers%20Notification%20letter%20-%20Buddhist%20Tzu%20Chi%20Foundation_v2_static%20proof%20r01.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2142.pdf"}],"summary":"Buddhist Tzu Chi Foundation found personal information present on systems affected by an incident but could not determine whether it had been accessed or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcbfdb4e9aad46055c641f7d54e3d6df9a191ab6","impact_type":"unknown","incident_date":"2021-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/UMC-%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99d014a3d221","org_name":"University Medical Center of Southern Nevada (\"UMC\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546514"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11113.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-10-15","discovered_date":"2021-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32c9c014fed5cb3f9530c85bcc4e6ca32b5b0a2b","impact_type":"both","incident_date":"2021-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Village%20Health_PracMax_ANTHEM%2010.8.21_No%20SSN%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"c9dc15af44b2","org_name":"Anthem, Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546499"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546965"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Village%20Health_PracMax_ANTHEM%2010.8.21_No%20SSN%20%28002%29.pdf"}],"summary":"A ransomware attack on PracticeMax may have exposed Anthem members’ personal and clinical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25c815b0e1590f73f5df7a5daed889e765fd7a35","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bb4a6557f368","org_name":"Thingiverse","org_type":"technology_saas","ransomware":null,"records_affected":228102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Thingiverse","type":"hibp","url":"https://haveibeenpwned.com/Breach/Thingiverse"}],"summary":"A database backup containing Thingiverse user information began circulating in the hacking community in October 2021.","supporting_quote":null,"technology_involved":["database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f12a0dd1934890848fc11521d1bb032ec61cde87","impact_type":"unknown","incident_date":"2021-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice%20Samples.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b7d3e68b2575","org_name":"The Public School and Education Employees Retirement Systems of Missouri","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546481"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Public%20School%20and%20Education%20Employees%20Retirement%20Systems%20of%20Missouri-2021-10-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2021-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"69bf8d85d85ece7af5af87ca5e87736eaccff802","impact_type":"unknown","incident_date":"2021-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2134.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7760b6b5f7e5","org_name":"The Public School and Education Employees Retirement Systems","org_type":"government","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2134.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2134.pdf"}],"summary":"The Public School and Education Employees Retirement Systems reported a security incident affecting 532 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-14","discovered_date":"2021-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3cff6888289cd2587ac5bba0150eeed501b4419","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-24","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SPWW%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"31d0b8ccf9d2","org_name":"Stone Pigman Walther Wittmann, L.L.C.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546482"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SPWW%20-%20Sample%20Notice.pdf"}],"summary":"Stone Pigman discovered suspicious activity affecting certain systems, and an investigation found personal information in files and folders that may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-14","discovered_date":"2021-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14df66807679a7ba0cf31de6ad9226f75cee0ad8","impact_type":"unknown","incident_date":"2021-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Newbridge%20-%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"707eb3536545","org_name":"Newbridge Securities Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546462"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Newbridge%20-%20California%20Notice.pdf"}],"summary":"Newbridge Securities Corporation reported that an unauthorized person accessed some network systems, and potential access to customer personal and account information could not be ruled out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-10-14","discovered_date":"2020-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6c49b1bd5dd365e69d4234663fed99f56c08574","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-21","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elevated%20Title%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"597e984c919a","org_name":"Elevated Title","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546491"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elevated%20Title%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2136.pdf"}],"summary":"Elevated Title reported that unknown individuals accessed company email accounts containing personal, financial, and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-14","discovered_date":"2021-09-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"043bd7b50f14d138e2bcfa559b91bf763cd9ab56","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ATP%20Breach%20Letter%20to%20Customer.pdf"},"notes":null,"org_country":"US","org_id":"d207cd0dbebc","org_name":"Academic Therapy Publications","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An improperly secured administrative feature on the website allowed unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ATP%20Breach%20Letter%20to%20Customer.pdf"}],"summary":"Academic Therapy Publications reported that an improperly secured administrative feature on its website allowed unauthorized access to customer information.","supporting_quote":"After a thorough investigation, we confirmed that an improperly secured administrative feature on our website allowed unauthorized access between January 6, 2020, and July 25, 2021.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-13","discovered_date":"2021-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd2c24afce7a4b7a1d9b9592937c1139d3532eb5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PetroQuest%20General%20Notice%20-%20Final%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"d0e72726aa7d","org_name":"PetroQuest Energy LLC","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PetroQuest%20General%20Notice%20-%20Final%20Proof.pdf"}],"summary":"PetroQuest discovered unauthorized system access, and its investigation found that an individual may have had access to a database containing landowner and lease files, including some older files with W-9s.","supporting_quote":null,"technology_involved":["Quorum database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e9bc6b652488753c59153d9f39ac16dd21d31eb","impact_type":"data_theft","incident_date":"2020-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AOA%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e65ca559cb62","org_name":"American Osteopathic Association","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AOA%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2133.pdf"}],"summary":"The American Osteopathic Association reported that an unauthorized actor exfiltrated information from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-12","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21d68d34048b0ef10f7773e46df35d311e8c7626","impact_type":"data_theft","incident_date":"2021-01-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20CORE%20-%20CA%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"618895674127","org_name":"National Community Renaissance of California","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546334"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20CORE%20-%20CA%20-%20Sample%20Letter.pdf"}],"summary":"An unauthorized actor accessed a National CORE employee’s email account between January and April 2021 and may have viewed or obtained messages and attachments.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"461002c0fea78f52574449943d2d1ea417fbf0e1","impact_type":"unknown","incident_date":"2021-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e17256b62eca","org_name":"Medical & Psychotherapy Billing, LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medical%20%26%20Psychotherapy%20Billing%2C%20LLC-2021-10-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85ffd76e0498e6ad4f31769bc3b442b8a83ebd89","impact_type":"disruption_or_ransomware","incident_date":"2021-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Timios-Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"70bda219af12","org_name":"Timios, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546327"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Timios-Sample%20Letter.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Timios.pdf"}],"summary":"Timios reported unauthorized access to certain devices that encrypted some systems, and personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec0213bfdf8c580192f162fc12da7710bcb33699","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ff097e3df2f1","org_name":"Playbook","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The Playbook database was publicly accessible and had been exposed since October 2020.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Playbook","type":"hibp","url":"https://haveibeenpwned.com/Breach/Playbook"}],"summary":"A publicly accessible Playbook database exposed personal information and password hashes.","supporting_quote":"In September 2021, a publicly accessible PostgresSQL database belonging to the Playbook service was identified .","technology_involved":["PostgresSQL database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-10-08","discovered_date":"2021-08-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"5448436884d0445db5e0dae40b3395708165e341","impact_type":"disruption_or_ransomware","incident_date":"2021-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/ReproSource%20Individual%20Notice%20Letter%20%28002%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4079658bd85a","org_name":"ReproSource Fertility Diagnostics Inc.","org_type":"healthcare","ransomware":true,"records_affected":350000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ReproSource%20Fertility%20Diagnostics%20Inc.-2022-01-31"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-550459"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546267"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ReproSource%20Individual%20Notice%20Letter%20%28002%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ReproSource%20Fertility%20Diagnostics%20Inc.-2021-10-08"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ReproSource%20Individual%20Notice%20Letter%20%28002%29.pdf"}],"summary":"ReproSource discovered ransomware after an unauthorized party accessed its network, and personal information may have been accessed or acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"438058763910992449b810959dac301209c2e995","impact_type":"unknown","incident_date":"2021-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d11d74232c2","org_name":"Oregon Eye Specialists, PC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Eye%20Specialists%2C%20PC-2021-10-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e187caa8e1f688d8cc835551563c157d4912ba8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CMG%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2cc7bd9f5565","org_name":"Cox Media Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546236"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-547126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CMG%20Sample%20Notice.pdf"}],"summary":"An unauthorized third party accessed a server containing human resources personal information and attempted to remove a copy of the data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-10-07","discovered_date":"2021-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a30be46f6f643a24c7d0259a7e98248d0ae09e0","impact_type":"data_theft","incident_date":"2021-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"9e51f619f8cb","org_name":"Pacific City Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546234"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification.pdf"}],"summary":"Pacific City Bank reported that an external actor accessed or acquired data in certain files containing customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2021-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97a4c83284ec9b447e36d2c360219981d16efed0","impact_type":"data_theft","imported_from":null,"incident_date":"2021-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5052dbccfd87","org_name":"Fantasy Football Hub","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fantasy Football Hub","type":"hibp","url":"https://haveibeenpwned.com/Breach/FantasyFootballHub"}],"summary":"Fantasy Football Hub suffered a data breach that exposed personal information, purchase transactions, and passwords stored as WordPress MD5 hashes.","supporting_quote":null,"technology_involved":["WordPress"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-06","discovered_date":"2021-08-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f4839da353e82e6c762be058a02e8c38c7a49615","impact_type":"unknown","incident_date":"2021-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"99f7c2501876","org_name":"Tammy Hastings Bookkeeping & Tax Service, Inc.","org_type":"unknown","ransomware":null,"records_affected":288,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tammy%20Hastings%20Bookkeeping%20%26%20Tax%20Service%2C%20Inc.-2021-10-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e0d03685713681f527a75508ae192cab2dc405b","impact_type":"both","imported_from":null,"incident_date":"2021-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"23c5937b4bdb","org_name":"Republican Party of Texas","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Republican Party of Texas","type":"hibp","url":"https://haveibeenpwned.com/Breach/RepublicanPartyOfTexas"}],"summary":"The Republican Party of Texas was hacked and defaced, followed by a leak of data and documents that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f12cec319cba2935118970c998e3b9a9136aee2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Dr.Kelley-McDowell.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"204a31e95992","org_name":"Drs. Kelley & McDowell PA","org_type":"unknown","ransomware":null,"records_affected":6204,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Dr.Kelley-McDowell.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff54baec2932754ce17ec20a9636bef61c8f6915","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Staff%20%26%20Vendor%20Notification%20letter%20-%20Buddhist%20Tzu%20Chi%20Education%20Foundation_v02_static%20proof%20r02.pdf"},"notes":null,"org_country":"US","org_id":"7263b79c7d40","org_name":"Buddhist Tzu Chi Education Foundation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Staff%20%26%20Vendor%20Notification%20letter%20-%20Buddhist%20Tzu%20Chi%20Education%20Foundation_v02_static%20proof%20r02.pdf"}],"summary":"Buddhist Tzu Chi Education Foundation discovered unusual computer activity and inaccessible systems, but could not determine whether information stored on affected systems had been accessed or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"250ebcd0e20e4f32b93d1f031d6878867b8f481b","impact_type":"unknown","incident_date":"2021-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Canon%20Notification%20Letter_%20Final.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed277cd892ae","org_name":"Synchrony Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-546114"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2021-10-04","discovered_date":"2021-07-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"492a22bd58a1dbe243774fa95062c4ef02c89204","impact_type":"unknown","incident_date":"2021-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11106.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a325361d8845","org_name":"Royell Manufacturing","org_type":"manufacturing","ransomware":null,"records_affected":1145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11106.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11106.pdf"}],"summary":"Royell Manufacturing detected potential unauthorized access on July 3, 2021, and investigated the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ecd7a502745b92b64f2c1550c277392d7ff3e1c","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e3b8cf264cdc","org_name":"LinkedIn","org_type":"technology_saas","ransomware":null,"records_affected":400000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LinkedIn Scraped Data (2021)","type":"hibp","url":"https://haveibeenpwned.com/Breach/LinkedInScrape"}],"summary":"Attackers scraped publicly accessible LinkedIn profiles during the first half of 2021 and sold the collected data online.","supporting_quote":null,"technology_involved":["LinkedIn"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da323e55e8e6642f4f6398ce56c08e55e49dda34","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pulmoune%20-%20Employee%20Notification%20Letter%20-%20CA_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"08cda12f78dd","org_name":"Pulmuone Foods USA, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pulmoune%20-%20Employee%20Notification%20Letter%20-%20CA_PROOF.pdf"}],"summary":"Pulmuone Foods reported unauthorized access to files and data on its computer servers, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a40afff30c237f680e9140179f7b1c50933cbd8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16d36580-40d4-11ec-b81c-33d442e55df8"},"incident_date":"2021-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e9bcf0fc21a7","org_name":"Ministry of Defense","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailymail.co.uk/news/article-10075979/SAS-secrets-revealed-cut-paste-error.html"}],"summary":"Ministry of Defense improperly redacts classified information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf2facad39155b9e4f28e86efe63bc26f7318750","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8af89b60-4278-11ec-b979-154550188709"},"incident_date":"2021-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd52e4c2e972","org_name":"Deep6.AI","org_type":"professional_services","ransomware":null,"records_affected":422000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techradar.com/news/millions-of-healthcare-records-exposed-in-mega-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/misconfigured-database-leaks-880-m/"}],"summary":"A non-password protected database containing millions of healthcare records and 68.53GB of medical related data has reportedly been discovered by security researcher Jeremiah Fowler and the Website Planet research team.  The medical records in the exposed database apparently cont","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2021-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"bf487a468b9bad9dac4b399f0eae99bb12b49a7c","impact_type":"data_theft","incident_date":"2020-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2124.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"53dd66944572","org_name":"Neiman Marcus Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":67410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Neiman%20Marcus%20Group%2C%20LLC%20%28%E2%80%9CNMG%E2%80%9D%20or%20the%20%E2%80%9CCompany%E2%80%9D%29-2021-09-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2124.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NMG%20-%20Email%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2124.pdf"}],"summary":"An unauthorized party obtained personal information associated with certain Neiman Marcus customers’ online accounts.","supporting_quote":null,"technology_involved":["Neiman Marcus online account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-09-30","discovered_date":"2021-08-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95de690f77473e43c89a4b38b4585ad27e6312a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11099.pdf"},"notes":null,"org_country":"US","org_id":"c584faefe1dd","org_name":"LPL Financial LLC","org_type":"financial","ransomware":null,"records_affected":992,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LPL%20Financial%20LLC-2021-09-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11099.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11099.pdf"}],"summary":"An unauthorized individual accessed an LPL advisor’s email account, which contained personal, financial, and medical information belonging to 992 Washington residents.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-30","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"40e0a485df8c6507ee076cab6f943c8981386e73","impact_type":"both","imported_from":null,"incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ClaycoCorp.pdf"},"notes":null,"org_country":"US","org_id":"5470d73d4934","org_name":"Clayco Corporation","org_type":"other","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ClaycoCorp.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ClaycoCorp.pdf"}],"summary":"An unknown party accessed or acquired data during a ransomware event affecting internal systems, and the impacted data included information relating to individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-29","discovered_date":"2021-08-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb16717b7837924a4e3403de0905985d1daf8026","impact_type":"unknown","incident_date":"2021-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0bae7c49e25","org_name":"Young Life","org_type":"unknown","ransomware":null,"records_affected":1121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Young%20Life-2021-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e700831ab74cb80043dd12d9eaa229775ff4da40","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2119.pdf"},"notes":null,"org_country":"US","org_id":"ee1bb90cae4e","org_name":"Wm. G. Roe & Sons, Inc.","org_type":"other","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wm.%20G.%20Roe%20%26%20Sons%2C%20Inc.-2021-09-28"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2119.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2119.pdf"}],"summary":"An unauthorized person accessed portions of Wm. G. Roe & Sons, Inc.'s computer system and may have accessed or taken a file containing employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-27","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e704a4409c2b8deafad05f3ba51ea9afc67e6f6","impact_type":"both","incident_date":"2021-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/09-24-2021%20Customer%20Notification.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; attack_techniques without supporting words dropped: T1657","org_country":"US","org_id":"9530b19d335b","org_name":"Coinbase","org_type":"financial","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":"A flaw in Coinbase’s SMS Account Recovery process allowed attackers to receive an SMS two-factor authentication token and access customer accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/09-24-2021%20Customer%20Notification.pdf"}],"summary":"Attackers exploited a flaw in Coinbase’s SMS Account Recovery process to access customer accounts, transfer funds, and view account information.","supporting_quote":"However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account.","technology_involved":["Coinbase SMS Account Recovery","Coinbase account platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"174b92408c97844fde132eab301308c847e13530","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MTG%20California%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"60433ee8ebd2","org_name":"MTG USA, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MTG%20California%20Sample%20Notification%20Letter.pdf"}],"summary":"MTG USA, Inc. reported that a security incident involving payment card information for certain website orders occurred between June 25, 2020, and June 15, 2021.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6d956e8891af54654f0be92ddae980e8ab980cc","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"TH","org_id":"752a1a27aad6","org_name":"Ajarn","org_type":"education","ransomware":null,"records_affected":266399,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ajarn","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ajarn"}],"summary":"Ajarn discovered a breach dating to December 2018 that exposed personal information and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c37d1f91f90a72dd668f23cbbfc82eb5d4998df","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2116.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0110d07b9430","org_name":"Zenith American Solutions","org_type":"unknown","ransomware":null,"records_affected":1687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2116.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2021-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f591ca277bd73e3935367362c8ea7cfce2c56ba","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11041.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"138ccaaf32e9","org_name":"Hattrup & Associates, P.S.","org_type":"unknown","ransomware":null,"records_affected":2839,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11041.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89e30ff1368a8a0ce3bec2e47a64475ee3c2ecc7","impact_type":"both","incident_date":"2021-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GE%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0fbf1f959c15","org_name":"Golden Entertainment","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GE%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2115.pdf"}],"summary":"Golden Entertainment reported that an unauthorized actor accessed part of its network, acquired documents, and encrypted network files around January 24, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-24","discovered_date":"2020-12-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d204a68a36e67aa192114f08f2bc28b1d669a67","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Forward%20Air%20Corp.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2af8c7d10a25","org_name":"Forward Air Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545711"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Forward%20Air%20Corp.%20-%20Sample%20Notice.pdf"}],"summary":"Forward Air reported that an unknown actor may have viewed or taken personal information from certain company systems accessible in November and early December 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-22","discovered_date":"2021-08-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"52ee72aa2a32f51d3cf099a90ccfbbfb1ff08974","impact_type":"unknown","incident_date":"2021-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/LachmanConsultants.pdf"},"notes":null,"org_country":"US","org_id":"3083cb1394cd","org_name":"Lachman Consultant Services","org_type":"professional_services","ransomware":null,"records_affected":1810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/LachmanConsultants.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/LachmanConsultants.pdf"}],"summary":"Lachman Consultant Services reported unauthorized activity involving personal information on August 10, 2021, affecting an estimated 1,810 employees and contractors.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-22","discovered_date":"2021-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d00a81d87272162bd9d9c9e4a8be39b162e964ea","impact_type":"both","incident_date":"2021-06-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ICS%20Notification%20Letter%20%28Adult%20One%20Year%29%20%28FINAL%29.pdf"},"notes":null,"org_country":"US","org_id":"bd8a5d3924e3","org_name":"Innovative Construction Solutions","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545596"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ICS%20Notification%20Letter%20%28Adult%20One%20Year%29%20%28FINAL%29.pdf"}],"summary":"Innovative Construction Solutions reported that an unauthorized third party accessed its computer system, encrypted files, and may have acquired documents containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-09-21","discovered_date":"2021-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14fe915d719b419131d6c0e7aaf236b784a5843c","impact_type":"data_theft","incident_date":"2021-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2021-09-21%20Navistar%20Inc.%20Template%20Notice%20Letters%20to%20Individuals%20%287%20versions%29.pdf"},"notes":null,"org_country":"US","org_id":"8f3a0b90845b","org_name":"Navistar, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545568"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2021-09-21%20Navistar%20Inc.%20Template%20Notice%20Letters%20to%20Individuals%20%287%20versions%29.pdf"}],"summary":"An unauthorized third party accessed and took data from Navistar’s IT system, including personal and health-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2021-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31ac90c2ac4f66eaa06684255e6a75009ae0a8df","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Epik%2050-State%20Notification%20%28final%29_1.pdf"},"notes":null,"org_country":"US","org_id":"dbe0cf690c20","org_name":"Epik Holdings, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545520"},{"fetched_at":null,"title":"Have I Been Pwned: Epik","type":"hibp","url":"https://haveibeenpwned.com/Breach/Epik"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Epik%2050-State%20Notification%20%28final%29_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Epik%20Holdings%2C%20Inc.-2021-09-22"}],"summary":"Epik reported that unauthorized third parties accessed a backup copy of its domain-side service accounts, which may have contained personal, credential, and financial information.","supporting_quote":null,"technology_involved":["domain-side service accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-17","discovered_date":"2020-12-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5db4fe3afca4202e8860d03ebc70c9adfb8d3eb2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reliance%20Steel%20%26%20Aluminum%20Co.%20%28Sugar%20Steel%20Corporation%29%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"05e5f69ae44c","org_name":"Sugar Steel Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545476"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reliance%20Steel%20%26%20Aluminum%20Co.%20%28Sugar%20Steel%20Corporation%29%20-%20Sample%20Notice.pdf"}],"summary":"Sugar Steel reported that an unknown actor accessed two employee email accounts, which contained personal information; the company could not determine whether it had been viewed or removed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-17","discovered_date":"2021-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b26e5f0600a592449c5e2cad5a0045e092be89e9","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PFU%20America%20Inc.%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"de8d1a1221e6","org_name":"PFU America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545480"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PFU%20America%20Inc.%20Sample%20Notice.pdf"}],"summary":"PFU America reported that payment card information entered on fujitsuscannerstore.com may have been compromised.","supporting_quote":null,"technology_involved":["fujitsuscannerstore.com"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98115bc71e3c9163e2402915169369e01802241f","impact_type":"data_theft","incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MMP%20-%20Notification%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"55785296fe7a","org_name":"Metabolic Maintenance Products, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545415"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MMP%20-%20Notification%20Letter%20Template.pdf"}],"summary":"Metabolic Maintenance Products reported that an unknown third party installed code on its websites that transmitted customers’ transaction information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5648bd727cca03b579cccea0db3d860624fe4da0","impact_type":"unknown","incident_date":"2021-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/B%26B%20Transport%20Experian%20IdentityWorks%20Credit%20Plus%203B%20letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0fb3cd84a0a5","org_name":"B&B Transport Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545430"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-09-15","discovered_date":"2021-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad538de5d235565502cbcc7ba6c1e5cb5f97bb08","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KING%27S%20SEAFOOD%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"40fa83893876","org_name":"King’s Seafood Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545400"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KING%27S%20SEAFOOD%20Notification%20Letter.pdf"}],"summary":"King’s Seafood Company reported that an unauthorized individual accessed directories containing information that may have included personal, payment card, and medical card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-13","discovered_date":"2020-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c5312e75fcc61d8821fcb58becd24f9a501905b","impact_type":"data_theft","incident_date":"2020-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HCI%2C%20LLC%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9743b1a1b626","org_name":"HCI, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545233"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HCI%2C%20LLC%20Sample%20Notice.pdf"}],"summary":"HCI reported that an unauthorized person accessed, viewed, and acquired files containing current and former employees’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d75a97f639e0f83d5e7a95b648cd7912ad8656b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELARC%20Ad%20CM%20Wave%203%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"dc84c989d44d","org_name":"Eastern Los Angeles Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-549748"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELARC%20Ad%20CM%20Wave%203%20r2prf.pdf"}],"summary":"Eastern Los Angeles Regional Center confirmed unauthorized access to one employee email account on July 15, 2021, and reviewed the mailbox for personal information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-13","discovered_date":"2021-08-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"302cb9c3faaf948c0d7512ec96988c5c303a8d4e","impact_type":"data_theft","incident_date":"2020-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dick%20Blick%20-%20%5Bredacted%5D%20No%20CM%20%289834697x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"f3dad6596038","org_name":"Dick Blick Holdings","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545248"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dick%20Blick%20-%20%5Bredacted%5D%20No%20CM%20%289834697x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11040.pdf"}],"summary":"Malicious code on Dick Blick Holdings’ website captured customer payment card information entered during online purchases.","supporting_quote":null,"technology_involved":["dickblick.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-11","discovered_date":"2021-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30be3ddb385294e1a72b42ad6972868f3dd07794","impact_type":"disruption_or_ransomware","incident_date":"2021-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enclosure%20to%20CA%20AG%20Form%20%28Carpenter%29.pdf"},"notes":null,"org_country":"US","org_id":"76e988ce90a9","org_name":"Carpenter Co","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545204"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enclosure%20to%20CA%20AG%20Form%20%28Carpenter%29.pdf"}],"summary":"Carpenter Co reported a ransomware incident that affected its information technology systems and in which a threat actor accessed employees’ and contractors’ personal information.","supporting_quote":null,"technology_involved":["email software systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6053b92ebed9abb4d8b27361da947536ae021eea","impact_type":"disruption_or_ransomware","incident_date":"2021-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nations%20Lending%20Ad%20CM%20Timios%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"8c71fb650a56","org_name":"Nations Lending Corporation","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545175"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nations%20Lending%20Ad%20CM%20Timios%20r1prf.pdf"}],"summary":"A title company used by Nations Lending experienced a ransomware attack that made loan-closing data inaccessible, with possible access to customer information not ruled out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2021-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8af040998149b283846be29245940d57eb147988","impact_type":"data_theft","incident_date":"2020-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCSDH%20Sample%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"b5c3e169fc62","org_name":"UC San Diego Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545117"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCSDH%20Sample%20Individual%20Notification.pdf"}],"summary":"UC San Diego Health reported unauthorized access to employee email accounts, where emails or attachments containing personal information were accessed and/or acquired.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-09","discovered_date":"2021-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7418cf05ed1be89bb21335b3334f21955856630","impact_type":"disruption_or_ransomware","incident_date":"2021-05-20","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cedarlane%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8660ddc91dd2","org_name":"Cedarlane Natural Foods, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545158"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cedarlane%20-%20Sample%20Notice.pdf"}],"summary":"A security incident disrupted access to Cedarlane systems, and an investigation found that personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80ad6bda967be0411137958c377156eb77cef4ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Buddhist%20Tzu%20Chi%20-%20Notice%20of%20patient%20data%20breach%20v2_static%20proof_r02.pdf"},"notes":null,"org_country":"US","org_id":"310e6885971f","org_name":"Buddhist Tzu Chi Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Buddhist%20Tzu%20Chi%20-%20Notice%20of%20patient%20data%20breach%20v2_static%20proof_r02.pdf"}],"summary":"Buddhist Tzu Chi Medical Foundation reported that encrypted servers may have contained patient names, addresses, dates of birth, diagnosis information, and dental X-rays.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-09-08","discovered_date":"2021-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"490132b188327a28777e619a369e977eeed87b31","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CAMTC%20-%20Sample%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"9fcbd040e9ce","org_name":"California Massage Therapy Council","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-545053"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CAMTC%20-%20Sample%20Notice%20Letter.pdf"}],"summary":"The California Massage Therapy Council notified people of a potential data security incident that may have affected names, addresses, and payment card information, though its investigation found no evidence its environment was compromised.","supporting_quote":null,"technology_involved":["website payment page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-08","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"67e92a86ba0d13013ec19df2fba0511527341e5a","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmGuard.pdf"},"notes":null,"org_country":"US","org_id":"336940e8610f","org_name":"AmGUARD Insurance Company","org_type":"financial","ransomware":true,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmGuard.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmGuard.pdf"}],"summary":"AmGUARD Insurance Company reported a ransomware event detected on September 26, 2020, during which an unknown party accessed or acquired data from parts of the organization’s systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-09-05","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f564bd33c675118391b2507ded9d04aaf2d712b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Somnia%20Draft%20Notification%20Letter%20%28Sample%29.pdf"},"notes":null,"org_country":"US","org_id":"8ff7896bc23b","org_name":"Resource Anesthesiology Association of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544969"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Somnia%20Draft%20Notification%20Letter%20%28Sample%29.pdf"}],"summary":"A stolen administrator laptop contained patient information, though the organization reported no evidence that the information was accessed or misused.","supporting_quote":"On July 8, 2021, an administrator at RAA of California had their password protected laptop stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-09-03","discovered_date":"2021-04-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59a930f9c6900f6b1b7ff26131fbbd4cc0aa4655","impact_type":"both","incident_date":"2021-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice.PDF"},"notes":null,"org_country":"US","org_id":"264d3a058641","org_name":"Smile Brands Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544924"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Smile%20Brands%20Inc.-2021-10-08"}],"summary":"Smile Brands reported a ransomware attack affecting systems containing protected health information, and said certain data may have been acquired by an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-03","discovered_date":"2021-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f1927dbf8e2296d0ba8c750c87e2a7da76c51fa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/K%26B%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b7a08a42ef1f","org_name":"K and B Surgical Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544933"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/K%26B%20-%20Sample%20Notice.pdf"}],"summary":"K and B Surgical Center reported unauthorized access to its systems from March 24 to March 30, 2021, potentially exposing personal information including names and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80a40b946d5595aa6d641292fb4c30a4118cd308","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"deb2dca0-157a-11ec-8375-f10617ad68c4"},"incident_date":"2021-09-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fb50ea1b11a","org_name":"Howard University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/howard-university-investigates-alleged-ransomware-attack/"}],"summary":"Howard University announced Monday that they are investigating a ransomware attack.  According to school officials, their information technology team detected unusual activity on the school’s network last Friday.  Due to the unusual activity, the school’s Enterprise Technology Se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e7db4eb7401d16d6db910e8481bf0b1ebef5a499","impact_type":"disruption_or_ransomware","incident_date":"2021-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1100.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9df119c95e01","org_name":"Famous Smoke Shop","org_type":"retail_ecommerce","ransomware":true,"records_affected":32950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1100.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1100.pdf"}],"summary":"Famous Smoke Shop reported that a ransomware attack encrypted files containing customer account information, and personal information may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-09-03","discovered_date":"2021-08-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db36e5f4243d3d4b174f75b82f927e92d059f1a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISO01432%20-%20Breach%20Notification%20Letter%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"96f90996e888","org_name":"Department of State Hospitals – Coalinga","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544919"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISO01432%20-%20Breach%20Notification%20Letter%20FINAL.pdf"}],"summary":"The Department of State Hospitals – Coalinga provided patient rosters containing more information than needed to the United States District Court for eligibility determinations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-09-02","discovered_date":"2021-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff5af72c40051e96e5fe074d70cc4f9683349929","impact_type":"disruption_or_ransomware","incident_date":"2021-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMD.pdf"},"notes":null,"org_country":"US","org_id":"f1ef88de8028","org_name":"Sequoia Concepts, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544902"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMD.pdf"}],"summary":"Sequoia Concepts, Inc. discovered a ransomware attack on July 2, 2021, and said an encrypted system may have contained personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"281a656a7a2681ab4cfbeb6ff904284b58fc394f","impact_type":"data_theft","incident_date":"2021-03-10","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MFA%20Financial%20-%20Version%20F%20%28CA%29.pdf"},"notes":"attack_techniques without supporting words dropped: T1041, T1213","org_country":"US","org_id":"9ae13d1935d6","org_name":"MFA Financial, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544766"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MFA%20Financial%20-%20Version%20F%20%28CA%29.pdf"}],"summary":"MFA Financial reported that an unauthorized party accessed and removed personal information from a file server in its legacy environment.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-09-01","discovered_date":"2021-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e8469f77d336295a62bfb041f4f3c4885c565d6a","impact_type":"unknown","incident_date":"2021-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4da08d65ccf","org_name":"Craft3","org_type":"unknown","ransomware":null,"records_affected":947,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Craft3-2021-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9184811f33fffd64df487e2cb34e2c70378c20e9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Career%20Group%20-%20CA%20SSN%20%5Bredacted%5D%20%289818323x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"b4cb1956c7e2","org_name":"Career Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Career%20Group%20-%20CA%20SSN%20%5Bredacted%5D%20%289818323x7AB84%29.pdf"}],"summary":"Career Group, Inc. reported unauthorized network access and potential removal of files and folders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2021-08-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc63193922e82854f48cb44ab9c72b1db7c24767","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RCBO-MaterDei%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"721b151d6504","org_name":"Mater Dei High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee response to a phishing email with a malicious link likely led to unauthorized access to employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RCBO-MaterDei%20-%20Sample%20Notice.pdf"}],"summary":"Mater Dei reported unauthorized access to two employee email accounts after a likely response to a phishing email, with personal information potentially exposed.","supporting_quote":"In late January 2021, Mater Dei became aware of suspicious logins into some of its employees’ email accounts likely due to a response to a phishing email message with a malicious link.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fad26f3432b90c1afe7a8bdc2456ecc3ddb1360","impact_type":"data_theft","incident_date":"2021-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Healthpointe%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"213a6dd15f6e","org_name":"Healthpointe Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544422"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Healthpointe%20-%20Sample%20Notice.pdf"}],"summary":"Healthpointe Medical Group reported that an unauthorized actor accessed its systems and removed files and folders containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-28","discovered_date":"2021-08-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc16badc06483111428aedac7c8e9cc735eadfbb","impact_type":"unknown","incident_date":"2021-08-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bad6ee2b4bad","org_name":"Bubble Tea House","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bubble%20Tea%20House-2021-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-27","discovered_date":"2020-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da300d1a1d1586a58e0402d8387b5693a367f636","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/395539_IDX_SmartStart_General%20with%20SSN_Recvd_08%2017%2021_Static_Proof_R4.pdf"},"notes":null,"org_country":"US","org_id":"8cd83464a2b1","org_name":"SmartStart Employment Screening, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/395539_IDX_SmartStart_General%20with%20SSN_Recvd_08%2017%2021_Static_Proof_R4.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10863.pdf"}],"summary":"SmartStart Employment Screening identified suspicious activity on a server and later learned that names may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-27","discovered_date":"2021-08-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ce09e0826fbde24e468d6fd32e712ba08e63e1","impact_type":"both","incident_date":"2020-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LifeLong%20-%20Adult%20SSN%20%5Bredacted%5D%20%289808489x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"2f314bd7eeaa","org_name":"LifeLong Medical Care","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544328"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LifeLong%20-%20Adult%20SSN%20%5Bredacted%5D%20%289808489x7AB84%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lifelong%20Medical%20Care-2021-09-07"}],"summary":"LifeLong Medical Care reported that files containing personal information were accessed or acquired from Netgain’s network in connection with a ransomware attack.","supporting_quote":null,"technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c17ca920c24f99381454e0a5a0e9471bbba3da8","impact_type":"data_theft","imported_from":null,"incident_date":"2021-05-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"087acc46d2ea","org_name":"IndiaMART","org_type":"retail_ecommerce","ransomware":null,"records_affected":38000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: IndiaMART","type":"hibp","url":"https://haveibeenpwned.com/Breach/IndiaMART"}],"summary":"Data associated with IndiaMART, including email addresses, names, phone numbers, and physical addresses, was found being traded on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-08-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4ad8ef7f581746f45395b36e02f6104188d5800b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1098.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e7f52d839c9d","org_name":"CareATC, Inc.","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1098.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1098.pdf"}],"summary":"CareATC reported that an employee email account contained personal and medical information that may have been subject to unauthorized access.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Conti","variety":"organized_crime"},"attack_techniques":["T1486","T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-08-26","discovered_date":"2021-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"269044e82c85bae38083a967cbe4c02af8947fff","impact_type":"both","imported_from":null,"incident_date":"2021-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b4676ae89fae","org_name":"SAC Wireless, LLC","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice%20Letter.pdf"}],"summary":"SAC Wireless reported that Conti accessed its systems, uploaded files to cloud storage, and deployed ransomware to encrypt files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware","derived":{"actor_id":"conti"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2021-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b770e287ec2c0d52de730a326f5679de7560bad3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3d5f98b29c0a","org_name":"Imavex","org_type":"professional_services","ransomware":null,"records_affected":878209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Imavex","type":"hibp","url":"https://haveibeenpwned.com/Breach/Imavex"}],"summary":"A breach of Imavex exposed user records and customer form submissions and orders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d24ad257b0a87bd0b0e1a3d0be8898ef9d81bb8","impact_type":"unknown","incident_date":"2021-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/T-Mobile%20Substitute%20Notice%20%282021.08.19%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd7db84b9052","org_name":"T-Mobile USA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544287"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA96.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ab0de99acaaa817f7e74f38535cb06dee62220f","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a2f587414bd4","org_name":"Suba Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SubaGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/SubaGames"}],"summary":"Suba Games suffered a breach in November 2016 that exposed email addresses, usernames, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-08-25","discovered_date":"2021-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f120d9de49c6126d674fa9add8da86a0549f746","impact_type":"both","incident_date":"2021-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SARC%20Ad%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"a185c9e5a084","org_name":"San Andreas Regional Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544241"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SARC%20Ad%20r4prf.pdf"}],"summary":"San Andreas Regional Center reported a ransomware incident in which an unauthorized individual encrypted some systems and acquired some information; the entry method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb381ba6cd25bdbc99c560f2ddae711813a75e0","impact_type":"data_theft","imported_from":null,"incident_date":"2018-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ec9659002eb5","org_name":"Eatigo","org_type":"technology_saas","ransomware":null,"records_affected":2789609,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Eatigo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Eatigo"}],"summary":"A breach of Eatigo exposed account details, including personal information and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-24","discovered_date":"2020-09-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdf5302a93e8f366e0c027fb71fe89997cfd18c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Syufy%20Enterprises%2C%20LP%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b15c4e879c49","org_name":"Syufy Enterprises, LP","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Syufy%20Enterprises%2C%20LP%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Syufy%20Enterprises%2C%20LP-2021-08-24"}],"summary":"Syufy Enterprises detected suspicious activity on certain systems and identified files that may have been viewed or taken by an unauthorized actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b4968802dd5c803c5337ad7ab979e5666dd0863","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88e3b3e0-156f-11ec-8375-f10617ad68c4"},"incident_date":"2021-08-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"dba1c2d326ba","org_name":"Neuchâtel Cantonal Bank (BCN)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.finews.com/news/english-news/47676-hackers-data-theft-neuchatel-cantonal-bank"}],"summary":"Hackers have stolen email addresses during a cyber-attack on the Neuchâtel Cantonal Bank, but the bank says the data is old and of limited value.  There was a cyber attack on the Neuchâtel Cantonal Bank (BCN) at the beginning of August, spokeswoman Marie-Laure Chapatte, told the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb51ff7bff660b7d86238934c4f41f97ed286d4d","impact_type":"unknown","incident_date":"2021-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57b5186b497c","org_name":"County of Los Angeles Fire Department","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544216"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544830"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-24","discovered_date":"2021-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4efa96332582af2099aff603578464134d11bb2c","impact_type":"unknown","incident_date":"2021-05-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8eb796a4693a","org_name":"Columbia Helicopters, Inc.","org_type":"unknown","ransomware":null,"records_affected":3096,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20Helicopters%2C%20Inc.-2021-08-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-24","discovered_date":"2021-06-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d6e84fb3454ee4233987fd247e3ad1dc85613f59","impact_type":"unknown","incident_date":"2020-11-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"339b2685af6e","org_name":"American Freight, LLC and its related subsidiaries and affiliates","org_type":"unknown","ransomware":null,"records_affected":36829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Freight%2C%20LLC%20and%20its%20related%20subsidiaries%20and%20affiliates%2C%20including%20American%20Freight%20Outlet-2021-08-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f25d3d92e93dbfae144eca9f76db2794faa5598c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Freight-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b780953386a7","org_name":"American Freight","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544213"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Freight-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA94.pdf"}],"summary":"An unauthorized person accessed contents of some American Freight employees’ email accounts, and the investigation identified an email or attachment containing personal information that may have been viewed or acquired.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-08-23","discovered_date":"2021-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea1b99cb8d119097d58335f370f60298488b86d6","impact_type":"both","imported_from":null,"incident_date":"2021-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCVTA%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cac55a55e348","org_name":"Santa Clara Valley Transportation Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544173"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCVTA%20-%20Sample%20Letter.pdf"}],"summary":"The Santa Clara Valley Transportation Authority reported that an unknown actor accessed its systems, which became inaccessible, and employee data may have been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-23","discovered_date":"2021-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5583b46205351c38e8d1ff9259ebe1b7d65e7389","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pendrick%20-%20Sample%20Notices.PDF"},"notes":null,"org_country":"US","org_id":"6964f77031bf","org_name":"Pendrick Capital Partner Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544183"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pendrick%20-%20Sample%20Notices.PDF"}],"summary":"Pendrick discovered unauthorized access to employee email accounts, and personal information may have been affected.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-08-20","discovered_date":"2021-06-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e0065f0780dc9c4353c018240f7e0399b502f4a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA88.pdf"},"notes":null,"org_country":"US","org_id":"1e0977f6a287","org_name":"South Florida Community Care Network LLC","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA88.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA88.pdf"}],"summary":"A former employee sent documents containing personal and medical information to a personal email address.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-20","discovered_date":"2021-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9e4bef2bb31392c4efa661303106ac9655500ab","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_2.pdf"},"notes":null,"org_country":"US","org_id":"c30ae0e5e085","org_name":"H Mart, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544090"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_2.pdf"}],"summary":"H Mart discovered encrypted files on several systems and said its corporate file server containing personal identifying information may have been accessed.","supporting_quote":null,"technology_involved":["corporate file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-19","discovered_date":"2021-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c8292c9b4f5646f0eb9af4ee0f8656b4506099a","impact_type":"data_theft","incident_date":"2021-06-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20SSN%20Letter%20%5Bredacted%5D%20%289795242x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"d80a29755e65","org_name":"Walter's Automotive Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544074"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20SSN%20Letter%20%5Bredacted%5D%20%289795242x7AB84%29.pdf"}],"summary":"Walter's Automotive Group reported unauthorized network access and acquisition of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-19","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4bd4e0c9bc72cba596027784c60648d55dcf009","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_11.pdf"},"notes":null,"org_country":"US","org_id":"80687a88a5da","org_name":"Fresno Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544083"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_11.pdf"}],"summary":"Fresno Unified School District discovered missing backup storage media containing names and Social Security numbers, with no evidence that the information was stolen or misused.","supporting_quote":"In March 2021, we discovered that specific storage media used to perform computer backups was missing from storage.","technology_involved":["computer backup storage media"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-08-18","discovered_date":"2021-04-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc078f2754ff1aecbef85843075803d0826d801b","impact_type":"disruption_or_ransomware","incident_date":"2021-04-09","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Dixie%20Group-%20Sample%20Letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"403376e86d69","org_name":"The Dixie Group, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544023"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Dixie%20Group-%20Sample%20Letter.pdf"}],"summary":"The Dixie Group reported a ransomware incident that made some devices unavailable and involved unauthorized access to folders on its file servers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2215bdc227c855189b47f45c4bd27872befed34","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/WSSN%20Notification%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31fe3543c25b","org_name":"WSSC Water","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543970"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10848.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec02304b8766bc473f56c9f09402ec1d40b86588","impact_type":"unknown","incident_date":"2021-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Secure%20Administrative%20Solutions%2C%20LLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42f44b5b0e3e","org_name":"Secure Administrative Solutions, LLC (\"SAS\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543968"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-17","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"441351a3e31d22a669296848087dd737e31c0e33","impact_type":"both","incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/GreenwichInsuranceCompany.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"060d4b60732b","org_name":"Greenwich Insurance Company","org_type":"financial","ransomware":true,"records_affected":379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/GreenwichInsuranceCompany.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/GreenwichInsuranceCompany.pdf"}],"summary":"Greenwich Insurance Company reported a ransomware event detected by Gallagher, with an unknown party accessing or acquiring data between June 3 and September 26, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-17","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"eddbac22832fb589f0ccf5092e9e85c12069d992","impact_type":"both","incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ContinentalCasualtyCompany.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5a31322cd09f","org_name":"Continental Casualty Company","org_type":"financial","ransomware":true,"records_affected":57,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ContinentalCasualtyCompany.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ContinentalCasualtyCompany.pdf"}],"summary":"Continental Casualty Company reported a ransomware event and data access affecting certain internal systems; the initial access method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-17","discovered_date":"2021-07-12","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6cb1d16c424389571a31e5deed131722a9d7592","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BackNine%20-%20Consumer%20Letters%20Combined.pdf"},"notes":null,"org_country":"US","org_id":"3e9d9f925377","org_name":"BackNine Insurance and Financial Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A coding error caused insurance and annuity applications to be uploaded to a publicly accessible cloud storage folder.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543955"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BackNine%20-%20Consumer%20Letters%20Combined.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BackNine%20Insurance%20and%20Financial%20Services%2C%20Inc.-2021-08-17"}],"summary":"BackNine reported that a coding error uploaded insurance and annuity applications containing personal information to a publicly accessible cloud storage folder.","supporting_quote":"On July 12, 2021, BackNine learned of a coding error that caused certain insurance and annuity applications to be uploaded to a publicly accessible folder on its cloud storage system.","technology_involved":["cloud storage system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-17","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"5eeba6718220b0882c035319d5ba8a4010a97c8a","impact_type":"both","incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ArchInsuranceCo.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ecc76f04cce0","org_name":"Arch Insurance Company","org_type":"financial","ransomware":true,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ArchInsuranceCo.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ArchInsuranceCo.pdf"}],"summary":"Arch Insurance Company reported a ransomware event and unauthorized access to or acquisition of data containing information about individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-16","discovered_date":"2021-07-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5fab93d1d033a04def5a4618b320a0fcfffefd82","impact_type":"unknown","incident_date":"2021-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3cd63dc8436","org_name":"Mackenzie Engineering, Inc.","org_type":"unknown","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mackenzie%20Engineering%2C%20Inc.-2021-08-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce5393429d081a96200b0230cac63fdd85fc1fde","impact_type":"both","incident_date":"2021-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RF%20SUNY%20California%20Sample%20Letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"2ca7443ab3a3","org_name":"The Research Foundation for the State University of New York","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RF%20SUNY%20California%20Sample%20Letter.pdf"}],"summary":"The Research Foundation for the State University of New York reported unauthorized activity that made some systems unavailable and resulted in files being obtained from its file servers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c679ae8af7fae2017fa65d9b38df5f929e8eb787","impact_type":"disruption_or_ransomware","incident_date":"2021-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sierra.Adult_.CM_.pdf"},"notes":null,"org_country":"US","org_id":"9b589c3e7f3b","org_name":"Sierra Joint Community College District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543883"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sierra.Adult_.CM_.pdf"}],"summary":"Sierra Joint Community College District reported that ransomware encrypted some systems and that an unauthorized individual accessed a system containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d73352d12eb729f331478e4eba6c8a960e2fe658","impact_type":"unknown","incident_date":"2020-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"155d3c547b30","org_name":"Pacific West Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pacific%20West%20Bank-2021-08-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7e1ddc85b8e416f19509dba6b13ee7e4edd284c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2021_8_13_CCB_customer_notice_CA.pdf"},"notes":null,"org_country":"US","org_id":"85847079d597","org_name":"JPMorgan Chase Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543873"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2021_8_13_CCB_customer_notice_CA.pdf"}],"summary":"A technical issue may have allowed another customer to view JPMorgan Chase account information or receive account statements.","supporting_quote":"We learned of a technical issue here that may have mistakenly allowed another customer with similar personal information to see your account information on chase.com or in the Chase Mobile app, or receive your account statements.","technology_involved":["chase.com","Chase Mobile app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"20b832342b389fb657e1a1c7fbf3029483ff25e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/DestinationMaternity.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c909bcb3bc02","org_name":"Destination Maternity","org_type":"retail_ecommerce","ransomware":null,"records_affected":2237,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Destination%20Maternity-2021-08-13"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/DestinationMaternity.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA75.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/DestinationMaternity.pdf"}],"summary":"Destination Maternity reported unauthorized access to its network that affected employee information, including personal information and potentially bank information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04bb476ee268e156d79393f82c92f504e184099c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-02","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AHP%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"45c6598034ae","org_name":"Academic HealthPlans, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email phishing incident targeting AHP employees resulted in unauthorized access to employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHP%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Academic%20HealthPlans%2C%20Inc.-2021-08-02"}],"summary":"A phishing incident resulted in unauthorized access to two AHP employees’ Microsoft Office 365 email accounts, which contained personal information.","supporting_quote":"On July 7, 2021, we notified the University of California of an email phishing incident that targeted AHP employees and may have resulted in unauthorized access to emails and attachments in the employees’ email accounts.","technology_involved":["Microsoft Office 365","email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7204b2753c8b4006de381c015107749dc8e04853","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CLEAN%20Employee%20Notification%20letter%202021.07.14%20w%20SSN_v3%20%28PRINT%20PROOF%20rev%20....pdf"},"notes":null,"org_country":"US","org_id":"823ed4849336","org_name":"On Lok Senior Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CLEAN%20Employee%20Notification%20letter%202021.07.14%20w%20SSN_v3%20%28PRINT%20PROOF%20rev%20....pdf"}],"summary":"On Lok detected and stopped a data security incident, and said personal and health information may have been exposed to unauthorized persons.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02bbc3692914cc7f382b5c9f65a3d8893df3a611","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/StJosephsCandler.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95d0c7a08e50","org_name":"St. Joseph's/Candler","org_type":"unknown","ransomware":null,"records_affected":100993,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/StJosephsCandler.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d87609d829691ccc253602f9986547f9739df92","impact_type":"both","incident_date":"2021-07-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/29662170_1_J.B.%20Poindexter%20Team%20Member%20Notice%20%28002%29%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"c1f634531765","org_name":"Morgan Truck Body, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543782"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/29662170_1_J.B.%20Poindexter%20Team%20Member%20Notice%20%28002%29%20%28002%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morgan%20Truck%20Body%2C%20LLC-2021-08-23"}],"summary":"Cyber criminals gained unauthorized access to components of the J.B. Poindexter & Co. computer network, encrypted servers and computers, and may have accessed or removed team members’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-11","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db66ecbe78df2bca6ee3040fd7ee305f2a082a1a","impact_type":"disruption_or_ransomware","incident_date":"2020-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jim%20Provencher%20Ad%203BM%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"659a07f5bc32","org_name":"Jim Provencher","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jim%20Provencher%20Ad%203BM%20CA%20r2prf.pdf"}],"summary":"Ransomware infected one of Jim Provencher’s computer systems and encrypted data, which was restored from backups; the letter states there was no evidence that information was stolen or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a89f309e4683216f79f2d173bce58ca0bd48378a","impact_type":"unknown","incident_date":"2021-06-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BBW%20--%20Customer%20Notification%20CA%20-%208-10-21.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bef74b0a4f37","org_name":"Bath & Body Works Direct, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543767"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-08-09","discovered_date":"2021-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3d1f421254b2b8bf24ba9cf8a431df576ca9546","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11029.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac38b73a1090","org_name":"Spreadshirt","org_type":"retail_ecommerce","ransomware":null,"records_affected":911,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Spreadshirt%20inc.-2021-08-09"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11029.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11029.pdf"}],"summary":"Spreadshirt reported that an attacker accessed and copied personal and internal business data during an attempted ransomware attack.","supporting_quote":null,"technology_involved":["employee computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7b62574de4f0b8e7ec55dfe37dbb69257477b65","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"613a5c34d447","org_name":"OrderSnapp","org_type":"technology_saas","ransomware":null,"records_affected":1304447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OrderSnapp","type":"hibp","url":"https://haveibeenpwned.com/Breach/OrderSnapp"}],"summary":"A June 2020 data breach at OrderSnapp exposed email addresses, names, phone numbers, dates of birth, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01b13b1af9a41c9440dd0986baee03db47202e34","impact_type":"data_theft","imported_from":null,"incident_date":"2020-12-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"51ea257895b5","org_name":"MMG Fusion","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MMG Fusion","type":"hibp","url":"https://haveibeenpwned.com/Breach/MMGFusion"}],"summary":"A December 2020 data breach at MMG Fusion exposed personal information and some bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3075421e9f507900e5cbbef32a516e30ac13a51a","impact_type":"unknown","incident_date":"2021-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bccaddca5721","org_name":"MLD Mortgage, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543638"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-06","discovered_date":"2020-08-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"27e8b54fdba4884b880962909606034ce4ae77ff","impact_type":"both","incident_date":"2020-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA68.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"53699a1fdbb7","org_name":"Ibex Global Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":891,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ibex%20Global%20Solutions%2C%20Inc.%20%28%E2%80%9CIbex%E2%80%9D%29-2021-08-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA68.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543664"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%201.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/IbexGlobalSolutions.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA68.pdf"}],"summary":"Ibex reported a malware attack that affected the availability of part of its systems and may have involved unauthorized access to files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2021-08-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8904ceeeaac41f80cf142277c7172c3f6eacf22","impact_type":"data_theft","incident_date":"2021-01-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UK%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"56bce1f777e6","org_name":"University of Kentucky","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability associated with the website was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UK%20-%20California%20Notification.pdf"}],"summary":"An unknown party exploited a vulnerability in the University of Kentucky’s OTIS website and likely acquired a copy of its Digital Driver’s License database.","supporting_quote":"On June 25, 2021, the investigation determined that an unknown party exploited the vulnerability and likely acquired a copy of the OTIS Digital Driver’s License database between January 8, 2021 and February 6, 2021.","technology_involved":["OTIS website","OTIS Digital Driver’s License database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-05","discovered_date":"2021-06-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"bc8c7b0fcd34955aac9bd1d7e79ffbaea82a60c5","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SkiBromley.pdf"},"notes":null,"org_country":"US","org_id":"b278d7d0ac75","org_name":"Ski Bromley, LLC","org_type":"other","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SkiBromley.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SkiBromley.pdf"}],"summary":"Ski Bromley discovered a ransomware attack that encrypted its network and resulted in unauthorized access to personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-08-05","discovered_date":"2020-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e95d6288703b43a80528e8a3a447777854bd2fd","impact_type":"disruption_or_ransomware","incident_date":"2020-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NTS%20-%20California%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0ca4938eb15f","org_name":"NTS Holding Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543615"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NTS%20-%20California%20Sample%20Notice.pdf"}],"summary":"NTS reported unauthorized access to certain systems and files that disrupted network access, but could not confirm whether the files were viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"434821f5934e86c99f53a8d423f9d075bb18197b","impact_type":"unknown","incident_date":"2021-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Transtar%20Notification%20Letter%20%28General%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec8edf46cfba","org_name":"Transtar Industries Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543566"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transtar%20Industries%20Inc.-2021-08-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-08-04","discovered_date":"2021-06-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2c4d02e8c46f01b8a80fedaf703b5de347f2796","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Breach%20Notification%20Template_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"f530f44cd4da","org_name":"Transamerica Retirement Solutions, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A change to the plan administration website inadvertently allowed administrators for other employers to access retirement contribution information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543531"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Breach%20Notification%20Template_Redacted.pdf"}],"summary":"A website change allowed administrators for other employers to access information about retirement contributions, including personal and financial details.","supporting_quote":"Transamerica learned that a change to one of our plan administration websites in early June /2/0/2/1 inadvertently allowed employers other than yours to access certain information about your retirement contributions/2e","technology_involved":["plan administration website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2021-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"237f62b29354745fd257ddc64627f935580966b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA61.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7c9d43ce352a","org_name":"Renton Regional Fire Authority","org_type":"unknown","ransomware":null,"records_affected":1334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA61.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f7151eef394fbcdbe1938a29397a019cbc1fdf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"225edd30-359e-11ec-be76-613d00a742ca"},"incident_date":"2021-08-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"dad0c3952f8a","org_name":"Oshawa City Fire Services","org_type":"government","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insauga.com/city-of-oshawa-dealing-with-internal-privacy-breach/"}],"summary":"Oshawa is sending some senior staff back to school for a refresher course on its Privacy Breach Response Policy and Procedure after private information was “inadvertently” leaked internally this summer.Fire Chief Derrick Clark sent a copy of an Excel file entitled ‘2021 Master Si","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-04","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"9a84b10dc7d55bf926980539bf7163e37f85b71b","impact_type":"both","imported_from":null,"incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NorthAmericanSpecialtyCorperation.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7d59a42fce06","org_name":"North American Specialty Corporation and Westport Insurance Corporation","org_type":"financial","ransomware":true,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NorthAmericanSpecialtyCorperation.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NorthAmericanSpecialtyCorperation.pdf"}],"summary":"A ransomware event affecting Gallagher’s internal systems involved access to or acquisition of data relating to individuals associated with North American Specialty Corporation and Westport Insurance Corporation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9770cf26b953d6a6e51f8031b8ea136faac302b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-10","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tuff%20Shed%2C%20Inc.%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d0aa6e737ed6","org_name":"Tuff Shed, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543486"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tuff%20Shed%2C%20Inc.%20-%20Sample%20Notice.pdf"}],"summary":"Tuff Shed reported that some computer systems were subject to unauthorized access between February 3 and February 10, 2021, and that affected systems contained information related to individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b45d8e8284ce829faa071aea5daa2943f97b1085","impact_type":"unknown","incident_date":"2020-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lereta%20LLC%20-%20Consumer%20Notification%20Letter%20-%20General%201.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"147a0eabd5de","org_name":"LERETA, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543463"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-08-02","discovered_date":"2021-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"978c4ad93dba23eac81acf8fc71c9f2405f1e900","impact_type":"disruption_or_ransomware","incident_date":"2021-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20Impacted%20Staff%20Clients%20Volunteers%20%28Draft%29.pdf"},"notes":null,"org_country":"US","org_id":"4d72efd21261","org_name":"Buddhist Tzu Chi Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20Impacted%20Staff%20Clients%20Volunteers%20%28Draft%29.pdf"}],"summary":"Buddhist Tzu Chi Foundation discovered abnormal computer systems and determined it was the victim of a ransomware attack that compromised systems containing private and confidential information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":"unknown","cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2021-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3481e71793e4a17c16ed207833576b49687b0b90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ec5c6ec0-25e2-11ec-8021-93be7268887c"},"incident_date":"2021-08-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1f73cc9bb77","org_name":"T-Mobile","org_type":"technology_saas","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/t-mobile-usa-investigates-possible-data-breach-a-17293"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/TMobile.pdf"}],"summary":"T-Mobile Investigating Claims of Massive Customer Data Breach possibly as a result of a misconfigured server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cec03f019d167569c6459c5f0e1395e1d9f265a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc26e7e0-099d-11ec-863c-8359987c65e0"},"incident_date":"2021-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d45070b5e19","org_name":"Maritz Holding Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/maritz-holdings-inc-employees-notified-of-data-security-incident-301263320.html"}],"summary":"Maritz employee accidentally emailed the wrong person information regarding employees in the employer-sponsored health plan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75a138627f8d4f5f94acce7218c804f491fe0ef4","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_G5264_WideOrbit%20LLC_L03_SAS_6.pdf"},"notes":null,"org_country":"US","org_id":"1110ff63c8be","org_name":"WideOrbit LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543399"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_G5264_WideOrbit%20LLC_L03_SAS_6.pdf"}],"summary":"WideOrbit reported unauthorized activity involving an employee’s email account after an employee clicked a phishing-email attachment; personal information was in the mailbox, but access or acquisition of that information was not confirmed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-30","discovered_date":"2021-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2948bc48a6a7575e794f23d0560c6cd5d4113ac8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ryan%20Specialty%20Group%20%28RSG%29%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"263dbd3b6d13","org_name":"Ryan Specialty Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ryan%20Specialty%20Group%20%28RSG%29%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"Ryan Specialty Group found unauthorized access to certain employee email accounts between April 4 and April 20, 2021; personal information was accessible, but actual viewing was not confirmed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-30","discovered_date":"2021-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a78e818e0a8a7be457e12fc79d9df8b00b7a65c9","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10788.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"205886ea911a","org_name":"Mandere Construction / Northwestern Building Components","org_type":"other","ransomware":null,"records_affected":781,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10788.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10788.pdf"}],"summary":"Mandere Construction / Northwestern Building Components reported that files were downloaded from its network without authorization and that stored files included names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d76ddfc726f34fed3427d97ed54c88e09691deca","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/La%20Jolla%20Professional%20Insurance%20Associates%20Sample%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e89462f988f7","org_name":"La Jolla Professional Insurance Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543388"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-30","discovered_date":"2021-06-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d0d3e2b146276eebe478cbe5cadb42ce6bad725","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%202.pdf"},"notes":null,"org_country":"US","org_id":"c2bd1c95767f","org_name":"Divvy Up, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543412"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%202.pdf"}],"summary":"Divvy Up reported that malware was downloaded to its hosted website after its hosting company’s network security was compromised, exposing payment transaction information to a third party.","supporting_quote":"Recently, we were notified by our website hosting company that their network security was compromised, allowing malware to be downloaded to the hosted website.","technology_involved":["hosted website"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2021-07-29","discovered_date":"2021-06-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e46c9a6522c88296c78f4700f3f3d898516e14cc","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spiezle%20-%20California%20Notice%20of%20Data%20Incident%20for%20Consumers.pdf"},"notes":null,"org_country":"US","org_id":"c91282f2be63","org_name":"Spiezle Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543361"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spiezle%20-%20California%20Notice%20of%20Data%20Incident%20for%20Consumers.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SpiezleGroup.pdf"}],"summary":"Spiezle discovered malware in its IT environment and said a third-party actor may have accessed and downloaded internal employee files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e938f3d342f3bb590e1720620fb2127f90d0e39","impact_type":"data_theft","incident_date":"2021-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Streetfire%20Incident%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2395613e78f3","org_name":"Motor Trend Group LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Streetfire%20Incident%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10806.pdf"}],"summary":"An unknown actor accessed backup servers holding information about the prior StreetFire website and downloaded certain files.","supporting_quote":null,"technology_involved":["backup servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-29","discovered_date":"2021-06-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea03d415d13a1e0db88aa165abde317c7c754365","impact_type":"unknown","incident_date":"2021-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10889.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd39be4734d8","org_name":"Grant Street Asset Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10889.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Grant%20Street%20Asset%20Management%2C%20Inc-2021-08-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-29","discovered_date":"2021-04-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9fd016f1742243fe450b04a584c2d22391c05857","impact_type":"unknown","incident_date":"2021-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9c0b387b4d2b","org_name":"Centennial School District","org_type":"unknown","ransomware":null,"records_affected":6537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Centennial%20School%20District-2021-07-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-28","discovered_date":"2021-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d1d1610505541ad2932b322d83b8e14c43ec6863","impact_type":"unknown","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c080442e0059","org_name":"Professional Benefit Services Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Professional%20Benefit%20Services%20Inc-2021-07-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"168851fefeb4fde984c145bb473d2ad01af04146","impact_type":"unknown","incident_date":"2021-02-02","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A2Z%20-%20CA%20Sample%20-%20Redacted%20%289750557x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"daba28f5c9e4","org_name":"A2Z Diagnostics, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543340"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A2Z%20-%20CA%20Sample%20-%20Redacted%20%289750557x7AB84%29.pdf"}],"summary":"A2Z Diagnostics reported that compromised email accounts contained information relating to affected individuals.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-07-27","discovered_date":"2021-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e3d41d3273eecd65cbe31d58e281426d2a7a147","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DK%20Engineering%20-%20Consumer%20Notification%20Letter%20%28Employee%29%20V3%20Print%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"10b13cecec09","org_name":"D&K Engineering Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543317"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DK%20Engineering%20-%20Consumer%20Notification%20Letter%20%28Employee%29%20V3%20Print%20Proof.pdf"}],"summary":"D&K Engineering discovered unauthorized access to its network environment and found that employment-related personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-07-26","discovered_date":"2021-06-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dcafb82466c3445682420872a2af23c43c5fce2","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Transformco%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"0c80f6374cea","org_name":"Transform SR Holding Management LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Transformco%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transform%20SR%20Holding%20Management%20LLC-2021-07-26"}],"summary":"Transform SR Holding Management LLC reported that an unauthorized party accessed some computer servers and that files containing employee personal, financial, and healthcare insurance information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3f12a3495e495bac81c72eae2f546f9e8d8ab3a","impact_type":"unknown","incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8e2e91b049d2","org_name":"Specialty Tax & Bookkeeping Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543267"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-26","discovered_date":"2021-06-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9caa8ef0046c8d6529e9dac1d66f5b195be932b1","impact_type":"unknown","incident_date":"2020-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"unknown","ransomware":null,"records_affected":8664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aetna-2021-07-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-23","discovered_date":"2020-10-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adfb27652c6f31b9327b6b2fb616eefce9095362","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Savory%20Spice%20-%20Letter%201.pdf"},"notes":null,"org_country":"US","org_id":"8096ebd6bc0e","org_name":"Savory Spice","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543203"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Savory%20Spice%20-%20Letter%201.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Savory%20Spice-2021-07-23"}],"summary":"Savory Spice reported that unauthorized parties may have accessed customer purchase information, including personal and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7d5d622a5b4cda61553393af93a9a18fbcd8ee3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ICL%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"84461aada65f","org_name":"Inner City Law Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ICL%20-%20California%20Notification.pdf"}],"summary":"An unauthorized person accessed an employee email account during periods between August 4, 2020, and January 26, 2021, and personal information in the account may have been accessible.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-23","discovered_date":"2021-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db641edf9be8b03a3acc7a1d83fc93a63d1d2f2f","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/G2%20Insurance%20Ad%20Version%204%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"53b382a970ea","org_name":"G2 Insurance Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543209"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/G2%20Insurance%20Ad%20Version%204%20r1prf.pdf"}],"summary":"An unauthorized user accessed some G2 systems files that may have contained individuals’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f51fdf2947ce9068f164bfa95e6ebe9b5e9b2cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e56543b2a58","org_name":"Carnival Corporation and Plc","org_type":"transportation_logistics","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42.pdf"}],"summary":"Carnival Corporation and Plc detected unauthorized third-party access to portions of its information technology systems, some of which may have contained guests’, employees’ and crew members’ personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2021-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d065d2b01bd88ac2afb8724382a29c6b8efedd4c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-08-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d62362dd69bb","org_name":"Audi","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor left data unsecured and exposed on the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Audi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Audi"}],"summary":"Audi USA data was left unsecured and exposed on the internet by a vendor, exposing personal and vehicle information.","supporting_quote":"In August 2019, Audi USA suffered a data breach after a vendor left data unsecured and exposed on the internet .","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-22","discovered_date":"2021-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f24444df58446b3e8827fab783e84609d2c2e2cb","impact_type":"data_theft","incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"204eb011e85c","org_name":"Resort Data Processing, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543186"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20%28CA%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10696.pdf"}],"summary":"Attackers used malicious code to obtain payment card information entered through Resort Data Processing’s online booking system.","supporting_quote":null,"technology_involved":["online booking system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-22","discovered_date":"2021-06-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bdc7ae5742e2a570eae12b427e9e0a4152816688","impact_type":"unknown","incident_date":"2021-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2069e513992a","org_name":"Forest City Trade Group, LLC and its affiliated companies","org_type":"unknown","ransomware":null,"records_affected":1855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Forest%20City%20Trade%20Group%2C%20LLC%20and%20its%20affiliated%20companies-2021-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-21","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"f80b468325ff52e9a4f174058ab5e0896acd2947","impact_type":"both","incident_date":"2020-06-03","initial_access":"unknown","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SafetyNationalCasualtyCorp.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d71b7806c34a","org_name":"Safety National Casualty Corporation & Safety First Insurance Company","org_type":"financial","ransomware":true,"records_affected":1348,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SafetyNationalCasualtyCorp.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SafetyNationalCasualtyCorp.pdf"}],"summary":"A ransomware event affecting Gallagher’s internal systems led to unauthorized access to data relating to individuals associated with Safety National Casualty Corporation and Safety First Insurance Company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Gallagher"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"35c9d4f627a1","name":"Gallagher"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43efde9a3c0e201f7b1c9bf6ea92a90de6517522","impact_type":"unknown","incident_date":"2021-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Hyphen%20-%20IDX_HYP%20StaticProof_1CA%20%5Bredacted%5D%20%289734189x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb9cf932405c","org_name":"Hyphen, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543154"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11035.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6345375a04846f838f9f1816566bfd5b1ddbd30","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-07-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"af45d6e01967","org_name":"Guntrader","org_type":"unknown","ransomware":null,"records_affected":112031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Guntrader","type":"hibp","url":"https://haveibeenpwned.com/Breach/Guntrader"}],"summary":"Guntrader suffered a data breach that exposed email addresses, personal information, and bcrypt password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-20","discovered_date":"2021-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0aa058d274c0495fdea65dfdb0303acdfb127689","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a28788b81ba","org_name":"Colton Telephone Company","org_type":"unknown","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colton%20Telephone%20Company%20dba%20COLTONTEL-2021-07-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9a2d33988c83cfd3a035d943a539797b32da48a","impact_type":"unknown","incident_date":"2020-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CMC%20Tax%20Services%20-%20Fraud%20%28redacted%29%20%289730795x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4b42e48b89a2","org_name":"CMC Tax Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543068"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f9f79cb2547178622528c60eb735d2b170144b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-26","initial_access":"unknown","notes":null,"org_country":"FR","org_id":"d1e253c3349b","org_name":"Short Édition","org_type":"other","ransomware":null,"records_affected":505466,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Short Édition","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShortEdition"}],"summary":"Short Édition reported a breach exposing records containing personal information and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-19","discovered_date":"2021-01-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2b0a49a7aac9852313be368f3da429aef266c01","impact_type":"both","incident_date":"2020-11-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Proof%20-%20CA%20-%20Redacted%20%289730726x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"0fa64dde4d35","org_name":"SafetyCall International","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543067"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543653"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544239"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Proof%20-%20CA%20-%20Redacted%20%289730726x7AB84%29.pdf"}],"summary":"SafetyCall International’s data hosted by Netgain may have been taken during a network intrusion in which ransomware was launched.","supporting_quote":"On January 14 , 2021, Netgain informed us that certain of SafetyCall’s customer’s data may have been taken from its network as part of the attack.","technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a91233710742a2455409b31408f505effdd0c0ca","impact_type":"both","incident_date":"2021-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DAVACO%20Notification%20Letter%20-%20IDX%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"34c9cc91afea","org_name":"Davaco LP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543040"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DAVACO%20Notification%20Letter%20-%20IDX%20PROOF.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Davaco.pdf"}],"summary":"Davaco LP reported a ransomware attack in which an unauthorized individual accessed its network and viewed and removed data that included employees’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c5e42d6d9a2a14dd3168cc28b5450ca357c6ea8","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FI","org_id":"112bfc5be18c","org_name":"Vastaamo","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vastaamo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vastaamo"}],"summary":"Vastaamo was targeted in a ransomware attack, and data including patient names, social security numbers, and psychotherapy notes was exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-16","discovered_date":"2020-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57a77608f9edec1911e8dc75b982d919ee16f484","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SN%20Servicing%20Corporation_1.pdf"},"notes":null,"org_country":"US","org_id":"3d27591413bb","org_name":"SN Servicing Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542995"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SN%20Servicing%20Corporation_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SN%20Servicing%20Corporation-2021-07-16"}],"summary":"SN Servicing Corporation discovered unauthorized access on October 15, 2020, and an investigation found that files had been exfiltrated and borrower information may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-16","discovered_date":"2021-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9e9b6b3d7bc84e193ce6e28d979cb72ec5dd427","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sierra%20Nevada%20Draft%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b3970a79416b","org_name":"Sierra Nevada Primary Care Physicians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542979"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sierra%20Nevada%20Draft%20Notification%20Letter.pdf"}],"summary":"Receipts from the practice were found in a suspect’s vehicle and recovered by the District Attorney’s office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"093a4c7753f9f4bb79ac5b4309f1d69591a2ae70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aee052a0-1570-11ec-8375-f10617ad68c4"},"incident_date":"2021-07-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"577e24b98ad3","org_name":"Federal Bureau of Investigation","org_type":"government","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/secret-terrorist-watchlist-with-2-million-records-exposed-online/"}],"summary":"In July this year, Security Discovery researcher Bob Diachenko came across a plethora of JSON records in an exposed Elasticsearch cluster that piqued his interest. The 1.9 million-strong recordset contained sensitive information on people, including their names, country citizensh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e4c3120ebdadbb39be07a8a07bd55ff4fd10586","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/eJuice%20Breach%20Notification%20Letter-California.pdf"},"notes":null,"org_country":"US","org_id":"84ced1f2456c","org_name":"eJuice Direct","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542992"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/eJuice%20Breach%20Notification%20Letter-California.pdf"}],"summary":"An unauthorized third party injected a malicious script into eJuice Direct’s website, potentially exposing personal information entered there, including payment card details.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"daac6cdd49376cfd0afaee574ce699f6c2de9da0","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-20","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Job38630d08_Guidehouse_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"173e17007e1c","org_name":"Community Memorial Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party secure file transfer service used by Community Memorial Health System was compromised.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Job38630d08_Guidehouse_L01_SAS_1.pdf"}],"summary":"Community Memorial Health System’s personal and medical information may have been involved in an attack that compromised a third-party secure file transfer service.","supporting_quote":"The attack occurred in late January 2021, and involved the compromise of a third-party service used for secure file transfer for many clients including Community Memorial Health System located in Ventura, CA.","technology_involved":["secure file transfer service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"459a022aaeee8c43f402ced670f3c7583e3478bc","impact_type":"unknown","incident_date":"2021-07-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Breach%20Notification_CalTAcct_Final.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a18463eb6fc4","org_name":"California Student Aid Commission","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542976"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-15","discovered_date":"2020-09-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ae766ae7b2f9041120388f35f345ea0185e884bc","impact_type":"unknown","incident_date":"2020-09-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42345ed8565f","org_name":"San Juan Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#San%20Juan%20Regional%20Medical%20Center-2021-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-15","discovered_date":"2021-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd839c710038a3b8d5690748a8ba4a5e0c367919","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CMST%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e605792e31d4","org_name":"Cohen Milstein Sellers & Toll PLLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542954"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CMST%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cohen%20Milstein%20Sellers%20%26%20Toll%20PLLC-2021-07-15"}],"summary":"Cohen Milstein reported unauthorized access to certain computer systems on January 23, 2021, and said potentially affected information included names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2f336cc09c6662b1a2069c330534a239c8611bbe","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10813.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cddd627c4fc0","org_name":"EvergreenHealth","org_type":"healthcare","ransomware":null,"records_affected":20215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10813.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10813.pdf"}],"summary":"An unauthorized person accessed data in the Washington State Auditor's Accellion file transfer account, including information for some EvergreenHealth patients.","supporting_quote":null,"technology_involved":["Accellion file transfer service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-13","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d81d566af9ae5391da760211d58426aee82f2e3","impact_type":"both","imported_from":null,"incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10497.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e0f8ba60806f","org_name":"Arthur J. Gallagher & Co.","org_type":"financial","ransomware":true,"records_affected":72378,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10497.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10497.pdf"}],"summary":"Arthur J. Gallagher & Co. detected a ransomware event in September 2020 and later confirmed that information relating to certain individuals was included in impacted data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-13","discovered_date":"2021-06-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a5a398f0c3824b01e4103dd1c5260cefbb7c75a3","impact_type":"unknown","incident_date":"2020-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b76894fb76c7","org_name":"Academic Health Plans","org_type":"unknown","ransomware":null,"records_affected":1657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Academic%20Health%20Plans-2021-07-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-07-12","discovered_date":"2021-08-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb1fe2f47e50f682aa459ceae00dbd9807e9dffd","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-12","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DMG%20Ltd.%2C%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"dff5d5827cd4","org_name":"DuPage Medical Group","org_type":"healthcare","ransomware":null,"records_affected":600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://chicago.suntimes.com/business/2021/8/30/22649201/dupage-medical-group-notifying-patients-data-breach"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-544814"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DMG%20Ltd.%2C%20Sample%20Notice.pdf"}],"summary":"DuPage Medical Group reported unauthorized access to its network that disrupted systems and may have affected files containing patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0ba0adb1245751d7d8de7f22f8243194ee57fe36","impact_type":"data_theft","incident_date":"2021-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10691.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ec2be5f031ef","org_name":"Clover Park School District","org_type":"education","ransomware":null,"records_affected":5872,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10691.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10691.pdf"}],"summary":"Clover Park School District reported that an unknown actor took and may have viewed information during unauthorized access to its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-12","discovered_date":"2021-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8febdc3696fb957e6ad493412f7425f861b01051","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"13e143245ff1","org_name":"Birtcher Anderson & Davis Associates Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542796"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice.pdf"}],"summary":"Birtcher Anderson & Davis Associates reported a cybersecurity incident involving potentially compromised personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ea0e1151f28daa71b65141034f82a844926c619","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Guess%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"afc52a569b66","org_name":"Guess?, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542711"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Guess%20-%20California%20Notification.pdf"}],"summary":"Guess? detected unauthorized access to devices and an attempt to encrypt systems, and found that personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-09","discovered_date":"2021-04-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"dce435c6cea3cd1ae5d49adbe50dd3348354bab8","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSI%20Financial%20Letter.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e1c48fbbb82b","org_name":"CSI Financial Services, LLC","org_type":"financial","ransomware":null,"records_affected":209719,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CSI%20Financial%20Services%2C%20LLC%20%28%E2%80%9CClearBalance%E2%80%9D%29-2021-07-09"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSI%20Financial%20Letter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSI%20Financial%20Letter.pdf"}],"summary":"ClearBalance reported unauthorized access to certain email accounts containing personal information and detected and prevented an attempted unauthorized wire transfer.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-07-09","discovered_date":"2021-04-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fdbda12b2ca14e04a67e50c23099e06459fb5a71","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10496.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e1c48fbbb82b","org_name":"CSI Financial Services, LLC","org_type":"financial","ransomware":null,"records_affected":4255,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10496.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10496.pdf"}],"summary":"Unauthorized access to ClearBalance cloud-based email accounts exposed emails containing personal, financial, and medical information; a wire transfer attempt was detected and prevented.","supporting_quote":null,"technology_involved":["cloud-based email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98aaf618deba2a9cfd51dc3ec19412e4699b53b9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SharedAllianceInsurance.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2081ce304967","org_name":"Shared Alliance Insurance","org_type":"unknown","ransomware":null,"records_affected":6099,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SharedAllianceInsurance.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-07-08","discovered_date":"2021-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"1c0d583a4b205dcd4c5ee893e44bce53982c5bac","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10808.pdf"},"notes":null,"org_country":"US","org_id":"554686c0cdca","org_name":"Forefront Dermatology","org_type":"healthcare","ransomware":null,"records_affected":877,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Forefront%20Management%2C%20LLC%20and%20Forefront%20Dermatology%2C%20S.C.-2021-07-08"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10808.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FFM%20FFD%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10808.pdf"}],"summary":"Forefront reported unauthorized access to files containing provider, employee, and patient information during an intrusion into its IT network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-08","discovered_date":"2021-03-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2cb0d7cf4d77cd4ddb129d8f6c2b324fcf34ba8","impact_type":"both","incident_date":"2021-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20TEMPLATE%20NOTICE.pdf"},"notes":null,"org_country":"US","org_id":"c3157ea383ab","org_name":"CNA Financial Corporation","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20TEMPLATE%20NOTICE.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10476.pdf"}],"summary":"CNA reported that a threat actor accessed its systems, copied some information, and deployed ransomware; the information included personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d7d62ab7a6903d0c65532b1364bf3762b4243df","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9885d8c0-2094-11ec-82c4-4d3486f21395"},"incident_date":"2021-07-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0653cfc5d9b","org_name":"York Animal Hospital","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.seacoastonline.com/story/news/crime/2021/07/12/york-animal-hospital-maine-ransomware-cyberattack-wipes-pet-medical-records-suspects-russia-bitcoin/7938174002/"}],"summary":"Ransomware attackers wanted $80,000 from York Animal Hospital. They won't pay.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-07-07","discovered_date":"2020-12-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"648f71cd3b46f095018d2c3f192ccc920f46c949","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Midpen%20Housing%20Notification%20letter%20proof.pdf"},"notes":null,"org_country":"US","org_id":"03b0dadff6e0","org_name":"Hello Housing","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Midpen%20Housing%20Notification%20letter%20proof.pdf"}],"summary":"Hello Housing detected suspicious activity in its business email environment and found that a business email account had been compromised, potentially exposing personal information.","supporting_quote":null,"technology_involved":["business email account","business email environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-06","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dff9626af4260c15d433a70447e3445a0d6d5b29","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-06-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10475.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"26cbf3660d8b","org_name":"UniBank","org_type":"financial","ransomware":null,"records_affected":11276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10475.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10475.pdf"}],"summary":"UniBank reported that an electronic device was stolen and that data stored on it was potentially accessible, with no evidence of unauthorized access to its internal systems or customer information being affected.","supporting_quote":"On June 9, 2021, we experienced a theft that included an electronic device among the items stolen.","technology_involved":["electronic device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cbbd4cdf6647ddff89a6c1086157ecf36333884b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SCMethodistConferenceCU.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ba562893aa7e","org_name":"South Carolina Methodist Conference Credit Union","org_type":"unknown","ransomware":null,"records_affected":1308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SCMethodistConferenceCU.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1e0818bb8362e64e9d62f340ac91a7f1100b6ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cdd11390-2095-11ec-82c4-4d3486f21395"},"incident_date":"2021-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2b8a4508d2e","org_name":"Respawn","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pcgamer.com/apex-legends-hacked-to-protest-titanfalls-server-situation/"}],"summary":"Apex Legends hacked to protest Titanfall server hacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45d7800f896db808638722842995d8683e9025bb","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IR","org_id":"3d7b2f227b51","org_name":"Raychat","org_type":"technology_saas","ransomware":null,"records_affected":938981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Raychat","type":"hibp","url":"https://haveibeenpwned.com/Breach/Raychat"}],"summary":"Raychat suffered a data breach in January 2021 that exposed personal information and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f3ace7d5cce77199d5c0f36a2327ba56be35669","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Impactree%20Data%20Breach%20Notification%20-%2007%2002%202021.pdf"},"notes":"attack_techniques without supporting words dropped: T1491","org_country":"US","org_id":"365aa80abcd4","org_name":"VotePlus10 Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542542"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Impactree%20Data%20Breach%20Notification%20-%2007%2002%202021.pdf"}],"summary":"An unauthorized user accessed the Impactree platform and altered public action content; the organization shut down the platform for a security review.","supporting_quote":null,"technology_involved":["Impactree platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ebe8dae3ef6a901c28aa6cd79467a3527e8d94fb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/United%20Healthcare.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95a0cf9d4a5e","org_name":"United Healthcare","org_type":"unknown","ransomware":null,"records_affected":1244,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/United%20Healthcare.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"713f15f36c5e284aa2dc18f2c031f411dd6b11c9","impact_type":"both","incident_date":"2020-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"f063c9d46cfc","org_name":"The Paradies Shops, LLC","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542517"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Paradies%20Shops%2C%20LLC-2021-07-02"}],"summary":"The Paradies Shops reported a ransomware attack affecting an internal administrative system, with records uploaded to third-party servers.","supporting_quote":null,"technology_involved":["internal administrative system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"353237225a9e5606f107937a806dd88dd3cbfcb3","impact_type":"unknown","incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Security%20Incident%20Consumer%20Notice%20-%20CA%20Non-Brokerage%20-%20SUM%20Shareworks.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"868e339a4142","org_name":"Morgan Stanley","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542538"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morgan%20Stanley-2021-07-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2021-07-01","discovered_date":"2020-12-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d0b64185f9cfb5d342b427be057efd99b6af6c","impact_type":"data_theft","incident_date":"2020-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/21.06.30%20Adult-Deceased-Minor%20Individual%20Notice%20Samples%20%28Redacted%29.pdf"},"notes":null,"org_country":"US","org_id":"0bba34ad0f02","org_name":"Professional Business Systems","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542502"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/21.06.30%20Adult-Deceased-Minor%20Individual%20Notice%20Samples%20%28Redacted%29.pdf"}],"summary":"An unauthorized actor copied files containing personal, patient, and employee information from Professional Business Systems’ systems after attempting to deploy ransomware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"460ef4f6131562530fe631764ea7bd9d3da585e2","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10493.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5a744905ad8e","org_name":"Nevada Restaurant Services Inc.","org_type":"other","ransomware":null,"records_affected":3241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nevada%20Restaurant%20Services%20Inc.-2021-07-01"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10493.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10493.pdf"}],"summary":"Nevada Restaurant Services Inc. reported malware on certain computer systems and said an unauthorized person copied information from affected systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":"REvil","variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"036e0896b51a102ba6b2a08929d9e2c19dc006ac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bd056f50-92a2-11ec-a39a-3584eb2df2ab"},"incident_date":"2021-07-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e53cf4f501c4","org_name":"Kaseya","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/story/kaseya-supply-chain-ransomware-attack-msps/"},{"fetched_at":null,"title":null,"type":"press","url":"https://kelo.com/2021/07/02/200-businesses-hit-by-ransomware-after-breach-at-florida-it-firm/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securelist.com/revil-ransomware-attack-on-msp-companies/103075/"},{"fetched_at":null,"title":null,"type":"press","url":"https://thehackernews.com/2021/07/revil-used-0-day-in-kaseya-ransomware.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident;"}],"summary":"It was probably inevitable that the two dominant cybersecurity threats of the day—supply chain attacks and ransomware—would combine to wreak havoc. That’s precisely what happened Friday afternoon, as the notorious REvil criminal group successfully encrypted the files of hundreds ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"revil"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-07-01","discovered_date":"2020-07-31","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac153fc99ab860a9e593dc288772fa81ee8f23db","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DPM-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c36236917855","org_name":"Discovery Practice Management, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DPM-%20Sample%20Letter.pdf"}],"summary":"Discovery Practice Management identified unauthorized logins to two staff email accounts, and the accounts contained personal, medical, and financial information.","supporting_quote":"On July 31, 2020, our investigation into suspicious email account activity identified unauthorized logins to two Facilities’ staff email accounts between June 22 and June 26, 2020.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-30","discovered_date":"2021-04-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7bf80ea444eb28248a2610997635c3b92ef6aaf","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_G5627_Marsh%20McLennan%20-%20Phase%201_L01_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"46f3504e9150","org_name":"Marsh McLennan","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized actor leveraged a vulnerability in third-party software to access data in Marsh McLennan's environment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542377"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_G5627_Marsh%20McLennan%20-%20Phase%201_L01_SAS_1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MarshMcLennan.pdf"}],"summary":"Marsh McLennan reported that an unauthorized actor exploited a vulnerability in third-party software to access a limited set of data in its environment.","supporting_quote":"On April 26, 2021, we discovered that an unauthorized actor had leveraged a vulnerability in a third party’s software since at least April 22, to gain access to a limited set of data in our environment.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-30","discovered_date":"2021-01-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56b8315b9cbdd5025abef83fb642095f07c6bc24","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hudson-Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"47f0b1f52797","org_name":"Hudson Envelope of New Jersey Corp.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542434"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hudson-Sample%20Letter.pdf"}],"summary":"Hudson discovered unauthorized code on its e-commerce website that could have captured customers’ cardholder and personal information.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-30","discovered_date":"2020-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"566bad08610040d0342c50ce1060c256556355e1","impact_type":"both","incident_date":"2020-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AJG%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"e0f8ba60806f","org_name":"Arthur J. Gallagher & Co.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AJG%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Arthur%20J.%20Gallagher%20%26%20Co.-2021-07-08"}],"summary":"Arthur J. Gallagher & Co. detected a ransomware event affecting internal systems and determined that an unknown party accessed or acquired data, including information relating to individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4f673225b2e284ab6fb7fc2221463102de91c7d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/371148_IDX_Wolfe%20Clinic%20P.C._General_Recvd_06%2021%2021_Static_Proof_R4%28255757718.1%29.pdf"},"notes":null,"org_country":"US","org_id":"a8c8557a4cae","org_name":"Wolfe Clinic, P.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542359"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/371148_IDX_Wolfe%20Clinic%20P.C._General_Recvd_06%2021%2021_Static_Proof_R4%28255757718.1%29.pdf"}],"summary":"Wolfe Clinic, P.C. reported that a cybersecurity attack involved an unauthorized third party attempting to access its computer network, and personal and medical information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0deed7f39d0264789f60b538f69423f92df5a214","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pharmavite-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"fbb86bae06ef","org_name":"Pharmavite LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542312"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pharmavite-%20Sample%20Letter.pdf"}],"summary":"An unauthorized person accessed a Pharmavite employee’s email account, which contained personal information that may have been accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"92c17cb53cb332b200db10e0bbb8e11fb606f4de","impact_type":"disruption_or_ransomware","incident_date":"2021-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10491.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2e7776ae3165","org_name":"Ankle and Foot Physicians and Surgeons, PLLC","org_type":"healthcare","ransomware":true,"records_affected":4996,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10491.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10491.pdf"}],"summary":"Ankle and Foot Physicians and Surgeons reported that a ransomware attack encrypted systems containing radiograph files and that some records could not be recovered.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fcfe876aa68b747da95432650b10f55c015c60a","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"MX","org_id":"7459f9e543d9","org_name":"yotepresto.com","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: yotepresto.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/YoteprestoCom"}],"summary":"A breach at yotepresto.com exposed customer email and IP addresses, usernames, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d57cbfb8d82f82012fa9e258bb2f843453a8fc0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d0a7b543aef0","org_name":"Teespring","org_type":"retail_ecommerce","ransomware":null,"records_affected":8234193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Teespring","type":"hibp","url":"https://haveibeenpwned.com/Breach/Teespring"}],"summary":"A data breach at Teespring exposed customer records, including email addresses, names, geographic locations and social media IDs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-06-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6f5dcde73807677843187499d176f0f0881b27","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Abode%20Services%20Ad%20CA%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"945ccb95737b","org_name":"Abode Services","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542286"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-543702"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Abode%20Services%20Ad%20CA%20r4prf.pdf"}],"summary":"An unauthorized third party intermittently accessed email accounts of certain Abode Services employees, and the investigation found that personal information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-24","discovered_date":"2021-01-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ad37101694beb0943a813c06e96502cfdfbb555","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multiplan_Sample_Individual_Notice_FINAL.pdf"},"notes":null,"org_country":"US","org_id":"643173013a58","org_name":"Highmark Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542234"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multiplan_Sample_Individual_Notice_FINAL.pdf"}],"summary":"An outside actor accessed a MultiPlan employee’s email account containing communications with Highmark about billing, and attempted to divert wire payments.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MultiPlan"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2f23b4da6253","name":"MultiPlan"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7fd71b8f296c389953c8c2797b5b6d108bed1ad","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Guest.pdf"},"notes":null,"org_country":"US","org_id":"e25e2f602dcd","org_name":"Royal Caribbean Cruises Ltd.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542141"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Guest.pdf"}],"summary":"A third party gained unauthorized access to a limited number of Royal Caribbean employees’ email accounts, potentially exposing customers’ personal and internal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-23","discovered_date":"2021-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"16e34b586c822f7f4997038dd132afc75a1f5598","impact_type":"unknown","incident_date":"2021-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dbdc61ae6ea3","org_name":"Princeton Property Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":3574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Princeton%20Property%20Management%2C%20Inc.-2021-06-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-23","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f0f5f3e6357140c5b670c3d56efdb699430811ed","impact_type":"unknown","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ca98f237ae1b","org_name":"Health Net Health Plan of Oregon/ Trillium Community Health Plan","org_type":"unknown","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Health%20Net%20Health%20Plan%20of%20Oregon/%20Trillium%20Community%20Health%20Plan-2021-06-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-23","discovered_date":"2021-05-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"4e505a1f7f38ed5882f1820476fb9495339ebd16","impact_type":"data_theft","incident_date":"2020-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10489.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ce91f6871935","org_name":"Asset Marketing Services, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Asset%20Marketing%20Services%2C%20LLC%20d/b/a%20GovMint.com-2021-06-23"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10489.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542194"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AMS%20Holdings%2C%20LLC%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10489.pdf"}],"summary":"An unknown actor accessed portions of GovMint.com and may have viewed or exfiltrated customer credit card information and names.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e04dc3f6877a07c4c8498ecc146e6236bd3865c","impact_type":"data_theft","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CaptureRx%20-%20Patient%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b3379a51beec","org_name":"Tiburcio Vasquez Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CaptureRx%20-%20Patient%20Notice.pdf"}],"summary":"CaptureRx reported that files containing Tiburcio Vasquez Health Center patients’ personal and prescription information were accessed and acquired without authorization.","supporting_quote":null,"technology_involved":["CaptureRx"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CaptureRx"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"6ac900f646cc","name":"CaptureRx"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a14da243115bbdf60d536eb0daec47cec00b4cee","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/S.%20McFadden%20CPA%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"ae54432b7479","org_name":"Stephen F. McFadden CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542117"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/S.%20McFadden%20CPA%20Letter.pdf"}],"summary":"Stephen F. McFadden reported an investigation after learning that a tax return had already been filed, but investigators had not identified signs of data access or exfiltration.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-06-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"08830d247e3bb3cbc896a969968e1b91f234dd81","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10488.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"113423374bc1","org_name":"Royal Caribbean Group","org_type":"transportation_logistics","ransomware":null,"records_affected":502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10488.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10488.pdf"}],"summary":"A third party gained unauthorized access to a limited number of Royal Caribbean Group employees’ email accounts, potentially exposing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"048344df0fa70075c6331df54943faf88d6b0761","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10725.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"19235947a55c","org_name":"Made In Oregon","org_type":"retail_ecommerce","ransomware":null,"records_affected":12890,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10725.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MadeInOregon.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Made%20In%20Oregon-2021-07-21"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10725.pdf"}],"summary":"Made In Oregon reported that an unauthorized party may have accessed personal information submitted with orders through madeinoregon.com between September 2020 and March 2021.","supporting_quote":null,"technology_involved":["madeinoregon.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-22","discovered_date":"2021-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77f0c0780a1cdac9feab7105503ed05fbb215296","impact_type":"data_theft","incident_date":"2021-04-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"222e313ddb83","org_name":"Amgen Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542098"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letters.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Amgen%20Inc.-2021-06-22"}],"summary":"An unauthorized party compromised a ZS Associates service account and accessed files related to Amgen that may have been downloaded.","supporting_quote":"On May 27, 2021, Amgen was notified by one of our service providers, ZS Associates (“ZS”), of a security incident in which an unauthorized party compromised a ZS service account and accessed and may have downloaded certain files related to Amgen between April 21, 2021 and May 14, 2021.","technology_involved":["ZS Associates","service account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ZS Associates"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"409c0deaaa37","name":"ZS Associates"}]}},{"actor":{"category":"external","country":"MY","motive":"ideology","name":"Dragon Force","variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3267c5bb91635226fcf066416a4cbfd428e81898","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"856b7ff0-8e77-11ec-8536-fdd879d89dfb"},"incident_date":"2021-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"bd6bbf4bfb72","org_name":"AcadeME","org_type":"other","ransomware":null,"records_affected":280000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/personal-information-of-over-200-000-students-leaked-533351.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesofisrael.com/pro-palestinian-hackers-steal-info-on-hundreds-of-thousands-of-israeli-students/"}],"summary":"Personal information on approximately 280,000 students in Israel was compromised last week in a cyberattack on the company AcadeME. May Brooks-Kempler of the Think Safe Cyber Facebook group estimates that about 280,000 current or former students may have had their personal inform","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"dragonforce"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-18","discovered_date":"2021-04-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a896481b2bd51cd115b70bf25858a3076b96c81b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/VistaTitle.pdf"},"notes":null,"org_country":"US","org_id":"4d1c88ffbdfb","org_name":"Vista Title and Escrow","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/VistaTitle.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/VistaTitle.pdf"}],"summary":"Vista Title and Escrow reported that an unauthorized individual accessed an email account from April 21 to April 30, 2021, and that the account contained a recipient’s information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-18","discovered_date":"2021-04-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f066eda463fd20438b220892bf1baa146396255","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_G5434_Prominence%20Health%20Plan_L01_SAS_0%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"bb854d991dd0","org_name":"Prominence Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542006"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_G5434_Prominence%20Health%20Plan_L01_SAS_0%20%281%29.pdf"}],"summary":"Prominence Health Plan reported unauthorized access to call recordings and healthcare claim-related files, with no interruption to member services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-18","discovered_date":"2021-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"b49f11ed727b8210ec68deab9fdc176784a63494","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NewFedMortgage.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9298136abf3c","org_name":"New Fed Mortgage","org_type":"financial","ransomware":true,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NewFedMortgage.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NewFedMortgage.pdf"}],"summary":"New Fed Mortgage discovered a ransomware attack that encrypted its network and involved unauthorized access to information on its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1381a6f6cabd714b00ddc19097535f6a4fe960df","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01.pdf"},"notes":null,"org_country":"US","org_id":"9a507b67c69c","org_name":"Naito Corporation dba Made In Oregon","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542062"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01.pdf"}],"summary":"An unauthorized party may have accessed personal and credit card information submitted with orders through Made In Oregon’s website between September 2020 and March 2021.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-18","discovered_date":"2021-04-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4365665572c8d9b61b8d9cbee2eb19a6a4ef580a","impact_type":"unknown","incident_date":"2021-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2c62c5526ce","org_name":"Charles E. Jones, DDS PC","org_type":"unknown","ransomware":null,"records_affected":6493,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Charles%20E.%20Jones%2C%20DDS%20PC%20d/b/a%20Jones%20Family%20Dental-2021-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-18","discovered_date":"2021-06-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1ccdf6fc5a218b73e1191fa805e8f99cb42c55a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AmeriFirst%20O365%20-%20Draft%20Consumer%20Notification%20%28Letter%201%20-%20CA%29.pdf"},"notes":null,"org_country":"US","org_id":"638b101186da","org_name":"AmeriFirst Financial, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542030"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AmeriFirst%20O365%20-%20Draft%20Consumer%20Notification%20%28Letter%201%20-%20CA%29.pdf"}],"summary":"AmeriFirst Financial determined that Microsoft Office 365 email accounts had been compromised, potentially exposing customers’ personal and financial information.","supporting_quote":null,"technology_involved":["Microsoft Office 365","email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"086620111d79fe3cb6bef9b3f2519e996dcaebf9","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/STG%20International%2C%20Inc.%20%28STGi%29%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"441830a14fca","org_name":"STG International, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email phishing campaign targeting employee email accounts resulted in unauthorized logins.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/STG%20International%2C%20Inc.%20%28STGi%29%20-%20Sample%20Notice.pdf"}],"summary":"A phishing campaign led to unauthorized logins to STG International employee email accounts, but the organization could not determine whether specific emails or attachments were viewed.","supporting_quote":"The investigation determined that an email phishing campaign targeted certain employees’ email accounts and resulted in unauthorized person(s) intermittently logging into the accounts between October 22, 2020 and January 12, 2021.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-16","discovered_date":"2021-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1098f1261bfd52fa6fd1aa27a51077ba995f4aa7","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Weiss%20%26%20Company%20notification%20letter%20-%206.12.21%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"8901e62eb8fb","org_name":"Kenneth Weiss and Company PC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541920"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Weiss%20%26%20Company%20notification%20letter%20-%206.12.21%20FINAL.pdf"}],"summary":"An unauthorized party accessed the company’s internal servers and computers, and personal information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2021-06-16","discovered_date":"2021-04-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db63ea36690fcd39fed141ca72143461af0a0779","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f576ab760970","org_name":"Herff Jones, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Herff%20Jones%2C%20LLC-2021-06-16"}],"summary":"Herff Jones reported unauthorized access to payment systems and customer information, including payment card information.","supporting_quote":null,"technology_involved":["payment systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-16","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4988def809d1fca2ee3ca080a4ce44e18eb0d261","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10484.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"95c9f6cbf9f7","org_name":"Buffalo State College Foundation","org_type":"nonprofit","ransomware":true,"records_affected":536,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10484.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10484.pdf"}],"summary":"Buffalo State College Foundation reported that data was removed from Blackbaud's systems during a security incident that included an attempted ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25c366448659afce75501c9675075589e4606913","impact_type":"unknown","incident_date":"2021-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aspiration%20Financial%20LLC.pdf"},"notes":null,"org_country":"US","org_id":"9be416b794ef","org_name":"Aspiration Financial, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541918"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aspiration%20Financial%20LLC.pdf"}],"summary":"Aspiration Financial, LLC issued a consumer notification letter concerning a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28781a7737d8662ec112d05a4e854ec9fefb5802","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-17","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Archbishop%20Mitty-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d54371874716","org_name":"Archbishop Mitty High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541910"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Archbishop%20Mitty-%20Sample%20Notice.pdf"}],"summary":"Archbishop Mitty High School reported that former students’ personal information stored in Blackbaud’s Financial Edge platform was exposed following a cyberattack on Blackbaud.","supporting_quote":"In late September 2020, Blackbaud advised Archbishop Mitty High School that backup files containing personal information of certain former students were exposed to an unauthorized individual(s) following a cyber -attack on Blackbaud.","technology_involved":["Blackbaud","Financial Edge"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-15","discovered_date":"2021-05-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c8f4b223b30cd6d06dfb31eefab5462509d3db9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10483.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9a09c1cb366b","org_name":"Washington State Department of Labor & Industries","org_type":"government","ransomware":null,"records_affected":16466,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10483.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10490.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10483.pdf"}],"summary":"A physical therapy clinic representative with authorized access to the scheduling system could view appointments for workers who were not patients at the clinic.","supporting_quote":null,"technology_involved":["scheduling system"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec787b053d84a3eae1f1f321456daeb960b794f2","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"224100334ee1","org_name":"Fotolog","org_type":"technology_saas","ransomware":null,"records_affected":16717854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fotolog","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fotolog"}],"summary":"Fotolog suffered a data breach in December 2018 that exposed email addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cf1840c3a7b6a23ef8239d8679e0c325e65a3ef","impact_type":"unknown","incident_date":"2021-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5685b82eef04","org_name":"Ally Financial Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541863"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-14","discovered_date":"2021-05-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a0a80877f06cdf4d94548dc1b9b9474d0b67131","impact_type":"unknown","incident_date":"2021-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6fc65b0e33cf","org_name":"St. Charles Health System, Inc. (Covered Entity) submitting due to vendor breach (Elekta, Inc.)","org_type":"unknown","ransomware":null,"records_affected":4687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Charles%20Health%20System%2C%20Inc.%20%28Covered%20Entity%29%20submitting%20due%20to%20vendor%20breach%20%28Elekta%2C%20Inc.%29-2021-06-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-11","discovered_date":"2020-09-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3756a51c0b244f4692ad3d9e7f6401ff6b157e2d","impact_type":"data_theft","imported_from":null,"incident_date":"2020-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10482.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f07d611fa03c","org_name":"Sincera Reproductive Medicine","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10482.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10482.pdf"}],"summary":"Sincera Reproductive Medicine reported that an unauthorized actor accessed its systems and may have exfiltrated patient data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74db39a61276e3aa77f3af10139c40fbe7bb0725","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/San%20Dieguito%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"07983445ed89","org_name":"San Dieguito Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541810"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/San%20Dieguito%20Sample%20Notice.pdf"}],"summary":"A former student sent an email to the student body with an attachment containing student information and San Dieguito email account credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-11","discovered_date":"2021-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2716eb144b8f72b1adf6915b3234fd24dfabf9c","impact_type":"both","imported_from":null,"incident_date":"2021-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hoya%20-%20Individual%20Phase%203%20Letter%20%28ECP%29-c.pdf"},"notes":null,"org_country":"US","org_id":"8c27c6943b17","org_name":"HOYA Optical Labs of America, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548924"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541821"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hoya%20-%20Individual%20Phase%203%20Letter%20%28ECP%29-c.pdf"}],"summary":"HOYA Optical Labs of America discovered ransomware encryption of files on U.S. servers and workstations, and its investigation found that attackers acquired names, eyecare providers, and in some cases eyewear prescription information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-11","discovered_date":"2021-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e62a34dc3cdd423a9909f70534e93355445c5afc","impact_type":"data_theft","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CaptureRx%20-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6ac900f646cc","org_name":"CaptureRx","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541820"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CaptureRx%20-%20Sample%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/CaptureRx.pdf"}],"summary":"CaptureRx reported that certain electronic files containing personal and prescription information were accessed and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2021-06-10","discovered_date":"2021-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7057db460c52117476019f493486631dcf610191","impact_type":"data_theft","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Audi%20Contact%20Info%20Letter%20Template.pdf"},"notes":null,"org_country":"US","org_id":"97fc9daccbb6","org_name":"Volkswagen Group of America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor left electronic data unsecured, allowing a third party to obtain customer information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541768"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Audi%20Contact%20Info%20Letter%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Volkswagen%20Group%20of%20America%2C%20Inc.-2021-06-10"}],"summary":"Volkswagen Group of America reported that a third party obtained customer contact and vehicle information from electronic data a vendor had left unsecured.","supporting_quote":"We believe the data was obtained when the vendor left electronic data unsecured at some point between August 2019 and May 2021, when we identified the source of the incident.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-10","discovered_date":"2021-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edab1b04379920c70e1b964259f77c9f5e40ffb5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Maricopa%20CCC%20District%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b8f57f590841","org_name":"Maricopa County Community Colleges District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541788"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Maricopa%20CCC%20District%20Sample%20Letter.pdf"}],"summary":"Maricopa County Community Colleges District detected suspicious activity, prevented a potential ransomware attack, and found an attempted download of a directory file with no evidence it left the system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"097dd5af5bf7850007c777aceac3e60a1291f86b","impact_type":"data_theft","incident_date":"2021-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ABU%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"fce34bf869a6","org_name":"Alderson Broaddus University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541767"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ABU%20Sample%20Letter.pdf"}],"summary":"An unauthorized person accessed Alderson Broaddus University systems and took files containing some individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-10","discovered_date":"2021-04-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4c0d50febd7280ddaee6c72cfa1dc9f898a99ef","impact_type":"disruption_or_ransomware","incident_date":"2021-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Type%20A%20-%20EmpCM%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"da272544e50a","org_name":"AireSpring, Inc.","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541755"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Type%20A%20-%20EmpCM%20Breach%20Notification%20Letter.pdf"}],"summary":"AireSpring became aware that an unauthorized party had accessed certain systems and installed ransomware, where employment-related personal information was stored.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-09","discovered_date":"2021-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"325186780c9126490d4d7778a0556abf5453d2fc","impact_type":"data_theft","incident_date":"2021-04-14","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Warren%20Resources%20-%20Sample%20Notice%20.pdf"},"notes":null,"org_country":"US","org_id":"650dba32acb8","org_name":"Warren Resources, Inc.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541726"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Warren%20Resources%20-%20Sample%20Notice%20.pdf"}],"summary":"Warren Resources reported that an unknown actor accessed and/or took limited data, including names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2021-06-09","discovered_date":"2021-04-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53ca2780360e844c364083f585d1ce0233c90879","impact_type":"data_theft","incident_date":"2021-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Progrexion%20-%20California%20Notice%20of%20Data%20Incident_1.pdf"},"notes":null,"org_country":"US","org_id":"e265d3349e54","org_name":"Progrexion ASG, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Progrexion%20-%20California%20Notice%20of%20Data%20Incident_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Progrexion%20ASG%2C%20Inc.-2021-05-26"}],"summary":"A malicious third party used information it may already have possessed to access Progrexion’s public-facing platforms and potentially view consumer credit and account details.","supporting_quote":null,"technology_involved":["public-facing platforms"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-09","discovered_date":"2021-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b95c42132b744d15776f188e359135f07ab2abef","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alitura%20-%20Consumer%20Notice%20Template_2983236_1.pdf"},"notes":null,"org_country":"US","org_id":"8eeed791e3f2","org_name":"Hnilo Naturals LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alitura%20-%20Consumer%20Notice%20Template_2983236_1.pdf"}],"summary":"Hnilo Naturals found malicious code on its website that may have put customers’ personal and payment card information at risk.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-08","discovered_date":"2020-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cee198dfc14cafad12300fd276a662a6d1d3e18","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HCI%20Consumer%20Notification%20Letter%20-%20%28BEC%29%20%28Adult%20SSN%29%204851-5018-2122%20v2%20%28PRINT%20PROOF%20revised%29.pdf"},"notes":null,"org_country":"US","org_id":"9743b1a1b626","org_name":"HCI LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541698"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HCI%20Consumer%20Notification%20Letter%20-%20%28BEC%29%20%28Adult%20SSN%29%204851-5018-2122%20v2%20%28PRINT%20PROOF%20revised%29.pdf"}],"summary":"HCI LLC reported that an unauthorized individual accessed employee email accounts and may have accessed personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6225351a8e6d93f6e085f5c1a978bc0c0e0b3b20","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"801faad0-1587-11ec-8375-f10617ad68c4"},"incident_date":"2021-06-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9268f586c600","org_name":"City of Freeport, Maine","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pressherald.com/2021/06/15/freeport-town-computer-network-back-up-following-ransomware-attack/"}],"summary":"FREEPORT — The town’s municipal computer network is back up and running after a cyberattack one week ago that has been linked to Russian criminals and a global ransomware group, the town manager said Tuesday.  Logically, a national information technology provider based in Portlan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-07","discovered_date":"2020-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"350713c31077629660ac9ce8d6b90ca54e1cfd7d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Public%20Allies%2C%20Inc.%20-%20Sample%20Letter%20and%20Email.pdf"},"notes":null,"org_country":"US","org_id":"16ac3b508f84","org_name":"Public Allies","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541647"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Public%20Allies%2C%20Inc.%20-%20Sample%20Letter%20and%20Email.pdf"}],"summary":"Public Allies notified affected people that employee or applicant names, usernames, and passwords had been found in an online data leak.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-04","discovered_date":"2021-04-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"569d13d86606c173b70715619fc2c00791dc9f87","impact_type":"data_theft","incident_date":"2021-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10810.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0d75fbc26d94","org_name":"Providence Health Plan","org_type":"healthcare","ransomware":null,"records_affected":220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Providence%20Health%20Plan-2021-06-04"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10810.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10810.pdf"}],"summary":"A temporary worker emailed a spreadsheet containing protected health information to their personal email address on three occasions.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-04","discovered_date":"2021-05-07","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f20015abbdaa7164750a8282175061a618d9b778","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10480.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8e9e5a03bf24","org_name":"Pediatrix Cardiology of Washington, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10480.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10480.pdf"}],"summary":"An external hard drive containing patient information was stolen from a physician's office on May 7, 2021.","supporting_quote":"During the early morning of May 7, 2021, an unauthorized third party entered the office of a single NWCHC physician and stole an external hard drive used for data backup purposes.","technology_involved":["external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01457ed64007db37324527396e109d0e97011e78","impact_type":"both","incident_date":"2021-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CA%20AD581_v03.pdf"},"notes":null,"org_country":"US","org_id":"f3d8834bab8b","org_name":"Victor Valley Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541557"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CA%20AD581_v03.pdf"}],"summary":"Malware encrypted data on District computer systems, and an investigation found that an unauthorized party accessed data including names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-03","discovered_date":"2021-04-25","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"860bca53da6b227f202c857352e8ea6ad9b26165","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Supplemental%20Income-%20California_8.pdf"},"notes":null,"org_country":"US","org_id":"fb9b1344f579","org_name":"Supplemental Income Trust Fund","org_type":"financial","ransomware":null,"records_affected":34858,"reviewed":false,"root_cause":"A likely phishing attack resulted in compromise of a single email account at the Administrator.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541552"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Supplemental%20Income-%20California_8.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Supplemental%20Income%20Trust%20Fund%3B%20MonRoc%20Administrators%20LLC-2021-06-03"}],"summary":"A likely phishing attack compromised an email account at MonRoc Administrators LLC containing Supplemental Income Trust Fund plan members’ personal and financial information.","supporting_quote":"The Administrator became aware and notified the Plan that it was the victim of a likely phishing attack resulting in the compromise of a single email account at the Administrator.","technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MonRoc Administrators LLC"},"updated_at":"2026-10-12","veris_action":"social","derived":{"vendors":[{"id":"9d56448f5d44","name":"MonRoc Administrators LLC"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-06-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"901a22623a69ca978c9440a6fb27ac00cb034408","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10479.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0129cb474924","org_name":"Supplemental Income 401(k) Plan","org_type":"financial","ransomware":null,"records_affected":1085,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10479.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10479.pdf"}],"summary":"A likely phishing attack compromised an email account at the Plan Administrator containing files with personal and financial information.","supporting_quote":"The Administrator became aware and notified the Plan that it was the victim of a likely phishing attack resulting in the compromise of a single email account at the Administrator.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9238bf352a9d09d184149e3bee28a7c4f0da5189","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/IntermountainFarmersAssociation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"67c1cae2aad8","org_name":"Intermountain Farmers Association","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/IntermountainFarmersAssociation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2021-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9e92701fc28dbb6831659606c7d6a3eb8eb8664","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"bc47c647e566","org_name":"Domino's India","org_type":"retail_ecommerce","ransomware":null,"records_affected":22527655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Domino's India","type":"hibp","url":"https://haveibeenpwned.com/Breach/DominosIndia"}],"summary":"Domino's India acknowledged a data breach involving customer contact details, physical addresses and order histories.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-03","discovered_date":"2021-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b01ed525a491a2940c3cca31d964825198c64064","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-14","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DiCon%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"cefbd3086b7c","org_name":"DiCon Fiberoptics, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541544"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DiCon%20-%20California%20Notification.pdf"}],"summary":"DiCon Fiberoptics identified unauthorized access to files on a file server, including a human resources file containing a person’s name and Social Security number, and reported that certain devices stopped working.","supporting_quote":null,"technology_involved":["file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8e630b0d052fd310570fa822270788a15b59bb3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"fa20f24ca93e","org_name":"JD.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JD","type":"hibp","url":"https://haveibeenpwned.com/Breach/JD"}],"summary":"A 2013 data breach at JD.com exposed email addresses, usernames, phone numbers and SHA-1-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52b5ca525d1962924467911b0c7cdc6df4760a68","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9997afc0-3be4-11ec-963f-f964320be408"},"incident_date":"2021-06-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b22f44415a88","org_name":"Des Moines Area Community College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.radioiowa.com/2021/06/17/dmacc-online-classes-resume-after-two-week-suspension/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ia-des-moines-area-community-college-investigating-possible-breach/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","other"],"disclosed_date":"2021-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44cbb5f105ab911a726f3cb58d2d5e251c65875f","impact_type":"both","incident_date":"2021-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Azusa%20Website%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2fb9b6742362","org_name":"City of Azusa Police Department","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541528"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Azusa%20Website%20Notice.pdf"}],"summary":"The City of Azusa Police Department reported a ransomware attack in which certain systems were inaccessible and information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-06-02","discovered_date":"2021-05-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc3430b96e6e759e4cafcbfda4fcbf2f101bf9c8","impact_type":"both","incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10478.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1749406faef2","org_name":"Asarco, LLC","org_type":"manufacturing","ransomware":true,"records_affected":670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10478.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10478.pdf"}],"summary":"Asarco reported that ransomware encrypted some servers, and later discovered that personal information may have been improperly acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0890a61ade845c4d0521fec2b70f2cf01d25689d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e89b3be0-d821-11eb-a5a2-812629c6bc41"},"incident_date":"2021-06-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"6dffe36be2e0","org_name":"AMT","org_type":"professional_services","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/battle-galaxy-gamers-data-leak/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.teiss.co.uk/battle-for-the-galaxy-server-data-leak/"}],"summary":"A Chinese game developer has accidentally leaked nearly six million player profiles for the popular title Battle for the Galaxy after misconfiguring a cloud database, Infosecurity has learned.  AMT Games, which has produced a string of mobile and social titles with tens of millio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64cb9bd84c9c99d55bad4d3088937d4ca5519103","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f416960-3b1d-11ec-ba5b-a1f2db3b8242"},"incident_date":"2021-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b807bda25be","org_name":"Vicksburg Warren School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.actionnews5.com/2021/06/15/vicksburg-warren-school-district-investigating-security-incident-after-becoming-target-ransomware-attack/"}],"summary":"Vicksburg Warren School District investigating ‘security incident’ after becoming target of ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-06-01","discovered_date":"2021-05-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68cb1f94920e4b5726b875f9875fc21a79985a9a","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Scripps%20Health-%20Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d4164d7bf030","org_name":"Scripps Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Scripps%20Health-%20Sample%20Notice.pdf"}],"summary":"An unauthorized person accessed Scripps Health’s network, deployed malware, and acquired copies of documents containing patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"130e0482a5923029eb453bf8bd78461a04f5f4bd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58d91310-3bea-11ec-963f-f964320be408"},"incident_date":"2021-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"564635140f9a","org_name":"Fuji Film","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/17727"}],"summary":"FujiFilm is investigating a ransomware attack and has shut down portions of its network to prevent the attack's spread.  FujiFilm, also known as just Fuji, is a Japanese multinational conglomerate headquartered in Tokyo, Japan, which initially started in optical film and cameras.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2021-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"251fceb64cfda1862fd2a0042df27c14e79aa96c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f8336440-4894-11ec-be64-495e033b0bce"},"incident_date":"2021-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e097dfaa1552","org_name":"Epilepsy Foundation of Texas","org_type":"healthcare","ransomware":null,"records_affected":2824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/3-indiana-clinics-suffer-healthcare-data-breaches;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/epilepsy-foundation-of-texas-provides-notice-of-privacy-event-301389718.html"}],"summary":"On or around June 8, 2021, the Epilepsy Foundation of Texas discovered fraudulent emails being sent out of an employee email account. Upon discovery, the Epilepsy Foundation of Texas contacted its IT personnel who determined that the email account had been the subject of a phishi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a952539bb4514dc79dd798677ba4f2b9e692ba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c238b060-374c-11ec-a7f4-f1e825b21d01"},"incident_date":"2021-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"a24785108f13","org_name":"Edward Don","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/foodservice-supplier-edward-don-hit-by-a-ransomware-cyberattack-533188.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/foodservice-supplier-edward-don-hit-by-a-ransomware-attack/"}],"summary":"Foodservice supplier Edward Don has suffered a ransomware attack that has caused the company to shut down portions of the network to prevent the attack's spread.  Edward Don and Company is one of the largest distributors of foodservice equipment and supplies, such as kitchen supp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20444ee84e1b68f2609055d54440faeea790151f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"949e3930-d433-11eb-a192-c5509024cd4a"},"incident_date":"2021-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"c9e653f84f81","org_name":"AMT games","org_type":"technology_saas","ransomware":null,"records_affected":5600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://illinoisnewstoday.com/6m-battle-for-the-galaxy-player-data-leaked-via-unprotected-cloud-server/235420/"}],"summary":"AMT games misconfigured an elasticsearch database and exposed the records on 5.9 million gamers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"excessive_privilege","credential_source":null,"cve":[],"data_types":["personal","medical","other"],"disclosed_date":"2021-06-01","discovered_date":"2021-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8e12eb26a8c94c8bfaeef6d4b3b134dcd28a989","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10474.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"c07c623f5ce0","org_name":"American Councils for International Education","org_type":"education","ransomware":null,"records_affected":119,"reviewed":false,"root_cause":"Program finalists were inadvertently given administrator-level viewing access instead of user access, allowing them to view other people's records.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10474.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10474.pdf"}],"summary":"American Councils for International Education inadvertently gave program finalists administrator-level viewing access to its AIS Forms database, making other applicants' and participants' records accessible.","supporting_quote":"The program finalists were inadvertently given administrator-level view access, rather than user access that would allow them to upload their own application-related documents to the system but not view anyone else's records.","technology_involved":["AIS Forms database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a68d664369b2cf0e094d7e80c4ab83a70a7c91","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f73948c0-8de0-11ec-bb25-234a6ad089e5"},"incident_date":"2021-05-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"7a90da7b5d56","org_name":"Nucleus Software Exports","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://therecord.media/epsilonred-ransomware-group-hits-one-of-indias-financial-software-powerhouses/"}],"summary":"Nucleus Software Exports, an Indian company that provides lending software to banks and retail stores, has suffered a major ransomware attack that crippled some of its internal networks and encrypted sensitive business information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa2be9194c4df289f271ff6e960aedbd9449b40c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20-20%20-%20Sample%20Letter.PDF"},"notes":null,"org_country":"US","org_id":"31c2f0fae6c3","org_name":"20/20 Eye Care Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541414"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20-20%20-%20Sample%20Letter.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/2020EyeCare.PDF"}],"summary":"An unknown person accessed 20/20 Eye Care Network's system and deleted files, and personal and health information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-28","discovered_date":"2021-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4fd3b816a12662b65d5ef141e32f039ec6c847b","impact_type":"data_theft","incident_date":"2021-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WM%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"20eac7b090f4","org_name":"USA Waste-Management Resources, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WM%20-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#USA%20Waste-Management%20Resources%2C%20LLC-2021-05-28"}],"summary":"An unauthorized actor accessed the organization’s environment and took a limited number of files; potentially accessed files may have contained individuals’ personal information, but the organization had no evidence those files were taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3e11c184d70c307b8c48d159b88a6ff4b4650d48","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10703.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71292cce5676","org_name":"Osborn Cancer Care","org_type":"unknown","ransomware":null,"records_affected":4305,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10703.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea2aad235c4cf6a11577dba44085fba0b171c5d5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b63e2b0-35b4-11ec-be76-613d00a742ca"},"incident_date":"2021-05-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"9fea240a0a32","org_name":"Municipality of Rolle","org_type":"other","ransomware":true,"records_affected":5393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://marketresearchtelecast.com/switzerland-citizen-and-municipality-data-published-on-darknet/142498/"}],"summary":"At the end of May, the municipal administration of the tranquil town of Rolle in French-speaking Switzerland was the victim of a cyber attack. This became known to the public recently through research on the news portal watson.ch. The result of the attack: The data of all residen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-27","discovered_date":"2020-05-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab03cfeb8ab66e03de225862d9424e22bd80eba1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/STG%20III%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"af9bde1e5ce8","org_name":"STG Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/STG%20III%20-%20Sample%20Letter.pdf"}],"summary":"STG determined that employee email accounts were accessed without authorization between May 3 and May 19, 2020, and personal information may have been affected.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-05-27","discovered_date":"2021-01-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0d9c8f43c3292f180b761919ffcd7cd089d76ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Plains%20Commerce%20Bank%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f5fa90d1f1e1","org_name":"Plains Commerce Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541365"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Plains%20Commerce%20Bank%20-%20Sample%20Letter.pdf"}],"summary":"Plains Commerce Bank reported that an unknown perpetrator may have accessed ten employee email accounts, potentially exposing personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2021-05-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5d07636d92f841166c08d3e98b651e8aae8b35c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc1e6070-3bf2-11ec-963f-f964320be408"},"incident_date":"2021-05-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"c38ba46b05a1","org_name":"Lotenal (National Lottery of Mexico)","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://mexiconewsdaily.com/news/lottery-agency-mum-after-hack/"}],"summary":"A group of hackers that claims to have infiltrated the computer servers of the National Lottery (Lotenal) has threatened to reveal confidential information if the agency refuses to cooperate with it.  A criminal group claims to have accessed Lotenal’s servers last Thursday using ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bb090656105451901ecf10e1178b2d24d85a909","impact_type":"unknown","incident_date":"2020-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/21.05.26%20Sample%20Notice%20Letter%20%28Experian%20Version%29%20%28Redacted%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dfd20dcca13a","org_name":"Accucom Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541332"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Accucom%20Corporation-2021-05-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-26","discovered_date":"2021-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bde9c6e13f1dcf77e92023a293183ec02a7e7fb6","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UL%20Notification%20V1.pdf"},"notes":null,"org_country":"US","org_id":"ab41c2f868df","org_name":"Underwriters Laboratories Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UL%20Notification%20V1.pdf"}],"summary":"UL reported unauthorized access to personal information that included names, Social Security numbers, and dates of birth.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1087274dc48333cc4d69c777bc75541f5a51a334","impact_type":"unknown","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/REDACTED.%20EXPERIAN_G4831_Building%20Materials%20Distributors_L03_SAS_6%20%289621233x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d56c49b6fda9","org_name":"Building Material Distributors, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541316"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2021-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41f902401fdd9528766a45b1c20e2056f2e3d2ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sugarfina%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"97ad0130aec8","org_name":"Sugarfina USA, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541284"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sugarfina%20-%20Sample%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sugarfina%20USA%2C%20LLC-2021-05-25"}],"summary":"Sugarfina reported that malicious code on its website may have exposed customers’ payment card information and, if provided, usernames and passwords; it could not confirm whether payment cards were accessed.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bbd534f60eeef6ac6bb9faf272dfe37659e7c44","impact_type":"unknown","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Infinity-%20Sample%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f44f1efc6053","org_name":"Infinity Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541278"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Infinity%20Insurance%20Company-2021-05-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51b7352fce6615ad0c481760c824d9aa1258c54a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eec19400-d827-11eb-a5a2-812629c6bc41"},"incident_date":"2021-05-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d54fc43cfff","org_name":"Spine & Disc Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/phoenix-chiropractic-practice-offline-after-ransomware-attack/"}],"summary":"Spine & Disc Medical Center in Phoenix, Arizona is a chiropractic practice. They have apparently been the victims of a ransomware attack by Avaddon threat actors, who added them to their leak site and dumped some data as proof of claims.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41625d0e3ecce0750639362aa27094c71e79c690","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ES","org_id":"82987ce5842d","org_name":"MobiFriends","org_type":"technology_saas","ransomware":null,"records_affected":3512952,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MobiFriends","type":"hibp","url":"https://haveibeenpwned.com/Breach/MobiFriends"}],"summary":"A January 2020 breach at MobiFriends exposed email addresses, usernames, genders, dates of birth, and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"254132145f288429c47c154a569245defc4ec5ca","impact_type":"data_theft","imported_from":null,"incident_date":"2013-06-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"TW","org_id":"502399e8d40b","org_name":"Yam","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Yam","type":"hibp","url":"https://haveibeenpwned.com/Breach/Yam"}],"summary":"Yam.com suffered a data breach in June 2013 exposing personal information and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":["Yam.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b057fc117bcd459b39b8e22306eb2ad0fb3b1bc8","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"675ef7b7cff9","org_name":"Moneycontrol","org_type":"financial","ransomware":null,"records_affected":762874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Moneycontrol","type":"hibp","url":"https://haveibeenpwned.com/Breach/Moneycontrol"}],"summary":"Data associated with Moneycontrol, including personal information and plain-text passwords, was posted for sale in April 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2021-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bd9698d90e89247c5129c75680b8f24d2f6b4d5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-08-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"43fd747048c1","org_name":"Livpure","org_type":"retail_ecommerce","ransomware":null,"records_affected":269552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Livpure","type":"hibp","url":"https://haveibeenpwned.com/Breach/Livpure"}],"summary":"A breach of Livpure exposed customer purchase details and personal information, including names, email addresses, phone numbers and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"185b7d68f25149940dce2117baf1e314ba5908bf","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"dd52a67bb2e6","org_name":"IIMJobs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: IIMJobs","type":"hibp","url":"https://haveibeenpwned.com/Breach/IIMJobs"}],"summary":"A December 2018 breach at IIMJobs exposed personal information and passwords for 4,216,063 accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-05-21","discovered_date":"2021-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9f0dea24e2bfd890e1df7c4bfefad7a2f16d5d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Defender%20-%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"35530ed891a2","org_name":"Defender Industries, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541157"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Defender%20-%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Defender%20Industries%2C%20Inc.-2021-05-21"}],"summary":"Defender Industries reported a malware incident on its e-commerce platform that may have involved customers’ payment card and personal information.","supporting_quote":null,"technology_involved":["e-commerce platform","online payment system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4df94bf7b1a0cf60f321f0626e5eee8e82377a4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"17547f2b2289","org_name":"Daily Quiz","org_type":"other","ransomware":null,"records_affected":8032404,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Daily Quiz","type":"hibp","url":"https://haveibeenpwned.com/Breach/DailyQuiz"}],"summary":"Daily Quiz's January 2021 breach exposed email addresses, IP addresses, usernames, and plaintext passwords.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f10722c1fc8006b83ea6b5e838b2bd2cb990dea9","impact_type":"unknown","incident_date":"2020-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aon%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3b9c1f84a3d6","org_name":"Custom Benefit Programs, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541189"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aon%20Notification.pdf"}],"summary":"Custom Benefit Programs, Inc. notified affected people of a security incident and offered credit monitoring.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bc6929181d78318fca8db42bc4aebe3f1d10308","impact_type":"data_theft","incident_date":"2020-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Atrium%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"da2ccb33d8d0","org_name":"Atrium Windows and Doors, Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Atrium%20Sample%20Letter.pdf"}],"summary":"Atrium Windows and Doors reported that an unauthorized party acquired information stored on its systems in late December 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-21","discovered_date":"2021-03-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5cc3ae3355f5a24d553435da8589ed04bd10d42e","impact_type":"unknown","incident_date":"2021-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c657fa232fb9","org_name":"Aspen Dental Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":10147,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aspen%20Dental%20Management%2C%20Inc.-2021-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"excessive_privilege","credential_source":"unknown","cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cf0a017c1275391a7d86731b2ceb17412910d6c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ZocDoc%20Sample%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"9137e0e382cc","org_name":"ZocDoc, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Programming errors allowed practice staff to access the Provider Portal after their usernames and passwords were intended to be removed, deleted, or limited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541087"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ZocDoc%20Sample%20Consumer%20Notice.pdf"}],"summary":"Programming errors allowed some past or current medical practice staff members to access Zocdoc’s Provider Portal after their usernames and passwords were intended to be removed or limited.","supporting_quote":"Beginning in August 2020, we learned of programming errors that allowed some past or current practice staff members to access the Provider Portal after their usernames and passwords were intended to be removed, deleted or otherwise limited.","technology_involved":["Zocdoc Provider Portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2021-05-19","discovered_date":"2021-02-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48d2705ea1cc735d5678e70939c16aa9312d4365","impact_type":"data_theft","incident_date":"2021-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RMCHCS%20-%20CA%20Individual%20Notice%20Template%20-%202021.05.19.pdf"},"notes":null,"org_country":"US","org_id":"57bf69655371","org_name":"Rehoboth McKinley Christian Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541055"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RMCHCS%20-%20CA%20Individual%20Notice%20Template%20-%202021.05.19.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rehoboth%20McKinley%20Christian%20Health%20Care%20Services-2021-05-19"}],"summary":"An unauthorized party accessed systems containing personal information and removed some data between January 21 and February 5, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9da30543cd95466c6e6c7706e2aa92022dbdb370","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8bf10683401","org_name":"Penobscot Community Health Center","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Penobscot%20Community%20Health%20Center-2021-05-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-19","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2407885a1496787887eda9ab2fe0b8ffb8f56ca0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BenefitsResourcePlanning.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3465f565f183","org_name":"Benefit Resources and Planning","org_type":"financial","ransomware":null,"records_affected":2210,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BenefitsResourcePlanning.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BenefitsResourcePlanning.pdf"}],"summary":"An unauthorized third party accessed an email account assigned to Benefit Resources and Planning by Lincoln Financial Securities, potentially exposing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Lincoln Financial Securities"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"137ba552406b","name":"Lincoln Financial Securities"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d065f57e44ad8559bd8fd61dc00a2523b49fcae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ec8a860-3c0b-11ec-963f-f964320be408"},"incident_date":"2021-05-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71431faa2a41","org_name":"Visalia Unified","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kmph.com/news/local/visalia-unified-hit-by-a-ransomware-attack-investigation-under-way"}],"summary":"FRESNO, Calif. (FOX26) — Visalia Unified says it has experienced a Ransomware attack and, as a result, many of its district IT systems are offline.  The district says the attack happened Tuesday morning.  It has notified local and federal law enforcement agencies.  \"The district ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2021-05-18","discovered_date":"2021-04-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fd92a42171e5515b19df8f07a44989cd423b34a","impact_type":"data_theft","imported_from":null,"incident_date":"2019-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOCO%20Indiana%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"dc2d6cfc760b","org_name":"The NOCO Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOCO%20Indiana%20Notice.pdf"}],"summary":"The NOCO Company reported that malicious code on its website allowed an unauthorized party to access information entered there, including payment card and account information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"202d17598e221df115833a1ce524fc87f035b010","impact_type":"data_theft","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CaptureRx%20Data%20Security%20Event%20Patient%20Notice%205-18-21.pdf"},"notes":null,"org_country":"US","org_id":"0e1353952bef","org_name":"Marshall Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540981"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CaptureRx%20Data%20Security%20Event%20Patient%20Notice%205-18-21.pdf"}],"summary":"CaptureRx reported that unauthorized parties accessed and acquired files containing Marshall Medical Center patients’ personal and prescription information.","supporting_quote":null,"technology_involved":["CaptureRx","electronic files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CaptureRx"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"6ac900f646cc","name":"CaptureRx"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-18","discovered_date":"2020-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90bb221c1422ee35ab99a7f1ee57495e348f5982","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HPSJ%20-%20Notice%20-%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"a8a717358b20","org_name":"Health Plan of San Joaquin","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-541021"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HPSJ%20-%20Notice%20-%20CA_1.pdf"}],"summary":"An unknown person accessed certain Health Plan of San Joaquin employee email accounts between September 26 and October 12, 2020, potentially exposing personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-17","discovered_date":"2021-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ebba86e27bfd7287de61629ad2298301edc02d3","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian%20Individual%20Notification%20Template.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"25c2484c18ec","org_name":"Maximus","org_type":"professional_services","ransomware":null,"records_affected":334000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/ohio-medicaid-provider-suffers/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542219"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian%20Individual%20Notification%20Template.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10486.pdf"}],"summary":"Maximus reported that an unknown party accessed a server containing personal information starting May 17, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1489"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70cda00df52b9af0427c2cc89b43e1d1129a01cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REEF%20CA%20letter.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"dd7623f5e65e","org_name":"REEF Global Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540906"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REEF%20CA%20letter.pdf"}],"summary":"REEF Global Inc. reported unauthorized access to files on its file servers and said some files may have contained individuals’ names and Social Security numbers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a70818fbcc8877de9c12dd6b2d3560b76b1460f","impact_type":"data_theft","incident_date":"2021-03-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Phillip%20Galyen%20PC%20-%20Substitute%20Website%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2e4448097c1e","org_name":"Phillip Galyen PC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540921"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Phillip%20Galyen%20PC%20-%20Substitute%20Website%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Phillip%20Galyen%20PC-2021-05-14"}],"summary":"Phillip Galyen PC reported that a malicious actor may have accessed its network and acquired personal information associated with clients and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"606ebfac2410fabccd5eef77320071cfb1266af7","impact_type":"unknown","incident_date":"2020-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20Proof%20-%20Redacted%20%289598931x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ad03c8a08a7","org_name":"M Bar C Construction","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540902"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"16052d7576be1c251fbd7d20af0d184c53cff4e6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/CareSC.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"28715c7804a6","org_name":"CareSouth Carolina","org_type":"healthcare","ransomware":null,"records_affected":68247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/CareSC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/CareSC.pdf"}],"summary":"CareSouth Carolina notified affected individuals of a security incident and offered identity-protection services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-14","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"84aa27addb8f583fad4e75a407253233367d6486","impact_type":"data_theft","incident_date":"2021-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/InsuranceTechCorp.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d9532dd9ddd8","org_name":"Atkins & Associates Insurance LLC","org_type":"financial","ransomware":null,"records_affected":1307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/InsuranceTechCorp.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/InsuranceTechCorp.pdf"}],"summary":"Atkins & Associates Insurance LLC customer information stored in Insurance Technologies Corporation’s AgencyMatrix application was accessed and acquired by an unauthorized third party.","supporting_quote":null,"technology_involved":["AgencyMatrix"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Insurance Technologies Corporation"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"6091ab6bfac5","name":"Insurance Technologies Corporation"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"582a5e0768fdf4e00a19d45687c1ab3aa03de962","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"3c278be2cf81","org_name":"WedMeGood","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WedMeGood","type":"hibp","url":"https://haveibeenpwned.com/Breach/WedMeGood"}],"summary":"A breach exposed customer personal information and password hashes from WedMeGood.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-05-13","discovered_date":"2021-03-29","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd01a5effdd6f30c90e10bc9e5f322cfc88e9d40","impact_type":"data_theft","incident_date":"2020-12-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCOP_General_Notice%20CA%20AG.pdf"},"notes":null,"org_country":"US","org_id":"5aca290c5a50","org_name":"University of California","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Perpetrators exploited a vulnerability in UC's Accellion FTA.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540841"},{"fetched_at":null,"title":"Have I Been Pwned: University of California","type":"hibp","url":"https://haveibeenpwned.com/Breach/UC"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCOP_General_Notice%20CA%20AG.pdf"}],"summary":"The University of California reported that attackers exploited a vulnerability in Accellion FTA and accessed files containing personal information.","supporting_quote":"On December 24, 2020, UC’s Accellion FTA was the target of an international attack, where perpetrators exploited a vulnerability in the application.","technology_involved":["Accellion FTA"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"319d47bee25e6847ed635f64ad29c741f39b7502","impact_type":"data_theft","incident_date":"2021-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2021%20Midvale%20Consumer%20Notification%20Ltr%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"3c236c779dac","org_name":"Midvale Indemnity Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540820"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2021%20Midvale%20Consumer%20Notification%20Ltr%20FINAL.pdf"}],"summary":"Unauthorized parties may have used an automated bot process to obtain driver’s license numbers through Midvale’s quoting platform.","supporting_quote":null,"technology_involved":["Midvale quoting platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"478d7f2233cc3fb1c4fd0dbe5bc6bfe237fc4a68","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c498fc90-35a1-11ec-be76-613d00a742ca"},"incident_date":"2021-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbe0cf690c20","org_name":"Epik","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/anonymous-leaks-gigabytes-of-data-from-alt-right-web-host-epik/"}],"summary":"Hacktivist collective Anonymous claims to have obtained gigabytes of data from Epik, which provides domain name, hosting, and DNS services for a variety of clients. These include the Texas GOP, Gab, Parler, and 8chan, among other right-wing sites. The stolen data has been release","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5f4f4354b2c47305de3dffc95fda3586e742ab9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"insider","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AD438_v03%20-%20Adults%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"375414b54cc7","org_name":"County of Orange Social Services Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee with access to SSA computer systems may have inappropriately accessed and used information without a business purpose.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540834"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AD438_v03%20-%20Adults%20Letter.pdf"}],"summary":"A former employee may have inappropriately accessed and used personal, financial, and medical information held by the County of Orange Social Services Agency.","supporting_quote":"A former employee with access to SSA computer systems may have inappropriately accessed and used your and/or your family’s information without a business purpose.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"42119058c85c3568215813b7b9fa4072cde7440c","impact_type":"data_theft","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10465.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2ee5942374fa","org_name":"American Family Mutual Insurance Company, S.I.","org_type":"financial","ransomware":null,"records_affected":5246,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10465.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540819"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2021%20American%20Family%20Consumer%20Notification%20Ltr%20FINAL.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10465.pdf"}],"summary":"Unauthorized parties used an automated bot process on American Family’s quoting platform and may have obtained driver’s license numbers.","supporting_quote":null,"technology_involved":["American Family quoting platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-12","discovered_date":"2021-04-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61d7454b13da4792b3da4725497852ceac2982c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_G4243_Sacramento%20County_L01_SAS_1%20%28FINAL%29.pdf"},"notes":null,"org_country":"US","org_id":"36bf508e25e3","org_name":"Sacramento County IHSS Public Authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A webpage setting allowed unauthorized access to data in the online provider enrollment system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540793"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_G4243_Sacramento%20County_L01_SAS_1%20%28FINAL%29.pdf"}],"summary":"A webpage setting in Sacramento County IHSS Public Authority’s online provider enrollment system allowed unauthorized access to personal data.","supporting_quote":"The webpage setting that allowed unauthorized access was deployed on February 28, 2021.","technology_involved":["online provider enrollment webpage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-11","discovered_date":"2021-03-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b54d6e34db9a17ae42ea07507d8ae1bbaa54d29c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/State%20Auto-%20California%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c2cce354f0e7","org_name":"State Automobile Mutual Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/State%20Auto-%20California%20Sample%20Letter.pdf"}],"summary":"An unknown actor initiated insurance quotes through State Auto’s application, triggering a prefill process that populated some customers’ personal information.","supporting_quote":null,"technology_involved":["insurance quote application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-11","discovered_date":"2021-02-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa4bb10da187194eaea032017a9e9513ba807880","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Oak%20Valley%20-%20CA%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"78050687d1e6","org_name":"Oak Valley Community Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Oak%20Valley%20-%20CA%20Letter.pdf"}],"summary":"Oak Valley Community Bank reported that an unauthorized party accessed a workstation and files on one file server.","supporting_quote":null,"technology_involved":["workstation","file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-11","discovered_date":"2021-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"873247ba47d9d13f8813ed3c4ed2d21f603c043c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-25","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISO01297%20Phase%203%20Breach%20Notification%20Letter%20for%20Website%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"1de3eb7cb4fe","org_name":"California Department of State Hospitals","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee improperly accessed confidential information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540778"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISO01297%20Phase%203%20Breach%20Notification%20Letter%20for%20Website%20FINAL.pdf"}],"summary":"An employee of the California Department of State Hospitals improperly accessed personal and health information.","supporting_quote":"This was discovered during the investigation of the same employee who was found to have improperly accessed approximately:","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-11","discovered_date":"2021-03-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a3eb3176ee48af5b0021ca9776c9fc1cc1cbaba","impact_type":"unknown","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7f635f7c69f6","org_name":"American Family Insurance","org_type":"unknown","ransomware":null,"records_affected":283734,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Family%20Insurance-2021-05-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-05-10","discovered_date":"2021-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7623dae5dd050ecd2fbe7f0b5c0f09817472d652","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-15","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sac%20HealthSystem%20Individual%20AD421_v04.pdf"},"notes":null,"org_country":"US","org_id":"f906253629f9","org_name":"SAC Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540710"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sac%20HealthSystem%20Individual%20AD421_v04.pdf"}],"summary":"SAC Health System confirmed unauthorized access to its data stored on Netgain servers.","supporting_quote":"On January 15, 2021, Netgain disclosed to SAC Health System that a data security incident resulted in the potential for unauthorized access to certain Netgain servers containing SAC Health System’s data between November 15, 2020 and November 22, 2020.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2021-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d56146480bbacd5deb86239e2d29f073be3640f","impact_type":"data_theft","imported_from":null,"incident_date":"2020-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"069dd6067966","org_name":"DriveSure","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DriveSure","type":"hibp","url":"https://haveibeenpwned.com/Breach/DriveSure"}],"summary":"DriveSure suffered a breach in December 2020 in which data including personal information, vehicle details, and some hashed passwords was downloaded and shared on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-10","discovered_date":"2021-01-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"af2218efdfd8aa5db491e9a5f2797349b210a1b0","impact_type":"data_theft","incident_date":"2020-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10464.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"81b38ee2f544","org_name":"Cougar Den, Inc.","org_type":"unknown","ransomware":null,"records_affected":757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10464.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10464.pdf"}],"summary":"Cougar Den determined that unauthorized parties accessed certain email accounts and that information including individuals’ names may have been accessible.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20540376bf2e16f2e2afdb2502404f76d81ea264","impact_type":"data_theft","imported_from":null,"incident_date":"2020-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aspen_California%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"bac0972ccd77","org_name":"Aspen Education Group, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aspen_California%20Notification_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aspen%20Education%20Group%2C%20Inc.-2021-05-10"}],"summary":"An unauthorized person accessed Aspen Education Group’s network, deployed malware, and acquired copies of some documents; the access method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0462b3a7108b2174f184311dbd7cfef2e8fe03a","impact_type":"both","incident_date":"2021-12-03","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SDFC%20-%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"539b8418cd6e","org_name":"San Diego Family Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SDFC%20-%20Notification.pdf"}],"summary":"San Diego Family Care reported that a hosting provider incident encrypted certain data and that some SDFC data may have been accessed or acquired by an unauthorized individual.","supporting_quote":"In December 2020, SDFC and its business associate, Health Center Partners of Southern California (HCP), became aware that our information technology hosting provider experienced a data security incident that resulted in the encryption of certain data.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"756e6cda3f886ff4bbb69a6111802b63c99f4d12","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20notification%20letter%2003.22.21.pdf"},"notes":null,"org_country":"US","org_id":"199b90a68621","org_name":"TradeSource, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540654"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20notification%20letter%2003.22.21.pdf"}],"summary":"TradeSource reported a data security incident on December 27, 2020, in which personal information could have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0873b5566bd64355703a3310d3fc469e25f0007","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Telmate%20Proof%20V3%20General%20Notice%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"257ef6b830ac","org_name":"Telmate, LLC","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An error by a vendor left some personal information accessible through an unsecured server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540651"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Telmate%20Proof%20V3%20General%20Notice%20%28002%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Telmate%2C%20LLC-2021-05-07"}],"summary":"Telmate reported that a vendor error made some personal information accessible through an unsecured server.","supporting_quote":"On August 13, 2020, Telmate, LLC learned that due to an error by one of our vendors, some personal information was inadvertently accessible through an unsecured server.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8a41d88a1aab374d686dfa95260db4fda6401b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20SEIU%20775%20Benefits%20Group%20Ad%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"660327d550d0","org_name":"SEIU 775 Benefits Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540643"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20SEIU%20775%20Benefits%20Group%20Ad%20CA%20r1prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10460.pdf"}],"summary":"Unknown individuals gained access to SEIU 775 Benefits Group systems and deleted information, including personal and protected health information; the organization reported no evidence of downloading or exfiltrating it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-07","discovered_date":"2021-03-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3dc1781a4cf033fd96100ee89839c31c9b7c401b","impact_type":"both","incident_date":"2021-03-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10459.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d0c3d423949b","org_name":"JHT Holdings","org_type":"transportation_logistics","ransomware":true,"records_affected":511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JHT%20Holdings%2C%20Inc.-2021-05-07"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10459.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10459.pdf"}],"summary":"JHT Holdings reported that an unauthorized actor encrypted systems in a ransomware attack and appears to have obtained some data, potentially including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-05-07","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e27bc2f7422cad3c13a12d6e597c7a06323bffb4","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_Exceltox%20Laboratories_AdultProof_1.pdf"},"notes":null,"org_country":"US","org_id":"1c98ef9ab73a","org_name":"Exceltox Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"UPS did not complete redelivery of the document package.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540660"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_Exceltox%20Laboratories_AdultProof_1.pdf"}],"summary":"Exceltox Laboratories reported that a package containing COVID-19 testing documents was lost during UPS delivery, with no confirmed disclosure or misuse.","supporting_quote":"UPS returned the package to its facility for redelivery later, but then never completed redelivery.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"UPS"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"15d709ab281e","name":"UPS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-05-07","discovered_date":"2021-03-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c4f757ef942f4f69e09f60e3f43628d8d94bc200","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10461.pdf"},"notes":null,"org_country":"US","org_id":"3d56a7bc2932","org_name":"Carnival Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10461.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10461.pdf"}],"summary":"Carnival Corporation detected unauthorized access to a limited number of email accounts, and personal information relating to guests, employees, and crew may have been accessed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-07","discovered_date":"2021-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28a6cc27f8d2c2632ebb027b401a3ff57c6981c6","impact_type":"unknown","imported_from":null,"incident_date":"2021-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arabian%20Horse%20Association%20-%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e64181f7325c","org_name":"Arabian Horse Association","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540684"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arabian%20Horse%20Association%20-%20Notification.pdf"}],"summary":"The Arabian Horse Association notified people that their name, address, and Social Security number may have been impacted by data incidents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-07","discovered_date":"2021-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"447dbe62e0bb81411cf1fc8eb2df52c5447b1798","impact_type":"both","incident_date":"2021-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Borrower%201%20Year%20AD402_v01-c.pdf"},"notes":null,"org_country":"US","org_id":"b3402043f7fb","org_name":"Anchor Loans","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Borrower%201%20Year%20AD402_v01-c.pdf"}],"summary":"Anchor Loans discovered a ransomware event that encrypted files, and its investigation found that files containing personal information had been copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-05","discovered_date":"2021-01-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ddbfed96ea23018eb078cf170a5a8c3a06634e2b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10458.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0734244220df","org_name":"Timberland Regional Library","org_type":"government","ransomware":null,"records_affected":26209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10458.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10458.pdf"}],"summary":"Unauthorized access to two Timberland Regional Library employees’ email accounts exposed mailboxes containing limited personal information, including dates of birth.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"12ded17802300e27799e4b5ae0ce9473323da102","impact_type":"unknown","incident_date":"2021-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10457.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"86c8063d0dbd","org_name":"NEC Networks, LLC","org_type":"professional_services","ransomware":null,"records_affected":126193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NEC%20Networks%2C%20LLC%20d/b/a%20CaptureRx-2021-05-05"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10457.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10457.pdf"}],"summary":"NEC Networks, LLC reported a data security incident affecting individuals associated with healthcare providers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-04","discovered_date":"2021-04-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f3ddc79cabfe0b65b4774405501215cbba6ae317","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10456.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5417e204039c","org_name":"Inventors Hall of Fame","org_type":"unknown","ransomware":null,"records_affected":685,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10456.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10456.pdf"}],"summary":"An unauthorized individual may have accessed an employee email account containing personal information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8ce042f30ac976e4fef7de70530aac93f8dd2e5","impact_type":"data_theft","incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20notice%20CA-FFQ.pdf"},"notes":null,"org_country":"US","org_id":"012717116671","org_name":"Farmers Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540538"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20notice%20CA-FFQ.pdf"}],"summary":"Unknown malicious actors targeted Farmers Insurance’s auto quoting system and obtained personal information, including potentially driver’s license numbers.","supporting_quote":null,"technology_involved":["Farmers auto quoting system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-04","discovered_date":"2021-04-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"61cad079c521b74daeacc61e1d2da805011946ed","impact_type":"unknown","incident_date":"2020-07-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a1a9ea3b0ef","org_name":"Acme Construction Supply (\"Acme\")","org_type":"unknown","ransomware":null,"records_affected":2095,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Acme%20Construction%20Supply%20%28%22Acme%22%29-2021-05-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52a7440b5e8c66f066148165251cfecdff1fae75","impact_type":"data_theft","incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20notice%20template-21stC_CA_Final%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"47b2d1d16aa1","org_name":"21st Century Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540528"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20notice%20template-21stC_CA_Final%20%281%29.pdf"}],"summary":"Unknown malicious actors targeted 21st Century Insurance Company’s auto quoting system to obtain personal information, including driver’s license numbers.","supporting_quote":null,"technology_involved":["21st Century auto quoting system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-05-03","discovered_date":"2021-03-04","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c90158b7169575c4db3de24418b41173aac0c3c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sonus_Lancaster_210430.pdf"},"notes":null,"org_country":"US","org_id":"2c91669c840d","org_name":"Sonus Hearing Care Professionals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540476"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sonus_Lancaster_210430.pdf"}],"summary":"Sonus Hearing Care Professionals reported that hard drives and CPUs containing potentially accessible personal and health information were stolen during a burglary at its Lancaster location.","supporting_quote":"The incident involving protected health information was the theft of several hard drives and several CPUs during a burglary in our Lancaster location.","technology_involved":["hard drives","CPUs","clinic computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-05-03","discovered_date":"2021-04-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"642b8af704564898d7f0ace59e0abf7c834944e7","impact_type":"data_theft","incident_date":"2021-03-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OHL%20Template%20Notice%20to%20Affected%20Persons.pdf"},"notes":null,"org_country":"US","org_id":"af5e630983d8","org_name":"OHL North America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540478"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OHL%20Template%20Notice%20to%20Affected%20Persons.pdf"}],"summary":"OHL North America reported that a third party accessed its systems and exfiltrated employee files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-05-03","discovered_date":"2021-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cf656461435f93d6f581ac1d0a88f3f5e5ac68e","impact_type":"both","incident_date":"2021-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCMA%20-%20Substitute%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"6c7e83002bf8","org_name":"Northern California Medical Associates, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCMA%20-%20Substitute%20Notice%20of%20Data%20Event.pdf"}],"summary":"Northern California Medical Associates reported unauthorized access, encryption of certain servers and workstations, and data taken from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"RansomEXX ransomware gang","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2021-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31be059229152466654e1d7efa631fc2f62beb33","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50244a90-35d3-11ec-be76-613d00a742ca"},"incident_date":"2021-05-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"13f28ea2a16d","org_name":"Gigabyte","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/gigabyte-suffers-data-breach-following-ransomware-attack-533713.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://nunewsindustry.com/gigabyte-ransomware-attack-rasomexx-gang-stole-112gb-of-data/"}],"summary":"According to Bleeping Computer, Gigabyte was the target of a ransomware attack last week and are currently being blackmailed with the exposure of 112GB of the stolen data.  The corporation announced that it shut down its IT infrastructure and that a small number of servers were i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"ransomexxransomwaregang"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-05-03","discovered_date":"2021-03-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6912967f33f77aa283101d4babf7f69031496c26","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20-%20DivvyUp.pdf"},"notes":null,"org_country":"US","org_id":"c2bd1c95767f","org_name":"Divvy Up, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The website hosting company's network security was compromised, allowing malware to be downloaded to the hosted website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540501"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20-%20DivvyUp.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Divvy%20Up%2C%20Inc.-2021-05-03"}],"summary":"Divvy Up reported that malware was downloaded to its hosted website after its hosting company’s security was compromised, potentially exposing payment transaction information.","supporting_quote":"Recently, we were notified by our website hosting company that their network security was compromised, allowing malware to be downloaded to the hosted website.","technology_involved":["hosted website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3218f274d341246974ad642d8a2371fa3a8b013","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"205de490-8e68-11ec-a600-657ec2694f8f"},"incident_date":"2021-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29b040f216c6","org_name":"Sierra College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insidehighered.com/quicktakes/2021/05/24/ransomware-attack-takes-sierra-college-line"}],"summary":"Sierra college goes offline due to a ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da19e85d7e09ae10674bb3cd58c4a79d2413ce08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ca333a70-1720-11ec-8047-3b8ad7d3e0d0"},"incident_date":"2021-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"professional_services","ransomware":null,"records_affected":38000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thedigitalhacker.com/the-data-breach-at-microsoft-power-apps-compromises-the-personal-data-of-38-million-users/"}],"summary":"Havoc creates amongst the users when the data breach was discovered via default permissions settings in Microsoft power apps, the data breach leads to an exposure of around 38 million users’ data. COVID-19 vaccination status, Social Security numbers, and email addresses are all l","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Darkside","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2021-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9daf135f9d933ad7593a1bfe0ea82609a720f698","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ba0ea10-bf36-11eb-a64d-8b45ca6f7953"},"incident_date":"2021-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffc77004af9b","org_name":"Colonial Pipeline","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailymail.co.uk/news/article-9556971/US-pipeline-company-halts-operations-cyberattack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2021-05-09/colonial-hackers-stole-data-thursday-ahead-of-pipeline-shutdown;"},{"fetched_at":null,"title":null,"type":"press","url":"https://apple.news/AhL-qjcmJQIejGfVbXsS82A;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/colonial-pipeline-paid-5-million-ransom-requested-by-hackers-532909.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom;"}],"summary":"Billing system for the pipeline was infected with ransomware.  The company shut the pipeline down because they wouldn't know how to bill for the fuel delivered.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"darkside"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"791b2755b549b4da66e31c9bf47bf06415e5a7dd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2cb2b30-3c14-11ec-963f-f964320be408"},"incident_date":"2021-04-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"6c4a457220d1","org_name":"Technische Universität Berlin","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/de-information-for-technische-universitat-berlin-members-several-it-services-currently-unavailable/"}],"summary":"An attack on TU Berlin’s Windows environment earlier today, 30 April 2021, has caused the University’s system to go down. Encrypted files have thus far been identified. The impact of the attack remains unclear.  To prevent further damage, many systems, including the Exchange serv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02bceff885c6e9e5c084c8a4591e1fb7624df936","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10454.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d0b48fca9397","org_name":"Kettle Cuisine","org_type":"unknown","ransomware":null,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10454.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-30","discovered_date":"2021-04-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1eaea92a31762ff09decb559d339f7e352ca5f24","impact_type":"unknown","incident_date":"2021-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"121821e85159","org_name":"ClearVoiceResearch.com, LLP","org_type":"unknown","ransomware":null,"records_affected":15700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ClearVoiceResearch.com%2C%20LLP-2021-04-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-04-29","discovered_date":"2021-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d97a941f6bedc41629bb7a34533a6ce3a056bf48","impact_type":"data_theft","incident_date":"2020-12-31","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/St%20Pauls%20Letter%201_1.pdf"},"notes":null,"org_country":"US","org_id":"0b635ea262f8","org_name":"St. Paul's PACE","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540409"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/St%20Pauls%20Letter%201_1.pdf"}],"summary":"St. Paul's PACE notified affected people that participant documents containing personal and medication information were compromised in a cyberattack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e3e9e64fac2fbb57542704e956cd7abc06e4967","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter.4.29.21.pdf"},"notes":null,"org_country":"US","org_id":"80d8db73535b","org_name":"St. John’s Well Child and Family Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter.4.29.21.pdf"}],"summary":"St. John’s reported a security incident that disrupted access to certain systems and may have involved unauthorized access to personal or health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce3fa3bf6bd7fc9a55d8e58cea44cc6db4deac3e","impact_type":"data_theft","incident_date":"2021-02-27","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ITC%20-%20Model%20Notification%20to%20Insureds%20%28Updated%29.pdf"},"notes":null,"org_country":"US","org_id":"6091ab6bfac5","org_name":"Insurance Technologies Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ITC%20-%20Model%20Notification%20to%20Insureds%20%28Updated%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10453.pdf"}],"summary":"An unauthorized third party accessed Insurance Technologies Corporation’s AgencyMatrix application and acquired personal information stored there.","supporting_quote":null,"technology_involved":["AgencyMatrix"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","medical","other"],"disclosed_date":"2021-04-29","discovered_date":"2021-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90b5101c542dc7645aebdb8654662178b0178a66","impact_type":"data_theft","imported_from":null,"incident_date":"2021-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20Data%20Breach%20Notification%204.29.21.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"434d6a49027d","org_name":"ClearVoice","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540397"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20Data%20Breach%20Notification%204.29.21.pdf"}],"summary":"ClearVoice reported that a database backup containing survey participant profile information was accessed and later posted online for purchase.","supporting_quote":null,"technology_involved":["database backup","cloud service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-28","discovered_date":"2020-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ae2910ce24c8c95bcbe9cb6e5342828181b01d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nat%20Hab%20-%20SSN%201%20Year.pdf"},"notes":null,"org_country":"US","org_id":"214cd5334288","org_name":"Natural Habitat, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540364"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nat%20Hab%20-%20SSN%201%20Year.pdf"}],"summary":"An unauthorized third party accessed Natural Habitat, Inc.'s computers and files from September 22 to 24, 2020, and the organization later determined that the files contained personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-28","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8de6e59a0aff8c93cbb8a1b3f313bc290fa2a823","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10452.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c731b294229c","org_name":"Direct Relief","org_type":"nonprofit","ransomware":true,"records_affected":926,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10452.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10452.pdf"}],"summary":"A threat actor removed data from Blackbaud systems that may have included Direct Relief constituents’ personal information and philanthropic giving history, following an attempted ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","other"],"disclosed_date":"2021-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c89f39e3c3ddd576dd6efac7d6eac5233c89211","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"6073d13fb481","org_name":"Descomplica","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Descomplica","type":"hibp","url":"https://haveibeenpwned.com/Breach/Descomplica"}],"summary":"Descomplica suffered a data breach in March 2021, and the exposed data was later posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1567"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","medical"],"disclosed_date":"2021-04-28","discovered_date":"2021-04-17","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3af727a9a726289699cd090881263de1ae375c9e","impact_type":"data_theft","incident_date":"2015-09-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10451.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"a72a160c574c","org_name":"ClearVoice Research.com, LLC","org_type":"professional_services","ransomware":null,"records_affected":21564,"reviewed":false,"root_cause":"A backup folder in the cloud storage service was publicly accessible due to human error.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10451.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10451.pdf"}],"summary":"An exposed cloud storage folder allowed access to ClearVoice Research.com, LLC’s 2015 database backups, which included personal information and passwords.","supporting_quote":"The folder these backups resided in was, due to human error, accessible to any individual who (a) was provided the link to it or (b) could use an automated tool or other means to locate publicly open files.","technology_involved":["cloud storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-27","discovered_date":"2020-12-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dce1668bccd79f638a09364eefdd811f057a8907","impact_type":"unknown","incident_date":"2020-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19a2baeea918","org_name":"Partnerships in Community Living, Inc.","org_type":"unknown","ransomware":null,"records_affected":1368,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Partnerships%20in%20Community%20Living%2C%20Inc.-2021-04-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-27","discovered_date":"2021-01-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"436b450a4195496633f801d6bd6ec461940462bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Capital%20Brands%20Holdings%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a5b078389397","org_name":"Capital Brands Distribution, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Capital%20Brands%20Holdings%20-%20Notice.pdf"}],"summary":"Capital Brands discovered malicious code in its e-commerce platform that may have collected customers’ names, addresses, and payment card information, but did not confirm that information was accessed.","supporting_quote":null,"technology_involved":["e-commerce platform","online payment platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-26","discovered_date":"2021-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9b41092bd2483bcc9a386544670931c42537a2f9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10450.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"811a6a948ac3","org_name":"Seattle Police Officers' Guild","org_type":"nonprofit","ransomware":null,"records_affected":1297,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10450.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10450.pdf"}],"summary":"The Seattle Police Officers' Guild reported that its Microsoft Exchange email server was accessed, exposing emails and personal information, but did not state how the attacker gained access.","supporting_quote":null,"technology_involved":["Microsoft Exchange email servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e034243994af535398dbf5cb1c8bf35bf08066e","impact_type":"unknown","incident_date":"2018-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Med-Data%20Inc%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"abd9765354f6","org_name":"Med-Data Incorporated","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540287"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Med-Data%20Inc-2021-05-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-26","discovered_date":"2021-02-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c105ade2f88630bf57993786881beb09f418673e","impact_type":"unknown","incident_date":"2021-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f4f748d97562","org_name":"Brownstein Rask LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brownstein%20Rask%20LLP-2021-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1295c6dee2bebbafc5a0bb76a9c0dcf1fb07904","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"6c99fde63f29","org_name":"BigBasket","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: bigbasket","type":"hibp","url":"https://haveibeenpwned.com/Breach/bigbasket"}],"summary":"BigBasket customer records, including personal information and password hashes, were exposed and later leaked publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64b5305b5988f4f7a43aaf3891d966f7d4385979","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6c61e7ed543a","org_name":"ShopBack","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ShopBack","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShopBack"}],"summary":"A breach exposed ShopBack email addresses, names, phone numbers, country of residence and salted SHA-1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48ff2d65ec03571fe0cc6591cbd674198201cd1d","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"aa23ec41a23b","org_name":"MangaDex","org_type":"other","ransomware":null,"records_affected":2987329,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MangaDex","type":"hibp","url":"https://haveibeenpwned.com/Breach/MangaDex"}],"summary":"MangaDex suffered a data breach in March 2021 that exposed subscriber email and IP addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2021-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb91303cf5bc1ff8b1a72e95ed126b30e2cdf937","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f593edc0-3bfd-11ec-963f-f964320be408"},"incident_date":"2021-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"a26988dc421e","org_name":"Tegut","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2021/06/data-breach-at-german-supermarket-chain-tegut/"}],"summary":"The German supermarket chain “tegut” was recently the target of a cyberattack (source in German) and on April 24 the company activated emergency procedures that shut down their entire central IT network and disconnected it from the internet. While done to limit the exposure of se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0aa2b651dd3bf491a1fb6381a292e56c9416db99","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Foodland%20Notice%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"55e83e3dd0cd","org_name":"Foodland Super Market, Limited","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540244"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Foodland%20Notice%20Proof.pdf"}],"summary":"Foodland reported a ransomware attack in which perpetrators may have accessed systems storing current and former employee, dependent, and beneficiary information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-04-23","discovered_date":"2021-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de90adaeea322a415d532411392ce07fb870f6a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_Proof.pdf"},"notes":null,"org_country":"US","org_id":"14f5249cd408","org_name":"Doctors Medical Center of Modesto","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfigured software update on a Medifies contractor's software development server made patient information publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_Proof.pdf"}],"summary":"Doctors Medical Center of Modesto reported that patient information on a Medifies contractor's software development server was potentially made publicly accessible after a misconfigured software update.","supporting_quote":"On April 2, 2021, we learned that patient information provided to a former vendor, Medifies, was potentially made publicly accessible to the internet as a result of a misconfigured software update on a server used by a Medifies contractor for software development.","technology_involved":["software development server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Medifies"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"e0f895be4959","name":"Medifies"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47abbf47743969d8a6856bf8e8b22d702efd74e4","impact_type":"data_theft","imported_from":null,"incident_date":"2015-08-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"841f886481f0","org_name":"ClearVoice Surveys","org_type":"professional_services","ransomware":null,"records_affected":15074786,"reviewed":false,"root_cause":"A database backup from 2015 was publicly facing and was taken.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ClearVoice Surveys","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClearVoiceSurveys"}],"summary":"ClearVoice Surveys confirmed that a publicly facing database backup containing personal information and plain text passwords was taken and redistributed.","supporting_quote":"In April 2021, the market research surveys company ClearVoice Surveys had a publicly facing database backup from 2015 taken and redistributed on a popular hacking forum.","technology_involved":["database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"273e5a1bff5f300912015b70d4b5590f1707aac9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-23","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fraud%20Data%20Breach%20Notice5.pdf"},"notes":null,"org_country":"US","org_id":"162ab2890952","org_name":"Smith and Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540240"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fraud%20Data%20Breach%20Notice5.pdf"}],"summary":"Smith and Company said cybercriminals targeted client data through its third-party software provider, Intuit, and its Electronic Filing ID number was compromised.","supporting_quote":"We recently discovered that we were targeted by cybercriminals trying to obtain client data through our third-party software provider, Intuit.","technology_involved":["Intuit"],"third_party":{"archetype":null,"involved":true,"vendor":"Intuit"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"71b813da9532","name":"Intuit"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Babuk","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b91ef61141c3260ff4e2e1fc192208d5ad7d7f9c","impact_type":"both","incident_date":"2021-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ES","org_id":"7786a031ef39","org_name":"Phone House España","org_type":"retail_ecommerce","ransomware":true,"records_affected":5223350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Phone House España","type":"hibp","url":"https://haveibeenpwned.com/Breach/PhoneHouse"}],"summary":"Phone House España customer data was posted online following an alleged ransomware attack attributed to Babuk, with further releases threatened unless a ransom was paid.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"babuk"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"556d960d8d6c40aca21f3553ff6aac1fe5781c60","impact_type":"both","incident_date":"2020-10-22","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HCP%20-%20Sample%20Notices%20Combined.pdf"},"notes":null,"org_country":"US","org_id":"79d6017b4101","org_name":"Health Center Partners of Southern California","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540188"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HCP%20-%20Sample%20Notices%20Combined.pdf"}],"summary":"An unauthorized third party accessed Netgain’s environment and obtained files containing Health Center Partners of Southern California data; Netgain paid the attacker, and the files contained personal information.","supporting_quote":"According to Netgain, in late September 2020, an unauthorized third party gained access to Netgain’s digital environment, and between October 22, 2020 to December 3, 2020, the unauthorized third party obtained certain files containing HCP data.","technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6379a4728003b44b802f7704004bf1bd1c539ca6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ca17160-10b0-11ec-ac2c-abfc822846a5"},"incident_date":"2021-04-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"eb2217e14484","org_name":"Centre François Baclesse","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fr-baclesse-cuts-its-internet-connection-to-prevent-the-spread-of-a-computer-worm/"}],"summary":" Centre François Baclesse had to close its network to prevent the exfiltration of data from ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c6ab5988ea8f7db62bb4c1b743b5aac8d1e532c2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/DoddsHennessyandStithLawfirm.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab7adc85e269","org_name":"Dodds, Hennessy, & Stith, LLC","org_type":"unknown","ransomware":null,"records_affected":11285,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/DoddsHennessyandStithLawfirm.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8a9719fdc4459e37c0b133eb336917bf665deb9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C%20-%20Data%20Breach%20Letter%20-%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"30900fd37ad0","org_name":"Blade HQ","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540050"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C%20-%20Data%20Breach%20Letter%20-%20FINAL.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Blade%20HQ-2021-04-19"}],"summary":"An unknown intruder uploaded malware to Blade HQ's website, potentially enabling access to customer transaction information.","supporting_quote":null,"technology_involved":["hosted website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-16","discovered_date":"2021-03-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c56911c48b27499e0ae91ba8427b787f7ee27992","impact_type":"unknown","incident_date":"2021-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2fa241855fc0","org_name":"Ryan, Swanson, & Cleveland PLLC","org_type":"unknown","ransomware":null,"records_affected":624,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ryan%2C%20Swanson%2C%20%26%20Cleveland%20PLLC-2021-04-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-16","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93a2e22ad73aa55ab86d62d9fa678356bec3cfc5","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fort%20Hays%20-%20CA%20Notice%20LTR.pdf"},"notes":null,"org_country":"US","org_id":"8abd83d07de1","org_name":"Fort Hays State University Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fort%20Hays%20-%20CA%20Notice%20LTR.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fort%20Hays%20State%20University%20Foundation-2021-04-16"}],"summary":"Backup files containing the Fort Hays State University Foundation’s information were taken from Blackbaud’s network during an attempted ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-16","discovered_date":"2021-02-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0284507ce85b26c715dfbe219dc2d02c1cb53f30","impact_type":"unknown","incident_date":"2020-12-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbb6a7b4782d","org_name":"Armfield Harrison & Thomas","org_type":"unknown","ransomware":null,"records_affected":30486,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Armfield%20Harrison%20%26%20Thomas-2021-04-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-16","discovered_date":"2020-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f41be75ce2b0c120a5b084bdb194c8a3441c731","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-23","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Administrative%20Advantage-Remedy.pdf"},"notes":null,"org_country":"US","org_id":"e423e5e23a11","org_name":"Administrative Advantage, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-540008"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Administrative%20Advantage-Remedy.pdf"}],"summary":"An unauthorized person or persons may have accessed an employee email account containing personal information, but no actual or attempted misuse was identified.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d87289db139e2c97c845c47119b7dd67270f6de2","impact_type":"data_theft","incident_date":"2021-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DL3_IndNoticeLttr_CA_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"467b8888476a","org_name":"Government Employees Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DL3_IndNoticeLttr_CA_Redacted.pdf"}],"summary":"Fraudsters used information acquired elsewhere to access driver’s license numbers through GEICO’s online sales system.","supporting_quote":null,"technology_involved":["online sales system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2021-04-15","discovered_date":"2020-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deb3a05634c5c896cf82c86dcce1bf9db0bb98bd","impact_type":"both","imported_from":null,"incident_date":"2020-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FPI%208%20Ad%20SSN%20Wave%20%232.pdf"},"notes":null,"org_country":"US","org_id":"fbca86440cb1","org_name":"FPI Management, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FPI%208%20Ad%20SSN%20Wave%20%232.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10436.pdf"}],"summary":"FPI Management reported that an unauthorized third party accessed certain systems, disrupting access and accessing or acquiring personal information without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-15","discovered_date":"2021-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c2ecef9e68bc1596dbafc41a8e1b1d2f6a7f572","impact_type":"disruption_or_ransomware","incident_date":"2021-03-03","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ec0b2b78f6f6","org_name":"Don Roberto Jewelers, Inc.","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification.pdf"}],"summary":"Don Roberto Jewelers discovered a ransomware attack that may have involved customers’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-15","discovered_date":"2021-04-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fff58e6dfd9a871ad7a5dadfeb657c4f57c723ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AmeriFirst%20Financial%2C%20Inc.%20-%20Sample%20of%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"638b101186da","org_name":"AmeriFirst Financial, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539984"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AmeriFirst%20Financial%2C%20Inc.%20-%20Sample%20of%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AmeriFirst%20Financial%2C%20Inc.-2021-04-15"}],"summary":"AmeriFirst Financial reported that customers’ loan file information was exposed after its electronic data storage was compromised.","supporting_quote":null,"technology_involved":["electronic data storage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91e87b965c8d3d2be9acfdb9788e92d35e48429c","impact_type":"unknown","incident_date":"2019-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/VEP%20Healthcare%20Inc.%20-%20Notice%20Letter%20A%20-%20SSN%20Variable%20V2%20Print%20Proof%20%28Redacted%29%20%289492913x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"497259c018bd","org_name":"VEP Healthcare, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539899"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-13","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"accb2aa119dafe5aa44afc3bad32cc37acded71d","impact_type":"data_theft","incident_date":"2021-01-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10447.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"548362a34774","org_name":"University of Colorado","org_type":"education","ransomware":null,"records_affected":3511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10447.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10447.pdf"}],"summary":"Files containing personal information about University of Colorado individuals were accessed or acquired from its Accellion service.","supporting_quote":"On January 25, 2021, CU was advised by Accellion that Accellion’s service was attacked and compromised.","technology_involved":["Accellion"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-13","discovered_date":"2020-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"203bbb9dd173cd28b8f88bf190b627659620e7eb","impact_type":"disruption_or_ransomware","incident_date":"2020-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ascentium%20Corp-%20SMITH%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"de091e035ab1","org_name":"SMITH","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ascentium%20Corp-%20SMITH%20Notice.pdf"}],"summary":"SMITH reported a ransomware attack on an onsite server containing current and legacy employee personal identifying information.","supporting_quote":null,"technology_involved":["onsite server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-13","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d85409dc3e6d9a921bffb3b8295c134ec2cc3bc0","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Seven%20Hills%20California%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"474408809408","org_name":"Seven Hills School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539910"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Seven%20Hills%20California%20Sample%20Letter.pdf"}],"summary":"Seven Hills School said information in its Blackbaud backup file was accessed and removed during a ransomware incident at Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud","Blackbaud backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-13","discovered_date":"2021-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"01a77a6709729e6b80284fd9ac76adc071a1065e","impact_type":"both","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10446.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"72f4de6468ec","org_name":"FloForm Industries LLC","org_type":"unknown","ransomware":null,"records_affected":970,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10446.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10446.pdf"}],"summary":"FloForm discovered that an unauthorized third party encrypted its technology infrastructure, causing a system outage, and later learned employee personal information may have been accessed and exfiltrated.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-12","discovered_date":"2021-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36b0fd78944f0e69f428a110960a3b21b2bc8d8b","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%202%20Yr.pdf"},"notes":null,"org_country":"US","org_id":"92eef1a818ab","org_name":"On Q Financial, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%202%20Yr.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#On%20Q%20Financial%2C%20Inc.-2021-04-02"}],"summary":"On Q Financial reported that customer data may have been exposed from a backup storage location between February 22 and 23, 2021.","supporting_quote":null,"technology_involved":["backup storage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b1a5e45210c078fae4073de598f02c3eddac1fe4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmericanAnesthesiology.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"681b17a82324","org_name":"American Anesthesiology, Inc.","org_type":"unknown","ransomware":null,"records_affected":14138,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmericanAnesthesiology.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-09","discovered_date":"2021-01-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"529721c7d4ad1c7ac07d1e3e90ace9d4c0870165","impact_type":"disruption_or_ransomware","incident_date":"2021-01-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/343378_McDougall%20%26%20Sons%20-%20Consumer%20Notification%20Letter%20-%20General%20Proof%20v1.pdf"},"notes":null,"org_country":"US","org_id":"6664fdf6d795","org_name":"McDougall & Sons, Inc.","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/343378_McDougall%20%26%20Sons%20-%20Consumer%20Notification%20Letter%20-%20General%20Proof%20v1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10445.pdf"}],"summary":"McDougall & Sons discovered that its systems had been encrypted in a ransomware attack, and an investigation found that an unauthorized third party had access from January 10 to January 12, 2021.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-09","discovered_date":"2021-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85a8521978c612057ef0557d52093844eef39075","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-18","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HBB%20-%20California%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"86cb49f4e44d","org_name":"Hamilton Beach Brands","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HBB%20-%20California%20Notification_2.pdf"}],"summary":"Hamilton Beach discovered unauthorized code on its ecommerce website that could have accessed customer checkout information.","supporting_quote":null,"technology_involved":["ecommerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d2e712c6c90aa57943617f122aa10cdf82b781c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3fd4c3e0-e961-11eb-9aea-07892f56ef76"},"incident_date":"2021-04-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"1fa16bff7c06","org_name":"City of Morières-lès-Avignon","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fr-morieres-les-avignon-douai-wurth-france-suffer-cyber-attacks/"}],"summary":"City of Morières-lès-Avignon experiences a ransomware attack  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-09","discovered_date":"2020-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"9cb56f769a5dc83d7bf2c3bb2477ca3f793e516d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACEP%20-%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3c4bc85608e6","org_name":"American College of Emergency Physicians","org_type":"nonprofit","ransomware":null,"records_affected":70349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20College%20of%20Emergency%20Physicians%20%28%22ACEP%22%29-2021-04-09"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539859"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACEP%20-%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10444.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACEP%20-%20Notice.pdf"}],"summary":"ACEP reported that an unauthorized actor compromised a server where credentials to separate SQL database servers were stored, though it found no evidence those databases were accessed or acquired.","supporting_quote":null,"technology_involved":["SQL database servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-08","discovered_date":"2020-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f0ff24f889f362f7439eb25019d388687e1768cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10443.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3413913aaa70","org_name":"Nexelis Group","org_type":"professional_services","ransomware":null,"records_affected":957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10443.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10443.pdf"}],"summary":"Nexelis reported that malware encrypted some systems and that personal information on a Pacific Biomarkers server was accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-04-08","discovered_date":"2020-12-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8c5fdd1396cbc182aa02678085dc8bc735b5c9b","impact_type":"disruption_or_ransomware","incident_date":"2020-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Neighborhood_%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"88a0d29e75e9","org_name":"Neighborhood Healthcare","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539832"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Neighborhood_%20Notification.pdf"}],"summary":"A ransomware attack on Netgain affected files hosted for Neighborhood Healthcare, potentially including patient information.","supporting_quote":null,"technology_involved":["Netgain"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-04-08","discovered_date":"2021-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7796e8b4c573d4fe985f29efa30615efd9322955","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AD158_v03.pdf"},"notes":null,"org_country":"US","org_id":"07c6ac6ca8fa","org_name":"MailMyPrescriptions.com Pharmacy Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539840"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AD158_v03.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MailMyPrescriptions.com%20Pharmacy%20Corporation-2021-04-08"}],"summary":"MailMyPrescriptions.com reported unauthorized access to an employee email account, which may have enabled access to personal and medical information, though there was no evidence that information was viewed or misused.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-04-08","discovered_date":"2021-01-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ace288ba3a403066e167d062f5b54f848c9fde66","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10442.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b922396fdfda","org_name":"MailMyPrescriptions.com","org_type":"healthcare","ransomware":null,"records_affected":507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10442.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10442.pdf"}],"summary":"MailMyPrescriptions.com reported unauthorized access to an employee email account that may have enabled access to personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1213"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-07","discovered_date":"2021-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"031dc311b7e4f529afd1d9d4433f550330c767b9","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-25","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Atlantic%20Media%2C%20Inc.%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8dcf0569c7c5","org_name":"Atlantic Media, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539793"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Atlantic%20Media%2C%20Inc.%20Notice%20Letter.pdf"}],"summary":"Atlantic Media said unauthorized actors accessed its network file share server, affecting employee and contractor tax documents containing personal information.","supporting_quote":null,"technology_involved":["network file share server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-07","discovered_date":"2021-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0291010cb1a93897cdf23ebfd1efcde40cfdc473","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Society%20for%20Clinical%20Pathology%20-%20Ad%20No%20CM%20r1prf%20%28redacted%29%20%289521611x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"677a962912c3","org_name":"American Society for Clinical Pathology","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Society%20for%20Clinical%20Pathology%20-%20Ad%20No%20CM%20r1prf%20%28redacted%29%20%289521611x7AB84%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10441.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Society%20for%20Clinical%20Pathology-2021-05-11"}],"summary":"The American Society for Clinical Pathology reported that a cybersecurity attack on its e-commerce website potentially exposed payment card information entered there.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-06","discovered_date":"2020-07-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9718d663d2023a736b03b636d192487b9fb5b863","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-26","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10440.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4e784bf1c1a9","org_name":"Portland State University Foundation","org_type":"nonprofit","ransomware":null,"records_affected":4216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10440.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10440.pdf"}],"summary":"An unauthorized actor logged into some PSU Foundation employees’ email accounts, which contained sensitive information including names.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ceb1eeaf2062c8b6a9dac9997aecd0ea16287da","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Minnetonka%20-%20Consumer%20Notification%20Letter%20Final%20Proof%20%28California%29.pdf"},"notes":null,"org_country":"US","org_id":"a97b48a47e79","org_name":"Minnetonka Moccasin Company, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539767"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Minnetonka%20-%20Consumer%20Notification%20Letter%20Final%20Proof%20%28California%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Minnetonka%20Moccasin%20Company%2C%20Inc.-2021-04-06"}],"summary":"Minnetonka Moccasin Company reported that a data security incident involving its website may have exposed customers’ names and payment card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-06","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eb4d9b60d8827bd6e0101390f0fa69c33e902c8","impact_type":"both","incident_date":"2020-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marines%27%20Memorial%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8ab39e69650f","org_name":"Marines' Memorial Association & Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539752"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marines%27%20Memorial%20-%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10438.pdf"}],"summary":"Marines' Memorial reported that Blackbaud experienced a ransomware incident involving encryption and exfiltration of customer data that may have included Marines' Memorial information.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1190"],"confidence":"high","control_failure":"zero_day","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-04-05","discovered_date":"2021-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06275f581f47e99ae135b5b3a02a0a9b4af16e37","impact_type":"data_theft","incident_date":"2021-01-20","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trinity%20Health%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"16deec0cd0a2","org_name":"Trinity Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unknown and unreported flaw in the Accellion appliance was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539704"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trinity%20Health%20-%20Notice.pdf"}],"summary":"Trinity Health reported that an unknown user exploited a flaw in an Accellion file-transfer appliance and downloaded files containing patient and colleague information.","supporting_quote":"The unauthorized user was able to take advantage of a previously unknown and unreported flaw in the security of the Accellion appliance.","technology_involved":["Accellion secure file transfer platform"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c2dade7efd4529b2d41f39d45b4e154ad851c0f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a194a770-de86-11eb-92f2-17e9027f1a94"},"incident_date":"2021-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf2089ad6824","org_name":"Douglas Elliman Property Management","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://therealdeal.com/2021/04/19/ellimans-property-management-arm-suffers-data-breach/?utm_source=internal&utm_medium=after_article&utm_campaign=related_article"}],"summary":"Thousands of New York residents who live in buildings run by Douglas Elliman’s property management arm may have had their personal information compromised this month.  Douglas Elliman Property Management’s three managing directors emailed hundreds of co-operative and condominium ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-05","discovered_date":"2021-02-25","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f42a0a5a85ff18645421a257b3645af2b28543d1","impact_type":"data_theft","incident_date":"2020-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20Letter%204-5-21.pdf"},"notes":null,"org_country":"US","org_id":"ed811898beb4","org_name":"Active Lifestyle Products & Services, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539708"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20Letter%204-5-21.pdf"}],"summary":"An attacker breached ALPS Brands’ e-commerce websites and installed a program that captured customer transaction data.","supporting_quote":null,"technology_involved":["e-commerce websites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a1c479e88233ec6e7d79f7017cfb6af5faaee7e5","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10415.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8a31179739ca","org_name":"RXLTC, PLLC & Prescription Pharmacy, PLLC","org_type":"healthcare","ransomware":null,"records_affected":560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10415.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10415.pdf"}],"summary":"RXLTC reported that business email accounts may have been compromised, with personal and health information present in the accounts but no specific access to that information identified.","supporting_quote":null,"technology_involved":["business email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"445334d5c518d6ca2ab6fd0bdaf6f6ad12b21589","impact_type":"data_theft","imported_from":null,"incident_date":"2019-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The data was allegedly obtained by exploiting a vulnerability Facebook later rectified.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Facebook","type":"hibp","url":"https://haveibeenpwned.com/Breach/Facebook"}],"summary":"Data associated with more than 500 million Facebook users was made available for download after being allegedly obtained by exploiting a vulnerability.","supporting_quote":"The data was allegedly obtained by exploiting a vulnerability Facebook advises they rectified in August 2019.","technology_involved":["Facebook"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-04-02","discovered_date":"2020-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"936e89c035cb25f8db076a77214b55f2f9ecd875","impact_type":"data_theft","incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Slate%20%26%20Tell%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c826401d19fb","org_name":"Slate & Tell LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Slate%20%26%20Tell%20-%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Slate%20%26%20Tell%20LLC-2021-04-02"}],"summary":"Slate & Tell reported that malware may have stolen customers’ payment card data from its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-04-02","discovered_date":"2021-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24f03727abb946352b4f51619ab0f6cc44c09007","impact_type":"data_theft","imported_from":null,"incident_date":"2021-02-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20.pdf"},"notes":null,"org_country":"US","org_id":"78d1253a1bbf","org_name":"MHNext, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10435.pdf"}],"summary":"An attacker accessed a database containing Manhunt user account credentials and downloaded usernames, email addresses, and passwords.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e18f288356102837626da93a231525d9c84015c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marquee%20Brands%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"4f15afa83fcd","org_name":"Maternity IP Holdings, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539694"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marquee%20Brands%20-%20Notice.pdf"}],"summary":"A cyber event affected Destination Maternity’s information technology systems and customer database containing customer personal information.","supporting_quote":null,"technology_involved":["customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-02","discovered_date":"2020-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06473d2e7436b7d708656a3ad395b9a0d3d76a1d","impact_type":"both","incident_date":"2020-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crestline%20Hotels%20%26%20Resorts%2C%20LLC%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"612576efdae8","org_name":"Crestline Hotels & Resorts, LLC","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539677"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crestline%20Hotels%20%26%20Resorts%2C%20LLC%20Notice.pdf"}],"summary":"An unauthorized actor accessed Crestline’s systems, encrypted and removed files, and threatened to release and released some of them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-02","discovered_date":"2021-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee29e9cdabc8c721dd44eb546148d96a50ce6e0b","impact_type":"both","incident_date":"2021-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"11210ab71957","org_name":"Bricker & Eckler LLP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539675"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notice%20Letter.pdf"}],"summary":"Bricker & Eckler LLP reported a ransomware attack in which an unauthorized party accessed internal systems and obtained data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-01","discovered_date":"2020-10-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a14efa4b46868559ddbad937dcd30795e6510a2","impact_type":"data_theft","incident_date":"2020-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USG%20-%20Substitute%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1682488211b4","org_name":"USG Insurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539658"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USG%20-%20Substitute%20Notice.pdf"}],"summary":"USG Insurance Services reported unauthorized access to its network and potential exfiltration of policyholders’ employees’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2af87e63d7501f0ef3c42c0e964967f0fa9c4a6b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b98344e0-02d9-11ed-8b5b-6134b3849169"},"incident_date":"2021-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c558c14193ef","org_name":"United Nations","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.darkreading.com/attacks-breaches/un-confirms-april-2021-data-breach"}],"summary":"Someone accessed UN project management platform through the use of purchased stolen credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42c4f5d411712c8a9b07ec46b802dadeaf23a898","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f7c43a0-35d3-11ec-9ec7-15e66f657ea5"},"incident_date":"2021-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"d3a20a939444","org_name":"Technological University Dublin","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/technological-university-of-dublin-victim-of-ransomware-attack/"}],"summary":"Technological University of Dublin victim of ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7a588924a06415d268181868e3d2dedaeced065","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5c21bd90-05b4-11ec-a755-057d35a918cc"},"incident_date":"2021-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c76ad4d0b738","org_name":"Service Employees International Union 775 Benefits Group","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20SEIU%20775%20Benefits%20Group%20Ad%20CA%20r1prf.pdf"}],"summary":"SEIU 775 Benefits Group experienced a breach when some unknown third party started deleted information of customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92d9f0c6581b0bdfacf4b3a970b618e8c23cdc09","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccf9d660-d436-11eb-8806-c7cd39544f5b"},"incident_date":"2021-04-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b6a24e80fb0","org_name":"ParkMobile","org_type":"transportation_logistics","ransomware":null,"records_affected":21000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2021/04/parkmobile-breach-exposes-license-plate-data-mobile-numbers-of-21m-users/"},{"fetched_at":null,"title":"Have I Been Pwned: ParkMobile","type":"hibp","url":"https://haveibeenpwned.com/Breach/ParkMobile"}],"summary":"Parkmobile was breached due to a vulnerability in a third party software exposing the data of various municipal governments that use the app","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1903ae7d9ccabd8de1716e382001e017099327d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6a0bbc60-8e73-11ec-a600-657ec2694f8f"},"incident_date":"2021-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04ecd7eb87bb","org_name":"Home Depot","org_type":"retail_ecommerce","ransomware":null,"records_affected":974000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/office-depot-configuration-error/"}],"summary":"Office Depot Europe leaves an elasticsearch database open resulting in nearly a million records exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal","personal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e66b44f52f1040f12b68ec74865d9bd5fa481e56","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2835aa70-e960-11eb-9aea-07892f56ef76"},"incident_date":"2021-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"8d81a99eab69","org_name":"Groupe Reorev","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.technadu.com/groupe-reorev-breached-lv-ransomware-actors/270239/"}],"summary":"Groupe Reorev had data stolen and then encrypted by ransomware group LV","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d11033f858b37d03c0d55bdebf2b660792ef7c1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6ba7d5a0-8e72-11ec-87f6-d3dcb0bc7258"},"incident_date":"2021-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"74568ea10223","org_name":"Debt-IN","org_type":"other","ransomware":true,"records_affected":140000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://businesstech.co.za/news/banking/523312/african-bank-warns-of-data-breach-with-personal-details-compromised/"},{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/millions-of-south-africans-caught-up-in-security-incident-after-debt-recovery-firm-suffers-significant-data-breach"}],"summary":"More than a million South African citizens have potentially had their personal data exposed after a ransomware attack at a debt recovery services firm.  The company in question, Debt-IN Consultants, confirmed this week (September 22) that it had been the victim of a cyber-attack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d54a0dc803310b2c10c8112727f9a6e98862ba8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69327790-8e6c-11ec-a600-657ec2694f8f"},"incident_date":"2021-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c4c884ee17c","org_name":"Buffalo Public Schools","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcnews.com/tech/security/parents-end-chain-ransomware-hit-rcna646"}],"summary":"Buffalo schools were impacted by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0983fbc4cbcc5bad9629f6e62c8782a684633eaf","impact_type":"unknown","incident_date":"2020-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Suburban%20Collection%20Holdings%2C%20LLC%20-%20Letter%20%281%29%20%28redacted%29%20%289496002x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"21e3265995fe","org_name":"Suburban Collection Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539607"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"eef199a9161b5017ad8efd4e4dc8f29b3323b6c3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42c4066f4420","org_name":"American Sentinel College of Nursing & Health Sciences at Post University","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#American%20Sentinel%20College%20of%20Nursing%20%26%20Health%20Sciences%20at%20Post%20University-2021-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-30","discovered_date":"2021-02-02","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9e56e2edb28e175201f56219e765422d97b0133","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10724.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e518c4db7ca1","org_name":"Prime Therapeutics","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":"The incorrect mailing address resulted from outdated prescriber contact information in the national registry.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10724.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10724.pdf"}],"summary":"Prime Therapeutics inadvertently mailed a prescription-related letter containing personal and medical information to an incorrect address.","supporting_quote":"On February 2, 2021, Prime became aware that your prescriber's copy of your Transition fill letter was inadvertently mailed to the incorrect address on January 22, 2021.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-30","discovered_date":"2021-01-21","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21ac2d13901f7f604ddaba6b3759eac265b13999","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Liberty%20Mutual%20-%20JAN%20and%20MAR%20-%20Version%20A%20-%20Adult%20Notice%20Template%202021-03-30.pdf"},"notes":null,"org_country":"US","org_id":"a910ac9c04e6","org_name":"Liberty Mutual Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539606"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Liberty%20Mutual%20-%20JAN%20and%20MAR%20-%20Version%20A%20-%20Adult%20Notice%20Template%202021-03-30.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Liberty%20Mutual%20Group%2C%20Inc.-2021-03-31"}],"summary":"An unauthorized third party misused Liberty Mutual’s online auto insurance quote application, potentially exposing driver’s license numbers.","supporting_quote":null,"technology_involved":["LibertyMutual.com","GetCertainly.com","online auto insurance quote application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"posted on the web by a user using the name of Maxim Gorki","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cdd7c4e4a6aec8878fc7d803138b04153d71797","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71107a80-d9b7-11eb-8feb-0b45b7dcf47e"},"incident_date":"2021-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"09bee8056cf1","org_name":"municipality of Konya","org_type":"other","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailysabah.com/turkey/investigations/cyberattack-steals-info-of-one-million-in-turkeys-konya"}],"summary":"About 1 million people’s information was stolen in a cyberattack targeting the municipality of Konya in central Turkey, media reports claimed.  A municipality official confirmed the attack but did not disclose its scale. The Sözcü newspaper claims the ID numbers and other persona","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"postedonthewebbyauserusingthenameofmaximgorki"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-29","discovered_date":"2021-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fd8f5e2a1bd385e873e0a5b869d96e6ce5ff736","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/La%20Clinica%20Adult%20and%20Minor%20English%20and%20Spanish%20Patient%20Privacy%20Notification%20Sample%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"bf841bf2c797","org_name":"La Clinica de La Raza, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539567"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/La%20Clinica%20Adult%20and%20Minor%20English%20and%20Spanish%20Patient%20Privacy%20Notification%20Sample%20Proof.pdf"}],"summary":"La Clinica reported malware deployment on its systems and unauthorized access from January 12, 2021, with some personal and health information potentially accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c1106392d68d4de6494571602b2450576a1ee18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b31719c0-3c18-11ec-963f-f964320be408"},"incident_date":"2021-03-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f9e4e770919","org_name":"Rochester Community Technical College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.postbulletin.com/news/education/7013860-RCTC-students-birthdates-released-in-data-breach"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mn-rctc-students-birthdates-released-in-data-breach/"}],"summary":"Erich Fisher reports that Rochester Community Technical College discovered it had twice made errors in responding to semi-annual public records requests from LexisNexis:  A data breach at Rochester Community Technical College was identified and remedied on March 31 after it was d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2021-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"158eb94b2b1447f08cead93028e5b4202e70593d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b5a117b0-d9ba-11eb-8feb-0b45b7dcf47e"},"incident_date":"2021-03-28","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"020587955757","org_name":"Hedgeye","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://remarkboard.com/m/hedgeye-files-lawsuit-restraining-order-against-former/1fmbtb0qh99ni"}],"summary":"Independent research shop Hedgeye has filed a lawsuit against one of its former employees-turned-competitors, Darius Dale, alleging that Dale stole trade secrets from the company. Dale has since started his own research firm, called 42 Macro LLC.  According to Dale's LinkedIn, he","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-26","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4682e92473a85b7d1c073f69b030cc8d3f8686c","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3c51da78ae4d","org_name":"Santa Catalina School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539519"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCS%20-%20California%20Notification.pdf"}],"summary":"Santa Catalina School said a Blackbaud backup file containing some of its information was accessed and taken during a ransomware incident at Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ef00b2c80d8289e9c63b6570b708678fda39510","impact_type":"unknown","incident_date":"2020-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20BioTel%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c473c13b932","org_name":"BioTel Heart (a trade name under which both CardioNet, LLC and LifeWatch, Inc. operate)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539524"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4baa2f950c8f0af68a42131fe08b81bbd614cc9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BioTelHeart.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b5df83979f08","org_name":"BioTel Heart","org_type":"unknown","ransomware":null,"records_affected":830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BioTelHeart.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e8609c8a4e438434d9b35550db40688550d9814","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rosa%20Mexicano%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"02b782231618","org_name":"Rosa Mexicano Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539448"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rosa%20Mexicano%20Sample%20Letter.pdf"}],"summary":"Rosa Mexicano reported unauthorized access to employees’ email accounts between October 6 and November 4, 2020, but could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-25","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b494b2b8978352105b252a3e7d928f91e3d1acb3","impact_type":"data_theft","incident_date":"2021-01-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Health%20Net%20of%20California%20-%20Accellion%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"eca324a73dec","org_name":"Health Net of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539506"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Health%20Net%20of%20California%20-%20Accellion%20Breach%20Notice%20Letter.pdf"}],"summary":"Health Net of California reported that an unknown party could view or download files containing personal and health information from Accellion’s file transfer platform.","supporting_quote":"On January 25, 2021, Accellion informed us that its file transfer platform was compromised by an unknown malicious party.","technology_involved":["Accellion file transfer platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-25","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15d25e21fce4fce35768662c8358b2900fc58dca","impact_type":"data_theft","incident_date":"2021-01-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Health%20Net%20Life%20Insurance%20Company%20-%20Accellion%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"8fe509af14f9","org_name":"Health Net Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539505"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Health%20Net%20Life%20Insurance%20Company%20-%20Accellion%20Breach%20Notice%20Letter.pdf"}],"summary":"Health Net Life Insurance Company reported that a compromise of Accellion’s file transfer platform allowed an unknown party to view or download files containing personal and health information.","supporting_quote":"On January 25, 2021, Accellion informed us that its file transfer platform was compromised by an unknown malicious party.","technology_involved":["Accellion file transfer platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-25","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6069fd0772acbd230027d5055d33772f645f3560","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Health%20Net%20Community%20Solutions%20-%20Accellion%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"88e5c8b85c63","org_name":"Health Net Community Solutions","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Health%20Net%20Community%20Solutions%20-%20Accellion%20Breach%20Notice%20Letter.pdf"}],"summary":"Health Net Community Solutions reported that an unknown malicious party compromised Accellion’s file transfer platform and could view or download files containing personal and health information.","supporting_quote":null,"technology_involved":["Accellion file transfer platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aa25342a2989f1177ac93ab84dee6bcdcdbbde34","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/FlorenceDarlingtonTechnicalCollege.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02612d2cc40d","org_name":"Florence-Darlington Technical College","org_type":"unknown","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/FlorenceDarlingtonTechnicalCollege.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-25","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ee91d231c2e399d8295c8983ef7c638b70d2354","impact_type":"data_theft","incident_date":"2021-01-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CalViva%20-%20%20Accellion%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"5583fbef7047","org_name":"CalViva Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CalViva%20-%20%20Accellion%20Breach%20Notice%20Letter.pdf"}],"summary":"CalViva Health reported that an unknown malicious party accessed or downloaded personal and health information stored on Accellion’s file transfer platform.","supporting_quote":"On January 25, 2021, Accellion informed us that its file transfer platform was compromised by an unknown malicious party.","technology_involved":["Accellion file transfer platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-25","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"943e27305974f2f59b11c78d0296660affc67e2c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Health%20%26%20Wellness%20-%20Accellion%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"13a6bbcbdfcd","org_name":"California Health & Wellness","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539502"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Health%20%26%20Wellness%20-%20Accellion%20Breach%20Notice%20Letter.pdf"}],"summary":"California Health & Wellness reported that a malicious party could view or download files containing personal and medical information stored on Accellion’s file transfer platform.","supporting_quote":"On January 25, 2021, Accellion informed us that its file transfer platform was compromised by an unknown malicious party.","technology_involved":["Accellion file transfer platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","other","personal"],"disclosed_date":"2021-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f35184c8629510c1635725881cdd281471b04890","impact_type":"data_theft","incident_date":"2021-01-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"90cdc266afce","org_name":"Unverified Data Source","org_type":"unknown","ransomware":null,"records_affected":11498146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Unverified Data Source","type":"hibp","url":"https://haveibeenpwned.com/Breach/Astoria"}],"summary":"In January 2021, over 11M unique email addresses were discovered by Night Lion Security alongside an extensive amount of personal information including names, physical and IP addresses, phone numbers and dates of birth. Some records also contained social security numbers, driver'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-24","discovered_date":"2020-12-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d97bde8fe9dfd73ef1f6bb0c7a53df2507a5593","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Wildlife%20Federation%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fb72b08c5784","org_name":"The National Wildlife Federation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Wildlife%20Federation%20-%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20National%20Wildlife%20Federation-2021-03-24"}],"summary":"Malicious code on Zoobooks.com may have exposed customers’ order and payment card information entered between February 6, 2019 and December 10, 2020.","supporting_quote":null,"technology_involved":["Zoobooks.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-24","discovered_date":"2020-12-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"568c7455154ef7ebdc06ca770f2a94767dfeab85","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalWildlifeFederation.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cf253fd66b84","org_name":"National Wildlife Federation","org_type":"nonprofit","ransomware":null,"records_affected":3311,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalWildlifeFederation.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10434.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalWildlifeFederation.pdf"}],"summary":"Malicious code on Zoobooks.com was used to capture customers’ order and payment information during the period stated in the notice.","supporting_quote":null,"technology_involved":["Zoobooks.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-24","discovered_date":"2020-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"432e49bbde9709af74a2269eb29defea662cd46d","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Capcom%20U.S.A.%2C%20Inc.%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ad910c12b10e","org_name":"Capcom U.S.A., Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539439"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Capcom%20U.S.A.%2C%20Inc.%20-%20Notice.pdf"}],"summary":"Capcom U.S.A., Inc. reported that files containing personal information were subject to unauthorized access before November 1, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c548296e7c7f670b36f6d883f7cce55fef35ff7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-03-18","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Letter%20to%20Owners%20%203-22-2021.pdf"},"notes":null,"org_country":"US","org_id":"40db827f322c","org_name":"State Controller's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee clicked a link in a deceptive email and provided an unauthorized user access to the employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539387"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Letter%20to%20Owners%20%203-22-2021.pdf"}],"summary":"A phishing email gave an unauthorized user access to a State Controller's Office employee's email account, which may have contained personal identifying information.","supporting_quote":"A SCO employee clicked on a link in an email that appeared to come from a trusted outside entity and unknowingly provided an unauthorized user with access to their email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-23","discovered_date":"2021-02-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6014eae477fa40e1cb07f73e1eb44749a5d3a1d","impact_type":"data_theft","incident_date":"2021-02-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2%20Hagerty%20Ind%20Notice%20CA%2003.23.2021.pdf"},"notes":null,"org_country":"US","org_id":"3b5632f894f4","org_name":"Hagerty Insurance Agency, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Personal information was inadvertently embedded in the quote webpage source code and was accessible to attackers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539374"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2%20Hagerty%20Ind%20Notice%20CA%2003.23.2021.pdf"}],"summary":"Hagerty said bots targeting its Instant Quote feature could access personal information embedded in the quote webpage source code.","supporting_quote":"While this additional personal information was not visible on the webpage itself, the attacker could search the source code to find it.","technology_involved":["Instant Quote feature","quote webpage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab449f49d618b61c060700adf34bbb597dcf4140","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"23453dfc77a2","org_name":"Carding Mafia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Carding Mafia (March 2021)","type":"hibp","url":"https://haveibeenpwned.com/Breach/CardingMafia"}],"summary":"The Carding Mafia forum suffered a data breach that exposed members' email addresses, usernames, IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea8f4ccbe0e126b964dc1d7b4b707fd34c1f1753","impact_type":"unknown","incident_date":"2020-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Smith%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0d561c89e89","org_name":"Ascentium inc. and Ascentium Corp. (Smith)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539405"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ascentium%20Inc%20and%20Ascentium%20Corp%20%28SMITH%29-2021-03-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1530"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-22","discovered_date":"2020-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf60d441123960ecab1498f22644197a21d69d5d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Solairus%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5a2e4ef05755","org_name":"Solairus Aviation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539359"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Solairus%20Notice.pdf"}],"summary":"An unauthorized third party accessed some of Solairus Aviation’s data in a vendor’s cloud storage.","supporting_quote":"On December 23, 2020, we were notified by a third-party vendor of an unauthorized intrusion into the vendor’s Microsoft Azure cloud hosting platform that is used to host our flight scheduling and tracking system.","technology_involved":["Microsoft Azure","flight scheduling and tracking system","cloud storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ad71765691dac8514a08f71b61cbf9fbb52fb08","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PCS%20Revenue%20Ad%20TA%20SSN%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"4cb3046ad0b7","org_name":"PCS Revenue Control Systems","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539332"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PCS%20Revenue%20Ad%20TA%20SSN%20r1prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10428.pdf"}],"summary":"PCS Revenue Control Systems reported unauthorized access to a server belonging to Advanced Business Technologies that contained files and records related to school lunch and meal programs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-22","discovered_date":"2021-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a48e749b98a0c8ad7cc284eeadc660b669dc8e48","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10433.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"92eef1a818ab","org_name":"On Q Financial","org_type":"financial","ransomware":null,"records_affected":18066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10433.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10433.pdf"}],"summary":"On Q Financial reported that customer data may have been exposed from a backup storage location.","supporting_quote":null,"technology_involved":["backup storage location"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2021-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3270f3624949ea1c93c99e51fd2a7e0e3f27e7e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5b83e780-e4a5-11eb-8ef6-fbb8d39928b9"},"incident_date":"2021-03-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"f45048c1dfbf","org_name":"Maharashtra Industrial Development Corporation","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ehackingnews.com/2021/03/midcs-server-hacked-threat-to-destroy.html"}],"summary":"The server of Maharashtra Industrial Development Corporation was hacked as of late. The ransomware 'SYNack' affected the applications and database servers facilitated at the MIDC headquarters in Mumbai by encrypting the information put away in these servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-20","discovered_date":"2020-11-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c930f3e6de5abfe6167ded0945addd43f9cf75b7","impact_type":"unknown","incident_date":"2020-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"92f9cb5cf5db","org_name":"Colin Rockey Hackett Law, PC","org_type":"unknown","ransomware":null,"records_affected":710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colin%20Rockey%20Hackett%20Law%2C%20PC-2021-03-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb2eb386f28c740486e1d4c02e0ed034d0b20b2e","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Victor%20Community%20Support%20Services%20CA%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"92293c99da6e","org_name":"Victor Community Support Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539319"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Victor%20Community%20Support%20Services%20CA%20Individual%20Notice%20Letter.pdf"}],"summary":"Victor Community Support Services reported that an unencrypted hard drive potentially accessed by unauthorized persons contained employee information, including names and Social Security numbers.","supporting_quote":null,"technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-19","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f3b1d82da16725222cbbd33a7b83ca5a9b460c4","impact_type":"disruption_or_ransomware","incident_date":"2020-10-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SunMed%20Holdings%2C%20LLC%20-%20SSN%20-%20CA%20%5BRedacted%5D%20%289479854x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"daa44c016a3e","org_name":"SunMed Group Holdings, LLC","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"The letter says the attacker likely got in after an employee clicked an external email link.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539296"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SunMed%20Holdings%2C%20LLC%20-%20SSN%20-%20CA%20%5BRedacted%5D%20%289479854x7AB84%29.pdf"}],"summary":"SunMed Group Holdings reported that a ransomware infection encrypted files on some servers and disrupted system operations.","supporting_quote":"As a result, a “hacker” was able to get into our computer system (likely through one of our employees clicking on an external link in an email that was not cleared through our email scanning tool) and lock it up from being able to function.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2021-03-19","discovered_date":"2021-01-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b03d56262b08bf314554870f4fd9cde2d8e60e25","impact_type":"data_theft","incident_date":"2021-01-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Insulet%20Corporation%20Notice%20-%20Security%20Incident_FINAL_3.17.2021_v2.pdf"},"notes":null,"org_country":"US","org_id":"48fd4f4113a5","org_name":"Insulet Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Insulet%20Corporation%20Notice%20-%20Security%20Incident_FINAL_3.17.2021_v2.pdf"}],"summary":"Insulet reported that an unauthorized third party accessed systems at its training vendor, Cornerstone, and may have accessed or downloaded customer names, email addresses, and training records.","supporting_quote":null,"technology_involved":["Cornerstone On-Demand"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Cornerstone On-Demand"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"e1fea7427c64","name":"Cornerstone On-Demand"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6e20ea2ab584df8fc7bef20efb02399ea0c91b3","impact_type":"unknown","incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_5.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d47fde6d14e","org_name":"Cancer Treatment Centers of America at Midwestern Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539315"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America%20at%20Midwestern%20Regional%20Medical%20Center-2021-03-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7d195850504a2e5f1a5018c63de06fabd8ebaa07","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10431.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5332a49e1516","org_name":"Cancer Treatment Centers of America","org_type":"unknown","ransomware":null,"records_affected":579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10431.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96fc601f864fc954704a261fba89b68ed2100ad2","impact_type":"unknown","incident_date":"2020-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Letter%20PDF.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72aab195e3ce","org_name":"Brandman Centers for Senior Care","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539318"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5f4cee318e618218066144cd458315ec7480b768","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10430.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"49087f381cc4","org_name":"Manson Construction Co.","org_type":"other","ransomware":null,"records_affected":1049,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10430.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10430.pdf"}],"summary":"Manson Construction Co. reported a 2020 data security incident in which individuals’ names, mailing addresses, and Social Security numbers may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb737a109192f3db54fd05ec36ac4f54185dc008","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JEFIT%20Data%20Breach%20Notificaiton.pdf"},"notes":null,"org_country":"US","org_id":"8069a675c450","org_name":"Jefit, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539268"},{"fetched_at":null,"title":"Have I Been Pwned: Jefit","type":"hibp","url":"https://haveibeenpwned.com/Breach/Jefit"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JEFIT%20Data%20Breach%20Notificaiton.pdf"}],"summary":"Jefit reported that a perpetrator accessed account usernames, email addresses, salted encrypted passwords, and account-creation IP addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-17","discovered_date":"2021-01-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1e464018964cf0055b50a7bc69c13e45e57abed","impact_type":"data_theft","incident_date":"2020-12-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Base%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c02b72fdd0f6","org_name":"Western Union Financial Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Base%20Consumer%20Notification%20Letter.pdf"}],"summary":"Personal information in Western Union money-transfer operational reports handled by Kroger was stolen after Kroger’s Accellion file transfer service was compromised.","supporting_quote":"The compromise resulted in an unauthorized party stealing significant volumes of data and records from a large number of Accellion customers, including Kroger.","technology_involved":["Accellion file transfer service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-17","discovered_date":"2021-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"998bcfd0b0718cf335d89349fc2de93fb9a6ea38","impact_type":"data_theft","incident_date":"2020-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10429.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3ca3007f84f6","org_name":"Western Union","org_type":"financial","ransomware":null,"records_affected":1555,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10429.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10429.pdf"}],"summary":"Western Union reported that data in Kroger operational reports transferred through Accellion’s compromised file transfer service was stolen.","supporting_quote":null,"technology_involved":["Accellion file transfer service"],"third_party":{"archetype":null,"involved":true,"vendor":"Accellion"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-17","discovered_date":"2021-02-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0b471f4ddd090d47fbb6961e6a6d24901d55981","impact_type":"unknown","incident_date":"2021-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79663f88f9f8","org_name":"Glenwood Restaurants Inc","org_type":"unknown","ransomware":null,"records_affected":420,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Glenwood%20Restaurants%20Inc-2021-03-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-17","discovered_date":"2021-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e6ed194067585b651a54b6b7ca9d05129ec2008","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISO01297%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"1de3eb7cb4fe","org_name":"California Department of State Hospitals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee with access to the data improperly accessed it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539211"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539698"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISO01297%20Breach%20Notification%20Letter.pdf"}],"summary":"A Department of State Hospitals employee improperly accessed patient and employee data, including COVID-19 test results and related health information.","supporting_quote":"an employee with access to DSH -Atascadero data servers as part of their Information Technology job duties improperly accessed your","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-17","discovered_date":"2021-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3a93eacd96d6fc3df03791a1d13b6627c0b91cb","impact_type":"both","imported_from":null,"incident_date":"2021-02-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10427.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e5c5b60517a8","org_name":"Automatic Funds Transfer Services Inc.","org_type":"financial","ransomware":true,"records_affected":695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10427.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10427.pdf"}],"summary":"Automatic Funds Transfer Services Inc. reported a ransomware attack that disrupted operations and involved unauthorized acquisition of customers’ personal and bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-16","discovered_date":"2020-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"506fe0c18fd0d6dcd9bb8337790de3c785f1963f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Infinity%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f44f1efc6053","org_name":"Infinity Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539174"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Infinity%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Infinity%20Insurance%20Company-2021-03-16"}],"summary":"Infinity Insurance Company reported unauthorized access to files on company servers in December 2020, including a file containing the recipient’s name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"198e54ddfa88d7992d0084329a65e2c3b607499f","impact_type":"unknown","incident_date":"2020-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCM%20Sample%20Notification%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64f3d3f11854","org_name":"Channel Control Merchants, LLC (“CCM”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539173"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-16","discovered_date":"2020-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7282aa4bbdf50937cfe17122052d57b94d1bf744","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/APS%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"159759215b25","org_name":"Automation Personnel Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539172"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/APS%20-%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AutomationPersonnelServicesInc.pdf"}],"summary":"Automation Personnel Services reported that an investigation found personal information in files and folders that may have been accessed by an unknown actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"pompompurin","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-15","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccdec2b70f45c4f9c3a58f3eebaba47ffdda2c71","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a55468c7bed6","org_name":"WeLeakInfo","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WeLeakInfo","type":"hibp","url":"https://haveibeenpwned.com/Breach/WeLeakInfo"}],"summary":"An attacker took over WeLeakInfo’s Stripe account, exposing customer email addresses and other personal and payment-related data.","supporting_quote":null,"technology_involved":["Stripe"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Stripe"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"6456f22731be","name":"Stripe"}],"actor_id":"pompompurin"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-15","discovered_date":"2020-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c14070dba11c0b562dccf9df52f3e6c2601de290","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACCA%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"774f5cbb0fe2","org_name":"Quality CPR Care LLC dba American CPR Care Association","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539140"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACCA%20-%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Quality%20CPR%20Care%20LLC%20dba%20American%20CPR%20Care%20Association-2021-03-15"}],"summary":"Quality CPR Care LLC dba American CPR Care Association found a webshell capable of accessing a database containing customers’ names and payment card numbers, but could not confirm that information was compromised.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-15","discovered_date":"2021-01-22","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1260c34b4b11ed9ea002a4b9d65066915eca1f23","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-20","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Flagstar%20Bank%20Ad%20Standard%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"763a2a23518f","org_name":"Flagstar Bank","org_type":"financial","ransomware":null,"records_affected":61006,"reviewed":false,"root_cause":"A vulnerability in Accellion's file-sharing platform was exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539111"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Flagstar%20Bank%20Ad%20Standard%20r3prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Flagstar%20Bank%2C%20FSB-2021-03-15"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10425.pdf"}],"summary":"An unauthorized party exploited a vulnerability in Accellion's file-sharing platform and accessed some Flagstar information stored there.","supporting_quote":"Accellion, a vendor that Flagstar uses for its file sharing platform, informed Flagstar on January 22, 2021 that the platform had a vulnerability that was exploited by an unauthorized party.","technology_involved":["Accellion file sharing platform"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-15","discovered_date":"2020-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"bacc3f160ab88f6d9249ad46bea5ea90a08b172f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/AHCA%20-%20Notice.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5c28cbddde57","org_name":"CPR AED Course LLC","org_type":"education","ransomware":null,"records_affected":35504,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CPR%20AED%20Course%20LLC%20dba%20American%20Health%20Care%20Academy-2021-03-15"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHCA%20-%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10424.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHCA%20-%20Notice.pdf"}],"summary":"CPR AED Course LLC found a webshell capable of accessing information in its database, but could not confirm whether personal information was compromised.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fdc967c11cacf847f1f2bfb14f2a88ce69e9800","impact_type":"unknown","incident_date":"2020-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Template%20B%20-%20Adult%201%20Year%20CM.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0c9489543c2","org_name":"Alameda-Contra Costa Transit District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539112"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68423439fefd057179402d9c6572616915128d6b","impact_type":"data_theft","imported_from":null,"incident_date":"2021-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e8bddfadd8a6","org_name":"Liker","org_type":"technology_saas","ransomware":null,"records_affected":465141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Liker","type":"hibp","url":"https://haveibeenpwned.com/Breach/Liker"}],"summary":"A breach of Liker exposed email addresses, passwords, private messages, and other personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62998175c224c519987366297e7bf4bec990e921","impact_type":"disruption_or_ransomware","incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Industry%20Specialists%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d2e46342817d","org_name":"Security Industry Specialists","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539051"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Industry%20Specialists%20-%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Security%20Industry%20Specialists-2021-03-11"}],"summary":"Security Industry Specialists discovered that some systems and devices were inaccessible and encrypted, and later learned that personal information was contained in potentially impacted files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-11","discovered_date":"2021-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7ab5671afc0e44c6bea0bf9f619859c220ff77f","impact_type":"both","incident_date":"2021-02-16","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PALIG%20Website%20Notice%20%283_11_2021%29.pdf"},"notes":null,"org_country":"US","org_id":"e66651c0fbb2","org_name":"Pan-American Life Insurance Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attempt resulted in malware being installed on the computer network.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539040"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PALIG%20Website%20Notice%20%283_11_2021%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pan-American%20Life%20Insurance%20Group-2021-03-11"}],"summary":"Pan-American Life Insurance Group reported that phishing led to malware installation, unauthorized access to systems containing personal information, and the taking of some policyholder and beneficiary information.","supporting_quote":"Our investigation concluded that a phishing attempt resulted in malware being installed on our computer network.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-11","discovered_date":"2020-05-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96eee500c8c7053f76cda29a4a8b614adddfe779","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2021-01-22_BNL_English-REVISED.pdf"},"notes":null,"org_country":"US","org_id":"aa042cb62a94","org_name":"Central California Alliance for Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539067"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2021-01-22_BNL_English-REVISED.pdf"}],"summary":"Central California Alliance for Health reported that an unknown person illegally accessed employee email accounts, and limited member health information may have been accessed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83d6bd85515b030931bc6d70140e0b137448b2da","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"09be1ec1d00a","org_name":"Travel Oklahoma","org_type":"government","ransomware":null,"records_affected":637279,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Travel Oklahoma","type":"hibp","url":"https://haveibeenpwned.com/Breach/TravelOK"}],"summary":"A breach at the Oklahoma state Tourism and Recreation Department exposed email addresses, age groups, dates of birth, genders, names, and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f1202c2f4969356d83754f599c1d785292ed57f5","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10420.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e89e81f9b05e","org_name":"Public Utility District No. 1 of Skagit County","org_type":"energy_utilities","ransomware":true,"records_affected":23935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10420.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10420.pdf"}],"summary":"Ransomware compromised AFTS servers holding utility billing and paper-check payment information for Public Utility District No. 1 of Skagit County; access to the information by attackers was not confirmed.","supporting_quote":null,"technology_involved":["AFTS servers","AFTS databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AFTS"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"e5c5b60517a8","name":"AFTS"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2021-03-10","discovered_date":"2020-12-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e622ca6f2f85b7ff4e16b3ca2e1afc9e9a8c2eb","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10419.pdf"},"notes":null,"org_country":"US","org_id":"59acb7389429","org_name":"Mead Johnson & Company, LLC","org_type":"unknown","ransomware":null,"records_affected":2828,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10419.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10419.pdf"}],"summary":"An unknown outside actor used an ActiveProspect employee’s credentials to access Mead Johnson account data held by ActiveProspect.","supporting_quote":"On or around November 7 and 8, 2020, an unknown outside actor using the user credentials of an employee of ActiveProspect gained access to MJN’s account data.","technology_involved":["ActiveProspect"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ActiveProspect, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"79855be9ca98","name":"ActiveProspect Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eec3faabcabb598d4b63de45d40461063f335d83","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Island%20Hotel%20Company%20Ad%20US%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"59261edc92cb","org_name":"Island Hotel Company Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Island%20Hotel%20Company%20Ad%20US%20r3prf.pdf"}],"summary":"Island Hotel Company Limited reported that an unauthorized party may have accessed a computer server containing company information and may have accessed or acquired personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"c23eccf901406dd649e96d116ac4e6e1cf298155","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HollidayIngram.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b16af773b22b","org_name":"Holliday Ingram, LLC","org_type":"professional_services","ransomware":null,"records_affected":1631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HollidayIngram.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HollidayIngram.pdf"}],"summary":"Holliday Ingram, LLC reported that an unauthorized individual may have accessed two employee email accounts between June 3 and July 16, 2020.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad0ffbee8fc9e3687690fe0180ac9734384c4ebf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8cc75b4d4dd5","org_name":"CorePower Yoga, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CorePower%20Yoga%2C%20LLC-2021-03-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"55b813578e54f13d16205543fb63734ee4e2ee7f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/McLeodOccupational.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d03368e59c08","org_name":"McLeod Occupational Health, LLC","org_type":"unknown","ransomware":null,"records_affected":15738,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/McLeodOccupational.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-08","discovered_date":"2020-12-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03fb3d6a1d3b062c787a7adb3e8c7fc986957750","impact_type":"data_theft","incident_date":"2020-10-12","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/283533%20Cotiviti%20-%20Mbr%20Breach%20Letter_2nd_FINAL%203-8-21.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Visionary employee misused authorized access to Humana data to disclose medical records for a personal business endeavor.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538937"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/283533%20Cotiviti%20-%20Mbr%20Breach%20Letter_2nd_FINAL%203-8-21.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Humana.pdf"}],"summary":"A Visionary employee used authorized access to disclose Humana medical records to unauthorized individuals through a personal Google Drive account.","supporting_quote":"In the incident described above, t he Visionary employee, who was authorized to access and use the data for Humana purposes, disclosed the information to the unauthorized individuals through a personal Google Drive account.","technology_involved":["Google Drive"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Visionary"},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"vendors":[{"id":"0a55144620ed","name":"Visionary"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2021-03-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd2dec04cadf17e10b11b8efc5a8afb5f87f543f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c3907cc0-4635-11ec-b26b-73b5a62f8946"},"incident_date":"2021-03-08","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c94847c7388","org_name":"ClearBalance","org_type":"financial","ransomware":null,"records_affected":209719,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/clearbalancedata-incidentimpactsover-200000uspatientspii;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/200-000-patients-exposed-after-hackers-tried-to-wire-money-from-clearbalance-funds.html"}],"summary":"ClearBalance, a California-based company, is notifying over 200,000 customers that their personally identifiable information (PII) may have been stolen during a recent email hacking event. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fcf456ed6eaae32b293b278931b3a734d47f11a","impact_type":"data_theft","incident_date":"2020-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"3044c3e18593","org_name":"Metromile Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10418.pdf"}],"summary":"Metromile said unknown actors used its online quote form and application process to obtain some individuals’ personal information, including driver’s license numbers.","supporting_quote":null,"technology_involved":["online quote form","application process"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-05","discovered_date":"2021-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d973d7f27f1d66c4b767b61bcb6dcd592bb0dd14","impact_type":"data_theft","incident_date":"2021-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAFMAA%20notice.pdf"},"notes":null,"org_country":"US","org_id":"c172bae308af","org_name":"The American Armed Forces Mutual Aid Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAFMAA%20notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20American%20Armed%20Forces%20Mutual%20Aid%20Association-2021-03-05"}],"summary":"An unauthorized actor accessed certain AAFMAA systems and removed and/or viewed files; names and other unspecified information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-03-05","discovered_date":"2021-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"0651fe29f8e779dd83f0e6307634e16b452f13fd","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SandhillsMedicalFound.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f9d0cd433f7","org_name":"Sandhills Medical Foundation","org_type":"healthcare","ransomware":true,"records_affected":38751,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SandhillsMedicalFound.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SandhillsMedicalFound.pdf"}],"summary":"Hackers accessed a storage vendor’s system and took Sandhills Medical Foundation data, which the vendor said was returned after it paid a ransom.","supporting_quote":"On January 8, 2021, the vendor notified Sandhills that hackers accessed their system and took Sandhill’s’ data on or before December 3, 2020.","technology_involved":["online data storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1567"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-05","discovered_date":"2020-12-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dfe4a16ac4369e6f4e5b14695e4bf96633cbc1e2","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10417.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b073d18ce6ae","org_name":"Ascentium Inc. and Ascentium Corp.","org_type":"unknown","ransomware":true,"records_affected":172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10417.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10417.pdf"}],"summary":"Ascentium reported ransomware affecting an onsite server with legacy employee information, and later learned that data had been extracted and uploaded to the dark web.","supporting_quote":null,"technology_involved":["onsite server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-05","discovered_date":"2021-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ef52edb40af2613ede34b8b421f584e8707c1f68","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AAFMAA.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b07a8c6ac823","org_name":"American Armed Forces Mutual Aid Association","org_type":"financial","ransomware":null,"records_affected":4318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AAFMAA.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10414.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AAFMAA.pdf"}],"summary":"An unauthorized actor accessed AAFMAA systems and removed and/or viewed files containing information that may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-04","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc896e1d7ad162d4458cb2dbcef941a5a03ba49f","impact_type":"unknown","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c4b2ae97981","org_name":"Trillium Community Health Plan","org_type":"unknown","ransomware":null,"records_affected":2181,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trillium%20Community%20Health%20Plan-2021-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-03-04","discovered_date":"2021-01-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a2ec0f12549721740a279c70475e08c7d7273be","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-04","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trinity%20-Notice.pdf"},"notes":null,"org_country":"US","org_id":"4aa46c786cb0","org_name":"Saint Alphonsus Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538900"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trinity%20-Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Saint%20Alphonsus%20Health%20System-2021-03-04"}],"summary":"An employee email account at Saint Alphonsus Health System was accessed without authorization, and personal and medical information may have been accessible.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-04","discovered_date":"2021-01-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d30526663c8817a205e7aa566dd6f99658b2a7bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Root%20Insurance%20Company%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2be7a2affc0b","org_name":"Root Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538890"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Root%20Insurance%20Company%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Root%20Insurance%20Company-2021-02-25"}],"summary":"Root Insurance Company identified suspicious account creation through its website that triggered prefill of individuals’ driver’s license, birth date, and vehicle information.","supporting_quote":null,"technology_involved":["Root website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efcd88aee0d13a6a67ced9f0a4b29d411882812f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LA%20Phil%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e8bc86802809","org_name":"Los Angeles Philharmonic Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538912"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LA%20Phil%20-%20California%20Notification.pdf"}],"summary":"An unauthorized person accessed an employee’s email account between December 3 and December 16, 2020, and information in the accounts may have included personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2021-03-04","discovered_date":"2020-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a99cda5bc418542cee622ce8ec6e1adf73b012b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/consumer%20notice%20template%20-%20update%20to%2012-29%20notice%20recipients%20%28002%29.pdf"},"notes":null,"org_country":"US","org_id":"04105e4163d7","org_name":"Americold Realty Trust","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538878"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539597"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/consumer%20notice%20template%20-%20update%20to%2012-29%20notice%20recipients%20%28002%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Americold%20Realty%20Trust-2021-03-04"}],"summary":"Americold Realty Trust reported a security incident in which personal information in files may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-03","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"339c7995e7f739a1caf37c80e7908b57ed96b343","impact_type":"both","incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/La%20Jolla%202%20Ad%20CM%20SSN%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"a93e48fe5d13","org_name":"La Jolla Country Day School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538837"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/La%20Jolla%202%20Ad%20CM%20SSN%20r1prf.pdf"}],"summary":"La Jolla Country Day School reported that personal information in legacy files held by Blackbaud may have been exposed following Blackbaud's 2020 ransomware incident.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2021-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17efbd0107ba0a5934301d049819bb5742236d68","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"58bc3a102335","org_name":"Gab","org_type":"technology_saas","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gab","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gab"}],"summary":"Gab suffered a data breach that exposed user accounts, some private chat logs, and public groups and posts.","supporting_quote":null,"technology_involved":["Gab"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-02","discovered_date":"2021-01-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf127018fa49ceb19591028d5e3feed967b310af","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Hartford%20Sample%20consumer%20notification.PDF"},"notes":null,"org_country":"US","org_id":"cbc4cd77f333","org_name":"The Hartford Fire Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538552"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Hartford%20Sample%20consumer%20notification.PDF"}],"summary":"Unidentified persons misused The Hartford's online auto insurance quote application, potentially exposing consumers' driver’s license numbers.","supporting_quote":null,"technology_involved":["online auto insurance quote application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fc6fa566abbdefde81a1e314eb06c86ade14809","impact_type":"data_theft","imported_from":null,"incident_date":"2021-01-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"7a90228435e3","org_name":"Oxfam Australia","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Oxfam","type":"hibp","url":"https://haveibeenpwned.com/Breach/Oxfam"}],"summary":"A data breach exposed supporters’ email addresses and other personal and financial information, which was later made freely available on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-02","discovered_date":"2021-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4df59ae0c83a8c62e56d4a48063fade9940d82ef","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10412.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b96d68dab825","org_name":"Northshore Utility District","org_type":"energy_utilities","ransomware":true,"records_affected":4900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10412.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10412.pdf"}],"summary":"Northshore Utility District learned that customer information stored on AFTS systems was affected by a ransomware incident, though the extent of any exposure remained under investigation.","supporting_quote":null,"technology_involved":["AFTS cloud-based service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AFTS"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"e5c5b60517a8","name":"AFTS"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-02","discovered_date":"2020-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dec26cff733f1077e4758b2e4b55cbb5496a243","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hurtigruten%20notice.pdf"},"notes":null,"org_country":"US","org_id":"b461c72217a5","org_name":"Hurtigruten","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hurtigruten%20notice.pdf"}],"summary":"An unauthorized actor remotely accessed Hurtigruten's network and encrypted parts of its computer systems; guest personal information was identified as affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2eae984057b6b081385489961387335a4e6a167e","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HammondSchool.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"9e790b40b6b7","org_name":"Hammond School","org_type":"education","ransomware":null,"records_affected":1743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HammondSchool.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HammondSchool.pdf"}],"summary":"Cybercriminals obtained Hammond School records containing personal information from Blackbaud’s systems.","supporting_quote":"In late September of 2020, we received a follow up notification from Blackbaud informing us that based on its additional investigation into the incident, the cybercriminals obtained some of Hammond’s records containing the personal information of students, vendors, and alumni.","technology_involved":["Blackbaud","cloud-based data management services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-13","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efd87c42475697fd2466a390ac411dcbc34bfae4","impact_type":"disruption_or_ransomware","incident_date":"2020-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cardinal-%20%20breach%20letter.pdf"},"notes":null,"org_country":"US","org_id":"56ef71006dae","org_name":"Cardinal Logistics Management Corp.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538533"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cardinal-%20%20breach%20letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cardinal%20Logistics%20Management%20Corp.-2021-03-02"}],"summary":"An attack encrypted several systems in Cardinal Logistics Management Corporation’s environment, and information related to current and former employees was impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96eaacee910da3c5eb2857c4046dc95c7cc4712e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f7d3d00-d50d-11eb-8806-c7cd39544f5b"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"94eb57f379d5","org_name":"Upstox","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/shinyhunters-broker-firm-upstox-database-leak/"}],"summary":"Upstox an Indian low-cost broker firm had it's taken stolen by hackers and put for sale on criminal forums","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0730b5d20bf4f09749ffe4b8a0c9c91a74344f5d","impact_type":"both","imported_from":null,"incident_date":"2021-02-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"NL","org_id":"12cc6f3be963","org_name":"Ticketcounter","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"Ticketcounter inadvertently published a database backup to a publicly accessible location.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ticketcounter","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ticketcounter"}],"summary":"Ticketcounter inadvertently exposed a database backup that was downloaded and later used in a ransom threat.","supporting_quote":"In August 2020, the Dutch ticketing service Ticketcounter inadvertently published a database backup to a publicly accessible location where it was then found and downloaded in February 2021 .","technology_involved":["database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f31f781ee675d6f89ea4c44d3f7641adee403de","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e879ff10-e655-11eb-b667-c585fe0ca11b"},"incident_date":"2021-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5cf22082de4","org_name":"Tether","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/cryptocurrency-firm-tether-hacked-refuses-to-pay-ransom-a-16090"}],"summary":"Tether a cryptocurrency company got hit by ransomware that demanded over 24 million for decryption","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccdbf83b8e83712edb24a924b9d75850a69d486f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7077c350-8e69-11ec-a600-657ec2694f8f"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"652501b2808a","org_name":"Swarmarket","org_type":"technology_saas","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/600000-payment-cards-stolen-from-swarmshop-darknet-market-a-16367"}],"summary":"Swarmshop a criminal market place was compromised leaking 600k stolen credit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2ef33e984c479e5e29671c0ac066de030d3c0f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2fee0350-4894-11ec-be64-495e033b0bce"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"8269301ce2c0","org_name":"RDC","org_type":"other","ransomware":null,"records_affected":7300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nltimes.nl/2021/03/25/millions-dutch-affected-data-leak-car-companies-service-report;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.dutchnews.nl/news/2021/03/hackers-steal-information-about-millions-of-car-owners-from-garage-databases/"}],"summary":"The personal data of potentially millions of Netherlands residents was available for sale online. The data was stolen from RDC, a company that provides car garages with IT services. It includes home addresses, telephone numbers, email addresses, licence plates, and dates of birth","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43aaf86a5b54ac7d1f9d790e1c0bb34a2c2a6d45","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a66e6570-0fdb-11ec-8c66-bd734728b5ba"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6b80bb89410f","org_name":"Pembroke College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cherwell.org/2021/05/17/exclusive-sensitive-alumni-data-made-available-in-pembroke-college-telethon-leak/"}],"summary":"Sensitive alumni data made available in Pembroke College telethon leak","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5148b4759d9e6be93b617db9a1bc7f2592d6f2b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ef8d6e0-0789-11ed-8fd4-9be359ef207c"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"578130630d46","org_name":"MCG Health","org_type":"healthcare","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.seattletimes.com/business/seattle-medical-firm-sued-for-alleged-breach-exposing-1-1-million-patients-health-data/"}],"summary":"MCG Health had their infrastructure compromised by unknown external actor which impacted 10 hospitals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2651b26e991936a006a725418e245ad265bcf6db","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6eb53180-e651-11eb-b667-c585fe0ca11b"},"incident_date":"2021-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"418620fdb8c2","org_name":"Honeywell International Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberscoop.com/honeywell-cyber-intrusion-industrial/?category_news=technology"}],"summary":"Honeywell systems experienced a temporary disruption of their systems due to an unknown malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0bb14fa88a46c3299603ed1f23d29f97e15e510","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96bbb480-e4a6-11eb-8ef6-fbb8d39928b9"},"incident_date":"2021-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0780802e7452","org_name":"Heart of Texas Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://wacotrib.com/ads/community/announcements/legal/public-notice---hipaa-security-breach/ad_8a6b6113-4c01-54b5-87bd-53b65cd86047.html"}],"summary":"Heart of Texas Community Health Center had a user email patient email addresses to their personal email account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1020ddcf0f5a3dbba61117226aa0325afb0c1406","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AllyAlignHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b9c0a590bd3f","org_name":"Ally Align Health, Inc.","org_type":"unknown","ransomware":null,"records_affected":4026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AllyAlignHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f83384c958651e4a589840653bb8342208405ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"288c0c00-4890-11ec-be64-495e033b0bce"},"incident_date":"2021-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"9e7b31304045","org_name":"Adecco Group","org_type":"other","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cybernews.com/security/5-million-adecco-com-users-data-leaked/?&web_view=true;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www2.staffingindustry.com/eng/Editorial/Daily-News/World-Adecco-Group-investigating-serious-data-breach-56940"}],"summary":"Company hacked, data posted for sale on hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9a95c8e5ebfad96c03521bda87f0e35471d150a","impact_type":"data_theft","imported_from":null,"incident_date":"2021-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"b47165261885","org_name":"SuperVPN and GeckoVPN","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SuperVPN & GeckoVPN","type":"hibp","url":"https://haveibeenpwned.com/Breach/SuperVPNGeckoVPN"}],"summary":"A breach involving SuperVPN and GeckoVPN exposed records containing email addresses, login histories, locations, and device information.","supporting_quote":null,"technology_involved":["SuperVPN","GeckoVPN"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-27","discovered_date":"2021-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46d8f26aa11ac5ba6f1e344998fc8b0730864b95","impact_type":"data_theft","incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10410.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"5deca7ece1f5","org_name":"Casemaker, LLC","org_type":"technology_saas","ransomware":null,"records_affected":1690,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10410.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10410.pdf"}],"summary":"Attackers used malicious code to access Casemaker Libra database tables, and stolen data may have included personal information and passwords.","supporting_quote":null,"technology_involved":["Casemaker Libra"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-26","discovered_date":"2021-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cc928bacf586d7f26989a1a511abfb254a91545","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Summit%20BHC%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"608f4dfddf4b","org_name":"Summit Behavioral Healthcare, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538369"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Summit%20BHC%20-%20Notice.pdf"}],"summary":"Summit Behavioral Healthcare investigated unauthorized access to two employee email accounts after suspicious activity and found that protected health information may have been affected.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6244c12c4b3de17b5ba829311701e5a60f52d44","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Santa%20Rosa%20Community%20Health%20-%20Notification%20Letter%20%28SSN%20%2B%20Health%20Data%29%20-%20IDX%20w%20Spanish.pdf"},"notes":null,"org_country":"US","org_id":"40f7600c607a","org_name":"Santa Rosa Community Health Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538397"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Santa%20Rosa%20Community%20Health%20-%20Notification%20Letter%20%28SSN%20%2B%20Health%20Data%29%20-%20IDX%20w%20Spanish.pdf"}],"summary":"Santa Rosa Community Health Centers reported unauthorized access to a corporate email account that may have contained personal and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-26","discovered_date":"2020-09-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76058ee59340e70d1d4a588afaf2e7a0c0d9eb6b","impact_type":"unknown","incident_date":"2020-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bbd3a785bc2f","org_name":"Nagel & Padilla, LLC","org_type":"unknown","ransomware":null,"records_affected":667,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nagel%20%26%20Padilla%2C%20LLC-2021-02-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2165adf56dec0494add97673a98d7cf11f38ec3c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/JimNNicks.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"201724c80a61","org_name":"Jim 'N Nick's Bar-B-Q","org_type":"unknown","ransomware":null,"records_affected":1944,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/JimNNicks.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce65a5bf4102977bcebdf2245cb787a03203eb30","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMC_California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"6730a09e0300","org_name":"International Medical Corps","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538384"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMC_California%20Notification.pdf"}],"summary":"International Medical Corps determined that information in a backup file held by Blackbaud was involved in a ransomware incident.","supporting_quote":"Blackbaud notified us that it had discovered a ransomware attack on its network.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-26","discovered_date":"2021-02-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bcb5092af92ef6bd4a8e5da8b6ee03ab14dc2feb","impact_type":"unknown","incident_date":"2020-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e239c1abace","org_name":"Integon National Insurance Company","org_type":"unknown","ransomware":null,"records_affected":208000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integon%20National%20Insurance%20Company-2021-02-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ece8c18832fb5092ff4ecf970671e4d18ee750fb","impact_type":"data_theft","incident_date":"2019-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BSN%20Notice%20AC802_v02%5B1%5D.pdf"},"notes":null,"org_country":"US","org_id":"b083f60a0233","org_name":"BSN Sports, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538406"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BSN%20Notice%20AC802_v02%5B1%5D.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BSN%20Sports%2C%20LLC-2021-02-26"}],"summary":"A criminal actor compromised the checkout pages of four BSN Sports eCommerce websites and copied payment card and personal information submitted there.","supporting_quote":null,"technology_involved":["eCommerce websites","checkout pages"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2021-02-26","discovered_date":"2020-11-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a473d16ff75d898a3c2a8dfdbccc489b69bc1f6","impact_type":"data_theft","incident_date":"2020-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arrow%20Truck%20Sales%2C%20Inc.%20%E2%80%93%20Sample%20of%20Individual%20Notification%20%E2%80%93%20California_2.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"23c135752bf0","org_name":"Arrow Truck Sales, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538385"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arrow%20Truck%20Sales%2C%20Inc.%20%E2%80%93%20Sample%20of%20Individual%20Notification%20%E2%80%93%20California_2.pdf"}],"summary":"Arrow Truck Sales reported that an unauthorized third party acquired internal company information and posted it on a publicly accessible website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-26","discovered_date":"2021-02-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"03ecbc6f1ab1d5562195491dd53cff70bfd16c4e","impact_type":"unknown","incident_date":"2020-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d2e500cdb7f2","org_name":"AllyAlign Health, Inc.","org_type":"unknown","ransomware":null,"records_affected":76348,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AllyAlign%20Health%2C%20Inc.-2021-02-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-25","discovered_date":"2020-06-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22713b875ae9d39dc6b7128fe6998c63e96265ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NYDOCS01-%2311535399-v1-CertifiedSafety-Notification-Letter_v4%20%28PRINT%20PROOF%29.pdf"},"notes":null,"org_country":"US","org_id":"b7b9313da680","org_name":"CertifiedSafety, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538302"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NYDOCS01-%2311535399-v1-CertifiedSafety-Notification-Letter_v4%20%28PRINT%20PROOF%29.pdf"}],"summary":"CertifiedSafety detected suspicious activity and determined that a business email account was compromised, potentially exposing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"622966cc78f933ed136ca20223b11ac8fd6a053e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5f6db670-8e7b-11ec-8536-fdd879d89dfb"},"incident_date":"2021-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b82aa61edc5e","org_name":"Achievement Center of LECOM Health (ACLH)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.yourerie.com/news/local-news/data-breach-discovered-at-the-achievement-center-of-lecom-health/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.erienewsnow.com/story/43797546/personal-data-exposed-in-achievement-center-data-breach"}],"summary":"A data breach is affecting clients and families of the Achievement Center of LECOM Health (ACLH), according to a news release.   ACLH is currently working to notify people whose data may have been improperly accessed as a result of the breach.   An investigation was launched imme","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c00fb0a0d8e27870eb60b630adf251fc8d1b52a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fa5e620-463d-11ec-b26b-73b5a62f8946"},"incident_date":"2021-02-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"0b3dea35f312","org_name":"Zee Entertainment Enterprises","org_type":"technology_saas","ransomware":null,"records_affected":9000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techdator.net/zee5-data-breach-pii-of-9-million-zee5-users-allegedly-leaked-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.technadu.com/zee5-leaked-data-nine-million-users-did-not-disclose-it/251211/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://bgr.com/2021/03/03/zee5-data-breach-reported-9-million-users-exposed/"}],"summary":"\"ZEE5,\" the popular Indian video-on-demand platform, has had a security incident that ended up in leaking the data (email addresses, cleartext passwords, full names, DoB) of nine million of its users. The discovery of the leaked data came from independent researchers Rajshekhar R","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-23","discovered_date":"2021-01-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64e3524289c6a9dc644648157c167b4b65d38103","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10408.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ada1f9a75f3f","org_name":"Washington Education Association & Seattle Education Association","org_type":"education","ransomware":null,"records_affected":17415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10408.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10408.pdf"}],"summary":"Staff discovered that malware had encrypted a Seattle Education Association server; the organizations could not rule out access to information stored there.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a2a25c6456f5c33b4d9b7a9a0b82ddc7b3a4e75","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Privacy%20Notification%20020521.pdf"},"notes":null,"org_country":"US","org_id":"e35a546cfdb7","org_name":"Principal Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538229"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Privacy%20Notification%20020521.pdf"}],"summary":"Principal inadvertently sent a file containing personal information to another plan sponsor and its actuary, who confirmed that they deleted it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32390f408ad1208aceea876de858d163d61f11a0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"49b03c648ba0","org_name":"People's Energy","org_type":"energy_utilities","ransomware":null,"records_affected":358822,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: People's Energy","type":"hibp","url":"https://haveibeenpwned.com/Breach/PeoplesEnergy"}],"summary":"People's Energy had a data breach in December 2020 that exposed files containing personal information and staff email addresses and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b930fc7ffc1ca80f49c6e5ff09294308b4683da","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2021-02-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a868c265a76e","org_name":"NurseryCam","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NurseryCam","type":"hibp","url":"https://haveibeenpwned.com/Breach/NurseryCam"}],"summary":"Security flaws in the NurseryCam system exposed parent records, including email addresses, before the service was shut down.","supporting_quote":null,"technology_involved":["NurseryCam"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-23","discovered_date":"2021-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6ff595ef85e9fb77c04f971e4edb1c7caa9c7ea","impact_type":"both","incident_date":"2021-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10407.pdf"},"notes":null,"org_country":"US","org_id":"1ee99ace35a3","org_name":"Lakewood Water District","org_type":"energy_utilities","ransomware":true,"records_affected":14877,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10407.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10407.pdf"}],"summary":"Lakewood Water District’s billing vendor experienced a ransomware attack and reported data exfiltration, while the extent of any impact to District customer data remained unknown.","supporting_quote":null,"technology_involved":["AFTS billing databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Automatic Funds Transfer Services, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"e5c5b60517a8","name":"AFTS"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-23","discovered_date":"2020-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e227502cdddfad751effb8b62eca61cd3e606b99","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20letter%20ADULT%20DEM%20PHOTO%20v4.pdf"},"notes":null,"org_country":"US","org_id":"af9ce57cf70a","org_name":"Kaiser Foundation Hospitals, Northern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee accessed members’ medical records for reasons unrelated to their health care service needs.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538242"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20letter%20ADULT%20DEM%20PHOTO%20v4.pdf"}],"summary":"An employee accessed portions of members’ medical records for reasons unrelated to their health care service needs.","supporting_quote":"On December 28, 2020, Kaiser Permanente determined that one of its employees accessed portions of members’ medical records for reasons unrelated to their health care service needs.","technology_involved":["medical records"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2021-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f63bb2dddf54a50ce9cd214ef768803324df2db","impact_type":"unknown","incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"5b9de7618ab2","org_name":"Filmai.in","org_type":"unknown","ransomware":null,"records_affected":645786,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Filmai.in","type":"hibp","url":"https://haveibeenpwned.com/Breach/FilmaiIn"}],"summary":"In approximately 2019 or 2020, the Lithuanian movie streaming service Filmai.in suffered a data breach exposing 645k email addresses, usernames and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43dbf3b54ad32004d6f3ccaadf0619bce8cecd0f","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_CA_Worldwide%20Facilities%20LLC_L02_SAS_1.pdf"},"notes":null,"org_country":"US","org_id":"f573fd095722","org_name":"Worldwide Facilities, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_CA_Worldwide%20Facilities%20LLC_L02_SAS_1.pdf"}],"summary":"Worldwide Facilities reported an unsuccessful attempt to interfere with its computer system, and files containing personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-22","discovered_date":"2020-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6a1d41232485bc8cc125376ce70d1be9c39e683","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SFUHS%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"17399ce3fafd","org_name":"San Francisco University High School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538186"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SFUHS%20-%20California%20Notification.pdf"}],"summary":"San Francisco University High School reported that backup files containing its information were taken during unauthorized access to Blackbaud systems, with an attempt to encrypt files.","supporting_quote":"Blackbaud notified us and many other institutions on July 16, 2020 that it had discovered an attempted ransomware attack on Blackbaud’s network in May 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b848efccadba3c886d1123de9e92e6d6165c31c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Itochu%20International%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"2dc078545a21","org_name":"ITOCHU International Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Itochu%20International%20Sample.pdf"}],"summary":"An unauthorized party accessed an employee’s email account, which may have contained personal and financial information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-19","discovered_date":"2021-01-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3f9606a4175f0182bdace03ed467f6ea2ecf671","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/All%20Notices.pdf"},"notes":null,"org_country":"US","org_id":"c151ce2ec5f0","org_name":"The Kroger Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An attacker exploited a vulnerability in Accellion’s file transfer service.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538150"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/All%20Notices.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10405.pdf"}],"summary":"An attacker exploited a vulnerability in Accellion’s file transfer service to access files containing Kroger associate benefit information.","supporting_quote":"Accellion has confirmed that an unauthorized person gained access to certain Kroger Family of Companies files by exploiting a vulnerabi lity in Accellion’s file transfer service.","technology_involved":["Accellion file transfer service"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-19","discovered_date":"2020-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea5aae0a353c15939405eba5ce196c90d15faea8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10404.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e25fe662712","org_name":"Renton School District","org_type":"education","ransomware":null,"records_affected":771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10404.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10404.pdf"}],"summary":"Unauthorized individuals accessed certain PSESD employee email accounts, and Renton School District was notified that its personal information was potentially accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2021-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51cc71c0e071516e5b9650b10eee15f16bf91bb9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af3cfec0-3c16-11ec-963f-f964320be408"},"incident_date":"2021-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0bbbd9659e2","org_name":"Health Aid of Ohio","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.calhipaa.com/health-aid-of-ohio-security-breach-impacts-approximately-14100-people/"}],"summary":"Full-service home medical equipment firm, Health Aid of Ohio in Parma, OH, has learned that unauthorized people obtained access to its networks and stolen a number of files. The data breach was identified on February 19, 2021 after noticing suspicious system activity. Health Aid ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-19","discovered_date":"2020-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b85de194fe9e900f389147f93d20fa6e02fcc56c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gallo%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"32814629f95c","org_name":"E & J Gallo Winery","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538155"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gallo%20-%20California%20Notification.pdf"}],"summary":"E & J Gallo Winery reported unauthorized access to company data, with some employment application information potentially accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78ecf767b02f66b8c2ebffb0868f7bd99990ec73","impact_type":"unknown","incident_date":"2021-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20AG%20Notice%20-%20Individual%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a0686f5d049","org_name":"Sequoia Capital Operations, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538102"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-18","discovered_date":"2020-11-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b33d87d3b03b649df3c50391e747b20de237ef33","impact_type":"unknown","incident_date":"2019-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c114865305f2","org_name":"Metro Presort, Inc","org_type":"unknown","ransomware":null,"records_affected":24100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Metro%20Presort%2C%20Inc-2021-02-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58e01314144d98936ab121dc22dd389212d66d42","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10403.pdf"},"notes":null,"org_country":"US","org_id":"507c38a28fc8","org_name":"Lucid Lane, Inc.","org_type":"professional_services","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":"A clerical error caused patients' email addresses to be entered in the To field instead of the Bcc field.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10403.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10403.pdf"}],"summary":"Lucid Lane accidentally exposed patient email addresses by placing recipients in the email's To field instead of its Bcc field.","supporting_quote":"Due t o a clerical error on the part of Lucid Lane, the list of email addresses for patients was inserted in the “To:” field instead of the “Blind carbon copy:” field, which hides email addresses from being seen by other intended email recipients.","technology_involved":["email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Lucid Lane"},"updated_at":"2026-10-12","veris_action":"error","derived":{"vendors":[{"id":"507c38a28fc8","name":"Lucid Lane"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2021-02-17","discovered_date":"2021-01-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e077ee68584a227f0920a232fa1925a8e458d19","impact_type":"disruption_or_ransomware","incident_date":"2020-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10402.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"52db1aae3359","org_name":"Woodcreek Provider Services, LLC","org_type":"professional_services","ransomware":true,"records_affected":25917,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10402.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10402.pdf"}],"summary":"Woodcreek Provider Services reported that its information hosted by Netgain Technology was involved in a cyberattack, after which Netgain paid a ransom to regain control of its systems and recover affected data.","supporting_quote":null,"technology_involved":["Netgain Technology, LLC"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Netgain Technology, LLC"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"8b6ba8d3290f","name":"Netgain"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3c2c79294e7e98bc27f0c7d71e4183e4bb93cbd","impact_type":"data_theft","imported_from":null,"incident_date":"2021-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"LT","org_id":"5eda8dcab348","org_name":"CityBee","org_type":"transportation_logistics","ransomware":null,"records_affected":110156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CityBee","type":"hibp","url":"https://haveibeenpwned.com/Breach/CityBee"}],"summary":"CityBee announced a breach that exposed customer names, email addresses, government-issued IDs, and passwords stored as unsalted SHA-1 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6794b9cc13574f35ad97495ee73c65a9fed61fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2021-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AxleHire%20Consumer%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"bc3021374b6b","org_name":"AxleHire Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A software glitch caused some drivers to receive other drivers' 1099 forms.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538046"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AxleHire%20Consumer%20Notice%20Letter.pdf"}],"summary":"A software glitch caused some AxleHire drivers to receive other drivers’ 1099 forms containing names, addresses, and Social Security numbers.","supporting_quote":"When we were preparing the 1099 tax forms for our drivers in January 2021, there was a software glitch that resulted in some drivers receiving the wrong 1099 forms.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-16","discovered_date":"2021-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bb86a807cb541a9570467e99b161210fc949f01","impact_type":"both","incident_date":"2020-10-24","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Letter%20-%20IDX%20Proof%20Copy.pdf"},"notes":null,"org_country":"US","org_id":"38454e46d351","org_name":"Harvard Eye Associates","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538038"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Letter%20-%20IDX%20Proof%20Copy.pdf"}],"summary":"Hackers accessed a data-storage vendor’s system and took Harvard Eye patient information, then demanded money to return the data.","supporting_quote":"On January 15, 2021, the vendor notified Harvard Eye that hackers had accessed the vendor’s computer system and taken some of our data.","technology_involved":["online data storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1e226327ceb13b3f40ee1fe0626a9b1336b7f4c","impact_type":"data_theft","imported_from":null,"incident_date":"2017-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3a0e0d719c6d","org_name":"Ge.tt","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ge.tt","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gett"}],"summary":"Ge.tt suffered a data breach in May 2017 that exposed names, social media profile identifiers, password hashes, and email addresses.","supporting_quote":null,"technology_involved":["file sharing platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-16","discovered_date":"2020-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd933f89547d950bc11c1c45b4f80ead5477a82a","impact_type":"data_theft","incident_date":"2020-11-18","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CW%20General%20Template%20%28Final%29.pdf"},"notes":null,"org_country":"US","org_id":"901d669f18da","org_name":"Citywide Home Loans, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538034"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CW%20General%20Template%20%28Final%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Citywide%20Home%20Loans%2C%20LLC-2021-03-19"}],"summary":"An unauthorized person remotely accessed Citywide Home Loans’ computer network and acquired information that may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ad760d0860cde8dadd0be1091a82ce3ccca3f16","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%26J%20Training%20-%20Consumer%20Notification%20Letter%20%28General%29.pdf"},"notes":null,"org_country":"US","org_id":"39e67a09c4fc","org_name":"Apprentice and Journeymen Training Trust Fund of the Southern California Plumbing & Piping Industry","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538037"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%26J%20Training%20-%20Consumer%20Notification%20Letter%20%28General%29.pdf"}],"summary":"The organization detected unusual activity involving an employee email account, and an investigation found that personal information could have been impacted.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd077f38b7713f005dbc968d4eb2c510da3bda97","impact_type":"both","incident_date":"2020-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Letter%20-%20IDX%20Proof%20Copy_2.pdf"},"notes":null,"org_country":"US","org_id":"5a4ad1317837","org_name":"Alicia Surgery Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538039"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Letter%20-%20IDX%20Proof%20Copy_2.pdf"}],"summary":"Hackers accessed a vendor’s computer system and took data that included information about Alicia Surgery Center patients; the vendor paid the hackers’ demand for its return.","supporting_quote":null,"technology_involved":["online data storage"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5a3002cef1fe1474bfbc1d3295707e59a72399b8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10401.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5dce5e5cad2e","org_name":"Washington State Auditor's Office","org_type":"government","ransomware":null,"records_affected":1420520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10401.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10401.pdf"}],"summary":"An unauthorized person accessed data stored in the Washington State Auditor's Office file transfer account with Accellion.","supporting_quote":null,"technology_involved":["Accellion file transfer service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Accellion"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"3c45248c1743","name":"Accellion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c7b98a4b91ef7cce6739b5245191d8c193a9236","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58bd49e76ddb","org_name":"Emerson Equity, LLC","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Emerson%20Equity%2C%20LLC-2021-02-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccff8d4589a63423a77f2373317beaa6280ee7f3","impact_type":"data_theft","incident_date":"2021-01-21","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rakuten%20USA%2C%20Inc.-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"146ac160f78a","org_name":"Rakuten Americas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537958"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rakuten%20USA%2C%20Inc.-%20Notice.pdf"}],"summary":"An employee transferred files containing employees’ sensitive personal information off a Rakuten-issued computer.","supporting_quote":"On or about January 21, 2021, Rakuten’s data security team detected that an employee who was in the process of voluntarily leaving the company had transferred a number of files off their Rakuten-issued computer.","technology_involved":["Rakuten-issued computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-11","discovered_date":"2020-06-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e077f91e825cc11e4900b47141bb1169765ec943","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Elwyn%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b07101bbe1b8","org_name":"Elwyn","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Elwyn%20-%20Notice.pdf"}],"summary":"Elwyn discovered unauthorized access to employee email accounts, and its review found personal information in the accounts that could have been accessed.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-10","discovered_date":"2020-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d76f62245a28f16a9e3e6721e3af8798aa07727","impact_type":"both","incident_date":"2020-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Westlake%20Hardware%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"d8b85c846412","org_name":"Westlake Hardware, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Westlake%20Hardware%20-%20Notice.pdf"}],"summary":"Westlake Hardware reported that an unknown actor accessed and acquired files from its systems, which were discovered inaccessible on August 26, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4010a28e3545798e363bb9485c280fffff5ff312","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ce1fdea0-1ae9-11ec-8477-47d0f236e203"},"incident_date":"2021-02-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"2ce7eb4e3e81","org_name":"Trade Me","org_type":"retail_ecommerce","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/business/124268534/more-than-1000-trade-me-accounts-swapped-briefly-exposing-personal-information"}],"summary":"More than 1000 Trade Me accounts swapped, briefly exposing personal information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa1fc2b78e1131e61a02baebb377a7c80c43e3db","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9b712d90-8ddc-11ec-bb25-234a6ad089e5"},"incident_date":"2021-02-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17386514ab3a","org_name":"Penn Foundation","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mcall.com/news/breaking/mc-nws-bucks-county-penn-foundation-cybercrime-20210629-tokzz775pfho5fwfonfmceuih4-story.html"}],"summary":"The records of an unspecified number of clients of an Upper Bucks County behavioral-health and substance abuse nonprofit, which serves the Lehigh Valley, might have been stolen as part of a ransomware attack on the agency earlier this year.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9860a6a8ee8cf8e71e5b879edefdf54a018b8331","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20201229_Jet_Aviation_Avianis_Data_Incident_Customer_Letter.pdf"},"notes":null,"org_country":"US","org_id":"1478f43e8032","org_name":"Jet Aviation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537901"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20201229_Jet_Aviation_Avianis_Data_Incident_Customer_Letter.pdf"}],"summary":"Jet Aviation said its third-party scheduling software provider Avianis experienced a data incident that may have compromised customers’ passport, travel visa, and driver’s license information.","supporting_quote":null,"technology_involved":["Avianis scheduling software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Avianis"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0c8b6b6b47fa","name":"Avianis"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-10","discovered_date":"2021-01-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dec21e34079507b4b184f662b46cbb5d81cd5e5f","impact_type":"unknown","incident_date":"2020-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cf16962130aa","org_name":"DACdb, LLC","org_type":"unknown","ransomware":null,"records_affected":1276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DACdb%2C%20LLC-2021-02-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-10","discovered_date":"2020-12-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1021a743d2366a78c1d837cb5dbf688f29da6fe2","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10314.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6ac013e55c5e","org_name":"City of Ellensburg","org_type":"government","ransomware":null,"records_affected":8523,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10314.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10314.pdf"}],"summary":"The City of Ellensburg reported a data security incident that disrupted access to some systems and may have resulted in personal information files being acquired by an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c8950bd32650a95b1acc6723854185b9f46603f","impact_type":"unknown","incident_date":"2020-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_G1997_AbacusNext_L01_SAS_0_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c91140b86b9d","org_name":"Abacus Data Systems, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537900"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2021-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9da28b60fbc6f75f707492b7f08e53037f8e884f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sutter%20Buttes%20Imaging%20Ad%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"5eb3aab5d33a","org_name":"Sutter Buttes Imaging Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Vulnerabilities in third-party IT hardware utilized by SBI allowed unauthorized penetration.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537879"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sutter%20Buttes%20Imaging%20Ad%20r4prf.pdf"}],"summary":"Sutter Buttes Imaging Medical Group reported that vulnerabilities in third-party IT hardware may have allowed unauthorized access to patient information.","supporting_quote":"In December 2020, we learned that third party IT hardware utilized by SBI demonstrated vulnerabilities which allowed unauthorized penetration for a period of time between July 2019 and December 2020.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ecb64bd4fc8a985e9435f29783e778e024ea32d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"388a7320-8e78-11ec-ab9f-33907697f3a6"},"incident_date":"2021-02-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5aa50de0df66","org_name":"Wolfe Eye Clinic","org_type":"healthcare","ransomware":true,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ia-wolfe-eye-clinic-victim-of-lorenz-threat-actors/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://kwwl.com/2021/06/22/february-data-breach-exposed-wolfe-eye-clinic-patient-information/"}],"summary":"Ransomware name and shame","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"037d00618861a08fd7d51ce2fef4fba0281d440b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Syracuse%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"31762a2dd857","org_name":"Syracuse University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537804"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Syracuse%20Sample%20Letter.pdf"}],"summary":"Syracuse University reported unauthorized access to an employee’s email account between September 24 and September 28, 2020, and could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaec6ac710ad2f9a191aa7c4cd965232614512fa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCCAA%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"6fffc5311a8e","org_name":"Southern California Center for Anti-Aging","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCCAA%20-%20California%20Notification.pdf"}],"summary":"An unauthorized person may have accessed an employee email account containing patient names and limited clinical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18e0f0b254c5ad55e2357eadbeec4093524cad79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64436070-f135-11eb-8c8a-5968a0b53910"},"incident_date":"2021-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f56eeb141ad7","org_name":"Simon Fraiser University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://vancouversun.com/news/student-data-breached-in-cyber-attack-on-simon-fraser-university"}],"summary":"Simon Fraiser University experienced a cybersecurity breach that resulted in disclosure of student and faculty personal data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2021-02-04","discovered_date":"2021-01-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2fd1ad03baf278d0e01928670ee578f7a0e0523","impact_type":"data_theft","incident_date":"2018-06-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"5f674cc6d863","org_name":"Traffic Solutions Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee acquired Statewide information without authorization shortly before their employment was terminated.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice.pdf"}],"summary":"A former Statewide employee downloaded a file containing employee personal information onto a thumb drive shortly before their employment ended in June 2018.","supporting_quote":"The former employee was not authorized to acquire Statewide’s information during the individual’s employment and we consider the unauthorized acquisition to be a theft.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-02-04","discovered_date":"2021-01-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c90ac6a72df6f1ddfc89e520f3a50ee396dc594b","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Granite%20Website%20Breach%20Notice_Clients.pdf"},"notes":null,"org_country":"US","org_id":"db28f4f8ade4","org_name":"Granite Wellness Centers","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537752"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Granite%20Website%20Breach%20Notice_Clients.pdf"}],"summary":"Granite Wellness Centers discovered that ransomware had encrypted data stored on its computer systems; affected files contained clients’ personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"302f98839e0467b1a7ebe4e283d3862f68fdce3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d8bcd760-d82b-11eb-a5a2-812629c6bc41"},"incident_date":"2021-02-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"a5166b48554c","org_name":"BabyChakra","org_type":"professional_services","ransomware":null,"records_affected":5500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/sensitive-data-of-parenting-platform-babychakra-leaked-personal-details-like-videos-medical-reports-exposed-online/"}],"summary":"The data leak was a result of misconfiguration in one of the company’s servers  The entire data was 259 GB in size and included photos, videos, personal details of the users  BabyChakra could have easily avoided exposing its customers’ data if it had taken some basic security mea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-03","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5b59c228007235fa4735b42d83c191aa8b9f6e9","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Oakwood%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"8c30121f22e7","org_name":"The Oakwood School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Oakwood%20-%20California%20Notification.pdf"}],"summary":"The Oakwood School reported that personal information in backup files held by Blackbaud was taken during a ransomware incident affecting Blackbaud.","supporting_quote":"Blackbaud reported that it conducted an investigation, determined that backup files containing information from its clients had been taken from its network, and an attempt was made to encrypt files to convince Blackbaud to pay a ransom.","technology_involved":["Blackbaud cloud-based software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-02-02","discovered_date":"2020-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"e35fff932792781f0371e2c1995a098a957ca383","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/WarehouseServices.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a6265a463599","org_name":"Warehouse Services, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":2066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/WarehouseServices.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/WarehouseServices.pdf"}],"summary":"Warehouse Services, Inc. discovered encrypted systems and an unauthorized actor who may have accessed information stored on its network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f192c035a26e9afd648cbd38ecadb8b127b0f0b","impact_type":"unknown","incident_date":"2021-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10400.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4dc079440750","org_name":"The Brotherhood's Relief & Compensation Fund","org_type":"other","ransomware":null,"records_affected":1563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10400.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10400.pdf"}],"summary":"The Fund reported a cyberattack on January 3, 2021, and said its investigation could not identify the responsible criminals; it found no evidence that personal information was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f69c8ed2b9de78998045a6cb3994c5666e7a17ef","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a6b0aac13784","org_name":"StoryBird","org_type":"technology_saas","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: StoryBird","type":"hibp","url":"https://haveibeenpwned.com/Breach/StoryBird"}],"summary":"A data breach exposed StoryBird records containing email addresses, names, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"925065fbbd0e1c3c8959a00fb2547c12cd378b33","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Porter%20%26%20Curtis%20-%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"9ff37b8d3d42","org_name":"Porter & Curtis LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Porter%20%26%20Curtis%20-%20Notification.pdf"}],"summary":"Porter & Curtis reported that a business partner’s cyber incident may have affected Porter & Curtis data containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"56aaf60b03708edd359c3c610c4b4c24c860bc2c","impact_type":"disruption_or_ransomware","incident_date":"2020-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HoneyBakedHam.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"653f967ab6d5","org_name":"Honey Baked Ham Company, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":4708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HoneyBakedHam.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/HoneyBakedHam.pdf"}],"summary":"Honey Baked Ham Company’s systems were encrypted on December 13, blocking access, and Social Security numbers or dates of birth may have been temporarily exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"88d2f14c96ca53de12a7871dfb1f66c57cd8491a","impact_type":"unknown","incident_date":"2021-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BrotherhoodRelief.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2ebd6a9ae2ea","org_name":"Brotherhood's Relief and Compensation Fund","org_type":"unknown","ransomware":null,"records_affected":1286,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BrotherhoodRelief.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BrotherhoodRelief.pdf"}],"summary":"The Fund reported a cyber-attack on January 3, 2021, and said there was no evidence that personal information was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e4872ec32cead18da6bce3dfcf876749fab9c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_G1654_Ardent%20Credit%20Union_L01_SAS_2.pdf"},"notes":null,"org_country":"US","org_id":"4303c6bc0526","org_name":"Ardent Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537666"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_G1654_Ardent%20Credit%20Union_L01_SAS_2.pdf"}],"summary":"An unauthorized individual accessed an Ardent Credit Union employee’s email account, which contained some individuals’ names and Social Security or driver’s license numbers; the organization said the information was not accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82a4ee765ca021203e7f8d2af1d808dae7a40dab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cbd6a9c0-8ddb-11ec-bb25-234a6ad089e5"},"incident_date":"2021-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b45e27fff22c","org_name":"Shorewood School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tmj4.com/news/local-news/shorewood-school-district-mistakenly-releases-student-info-while-responding-to-records-request"}],"summary":"Shorewood School District mistakenly releases student info while responding to records request","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db6e3cac05b229750c1aa893778128105d187dda","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"248c3e99a68b","org_name":"Pixlr","org_type":"technology_saas","ransomware":null,"records_affected":1906808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pixlr","type":"hibp","url":"https://haveibeenpwned.com/Breach/Pixlr"}],"summary":"Pixlr suffered a data breach exposing subscriber information, including names, email addresses, social media profiles, geographic locations, and hashed passwords.","supporting_quote":null,"technology_involved":["Pixlr"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1913cdfe3ed8778c5103c6f381018625d5448444","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10357.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a25ade693c46","org_name":"Gonzaga University","org_type":"education","ransomware":null,"records_affected":8041,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10357.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10357.pdf"}],"summary":"An unknown actor accessed a Gonzaga employee email account, but the investigation could not determine which emails were accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03d497b5c389b17c1a9e6d54a30affa50a6a5ab1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2480a2e0-e659-11eb-b667-c585fe0ca11b"},"incident_date":"2021-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6c3f742dc764","org_name":"Discount Car and Truck Rentals","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://financialpost.com/technology/tech-news/canadian-vehicle-rental-service-hit-by-ransomware"}],"summary":"Canadian car rental company got hit by darkside ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c44889e5c4dd867f622af2373b04eecb1d4b9e7c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ad8d9a0-92c8-11ec-a39a-3584eb2df2ab"},"incident_date":"2021-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ac900f646cc","org_name":"CaptureRX","org_type":"professional_services","ransomware":true,"records_affected":1656569,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/3-hospitals-added-to-capturerx-data-breach-victim-toll-17-hospitals-healthcare-organizations-affected.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.vnews.com/Gifford-reports-vendor-data-breach-40284473"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/capturerx--notice-of-data-incident-301284905.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://bismarcktribune.com/news/state-and-regional/thrifty-drug-discloses-security-breach/article_102ad9ff-3cc5-54ea-8078-1f1ce19e3386.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/capturerx-notice-of-data-incident/;"}],"summary":"Ransomware attack on partner exposes the data of over 1 million patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2021-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff4ce903284c33f082258068cea3e463ca9939f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"247870a0-3278-11ec-a962-0f8a4d8d5131"},"incident_date":"2021-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c4f2f6397b0","org_name":"Campbell Conroy & O'Neil","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.biometricupdate.com/202107/potential-biometric-data-exposure-from-ransomware-incident-prompts-law-firm-notification"}],"summary":"Law Firm Serving Fortune 500 Firms Hit by Ransomware - Campbell Conroy & O’Neil","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c775a01881eddca123247b4a795daabea7ad0aee","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"eb0c70a08e7c","org_name":"MeetMindful","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MeetMindful","type":"hibp","url":"https://haveibeenpwned.com/Breach/MeetMindful"}],"summary":"A breach exposed customer personal information and bcrypt-hashed passwords from MeetMindful.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8da42cbce3b0bb1f89ab73ab12153a914d6e1a1","impact_type":"data_theft","incident_date":"2020-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/05769168.PDF"},"notes":null,"org_country":"US","org_id":"14154878a2b2","org_name":"Wind River Systems, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537557"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/05769168.PDF"}],"summary":"Wind River Systems reported that files downloaded from its network may have contained personal information, including medical and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc558aea26886982bf37c46e53267318d270fe4d","impact_type":"both","incident_date":"2020-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SN%20Servicing%20Corporation.pdf"},"notes":null,"org_country":"US","org_id":"3d27591413bb","org_name":"SN Servicing Corporation","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SN%20Servicing%20Corporation.pdf"}],"summary":"SN Servicing Corporation reported a ransomware attack in which some borrower information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-29","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11c8b2a2fbc88d2356abb95c17f4bf9cfddaf354","impact_type":"data_theft","imported_from":null,"incident_date":"2020-05-20","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SF%20Conservatory%20of%20Music-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"83ec449649b7","org_name":"San Francisco Conservatory of Music","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SF%20Conservatory%20of%20Music-%20Notice.pdf"}],"summary":"An unknown actor exfiltrated personal information related to the San Francisco Conservatory of Music from systems involved in a Blackbaud incident.","supporting_quote":"SFCM received information from Blackbaud that it experienced an attempted ransomware incident that impacted certain Blackbaud systems.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5d6dc2eeab5ced241a25000a42d5a2a049c5c771","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10356.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"734e9bf2b9ff","org_name":"Grays Harbor Community Hospital","org_type":"healthcare","ransomware":true,"records_affected":4984,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10356.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10356.pdf"}],"summary":"Ransomware disrupted MPI systems that processed patient mailing files for Grays Harbor Community Hospital, which were potentially accessible, though no improper access was evidenced.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MPI"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"26d6ef388881","name":"MPI"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f09f751841f475e7c41e477473c57b2d9ad5ad2d","impact_type":"unknown","incident_date":"2021-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IDX%20-%20BRCF%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a55226c294c2","org_name":"Brotherhood’s Relief & Compensation Fund","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537600"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IDX%20-%20BRCF%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brotherhood%E2%80%99s%20Relief%20%26%20Compensation%20Fund-2021-02-02"}],"summary":"The Fund reported a cyber-attack on January 3, 2021, but said there was no evidence that personal information was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-27","discovered_date":"2021-01-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b50a55eb8080a143dfd3501d636c7d657d3e4b0b","impact_type":"unknown","incident_date":"2019-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"59de84c82ea4","org_name":"William LaMarche","org_type":"unknown","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#William%20LaMarche-2021-01-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-27","discovered_date":"2020-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0c01b821fc12001ebd00be846adbb72e5c0675e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Margucci%20IDX%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"33799a39b140","org_name":"Rochelle Margucci","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Margucci%20IDX%20Consumer%20Notification%20Letter.pdf"}],"summary":"Rochelle Margucci reported suspicious activity in its email system, and an investigation found that personal information may have been accessed or acquired.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-27","discovered_date":"2020-07-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"d61718415c90a2762ef6cec97613bcb5b6c86489","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/EyeMed.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f8f1ab34532e","org_name":"EyeMed Vision Care LLC","org_type":"healthcare","ransomware":null,"records_affected":219518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/EyeMed.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/EyeMed.pdf"}],"summary":"An unauthorized individual accessed an EyeMed email mailbox, which contained personal information, and sent phishing emails to addresses in its address book.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-27","discovered_date":"2020-11-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e27ded2ceb3bdbd9434cd299bc9bc1f0ef037f77","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DGO-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"bf2ef5164b62","org_name":"Diversified Gas & Oil Corporation","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DGO-%20Notice.pdf"}],"summary":"Diversified Gas & Oil Corporation reported that malware infiltrated part of its computer systems and that personal information was subject to unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa97c6b4902ed48d14d0ab19954e70150ca65473","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Auris%20-%20Sample%20California%20Individual%20Notice%20Letter%20%28Attachment%29.pdf"},"notes":null,"org_country":"US","org_id":"833f32f082eb","org_name":"Auris Health, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537478"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Auris%20-%20Sample%20California%20Individual%20Notice%20Letter%20%28Attachment%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Auris%20Health%2C%20Inc.-2021-01-27"}],"summary":"An unauthorized actor accessed an Auris employee’s email account beginning in March 2020, and personal information was involved.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-27","discovered_date":"2020-08-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"91cc149e9c1678b00ea0a4bb6e3b4be327f5922b","impact_type":"both","incident_date":"2020-08-28","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10398.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a86266665e06","org_name":"Absher Construction Company","org_type":"other","ransomware":null,"records_affected":1527,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10398.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10398.pdf"}],"summary":"An unknown actor used malware to encrypt some Absher systems and collect files containing personal information.","supporting_quote":"The investigation determined that an unknown actor used malicious software (malware) to encrypt certain of Absher’s systems and collect a limited number of files from the systems between August 28 and August 29, 2020.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94462a332aae0d94e4166769bff1371e391dd2d2","impact_type":"disruption_or_ransomware","incident_date":"2020-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/U.S.%20Employee%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"47048005ca7c","org_name":"thyssenkrupp Materials","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537462"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/U.S.%20Employee%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10399.pdf"}],"summary":"thyssenkrupp Materials reported a ransomware attack that encrypted servers and workstations, and said the threat actor had access to system data that could include employee information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-26","discovered_date":"2020-07-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d601ed43bf413081ceac72b5064b6927aa53d36","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10397.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e63a7ee51b67","org_name":"Puget Sound Educational Service District","org_type":"education","ransomware":null,"records_affected":32419,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10397.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10397.pdf"}],"summary":"Puget Sound Educational Service District reported that unauthorized individuals accessed certain employee email accounts, potentially exposing personal information.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-26","discovered_date":"2020-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e814806d176ca38a3cc18fa02cd0e408c6b8b55e","impact_type":"disruption_or_ransomware","incident_date":"2020-08-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bosley%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"44cc5c167467","org_name":"Bosley, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537436"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bosley%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bosley%2C%20Inc.-2021-01-26"}],"summary":"Bosley reported that malware encrypted data on certain systems and that an unauthorized party accessed systems containing customer personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-25","discovered_date":"2020-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"130578138be2d8e78ece28851af4dd7a75ae8498","impact_type":"data_theft","incident_date":"2020-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Western%20Life%20Insurance%20Company%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"546f1da371bc","org_name":"National Western Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537421"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Western%20Life%20Insurance%20Company%20Notice.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalWesternLifeInsuranceCompany.pdf"}],"summary":"National Western Life Insurance Company reported that an unauthorized actor accessed or acquired data from certain company systems, including personal information and policy numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-01-25","discovered_date":"2020-08-10","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e2839939fdb93c0e14ba2709bff6e0782ed0d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Einstein%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"595f52cef482","org_name":"Einstein Healthcare Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537414"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Einstein%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10395.pdf"}],"summary":"Einstein Healthcare Network identified suspicious activity in employee email accounts, which may have contained patient information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb15f7325bedba292717b770cb7b471da4143151","impact_type":"disruption_or_ransomware","incident_date":"2020-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification-Letter-PII-%26-CC-.PDF"},"notes":null,"org_country":"US","org_id":"661d68095bb5","org_name":"American Frame Corporation","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537411"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification-Letter-PII-%26-CC-.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Frame%20Corporation-2021-01-25"}],"summary":"American Frame Corporation reported a cybersecurity attack involving an attempted intrusion, data encryption, and ransom demand, with some personal information potentially exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-22","discovered_date":"2021-01-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9667e0495516d6ba844168054e9929833f6a24cd","impact_type":"unknown","incident_date":"2021-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06c86f18bf3a","org_name":"USCellular","org_type":"unknown","ransomware":null,"records_affected":276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#USCellular-2021-01-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3145a29d758eb0e0a253edb0426fb547c33367d8","impact_type":"both","incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSN.pdf"},"notes":null,"org_country":"US","org_id":"de022b8e8761","org_name":"St. Francis Catholic High School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537343"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSN.pdf"}],"summary":"A cybercriminal removed a copy of a Blackbaud backup file containing some St. Francis Catholic High School personal information and demanded payment.","supporting_quote":null,"technology_involved":["Blackbaud","backup file"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54dc2c9e2dcae8219c20720cf98d7d5229d8c3eb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_12m_Communications%20Workers%20America_L01.pdf"},"notes":null,"org_country":"US","org_id":"d5c20e61f7f8","org_name":"Communications Workers of America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A document containing personal information was available on a private server without a login or password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537352"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_12m_Communications%20Workers%20America_L01.pdf"}],"summary":"A document containing personal information about Communications Workers of America members was copied to a private server and was available without a login or password.","supporting_quote":"A document, originally created in 2006 and containing in an unencrypted format certain information pertaining to you, was copied to a private server and was available without a login or password for an unknown period.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-01-22","discovered_date":"2020-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"210aa6cf2548811d298ed5921a514b441e0325f2","impact_type":"data_theft","incident_date":"2020-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arraycon%20-%20CA%20sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2bb8ebd4c175","org_name":"Arraycon LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537386"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arraycon%20-%20CA%20sample%20Notice.pdf"}],"summary":"Arraycon reported unauthorized access to its systems during which an actor appears to have obtained personnel data from its file management platform.","supporting_quote":null,"technology_involved":["file management platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db93304a5d525951f61fdeda3fc0d00629ad4326","impact_type":"unknown","incident_date":"2020-11-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Attachment%20to%20CA%20Supp%20AG%20Notice%20%28Direct%20Energy%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dcaabdf046bc","org_name":"Direct Energy LP, together with its affiliates First Choice Power, LLC and Home Warranty of America, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542762"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537332"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-21","discovered_date":"2020-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a57d8e6ddef26628584fd26bc4ac704cb114976","impact_type":"data_theft","incident_date":"2020-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10393.pdf"},"notes":null,"org_country":"US","org_id":"cf50269a156e","org_name":"Cardinal Financial Company","org_type":"financial","ransomware":null,"records_affected":925,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10393.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10393.pdf"}],"summary":"Cardinal Financial Company reported that data held by its vendor ActiveProspect was exfiltrated, including personal information for 925 Washington residents.","supporting_quote":null,"technology_involved":["ActiveProspect"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"ActiveProspect Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"79855be9ca98","name":"ActiveProspect Inc"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","medical","personal"],"disclosed_date":"2021-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98c3cf70a58fcb9cf6b292d09db05da84a669fd7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad1fdda0-8e74-11ec-a600-657ec2694f8f"},"incident_date":"2021-01-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9c2f47ba4e9","org_name":"Personal-Touch Holding corp","org_type":"healthcare","ransomware":true,"records_affected":759000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/personal-touch-holding-corp-identifies-and-addresses-data-security-breach-301256229.html"}],"summary":"Personal Touch Holding corp had their private cloud compromised by ransomware resulting in compromise of patient and employee data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-20","discovered_date":"2020-12-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a7fe1e93accd845e1dcaf148b25d383d565053fa","impact_type":"unknown","incident_date":"2020-10-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2186ae679c7a","org_name":"Cascade Insurance Center","org_type":"unknown","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cascade%20Insurance%20Center-2021-01-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2021-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c41ee77a0ddabc284a3a848fec4feab4927608ca","impact_type":"disruption_or_ransomware","incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wildwood%20School%20Adult.pdf"},"notes":null,"org_country":"US","org_id":"356fe1d62bf7","org_name":"Wildwood School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537256"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wildwood%20School%20Adult.pdf"}],"summary":"Wildwood School reported exposure of personal and medical information in backup files affected by a ransomware attack on its service provider, Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-19","discovered_date":"2020-11-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5042025fb1f10f6b45d9e36bd4b50136561e0723","impact_type":"unknown","incident_date":"2018-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c9bc4a6a98c9","org_name":"Paysafe Group Holdings Limitedd","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Paysafe%20Group%20Holdings%20Limitedd-2021-01-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2021-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12d9c64fa321a9cd8da818457e241b2018939a08","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"50cdedb5ff93","org_name":"Nitro","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nitro","type":"hibp","url":"https://haveibeenpwned.com/Breach/Nitro"}],"summary":"The Nitro PDF service breach exposed email addresses, names, bcrypt password hashes, and titles of converted documents.","supporting_quote":null,"technology_involved":["Nitro PDF service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-19","discovered_date":"2020-08-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"859b5f30a437d7d419e6ad5a2c8144b2e7651eee","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04a3f1105c86","org_name":"National Western Life Insurance Company (NWL)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20Western%20Life%20Insurance%20Company%20%28NWL%29-2021-01-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2021-01-19","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25d7711c5711e39dd90445b31d2a52a7d0b3f977","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10392.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"e7c1f038bab1","org_name":"Helen Keller International","org_type":"nonprofit","ransomware":true,"records_affected":534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10392.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10392.pdf"}],"summary":"A ransomware attack on Blackbaud affected a database containing Helen Keller International data, which the attacker may have acquired.","supporting_quote":"Blackbaud’s systems that were affected by the attack included a database containing certain data related to Helen Keller International.","technology_involved":["Blackbaud database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-19","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d280596726a9a2f3584fcdd27bdd29f6e431d9db","impact_type":"both","incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fairmont%20Private%20Schools%20Ad%20TIN%20SSN%20prf1.pdf"},"notes":null,"org_country":"US","org_id":"55cce056577d","org_name":"Fairmont Private Schools","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537257"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fairmont%20Private%20Schools%20Ad%20TIN%20SSN%20prf1.pdf"}],"summary":"Fairmont Private Schools reported that personal information held in Blackbaud files may have been accessed during a ransomware incident and that additional legacy data was exposed.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2021-01-18","discovered_date":"2020-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"74696fcd232f11853d4d2625cca15a984fc4c2fe","impact_type":"data_theft","incident_date":"2018-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Romwe.pdf"},"notes":null,"org_country":"US","org_id":"d8c1de97b71c","org_name":"Romwe","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Romwe","type":"hibp","url":"https://haveibeenpwned.com/Breach/Romwe"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Romwe.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Romwe.pdf"}],"summary":"Romwe reported that customer usernames and passwords may have been stolen in July 2018 and later found posted on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a5bbaefe42558d3de67ab4b366259a443a97d5f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALE%20Solutions%20Inc..pdf"},"notes":null,"org_country":"US","org_id":"96bc54e181ee","org_name":"ALE Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-500213"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALE%20Solutions%20Inc..pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10386.pdf"}],"summary":"ALE Solutions reported that an unknown actor encrypted data and unauthorized parties may have accessed or downloaded personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb09552349056d359451ee5a063f85d60222d88f","impact_type":"data_theft","imported_from":null,"incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cdc3356e043e","org_name":"Jobandtalent","org_type":"professional_services","ransomware":null,"records_affected":10981207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Jobandtalent","type":"hibp","url":"https://haveibeenpwned.com/Breach/JobAndTalent"}],"summary":"A breach of Jobandtalent’s employment website exposed subscriber names, email and IP addresses, and salted SHA-1 password hashes.","supporting_quote":null,"technology_involved":["employment website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"751b8fcda73a608867746f07788657409ac16e19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ed03930-1adf-11ec-93a7-f3130d45721c"},"incident_date":"2021-01-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a744905ad8e","org_name":"Nevada Restaurant Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ktnv.com/news/dottys-parent-company-announces-data-breach-says-private-info-may-have-been-released"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542511"}],"summary":"Dotty’s Confirms Data Breach, Gaming Company Latest Cyberattack Victim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2021-01-15","discovered_date":"2020-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"196c960ad9a81c1d07e6384518ed807c38ca5993","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10391.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c006b478b248","org_name":"Walla Walla County","org_type":"government","ransomware":null,"records_affected":577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10391.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10391.pdf"}],"summary":"Walla Walla County reported a cyberattack involving possible compromise of login credentials associated with its permitting website.","supporting_quote":null,"technology_involved":["eTRAKiT permitting website","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1530"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-14","discovered_date":"2020-09-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c984f8941b7e388bbeaf164a0776286b8248a96a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Shift%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"69525bb3c6e7","org_name":"Shift Technologies, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198531"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Shift%20-%20California%20Notification.pdf"}],"summary":"Shift Technologies reported that an unauthorized third party accessed cloud storage containing personal information, but it could not determine whether any specific data was viewed.","supporting_quote":null,"technology_involved":["cloud storage"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-13","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cc9e5f972a11346067c2da278de85aab4a33083","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-05","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Waters%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"b519fe1ac035","org_name":"Waters & Kraus LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198514"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Waters%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10390.pdf"}],"summary":"Waters & Kraus LLP reported unauthorized access to certain employee email accounts between December 5, 2019 and May 15, 2020.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-13","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c2a4e5c8482c3ad04243b90dcb211f802983f4a","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Archer%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3a56fa2fb053","org_name":"The Archer School for Girls","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Archer%20-%20California%20Notification.pdf"}],"summary":"The Archer School for Girls’ personal information was included in backup files taken from Blackbaud, which attempted to encrypt files and paid a ransom.","supporting_quote":"Blackbaud reported that it conducted an investigation, determined that backup files containing information from its clients had been taken from its network, and an attempt was made to encrypt files to convince Blackbaud to pay a ransom.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-13","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dc27b6c815825f3d1e249f7d9fea2eb8a4c2b5c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10389.pdf"},"notes":null,"org_country":"US","org_id":"7c0a86db24de","org_name":"North Park University","org_type":"education","ransomware":true,"records_affected":1239,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10389.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10389.pdf"}],"summary":"North Park University notified residents that personal information held in Blackbaud systems may have been accessed or exfiltrated during Blackbaud's ransomware incident.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aefc718911ba1cad0d82ed4b81239e2c924f76a8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c44d0c10-da73-11eb-bcc7-b7194a064c3e"},"incident_date":"2021-01-13","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5086d94f6b05","org_name":"Cochise Eye and Laser","org_type":"healthcare","ransomware":true,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/ransomware-attack-on-arizona/"}],"summary":"Cyber-criminals successfully hit Cochise Eye and Laser with ransomware in January, encrypting the office's patient scheduling and billing software","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2021-01-12","discovered_date":"2020-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c5cf47edf1e2cd0063749e56a1b21d1119d3585","impact_type":"data_theft","incident_date":"2020-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sedgwick%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"906e85aa4b72","org_name":"Sedgwick Claims Management Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198457"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sedgwick%20-%20Notice.pdf"}],"summary":"Sedgwick reported that records on Cunningham Lindsey data servers were accessed without authorization between July 31 and August 2, 2020, and acquired without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-01-12","discovered_date":"2020-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dff79dbb7b47470491cc007b6c1fa1dc5af0076a","impact_type":"both","incident_date":"2020-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NBCC%20-Notice.PDF"},"notes":null,"org_country":"US","org_id":"64790fde9631","org_name":"National Board for Certified Counselors, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198460"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NBCC%20-Notice.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10388.pdf"}],"summary":"Malware prevented access to certain NBCC files, and an unauthorized actor accessed and acquired files containing potentially exposed personal and credential information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-12","discovered_date":"2020-12-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8175d302a6d30bc260bb5fb2603530a81a2ed54c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LACCD%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"552c3e7b9e17","org_name":"Los Angeles Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Documents containing student information were inadvertently made accessible from the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198442"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LACCD%20-%20California%20Notification.pdf"}],"summary":"The District reported that documents containing current and former student information had inadvertently been made accessible from the Internet.","supporting_quote":"On December 9, 2020, we learned that documents containing certain current and former student information had been inadvertently made accessible from the Internet.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-11","discovered_date":"2020-05-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9489e95b4dee69922384f5a413d199744d3c246c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Veritex%20-%20CA%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2d1941305d8d","org_name":"Veritex Holdings Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Veritex%20-%20CA%20Notice.pdf"}],"summary":"Veritex reported unauthorized access to certain employee email accounts, where personal information including names was present.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"adcd4ab313b73373f3b633168e2b870e8c7bc420","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/RoperStFrancis.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ea5e1846bca","org_name":"Roper St. Francis Healthcare","org_type":"unknown","ransomware":null,"records_affected":9839,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/RoperStFrancis.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2021-01-11","discovered_date":"2020-11-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"07a6e9df0ce38973c8175c25f507ca9d56a963bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-09","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10387.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3e19d0780215","org_name":"Jefferson Healthcare","org_type":"healthcare","ransomware":null,"records_affected":2496,"reviewed":false,"root_cause":"An email phishing attack obtained an employee's email login credentials, enabling unauthorized access to the employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10387.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10387.pdf"}],"summary":"Jefferson Healthcare reported that a phishing attack obtained an employee's email login credentials and enabled access to the employee's email account.","supporting_quote":"On November 12, 2020, Jeffercon Healthcare ftrst discovered that an email phishing attack resulted in unauthorized access to an employee's email account by unidentilied third parties, who wEre ablE to obtain the employee's email login credentials.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-11","discovered_date":"2020-08-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9327546308fa1b6e1587f9fc4eab70788d401430","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AFM%20-%20Notice.PDF"},"notes":null,"org_country":"US","org_id":"714d58b8c88e","org_name":"American Federation of Musicians and Employers' Pension Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AFM%20-%20Notice.PDF"}],"summary":"The fund reported unauthorized access to an employee’s email account, where personal information was found, but said it had no indication of misuse.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f4420afe03fe64b0272b5e15ca7348821e5c908","impact_type":"both","incident_date":"2020-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10385.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fedd908d78a9","org_name":"US Fertility, LLC","org_type":"healthcare","ransomware":true,"records_affected":47952,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10385.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10385.pdf"}],"summary":"US Fertility reported that ransomware encrypted systems and an unauthorized actor acquired files containing personal information.","supporting_quote":null,"technology_involved":["workstations"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-08","discovered_date":"2020-09-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d43bedbf8e3a3458103c34ed7fa3aaa6fbeed93","impact_type":"both","incident_date":"2020-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Fertility%2C%20LLC%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fedd908d78a9","org_name":"US Fertility LLC","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198340"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Fertility%2C%20LLC%20-%20Notice.pdf"}],"summary":"US Fertility reported that ransomware encrypted systems and an unauthorized actor acquired files containing personal information.","supporting_quote":null,"technology_involved":["workstations"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566","T1657"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-01-08","discovered_date":"2020-07-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64dc92cd94d0808aff2fdb0574e14ba3b28509c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10384.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e3e7c779046d","org_name":"North American Partners in Anesthesia","org_type":"healthcare","ransomware":null,"records_affected":505,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10384.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10384.pdf"}],"summary":"North American Partners in Anesthesia reported that a phishing attack led to unauthorized access to email accounts hosted by its business associate, exposing personal, medical, and financial information.","supporting_quote":"On July 16, 2020, American Anesthesiology was notified that an unauthorized party had gained access to several email accounts on our business associate’s Microsoft Office 365 hosted email system (“O365 System”) between June 17, 2020 and June 22, 2020 through phishing.","technology_involved":["Microsoft Office 365","email accounts"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2021-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4451dcb3404f1f54d436914e6a4df210261f154a","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7e912defd0af","org_name":"GeniusU","org_type":"education","ransomware":null,"records_affected":1301460,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GeniusU","type":"hibp","url":"https://haveibeenpwned.com/Breach/GeniusU"}],"summary":"Data associated with GeniusU, including personal information and bcrypt-hashed passwords, was reported in a breach dating to October 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a38c23e4216bd3cfd02d4856abf4fe63b1f1cba4","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20V2.pdf"},"notes":null,"org_country":"US","org_id":"1418cc3e4f50","org_name":"Creal & Creal","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20V2.pdf"}],"summary":"Creal & Creal reported IRS e-file rejections for clients whose 2019 tax returns were already on file, and said personal and financial information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6ff4521c20b34b2cb2de49d82229a381942ada1e","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10383.pdf"},"notes":null,"org_country":"US","org_id":"c9d5b735918a","org_name":"Convoy of Hope","org_type":"nonprofit","ransomware":null,"records_affected":1017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10383.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10383.pdf"}],"summary":"Convoy of Hope reported that personal information, including names and dates of birth, was present in data accessed or acquired from Blackbaud’s systems.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566","T1657"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2021-01-08","discovered_date":"2020-07-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adbf4348c5f6203a07b94f77ddc3b451e9dcffd4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-06-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_1.pdf"},"notes":null,"org_country":"US","org_id":"681b17a82324","org_name":"American Anesthesiology, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198346"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Anesthesiology%2C%20Inc.-2021-01-08"}],"summary":"An unauthorized party accessed email accounts on American Anesthesiology’s business associate’s Microsoft Office 365 system through phishing, and the accounts contained personal, medical, and financial information.","supporting_quote":"On July 16, 2020, American Anesthesiology was notified that an unauthorized party had gained access to several email accounts on our business associate’s Microsoft Office 365 hosted email system (“O365 System”) between June 17, 2020 and June 22, 2020 through phishing.","technology_involved":["Microsoft Office 365 hosted email system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Microsoft Office 365"},"updated_at":"2026-10-10","veris_action":"social","derived":{"vendors":[{"id":"2204c6a98e58","name":"Microsoft"}]}},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f02f31eadb00459d137622aa59f30f6bdba7ded","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6c8628d0-545f-11eb-a683-ed9206b72971"},"incident_date":"2021-01-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"773c4fad733d","org_name":"United States Federal Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.politico.com/news/2021/01/07/capitol-hill-riots-doj-456178;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnn.com/2021/01/07/tech/capitol-riots-cybersecurity/index.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.axios.com/pelosi-laptop-stolen-capitol-riot-268f364b-8695-4249-b0f3-0f28eb99ab6e.html"}],"summary":"Large group of people mob the US Capitol building, invading offices, and stealing computers and documents.  Many posted on social media what they were doing.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2021-01-06","discovered_date":"2020-10-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd68f70caba1259701f7cef1dff4ad33c9662860","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AHIMA%20-%20CA%20Consumer%20Notification%20Letter_FINAL%20to%20IDX%20-%20IDX%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"abc369e6322a","org_name":"American Health Information Management Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198276"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHIMA%20-%20CA%20Consumer%20Notification%20Letter_FINAL%20to%20IDX%20-%20IDX%20%281%29.pdf"}],"summary":"AHIMA reported that payment card information associated with purchases through its online store may have been exposed.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-05","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d9535782f6db598dba1144d05c7faf0b1ecfc103","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10382.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1f7e7345b2d3","org_name":"Grinnell College","org_type":"education","ransomware":true,"records_affected":2465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10382.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10382.pdf"}],"summary":"Blackbaud reported that a threat actor removed data from its systems between February 7 and May 20, 2020, affecting Grinnell College.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-05","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8c6e59fcb2db467975d0748426134a829a1cbba","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Francis%20Parker%20School%20Ad%20SSN%20TIN%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"3b9ff83674d4","org_name":"Francis Parker School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198248"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Francis%20Parker%20School%20Ad%20SSN%20TIN%20r3prf.pdf"}],"summary":"Francis Parker School notified affected people that personal information held in Blackbaud legacy files may have been exposed after a ransomware incident at Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2021-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7242243ae14b24f636ccc14a655c07b36ec54181","impact_type":"disruption_or_ransomware","incident_date":"2020-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_United%20States%20Non%20Massachusetts%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"f15ffef7905b","org_name":"Peter Pan Seafoods, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198127"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_United%20States%20Non%20Massachusetts%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Peter%20Pan%20Seafoods%2C%20Inc.-2021-01-04"}],"summary":"Peter Pan Seafoods detected ransomware that denied access to its systems and accessed business confidential and personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-04","discovered_date":"2020-10-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccf097da2f3bccaa3e215e2c5711924107bd34d6","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/11-24-20%20-%20Matson%20Notice%20Ltr.%20to%20Individuals.pdf"},"notes":null,"org_country":"US","org_id":"559524af542b","org_name":"Matson Navigation Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198151"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/11-24-20%20-%20Matson%20Notice%20Ltr.%20to%20Individuals.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10363.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Matson%20Navigation%20Company-2021-01-06"}],"summary":"Matson reported that an attacker accessed parts of its network, including servers likely containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-02","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69bb2ea046b287c8fc33f702d6b4fc56a928c6b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Anchor%20General%20Insurance%20Agency%2C%20Inc.-%20Template%20Notification%20Letter%20%281%20Year%29.pdf"},"notes":null,"org_country":"US","org_id":"0b8199d8afe4","org_name":"Anchor General Insurance Agency, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-198123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Anchor%20General%20Insurance%20Agency%2C%20Inc.-%20Template%20Notification%20Letter%20%281%20Year%29.pdf"}],"summary":"An unauthorized third party accessed an Anchor General employee’s email account containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85226a16b0419ff7730d3ad7d60dca8aeb360ed9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"244496f0-4893-11ec-be64-495e033b0bce"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c98b5f50ade3","org_name":"Wyoming Department of Health","org_type":"government","ransomware":null,"records_affected":164000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.powelltribune.com/stories/health-department-data-breach-exposed-info-of-164000-wyomingites,31132;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/data-breach-impacts-1-in-4/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://county17.com/2021/04/28/wdh-data-breach-compromises-nearly-30-percent-of-wyomingites/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/covid-19-breath-alcohol-test-results-of-164-000-wyoming-residents-mistakenly-exposed-on-github"}],"summary":"A data breach at the Wyoming Department of Health publicly exposed COVID-19, influenza and blood alcohol test data from more than a quarter of Wyomingites and some out of state residents, the department announced Tuesday.   The breach occurred when an employee erroneously uploade","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bba9da83677a6bf972c9dbbea871368c0d0b3e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ddb2b30-1647-11ec-8258-83f74c3914c9"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4941eb3e8005","org_name":"Walmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ctvnews.ca/sci-tech/data-exposure-flaw-on-walmart-ca-revealed-personal-customer-information-1.5256105"}],"summary":"Data exposure flaw on Walmart.ca revealed personal customer information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e4e40824aeb2005c838e67df4bdd3ba2b4a4358","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a2a3cd50-f45a-11eb-821b-d1ebb09f37f0"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"cd691e5c2aa8","org_name":"VirginActive","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/za-virginactive-goes-offline-after-cyberattack/"}],"summary":"VirginActive goes offline after cyberattack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"573a188ee93720be04e396b540846b9cf1d1a018","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf971190-4641-11ec-b26b-73b5a62f8946"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SK","org_id":"1ab5120e7501","org_name":"VIPGames","org_type":"other","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/gamer-records-exposed-vipgames-leak/163352/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thecybersecurity.news/cloud-security-news/23m-gamer-records-exposed-in-vipgames-leak-5571/"}],"summary":"The personal data of 66,000 users was left wide open on a misconfigured Elasticsearch server, joining a growing list of companies with leaky clouds.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f93ec6008d3ecda93725c821782e7987eae6c9b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28197d50-d9b1-11eb-bcc7-b7194a064c3e"},"incident_date":"2021-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e61be0d68372","org_name":"Vermont Department of Labor","org_type":"government","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.benningtonbanner.com/local-news/vermont-labor-dept-facing-personal-info-data-breach/article_758174da-65a8-11eb-bca7-2b940a6a42a0.html"}],"summary":"Mailing error resulted at Vermont Department of Labor resulted in 80,000 letters being mailed to the wrong people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"n3tw0rm","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"299df8e029b6e9cc4818ed9cae381547a761d0ca","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6cf08e0-30df-11ec-9798-915a6ecdc137"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"f0d2327dfa81","org_name":"Veritas","org_type":"professional_services","ransomware":true,"records_affected":180000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.jpost.com/breaking-news/iranian-hackers-release-information-of-israeli-logistics-company-veritas-667062"}],"summary":"Iranian hackers release information of Israeli logistics company Veritas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"n3tw0rm"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c1dcd03f03088d492e5a5a1af5d4685e7135a7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76d289c0-3bed-11ec-963f-f964320be408"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03f153cf0a81","org_name":"United States Air Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.popularmechanics.com/military/weapons/a36598369/air-force-personnel-exposed-nuclear-weapons-secrets-online/"}],"summary":"U.S. Air Force airmen studying for service tests inadvertently leaked highly classified details about American nuclear weapons for the entire world to see, according to a new report. The airmen exposed the information—including which storage bunkers at European military bases lik","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e41af44908901332fa166296664d9594cd00d6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9bb8e910-8e99-11ec-a600-657ec2694f8f"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6a8bc414a60","org_name":"Twitch","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lightreading.com/security/twitch-gets-hacked-in-biggest-data-breach-ever/d/d-id/772624?_mc=RSS_LR_EDT"}],"summary":"Streaming service twitch is compromised after hackers discovered a misconfigured switch which exposed internal resources","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60e22b5a5d24b8941967f5bd77b42011a8c9d349","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88b06a80-4896-11ec-be64-495e033b0bce"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0a7b543aef0","org_name":"Teespring","org_type":"manufacturing","ransomware":null,"records_affected":8200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-leaks-data-of-millions-of-teespring-users/"}],"summary":"A hacker has leaked the details of millions of users registered on Teespring, a web portal that lets users create and sell custom-printed apparel.  The user data was leaked last Sunday on a public forum dedicated to cybercrime and the sale of stolen databases.  The Teespring data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43255724433b4e2c75c6022003cb4cf26948fd5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f7818d0-4637-11ec-b26b-73b5a62f8946"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"d0a8ea690b4f","org_name":"Tamil Nadu Public Distribution System","org_type":"government","ransomware":null,"records_affected":4919668,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/breach-of-data-in-public-distribution-system-of-tamil-nadu-identifies-technisanct/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.expresscomputer.in/news/breach-of-data-in-public-distribution-system-of-tamil-nadu-identifies-technisanct/77284/"}],"summary":"    Technisanct, a cyber security and big data startup headquartered in Bangalore, reports data breach of over 4.5 million citizens from the Public Distribution System (PDS) of the state of Tamil Nadu. Major details including Personal Identifiable Information (PII) and Aadhaar nu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95ca89f0b9cdd4825c6497b1d99558d6bb9d215a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f951100-de8c-11eb-92f2-17e9027f1a94"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"8ad8791ea416","org_name":"SuperSoftTech","org_type":"professional_services","ransomware":null,"records_affected":21000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cybernews.com/security/one-of-the-biggest-android-vpns-hacked-data-of-21-million-users-from-3-android-vpns-put-for-sale-online/"}],"summary":"A user on a popular hacker forum is selling three databases that purportedly contain user credentials and device data stolen from three different Android VPN services – SuperVPN, GeckoVPN, and ChatVPN – with 21 million user records being sold in total. The VPN services whose data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f29a7d7342ff1b588588469e17266d6d0fc799f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c9dae7e0-f45b-11eb-821b-d1ebb09f37f0"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d6634e6414c","org_name":"Summit County","org_type":"energy_utilities","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.parkrecord.com/news/summit-county/ransomware-attack-hits-water-district/"}],"summary":"Summit County water district experiences a ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87b2ad87f0c89191d43d8c5eaf232a22b5a81c64","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"770b3e20-f91f-11eb-98bb-95028a4c8b05"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dd29e8057d5","org_name":"Southern Arkansas University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/first-it-was-blackbaud-now-its-sodinokibi-southern-arkansas-university-becomes-a-breach-victim-again/"}],"summary":"South Arkansas University hit (again) by ransomware, this time Sodinokibi Ransomware group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Avaddon","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"424a5eeacb89089a803b845bc771926057d6a216","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01156af0-149b-11ec-92c0-8d3c636e1e37"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f5835db928f","org_name":"Somerset Independent School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/update-threat-actors-dump-somerset-isd-student-personal-and-health-information/"}],"summary":"Somerset Independent School district in Texas were ransomwared and extorted by Avaddon threat group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"avaddon"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fecbe2fe59384c17d5ee41fe1a645ecd59ee308","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34fb7260-488f-11ec-be64-495e033b0bce"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"feba3897979e","org_name":"SocialArks","org_type":"professional_services","ransomware":null,"records_affected":318000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/social-profiles-leaked-chinese-data-scrapers/162936/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.digitalinformationworld.com/2021/01/socialarks-data-breach-has-left-over.html"}],"summary":"  A cloud misconfig by SocialArks exposed 318 million records gleaned from Facebook, Instagram and LinkedIn.  More than 400GB of public and private profile data for 214 million social-media users from around the world has been exposed to the internet – including details for celeb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a235df6de2522c6979d5bd9ad3c9933d1b09adbe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2e73670-0787-11ed-8fd4-9be359ef207c"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"f265549e3262","org_name":"Siriraj Hospital","org_type":"healthcare","ransomware":null,"records_affected":39000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bangkokpost.com/thailand/general/2245063/huge-patient-data-leak-from-siriraj-hospital"}],"summary":"39m Million Medical records from Siriraj Hospital are up for sale on criminal website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21610547379152a89284f8c36ff13584f57f791b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"724e14d0-463a-11ec-b26b-73b5a62f8946"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"3dbe218d2514","org_name":"Raychat.io","org_type":"technology_saas","ransomware":null,"records_affected":267000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/hacker-leaks-iranian-raychat-app-user-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.gizmodo.com.au/2021/02/iranian-chat-app-gets-its-data-wiped-out-in-a-cyberattack/"}],"summary":"The hacker behind the data leak claims they downloaded the Raychat app data when the company exposed its entire database online between December 2020 to January 2021.  Raychat app (Raychat.io), a popular Iranian social and business messaging platform has apparently suffered a dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf5a3045a8e7f995d4c0b02e5cf0f2d241915f95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"912160f0-8ddf-11ec-bb25-234a6ad089e5"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"64648eaef9f3","org_name":"Primary Care Support England","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pulsetoday.co.uk/news/practice-personal-finance/gps-mistakenly-given-online-access-to-pensions-data-belonging-to-colleagues/"}],"summary":"Some GPs found they were mistakenly given access to other people’s ‘sensitive’ pensions information after logging into their own account on PCSE’s new online portal.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f94dbb7a0d7fc219d842cc2e0ac84322ed6330f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0e7e080-0fe0-11ec-8c66-bd734728b5ba"},"incident_date":"2021-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ea3aee66948","org_name":"Prestera Center for Mental Health Services","org_type":"healthcare","ransomware":null,"records_affected":3720,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.herald-dispatch.com/news/prestera-center-notifies-patients-of-data-security-incident/article_8d844ec5-1272-5ea9-9d5e-2706505b8218.html"}],"summary":"Prestera Center for Mental Health Services notifies patients of data security incident ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c896ae82c1c3461c309c90534e3b36a319749c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6016bd70-1576-11ec-8375-f10617ad68c4"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"6db1f935767d","org_name":"Phetchabun Hospital","org_type":"healthcare","ransomware":null,"records_affected":105000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/th-hacked-hospital-patients-data-not-important/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bangkokpost.com/thailand/general/2177887/hacked-hospital-patients-data-not-important"}],"summary":"PHETCHABUN: Officials have rushed to downplay the theft by a hacker of more than 10,000 patients' personal details from Phetchabun Hospital, describing the information as \"not important\".  Phetchabun governor Krit Kongmuang was among those who responded to initial reports on soci","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"299266b8ccfdf0484d7e5c3b29bb23bff5faa705","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cf5b7700-1195-11ec-a044-77090c8577a4"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"7a90228435e3","org_name":"Oxfam Australia","org_type":"nonprofit","ransomware":null,"records_affected":1700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/oxfam-australia-investigates-data-breach-after-database-put-up-for-sale/"}],"summary":"Oxfam Australia found their data up for sale in a criminal forum ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6713b4e818f17d661aa75e9081a0d82a007e9d63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eb86a2c0-157c-11ec-8375-f10617ad68c4"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"1dcd5fb81f37","org_name":"Moss Municipal Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/norwegian-dpa-moss-municipal-council-fined/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c7432051135592ff9fb4cc2bca55bc1079d921f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e10742d0-4891-11ec-be64-495e033b0bce"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fed34d118ec","org_name":"MeetMindful.com (MINDFUL, LLC.)","org_type":"other","ransomware":null,"records_affected":2280000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-leaks-data-of-2-28-million-dating-site-users/"}],"summary":" Hacker leaks data of 2.28 million dating site users  Data belongs to dating site MeetMindful and includes everything from real names to Facebook account tokens, and from email addresses and geo-location information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":"IR","motive":"ideology","name":"Hezbollah","variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2669dbbdb8ffb180707b43ed1d02e7da861d8d78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"349c1500-38d0-11ec-b42b-a7ad11fc87ee"},"incident_date":"2021-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"462344db6236","org_name":"Israeli Defense Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/iran-said-to-hack-former-israeli-army-chief-of-staff-access-his-entire-computer-533222.shtml"}],"summary":"A cybercriminal working for Iran attacked the computer of a former IDF chief of staff and gained access to his entire computer database, says Times of Israel.    Channel 10 identified the hacker as Yaser Balaghi. He reportedly bragged about the hack afterward, but also unknowingl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"hezbollah"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1598"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f58e46792011c70ece3d6fea81b674af1812fec","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5b7713a0-073e-11ec-863c-8359987c65e0"},"incident_date":"2021-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fb13556d2a7","org_name":"IObit","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/"}],"summary":"IObit forum hacked and used to distribute ransomware to it's customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f21d96ec822ccf67ff75442f54e088f4602e69c8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f20988a0-d42d-11eb-a192-c5509024cd4a"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57f68a8e439f","org_name":"Hearing Care network","org_type":"healthcare","ransomware":null,"records_affected":32000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/data-of-3.3m-20-20-hearing-care-patients-hacked-from-cloud-database"}],"summary":"Hearing care network has it's aws account ransacked and then deleted by hackers, which impacted 3.2 million people. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af3683430b29d689e1bea0909e77f238fabf533e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f699080-327a-11ec-a962-0f8a4d8d5131"},"incident_date":"2021-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"58bc3a102335","org_name":"Gab","org_type":"technology_saas","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/story/gab-hack-data-breach-ddosecrets/"}],"summary":"Alleged \"Demon\" hackers breached Gab and it's over 15,000 users and over 70Gbs of data taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c69a41cf46322ece9b694328c0ba04864bbd435","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00533240-f142-11eb-8c8a-5968a0b53910"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6489d33dacb3","org_name":"Foreign, Commonwealth and Development Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/politics/2021/mar/05/hackers-obtain-sensitive-data-on-uk-aid-projects-overseas"}],"summary":"Hackers obtained sensitive data on UK aid projects overseas ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d792bb3256b0e53af2a8f73d9c752dabb9b94e5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee0bef70-3ccb-11ec-b63a-33c287a8ec4a"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"57b929af410b","org_name":"Everis","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/nato-s-cloud-platform-has-been-hacked-533282.shtml"}],"summary":"Everis an infrastructure provider was hacked and had one of it's client's (NATO) data stolen and held ransom by hackers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bd34b758d06be45220a6c2a924f5bb6f5326661","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09fbea80-da77-11eb-bcc7-b7194a064c3e"},"incident_date":"2021-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":1000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/over-a-billion-cvs-health-records-exposed-online-533264.shtml"}],"summary":"Over a Billion CVS Health records belonging to CVS were out for grabs on the Internet due to poor cloud security managemen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"679076c9c006044ca81334888bfe5a33522234ed","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e7f288a0-f163-11eb-821b-d1ebb09f37f0"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d5cc8ca1a931","org_name":"Commport Communications","org_type":"technology_saas","ransomware":true,"records_affected":950000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techgenix.com/canada-post-experiences-data-breach/"}],"summary":"Commport Communications, a Canada Post supplier, experienced a databreach that impacted 44 commercial customers and relating to 950k receiving customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8425d3103cfd53cee21e5641a3b1b092a9ae3b8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2676a410-4891-11ec-be64-495e033b0bce"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LT","org_id":"5eda8dcab348","org_name":"CityBee","org_type":"transportation_logistics","ransomware":null,"records_affected":110000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.euronews.com/2021/02/17/thousands-of-citybee-users-have-their-personal-data-leaked-online"}],"summary":"Company hacked, data posted for sale on hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63be723b5e39a775cca37513310f270fecc7a439","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96e0cfc0-8e7b-11ec-a600-657ec2694f8f"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"377f1e6ea1cf","org_name":"Buyucoin","org_type":"financial","ransomware":null,"records_affected":161487,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/16918"}],"summary":"Threat actor dumps stolen data from Buyucoin archive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"238b5e1804ac5cf3298fe280649d2b63e6eb445c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ceaa8a00-8e7a-11ec-a600-657ec2694f8f"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0a75d545e1d","org_name":"Bonobos","org_type":"other","ransomware":null,"records_affected":70000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/bonobos-clothing-store-suffers-a-data-breach-hacker-leaks-70gb-database/"},{"fetched_at":null,"title":"Have I Been Pwned: Bonobos","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bonobos"}],"summary":"Bonobos clothing store experienced a breach after an attacker was able to exploit a misconfiguration in their cloud based backups","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35fc1bca307430518eb481c1e79dacb2c742d331","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70e5f570-1199-11ec-a044-77090c8577a4"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"06be1de6679b","org_name":"Bank Rakyat Indonesia","org_type":"financial","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.marketing-interactive.com/bri-life-investigates-alleged-data-leak-of-2-million-customers"}],"summary":"Bank Rakyat Indonesia experienced a breach when a hacker posted for sale one of their databases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9bf2ef36681bc66d172b50d9b437c3447f0a95b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a46c7250-463e-11ec-b26b-73b5a62f8946"},"incident_date":"2021-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"827d581ea277","org_name":"Airtel","org_type":"technology_saas","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.indiatoday.in/technology/news/story/exclusive-millions-of-airtel-numbers-with-aadhaar-details-and-user-data-likely-leaked-were-accessible-on-web-1765247-2021-02-02"}],"summary":"Over two million Airtel numbers along with users details like the address and Aadhaar numbers reportedly leaked in a data breach and were available on the web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb99c0a0afeb0cbcef2f25d795502c98ed35a786","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4a70e2f0-1c7b-11ec-bbb1-d17b99816d46"},"incident_date":"2021-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"b2f84f106dda","org_name":"Acer","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/acer-data-breach-sodinokibi-ransomware-group-publishes-first-stolen-data/"}],"summary":"Acer hit by apparent attack from REvil ransomware group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"CLOP","variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":["CVE-2021-27101","CVE-2021-27102","CVE-2021-27103","CVE-2021-27104"],"data_types":["internal","medical","personal"],"disclosed_date":"2021-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1941dd8310c07d050d59b4c971f5e4ef71c58bdb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fb411460-92cd-11ec-a39a-3584eb2df2ab"},"incident_date":"2021-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c45248c1743","org_name":"Accellion","org_type":"technology_saas","ransomware":true,"records_affected":5786739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-australia-cyber-asic/australias-securities-regulator-says-server-hit-by-cyber-security-breach-idUSKBN29U0S7;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fears-grow-data-hacked-from-reserve-bank-may-be-leaked-by-clop-ransomware-group/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2021/01/25/asic_accellion_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://toronto.ctvnews.ca/cyberattack-hits-vaccine-records-for-thousands-of-durham-region-children-ctv-news-investigation-1.5543525;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.khq.com/news/washington-state-auditors-office-suffers-security-breach-seattle-times-reports/article_641dbe82-62ac-11eb-9063-a33a89824152.html;"}],"summary":"Accellion's FTA product was compromised through a series of zero day exploits. Many client's were impacted. A number of those client's data was posted to the name and shame website of the threat actor.  Ransomware was deployed to many, and litigation settlements happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"clop","kev":[{"cve":"CVE-2021-27101","kev_added":"2021-11-03","name":"Accellion FTA SQL Injection Vulnerability","days_listed_before_incident":-306,"product":"Accellion FTA"},{"cve":"CVE-2021-27102","kev_added":"2021-11-03","name":"Accellion FTA OS Command Injection Vulnerability","days_listed_before_incident":-306,"product":"Accellion FTA"},{"cve":"CVE-2021-27103","kev_added":"2021-11-03","name":"Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability","days_listed_before_incident":-306,"product":"Accellion FTA"},{"cve":"CVE-2021-27104","kev_added":"2021-11-03","name":"Accellion FTA OS Command Injection Vulnerability","days_listed_before_incident":-306,"product":"Accellion FTA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-31","discovered_date":"2020-09-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f26e31ca74dd1a677f688a627c229e1281e02cbc","impact_type":"unknown","incident_date":"2019-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"978f2972b774","org_name":"Treasure Valley Community College","org_type":"unknown","ransomware":null,"records_affected":8909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Treasure%20Valley%20Community%20College-2020-12-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-31","discovered_date":"2020-10-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a6f23069bfa7474656e45f2b46b5676961f4580","impact_type":"disruption_or_ransomware","incident_date":"2020-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LifeQuotes%20-%20All%20Other%20States%20Proof%20-%2012-31-2020%204826-3487-6373%20v.1.pdf"},"notes":null,"org_country":"US","org_id":"a2c43e6dafe0","org_name":"Life Quotes, Inc.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197676"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LifeQuotes%20-%20All%20Other%20States%20Proof%20-%2012-31-2020%204826-3487-6373%20v.1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Life%20Quotes%2C%20Inc.-2020-12-31"}],"summary":"Life Quotes learned its systems had been encrypted in a ransomware attack, and an investigation found unauthorized access on October 19 and 20, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-12-30","discovered_date":"2020-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5de061d901bddf9576b82506cc8375b22b85c89d","impact_type":"data_theft","incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10195.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"1fdbc4039440","org_name":"Zoetop Business Co. Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":148785,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10195.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10195.pdf"}],"summary":"ROMWE reported that customer usernames and passwords may have been stolen in July 2018 and later found posted on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-12-30","discovered_date":"2020-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46248871529f0270a45bada1f33f390d8687f20c","impact_type":"data_theft","incident_date":"2018-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Customer%20Email%20Notification%20-%20ROMWE_1.pdf"},"notes":null,"org_country":"US","org_id":"1fdbc4039440","org_name":"Zoetop Business Co. Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Customer%20Email%20Notification%20-%20ROMWE_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Zoetop%20Business%20Co.%20Ltd.-2020-12-30"}],"summary":"ROMWE reported that customer usernames and passwords may have been stolen from its computer network in July 2018 and later found posted on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e34c26fc405ad68e89f60b116970c4d6094d0e9","impact_type":"both","incident_date":"2020-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VPH%20-%20CA%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"f807011c7ecd","org_name":"Valley Presbyterian Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197631"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VPH%20-%20CA%20Notice%20of%20Data%20Event.pdf"}],"summary":"A ransomware incident involving Blackbaud systems resulted in the exfiltration of data that may have included Valley Presbyterian Hospital individuals' names.","supporting_quote":null,"technology_involved":["Blackbaud systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-30","discovered_date":"2020-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b22688237a2b208c139423cb73b4af21628c93bb","impact_type":"disruption_or_ransomware","incident_date":"2020-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sugar%20Bowl-%20Template%20Notification%20Letter%20%28Adult%201%20year%29.pdf"},"notes":null,"org_country":"US","org_id":"3bd8404bb84c","org_name":"Sugar Bowl Corporation","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197638"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sugar%20Bowl-%20Template%20Notification%20Letter%20%28Adult%201%20year%29.pdf"}],"summary":"Sugar Bowl reported that an unauthorized person accessed its computer network during a ransomware attack, potentially involving names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-30","discovered_date":"2020-06-29","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"985fc8cc2332b4942d9148b696e4e7e43059a40d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IUBAC%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"eb57f5678516","org_name":"International Union of Bricklayers and Allied Craftworkers","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197645"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IUBAC%20-%20Notice%20of%20Data%20Event.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Union%20of%20Bricklayers%20and%20Allied%20Craftworkers-2020-12-30"}],"summary":"The organization confirmed unauthorized access to employee email accounts between June 4 and July 10, 2020, and could not rule out access to emails or attachments containing personal information.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f98c570ce1527e953be70fdde726eef8a1f9b99c","impact_type":"unknown","incident_date":"2019-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Dickey%27s%20-%20California%20Attachment.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f3ff35a84ac9","org_name":"Dickey's Barbecue Pit","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197607"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dickey%27s%20Barbecue%20Pit-2020-12-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08e3735b9850448c6f521a6ecfe93ca6d014b4ab","impact_type":"unknown","incident_date":"2020-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EXPERIAN_G0290_Total%20Vision_L01_SAS_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"458ad261a8f8","org_name":"Total Vision, PC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197571"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"67b46ab3a75b651e25bbeb1a4f6ceb18777b6867","impact_type":"both","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ThriveUpstate.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9322e165f64a","org_name":"Thrive Upstate","org_type":"nonprofit","ransomware":true,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ThriveUpstate.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ThriveUpstate.pdf"}],"summary":"Thrive Upstate reported that a ransomware attack on its service provider BlackBaud resulted in a copy of a backup file containing personal information being removed.","supporting_quote":"After discovering the attempted attack, BlackBaud ’s Cyber Security team —together with independent forensics experts and law enforcement— successfully prevented the cybercriminal from blocking their system access and fully encrypting files; and ultimately expelled them from their system.","technology_involved":["BlackBaud, Inc."],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"BlackBaud, Inc."},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-28","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"256c16aa6caad6809dc24e51f7ac60d19058493d","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10379.pdf"},"notes":null,"org_country":"US","org_id":"88be1dff11ef","org_name":"Pulmonary Hypertension Association, Inc.","org_type":"nonprofit","ransomware":true,"records_affected":722,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10379.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10379.pdf"}],"summary":"The Pulmonary Hypertension Association reported that a ransomware incident at Blackbaud involved data including names and dates of birth associated with the organization.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-12-28","discovered_date":"2020-12-02","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5e134b310d88a3a1d223903854e0e1040364714e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10378.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e518c4db7ca1","org_name":"Prime Therapeutics","org_type":"professional_services","ransomware":null,"records_affected":897,"reviewed":false,"root_cause":"The incident was due to manual mailing error.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10378.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10378.pdf"}],"summary":"Prime Therapeutics reported that letters mailed to incorrect addresses may have exposed recipients’ names and medication names.","supporting_quote":"On December 2, 2020, we became aware that certain letters mailed to inform individuals of changes to their 2021 prescription drug benefits were mailed to the incorrect address and may have contained a correct or incorrect medication name.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15482613822ff0d49ad56b8451b8a4832943f8e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5f185780-d831-11eb-a5a2-812629c6bc41"},"incident_date":"2020-12-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fd6282ca060","org_name":"CallX","org_type":"other","ransomware":null,"records_affected":114000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/telemarketing-biz-exposes-114000/"}],"summary":"A US telemarketing company has leaked the personal details of potentially tens of thousands of consumers after misconfiguring a cloud storage bucket, Infosecurity can reveal.  A team at vpnMentor led by Noam Rotem found the unsecured AWS S3 bucket on December 24 last year. It was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-23","discovered_date":"2020-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1e5de5331dd9be111dad5a4ad6b16c9955b243d","impact_type":"both","incident_date":"2020-08-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_34.pdf"},"notes":null,"org_country":"US","org_id":"25a6a0e6d599","org_name":"Ultra Clean Holdings, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_34.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ultra%20Clean%20Holdings%2C%20Inc.-2020-11-10"}],"summary":"Ultra Clean Holdings reported that an email phishing scheme led to an attacker obtaining personal information and attempting to extort the company.","supporting_quote":"We are writing to inform you that on August 5, 2020, we discovered that on August 3 and 4, 2020 UCT had been the victim of an email phishing scheme, which resulted in the attacker obtaining some of your personal information.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-12-23","discovered_date":"2020-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82c6ba903a6fd06c4a1acfe2daf2058c4fd04adc","impact_type":"disruption_or_ransomware","incident_date":"2020-11-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TT%20Breach%20Notice%20Template_1.pdf"},"notes":null,"org_country":"US","org_id":"afee14fcd02d","org_name":"Tree Top, Inc.","org_type":"manufacturing","ransomware":true,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197530"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TT%20Breach%20Notice%20Template_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10377.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tree%20Top%2C%20Inc.%20and%20Northwest%20Naturals%20LLC-2020-12-23"}],"summary":"Tree Top reported that attackers accessed its systems through a compromised user account, encrypted servers with ransomware, and may have exposed personal information.","supporting_quote":"The hackers initially gained access to our network through a compromised user account and then gained access to several of our corporate computer systems.","technology_involved":["servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1491"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b7b3bbf0f1b42dd7632c30497dd5c8e1908264d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-12-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCPA%20Data%20Breach%20Notification%202020-12-23.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"d9656c89955b","org_name":"NetGalley","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unsecured testing server made credentials easily attainable to a hacker.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NetGalley","type":"hibp","url":"https://haveibeenpwned.com/Breach/NetGalley"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197477"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCPA%20Data%20Breach%20Notification%202020-12-23.pdf"}],"summary":"NetGalley reported unauthorized access to a database backup stored in Amazon Cloud after a testing server was left unsecured.","supporting_quote":"One of our testing servers had been left unsecured, and the credentials became easily attainable by a hacker.","technology_involved":["Amazon Cloud","testing server","NetGalley database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-23","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2d8d50a627b7d187494ef44b622a33fec51bf7a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Metabolic%20Maintenance%20Ad%20No%20SSN%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"55785296fe7a","org_name":"Metabolic Maintenance Products, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197485"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Metabolic%20Maintenance%20Ad%20No%20SSN%20r3prf.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Metabolic%20Maintenance%20Products%2C%20Inc.-2020-12-23"}],"summary":"Metabolic Maintenance Products reported that an unknown third party may have accessed names and payment card numbers used on its website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"408f0c23db2e124667c472b406b4bb1fe88d699b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2020_12_23_CCB_customer_notice_CA_.pdf"},"notes":null,"org_country":"US","org_id":"2413eac296e0","org_name":"JPMorgan Chase Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197508"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2020_12_23_CCB_customer_notice_CA_.pdf"}],"summary":"A call center employee may have allowed an unauthorized third party to overhear a conversation about a Chase account or view the employee’s screen, potentially disclosing personal and account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-12-23","discovered_date":"2020-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc8b512dafc19afad2660b0a0baff9457b8f5fe1","impact_type":"data_theft","incident_date":"2020-11-08","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DJO%20-%20Notification%20Letter%20%28General%20Template%29.pdf"},"notes":null,"org_country":"US","org_id":"334737e5d532","org_name":"DJO Global, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197509"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DJO%20-%20Notification%20Letter%20%28General%20Template%29.pdf"}],"summary":"DJO Global reported that cyber criminals likely exfiltrated data from its systems between November 8 and 9, 2020, including personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"52c437f2f17d3bf7e7143b55c7e2135d42e683d4","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10375.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4a56cb56c884","org_name":"Bucknell University","org_type":"education","ransomware":true,"records_affected":710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10375.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10375.pdf"}],"summary":"Blackbaud reported that a threat actor removed data from its systems while carrying out a ransomware attack affecting Bucknell University.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-22","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"973813e27987ddeb280a1630df74b33e01b3cf7e","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10374.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a5de625fc973","org_name":"Cedarville University","org_type":"education","ransomware":true,"records_affected":1706,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10374.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10374.pdf"}],"summary":"Data belonging to Cedarville University was removed from Blackbaud's systems during a ransomware incident.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-21","discovered_date":"2020-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7841ef841fb50f407a151b387e37cfdbf38709b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Southbeachsmoke%2Cdirectvapor%2Cvaporfi_1.pdf"},"notes":null,"org_country":"US","org_id":"9d739084e02f","org_name":"South Beach Smoke","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197405"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Southbeachsmoke%2Cdirectvapor%2Cvaporfi_1.pdf"}],"summary":"South Beach Smoke reported suspicious activity associated with its online checkout page that may have exposed personal and payment information entered there.","supporting_quote":null,"technology_involved":["online checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-12-18","discovered_date":"2020-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e9ebdc578562aa39a9aa10f981eeea00d3f9cea","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10373.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"63b3550db294","org_name":"Washington State Bar Association","org_type":"professional_services","ransomware":null,"records_affected":4051,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10373.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10373.pdf"}],"summary":"The Washington State Bar Association reported that unauthorized code appeared on mywsba.org and payment card information may have been acquired without authorization.","supporting_quote":null,"technology_involved":["mywsba.org website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-12-18","discovered_date":"2020-09-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c867c28d1c03a4e7961e4e9a3bc4aae8588a442","impact_type":"both","incident_date":"2020-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2020-12-18%20GenRx%20-%20Template%20Notice%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"ca6fcd714793","org_name":"GenRx Pharmacy","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197301"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2020-12-18%20GenRx%20-%20Template%20Notice%20Letters.pdf"}],"summary":"GenRx Pharmacy discovered ransomware on its system, and later confirmed that a cybercriminal removed files containing health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-18","discovered_date":"2020-09-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0e554dde71df8ed9026d53c3009873ffc4ee709","impact_type":"both","incident_date":"2020-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Capital%20Lumber%20-%20Sample%20Consumer%20Notification%20Letter%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"de6749aeba36","org_name":"Capital Lumber Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197306"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Capital%20Lumber%20-%20Sample%20Consumer%20Notification%20Letter%20%28CA%29.pdf"}],"summary":"Capital Lumber Company reported a security incident that disrupted access to certain systems and may have involved access to or acquisition of personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2020-12-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0cfbf373865db5accb8957951d23f4082c89c7f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10372.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"318d68838d59","org_name":"Benton County","org_type":"government","ransomware":null,"records_affected":820,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10372.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10372.pdf"}],"summary":"Benton County reported unauthorized access to an email account that contained information related to affected individuals.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7b08a4e997cc55fa99d7cdd50e57d445d856e45","impact_type":"unknown","incident_date":"2020-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/II-VI%20Mail%20Proof%20US-Other.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d515a9316dc","org_name":"II-VI Incorporated","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197254"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-17","discovered_date":"2020-10-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b4f6e6dac46d8e5d0a8b63e97e904d05018b2b6","impact_type":"data_theft","incident_date":"2020-08-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gundry%20MD%20-%20Template%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"4eca5b6760b4","org_name":"Gundry MD","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gundry%20MD%20-%20Template%20Notification%20Letter.pdf"}],"summary":"An unauthorized third party accessed 1ShoppingCart systems and collected information about transactions on Gundry MD’s website.","supporting_quote":"On October 30, 2020, we learned from 1ShoppingCart that an unauthorized third party accessed 1ShoppingCart’s systems and collected information regarding transactions placed on Gundry MD’s website from August 6, 2020 to August 22, 2020.","technology_involved":["1ShoppingCart"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"1ShoppingCart"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fb75680d050f","name":"1ShoppingCart"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-16","discovered_date":"2020-11-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17b7705b0b4960668a7e77dc243a0cc1617125c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"72f087dc7ab4","org_name":"Paysafe Group Holdings Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197247"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Individual%20Notification.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/PaysafeGroup.pdf"}],"summary":"Paysafe reported suspicious automated queries to a website that may have compromised personal and bank account information, with no confirmed unauthorized acquisition or misuse.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-12-16","discovered_date":"2020-06-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f581cd630a314fe97a698057d836224c2bf30896","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Attachment%20-%20CA%20Individual%20Notice%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"8da05db10b3d","org_name":"MEDNAX Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email enabled unauthorized access to MEDNAX business email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197246"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Attachment%20-%20CA%20Individual%20Notice%20Letters.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MEDNAX%20Services%2C%20Inc.-2020-12-16"}],"summary":"A phishing incident gave an unauthorized third party access to certain MEDNAX business email accounts, where personal information may have been present.","supporting_quote":"On June 19, 2020, MEDNAX discovered that an unauthorized third party gained access to certain Microsoft Office 365-hosted MEDNAX business email accounts through phishing.","technology_involved":["Microsoft Office 365","business email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-16","discovered_date":"2020-11-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a60e2a69018a145d43bde060c7579e08630688b","impact_type":"unknown","incident_date":"2020-09-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3df4cb41e20b","org_name":"Maps Credit Union","org_type":"unknown","ransomware":null,"records_affected":1911,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Maps%20Credit%20Union-2020-12-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bcc14bebdb2e3a6c6895222fef4b591cad60db56","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10369.pdf"},"notes":null,"org_country":"US","org_id":"b79ba3c02fd6","org_name":"Kappa Delta Foundation","org_type":"nonprofit","ransomware":true,"records_affected":1508,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10369.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10369.pdf"}],"summary":"A ransomware attack on Blackbaud exposed copies of a Kappa Delta Foundation file containing members’ and donors’ personal information and donation history.","supporting_quote":"The Kappa Delta Foundation has been notified that one of our third-party software service providers, Blackbaud, a provider used by hundreds of colleges, universities, health care organizations, schools, and other non-profit organizations, was victim of a ransomware attack.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-16","discovered_date":"2019-10-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"90a52959c0e3f7701f782085e14f7164d437fd99","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AFTRARetirementFund.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f4a0ba7c9c95","org_name":"AFTRA Retirement Fund","org_type":"financial","ransomware":null,"records_affected":1786,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AFTRARetirementFund.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AFTRARetirementFund.pdf"}],"summary":"AFTRA Retirement Fund reported that files and folders may have been subject to unauthorized access between October 24 and October 28, 2019.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-15","discovered_date":"2020-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5365088bf9cc5b4f1a4867797de71f81016885f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sonoma%20Recovery%20Services%2C%20LLC%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6c536f183877","org_name":"Olympia House","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197196"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sonoma%20Recovery%20Services%2C%20LLC%20-%20Notice.pdf"}],"summary":"Olympia House reported that files on its systems were accessed without authorization between July 1 and August 7, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1242ce5992ea427f31da000d616bc2dca5d7d9a","impact_type":"unknown","incident_date":"2020-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_8.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0fa9fa92f63b","org_name":"Monterey  Bay Air Resources District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197205"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-14","discovered_date":"2020-11-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e54a9253b1a7682bce7b728fb8ef7b9434f47f01","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template%20-%20%28Grass%20Valley%29%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"530934c64bb2","org_name":"Grass Valley USA, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template%20-%20%28Grass%20Valley%29%20%28US%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Grass%20Valley%20USA%2C%20LLC-2020-12-14"}],"summary":"Grass Valley reported that personal information of current and former employees was accessed in an incident affecting Belden, which provided services to Grass Valley.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Belden"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2296041a6e0d","name":"Belden"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-14","discovered_date":"2020-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02ca9f3c677cd7f88bc64ad6d4e5d5e74898a2f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template%20-%20%28Belden%29%20%28US%29.pdf"},"notes":null,"org_country":"US","org_id":"2296041a6e0d","org_name":"Belden Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template%20-%20%28Belden%29%20%28US%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Belden%20Inc.-2020-12-14"}],"summary":"Belden reported that an outside party accessed servers containing personal information of current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-11","discovered_date":"2020-11-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a16b8a65694260fa5e5efea03259195298e946b9","impact_type":"unknown","incident_date":"2020-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cec51e59c208","org_name":"Sonoma Valley Hospital","org_type":"unknown","ransomware":null,"records_affected":69000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sonoma%20Valley%20Hospital-2020-12-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9828c794af296058f9dd729968861eef43961a15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e48a2e70-22dd-11eb-b221-a300329fb9cf"},"incident_date":"2020-12-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"ad28e3f419f6","org_name":"Honda","org_type":"retail_ecommerce","ransomware":null,"records_affected":26000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/honda-leak-hits-26000-north/,https://siliconangle.com/2019/12/18/honda-exposes-customer-data-unsecured-elasticsearch-database-second-time-year/,https://www.informationsecuritybuzz.com/expert-comments/leaky-honda-database-exposes-976m-records-expert-commentary/"}],"summary":"cloud exposed database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5cac32c30633ac191f74623f169effbd3ea39b90","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10368.pdf"},"notes":null,"org_country":"US","org_id":"87426d4c3a5e","org_name":"Fairfield University","org_type":"education","ransomware":null,"records_affected":505,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10368.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10368.pdf"}],"summary":"Fairfield University reported that an incident at Blackbaud resulted in exfiltration of customer data that included names and dates of birth.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-11","discovered_date":"2020-07-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72e193206f4ea5450f911e32f1b80c3619d60f79","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EyeMed%20Individual%20Notice%20Template%20%2810.21.2020%29%20Reseller.pdf"},"notes":null,"org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EyeMed%20Individual%20Notice%20Template%20%2810.21.2020%29%20Reseller.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aetna-2020-12-10"}],"summary":"An unauthorized individual accessed an EyeMed email mailbox and sent phishing emails; personal information may have been viewed or acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-10","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5e9902d88dac42ca748efd8d1aa2415dd0f8f5df","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10367.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f14363672259","org_name":"Oklahoma State University Foundation","org_type":"nonprofit","ransomware":null,"records_affected":1334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10367.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10367.pdf"}],"summary":"An unauthorized third party accessed Blackbaud servers holding backup files for the Foundation’s fundraising and donor relationship management software.","supporting_quote":"Through the course of our investigation, we learned that between February 7, 2020, and May 20, 2020, an unauthorized third party gained access to Blackbaud’s servers where backup files for our fundraising and donor relationship management software were stored.","technology_involved":["Blackbaud","fundraising and donor relationship management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-10","discovered_date":"2020-10-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc1131f4bc018c7a22e3b95955c07e63d5fb75a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HNR%20Clark%20-%20Individual%20Notification%20Letter_v2%20%28PRINT%20PROOF%29.pdf"},"notes":null,"org_country":"US","org_id":"2507e4285049","org_name":"H.N.R. Clark, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197018"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HNR%20Clark%20-%20Individual%20Notification%20Letter_v2%20%28PRINT%20PROOF%29.pdf"}],"summary":"H.N.R. Clark discovered unauthorized access to an email account that potentially exposed clients’ personal information, including tax returns.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-12-09","discovered_date":"2020-11-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"180f60071b8ae5d53ad14c28fc5131e9db629be7","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Copy%20of%20Spotify%20Breach%20Notice%20Letter%20%28CALIFORNIA%29.DOCX_.pdf"},"notes":null,"org_country":"US","org_id":"b857945d49ba","org_name":"Spotify USA Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196954"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Copy%20of%20Spotify%20Breach%20Notice%20Letter%20%28CALIFORNIA%29.DOCX_.pdf"}],"summary":"Spotify discovered that a system vulnerability exposed some account registration information to certain business partners.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-12-09","discovered_date":"2020-10-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98e85e3ef616e3afa14d7b4d4c4ad665fdf9a088","impact_type":"disruption_or_ransomware","incident_date":"2020-10-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sonoma%20Valley%20Health%20Ad%20No%20CM%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"a2eb9d3123ae","org_name":"Sonoma Valley Healthcare District","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196956"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sonoma%20Valley%20Health%20Ad%20No%20CM%20r1prf.pdf"}],"summary":"Sonoma Valley Healthcare District reported a ransomware attack discovered on October 11, 2020, and said health claims and certain medical record information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a8f6a66636d67677a76c4babe4fb236a493b577","impact_type":"disruption_or_ransomware","incident_date":"2020-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Robie%20%26%20Matthai%2C%20P.C.%20V5%20Print%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"13917e2757ff","org_name":"Robie & Matthai APC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Robie%20%26%20Matthai%2C%20P.C.%20V5%20Print%20Proof.pdf"}],"summary":"Robie & Matthai APC reported a ransomware attack after which an attacker may have accessed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-09","discovered_date":"2020-10-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c32ab5801491ced85c3cdfd7fd4fe4d4794bc2fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20-%20Adult%20SSN%20AC093_v02.pdf"},"notes":null,"org_country":"US","org_id":"62ed9afd061a","org_name":"KeyPoint Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20-%20Adult%20SSN%20AC093_v02.pdf"}],"summary":"An unauthorized third party accessed an employee email account, where some customers’ personal information could have been viewed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-12-09","discovered_date":"2020-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60bb9b5aa16b602089c0c01b89459cba6e48a631","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Version%20-%20Customer%20Comms.pdf"},"notes":null,"org_country":"US","org_id":"7f4a76c671e2","org_name":"Glofox Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196919"},{"fetched_at":null,"title":"Have I Been Pwned: Glofox","type":"hibp","url":"https://haveibeenpwned.com/Breach/Glofox"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Version%20-%20Customer%20Comms.pdf"}],"summary":"Glofox reported that an unknown third party accessed archived user data, including personal information and hashed passwords.","supporting_quote":null,"technology_involved":["Glofox platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-12-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78efd3b434e0fab053f62450903ff92dc719cf37","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a2b41b90-25df-11ec-8021-93be7268887c"},"incident_date":"2020-12-09","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b15556ea1496","org_name":"Elara Caring","org_type":"healthcare","ransomware":null,"records_affected":100484,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/data-breach-at-healthcare-provider-elara-caring-exposes-100-000-patients-information"}],"summary":"PHI of More Than 100,000 Elara Caring Patients Potentially Compromised in Phishing Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36324fbf779c61641f01028b557fa8419f284c4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10366.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"de45e6ffac51","org_name":"City University of Seattle","org_type":"education","ransomware":null,"records_affected":1097,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10366.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10366.pdf"}],"summary":"City University of Seattle investigated an incident in which personal information, including names, may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d39ba3fde6e5e83c7f5600db19cf88493c029d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Woodruff%20Sawyer%20%26%20Co.%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"a61c431f6155","org_name":"Woodruff Sawyer & Co.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196912"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Woodruff%20Sawyer%20%26%20Co.%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10359.pdf"}],"summary":"Woodruff Sawyer reported unauthorized access to employee email accounts on separate occasions between March 2 and April 30, 2020, which may have exposed emails and attachments containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-07","discovered_date":"2020-10-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d07e5cf827a11cf9c3fa723f065f31a3169140d","impact_type":"unknown","incident_date":"2020-04-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af99d3236fdf","org_name":"Westminster School","org_type":"unknown","ransomware":null,"records_affected":804,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Westminster%20School-2020-12-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd9033cc71675a259757f61ab208240692d301b4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-01-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c4c3eee3fa3a","org_name":"Peatix","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Peatix","type":"hibp","url":"https://haveibeenpwned.com/Breach/Peatix"}],"summary":"A January 2019 Peatix data breach exposed email addresses, names, and salted password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"140252d13cc96054299c2c52135e6316c61d1a5f","impact_type":"unknown","incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CSE%20CCHS%20Blackbaud%20Exposure%20Letter%20SSN%20V2%20Print%20Proof.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"456bb28e16c5","org_name":"Diocese of Charlotte","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196814"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"270bcc4ba51639a47c84965566b9beb140ab6374","impact_type":"data_theft","imported_from":null,"incident_date":"2018-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"598adfaf138b","org_name":"Pluto TV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pluto TV","type":"hibp","url":"https://haveibeenpwned.com/Breach/PlutoTV"}],"summary":"A breach of Pluto TV exposed user information, including email and IP addresses, names, usernames, dates of birth, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-04","discovered_date":"2020-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9a52998c3940a90ea2f338e8fefd50a719a7bbd0","impact_type":"disruption_or_ransomware","incident_date":"2020-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10365.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"94ecbfe38797","org_name":"USNR, LLC","org_type":"unknown","ransomware":true,"records_affected":3950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10365.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#USNR%20LLC-2020-12-07"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10365.pdf"}],"summary":"Unknown individuals accessed USNR's information systems and launched an attack designed to encrypt data files, with employee personal information potentially accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dd08da5a2ec949af7c481bfe3d0cfb026d89d98c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"552f72b41dde","org_name":"Relay Resources","org_type":"unknown","ransomware":null,"records_affected":1199,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Relay%20Resources-2020-12-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-12-04","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dffa3ead44ddd14399f5524034d26e1372a36ee3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Angeion%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"397e4e835912","org_name":"Angeion Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Angeion%20Notice.pdf"}],"summary":"An unauthorized third party accessed an Angeion Group employee's corporate email box containing personal information.","supporting_quote":null,"technology_involved":["corporate email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-03","discovered_date":"2020-10-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76d0bca6a152e0b0cc2f416c52284b8c2ce531b6","impact_type":"unknown","incident_date":"2020-04-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"737435ec1b76","org_name":"Moses Brown School","org_type":"unknown","ransomware":null,"records_affected":738,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Moses%20Brown%20School-2020-12-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"554777f36abf52a1cc002216273ec726d774e50f","impact_type":"unknown","incident_date":"2020-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/legal%20email%20%281%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1f9565f7199","org_name":"Eaze Technologies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196750"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d25baedcda76056d8524774c1d2b29faf8333aa","impact_type":"disruption_or_ransomware","incident_date":"2020-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Long%20%26%20Foster%20Supplemental%20Notice%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"88dd4d2a631b","org_name":"The Long & Foster Companies, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196639"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Long%20%26%20Foster%20Supplemental%20Notice%20Proof.pdf"}],"summary":"Long & Foster reported that cybercriminals gained access to its systems during a ransomware attack, and personal and financial information may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"33d64ec797a0553896f24708642c30fb110fda16","impact_type":"both","incident_date":"2020-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10364.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"da1e25a3cf79","org_name":"Stride, Inc.","org_type":"education","ransomware":true,"records_affected":23361,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Stride%2C%20Inc.-2021-07-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10364.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-542602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stride%20-%20Sample%20Notice%20-%20CA.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10364.pdf"}],"summary":"Stride reported a ransomware attack in which an unknown actor may have accessed its systems and obtained information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96e88561df0041de8b8d4909f6e75baecd970de5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b5e17810-9372-11ec-a39a-3584eb2df2ab"},"incident_date":"2020-12-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"691715b75cab","org_name":"SolarWinds","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2020/12/08/technology/fireeye-hacked-russians.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.marketwatch.com/story/fireeye-stock-drops-as-cybersecurity-company-reveals-it-was-hacked-11607462414;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/solarwinds-says-18000-customers-may-have-used-compromised-product;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2021/01/19/fireeye_solarwinds_code/;"}],"summary":"SolarWinds disclosed on Sunday that a nation-state hacker group breached its network and inserted malware in updates for Orion, a software application for IT inventory management and monitoring.  The trojanized Orion update allowed attackers to deploy additional and highly stealt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bda7559df26ccb9d9fe584617b12a31b433fd08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9d9c8b60-4646-11ec-b26b-73b5a62f8946"},"incident_date":"2020-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"b674c1711d80","org_name":"Sistema Único de Saúde","org_type":"government","ransomware":null,"records_affected":243000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theverge.com/2020/12/3/22150973/brazilian-ministry-of-health-leak-medical-records-personal-information;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/data-of-243-million-brazilians-exposed-online-via-website-source-code/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/experian-challenged-over-massive-data-leak-in-brazil/"}],"summary":"The personal information of more than 243 million Brazilians was potentially accessible for at least six months thanks to weakly encoded credentials kept in the source code of the Brazilian Ministry of Health’s website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1e7151e020678d48ed896764e5f1e185dcae843","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07bbefc0-0fe4-11ec-8c66-bd734728b5ba"},"incident_date":"2020-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"7770d9bb1265","org_name":"Randstad","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/top-global-hr-firm-randstad-stung-by-windows-ransomware.html"}],"summary":"Global human resources giant Randstad has taken a hit from cyber criminals using the Windows Egregor ransomware, with the company saying it is trying what data the attackers have stolen and placed on their site on the dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7fae0d946ff89094598a5bfb8b7cfedf3b4598a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a47d9af0-d9c2-11eb-8feb-0b45b7dcf47e"},"incident_date":"2020-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a20e77f7171e","org_name":"Q Link Wireless","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2021/04/no-password-required-mobile-carrier-exposes-data-for-millions-of-accounts/"}],"summary":"Q Link Wireless, a provider of low-cost mobile phone and data services to 2 million US-based customers, has been making sensitive account data available to anyone who knows a valid phone number on the carrier’s network, an analysis of the company’s account management app shows.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5457dc2e5e37e65b108331517fb31509bf4e6b7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07bc6df0-8e75-11ec-8536-fdd879d89dfb"},"incident_date":"2020-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd6ed3e1b68f","org_name":"PracticeFirst","org_type":"professional_services","ransomware":true,"records_affected":1200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/healthcare-ransomware-attack-targets-practice-management-vendor"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.practicefirstsecure.com/security-incident"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/practicefirst-notifies-patients-and-employees-after-ransomware-incident/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/supply-chain-ransomware-breach-affects-12-million-a-17062"}],"summary":"A supply chain ransomware attack affecting more than 1.2 million individuals is among the largest health data breaches reported to federal regulators so far this year.  See Also: Live Webinar | How to Stop the Four Horsemen of the Data Loss Apocalypse  Practicefirst, an Amherst, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a35a813b1581c8193fdf204525900380366ad922","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07fe5b20-8e84-11ec-a600-657ec2694f8f"},"incident_date":"2020-12-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b7056c11464","org_name":"MyFreeCams","org_type":"technology_saas","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techradar.com/news/adult-streaming-site-myfreecams-has-two-million-user-records-stolen"}],"summary":"Adult streaming site ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6086e8da2eb3a89c0cd1df4b7957e369125344fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20breach%20report%20-%20for%20submission.pdf"},"notes":null,"org_country":"US","org_id":"08a6d673d534","org_name":"MetaBrainz Foundation Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196624"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20breach%20report%20-%20for%20submission.pdf"}],"summary":"MetaBrainz Foundation Inc. reported that users’ email addresses and birth dates, when present, were temporarily available in the source of MusicBrainz entity pages.","supporting_quote":null,"technology_involved":["MusicBrainz entity page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"47cfe38436b658b198d27888316aeb1b56f447e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10913.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1aa7a880996e","org_name":"Kitsap County Credit Union","org_type":"unknown","ransomware":null,"records_affected":3268,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10913.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9ed14ce84d4bfed858701c3d0dbfe5be470d192","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9446add0-8e84-11ec-a600-657ec2694f8f"},"incident_date":"2020-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b19539460ed","org_name":"GetSchooled","org_type":"education","ransomware":null,"records_affected":930000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/bill-melinda-gates-foundations-charity-getschooled-breaches-900k-childrens-details/"}],"summary":"GetSchooled accidentally left a database open impacting 930k individuals ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-30","discovered_date":"2020-10-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e5f7db8e7e333bd13d0b426db99485d816d0786","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"afd82460499c","org_name":"Minerals Technologies Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196605"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Individual%20Notice%20Letter.pdf"}],"summary":"Minerals Technologies Inc. reported that a security breach compromised certain servers and may have resulted in unauthorized access to employees’ and dependents’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-30","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e4b780c2a0a0e6bfb8fdde355185da8c265e744","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FSC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"bfc16cd77d8d","org_name":"Florida State College at Jacksonville Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196618"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FSC%20-%20California%20Notification.pdf"}],"summary":"Blackbaud reported that backup files containing the Foundation's information were taken during a ransomware attack, and the files included names and Social Security numbers.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bddeeb70f4626ec01a31ff8763da255a4229786b","impact_type":"unknown","incident_date":"2020-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Lazarus%20Naturals-%20Notice%20of%20Data%20Event.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8db797e382f","org_name":"Etz Hayim Holdings, SPC. d/b/a Lazarus Naturals","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196610"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Etz%20Hayim%20Holdings%2C%20SPC.%20d/b/a%20Lazarus%20Naturals-2020-11-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-11-25","discovered_date":"2020-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db6f340b551cf787284068c793dcf11c86fa376b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ZEG%20California%20-%20Notice.pdf"},"notes":null,"org_country":"DE","org_id":"2efa233f9790","org_name":"ZEG – Berlin Center for Epidemiology and Health Research GMBH","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196531"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ZEG%20California%20-%20Notice.pdf"}],"summary":"Malicious code was found on certain servers, and a server contained Study data that may have included personal and medical information; the organization reported no indication that the data were stolen, viewed, or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-25","discovered_date":"2020-01-31","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0371d4d1350047d9756c56b2b4ff63cf8b7c0ddf","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-30","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UMPhysicians.pdf"},"notes":null,"org_country":"US","org_id":"6f50c83a8493","org_name":"University of Minnesota Physicians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Phishing emails were used to fraudulently access two employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UMPhysicians.pdf"}],"summary":"University of Minnesota Physicians reported that attackers used phishing emails to access two employee email accounts containing personal information.","supporting_quote":"UMPhysicians identified that cyber attackers used phishing emails to fraudulently access two employee email accounts.","technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c94341b0df74a57164ae97940d336d14b862dd1","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fairchild%20Medical%20Center.pdf"},"notes":null,"org_country":"US","org_id":"48683904c05a","org_name":"Fairchild Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A misconfiguration on a server allowed external individuals access to it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196532"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fairchild%20Medical%20Center.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fairchild%20Medical%20Center-2020-12-04"}],"summary":"A server misconfiguration at Fairchild Medical Center allowed external individuals access, and the organization could not rule out unauthorized access to records on the server.","supporting_quote":"Through the investigation, FMC determined that a misconfiguration existed from approximately December 16, 2015 to July 31, 2020 that allowed external individual(s) access to the server.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-25","discovered_date":"2020-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15ecb3aac72e01984840c0af60c8c7affe8da89c","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2020-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Canon%20-%20California%20Notification%20Material.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"a5d71c2f5145","org_name":"Canon U.S.A., Inc.","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196551"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Canon%20-%20California%20Notification%20Material.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Canon%20U.S.A.%2C%20Inc.-2020-11-25"}],"summary":"Canon U.S.A. reported a ransomware-related security incident involving unauthorized access to files on its file servers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-24","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80ad51946a9eafb2e63232cf3324011b7135ceed","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Center%20for%20Early%20Ed%20-%20BakerHostetler%20Blackbaud%20Incident%20Notice%20CM.pdf"},"notes":null,"org_country":"US","org_id":"44a871a7f46d","org_name":"The Center for Early Education","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196491"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Center%20for%20Early%20Ed%20-%20BakerHostetler%20Blackbaud%20Incident%20Notice%20CM.pdf"}],"summary":"A ransomware attack on Blackbaud exposed backup files containing the Center for Early Education’s information, including names and Social Security numbers.","supporting_quote":"Blackbaud reported that it conducted an investigation, determined that backup files containing information from its clients had been taken from its network, and an attempt was made to encrypt files to convince Blackbaud to pay a ransom.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2020-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"318965e4994b5854211f9be9e6af887f0b332700","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5cfa3090-8dda-11ec-bb25-234a6ad089e5"},"incident_date":"2020-11-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4173c3295d88","org_name":"Netgain Technology","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/12/09/cloud-hosting-provider-netgain-struck-ransomware-attack/"}],"summary":"Cloud hosting and information technology services provider Netgain Technology Inc. has been struck by a ransomware attack that has forced the company to take some of its data centers offline.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a978ebf18e0b548feb5e794db0811f720fe9cc5f","impact_type":"both","incident_date":"2020-10-11","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Atlas%20Mechanical.pdf"},"notes":null,"org_country":"US","org_id":"66958b506122","org_name":"Atlas Mechanical, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20Atlas%20Mechanical.pdf"}],"summary":"Atlas Mechanical, Inc. experienced a malware incident that made files inaccessible and resulted in unauthorized access to and acquisition of files containing personal and financial information.","supporting_quote":"The investigation determined that the malware was introduced into the system by an unauthorized actor who also accessed and acquired certain files in Atlas’ system.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33b8f55a0337d72492027a319c38434cdedf8b65","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bad2cd90-e4ab-11eb-8ef6-fbb8d39928b9"},"incident_date":"2020-11-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11c78986d002","org_name":"Wright Global Graphics","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bedtimesmagazine.com/2021/04/how-wright-global-graphics-handled-a-data-breach/"}],"summary":"Wright Global Graphics experiences a ransomware attack that started from a phishing email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ac4c823fb939524f1bb7fbf86d59830a1e2cd5e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Merchant%20One%20Inc%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"915836359c82","org_name":"Merchant One, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196442"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Merchant%20One%20Inc%20Breach%20Letter.pdf"}],"summary":"Merchant One reported that an unknown individual may have accessed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a3b4de591bf1b6e1e3ee1debb40acad1a4a1fe1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"adbd09c0-3bfb-11ec-963f-f964320be408"},"incident_date":"2020-11-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"dd52a67bb2e6","org_name":"IIMJobs","org_type":"other","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/indian-job-portal-iimjobs-hacked-database-leaked/"}],"summary":"According to Alexa traffic analysis, IIMJobs is among the top 700 visited websites in India. Another day, another Indian job site targeted by hackers. This time, the database of Indian job board IIMJobs was leaked on a prominent hacking forum after the website suffered a data bre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-21","discovered_date":"2020-09-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"605ae990f65d0f5e8acf85ddb32b945337243e96","impact_type":"unknown","incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8cadb3500a36","org_name":"First Sonora Bancshares, Inc. (\"Sonora Bank\")","org_type":"unknown","ransomware":null,"records_affected":10551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#First%20Sonora%20Bancshares%2C%20Inc.%20%28%22Sonora%20Bank%22%29-2020-11-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8f60fcd0d03fd090f58ef97c1cadc3fc48d180e","impact_type":"disruption_or_ransomware","incident_date":"2020-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10362.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4c27cc6b7154","org_name":"Senior Operations, LLC","org_type":"manufacturing","ransomware":true,"records_affected":2543,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10362.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10362.pdf"}],"summary":"Senior Operations reported a ransomware attack that led it to shut down its systems, with personal, medical, and financial information potentially accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb044cff5cf9d243cb579de4593f5275843bc35","impact_type":"data_theft","incident_date":"2020-09-29","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/River%20City%20-%20California%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"c3dbc2861f50","org_name":"River City Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Bank employee exceeded their authorized access and sent customer data to a third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196385"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/River%20City%20-%20California%20Notice.pdf"}],"summary":"A River City Bank employee downloaded customer data to a personal storage drive and sent it to a third party.","supporting_quote":"In doing so, the employee exceeded their authorized access, which was limited to accessing the Bank’s data for legitimate bank purposes.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-20","discovered_date":"2020-11-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f702a935f86c8424e5ef4f2853877ffab14a98e7","impact_type":"unknown","incident_date":"2020-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24245a220892","org_name":"Next Adventure","org_type":"unknown","ransomware":null,"records_affected":15117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Next%20Adventure-2020-11-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c275bd7d361fcfdd13ae65f12b55e0a4616abb9e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Indian%20Health%20Council%20Inc.pdf"},"notes":null,"org_country":"US","org_id":"564882740157","org_name":"Indian Health Council Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Indian%20Health%20Council%20Inc.pdf"}],"summary":"Indian Health Council Inc. reported that an unauthorized actor may have accessed files containing personal and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-11-20","discovered_date":"2021-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e030a70407e66c452c7784b1130951dac0b23af3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GGRC%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"41668b38fe45","org_name":"Golden Gate Regional Center","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539079"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GGRC%20-%20Notice.pdf"}],"summary":"Golden Gate Regional Center detected unusual activity consistent with a ransomware incident, and later discovered that some personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d189ec3ecba1024865669e57fe3f81d0ea9cf85","impact_type":"data_theft","incident_date":"2020-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"ac6dc460653d","org_name":"Cit0day","org_type":"unknown","ransomware":null,"records_affected":226883414,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cit0day","type":"hibp","url":"https://haveibeenpwned.com/Breach/Cit0day"}],"summary":"In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums . The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-11-19","discovered_date":"2020-10-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d8234f86c4277758706293f2b23cfb3c7f918a9","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2020-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Backroads%20-%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"b1cff690acf2","org_name":"Backroads","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-538388"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196345"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Backroads%20-%20Notice.pdf"}],"summary":"Backroads reported that files were encrypted and inaccessible, and that personal information in certain files may have been accessible to unknown actors.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2020-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f03c3d4e3b6cf5f2aa0f7e89520ead475812032c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Windstream%20Sample%20Notices_2.pdf"},"notes":null,"org_country":"US","org_id":"15badb2d1e3f","org_name":"Windstream Holdings II, LLC","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196297"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Windstream%20Sample%20Notices_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10361.pdf"}],"summary":"An unauthorized party accessed Windstream internal systems between July 11 and August 23, 2020, and may have obtained internal information that included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a47dd599d6f26e30de1bd51d8f1593c2abc0f76","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ICP%20_Notice%20of%20Data%20Security%20Incident%20Template.pdf"},"notes":"attack_techniques without supporting words dropped: T1657","org_country":"US","org_id":"10f4715f596a","org_name":"International Cosmetics & Perfumes","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196261"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ICP%20_Notice%20of%20Data%20Security%20Incident%20Template.pdf"}],"summary":"International Cosmetics & Perfumes reported that employee email accounts were affected by a business email compromise attack, with possible access to personal information and an attempt to divert funds.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc4b2c3f7a266e4f91408cea5d301ee3d7e5774f","impact_type":"data_theft","imported_from":null,"incident_date":"2020-03-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2d6f01b7582a","org_name":"123RF","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 123RF","type":"hibp","url":"https://haveibeenpwned.com/Breach/123RF"}],"summary":"123RF experienced a data breach in March 2020 that exposed subscriber information, including password hashes, and was later sold online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d06628f450a87cf0e6e3c80db1a7fdb997f5307","impact_type":"both","incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cyberincident_notification%20letter_SAMPLE_1.pdf"},"notes":null,"org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California San Francisco","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196123"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cyberincident_notification%20letter_SAMPLE_1.pdf"}],"summary":"UCSF reported that an attacker obtained files and encrypted others with ransomware in a limited part of the School of Medicine’s IT environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa5d706ef35ec904652e5db276fd8a82e99d5857","impact_type":"data_theft","imported_from":null,"incident_date":"2020-02-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"355035e4aaf7","org_name":"Home Chef","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Home Chef","type":"hibp","url":"https://haveibeenpwned.com/Breach/HomeChef"}],"summary":"Home Chef customer information, including personal details, partial credit card data, and bcrypt-hashed passwords, was exposed in a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d84ba4f976eff90478bf4614538af10e11fd035","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-21","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notices.pdf"},"notes":null,"org_country":"US","org_id":"f266a1e34fc1","org_name":"1919 Investment Counsel LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notices.pdf"}],"summary":"1919 Investment Counsel reported unauthorized access to its computer systems, with no indication that information was accessed or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28359dd76d6d9a18027ae15497a530fa2110d657","impact_type":"unknown","incident_date":"2020-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Hutchison%20Breach%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"167bbdba721c","org_name":"Hutchison School","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196065"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"422f22685e18183042bc29e159463c0803c4b3dd","impact_type":"data_theft","imported_from":null,"incident_date":"2020-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b083af1a804f","org_name":"Animal Jam","org_type":"technology_saas","ransomware":null,"records_affected":46000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Animal Jam","type":"hibp","url":"https://haveibeenpwned.com/Breach/AnimalJam"}],"summary":"Animal Jam suffered a data breach affecting 46 million user accounts, exposing personal information and hashed passwords.","supporting_quote":null,"technology_involved":["Animal Jam"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3631f601676a73ac8132e991429de8975e78196d","impact_type":"data_theft","incident_date":"2020-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Barrister%20-%20Consumer%20Notification%20Letter%20%28CA%29%204851-2741-7808%20v.2%20%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"43be20864724","org_name":"BarristerBooks, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196050"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Barrister%20-%20Consumer%20Notification%20Letter%20%28CA%29%204851-2741-7808%20v.2%20%20%281%29.pdf"}],"summary":"BarristerBooks reported that an unknown party may have obtained customers’ names and payment card information entered through its websites.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e19ce745d384450b8202f02fc8b9f9e52752269","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2f4f9cf23ae3","org_name":"Mashable","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mashable","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mashable"}],"summary":"A breach of Mashable data surfaced publicly in November 2020, exposing email addresses and other personal information, along with expired authentication tokens.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f682a4789cda6b7b7cfb5ecb1e84b00596ddcd7c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f338cf10e811","org_name":"Lazada RedMart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lazada RedMart","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lazada"}],"summary":"Lazada RedMart customer data, including personal details, partial credit card data and hashed passwords, was sold via an online marketplace.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cf8cd00a646bc43c1c36fa2632ee64ed6aed0d7","impact_type":"unknown","incident_date":"2020-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Client%20Breach%20Notification%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fdbeaf55f729","org_name":"Cantella & Co., Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195984"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-09","discovered_date":"2020-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3923c422b3102bb27d9111138cd8e4f9d197348a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AB279_v01.pdf"},"notes":null,"org_country":"US","org_id":"07983445ed89","org_name":"San Dieguito Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195974"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AB279_v01.pdf"}],"summary":"San Dieguito Union High School District reported unauthorized access to an Aeries database from April 2019 to January 2020, but investigators could not confirm whether information was viewed.","supporting_quote":null,"technology_involved":["Aeries database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43f93e2a2a56cb82939d08615e447e5d0654648a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61a62450-10c6-11ec-ac2c-abfc822846a5"},"incident_date":"2020-11-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"404e44dd63fc","org_name":"Cedar Springs Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/cedar-springs-hospital--notice-of-data-incident-301189953.html"}],"summary":"Cedar Springs Hospital experienced a breach when they lost a harddrive full of patient data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-06","discovered_date":"2020-08-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"861d5a3b3a5062dc2229c7555c3066eb773cfe9b","impact_type":"disruption_or_ransomware","incident_date":"2019-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Camrosa%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"3e4ddf05f5b9","org_name":"Camrosa Water District","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195916"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Camrosa%20-%20California%20Notification.pdf"}],"summary":"Camrosa Water District reported that a cyberattack encrypted data on certain devices and involved unauthorized access to files on its file servers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f022615c996d01f03de839ab3a5a79b1b087d78","impact_type":"unknown","incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Redacted%20%289205840x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a21ee4287282","org_name":"Bruce L. Boros, M.D., P.A. DBA Advanced Urgent Care","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195918"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-06","discovered_date":"2020-10-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10866abdd06ab1c93ce9d6beb8e710d913a4a79e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01%20-%20DB23635%20-%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An error while updating the Medicare Advantage HMO provider directories caused Social Security numbers to display as provider identification numbers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195911"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01%20-%20DB23635%20-%20Notification%20Letter.pdf"}],"summary":"Blue Shield of California's provider directories displayed members' Social Security numbers as provider identification numbers after an update error.","supporting_quote":"This error caused your Social Security Number to display as your provider identification number in the provider directories.","technology_involved":["PDF provider directories","website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Arvato"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"069f6aa68d06","name":"Arvato"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eccc83a291bbde3199a41e45b0cb5db3e6f2f2a8","impact_type":"unknown","incident_date":"2020-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/VF%20Outdoor%20-%20Sample%20Notice%20%28CA%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7855daeec2cc","org_name":"VF Outdoor, LLC doing business as The North Face®","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195859"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#VF%20Outdoor%2C%20LLC%20doing%20business%20as%20The%20North%20Face%C2%AE-2020-11-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1110"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-05","discovered_date":"2020-10-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"468ab7b1abffb041198e28751889933dd3f4b89b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10358.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8439f2c883a4","org_name":"VF Outdoor, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":366,"reviewed":false,"root_cause":"The attacker used email and password credentials obtained from another source to access accounts on thenorthface.com.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10358.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10358.pdf"}],"summary":"VF Outdoor, LLC reported that an attacker used credentials obtained elsewhere in a credential-stuffing attack to access customer accounts on thenorthface.com.","supporting_quote":"Based on our investigation, we believe that the attacker previously gained access to your email address and password from another source (not from The North Face) and subsequently used those same credentials to access your account on thenorthface.com.","technology_involved":["thenorthface.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97bf1bff6a26fb9f35fd6916dd710a1affa67df7","impact_type":"data_theft","imported_from":null,"incident_date":"2020-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"083e5b0d889b","org_name":"James","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: James","type":"hibp","url":"https://haveibeenpwned.com/Breach/James"}],"summary":"A March 2020 breach at James exposed email addresses, customer locations, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"91b1b5ad106d22bf2b39287a69d1ce57c1afb98e","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10355.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"588ec87aeb20","org_name":"Green America","org_type":"nonprofit","ransomware":true,"records_affected":1127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10355.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10355.pdf"}],"summary":"Green America notified affected people that personal information may have been involved in a ransomware incident at Blackbaud, where customer data was apparently exfiltrated.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-05","discovered_date":"2020-09-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59a3ec16427bd389318551d91dd897dd0106b7bf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0180d9987828","org_name":"Baker Tax & Accounting PC","org_type":"unknown","ransomware":null,"records_affected":962,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baker%20Tax%20%26%20Accounting%20PC-2020-11-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-04","discovered_date":"2020-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1063309396eb35fd339cb971698c2d16e03a63fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Woodland%20Joint%20USD%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"36b4f7eeb41f","org_name":"Woodland Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195840"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Woodland%20Joint%20USD%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"Woodland Unified School District reported that personal information in its Aeries Student Information System was potentially subject to unauthorized access.","supporting_quote":null,"technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aeries Software, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2afdd4074270b90fbb0d95e0082fd284f6dd9e4","impact_type":"data_theft","incident_date":"2020-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a9e5e9a4303b","org_name":"Wongnai","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wongnai","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wongnai"}],"summary":"Wongnai customer records, including personal information and MD5-hashed passwords, were exposed in a breach during 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-11-04","discovered_date":"2020-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da7ebe1d98a2296a92a62498947656aa1aa1426a","impact_type":"both","incident_date":"2020-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Letter%20%28DWT%20final%2010.20.2020%29.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"8d2ad23df478","org_name":"Methodist Hospital of Southern California","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Letter%20%28DWT%20final%2010.20.2020%29.pdf"}],"summary":"A ransomware attack on Blackbaud’s system copied a backup file containing some Methodist Hospital of Southern California patient information.","supporting_quote":"On September 9, 2020, we were notified by the Foundation that Blackbaud discovered and stopped a ransomware attack that included the Foundation’s donor database, as well as those of many other nonprofit organizations.","technology_involved":["Blackbaud","donor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-04","discovered_date":"2020-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3131293193af290376db30a8adba56e24e0b2d47","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amtrak%20AGR%20Member%20Notification%20Letter_11.4.DF_.pdf"},"notes":null,"org_country":"US","org_id":"3aae7798f2bf","org_name":"Amtrak","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195848"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amtrak%20AGR%20Member%20Notification%20Letter_11.4.DF_.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10354.pdf"}],"summary":"Amtrak reported unauthorized access to certain Guest Rewards accounts using compromised usernames and passwords, with some personal information potentially viewed.","supporting_quote":"We have determined that compromised usernames and passwords were used to access certain accounts and some personal information may have been viewed.","technology_involved":["Amtrak Guest Rewards"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-11-03","discovered_date":"2020-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b5da21fb8458716947ce125cbab10e569858c6b","impact_type":"disruption_or_ransomware","incident_date":"2020-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F9031_The%20GEO%20Group%20Inc_L01_SAS_2.pdf"},"notes":null,"org_country":"US","org_id":"39c335748f38","org_name":"The GEO Group","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F9031_The%20GEO%20Group%20Inc_L01_SAS_2.pdf"}],"summary":"The GEO Group discovered a ransomware attack in which an unauthorized actor accessed its network, and the incident may have affected personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-03","discovered_date":"2020-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d50c3da0a3344cf2fb656071f0303019d49a6dd6","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REDACTED.%20Stetson%20-%20BLACKBAUD-%20Notification%20Letter%20-%20SSN%20%289138807x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"2a1e66c81535","org_name":"Stetson University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195773"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REDACTED.%20Stetson%20-%20BLACKBAUD-%20Notification%20Letter%20-%20SSN%20%289138807x7AB84%29.pdf"}],"summary":"Stetson University reported that a cybercriminal removed a backup file containing information from Blackbaud systems during a ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9159082d79d3600326e18b55e9ebc740ed8e55e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2b460f4b2aff","org_name":"Minted","org_type":"retail_ecommerce","ransomware":null,"records_affected":4418182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Minted","type":"hibp","url":"https://haveibeenpwned.com/Breach/Minted"}],"summary":"Minted customer records, including personal information and bcrypt-hashed passwords, were exposed and later sold on a dark web marketplace.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b362e3b299b99445c7cc5424ad581059373fb8f3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AscindClinical.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a559007e0b8a","org_name":"Ascind Clinical LLC","org_type":"unknown","ransomware":null,"records_affected":514,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AscindClinical.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2020-11-02","discovered_date":"2020-08-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42c6de05c50dbb0b9a771d1e67f723ef24de16cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_10.pdf"},"notes":null,"org_country":"US","org_id":"3c0eb474d01b","org_name":"Imperial Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195734"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_10.pdf"}],"summary":"An unknown source compromised an employee’s administrative account at Imperial Community College District, potentially accessing personal information.","supporting_quote":"Following progress by experts in their thorough investigation, it was ultimately determined that, on August 5, 2020, the administrative account of one employee was hacked and compromised by an unknown source, which allowed unauthorized access onto ICCD’s computer network.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-11-02","discovered_date":"2020-06-05","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859c070751df337994e8554648aa4c941c3a393a","impact_type":"data_theft","incident_date":"2020-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Health%20Formula%20%20-%20Consumer%20Notification%20%28CA%20Version%29%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"2f9a5b342839","org_name":"Health Formula Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195772"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Health%20Formula%20%20-%20Consumer%20Notification%20%28CA%20Version%29%20Proof.pdf"}],"summary":"Health Formula Inc. reported that payment card information was acquired without authorization from its website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c79fb67c902ffd982cf8326f66d660762776c547","impact_type":"data_theft","imported_from":null,"incident_date":"2019-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ES","org_id":"3e50c16e5a48","org_name":"Promofarma","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Promofarma","type":"hibp","url":"https://haveibeenpwned.com/Breach/Promofarma"}],"summary":"Customer email addresses and names from Promofarma appeared for sale on a dark web marketplace.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc2a7d5f00fd11d8ce51c184f5ecec43a866d213","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6aedb5f0-05d1-11ec-a755-057d35a918cc"},"incident_date":"2020-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9df4a27b8fa4","org_name":"DeFi","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fxstreet.com/cryptocurrencies/news/nearly-20-million-stolen-from-the-defi-protocol-pickle-finance-202011221250"}],"summary":"Nearly $20 million stolen from the DeFi protocol Pickle Finance","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a0b19d832dcf77820ba8f412e8bdffdbe06c2fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8a50420-0cbe-11ec-a2d0-f3cc343be99c"},"incident_date":"2020-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d23d275f4e15","org_name":"Bumble","org_type":"other","ransomware":null,"records_affected":100000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/dating-site-bumble-swipes-unsecured-100m-users/161276/"}],"summary":"Dating Site Bumble Leaves Swipes Unsecured for 100M Users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"744eed11ef7137f538273f013b3371fe18720701","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c74e8f00-2d9a-11eb-8132-47626699b560"},"incident_date":"2020-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6827514e3be","org_name":"Americold","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/https://www.databreaches.net/cold-storage-giant-americold-hit-by-cyberattack-services-impacted/"}],"summary":"Americold got hit by a ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de4bf177abf5d9c6e245496b085847e4e496c4b7","impact_type":"data_theft","imported_from":null,"incident_date":"2019-10-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"73b5e277816b","org_name":"StarTribune","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: StarTribune","type":"hibp","url":"https://haveibeenpwned.com/Breach/StarTribune"}],"summary":"A StarTribune data breach exposed email addresses and other personal information, including bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dfa7e3734ee37e1777e2345686a7e2fe4d18394","impact_type":"unknown","incident_date":"2020-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SiteOne%20-%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ed04f0b1df33","org_name":"SiteOne Landscape Supply, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195729"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SiteOne%20-%20California%20Notice.pdf"}],"summary":"SiteOne Landscape Supply filed a California consumer notification concerning a security incident, but the provided text does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43cc94125c61ddc5b2c7367be337d6b4b36684cd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65c29ab0-1ae8-11ec-8477-47d0f236e203"},"incident_date":"2020-10-30","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"cf873ac1c17b","org_name":"Saskatchewan Polytechnic","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.moosejawtoday.com/local-news/cybersecurity-attack-on-sask-polytech-suspends-classes-until-wednesday-2842618"}],"summary":"Cybersecurity attack on Sask Polytech suspends classes until Wednesday - Saskatchewan Polytechnic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-30","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b40c10a4737bcf8890c6a82b55cd0d14f09a24f2","impact_type":"unknown","incident_date":"2020-05-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0dd59f15e367","org_name":"Ride Connection, Inc.","org_type":"unknown","ransomware":null,"records_affected":293,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ride%20Connection%2C%20Inc.-2020-10-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-30","discovered_date":"2020-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19e502c09a730d70ec983cfdb7001e37427defae","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20%28LATS%29_0.pdf"},"notes":null,"org_country":"US","org_id":"21e880dbdbd9","org_name":"L.A. Tax Service, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195726"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20%28LATS%29_0.pdf"}],"summary":"L.A. Tax Service said clients’ tax returns were potentially exposed to an unauthorized third party in June and September 2020, and some returns were fraudulently filed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"508e84db6d0f26716c4a1ec35547f598a573bcad","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-05-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1af1f56ef857","org_name":"Reincubate","org_type":"technology_saas","ransomware":null,"records_affected":616146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Reincubate","type":"hibp","url":"https://haveibeenpwned.com/Breach/Reincubate"}],"summary":"A breach exposed a Reincubate backup containing email addresses, names and passwords stored as PBKDF2 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6647b9b6ee5b038fdf5c541a82040b4da60ef585","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f95e05d0-22d1-11eb-b221-a300329fb9cf"},"incident_date":"2020-10-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"c16c54873409","org_name":"RedMart","org_type":"retail_ecommerce","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/lazada-confirms-1-1m-accounts-compromised-in-redmart-security-breach/,https://www.businesstimes.com.sg/consumer/personal-information-of-11-million-redmart-accounts-stolen-in-lazada-data-breach"}],"summary":"database found vulnerable (but unclear to what) and individual claims to be in possession of the data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4586a82fb235fa09867d8d3d666a632f59b3deb9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RCHSD-Blackbaud%20-%20Notification%20Letter%20%28Adult%20Identity%20Monitoring%20with%20Spanish%20Translation%29.pdf"},"notes":null,"org_country":"US","org_id":"f787bef51844","org_name":"Rady Children’s Hospital – San Diego and Rady Children’s Hospital Foundation – San Diego","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RCHSD-Blackbaud%20-%20Notification%20Letter%20%28Adult%20Identity%20Monitoring%20with%20Spanish%20Translation%29.pdf"}],"summary":"An unauthorized party accessed Blackbaud backup files containing some Rady Children’s Hospital and Foundation personal information.","supporting_quote":"According to Blackbaud, between February 7, 2020 and June 4, 2020, an unauthorized party had access to backup files related to the Blackbaud fundraising and donor management software we use.","technology_involved":["Blackbaud fundraising and donor management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2020-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"45c80b39ad3d605ce9961f8dafeb6333b496bc09","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10353.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f7e4c7863d10","org_name":"MK Periodontics and Implants","org_type":"unknown","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10353.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-29","discovered_date":"2020-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3cac62dfa72f962ae243c547da84c7a567cd833b","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10352.pdf"},"notes":null,"org_country":"US","org_id":"167bbdba721c","org_name":"Hutchison School","org_type":"education","ransomware":true,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10352.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10352.pdf"}],"summary":"Cybercriminals copied Hutchison School data from Blackbaud's system during an extortion incident involving the vendor.","supporting_quote":"Prior to locking the cybercriminal out, the cybercriminal removed a copy of a subset of data from Blackbaud's system.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-29","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0beeb976d92473b60db3518f2d6a2232896d47e6","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10351.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9e8087844455","org_name":"Feed the Children","org_type":"nonprofit","ransomware":true,"records_affected":21257,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10351.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10351.pdf"}],"summary":"Feed the Children reported that data about donors and other contacts was copied during a ransomware attack on its service provider, Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b4233a2033769ce54c51b64f41268e314605e45","impact_type":"both","incident_date":"2020-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian%20Letter%202020.pdf"},"notes":null,"org_country":"US","org_id":"9032a6da5c8a","org_name":"CCPOA Benefit Trust Fund","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian%20Letter%202020.pdf"}],"summary":"The CCPOA Benefit Trust Fund reported a ransomware attack in which personally identifiable information was obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-28","discovered_date":"2020-07-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"307f882d6203127c0669b50aaeb758e81dbd1f26","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JMB-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"ef4197f9fe97","org_name":"JM Bullion, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195631"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JMB-%20Notice%20of%20Data%20Event.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JM%20Bullion%2C%20Inc.-2020-10-28"}],"summary":"Malicious code on JM Bullion’s website could capture customer names, addresses, and payment card information during some purchases.","supporting_quote":null,"technology_involved":["JM Bullion website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d08dd07ca15ab22c36350fe745eee31ad6032099","impact_type":"unknown","incident_date":"2020-08-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10348.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"720d8a6a65af","org_name":"Luxottica of America Inc.","org_type":"healthcare","ransomware":null,"records_affected":12166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10348.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Luxottica%20of%20America%20Inc-2020-12-02"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10348.pdf"}],"summary":"An automated attack used an account to make requests to Luxottica's appointment scheduling application, potentially accessing personal and medical information.","supporting_quote":"On August 9, 2020, an automated attack was carried out against the Luxottica appointment scheduling application using an account that was created on August 5, 2020.","technology_involved":["Luxottica appointment scheduling application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-27","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aeaa78ea166c115de2ed9a949ebac5d5acdb5e3","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LBBC%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"16c6596825ca","org_name":"Living Beyond Breast Cancer","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195576"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LBBC%20-%20California%20Notification.pdf"}],"summary":"Living Beyond Breast Cancer reported that backup files held by Blackbaud were taken in a ransomware incident and contained names and breast cancer diagnosis information.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5087370cab2f464cc76cc72e15105f6ea5e72cc6","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20to%20be%20sent%20to%20AG%20with%20Credit%20Monitoring.pdf"},"notes":null,"org_country":"US","org_id":"76bcfd07c491","org_name":"Athenian School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195583"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20to%20be%20sent%20to%20AG%20with%20Credit%20Monitoring.pdf"}],"summary":"Cybercriminals accessed Blackbaud’s system, removed a backup copy containing Athenian School personal information, and received a ransomware payment.","supporting_quote":"According to Blackbaud, cybercriminals gained access to their system as part of a ransomware attack sometime between February 7, 2020 and May 20, 2020.","technology_involved":["Blackbaud software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-26","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e67adb622f5c5343b9fc3d44737da6d29c3c3722","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tailored%20Brands%20Ad%20CM%20Variable%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"262d493bdba3","org_name":"Tailored Brands","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195543"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tailored%20Brands%20Ad%20CM%20Variable%20CA%20r1prf.pdf"}],"summary":"Tailored Brands reported that an unauthorized individual accessed employee email accounts after a phishing incident, but the investigation could not determine which emails or attachments may have been accessed.","supporting_quote":"We recently concluded our investigation into an email phishing incident that targeted some of our employees.","technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-26","discovered_date":"2020-05-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7965e5b338928a596afe64bc5089ff98cd7f5928","impact_type":"both","incident_date":"2020-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Additional%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"19bdd73ca50f","org_name":"Ascend Clinical LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195527"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Additional%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ascend%20Clinical%20LLC-2020-10-27"}],"summary":"Ascend Clinical reported that an unauthorized user accessed and downloaded business records containing patients’ personal and health information, while some Ascend data had become encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c19f3e3f48999c0d8252ce168149d7184952330f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alcorn%20-%20Consumer%20Notification%20Letter%20V2%20Print%20Proof_1.pdf"},"notes":null,"org_country":"US","org_id":"4e2e6c7523bf","org_name":"Alcorn Fence Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195547"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alcorn%20-%20Consumer%20Notification%20Letter%20V2%20Print%20Proof_1.pdf"}],"summary":"Unauthorized access to an Alcorn employee email account may have exposed personal information, including names.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4899bca25f8462f4797b24b7c9fbc1486fdaa9e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10346.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89cb0a6c2d63","org_name":"Hi-Line Ranch, Harris Farms, Cherry River Farms","org_type":"unknown","ransomware":null,"records_affected":852,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10346.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-10-23","discovered_date":"2020-09-23","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9e858bfbeb999635b9ff93e80fc607b4b69078","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Standard%20for%20Cal.pdf"},"notes":null,"org_country":"US","org_id":"586a6362e161","org_name":"UAMG, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Standard%20for%20Cal.pdf"}],"summary":"An unauthorized entity accessed an individual’s email account, which contained personal, financial, and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-23","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75c26dab71724174a870ff14ae4b2e22baa35b40","impact_type":"disruption_or_ransomware","incident_date":"2020-08-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trinity%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"16deec0cd0a2","org_name":"Trinity Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trinity%20Breach.pdf"}],"summary":"Trinity Health’s donor database backup files maintained by Blackbaud were impacted by a cyberattack involving ransomware.","supporting_quote":null,"technology_involved":["Blackbaud","donor database backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-23","discovered_date":"2020-07-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9bafaeeb265fd7aaec003fbf8f8048c29c4cc5c2","impact_type":"unknown","incident_date":"2020-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e70313369543","org_name":"Hacker Architects","org_type":"unknown","ransomware":null,"records_affected":416,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hacker%20Architects-2020-10-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bf9f62976dbcadebc0fc1c620a39677cd50d45a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FDBL%20-%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"ea76dbc44cde","org_name":"Fragomen, Del Rey, Bernsen & Loewy, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195495"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FDBL%20-%20California%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10840.pdf"}],"summary":"An unauthorized third party accessed a file containing personal information relating to employment verification services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-22","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"995d2abf7033cb6033280edceed1756b52c6fb87","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10345.pdf"},"notes":null,"org_country":"US","org_id":"6c1a82db9589","org_name":"University of Nevada, Las Vegas Foundation","org_type":"education","ransomware":null,"records_affected":2563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10345.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10345.pdf"}],"summary":"The University of Nevada, Las Vegas Foundation reported that personal information stored on Blackbaud systems may have been accessed during a cyber incident.","supporting_quote":null,"technology_involved":["Blackbaud systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b2336a76b839c7068fe1361d035967cf1c09f2b","impact_type":"unknown","incident_date":"2020-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc95ab3cd7bc","org_name":"Alameda Health System","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195465"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-21","discovered_date":"2020-09-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f20840532fce020ecd732507dacb7a3c42a56b8d","impact_type":"unknown","incident_date":"2020-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"77dede0670df","org_name":"Sam's West, Inc.","org_type":"unknown","ransomware":null,"records_affected":285885,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sam%27s%20West%2C%20Inc.%20dba%20Sam%27s%20Club-2020-10-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e364aa0341e021f4435793bc704714be85a79de4","impact_type":"unknown","incident_date":"2020-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sams%20Club%20-%20Individual%20Notification%20Letter%20Template.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62f6004d7d6e","org_name":"Sam's Club","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195405"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10344.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-21","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c6ddaa9adeace696b1f5f0e4eb7c34eb8b704b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10343.pdf"},"notes":null,"org_country":"US","org_id":"75d49d967f41","org_name":"Carroll College","org_type":"education","ransomware":true,"records_affected":2166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10343.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10343.pdf"}],"summary":"Carroll College reported that personal information stored with Blackbaud may have been accessed or acquired during Blackbaud’s ransomware incident.","supporting_quote":"Following its investigation, Blackbaud notified its customers that an unknown actor may have accessed or acquired certain Blackbaud customer data.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebcc9263953e5027294814cf727deb05dde5edc4","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20breach%20-%20School%20Messenger_1.pdf"},"notes":null,"org_country":"US","org_id":"685ae042138d","org_name":"Mount Diablo Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A coding error in the SchoolMessenger application caused it to disclose other parents’ and students’ contact information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195323"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20breach%20-%20School%20Messenger_1.pdf"}],"summary":"Mount Diablo Unified School District reported that a coding error in the SchoolMessenger application disclosed parents’ and students’ contact information to other parents using the app.","supporting_quote":"Intrado has notified the District that due to their coding error, the SchoolMessenger application randomly disclosed other parent’s and student’s contact information (names, email, and phone numbers) to parents accessing their application.","technology_involved":["SchoolMessenger mobile application"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Intrado"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"6b70a859fa33","name":"Intrado"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"506151d39f36f0b0accce4694fca16d49652b66d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6db809f0-3cce-11ec-b63a-33c287a8ec4a"},"incident_date":"2020-10-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b58363659756","org_name":"Société de transport de Montréal","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/montreals-stm-public-transport-system-hit-by-ransomware-attack/"}],"summary":"Montreal's STM public transport system hit by ransomware attack - Société de transport de Montréal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-18","discovered_date":"2020-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b84d7cce75886cb7bb74a7e9f55c0713757568b","impact_type":"data_theft","incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F8736_City%20of%20Torrance%20%232_L01_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"8aa6069ab4be","org_name":"City of Torrance","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195232"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F8736_City%20of%20Torrance%20%232_L01_SAS_PROOF.pdf"}],"summary":"The City of Torrance reported a cybersecurity incident in which some data was taken and later found accessible on the internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f7f73b45291f8f38ea36675a32d6be1c6effe3d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WCM-Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"33fe05d575cd","org_name":"Wyndham Capital Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195226"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WCM-Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wyndham%20Capital%20Mortgage%2C%20Inc.-2020-10-16"}],"summary":"Wyndham Capital Mortgage accidentally emailed an account outside the organization a message containing personal information and loan data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-16","discovered_date":"2020-09-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"925c7022ea76859e3bf885bcf3198194f504ca76","impact_type":"unknown","incident_date":"2020-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"95a0cf9d4a5e","org_name":"United Healthcare","org_type":"unknown","ransomware":null,"records_affected":308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#United%20Healthcare-2020-10-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-16","discovered_date":"2020-08-31","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b48cedeb9e8bdfd7dfe6271ee39c8af46915a14e","impact_type":"data_theft","incident_date":"2020-08-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10341.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"051fdccd047b","org_name":"The Health & Wellness Clinic","org_type":"healthcare","ransomware":null,"records_affected":889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10341.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10341.pdf"}],"summary":"Intruders broke into the clinic’s storage room and stole a box of patient records, which police later recovered.","supporting_quote":"Unfortunately, it appears that over the weekend of August 29 -30, 2020, intruder(s) jumped the fence, broke the door, and entered the storage room.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-15","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"779564d4d3c20c1100fb9639ad312302aa6797d5","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10340.pdf"},"notes":null,"org_country":"US","org_id":"0cbe4bafbb79","org_name":"University of Nevada, Reno","org_type":"education","ransomware":null,"records_affected":3361,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10340.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10340.pdf"}],"summary":"The University of Nevada, Reno reported that personal information may have been present in Blackbaud systems accessed during a cyber incident.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44a2aeea4fd3698152aacae5836f6016f9729491","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20-%20CARD%20%28patients%29_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"0b5b5c7feb92","org_name":"Center for Autism and Related Disorders","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20-%20CARD%20%28patients%29_PROOF.pdf"}],"summary":"The Center for Autism and Related Disorders reported a data security incident that may have affected files containing limited patient health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0ec9d4d0305eb7e19ca34e86eba5bc92a0f2c94","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AIC%20-%20Consumer%20Notification%20%28CA%20Version%29_PROOF%20V2.pdf"},"notes":null,"org_country":"US","org_id":"c7c9dfc623c1","org_name":"Accident Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195182"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AIC%20-%20Consumer%20Notification%20%28CA%20Version%29_PROOF%20V2.pdf"}],"summary":"Accident Insurance Company reported that unauthorized persons attempted to interfere with its computer system and may have accessed sensitive personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-14","discovered_date":"2020-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49ff58e3cee7b549def6f5371dee92df5ca0c347","impact_type":"both","incident_date":"2020-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/One%20Workplace%20employee%20notification%20letter%28FINAL%29.pdf"},"notes":null,"org_country":"US","org_id":"e45084496272","org_name":"One Workplace","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195141"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/One%20Workplace%20employee%20notification%20letter%28FINAL%29.pdf"}],"summary":"One Workplace reported that an unauthorized individual accessed its network, viewed and removed data, and that the incident involved ransomware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c23d960dde0538dc3606eac345f11d2ffdfebf9","impact_type":"unknown","incident_date":"2020-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20response%201-28-21.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"19235947a55c","org_name":"Made In Oregon","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537596"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195064"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10328.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-13","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4feb249df407b23f05809c8425014c523fb7693c","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10339.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6a8375a032b9","org_name":"Forest Ridge School of the Sacred Heart","org_type":"education","ransomware":null,"records_affected":555,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10339.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10339.pdf"}],"summary":"Forest Ridge reported that personal information stored in its Blackbaud Raiser’s Edge NXT platform may have been viewed or accessible to unauthorized individuals.","supporting_quote":null,"technology_involved":["Blackbaud","Raiser’s Edge NXT"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-13","discovered_date":"2020-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1014b5611b8372eabe637e767367ec8cc464fda","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Carnival-%20US%20Adult%20Guest%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"6e56543b2a58","org_name":"Carnival Corporation and plc","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537788"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carnival-%20US%20Adult%20Guest%20Sample.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carnival%20Corporation%20and%20plc-2020-10-16"}],"summary":"Carnival detected unauthorized access to portions of its information technology systems, and guest, employee, and crew personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-13","discovered_date":"2020-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9d44bc56db9a88ba8a5e05ff8bb09ba70eeb7b2b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10336.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3d56a7bc2932","org_name":"Carnival Corporation & PLC","org_type":"transportation_logistics","ransomware":null,"records_affected":5801,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10336.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/CarnivalCorpOctober.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10336.pdf"}],"summary":"Carnival detected unauthorized third-party access to portions of its information technology systems and said personal information relating to guests, employees, and crew may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-10-12","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6016b97c485ddba78e43ca96f59d2acd1b6ddcbb","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10335.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1933b4405b46","org_name":"ZERO","org_type":"nonprofit","ransomware":true,"records_affected":1139,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10335.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10335.pdf"}],"summary":"A ransomware attack on Blackbaud resulted in the removal of a backup file containing ZERO constituent personal and health-related information.","supporting_quote":"Blackbaud confirmed that, as a result of the incident, a copy of its back-up file that contained ZERO constituent personal information was removed from its system from the individual or group that initiated the ransomware attack.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1077643a01877c813ac4c55f64ae084fd24297ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10334.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d81223599689","org_name":"Evergreen Public Schools","org_type":"unknown","ransomware":null,"records_affected":3585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10334.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-10-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10137f56d358e1ea3b9be3816f10fde176b16938","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39d1a810-8e97-11ec-ab9f-33907697f3a6"},"incident_date":"2020-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03bb62643207","org_name":"Dental Care Alliance","org_type":"healthcare","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/1m-us-dental-patients-impacted-by/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/vendor-to-dental-practices-hacked-1-million-affected-a-15566;"}],"summary":"An American healthcare provider has started notifying more than a million patients that their data may have been exposed as the result of a cyber-attack.  Dental Care Alliance discovered on October 11 that it had been the victim of a hack that began on September 18, 2020. The com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14c61cb092df32c43fac4774a26bf0d3ae502c60","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aa9d2fd0-1d1c-11eb-866e-51f25f42af12"},"incident_date":"2020-10-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d99e7428e56f","org_name":"Seyfarth Shaw Law Firm","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2020/10/law-firm-seyfarth-shaw-hit-by-apparent-ransomware-attack/"}],"summary":"Seyfarth Shaw fell victim to a crippling malware attack over the weekend, the global law firm disclosed earlier this week.  According to an official statement, unauthorized activity was detected by the company’s monitoring systems on Saturday.  “On Saturday, October 10, 2020, Sey","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483b5ae4c2e1dc0b72fbcbd117aa2a2362054db8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c6aecc0-120c-11eb-a3ae-53136ea5d4e6"},"incident_date":"2020-10-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c8e868df52b","org_name":"University of South Carolina School of Law","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abajournal.com/news/article/law-school-dean-devastated-about-flubbed-email-with-bar-exam-grades"}],"summary":"University of South Carolina School of Law dean accidentally emailed students with a file attached containing all student's score on the bar exam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566","T1567"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-09","discovered_date":"2020-09-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6df551c2ee383325e902e90087be6f92ebb644dd","impact_type":"data_theft","incident_date":"2020-09-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach_redacted%20enrollment%20code.pdf"},"notes":null,"org_country":"US","org_id":"18050d607f05","org_name":"Terminix Global Holdings","org_type":"other","ransomware":null,"records_affected":14708,"reviewed":false,"root_cause":"A teammate responded to a phishing scam, allowing hackers to access their Office 365 account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194953"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach_redacted%20enrollment%20code.pdf"}],"summary":"Hackers accessed a Terminix teammate’s Office 365 account after a phishing scam and auto-forwarded emails containing personal and financial information.","supporting_quote":"On September 16th, the company discovered that a teammate had responded to a phishing scam, which allowed hackers to gain access to the teammate’s Office 365 account and cause the teammate’s emails to be auto-forwarded from the teammate’s inbox to an external email account controlled by the hackers.","technology_involved":["Office 365","email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dc9e2353e0d57c24112d02a200fd5aaa832f41f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"598a5f00-1aeb-11ec-8477-47d0f236e203"},"incident_date":"2020-10-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cec51e59c208","org_name":"Sonoma Valley Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/svh-notifies-67k-patients-of-data/"}],"summary":"Ransomware Incident Drives Sonoma Valley Hospital to EHR Downtime","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-09","discovered_date":"2020-08-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4224f1f5439eb75e9fd7d4ae3f1c5789f4756489","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AB515_v02.pdf"},"notes":null,"org_country":"US","org_id":"53ed0cc2c42a","org_name":"Keith Fabry","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194952"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AB515_v02.pdf"}],"summary":"An unknown party accessed Keith Fabry’s PDFPlotting.com website, potentially exposing personal and payment card information.","supporting_quote":null,"technology_involved":["PDFPlotting.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-09","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba67ae06f688ac8b0861b5dccea172da2e46f76f","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GSU%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"9969c4c8bbed","org_name":"Georgia Southern University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194984"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GSU%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/GeorgiaSouthernUniversity.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10360.pdf"}],"summary":"Backup files containing Georgia Southern University information were taken from Blackbaud, and an attempt was made to encrypt files to extort a ransom.","supporting_quote":"Blackbaud reported that it conducted an investigation, determined that backup files containing information from its clients had been taken from its network, and an attempt was made to encrypt files to convince Blackbaud to pay a ransom.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2020-10-09","discovered_date":"2020-07-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"21ae243daf37a88a82c55a94b7e9a5f638f90a39","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ExcaliburYouthServices.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7c0c8870db34","org_name":"Excalibur Youth Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":1349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ExcaliburYouthServices.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ExcaliburYouthServices.pdf"}],"summary":"Excalibur Youth Services discovered unauthorized access to its information system, and files containing personal and intake or referral information may have been copied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7ad3f8c1b489aabb1eb486e6f13d364c9c8a0df","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f16254f0-2da1-11eb-8132-47626699b560"},"incident_date":"2020-10-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4665754dd46c","org_name":"Hall County, GA","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/ransomware-knocks-out-voter-database-in-georgia-a-15235"}],"summary":"Hall County GA was impacted by a ransomware attack that prevented them from comparing signatures of voters","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1012e2369cf7232e4c0097909600c7a9711ebd9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f243a2f0-1a1f-11ec-9cee-0b92cf8d85df"},"incident_date":"2020-10-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82b6f411425f","org_name":"Pray.com","org_type":"technology_saas","ransomware":null,"records_affected":10000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/10m-impacted-pray-com-data-exposure/161459/"}],"summary":"10M Impacted in Pray.com Data Exposure ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-06","discovered_date":"2020-09-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f68341a65c2e8c1d7c8852c64e613fe57be8aba7","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10333.pdf"},"notes":null,"org_country":"GB","org_id":"ab9741d20386","org_name":"Gymshark Limited","org_type":"retail_ecommerce","ransomware":null,"records_affected":59769,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10333.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10333.pdf"}],"summary":"Gymshark customers’ personal and partial payment card information was accessed by Shopify contractors.","supporting_quote":"Shopify informed Gymshark that personal information belonging to Gymshark’s customers was accessed in an unauthorized fashion by Philippines-based Shopify contractors.","technology_involved":["Shopify"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Shopify"},"updated_at":"2026-10-12","veris_action":"misuse","derived":{"vendors":[{"id":"263a169d1ef4","name":"Shopify"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b5f5f4238c50ee16a78bcc157c65527a11e97b8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-10-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7585df58258b","org_name":"Chowbus","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chowbus","type":"hibp","url":"https://haveibeenpwned.com/Breach/Chowbus"}],"summary":"Chowbus customer data, including contact details and physical addresses, was exposed in a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03150ea4c44a67eb7fff1873715a3a44d892852f","impact_type":"data_theft","imported_from":null,"incident_date":"2020-07-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"4703166fa6ea","org_name":"WiziShop","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WiziShop","type":"hibp","url":"https://haveibeenpwned.com/Breach/WiziShop"}],"summary":"WiziShop suffered a data breach in July 2020 that exposed personal information and SHA-1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-05","discovered_date":"2020-09-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4840b46a8bf28cf6a6f39f852f171f0d4da4d2ce","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bledshoe.pdf"},"notes":null,"org_country":"US","org_id":"6c3eaaa9d1f3","org_name":"Law Office of Robert T. Bledsoe","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194759"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bledshoe.pdf"}],"summary":"The firm discovered that an account had been accessed by unauthorized individuals and that its server was used to send unauthorized emails.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f2dbdcdc759fd21b1e6bf0a673a8c80679f7e0d","impact_type":"both","incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Incident%20Letter%20on%20letterhead%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"c932598f692d","org_name":"American Symphony Orchestra League","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Incident%20Letter%20on%20letterhead%20FINAL.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Symphony%20Orchestra%20League-2020-10-05"}],"summary":"Blackbaud reported that a cybercriminal removed a backup file containing some American Symphony Orchestra League constituent information during a ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a65c3acdcb9046c6b779c9164f7c92b48e4158","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95138980-0997-11ec-863c-8359987c65e0"},"incident_date":"2020-10-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"ef0d610300dc","org_name":"Software AG","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/"}],"summary":"German tech giant Software AG down after ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-02","discovered_date":"2020-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2d9b1e91fddfe334852b95119da5bda8541578b","impact_type":"data_theft","incident_date":"2020-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SPC%20INDIVIDUAL%20NOTICE%20LETTER%20%20BLANK%20%28Y0188181xBD6FB%29.pdf"},"notes":null,"org_country":"US","org_id":"8ae143d0a938","org_name":"St. Paul Center for Biblical Theology","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194694"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SPC%20INDIVIDUAL%20NOTICE%20LETTER%20%20BLANK%20%28Y0188181xBD6FB%29.pdf"}],"summary":"St. Paul Center for Biblical Theology reported that malware in software used for online purchasing scraped payment card and related personal information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-02","discovered_date":"2020-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"a4700213ff877dbaa999f872fd27836ae7625f49","impact_type":"unknown","incident_date":"2020-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian_F8590_L02_PupBox_CA%20Template.docx_SAS_PROOF_Rev1.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"77251c036517","org_name":"PupBox","org_type":"retail_ecommerce","ransomware":null,"records_affected":30673,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PupBox%2C%20c/o%20Petco%20Animal%20Supplies%20Stores%2C%20Inc.-2020-10-02"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194725"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian_F8590_L02_PupBox_CA%20Template.docx_SAS_PROOF_Rev1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10682.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian_F8590_L02_PupBox_CA%20Template.docx_SAS_PROOF_Rev1.pdf"}],"summary":"PupBox notified customers of a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-02","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"621dcf16de5c4f7821613df8905e2e7471fa0ba7","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10332.pdf"},"notes":null,"org_country":"US","org_id":"8475715b11a3","org_name":"Farm Sanctuary","org_type":"nonprofit","ransomware":true,"records_affected":1065,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10332.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10332.pdf"}],"summary":"Farm Sanctuary reported that a ransomware incident at its cloud provider Blackbaud may have exposed personal information, including names and dates of birth.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9fafb4101a194340f62a303953af7fe8fd1528b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"661000d0-2376-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"345cc7cb098e","org_name":"Nitro PDF maker","org_type":"professional_services","ransomware":null,"records_affected":1800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/nitro-pdf-maker-hit-by-breach-it-says-is-isolated-,-sec-firm-claims-otherwise.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/massive-nitro-data-breach-impacts-microsoft-google-apple-more/"}],"summary":"A massive data breach suffered by the Nitro PDF service impacts many well-known organizations, including Google, Apple, Microsoft, Chase, and Citibank.  Claimed to be used by over 10 thousand business customers and 1.8 million licensed users, Nitro is an application used to creat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47c45701f87de46b3e94ff754f6057938693bfb8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27cd9e80-f6c1-11eb-9352-c36534d585e1"},"incident_date":"2020-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"777afa36312b","org_name":"Isentia","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/isentia-ransomware-attack-expected-to-cost-at-least-7-million-555472"}],"summary":"Isentia, a online monitoring tool was impacted by ransomware costing them up to 7million dollars in immediate costs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"34c06604067b080043fbab606ee2744b964a1e0c","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10331.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9dcefed9acd9","org_name":"Gallaudet University","org_type":"education","ransomware":true,"records_affected":1195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10331.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10331.pdf"}],"summary":"A ransomware attack on donor database provider Blackbaud involved the removal of a backup copy of Gallaudet University donor information.","supporting_quote":"We were notified that our donor database service provider, Blackbaud, Inc., discovered and stopped a ransomware attack that had occurred sometimes in May 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8488914464603547c54f3997ae4b6f9f6e62b807","impact_type":"unknown","incident_date":"2020-09-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/20201001_NOTICE%20OF%20DATA%20BREACH.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e676b598eff0","org_name":"FRIEDMAN & COMPANY CPA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194686"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","personal"],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1ac32f984c6b1faf5c94b163fde0aa685b14634","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"296df8b0-8e7a-11ec-a600-657ec2694f8f"},"incident_date":"2020-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5919017c9112","org_name":"Forex Broker","org_type":"financial","ransomware":null,"records_affected":16000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/forex-leaks-millions-customer/"}],"summary":"Forex Broker leaks billions of records due to misconfigured Elasticsearch server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98f0c03dcb0ca37d504664a26e207f570e3cd517","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3cb621c0-237f-11eb-a2fc-cdee479fbead"},"incident_date":"2020-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96cb96be5b1b","org_name":"Broadvoice","org_type":"technology_saas","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/,https://www.bankinfosecurity.com/sensitive-voicemail-transcripts-exposed-a-15203https://www.techradar.com/news/clone-350-million-customer-details-leaked-in-broadvoice-scandal,https://www.hipaajournal.com/exposed-broadvoice-databases-contained-350-million-records-including-health-data/"}],"summary":"internet-exposed elastic search database found by security researcher.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fa0e84f320994ad8f03738616e1be41334b05ea8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10330.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0d7efa0aa532","org_name":"World Relief","org_type":"nonprofit","ransomware":true,"records_affected":734,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10330.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10330.pdf"}],"summary":"World Relief reported that information in Blackbaud’s databases may have been accessed during a ransomware attack, with no confirmed misuse or public sharing.","supporting_quote":"In July 2020, World Relief was notified by Blackbaud, a large provider of cloud-based data management services to World Relief and many other not -for-profit organizations, that Blackbaud had discovered and stopped a ransomware attack that occurr ed in May 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-30","discovered_date":"2020-08-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25050525f342cbf496feeb474339ede088fc89c6","impact_type":"unknown","incident_date":"2020-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ada8bfa87e7","org_name":"The Hoffman Corporation","org_type":"unknown","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Hoffman%20Corporation-2020-09-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95bc3ff319634887b83b356edd2021e93a1e052f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10329.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f92491bd40f0","org_name":"Northwest Eye Surgeons and Sight Partners","org_type":"healthcare","ransomware":null,"records_affected":6809,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10329.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10329.pdf"}],"summary":"A security incident affected the organization’s systems, and information on a server may have been exposed to an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-29","discovered_date":"2020-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74383720fd63d87a492c3da3382f2f264935865e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Notice%20%289-10-20%29%20-%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"5639ca3a9d87","org_name":"University Muslim Medical Association","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194598"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Notice%20%289-10-20%29%20-%20FINAL.pdf"}],"summary":"A former employee sent a secured file containing patient information to their personal email, with no indication that an unauthorized individual accessed or used it.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-09-29","discovered_date":"2020-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e2e38935ec5b5f5d7023c37c538889cf52589ea0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10327.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a641e8996572","org_name":"Spire Hospitality, LLC","org_type":"other","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10327.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10327.pdf"}],"summary":"Spire Hospitality reported unauthorized access to an employee email account containing sensitive information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1918ea7c641a27094768a0d076aa388277ba4a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20%28B%26W%29.pdf"},"notes":null,"org_country":"US","org_id":"3ee4ec654ad8","org_name":"CBD Industries, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194582"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20%28B%26W%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CBD%20Industries%2C%20LLC-2020-09-29"}],"summary":"CBD Industries reported that an unauthorized third party skimmed elements of its eCommerce platform, putting customers’ personal and payment information at risk.","supporting_quote":null,"technology_involved":["eCommerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-29","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1f2a3d3f769d497fa4b358a645a0a91f21245d29","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10325.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6e945bb0db81","org_name":"Catholic Memorial School","org_type":"education","ransomware":true,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10325.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10325.pdf"}],"summary":"Catholic Memorial reported that data held by Blackbaud was copied during a ransomware attack on the vendor.","supporting_quote":null,"technology_involved":["Blackbaud customer relationship management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7de57ee29706ce5d7cf4ce4debc3901423a7e435","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10324.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c91141eb7a9e","org_name":"Mary's Place","org_type":"nonprofit","ransomware":true,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10324.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10324.pdf"}],"summary":"Mary's Place reported that a cybercriminal removed a backup copy of donor information held by Blackbaud during a ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-28","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9792faaa996bdbdce8cc0421db81fb4ab63550cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10323.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7a58ae8003cf","org_name":"5th Avenue Theatre Association","org_type":"nonprofit","ransomware":null,"records_affected":3468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10323.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10323.pdf"}],"summary":"Unauthorized individuals broke into the Theatre and stole computer equipment that may have contained files with personal information.","supporting_quote":"The Incident occurred overnight on August 29, 2020 where unauthorized individuals broke into the Theatre, among other offices in the building, and stole certain computer equipment, among other property.","technology_involved":["computer equipment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2083ddb55284861f6ac83fb6d56ff0a2e563626","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a202c40-d921-11eb-8217-91ad7b220efe"},"incident_date":"2020-09-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f068553d79f","org_name":"Cook County Illinois","org_type":"government","ransomware":null,"records_affected":323000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/criminal-domestic-case-cook-county-leak23k-sensitive-court-records/163336/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securitymagazine.com/articles/94423-277-cook-county-illinois-records-exposed"}],"summary":"A non-password protected database exposed 323,000 court records for at least four months, according to researchers. The database exposed the names of various people involved in sensitive criminal, domestic-abuse or child-custody court cases, related to a county in Illinois.  Rese","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-25","discovered_date":"2020-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c933bf38967cf1fc5060845e8050cfd67d35714e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Data%20Breach%20Notification%20Letter%20-%20Full%20Name.pdf"},"notes":null,"org_country":"US","org_id":"69f03ce0d641","org_name":"Mono County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194510"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Data%20Breach%20Notification%20Letter%20-%20Full%20Name.pdf"}],"summary":"Mono County reported unauthorized public access to a database that may have contained personal and health information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-25","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8a478adc15397208fe01932c5530057593c6b6d","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10322.pdf"},"notes":null,"org_country":"US","org_id":"9c74fc36d385","org_name":"Doug Flutie, Jr. Foundation for Autism, Inc.","org_type":"nonprofit","ransomware":true,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10322.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10322.pdf"}],"summary":"A ransomware attack on Blackbaud resulted in a copy of some donor data associated with the Foundation being removed from its database.","supporting_quote":null,"technology_involved":["Blackbaud","customer relationship management system","database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-25","discovered_date":"2020-09-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"853782e1c0bea29e33263dea1d8706f9d1c6c02e","impact_type":"both","incident_date":"2020-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10321.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"036811568334","org_name":"Bayley Construction","org_type":"other","ransomware":null,"records_affected":938,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10321.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10321.pdf"}],"summary":"Bayley Construction reported that unknown actors removed files containing personal information and encrypted certain files, making them inaccessible.","supporting_quote":null,"technology_involved":["network device","server environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-24","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c86b5c16045bc6ba93f04383dfde148518c2439","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-09-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Unauthorized%20Access%20to%20Medical%20Information%20%28Template%20for%20SSN%20disclosure%29.pdf"},"notes":null,"org_country":"US","org_id":"ea14033080b4","org_name":"Mammoth Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Unauthorized%20Access%20to%20Medical%20Information%20%28Template%20for%20SSN%20disclosure%29.pdf"}],"summary":"A staff member's laptop was stolen from a vehicle, and the hospital could not confirm whether its hard drive was encrypted.","supporting_quote":"A laptop of a Mammoth Hospital staff member was stolen from a vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-23","discovered_date":"2020-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"13c989c7629f778fbdef27123c8df9ce5676da3f","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10320.pdf"},"notes":null,"org_country":"US","org_id":"548d791e24ca","org_name":"Point Loma Nazarene University","org_type":"education","ransomware":true,"records_affected":1967,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10320.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10320.pdf"}],"summary":"A ransomware incident at Blackbaud exposed or exfiltrated Point Loma Nazarene University donor information stored in Blackbaud’s environment.","supporting_quote":"Blackbaud recently notified PLNU that Blackbaud was impacted by a ransomware event where certain data, including some of PLNU’s donors’ data, was exfiltrated out of Blackbaud’s systems between April 18, 2020, through May 7, 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"809c753cb1a2e0e3873d74722e4c67146c8ec594","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%2002032021.pdf"},"notes":null,"org_country":"US","org_id":"463e760a08e4","org_name":"U.S. Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-537709"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196417"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196918"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-197406"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194219"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194574"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195067"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%2002032021.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#U.S.%20Bank%2C%20N.A.-2020-09-18"}],"summary":"A computer server containing customers’ names and Social Security numbers was physically stolen from a U.S. Bank corporate office.","supporting_quote":"A computer server containing your information was physically stolen from one of our corporate offices.","technology_involved":["computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"833166ca4922feaa859bdf9bc9e5d1bd219b9ed3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10319.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a1c4289a00a5","org_name":"U.S. Bank","org_type":"financial","ransomware":null,"records_affected":1292,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10319.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10319.pdf"}],"summary":"A computer server containing U.S. Bank customer information was physically stolen from a corporate office.","supporting_quote":"A computer server containing your information was physically stolen from one of our corporate offices.","technology_involved":["computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"665342a568bb5bff9ddd33244f59dc27e07ae402","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10318.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"621e14f3b8ec","org_name":"St. Hubert's Church","org_type":"nonprofit","ransomware":null,"records_affected":657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10318.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10318.pdf"}],"summary":"A thief took a laptop containing a parishioner tracking database with personal information.","supporting_quote":"The thief did NOT access credit card information or Social Security numbers, since this information was not stored on this laptop.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9f8d79d090bbd0735bbfd1aea3c855cbb0f650f8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SAFY.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2c047436f4a","org_name":"Specialized Alternatives for Family & Youth of SC","org_type":"unknown","ransomware":null,"records_affected":2695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SAFY.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":"2020-09-17","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"278f07d2a6d29dc3ba073ab30630330f41e3e10f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RUSD%20-%20NutriKids%20-%20NutriLink%20Breach%20Parent%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"7e89d51468c4","org_name":"Rocklin Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194221"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RUSD%20-%20NutriKids%20-%20NutriLink%20Breach%20Parent%20Notification.pdf"}],"summary":"Rocklin Unified School District reported that a bug in the NutriKids-NutriLink student lunch program may have allowed access to student and parent information.","supporting_quote":"On September 17, 2020 we were informed by Rocklin Unified Parent that there was a bug in the NutriLink software that may allow unauthorized access to the NutriKids-NutriLink system.","technology_involved":["NutriKids-NutriLink","NutriLink portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"NutriLink"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"33bcb77ee8ae","name":"NutriLink"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0fcaa1d6662022167841e3d9d63d7a6707b0f76","impact_type":"data_theft","incident_date":"2020-07-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Radnet%20Consumer%20Notice%20%282%29.pdf"},"notes":null,"org_country":"US","org_id":"68cd7fb42829","org_name":"RadNet, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Radnet%20Consumer%20Notice%20%282%29.pdf"}],"summary":"An unknown third party accessed a RadNet server storing employee data and copied files to an external server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"df01b1f4ab5ce56fa6ca5ccfc33399f31d5e5fc1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10317.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d9c88d5b3ae8","org_name":"Minnesota State University Mankato Foundation","org_type":"unknown","ransomware":null,"records_affected":1134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10317.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9b5ab96e71e656289f54bb692a1cddb9a7ef753","impact_type":"unknown","incident_date":"2020-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Joslin%20Diabetes%20Center%20Inc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b99c331bb1af","org_name":"Joslin Diabetes Center, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194224"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10316.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95fd70d22828deebb8d7bfa7353a3aeb02578fcf","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10315.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f21fb1bd3491","org_name":"Homeward Pet Adoption Center","org_type":"nonprofit","ransomware":true,"records_affected":36050,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10315.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10315.pdf"}],"summary":"A ransomware attack on Blackbaud may have exposed files containing Homeward Pet Adoption Center donor information, and Blackbaud reported that a copy of data removed by the attacker was destroyed.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"faba14993a4aa5807fff72e9fe9e017f875092a3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/GreenvilleTechnicalCollege.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1146494d2637","org_name":"Greenville Technical College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/GreenvilleTechnicalCollege.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91d110b053c561612c894a07265ec4bac512d88d","impact_type":"data_theft","incident_date":"2020-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_33.pdf"},"notes":null,"org_country":"US","org_id":"30e51e60ebbb","org_name":"FabFitFun","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_33.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FabFitFun%2C%20Inc.-2020-09-18"}],"summary":"Malicious code was inserted on portions of FabFitFun’s website and may have captured information entered during customer sign-ups.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1bea83bf089b7ec16530726b6edb0b9fc349c813","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10312.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f18436da5b5","org_name":"Ball State University Foundation","org_type":"unknown","ransomware":null,"records_affected":755,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10312.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-17","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"984227535b24bf514705e8485fc93a37c11fb4c6","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10311.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"663516e2a6b5","org_name":"Western Washington University Foundation","org_type":"nonprofit","ransomware":true,"records_affected":165000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10311.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10311.pdf"}],"summary":"Attackers obtained files containing personal information from Blackbaud servers in a ransomware attack affecting the Western Washington University Foundation.","supporting_quote":"On July 16, Blackbaud notified the WWU Foundation and other affected organizations about this attack and that the attackers had obtained their files from Blackbaud’s servers.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5b8aa0fa4198d64b287ea12c149adccf780758a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10310.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"acbee1035009","org_name":"Tidewater Community College Education Foundation","org_type":"unknown","ransomware":null,"records_affected":1029,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10310.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-17","discovered_date":"2020-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"242297dbe75f23a71325ced269b3c82a7b8acc34","impact_type":"disruption_or_ransomware","incident_date":"2020-08-14","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10309.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"df089f156015","org_name":"Ponti Veterinary Hospital","org_type":"healthcare","ransomware":null,"records_affected":135,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10309.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10309.pdf"}],"summary":"Ponti’s computer systems were encrypted during two cyberattacks, temporarily preventing access to customer and associate data; the organization reported no evidence that personal information was acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-17","discovered_date":"2020-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5d241951605357f5700a9f91e09f6fe3f0c012d","impact_type":"data_theft","incident_date":"2019-07-14","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Greenworks.pdf"},"notes":null,"org_country":"US","org_id":"f64c812d7489","org_name":"Greenworks Tools","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Greenworks.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10308.pdf"}],"summary":"Greenworks Tools reported that malware may have stolen customers’ personal and payment card information used on its e-commerce website.","supporting_quote":"Through the third-party forensic investigation, we confirmed on August 14, 2020 that malware may have stolen credit or debit card data from some credit and debit cards used on our website, www.greenworkstools.com, between July 14, 2019 and June 30, 2020.","technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-17","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"931285162f5b0344cedc1696abe1e4fbc565dbee","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20pdf.pdf"},"notes":null,"org_country":"US","org_id":"0e518b3c17a6","org_name":"Episcopal Community Services","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194129"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20pdf.pdf"}],"summary":"A cybercriminal removed a copy of a Blackbaud backup file containing some Episcopal Community Services donor information.","supporting_quote":"Please note that this breach only affected information on Blackbaud’s servers for ECS donors and has no impact on ECS clients or programs.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1c649422c3d319b3aa079a59f32710121dc8fe1a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/MUSC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2ed111245ff8","org_name":"Medical University of South Carolina","org_type":"unknown","ransomware":null,"records_affected":85897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/MUSC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-16","discovered_date":"2020-08-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d630559812026068382f103d5d6a5522c897958","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CDMS%20-%20Template%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"aaeaa4fba5c6","org_name":"California Dialysis Management Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194122"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CDMS%20-%20Template%20Notification%20Letter.pdf"}],"summary":"California Dialysis Management Services reported that an individual arrested by the FBI possessed documents containing employees’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"957caa0f1b25e35a868f3d3904d1ebee24e1826c","impact_type":"unknown","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Inova%20-%20Patient%20AB292%20%5Bredacted%5D%20%289089426x7AB84%29.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5895f62d562c","org_name":"Inova Health System","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194048"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10302.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-15","discovered_date":"2020-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdf59ff4e9442067468dae2c045223ace56ed91c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMB%20Associates%20-%20Breach%20Notification%20Letter%20-%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"de4377682bde","org_name":"BMB Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194051"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMB%20Associates%20-%20Breach%20Notification%20Letter%20-%20PROOF.pdf"}],"summary":"BMB Associates discovered fraudulent tax filings after an unauthorized third party compromised its Intuit ProSeries service and created a guest account; the company could not confirm what information, if any, was compromised.","supporting_quote":null,"technology_involved":["Intuit ProSeries"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Intuit"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"71b813da9532","name":"Intuit"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-15","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9f88910beb6f1bcce9f807f6c15cf4fed9eface","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10307.pdf"},"notes":null,"org_country":"US","org_id":"d764949ca092","org_name":"American Medical Association Foundation","org_type":"nonprofit","ransomware":true,"records_affected":1369,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10307.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10307.pdf"}],"summary":"The American Medical Association Foundation reported that ransomware at Blackbaud led to exfiltration of donor information, including names and dates of birth.","supporting_quote":"The AMA F contracts with the company Blackbaud, Inc. (“Blackbaud”) to store its donor information within Blackbaud’s self-hosted environment.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-15","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"032ad2a027c873a81a3c653f85857220271243b5","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10277.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ae96940d753c","org_name":"American Heart Association","org_type":"nonprofit","ransomware":null,"records_affected":7658,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10277.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10277.pdf"}],"summary":"The American Heart Association reported that backup files containing personal information were taken from Blackbaud’s network.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7768d41248c2395fb37d7b1795b5ac0e648de18c","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10306.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"332d14209173","org_name":"Valley City State University Foundation","org_type":"nonprofit","ransomware":true,"records_affected":71,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10306.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10306.pdf"}],"summary":"Blackbaud notified the Foundation that attackers removed backup files containing personal information from its hosted platform during a ransomware incident.","supporting_quote":"We were recently notified by one of our vendors, Blackbaud Inc., of a security incident in which they stopped a ransomware attack.","technology_involved":["Blackbaud platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"df17c3c10a27bbdf57a5a66be9c44b3f40454869","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/USCUpstateFoundations.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ff694261b2e2","org_name":"University of South Carolina Upstate Foundations","org_type":"nonprofit","ransomware":true,"records_affected":5201,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/USCUpstateFoundations.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/USCUpstateFoundations.pdf"}],"summary":"A ransomware attack on Blackbaud’s self-hosted platform exposed a copy of data related to University of South Carolina Upstate Foundations constituents.","supporting_quote":"We were notified that Blackbaud, an outside vendor, discovered and stopped a ransomware attack of Blackbaud’s self-hosted platform in May 2020.","technology_involved":["Blackbaud self-hosted platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb4225a60c951753451a25be64535fb96c2a15fa","impact_type":"both","imported_from":null,"incident_date":"2020-05-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Northern%20Light%20Health.pdf"},"notes":null,"org_country":"US","org_id":"76ff6d171c3b","org_name":"Northern Light Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194021"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Northern%20Light%20Health.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10305.pdf"}],"summary":"Northern Light Health reported that personal and limited protected health information held by Blackbaud may have been accessed or acquired during a ransomware incident.","supporting_quote":"Blackbaud reported that in May 2020, it experienced a ransomware attack during which certain \ninformation it maintained for its customers was taken “hostage” by a cybercriminal .","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2020-09-14","discovered_date":"2020-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41fa3aaaace8a2e796a28c1a163de21781334ca5","impact_type":"data_theft","imported_from":null,"incident_date":"2020-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Drive%20Medical%20Individual%20Notification%20Template_CA%20July.pdf"},"notes":null,"org_country":"US","org_id":"7c68fef66c0e","org_name":"Medical Depot, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Drive%20Medical%20Individual%20Notification%20Template_CA%20July.pdf"}],"summary":"An unauthorized third party gained remote access to Drive Medical’s network and briefly possessed a file system containing internal company and employee information.","supporting_quote":null,"technology_involved":["electronic file system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"32be486cc97b74aa7e2eb1dd5d2c017d79162bbe","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10276.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"757eac62bdf4","org_name":"Jewish Family Service","org_type":"nonprofit","ransomware":true,"records_affected":3204,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10276.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10276.pdf"}],"summary":"Blackbaud reported that a cybercriminal copied a backup of Jewish Family Service’s ResearchPoint data and that Blackbaud paid the criminal’s demand after stopping the ransomware attack before files were fully encrypted.","supporting_quote":null,"technology_involved":["Blackbaud","ResearchPoint"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"157fb9b7351bacfcc3982401729cad13fafe6cb9","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/9102338.PDF"},"notes":null,"org_country":"US","org_id":"ef4a92058d17","org_name":"Baylor Genetics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees fell victim to a phishing campaign, which allowed an unauthorized individual to access their email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194047"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/9102338.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baylor%20Genetics-2020-09-14"}],"summary":"A phishing campaign led to unauthorized access to Baylor Genetics employees’ email accounts, with no evidence that information was acquired or used.","supporting_quote":"These employees unfortunately fell victim to the phishing campaign, resulting in an unauthorized individual gaining access to those employees’ email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9525b4c0e45eabdc06db0181055a1d3e10329e9","impact_type":"both","incident_date":"2020-02-06","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10297.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"813a220adc68","org_name":"AARP Foundation","org_type":"nonprofit","ransomware":true,"records_affected":248615,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10297.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10297.pdf"}],"summary":"An intruder accessed and copied donor information held by Blackbaud for AARP Foundation, and Blackbaud paid a ransom in exchange for a promise to delete it.","supporting_quote":"In this intrusion, information provided to Blackbaud by its many customers, including AARP, was accessible to the intruder and the intruder copied a significant amount of this information, although the most sensitive information was stored in encrypted form.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c136ab2b64a97f570e77cfcb880193fd99e9007","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dc1be460-1d40-11eb-866e-51f25f42af12"},"incident_date":"2020-09-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SK","org_id":"547f5eb10be8","org_name":"Slovakia Public Health","org_type":"government","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://borncity.com/win/2020/09/20/datenleck-corona-testergebnisse-von-400-000-slowaken-ffentlich/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33c95c1a7ef7db9247d6d5454737675e1602222e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d4a9ba90-6c87-11eb-ae4f-03e1e00a9a54"},"incident_date":"2020-09-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"technology_saas","ransomware":null,"records_affected":10000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.komando.com/security-privacy/bing-data-leak/755664/"}],"summary":"Microsoft accidentally left an unsecured database full of customer's searches which was then discovered by security researchers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f806ca209d0ba43ffbd1c6c789b762bc482851c9","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10304.pdf"},"notes":null,"org_country":"US","org_id":"10c5310385f1","org_name":"YouthCare","org_type":"nonprofit","ransomware":true,"records_affected":3410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10304.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10304.pdf"}],"summary":"YouthCare reported that a ransomware attack on its data-management provider, Blackbaud, resulted in the copying of some personal data and a ransom payment.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-11","discovered_date":"2019-09-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52d787a62603b37712053c345704697840072b69","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/STG%20-%20CA%20-%20Notice%20of%20Data%20Event_2.pdf"},"notes":null,"org_country":"US","org_id":"b59a0d35e372","org_name":"STG Logistics","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193970"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/STG%20-%20CA%20-%20Notice%20of%20Data%20Event_2.pdf"}],"summary":"STG Logistics reported unauthorized access to employee email accounts, with personal information potentially affected.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-11","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"efa8aae4c29c77c3082457d8fa1a4b7d3f4fe09b","impact_type":"unknown","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0003409a7b46","org_name":"SMART Reading","org_type":"unknown","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SMART%20Reading-2020-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-11","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd18593f4e3131bbeff9380b77592c04b68a45bb","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EHF%20Privacy%20Breach%20Notice_9.2020.pdf"},"notes":null,"org_country":"US","org_id":"ba07dbb59876","org_name":"Emanate Health Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EHF%20Privacy%20Breach%20Notice_9.2020.pdf"}],"summary":"A cybercriminal accessed and removed a copy of the Foundation’s backup file stored on Blackbaud’s servers.","supporting_quote":"On July 16, 2020, the Foundation was notified by its third-party provider, Blackbaud, of a security incident which involved your personal information.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c726321555eb29bce6c07ad8c16a7615ec313ab1","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CorePower%20Yoga%20-%20Notice%20of%20Data%20Event%20-%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"8cc75b4d4dd5","org_name":"CorePower Yoga","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193986"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CorePower%20Yoga%20-%20Notice%20of%20Data%20Event%20-%20CA_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10296.pdf"}],"summary":"CorePower Yoga reported unauthorized access to multiple employee email accounts, where individuals’ names were found in emails or attachments that may have been viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-09-10","discovered_date":"2020-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d7ddb70173568eec5dcb9e99969c35538097890","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/dataincident.pdf"},"notes":null,"org_country":"US","org_id":"6f31730af3dd","org_name":"LiveAuctioneers, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193927"},{"fetched_at":null,"title":"Have I Been Pwned: LiveAuctioneers","type":"hibp","url":"https://haveibeenpwned.com/Breach/LiveAuctioneers"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/dataincident.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LiveAuctioneers%2C%20LLC-2020-09-10"}],"summary":"An attack against an IT supplier led to unauthorized access to personal information in LiveAuctioneers’ bidder database.","supporting_quote":"Our cybersecurity team has indeed confirmed that following a cyber attack against one of our IT suppliers on June 19, 2020, an unauthorised third party managed to access certain personal information from our bidder database.","technology_involved":["bidder database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f023088d60448e2306b8ac73976671e4f13d9d8b","impact_type":"data_theft","incident_date":"2020-05-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enloe-%20Notice%20of%20Data%20Event_1.pdf"},"notes":null,"org_country":"US","org_id":"acdf2de1272e","org_name":"Enloe Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enloe-%20Notice%20of%20Data%20Event_1.pdf"}],"summary":"Enloe Medical Center reported that personal and medical information held by Blackbaud may have been involved in a ransomware incident, though access to specific individuals' information was unconfirmed.","supporting_quote":"Although not the target of the ransomware incident, Enloe was one of the countless organizations that were impacted.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8685816e2caff35fd7adef38b125e37d80091c20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ac2cc20-2378-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-09-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2458474868da","org_name":"University of Ottawa","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thefulcrum.ca/sciencetech/students-information-leaked-in-youtube-broadcast/"}],"summary":" Sept.9, students in CSI 4139, Design of Secure Systems, joined their class using YouTube live streams only to see their private information leaked on YouTube.  The professor was seemingly unaware that he was publicly broadcasting the names, email addresses, year of study, and pr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1722bccfbbb5300181bdc788a0aed37a40c0474","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10303.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7df3ef79f0f6","org_name":"KidsQuest Children's Museum","org_type":"nonprofit","ransomware":true,"records_affected":57024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10303.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10303.pdf"}],"summary":"A cybercriminal copied a backup of KidsQuest Children's Museum's Blackbaud Altru data during a ransomware incident at Blackbaud, which paid the extortion demand.","supporting_quote":null,"technology_involved":["Blackbaud Altru backup"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-08","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64c1096124c9698b46aacba92a024d7ca53c78d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10300.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4b2b89a42bca","org_name":"Virginia Mason Medical Center","org_type":"healthcare","ransomware":null,"records_affected":227371,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10300.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10300.pdf"}],"summary":"Virginia Mason Medical Center said Blackbaud notified it that an unauthorized individual accessed Blackbaud systems and may have acquired a backup of the center’s donor/fundraising database.","supporting_quote":null,"technology_involved":["Blackbaud","donor/fundraising database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-08","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4105b5ff59fe686c0fbd97398aad7e6e2975b720","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10299.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"20fd8f2a88f6","org_name":"The University of Notre Dame","org_type":"education","ransomware":true,"records_affected":3209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10299.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10299.pdf"}],"summary":"Data was removed from Blackbaud's systems between February 7 and May 20, 2020, and an attempted ransomware attack was stopped.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c8ede6fd4a229996271ab4ed0a8b5cf839e9c90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6c92d460-019c-11eb-b177-5f49668a9776"},"incident_date":"2020-09-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"080246cacba8","org_name":"Spokane Regional Health District","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.krem.com/article/news/health/coronavirus/spokane-health-district-apology-accidental-data-disclosure/293-b9c61e8a-5a95-4d9e-b27b-b5f6fdfae183"}],"summary":"SPOKANE, Wash. — The Spokane Regional Health District is apologizing on Monday after it accidentally disclosed personal health information to a partner agency.   According to a press release, SRHD discovered the unauthorized disclosure to Northeast Washington Educational Service ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-08","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4ba5739013524c931d2612acf568f46ba51a8421","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10298.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"71f16a044f70","org_name":"Saybrook University","org_type":"education","ransomware":true,"records_affected":935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10298.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10298.pdf"}],"summary":"Saybrook University reported that a ransomware attack at its third-party provider Blackbaud resulted in a copy of a subset of client data, including information about Saybrook individuals, being removed.","supporting_quote":"On July 16, 2020, Saybrook University was notified by Blackbaud, one of our third-party service providers, that they had recently discovered a ransomware attack that may have affected your personal information.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-08","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3d8624f18af23a5aa986e91bda54ecc3a016d475","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10301.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2e41261c6c05","org_name":"Pacific University Oregon","org_type":"education","ransomware":true,"records_affected":9196,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10301.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10301.pdf"}],"summary":"Pacific University Oregon reported that Blackbaud experienced a ransomware attack involving stolen files, and Blackbaud paid the demand to have them destroyed.","supporting_quote":"Blackbaud notified us on July 16 that it has experienced a ransomware attack between Feb. 7 and May 20.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-08","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4bd27fdf79a8fd1693fcca085d62c320d9a1615","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10295.pdf"},"notes":null,"org_country":"US","org_id":"6b9591989eff","org_name":"National Outdoor Leadership School","org_type":"education","ransomware":true,"records_affected":3049,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10295.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10295.pdf"}],"summary":"Data was removed from Blackbaud systems, potentially exposing NOLS residents’ names and dates of birth, during an incident involving a ransomware attempt.","supporting_quote":"I am writing to provide notification of an incident at Blackbaud, a third party service provider, that may affect the security of personal information of three thousand forty-nine (3,049) Washington residents.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f9abe60bf8e7cf772ab59be24be2a5f6a9ac524","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10294.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8c39a94e67d8","org_name":"Florida International University Foundation","org_type":"unknown","ransomware":null,"records_affected":922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10294.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cf88aa10ad71a650479981fc20db3e8ad753b393","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10275.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6059d5b8bf26","org_name":"Children's Cancer Association","org_type":"unknown","ransomware":null,"records_affected":1752,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Children%27s%20Cancer%20Association-2020-09-08"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10275.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9572f27fabfc2484bba2ed2a1d0275fd1427c8f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40e8c310-38cd-11ec-b42b-a7ad11fc87ee"},"incident_date":"2020-09-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"140efe3c7903","org_name":"San Juan Medical Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.daily-times.com/story/news/local/farmington/2021/06/20/san-juan-regional-medical-center-reports-data-breach-network-hundrends-patients-affected/7744970002/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.daily-times.com/story/news/local/farmington/2021/06/20/san-juan-regional-medical-center-reports-data-breach-network-hundrends-patients-affected/7744970002/"}],"summary":"FARMINGTON — A Farmington hospital has reported a data breach to its network in Fall 2020 that impacted more than 500 patients whose personal information was taken.  The hospital said in a statement there is no evidence of any personal information being misused from the data brea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-07","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb4e34bf0053261df2a0545aefca241db25e5411","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10293.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"10bd001b1a16","org_name":"Operation Homefront","org_type":"nonprofit","ransomware":null,"records_affected":5272,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10293.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10293.pdf"}],"summary":"Operation Homefront reported that its donor database hosted by Blackbaud was affected by a security breach, with no sensitive information reported taken.","supporting_quote":null,"technology_involved":["Blackbaud","donor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Netwalker","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cf234c91ae4c150f90e302e6d39498fa57723b1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00392c50-0bf6-11ec-9c8a-d72b813bc8ca"},"incident_date":"2020-09-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb0da3eaf2d6","org_name":"Equinix","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.crn.com/news/security/equinix-ransomware-attack-hits-company-s-internal-systems"}],"summary":"Netwalker carried out the ransomware attack against data center colocation giant Equinix and demanded a $4.5 million ransom to prevent the release of stolen data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"netwalker"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"215a6f62c25d7ffb5d5c5d5b04ac6de412962228","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notices%20of%20Data%20Breach%285576039.1%29.pdf"},"notes":null,"org_country":"US","org_id":"4b267824dc2b","org_name":"Promo.com Ltd.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193800"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notices%20of%20Data%20Breach%285576039.1%29.pdf"}],"summary":"Promo.com reported that breached servers held personal information and encrypted, hashed, and salted passwords for Slidely and Promo accounts.","supporting_quote":null,"technology_involved":["Slidely","Promo"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3e943c2a4e495f5372b3935a70118542d085ff3","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vermont%20Student%20Assistance%20Corporation.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"9217c9238d76","org_name":"Vermont Student Assistance Corporation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193789"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194530"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vermont%20Student%20Assistance%20Corporation.pdf"}],"summary":"A ransomware incident in Blackbaud’s environment resulted in encryption of certain systems and removal of a backup file that may have contained VSAC customers’ personal information.","supporting_quote":"As a result of this incident, certain Blackbaud systems were encrypted and a Blackbaud database backup file including VSAC data was removed from the Blackbaud environment by an unauthorized actor.","technology_involved":["Blackbaud","database backup file"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"103542cd5955c9dc10d6e05c56083bd19e1c3070","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10292.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"88314616f3e8","org_name":"Southern Adventist University","org_type":"education","ransomware":true,"records_affected":1336,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10292.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10292.pdf"}],"summary":"Cybercriminals removed a backup file containing Southern Adventist University information from Blackbaud's systems, but the letter does not state how they gained access.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df9c02783f3fcddb4e52f728d9a2e455138c89c3","impact_type":"both","incident_date":"2020-05-01","initial_access":"supply_chain_or_third_party","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PKD%20Foundation%20Data%20Security%20Breach%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d12cf246e05c","org_name":"Polycystic Kidney Disease Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193798"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PKD%20Foundation%20Data%20Security%20Breach%20Notice%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10286.pdf"}],"summary":"Data belonging to the Polycystic Kidney Disease Foundation was accessed and copied from a Blackbaud database during a ransomware attack on a Blackbaud service provider.","supporting_quote":"The cybercriminal was unsuccessful in blocking access to the database involved in the attack, however, the cybercriminal was able to remove a copy of a subset of data from several of Blackbaud’s clients including data of Polycystic Kidney Disease Foundation.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1195","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e75852ed1f7a288c2d91d6aabab37f128ff2990f","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10291.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7d8db35c9ad4","org_name":"Navy League of the United States","org_type":"nonprofit","ransomware":true,"records_affected":1398,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10291.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10291.pdf"}],"summary":"A threat actor removed data from Blackbaud systems affecting Navy League of the United States, and Blackbaud reported stopping an attempted ransomware attack.","supporting_quote":"That investigation concluded that the threat actor intermittently removed data from Blackbaud's systems between February 7, 2020 and May 20, 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98409f86d458481892e31371b2545ad35f362b9f","impact_type":"unknown","incident_date":"2019-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/INTEGRIS%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22e86b4355d2","org_name":"INTEGRIS Baptist Medical Center, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193787"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#INTEGRIS%20Baptist%20Medical%20Center%2C%20Inc.-2020-09-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b15bbbee1f023e9c53815b436bfc5de0b30800f1","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_6.pdf"},"notes":null,"org_country":"US","org_id":"a463eafbd322","org_name":"Hydrocephalus Association","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193773"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_6.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10290.pdf"}],"summary":"An unauthorized third party removed a copy of non-financial Hydrocephalus Association data held by Blackbaud and demanded payment.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f6accec14c4d39da922645b47e77247da39e88b7","impact_type":"data_theft","imported_from":null,"incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10289.pdf"},"notes":null,"org_country":"US","org_id":"291d4e84d4f3","org_name":"Drake University","org_type":"education","ransomware":true,"records_affected":1050,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10289.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10289.pdf"}],"summary":"An incident at Blackbaud exposed Drake University customer data, including names and dates of birth.","supporting_quote":"Following its investigation, Blackbaud notified its customers that an unknown actor may have accessed or acquired certain Blackbaud customer data.","technology_involved":["Blackbaud","database and relationship management services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-09-04","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3b9fd4ce78aa28fd06eab752739bc4c09dcc23e7","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10288.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4762596f4fb1","org_name":"Children's Home Society of Washington","org_type":"nonprofit","ransomware":true,"records_affected":564,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10288.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10288.pdf"}],"summary":"Data was removed from Blackbaud's systems between February 7 and May 20, 2020, and Blackbaud notified Children's Home Society of Washington on July 16.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-04","discovered_date":"2020-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04234a186afeb2d3f739faea3b713bf11b5b8821","impact_type":"disruption_or_ransomware","incident_date":"2020-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Artech%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"bf6780c5cbec","org_name":"Artech, L.L.C.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Artech%20-%20Notice%20of%20Data%20Event.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Artech%2C%20L.L.C.-2020-09-04"}],"summary":"Artech reported unauthorized access to certain systems where ransomware was identified and personal information was present.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1da57b89b366d6a7cfc404f7d51f422cf397f460","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AdCap%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"28ca2f5f0738","org_name":"Advantage Capital Funding, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193799"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AdCap%20-%20California%20Notification.pdf"}],"summary":"Advantage Capital reported unauthorized access to a third-party-hosted database containing merchant loan application data and personal and financial information.","supporting_quote":null,"technology_involved":["hosted database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a18ef086766469484c8fe881d541645b5164605","impact_type":"data_theft","incident_date":"2020-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sekure%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"0e1ea50b2c37","org_name":"Sekure Merchant Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sekure%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sekure%20Merchant%20Solutions-2020-09-03"}],"summary":"Sekure Merchant Solutions said an unauthorized actor removed data from its network, and an investigation found that a database containing personal information could have been accessed.","supporting_quote":null,"technology_involved":["merchant applications database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3197f0c4d9edb9e4a6245602774ec35f5a58c394","impact_type":"disruption_or_ransomware","incident_date":"2020-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Osmose%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"140080a565f0","org_name":"Osmose Utilities Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Osmose%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Osmose%20Utilities%20Services%2C%20Inc.-2020-09-03"}],"summary":"Osmose Utilities Services, Inc. reported a cyber attack that encrypted some computer systems and involved unauthorized access to systems containing employee-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2020-09-03","discovered_date":"2020-08-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3344cdd9ba5a58947fa1a884dbeb8fd612620421","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10284.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"fc20a1ce45ac","org_name":"Olympic College Foundation","org_type":"nonprofit","ransomware":true,"records_affected":25583,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10284.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10284.pdf"}],"summary":"The Olympic College Foundation reported that data held by Blackbaud may have been involved in a ransomware incident, and the data may have included personal and philanthropic information.","supporting_quote":null,"technology_involved":["Blackbaud","Blackbaud database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-09-03","discovered_date":"2020-07-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5392bc1c85a54dff8e691f01ad5c14a520afd05","impact_type":"data_theft","incident_date":"2020-06-19","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10283.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6f31730af3dd","org_name":"LiveAuctioneers","org_type":"retail_ecommerce","ransomware":null,"records_affected":38523,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10283.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10283.pdf"}],"summary":"An attack against an IT supplier led to unauthorized access to personal information in LiveAuctioneers’ bidder database.","supporting_quote":"Our cybersecurity team has indeed confirmed that following a cyber attack against one of our IT suppliers on June 19, 2020, an unauthorised third party managed to access certain personal information from our bidder database.","technology_involved":["bidder database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-02","discovered_date":"2020-08-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"960c1758aeecc14868f5054cf7bd6e1a5d9aa6c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_Consumer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"79ee438dff11","org_name":"Warner Music Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193707"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_Consumer%20Letter.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/WarnerMusicGroup.pdf"}],"summary":"An unauthorized third party compromised Warner Music Group e-commerce websites hosted and supported by an external service provider, potentially acquiring customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["e-commerce websites"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-02","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1503dfd354dfdc3a1b59288a3c7cfe866663d335","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10281.pdf"},"notes":null,"org_country":"US","org_id":"f8387209caaa","org_name":"University of Rhode Island Foundation","org_type":"nonprofit","ransomware":true,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10281.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10281.pdf"}],"summary":"Blackbaud reported a ransomware event in its environment that resulted in exfiltration of some University of Rhode Island Foundation donor data.","supporting_quote":"Blackbaud notified URIF that Blackbaud was impacted by a ransomware event where certain data, including some of URIF’s donors’ data, was exfiltrated out of Blackbaud’s systems between April 18, 2020 and May 17, 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-02","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"42a1bfc8a5b171638574ed592482524075de3a66","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10280.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"629aa2ed18ef","org_name":"University of North Dakota Alumni Association and Foundation","org_type":"nonprofit","ransomware":true,"records_affected":2687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10280.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10280.pdf"}],"summary":"The University of North Dakota Alumni Association and Foundation was notified that backup files potentially containing its information were removed from Blackbaud's platform during a ransomware incident.","supporting_quote":"However, prior to being locked out, the cybercriminals removed backup files from Blackbaud's platform, which hosted data for numerous colleges, universities, health care organizations, foundations, and other non-profit organizations around the world, including UNDAAF.","technology_involved":["Blackbaud platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"383278c5ef9caf6ec6c6a46b8d23e11dec1ec64f","impact_type":"unknown","incident_date":"2020-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F7566_L01_L01_Clorox_CA.pdf"},"notes":null,"org_country":"US","org_id":"605778ee62d1","org_name":"Nutranext, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193700"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F7566_L01_L01_Clorox_CA.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nutranext%2C%20LLC-2020-09-02"}],"summary":"Nutranext, LLC sent a consumer notification letter regarding an incident dated May 27, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"05cb042727f68cf2ffa561314ab73d3c8cf6ea08","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10278.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"25e206b5dd86","org_name":"Hamline University","org_type":"education","ransomware":true,"records_affected":1066,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10278.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10278.pdf"}],"summary":"Hamline alumni and donor information was copied from a database backup held by its service provider, Blackbaud.","supporting_quote":"On July 16, 2020, Blackbaud notified Hamline that it had experienced a ransomware attack in May 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f2364da82d8da6762c6e853a83fd979fd5e29a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"585d5280-74ac-11eb-a956-8766d2dd0181"},"incident_date":"2020-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2e1fa03a1b3f","org_name":"Uttar Pradesh government","org_type":"government","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://reclaimthenet.org/indian-covid-surveillance-app-has-massive-data-leaks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/india-covid-19-surveillance-tool-exposed-user-data/?utm_source=ReviveOldPost&utm_medium=social&utm_campaign=ReviveOldPost;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/millions-exposed-covid19/"}],"summary":"Over eight million patients in India had their personal and medical details exposed after security researchers discovered multiple vulnerabilities in a government-run COVID-19 surveillance system.  The “Surveillance Platform Uttar Pradesh Covid-19” software was first discovered b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78e97b90c926a4a952f3df2d22b91b6472c458ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d51c7080-1d1d-11eb-866e-51f25f42af12"},"incident_date":"2020-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1d66e81c133","org_name":"United Health Services, Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/universal-health-services-slammed-by-massive-cyberattack/"}],"summary":"Computer systems at some hospitals began failing over the weekend after Universal Health Systems, a major provider with over 400 locations primarily in the US, was hit by a cyberattack. With systems offline, some impacted hospitals resorted to filing patient information with pen ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a59b1a690f2eb7326e719c4c85f6182cdbf33a5c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"568a66d0-1d42-11eb-866e-51f25f42af12"},"incident_date":"2020-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3e5b3030e4c1","org_name":"The College of Nurses of Ontario (CNO)","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/london/college-of-nurses-ontario-cyber-security-incident-1.5727816"}],"summary":"The College of Nurses of Ontario (CNO) has been dealing with a \"cybersecurity incident\" that may have compromised the personal information of its almost 200,000 members, CBC News has learned.   The name of the college and some of the information hackers say they have access to ap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-09-01","discovered_date":"2020-05-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"164ef67ab4ad756b59233083a406cfeb492a89bf","impact_type":"unknown","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71dbb859596c","org_name":"Ohio History Connection","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ohio%20History%20Connection-2020-09-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"111c36c012f4ec1f4046432edef850453dbb1276","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41cf5b40-8e7c-11ec-ab9f-33907697f3a6"},"incident_date":"2020-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08900b8c29bd","org_name":"Louisiana State University","org_type":"education","ransomware":null,"records_affected":185000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kplctv.com/2021/01/29/possible-breach-info-moss-memorial/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wdsu.com/article/another-medical-facility-added-to-lsu-health-care-services-division-hippa-breach/35365466"}],"summary":"In 2013, billing services for Moss Memorial were provided by Louisiana State University, Health Care Services Division (“LSU HCSD”).  As a result, LSU HCSD has in its files certain information related to the care of Moss Memorial patients.  On December 10, 2020, LSU HCSD notified","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-01","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f974fa29363be7505f6233000967473976fc3736","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10274.pdf"},"notes":null,"org_country":"US","org_id":"69cdec18a134","org_name":"Guide Dogs for the Blind, Inc.","org_type":"nonprofit","ransomware":true,"records_affected":8169,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10274.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10274.pdf"}],"summary":"Guide Dogs for the Blind, Inc. was affected by a Blackbaud data security incident in which personal data was accessed or acquired and exfiltrated.","supporting_quote":"Following its investigation, Blackbaud notified its customers that an unknown actor may have accessed or acquired certain Blackbaud customer data.","technology_involved":["Blackbaud","database and relationship management services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db5f25d632b0f16da77ed6a458474be6760d8c63","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"5ca2bc9623a8","org_name":"Experian South Africa","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Experian (South Africa)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Experian2020"}],"summary":"Experian South Africa suffered a data breach that exposed personal information, including government-issued IDs, names, occupations, employers and phone numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-09-01","discovered_date":"2020-05-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7befba3c4883666a894f4bba6b74bb0007f2213a","impact_type":"both","incident_date":"2020-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Coast%20Financial%20Services%20-%20California%20Attorney%20General%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"578aac51a570","org_name":"Coast Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coast%20Financial%20Services%20-%20California%20Attorney%20General%20Notification%20Letter.pdf"}],"summary":"Coast Financial Services reported that two servers were encrypted and inaccessible, and that an unauthorized individual accessed files containing tax-related personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa8f3598e25e113a6df0aa1e50b9da9ef6630d28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a605e40-4642-11ec-b26b-73b5a62f8946"},"incident_date":"2020-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78e9ab5c3f04","org_name":"Centers for Advanced Orthopaedics","org_type":"healthcare","ransomware":null,"records_affected":125291,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cfaortho.com/docs/120863433_2_Website%20Substitute%20Notice-C1.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ryortho.com/breaking/maryland-ortho-practice-data-breach-exposes-over-125000-people/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"On September 17, 2020, CAO identified unusual activity in its email environment. After discovering the unusual activity, CAO immediately launched an investigation, with the assistance of cybersecurity experts, into the nature and scope of the incident. As part of this investigati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bee8ca133f13e71d3035008cc4d31f363b417a13","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10273.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ab5fc946ca1c","org_name":"The Open Window School","org_type":"education","ransomware":true,"records_affected":1929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10273.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10273.pdf"}],"summary":"The Open Window School was notified that personal data in Blackbaud systems may have been accessed during a ransomware incident, but the school could not confirm that its data was accessed.","supporting_quote":null,"technology_involved":["Blackbaud systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-08-31","discovered_date":"2020-07-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3f790cff6fd7b95a1701a1f6347edab9f115061","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/260886_01_2CA_Stericycle%20-%20US%20CALIFORNIA%20Individual%20Notification%20Template%20-%20FINAL%20V2%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"ead3e197096c","org_name":"Stericycle, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/260886_01_2CA_Stericycle%20-%20US%20CALIFORNIA%20Individual%20Notification%20Template%20-%20FINAL%20V2%20%281%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10265.pdf"}],"summary":"Stericycle reported unauthorized access to employee email accounts containing personal information, with no evidence that emails containing that information were accessed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"659c247e40825d59257ab1fe56d29d8501cd1028","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10272.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb2a21d9bab1","org_name":"Planned Parenthood Los Angeles","org_type":"unknown","ransomware":null,"records_affected":1027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10272.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3953d142d34ada3a6e660a155317b8ddd5d3d931","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_32.pdf"},"notes":null,"org_country":"US","org_id":"493eca6a766a","org_name":"Havenly, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193576"},{"fetched_at":null,"title":"Have I Been Pwned: Havenly","type":"hibp","url":"https://haveibeenpwned.com/Breach/Havenly"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_32.pdf"}],"summary":"An outside individual gained unauthorized access to a Havenly database containing users’ names, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-31","discovered_date":"2020-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30b00e974898692a3aa1fe3c116de0b3f487ddee","impact_type":"data_theft","incident_date":"2020-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WPDOCS01-%238368168-v1-Notification-Letter-%28CA-AG%29.pdf"},"notes":null,"org_country":"US","org_id":"9323a70f090a","org_name":"Ferris Marketing, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193618"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WPDOCS01-%238368168-v1-Notification-Letter-%28CA-AG%29.pdf"}],"summary":"An unknown attacker inserted a malicious script into Night Owl’s retail website that enabled acquisition of customer payment card information.","supporting_quote":null,"technology_involved":["Night Owl retail website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-31","discovered_date":"2020-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f355bb8cd371a219469648a25f1ce695391a7a8","impact_type":"both","incident_date":"2020-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Assured%20Imaging%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"545558c861cd","org_name":"Assured Imaging","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Assured%20Imaging%20Breach%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Assured%20Imaging-2020-08-31"}],"summary":"Assured Imaging reported that ransomware encrypted its electronic medical records system and an unknown actor accessed systems and exfiltrated limited data.","supporting_quote":null,"technology_involved":["electronic medical records system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1822424931fd340c307de493c6dbcbbd51a79783","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc3fc080-019d-11eb-b177-5f49668a9776"},"incident_date":"2020-08-31","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"54c4cf43d6b3","org_name":"Anglicare Sydney","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2020-09-19/anglicare-sydney-victim-of-cyber-security-breach-involving-data/12681510"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/anglicare-sydney-says-17gb-of-data-exfiltrated-during-cyber-attack.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://ia.acs.org.au/article/2020/anglicare-hit-by-ransomware.html"}],"summary":"About 17GB of data has been exfiltrated from Anglicare Sydney, a Christian not-for-profit that supports people across the greater Sydney and Illawarra regions, to a remote location during a ransomware attack, according to a statement put out by the organisation.  But in the same ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-08-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ff050612508898ac3cd77a91305360cd94baf12","impact_type":"data_theft","incident_date":"2020-05-13","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/APA%20Security%20Incident%20Sample%20Notice%20Template.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"ca8e83eb2232","org_name":"American Payroll Institute","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in APA’s content management system allowed a skimmer to be installed on the website’s login page and online store checkout.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193589"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/APA%20Security%20Incident%20Sample%20Notice%20Template.pdf"}],"summary":"A skimming attack accessed login credentials, payment card information, and other personal information through skimmers installed on the APA website login page and online store checkout.","supporting_quote":"The source of the cyberattack is thought to have been a vulnerability in APA’s content management system, which allowed a “ski mmer” to be installed on both the login webpage of the APA website, as well as the checkout section of APA’s online store.","technology_involved":["content management system","APA website","APA online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-28","discovered_date":"2020-05-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bde06ad1a58f8d0d9fc7516a7445a52f79786956","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F7344_Williams%20Hart%20Boundas%20Easterby_L06_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"8344c30b8273","org_name":"Williams Hart Boundas Easterby LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F7344_Williams%20Hart%20Boundas%20Easterby_L06_SAS_PROOF.pdf"}],"summary":"An unauthorized individual accessed a firm email account containing documents with sensitive personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-28","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c90d7028e08a0cda542d5765fdd5f0f47ac9e736","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10269.pdf"},"notes":null,"org_country":"US","org_id":"d1d972741d44","org_name":"University of Alaska Foundation","org_type":"nonprofit","ransomware":true,"records_affected":6586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10269.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10269.pdf"}],"summary":"The University of Alaska Foundation reported that personal information potentially held by Blackbaud may have been accessed and exfiltrated during a ransomware incident.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47d869a256e8c256cef5feb01c51da9cc85658b3","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JGI%20Donor%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"1dc747d118c0","org_name":"The Jane Goodall Institute","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193569"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JGI%20Donor%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Jane%20Goodall%20Institute-2020-08-28"}],"summary":"The Jane Goodall Institute reported that donor and prospective donor information was obtained in a ransomware attack on its vendor, Blackbaud.","supporting_quote":"We're reaching out to let you know that the Jane Goodall Institute was notified of a data security incident at one of our vendors, Blackbaud.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2020-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"331feed36877f1873198ffcbaf9308d85fd6b9af","impact_type":"data_theft","incident_date":"2020-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PULAU%20-%20Individual%20Notification%20Letter%20-%20General%20Population.pdf"},"notes":null,"org_country":"US","org_id":"80d6f2fce29e","org_name":"PULAU Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193554"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PULAU%20-%20Individual%20Notification%20Letter%20-%20General%20Population.pdf"}],"summary":"PULAU Corporation reported that an unauthorized party accessed systems and acquired employment-related records containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6309902e1362c34b48898ee3d0160890eccda7d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20200827%20-%2027848%20MLM%20Print%20LTRs%20proof%20%28final%29.pdf"},"notes":null,"org_country":"US","org_id":"6330409eb187","org_name":"Mechanics Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20200827%20-%2027848%20MLM%20Print%20LTRs%20proof%20%28final%29.pdf"}],"summary":"A hard drive missed during a computer donation contained CRB Auto loan documentation, but Mechanics Bank determined it had not been shared with an unknown third party.","supporting_quote":null,"technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-28","discovered_date":"2020-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c80749b5a845d674cb6dc5dd693e4b24d62e5944","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10270.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b5e347e52672","org_name":"Jane Goodall Institute","org_type":"nonprofit","ransomware":true,"records_affected":1082,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10270.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/JaneGoodallInstitute.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10270.pdf"}],"summary":"A ransomware attack on Blackbaud systems exposed personal information about Jane Goodall Institute donors and prospective donors.","supporting_quote":"On or about July 22, 2020, it came to JGI’s attention that in May 2020, Blackbaud, a vendor that supports JGI’s fundraising and engagement efforts, experienced a ransomware attack on systems that contained information of a number of its nonprofit clients.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2020-08-28","discovered_date":"2020-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b76d8a53d85635cf6d1e4d08c8c0f2b92fb69fc7","impact_type":"both","incident_date":"2020-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amphastar%20Sample%20Individual%20Notification%20Letter%20%28CA%29%20%28082720%29.pdf"},"notes":null,"org_country":"US","org_id":"1d711982cf69","org_name":"Amphastar Pharmaceuticals","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amphastar%20Sample%20Individual%20Notification%20Letter%20%28CA%29%20%28082720%29.pdf"}],"summary":"Amphastar Pharmaceuticals reported a May 2020 ransomware attack related to company data and personal information later posted online without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f286ac3e1af4388cd8e881d63eff85c80dcf38ea","impact_type":"unknown","incident_date":"2019-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/9060310.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c112b84e0de5","org_name":"AliMed, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193537"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AliMed%2C%20Inc.-2020-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82c8456b1db8593496c2df0ac2353b3ceaf19fea","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10267.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"acdf82b2440a","org_name":"University of Puget Sound","org_type":"education","ransomware":true,"records_affected":1429,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10267.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10267.pdf"}],"summary":"The University of Puget Sound reported that constituent information held by its service provider Blackbaud was involved in a ransomware attack.","supporting_quote":"A portion of your information on file with the university – not including social security numbers, bank account information, passwords, or credit and debit card information – was involved in a recent ransomware attack targeting Blackbaud.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dad803df011a7d7df3cb00441336e34edea66e17","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10266.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6dec950cf535","org_name":"The Omicron Delta Kappa Society and Educational Foundation, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":1753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10266.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10266.pdf"}],"summary":"The organization reported that an unknown third party potentially accessed personal information, including names, addresses, dates of birth, contact information, employment information, and marital status.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d146421455ce1eebc09bb09a52099591813cc94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b9150560-de73-11eb-92f2-17e9027f1a94"},"incident_date":"2020-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"031529174565","org_name":"Planned Parenthood of Metropolitan Washington DC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/dc-md-va/2021/04/16/data-breach-planned-parenthood-dc/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.plannedparenthood.org/planned-parenthood-metropolitan-washington-dc/who-we-are/reports-financials/notice-our-patients-regarding-cyber-incident"}],"summary":"Planned Parenthood of Metropolitan Washington, D.C., on Friday revealed it had a breach of patient and donor information last fall.  In a notice posted to its website, the organization revealed that it found “unusual” activity on its networks on Sept. 3. At that time, it began se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9a478be8bfa966dcabfdb5f904ecf86b4aa145a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lemoore.Email_.Notification.final_.pdf"},"notes":null,"org_country":"US","org_id":"b3777bbc63b7","org_name":"Lemoore Union High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the Aeries software was successfully exploited, allowing access to student and parent information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193515"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lemoore.Email_.Notification.final_.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the Aeries Student Information System and may have accessed student and parent information.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual attempted to exploit a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical"],"disclosed_date":"2020-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd7662d9106fe306fee7ca7fd267e6c4f526e058","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c0c53470-09a7-11eb-92b1-f7181081a05e"},"incident_date":"2020-08-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1db59a44fe2e","org_name":"Manitoba Children's Disability Services","org_type":"healthcare","ransomware":null,"records_affected":9001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/manitoba/privacy-breach-manitoba-families-childrens-disability-services-1.5703482,https://www.insurancebusinessmag.com/ca/news/cyber/manitoba-governments-email-error-leads-to-potential-data-breach-232144.aspx"}],"summary":"government leaks 9000 pII records by email accidentally","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdc4183609417511c3a6b5c8163c5926e097c680","impact_type":"data_theft","incident_date":"2020-05-20","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crystal%20Stairs%2C%20Inc%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"3978cad4f586","org_name":"Crystal Stairs, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193480"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crystal%20Stairs%2C%20Inc%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"A cybercriminal may have accessed or acquired Crystal Stairs stakeholder data held in Blackbaud systems.","supporting_quote":"Following its investigation, Blackbaud notified Crystal Stairs that the cybercriminal may have accessed or acquired Blackbaud customer data, before Blackbaud locked them out on May 20, 2020.","technology_involved":["Blackbaud systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbd0a2fc39e095c6536343764537bb994e3436c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%20-%20California%20Notification%20Letter%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"c4c550f3832b","org_name":"Combe Incorporated","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193479"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%20-%20California%20Notification%20Letter%20-%20Redacted.pdf"}],"summary":"Combe Incorporated reported that unauthorized code on its website checkout page may have collected customers’ personal and credit card information.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-25","discovered_date":"2020-01-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06dff07aa40a93e4f55398b3a694c3bda0e23358","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Westcor%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"b8f255964f9b","org_name":"Westcor Land Title Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193450"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Westcor%20-%20Notice%20of%20Data%20Event.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Westcor%20Land%20Title%20Insurance%20Company-2020-08-25"}],"summary":"Westcor reported that malware partially impacted its network and an unauthorized individual accessed a database containing names and associated personal information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-25","discovered_date":"2020-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8ab644b770ef08865eeec8be0096ee295e2d1fd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58f5737faab0","org_name":"Orenco Systems, Inc.","org_type":"unknown","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Orenco%20Systems%2C%20Inc.-2020-08-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-25","discovered_date":"2020-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c245ed4bd28c1dbf1875f68f126425914770e00","impact_type":"data_theft","incident_date":"2020-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BF%20-%20L01.pdf"},"notes":null,"org_country":"US","org_id":"567f42824ff8","org_name":"Brown-Forman Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BF%20-%20L01.pdf"}],"summary":"Brown-Forman reported that cyber criminals stole employee and dependent records containing personal and salary-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-24","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b058168c21b1432c285169549efcdcac770fdfb","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10263.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"59e5ef0a856c","org_name":"Southern New Hampshire University","org_type":"education","ransomware":true,"records_affected":1826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10263.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10263.pdf"}],"summary":"Southern New Hampshire University reported that a cybercriminal removed a backup file containing personal and philanthropic giving information from Blackbaud systems.","supporting_quote":"The investigation concluded that the cybercriminal removed data from Blackbaud’s systems sometime between February 7, 2020 and May 20, 2020.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2020-08-24","discovered_date":"2020-08-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25eb7dd2d35c695a9276713a47efaba38c574897","impact_type":"data_theft","incident_date":"2020-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10258.pdf"},"notes":null,"org_country":"US","org_id":"ccdec598978c","org_name":"Pruitt-Hamm Law and Mediation Services","org_type":"professional_services","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10258.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10258.pdf"}],"summary":"An unknown hacker accessed the Firm bookkeeper’s email program and forwarded outgoing email, exposing personal information for two staff members.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"765d3d6967e3786328634a27659ff8e1ad7b4de3","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10262.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"56dd8befa515","org_name":"Planned Parenthood of the Great Northwest and the Hawaiian Islands","org_type":"nonprofit","ransomware":true,"records_affected":60813,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10262.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10262.pdf"}],"summary":"Planned Parenthood of the Great Northwest and the Hawaiian Islands reported that donor information stored with Blackbaud was taken during a ransomware cyberattack.","supporting_quote":null,"technology_involved":["Blackbaud fundraising and donor engagement software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-24","discovered_date":"2020-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efa3b5561d62961b772e80b36e4e03dd2976d566","impact_type":"both","incident_date":"2020-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arbiter%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"53694001547e","org_name":"ArbiterSports","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193406"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arbiter%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ArbiterSports%2C%20LLC-2020-08-24"}],"summary":"ArbiterSports reported that an unauthorized party obtained a backup database containing user information and demanded payment to delete the files after the company prevented system encryption.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-24","discovered_date":"2020-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b17c3f3cdaadb330af3cacefbcd634f32868f016","impact_type":"both","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10199.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1b7fe4e18ff2","org_name":"Arbiter Sports","org_type":"technology_saas","ransomware":true,"records_affected":8052,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10199.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ArbiterSports.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10199.pdf"}],"summary":"Arbiter Sports reported that an unauthorized party obtained a backup database containing user information and attempted to encrypt systems before demanding payment.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea81f1e5d73df8799e716636dcf264f9fb71bb2e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10261.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d5c194af47f","org_name":"West Virginia University Foundation","org_type":"unknown","ransomware":null,"records_affected":1015,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10261.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f47ba75b582c8c19ebe57e794d64355ce7aa90c0","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10260.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2ea14a9800c6","org_name":"National Parks Conservation Association","org_type":"nonprofit","ransomware":true,"records_affected":12640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10260.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10260.pdf"}],"summary":"National Parks Conservation Association reported that Blackbaud notified it of a ransomware incident in which a cybercriminal removed backup files that may have contained personal information.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-21","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f478de3adf1d11bb4d9b2d6133c267f260ac6f91","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10257.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ff2e9f55ec13","org_name":"Heifer International","org_type":"nonprofit","ransomware":true,"records_affected":4026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Heifer%20Project%20International-2020-08-21"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10257.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/HeiferInternational.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10257.pdf"}],"summary":"Heifer International reported that an unknown actor may have accessed or acquired customer data held in Blackbaud’s system during a ransomware incident.","supporting_quote":null,"technology_involved":["Blackbaud","customer relationship management database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-21","discovered_date":"2020-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3a53a924e2942cb7c67913aaaafe4d25d40c201","impact_type":"both","incident_date":"2020-06-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EOFCU%20Ad%20CA%20CM%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"ef2acd4304f4","org_name":"Energy One Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193375"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EOFCU%20Ad%20CA%20CM%20r2prf.pdf"}],"summary":"Energy One Federal Credit Union reported unauthorized encryption of files and said an actor may have accessed files containing member information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21f3ea8b6ba78a003daf150edbfa5f0eb852c7fb","impact_type":"unknown","incident_date":"2020-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Cetera%20-%20California%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6d3a581190d4","org_name":"Cetera Financial Group, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193366"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad9ad8ed8e00d39a5d6b21f9807d046da3ef95af","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10255.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f116a9157bda","org_name":"Boy Scouts of America","org_type":"unknown","ransomware":null,"records_affected":981068,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10255.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-20","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"06fc750da9bc3e0b8d6003f633c1831ad0f5fe8f","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10254.pdf"},"notes":null,"org_country":"US","org_id":"bd6de2482e53","org_name":"UWM Foundation","org_type":"nonprofit","ransomware":true,"records_affected":1357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10254.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10254.pdf"}],"summary":"A ransomware incident at Blackbaud involved encryption of some of its systems and exfiltration of data that may have included UWM Foundation personal information.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-08-20","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dfa09eb2cfcf2cf381639f47b2773bb055c3b26","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20to%20Individuals%20%28Sample%20Copy%29.pdf"},"notes":null,"org_country":"US","org_id":"0e9b3c14eef4","org_name":"Saint Luke's Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193317"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20to%20Individuals%20%28Sample%20Copy%29.pdf"}],"summary":"Saint Luke's Foundation said Blackbaud's ransomware incident involved removal of a backup file that may have contained personal and limited medical information.","supporting_quote":"On July 16, 2020, we were notified by one of our third-party vendors, Blackbaud, that it had experienced a security incident potentially involving certain limited information it obtained from SLF.","technology_involved":["Blackbaud","constituent relationship management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-20","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cb3466ce31382aba363b22b71ec53796cace1616","impact_type":"unknown","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08981d86a638","org_name":"Richard J. Caron Foundation","org_type":"unknown","ransomware":null,"records_affected":22296,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Richard%20J.%20Caron%20Foundation-2020-08-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13751f0f7247405abcd996ca85997731bc987abd","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F6968_Revised_TLLAX%20-%20Cyber%20-%20Template%20notification%20letter%20%28DRAFT%2020200804%29_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"fbdbdce85ead","org_name":"Pacific Huntington Hotel Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack enabled unauthorized access to an employee's mailbox.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193314"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F6968_Revised_TLLAX%20-%20Cyber%20-%20Template%20notification%20letter%20%28DRAFT%2020200804%29_SAS_PROOF.pdf"}],"summary":"A phishing attack gave a third party access to an employee's mailbox at Pacific Huntington Hotel Corporation, where emails and attachments contained personal and financial information.","supporting_quote":"On 28 April 2020, The Langham, Huntington, Pasadena confirmed that t hrough a phishing attack, a third party gained unauthorised access to the mailbox of an employee of the hotel on April 10, 2020 and had access to the mailbox for approximately two weeks.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-08-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"605513904dac485059dc90229697c4b7f0992390","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32d47ba0-7494-11eb-b6c3-130fdd35ca3d"},"incident_date":"2020-08-20","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"7ecc20fc0862","org_name":"Freepik","org_type":"technology_saas","ransomware":null,"records_affected":8300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/free-photos-graphics-site-freepik-discloses-data-breach-impacting-8-3m-users/"}],"summary":"The Freepik Company has disclosed a data breach impacting the login information of more than 8 million Freepik and Flaticon users.  According to a press release, the security incident was the result of a SQL injection in Flaticon, one of the world’s largest databases of free cust","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-20","discovered_date":"2020-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8b1e16084fdb7107211aced4600a42711813493","impact_type":"data_theft","incident_date":"2020-06-23","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20notice%20to%20customers.pdf"},"notes":null,"org_country":"US","org_id":"97f3b6384763","org_name":"Dave, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A breach at a former third-party service provider enabled an unauthorized party to gain temporary access to Dave's systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193343"},{"fetched_at":null,"title":"Have I Been Pwned: Dave","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dave"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20notice%20to%20customers.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dave%2C%20Inc.-2020-08-20"}],"summary":"A breach at a former third-party service provider enabled an unauthorized party to access Dave's systems and steal customer data.","supporting_quote":"As a result of a breach at a former third-party service provider, an unauthorized party illegally accessed and stole certain customer data at Dave between June 23 and July 1, 2020.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fbf21a616b092f099300465dcdecbc962d09758","impact_type":"data_theft","imported_from":null,"incident_date":"2020-07-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"e6f15474f9b2","org_name":"Utah Gun Exchange","org_type":"retail_ecommerce","ransomware":null,"records_affected":235233,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Utah Gun Exchange","type":"hibp","url":"https://haveibeenpwned.com/Breach/UtahGunExchange"}],"summary":"A breach of the Utah Gun Exchange website exposed personal information and password hashes that were later traded online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"259dd7c4543051e4287da560df521565e0af5eca","impact_type":"data_theft","imported_from":null,"incident_date":"2020-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IT","org_id":"1ac2695d1186","org_name":"Unico Campania","org_type":"transportation_logistics","ransomware":null,"records_affected":166031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Unico Campania","type":"hibp","url":"https://haveibeenpwned.com/Breach/UnicoCampania"}],"summary":"Unico Campania's website was hacked in August 2020, exposing 166,031 user records containing email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-19","discovered_date":"2020-07-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8404b19ed81b14fa89f7a5c928e582bcf2b8848","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F6848_Stockpile%20-%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c9a96b470e32","org_name":"Stockpile, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193217"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F6848_Stockpile%20-%20Breach%20Notification%20Letter.pdf"}],"summary":"Stockpile reported that an unauthorized person accessed a folder in its cloud environment that contained personal information, though it had no evidence the information was viewed or misused.","supporting_quote":null,"technology_involved":["cloud environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db274f31f4c2d1364c3c2adead8489a97868f1f3","impact_type":"unknown","incident_date":"2020-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SRJC%20Notification%20of%20Data%20Incident.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b3763aeb5e3","org_name":"Santa Rosa Junior College Foundation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193257"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-19","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"32dbff030b89f2f3a72f909e3a36be131b015934","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10252.pdf"},"notes":null,"org_country":"US","org_id":"ec533ed9e75c","org_name":"Ronald McDonald House Charities","org_type":"nonprofit","ransomware":true,"records_affected":911,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10252.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10252.pdf"}],"summary":"Ronald McDonald House Charities said Blackbaud notified it of a ransomware attack in which attackers removed a backup containing donor information.","supporting_quote":"On July 16, 2020, RMHC was notified by its third-party service provider, BlackBaud, Inc. (BlackBaud), that Blackbaud had experienced a ransomware attack in May 2020.","technology_involved":["Blackbaud","backup"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-19","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"087aedfedc96618bce4c1e57916f9db38c62a86c","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10251.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"f31b334f577d","org_name":"California Lutheran University","org_type":"education","ransomware":true,"records_affected":3549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10251.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10251.pdf"}],"summary":"A ransomware attack on Blackbaud exposed Cal Lutheran data that potentially included names, dates of birth, and mailing addresses.","supporting_quote":"Cal Lutheran learned on July 26, 2020, that your data may have been at issue in a ransomware attack on one of Cal Lutheran’s third-party service providers, Blackbaud.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-08-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f0aaa5b6e609577da299fb56acae36363e99a00a","impact_type":"data_theft","incident_date":"2020-05-13","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10250.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"05dec8d9308d","org_name":"American Payroll Association","org_type":"nonprofit","ransomware":null,"records_affected":548,"reviewed":false,"root_cause":"A vulnerability in the APA content management system was thought to have allowed a skimmer to be installed on the login webpage and online store checkout.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10250.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10250.pdf"}],"summary":"The American Payroll Association reported that a vulnerability in its content management system was thought to have allowed a skimmer to access personal, login, and payment card information.","supporting_quote":"The source of the cyberattack is thought to have been a vulnerability in APA’s content management system, which allowed a “skimmer” to be installed on both the login webpage of the APA website, as well as the checkout section of APA’s online store.","technology_involved":["content management system","APA website","APA online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a975d62484a700606ba7cec3239761914c765da","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10249.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d45d97d0859","org_name":"University of South Carolina","org_type":"unknown","ransomware":null,"records_affected":1994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10249.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/UniversityofSouthCarolina.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f206f6829c4f9d712a2e1c4fe995712b65be470","impact_type":"data_theft","imported_from":null,"incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"54e59e205dc9","org_name":"Catho","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Catho","type":"hibp","url":"https://haveibeenpwned.com/Breach/Catho"}],"summary":"Catho’s website was compromised around March 2020, exposing names, email addresses, usernames, and plain-text passwords.","supporting_quote":null,"technology_involved":["Catho website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-17","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"79e5d9e43dc9680c4187fd7a431360a4671e559f","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10248.pdf"},"notes":null,"org_country":"US","org_id":"9b3e48a24f2c","org_name":"Washington State University Foundation","org_type":"nonprofit","ransomware":true,"records_affected":334219,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10248.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10248.pdf"}],"summary":"Copies of backup files containing WSU Foundation personal information were removed during a ransomware attack on Blackbaud, its third-party service provider.","supporting_quote":null,"technology_involved":["Blackbaud platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-17","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a8560b2284ef8cf8e2bb6a08e59a1b2a4b558ff","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/9028629.PDF"},"notes":null,"org_country":"US","org_id":"80128fd249ab","org_name":"University of Detroit Mercy","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193131"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/9028629.PDF"}],"summary":"A cybercriminal removed a backup file containing personal information from Blackbaud systems, and Blackbaud paid the attacker to ensure the file was destroyed.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-17","discovered_date":"2020-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6a4fa667bcf20c45ffed692260a1ca55d2eda1b1","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10247.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2c89a3967295","org_name":"Phi Kappa Psi Fraternity","org_type":"nonprofit","ransomware":true,"records_affected":677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10247.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10247.pdf"}],"summary":"Intruders removed donor data for the Phi Kappa Psi Foundation from Blackbaud’s platform during a ransomware attack.","supporting_quote":"During the attack, the intruders removed files from Blackbaud’s platform, which hosted data for hundreds of colleges, universities, health care organizations, schools, charities and other non-profit organizations, including the Phi Kappa Psi Foundation.","technology_involved":["Blackbaud","customer relationship management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-17","discovered_date":"2020-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba47d601531a8d0d622a3d661a98c3c7a0c89ea5","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10246.pdf"},"notes":null,"org_country":"US","org_id":"45d7108329fb","org_name":"Mammoth Media, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10246.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10246.pdf"}],"summary":"An unauthorized individual may have accessed Wishbone’s database using stolen credentials, exposing user profile information and hashed passwords.","supporting_quote":"On May 20, 2020, our team became aware of a security issue where we believe an unauthorized individual may have had access to Wishbone’s database through stolen credentials.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-17","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a543b0a72eb71d52d575364c80a1ebd5550faa1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10245.pdf"},"notes":"initial_access set without supporting_quote; reset to unknown; records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"8f46792fe368","org_name":"Gonzaga Preparatory School","org_type":"education","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10245.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10245.pdf"}],"summary":"Gonzaga Preparatory School reported that personal information stored on Blackbaud’s Raiser’s Edge platform was exposed to or acquired by unauthorized individuals.","supporting_quote":null,"technology_involved":["Blackbaud","Raiser’s Edge"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3925104bcd91fdbca046313e70d6b60992c914d","impact_type":"data_theft","incident_date":"2020-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dynasplint%20Systems%20Inc.%20-%20California%20Consumer%20Notification%20Template%204848-3746-4775%20v.1.pdf"},"notes":null,"org_country":"US","org_id":"610471bc1449","org_name":"Dynasplint Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193150"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dynasplint%20Systems%20Inc.%20-%20California%20Consumer%20Notification%20Template%204848-3746-4775%20v.1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10214.pdf"}],"summary":"Dynasplint Systems reported that customer information, including names, addresses, dates of birth, and medical information, was accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cddc39f0e6455f933aafd565debdc8954818c49d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10244.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61600f971e07","org_name":"Colby College","org_type":"unknown","ransomware":null,"records_affected":606,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10244.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8ea1982ecccfc19f57bed8868c5346a4292f39b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-03-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IIN%20--%20Sample%20Notice%20of%20Data%20Breach%20%289005729x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"dc212564003c","org_name":"Institute for Integrative Nutrition","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IIN%20--%20Sample%20Notice%20of%20Data%20Breach%20%289005729x7AB84%29.pdf"}],"summary":"A phishing incident may have provided an unauthorized party access to an Institute for Integrative Nutrition employee email account.","supporting_quote":"As a result of a phishing incident, an unauthorized party may have obtained access to one IIN employee email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"564de6ed2e169ad9a0bc460abd00f6ae7a631a06","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10243.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"39161d0f13da","org_name":"Excelsior College","org_type":"unknown","ransomware":null,"records_affected":4069,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10243.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9fb3d52837c654df5ecdbfabb05a124d93d77374","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10242.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e05edfafdc09","org_name":"Washington State Department of Social And Health Services","org_type":"unknown","ransomware":null,"records_affected":648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10242.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d59ee3ffbc89c887c0150c0505240d70595b39a9","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10241.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab2afa22d9ff","org_name":"University of Minnesota Foundation","org_type":"unknown","ransomware":null,"records_affected":6460,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10241.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"48f5a7993a6ba8be31ec40369896bf277f855aa5","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10240.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9d9062cf9673","org_name":"The Greater Boston Food Bank","org_type":"nonprofit","ransomware":true,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10240.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10240.pdf"}],"summary":"Blackbaud reported a ransomware attack in which a cybercriminal removed a copy of data that included personal information held for The Greater Boston Food Bank.","supporting_quote":null,"technology_involved":["Blackbaud","customer relationship management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1c2c0103b3bb5d0cdb36670fe2962ed0a5c3de43","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10239.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbb8c6f1bb42","org_name":"St. Joseph School","org_type":"education","ransomware":true,"records_affected":5142,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10239.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10239.pdf"}],"summary":"A cybercriminal removed a backup copy of St. Joseph School donor information maintained by Blackbaud during a ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"93de2ff4a238cfbc046207826e68adfa46ae1fc7","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10238.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3302a2ecef07","org_name":"ShelterBox USA","org_type":"nonprofit","ransomware":true,"records_affected":778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10238.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10238.pdf"}],"summary":"A ransomware attack on Blackbaud resulted in the removal of a backup copy of ShelterBox USA donor information maintained by Blackbaud.","supporting_quote":"According to Blackbaud, the cybercriminal removed a backup copy of donor information that Blackbaud maintained for us.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1c16a823b396fd8b01f4a31a63454cfb87ddc785","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10237.pdf"},"notes":null,"org_country":"US","org_id":"3d2112b3680f","org_name":"Save the Children","org_type":"nonprofit","ransomware":true,"records_affected":47465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10237.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10237.pdf"}],"summary":"A hacker accessed a backup of Save the Children’s supporter database held on Blackbaud’s system, copied data, and Blackbaud paid a ransom for its deletion.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba1b8032dd28fbf42484992287ce6994da7416ec","impact_type":"disruption_or_ransomware","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10236.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"81fb2f5d9c10","org_name":"Portland Community College Foundation","org_type":"nonprofit","ransomware":true,"records_affected":17908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10236.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10236.pdf"}],"summary":"A ransomware attack at Blackbaud may have exposed personal and donation-related information held for the Portland Community College Foundation.","supporting_quote":"The incident occurred at a company known as Blackbaud, which is one of the largest donor management software companies serving non-profits, including the PCC Foundation.","technology_involved":["Blackbaud donor management software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6064a033469b7f3eeb0ad61a04c2be97fa1b1ae8","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10235.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"94b901ed42be","org_name":"Planned Parenthood of the Columbia Willamette, Inc.","org_type":"healthcare","ransomware":true,"records_affected":2866,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10235.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10235.pdf"}],"summary":"Planned Parenthood of the Columbia Willamette reported that donor data was removed during a ransomware attack on Blackbaud, which held the information.","supporting_quote":"We’re reaching out today to let you know that Planned Parenthood Columbia Willamette was recently notified of a data breach at Blackbaud, a vendor whose fundraising and donor engagement software is used by nonprofit organizations nationwide.","technology_involved":["Blackbaud fundraising and donor engagement software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1ab7a5ca7e0fa53a9570c9e1affc8363ac4e5a1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5adf0d10-e968-11eb-9aea-07892f56ef76"},"incident_date":"2020-08-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e45084496272","org_name":"One Workplace","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/One%20Workplace%20employee%20notification%20letter%28FINAL%29.pdf"}],"summary":"One Workplace experienced a ransomware attack that resulted on various personal customer data being taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":"2019-10-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcbfb0c14f291fa4e4297c133adb2678104d5027","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NRI%20Distribution%20Ad%20CA%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"9cd64dfc82a6","org_name":"NRI USA, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NRI%20Distribution%20Ad%20CA%20r2prf.pdf"}],"summary":"NRI USA, LLC determined that two corporate email accounts were accessed and personal information may have been exposed during an attempted payment diversion.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"521d890a670d9a3275779e1f51beeb3afcd522ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10234.pdf"},"notes":null,"org_country":"US","org_id":"e0b02d3d28ea","org_name":"Metropolitan State University Denver Foundation","org_type":"nonprofit","ransomware":true,"records_affected":1235,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10234.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10234.pdf"}],"summary":"A ransomware event at Blackbaud potentially exposed personal information maintained for the Metropolitan State University Denver Foundation.","supporting_quote":"On July 16, 2020, MSU Denver Foundation’s third-party vendor, Blackbaud, informed it that, in May 2020, Blackbaud suffered a ransomware event which resulted in potential unauthorized access and acquisition to certain information maintained by Blackbaud.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-08-14","discovered_date":"2020-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ec5b018488ca63068d8c6602bad75fccb31be0b","impact_type":"disruption_or_ransomware","incident_date":"2020-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MCCKC%20-%20CA%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"9ad87700b6dc","org_name":"Metropolitan Community College of Kansas City","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193104"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MCCKC%20-%20CA%20Notice%20of%20Data%20Event.pdf"}],"summary":"Metropolitan Community College of Kansas City reported a ransomware attack that encrypted data and may have exposed personal, medical, and financial information, with no evidence that information was extracted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f3f905357ef42c2626aa4a51e25b158e0f29188","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10233.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4df355099007","org_name":"March of Dimes","org_type":"nonprofit","ransomware":true,"records_affected":446097,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10233.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10233.pdf"}],"summary":"Intruders removed files containing March of Dimes donor data from Blackbaud’s platform during a ransomware attack.","supporting_quote":null,"technology_involved":["Blackbaud platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"831f5c6214f3de5440dcabf6a05cea27fb9bdbbe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98cb1610-01a5-11eb-b177-5f49668a9776"},"incident_date":"2020-08-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"379c144128c8","org_name":"Global Tel Link","org_type":"technology_saas","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.macobserver.com/link/telmate-data-leak/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.techtimes.com/articles/252301/20200905/beware-11-million-inmates-personal-convos-with-their-families-leaked-telmate-exposes-their-contacts-data-online.htm"}],"summary":"Telmate, a service used by incarcerated inmates at US prisons to communicate with their friends and loved ones, has exposed a database containing tens of millions of call logs, private messages, and personal information about inmates and their contacts. The database was exposed o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-20","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"765aabaf17120085d02b909f0ac3c2b97a1b4dd4","impact_type":"data_theft","incident_date":"2019-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FiltersFast_%20CA%20AG%20Notification%28602315182.2%29.pdf"},"notes":null,"org_country":"US","org_id":"5a7e34402866","org_name":"Filters Fast LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193082"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FiltersFast_%20CA%20AG%20Notification%28602315182.2%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Filters%20Fast%20LLC-2020-08-14"}],"summary":"Attackers added malicious code to the FiltersFast.com website that captured customer information during checkout.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-14","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"039582769e2049d1f251f62e47916e6edeebc1f1","impact_type":"both","imported_from":null,"incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10231.pdf"},"notes":null,"org_country":"US","org_id":"16b56c0c6d6f","org_name":"EMILY's List","org_type":"nonprofit","ransomware":true,"records_affected":9325,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10231.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10231.pdf"}],"summary":"Attackers obtained files containing EMILY’s List donor information from Blackbaud, including personal and financial information, and demanded payment to delete the data.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d8a2671751cb51f91df9cdd90189885cb2e5179a","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10230.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e933bf83dc9","org_name":"Denver Dumb Friends League","org_type":"unknown","ransomware":null,"records_affected":655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10230.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"645ffdb8e5ecff255451e0148ce243d69ec5fa88","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_5.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20412e00d000","org_name":"Construction Bidboard, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193121"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b2bd79d63baa54a7c832d9ddc3031c6dd4897916","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10229.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07d50dd9f869","org_name":"Confluence Health Foundation","org_type":"unknown","ransomware":null,"records_affected":1132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10229.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3edb8bd47b146616e2d095115effa5dd02fb93ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10228.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e15eef264119","org_name":"Boston University","org_type":"unknown","ransomware":null,"records_affected":7067,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10228.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bc72134db1923c0777cc1d1d5791a859a459fc84","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10227.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cbc35cb04d2e","org_name":"Bishop Blanchet High School","org_type":"education","ransomware":true,"records_affected":3162,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10227.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10227.pdf"}],"summary":"Bishop Blanchet High School said a ransomware attack at Blackbaud resulted in the removal of a backup copy of donor information.","supporting_quote":"We understand the cybercriminal removed a backup copy of donor information that Blackbaud maintained for us.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7df46a70a6f341c93e28d4a42aa0ab8d14303e7","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10226.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"69da2b76664a","org_name":"Assumption St. Bridget School","org_type":"education","ransomware":true,"records_affected":769,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10226.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10226.pdf"}],"summary":"Blackbaud notified Assumption St. Bridget School that a ransomware attack removed a backup copy of donor information it maintained for the school.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"42f5b6d929ca6a1b492f94451b6483d5c4a4c991","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10225.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f774195e518a","org_name":"American Civil Liberties Union, Inc.","org_type":"nonprofit","ransomware":true,"records_affected":86269,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10225.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10225.pdf"}],"summary":"An intruder accessed and copied supporter information stored for the ACLU on Blackbaud’s systems and demanded a ransom.","supporting_quote":"The intruder accessed and copied a subset of data stored on Blackbaud’s systems and demanded a ransom payment in exchange for destroying that information.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ee91243fc2784ce295ee925b2439aaadeb4de39","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20re%20Data%20Breach-Package%20A.pdf"},"notes":null,"org_country":"US","org_id":"4d82f64caaca","org_name":"Prostate Cancer Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20re%20Data%20Breach-Package%20A.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Prostate%20Cancer%20Foundation-2020-08-13"}],"summary":"A cybercriminal removed a copy of the Prostate Cancer Foundation’s backup file from a third-party service provider during a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-13","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"04802014fbe8cd201b0b64b2ed9871058c3e8815","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10224.pdf"},"notes":null,"org_country":"US","org_id":"d24bd08bea18","org_name":"Hearing, Speech & Deaf Center","org_type":"nonprofit","ransomware":true,"records_affected":8441,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10224.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10224.pdf"}],"summary":"Hearing, Speech & Deaf Center reported that a ransomware attack at Blackbaud may have exposed donors’ names and birthdates.","supporting_quote":null,"technology_involved":["Blackbaud","fundraising and donor engagement software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3969b757dd6e32d6b0743f3819b6e2439f05eef8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20PINC2020.78%20Notification%202.pdf"},"notes":null,"org_country":"US","org_id":"6f6942384d5c","org_name":"Dyson, Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193035"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20PINC2020.78%20Notification%202.pdf"}],"summary":"Dyson reported that an incident outside the company affected its US website and provided third-party access to Dyson accounts, potentially compromising login details.","supporting_quote":null,"technology_involved":["Dyson US website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-12","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"41a751ee2660c471a76348d2d40d412772022af3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10223.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"133cebf813a9","org_name":"The University of Florida","org_type":"education","ransomware":null,"records_affected":5075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10223.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10223.pdf"}],"summary":"The University of Florida Foundation’s personal information was involved in an attack on Blackbaud systems.","supporting_quote":"On July 16, 2020, UF was notified of a security incident involving UF Foundation data by Blackbaud, a third-party vendor that helps the UF Foundation maintain current and accurate information about UF alumni.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-12","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95c4245eaf40608f40e25ca62a6c578482f98c1a","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10220.pdf"},"notes":null,"org_country":"US","org_id":"134e49ebf96c","org_name":"The Food Project","org_type":"nonprofit","ransomware":true,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10220.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10220.pdf"}],"summary":"A ransomware attack on Blackbaud resulted in the removal of a copy of donor data associated with The Food Project.","supporting_quote":null,"technology_involved":["Blackbaud","customer relationship management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-08-12","discovered_date":"2020-01-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92b416c7f03e8f5c3dc14ea2bd003700b4e34eb6","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PGIS%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d05a972a74f6","org_name":"Patriot Growth Insurance Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193034"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-193251"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PGIS%20Breach%20Letter.pdf"}],"summary":"An unknown actor used credentials to access two VBS employee email accounts containing emails and attachments with personal and medical information.","supporting_quote":"On January 17, 2020, the investigation determined that two (2) VBS employee email accounts had their account credentials being used by an unknown actor(s) to gain unauthorized access to each account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5914b434fc8aba176a82d391fcb89c5c760f03f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10219.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0f5c29aa930d","org_name":"Northeastern University","org_type":"education","ransomware":true,"records_affected":2602,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10219.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10219.pdf"}],"summary":"A Northeastern University backup file containing personal information was compromised in a ransomware attack on Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud","backup file"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195","T1485"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-12","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bcce5a612f3423e5b6f8982fc0e3c852036d389f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10218.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4894015c7798","org_name":"Mt. Baker Planned Parenthood","org_type":"nonprofit","ransomware":null,"records_affected":2367,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10218.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10218.pdf"}],"summary":"A cybercriminal accessed and destroyed a Blackbaud backup file that may have contained personal information provided by Mt. Baker Planned Parenthood.","supporting_quote":"Blackbaud informed MBPP that as part of the breach the cybercriminal accessed a backup file that we believe contained some of your personal information listed below that Blackbaud obtained from MBPP in connection with the service.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-11","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a7894dd9926df89d7cd0dcd2ae8fc324457ef4d","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10222.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f14a263017d7","org_name":"The Evergreen State College Foundation","org_type":"nonprofit","ransomware":true,"records_affected":40549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10222.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10222.pdf"}],"summary":"A ransomware attack on Blackbaud systems exposed copies of data associated with Evergreen donors.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-11","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d84378daf1f17c59afeae541a4b9ce95c3947fea","impact_type":"both","imported_from":null,"incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10221.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b140e6817da7","org_name":"The Evergreen State College","org_type":"education","ransomware":true,"records_affected":40549,"reviewed":false,"root_cause":"A vulnerability in Blackbaud's systems led to the incident.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10221.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10221.pdf"}],"summary":"The Evergreen State College reported that a ransomware attack on its data-management provider, Blackbaud, may have exposed personal information.","supporting_quote":"On July 16, Blackbaud informed us that in May 2020 they discovered—and stopped—a ransomware attack on their computer systems.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a10d9d3dcf3e645b88dd5563f8d807babbc6ce50","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10217.pdf"},"notes":null,"org_country":"US","org_id":"418a0ba7ba65","org_name":"Planned Parenthood of Tennessee and North Mississippi","org_type":"nonprofit","ransomware":true,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10217.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10217.pdf"}],"summary":"Planned Parenthood of Tennessee and North Mississippi reported that a ransomware attack at Blackbaud removed donor information stored on the vendor’s servers.","supporting_quote":"We’re reaching out today to let you know that Planned Parenthood of Tennessee and North Mississippi (PPTNM) was recently notified of a data breach at Blackbaud, a vendor whose fundraising and donor engagement software is used by nonprofit organizations nationwide.","technology_involved":["Blackbaud fundraising and donor engagement software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-10","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c00c33e5512e0054cc2ad20d7d50f54518dbc084","impact_type":"disruption_or_ransomware","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10216.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7b2afb71e100","org_name":"Wisconsin Evangelical Lutheran Synod","org_type":"nonprofit","ransomware":true,"records_affected":867,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10216.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10216.pdf"}],"summary":"Wisconsin Evangelical Lutheran Synod reported that a ransomware incident at its provider Blackbaud may have exposed personal and financial information.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85f3a6bf1fe243b0f4ce7692a266e2bdb19a6dae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd35fb20-0cd2-11eb-9ca0-972c112a0cb8"},"incident_date":"2020-08-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"6fc32bf4aa2e","org_name":"RailYatri","org_type":"other","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/travel-site-exposed-37m-records/,https://indianexpress.com/article/technology/tech-news-technology/7-lakh-railyatri-user-data-leaked-personal-payment-details-6570326/"}],"summary":"Security researcher find exposed elastic search database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-10","discovered_date":"2020-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62de70069fd8f926a3725b60016776561de2ed11","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRI-15674%20CA%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"188bacab9582","org_name":"Metropolitan Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192939"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRI-15674%20CA%20Individual%20Notification.pdf"}],"summary":"MetLife inadvertently emailed a report containing personal and premium refund information to an unrelated employer, whose benefits consultant notified MetLife and confirmed deletion.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"829ef6af63f0d81c5d1c5deec97b42ea5012d32f","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10215.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"39795dde65f6","org_name":"Heritage University","org_type":"education","ransomware":null,"records_affected":7803,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10215.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10215.pdf"}],"summary":"Heritage University notified people that personal information may have been compromised in a breach at third-party provider Blackbaud.","supporting_quote":"One of our third-party service providers recently experienced a data breach.","technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfc84d21b36c430759f24467e43f3267ab4c5ebd","impact_type":"unknown","incident_date":"2020-01-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/K%20-%20SSN%20Variable%20-%20Redacted%20%289016338-2x7AB84%29.pdf"},"notes":null,"org_country":"US","org_id":"aacafc210dda","org_name":"Dent Wizard International","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192974"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/K%20-%20SSN%20Variable%20-%20Redacted%20%289016338-2x7AB84%29.pdf"}],"summary":"A phishing incident may have allowed an unauthorized party to access a small portion of Dent Wizard employee email accounts.","supporting_quote":"As a result of a phishing incident, we have learned that an unauthorized party may have obtained acces s to a small portion of Dent Wizard employee email accounts between January 22, 2020 and February 4, 2020.","technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"29f2225d3b492c3c8eabfa2d86a70856dc60d222","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10213.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"83dc61403b6e","org_name":"Planned Parenthood of the Rocky Mountains","org_type":"nonprofit","ransomware":true,"records_affected":526,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10213.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10213.pdf"}],"summary":"Planned Parenthood of the Rocky Mountains reported that a ransomware attack on Blackbaud resulted in the removal of some donor information from the vendor’s servers.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-07","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ea0ac4f8135737e42f021776de5594c1eacbd54f","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10212.pdf"},"notes":null,"org_country":"US","org_id":"1c965416ee71","org_name":"Pacific Northwest University of Health Sciences","org_type":"education","ransomware":null,"records_affected":1122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10212.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10212.pdf"}],"summary":"Pacific Northwest University of Health Sciences reported that unauthorized individuals accessed personal information in its Blackbaud alumni and donor database.","supporting_quote":"One of our third-party service providers recently experienced a data breach.","technology_involved":["Blackbaud","third-party alumni and donor database system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-07","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f26198505d5e49ff14f9aea2506b93fb0483e66","impact_type":"both","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blackbaud%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"cfeef1853e5b","org_name":"Northwest Foundation, Inc.","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192817"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blackbaud%20Notification%20Letter.pdf"}],"summary":"A cybercriminal removed a copy of Northwest Foundation data from a Blackbaud database during a ransomware attack on a Blackbaud service provider.","supporting_quote":"The cybercriminal was unsuccessful in blocking access to the database involved in the attack, however, the cybercriminal was able to remove a copy of a subset of data from several of Blackbaud’s clients including data of Northwest Foundation.","technology_involved":["Blackbaud customer relationship management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd857f09bfc28429ef18a0c0e459ab249ae36cfa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60103b30-f6c8-11ea-b7b2-2361ceadc5c7"},"incident_date":"2020-08-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d7c908a9b15","org_name":"Shields Healthcare Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Developer accidentally published private repo for Shields Healthcare Group exposing credentials and patient data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7db29ff3b11fe53c89fab9c080964f02265329e6","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4fc134fe9e21","org_name":"ProctorU","org_type":"technology_saas","ransomware":null,"records_affected":444453,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ProctorU","type":"hibp","url":"https://haveibeenpwned.com/Breach/ProctorU"}],"summary":"ProctorU suffered a data breach in June 2020 involving 444,453 user records with personal information and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d59debfd896c3f0073de5bead6f25a1728bed0b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69de55e0-f1fd-11ea-9eb3-fb45745214a6"},"incident_date":"2020-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"20dee548ea8c","org_name":"Isetan Mitsukoshi Co., Ltd","org_type":"retail_ecommerce","ransomware":null,"records_affected":19000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dataguidance.com/news/japan-mitsukoshi-and-mi-card-announce-data-breach-affecting-approximately-19000-customers"}],"summary":"Isetan Mitsukoshi Co., Ltd and MI Card Co., Ltd announced, on 5 August 2020, that they had suffered a data breach affecting approximately 19,000 customers as a result of unauthorised access. In particular, MI Card noted that the data breach occurred on the Isetan Mitsukoshi Onlin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b93a2578bdd77347fb0ba1efb2021f84623ad40","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10211.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a53d7e06a0b0","org_name":"Cancer Research Institute","org_type":"unknown","ransomware":null,"records_affected":1312,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10211.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2020-08-04","discovered_date":"2020-04-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ba60b45cd0da2236646bb5fffb4fac4c238316ae","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10210.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"544714d65868","org_name":"Scholarship America","org_type":"nonprofit","ransomware":null,"records_affected":2620,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10210.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10210.pdf"}],"summary":"Scholarship America detected suspicious activity in its email system, and unauthorized access exposed information in accessed email accounts.","supporting_quote":null,"technology_involved":["email system","email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-04","discovered_date":"2020-04-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dea97c654c7fee833ed6d2164d73642743e5068a","impact_type":"data_theft","incident_date":"2020-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%201.%20Final%20Draft%207-10-20.pdf"},"notes":null,"org_country":"US","org_id":"99d395cf296f","org_name":"Romanazzi & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%201.%20Final%20Draft%207-10-20.pdf"}],"summary":"Romanazzi & Associates reported suspicious activity involving a workstation that captured tax software information, potentially affecting clients’ personal and tax-filing information.","supporting_quote":null,"technology_involved":["workstation","tax software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37f30a1b2754307844baa6ff84d021b39507de35","impact_type":"both","imported_from":null,"incident_date":"2020-05-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/bBackbaud%20notice.pdf"},"notes":null,"org_country":"US","org_id":"f2d78e4bde91","org_name":"Museum of Contemporary Art Santa Barbara","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/bBackbaud%20notice.pdf"}],"summary":"A ransomware attacker removed a copy of a Blackbaud eTapestry backup containing the museum’s data and Blackbaud paid the attacker’s demand.","supporting_quote":null,"technology_involved":["Blackbaud eTapestry"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f1bbe48a8f1f149353147bd2bf8dd1de3b0efcc","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bregante%20-%20Consumer%20Notification%20Letter%20-%20Phase%202%20%28no%20fraudulent%20returns%29%20-%20FINAL_Proof.pdf"},"notes":null,"org_country":"US","org_id":"fb42aa435ec8","org_name":"Bregante + Company, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bregante%20-%20Consumer%20Notification%20Letter%20-%20Phase%202%20%28no%20fraudulent%20returns%29%20-%20FINAL_Proof.pdf"}],"summary":"Bregante + Company, LLC reported that an unauthorized user could have accessed clients’ personal information, including tax-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","medical"],"disclosed_date":"2020-08-03","discovered_date":"2020-07-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"d9bce6ab5c2914ed2b6635a8ad1532bf5d024f7e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wurkforce%20-%20Consumer%20Notification%20Letter%20%28General%20SSN%29.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0ab8056720aa","org_name":"Wurkforce, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":4761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wurkforce%2C%20Inc.-2020-08-03"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wurkforce%20-%20Consumer%20Notification%20Letter%20%28General%20SSN%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10209.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wurkforce%20-%20Consumer%20Notification%20Letter%20%28General%20SSN%29.pdf"}],"summary":"Würk reported unauthorized access to certain employees’ email accounts, which may have contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7099fb085278fd14821f8b3c932fab43e37fcdf","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ID","org_id":"f377438df192","org_name":"Kreditplus","org_type":"financial","ransomware":null,"records_affected":896000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kreditplus","type":"hibp","url":"https://haveibeenpwned.com/Breach/Kreditplus"}],"summary":"Kreditplus suffered a June 2020 data breach exposing 896,000 records containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-08-03","discovered_date":"2020-06-05","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e141aa74557a7e2a7d008cb45ba7756dfc72ef1a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-06-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hoag%20Clinic%20Patient%20Notification%201%20-%20For%20CA%20AG.pdf"},"notes":null,"org_country":"US","org_id":"42eab7147305","org_name":"Hoag Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Hoag Clinic-issued laptop was stolen from a staff member’s vehicle.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hoag%20Clinic%20Patient%20Notification%201%20-%20For%20CA%20AG.pdf"}],"summary":"A Hoag Clinic-issued laptop containing patient information was stolen from a staff member’s vehicle.","supporting_quote":"On June 5, 2020, we discovered that on that same day, a Hoag Clinic-issued laptop was stolen from a staff member’s vehicle at a worksite parking lot in Newport Beach.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-03","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc81807bda39fa00ba9149fc85cd71e1a9522569","impact_type":"data_theft","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10208.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f133f4a75b36","org_name":"Americares Foundation","org_type":"nonprofit","ransomware":true,"records_affected":2444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10208.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10208.pdf"}],"summary":"A ransomware attack on Blackbaud resulted in the removal of a copy of data from Americares's customer relationship management system.","supporting_quote":null,"technology_involved":["Blackbaud","customer relationship management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-08-02","discovered_date":"2020-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"cb07fbb4dc21566e12d9d14a855cc23d458d9f96","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10349.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c1d2c4b2953a","org_name":"TrueFire LLC","org_type":"education","ransomware":null,"records_affected":2633,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TrueFire%20LLC-2020-10-27"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10349.pdf"},{"fetched_at":null,"title":"Have I Been Pwned: TrueFire","type":"hibp","url":"https://haveibeenpwned.com/Breach/TrueFire"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-195584"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TrueFire-%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10349.pdf"}],"summary":"An unauthorized actor accessed TrueFire’s network and certain information stored on it; TrueFire reported no known actual or attempted misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f41a46bc71ff2aa5958742eabfcad1776e75f03","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"KR","org_id":"036a8a5a019c","org_name":"집꾸미기","org_type":"retail_ecommerce","ransomware":null,"records_affected":1298651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 집꾸미기","type":"hibp","url":"https://haveibeenpwned.com/Breach/DecoratingTheHouse"}],"summary":"집꾸미기 suffered a data breach in March 2020, and member data was shared online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0de7c52a0634588607a9b0f36fa1b0f3e748a5ea","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"3ae8a2bc3d71","org_name":"Vakinha","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vakinha","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vakinha"}],"summary":"Vakinha suffered a data breach affecting 4,775,203 members, exposing personal information and passwords stored as bcrypt hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb1ce0c61ac82355195b357031c9f8647a4729ef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43702e60-2385-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6a4550882cf7","org_name":"Telstra","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/telstra-dns-falls-over-after-denial-of-service-attack/"}],"summary":"The attack kicked off some time before 10:30am on the Australian east coast.  \"Some of our Domain Name Servers (DNS) used to route your traffic online are experiencing a cyber attack, known as a Denial of Service (DoS),\" Telstra said on Twitter just before noon.  \"Your info isn't","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"255ba30b477a62724db75ebce844c36f7d2cd281","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eca17ad0-09ad-11eb-a175-e162319ad19d"},"incident_date":"2020-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"adf3813f27a2","org_name":"SSL247","org_type":"technology_saas","ransomware":null,"records_affected":350000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.informationsecuritybuzz.com/expert-comments/details-on-over-350000-ssl247-customers-exposed-due-to-misconfigured-aws-bucket/,https://cisomag.eccouncil.org/misconfigured-aws-s3-bucket/"}],"summary":"unsecured cloud file storage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fefc2ae37be5e77ebd2b437695cc7458e98d41e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6a090e0-05ad-11ec-a755-057d35a918cc"},"incident_date":"2020-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e46de92d21a5","org_name":"Sewell Family of Companies","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-sewell-family-of-companies-discloses-breach/"}],"summary":"Sewell Family of Companies discloses breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae3eca3a676408587d952e2f3d88d85b1b5025e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dfd87b10-f2aa-11ea-8781-7798bdcc4349"},"incident_date":"2020-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"9170b03b1dc5","org_name":"San Juan Argentina  Ministry of Public Health","org_type":"government","ransomware":null,"records_affected":115000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/life/health/argentina-exposes-covid-19-health-data-in-error/article/575797"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/argentina-exposes-covid-19-health-data-in-error/"}],"summary":"Argentina's health officials have apparently exposed personal medical data relating to some 115,000 COVID-19 quarantine exemption applicants, in what represents a major health sector data breach.  The novel coronavirus pandemic has resulted in more data being collected by nationa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2ec62dd5748596d09d71ac00ecb404a62ca1f92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f7d4040-0cc2-11ec-a2d0-f3cc343be99c"},"incident_date":"2020-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ca7073f01181","org_name":"NSW Police","org_type":"government","ransomware":null,"records_affected":156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gizmodo.com.au/2020/08/nsw-police-leaked-the-emails-of-everyone-who-complained-about-blm-protestors-being-pepper-sprayed/"}],"summary":"NSW Police Leaked the Emails of Everyone Who Complained About BLM Protestors Being Pepper Sprayed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37917efa1f01a6109938f65ad74ab58eb0fbd80f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19573f70-74ab-11eb-a956-8766d2dd0181"},"incident_date":"2020-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"f3365c16a28b","org_name":"Moneed","org_type":"other","ransomware":null,"records_affected":389000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenextweb.com/security/2020/08/13/a-china-based-loan-app-exposed-millions-of-indians-data-in-an-unsecured-server/"}],"summary":"China-based lending company Moneed’s unprotected database has exposed the names and phone numbers of millions of Indians, putting them at risk of identity theft. Security researcher Anurag Sen found this database on an open elastic server that had more than 389 million phonebook ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31fe6914d7d129676145161eeb436f78608dc72b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55cbb290-0d5b-11eb-835c-77358de149b1"},"incident_date":"2020-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"650720eb1671","org_name":"Medisys Health Group","org_type":"healthcare","ransomware":true,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://globalnews.ca/news/7367127/medisys-data-breach/"}],"summary":"Medisys Health Group reported a ransomware attack impacting the information of 60,000 patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"882ac5ddef23b6f9d20a7f906331cdf97661e181","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"edd1fbe0-01a7-11eb-b177-5f49668a9776"},"incident_date":"2020-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"d459cf1d9ecf","org_name":"Managed Isolation and Quarantine, Ministry of Business, Innovation & Employment:","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scoop.co.nz/stories/GE2008/S00103/personal-information-breach-auckland-managed-isolation-facility.htm"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.tvnz.co.nz/one-news/new-zealand/security-guard-posted-details-managed-isolation-returnees-in-social-media-privacy-breach"}],"summary":"Managed Isolation and Quarantine (MIQ) staff have been reminded of their privacy obligations after a list of people staying in a facility was posted to a social media site.  On Saturday morning (15 August) a security guard employed by First Security posted an image to a private g","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10ca88bd81819c7d5e231677eecc51ee03f38bac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d86488c0-2382-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"31d979e4f0b8","org_name":"iVoy","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.contxto.com/en/mexico/logistics-startup-ivoy-data-breach/"}],"summary":"What a week it must have been over at Mexican logistics startup, iVoy. When your users’ data has been potentially compromised, you have a lot to do.  Last Tuesday (28), news broke that it was among a series of companies to experience a data breach. In the process, a reported 127,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88fff2c7e9e46ca1e4711ee714f09850d011a6a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5bf780a0-f6b2-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2020-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":24793749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/experian-south-africa-discloses-data-breach-impacting-24-million-customers/"}],"summary":"Experian South African branch was social engineered into sending off client data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78d27259e8ac298f2f6e751a936f8e6289252cf9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68415760-0d8b-11eb-8a4c-a57973eceafd"},"incident_date":"2020-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"fa6e49d3f447","org_name":"Edureka","org_type":"education","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thehindubusinessline.com/info-tech/data-breach-at-e-learning-platform-edureka/article32733488.ece,https://inc42.com/buzz/edureka-suffers-server-breach-data-of-2-mn-users-exposed/"}],"summary":"elasticsearch in AWS left online without password","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52db58829f660da2c06b3cc452177f75aedc9f2b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f2f9bf0-e962-11eb-9aea-07892f56ef76"},"incident_date":"2020-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c9969c06fa3","org_name":"Barnes and Noble","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/barnes-noble-confirms-cyberattack-customer-data-breach/"}],"summary":"Barnes and Noble was potentially compromised by Ergegor ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"961e5316cd2ef20b51575c58cef2e6ac928ca7e4","impact_type":"data_theft","incident_date":"2020-06-23","initial_access":"unknown","notes":"records_affected not found in source; cleared","org_country":"EG","org_id":"a466127b7ca0","org_name":"Swvl","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Swvl","type":"hibp","url":"https://haveibeenpwned.com/Breach/Swvl"}],"summary":"Swvl suffered a data breach in June 2020 that exposed member information, including personal details, partial payment-card data, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1195","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-31","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c8f9882a724dc59bc75118637019466a05472c54","impact_type":"both","incident_date":"2020-02-07","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10207.pdf"},"notes":null,"org_country":"US","org_id":"f6bcdc852ff7","org_name":"George W. Bush Presidential Center","org_type":"nonprofit","ransomware":true,"records_affected":6797,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10207.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10207.pdf"}],"summary":"Attackers breached Blackbaud and removed a copy of the Center’s donor and contact data; Blackbaud paid a ransom.","supporting_quote":"Our Firm is writing you on behalf of our client, George W. Bush Presidential Center (the “Center”), to notify you of a recent security incident that affected the personal information of some Washington residents as a result of a service provider’s breach.","technology_involved":["Blackbaud","databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"malware","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-31","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b8e960cfa82d9739edbc9086eb910e3dbd17e55","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach%20-%20Blackbaud%20July%202020%20CWSL.pdf"},"notes":null,"org_country":"US","org_id":"a1321e664061","org_name":"California Western School of Law","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192644"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach%20-%20Blackbaud%20July%202020%20CWSL.pdf"}],"summary":"California Western School of Law reported that Blackbaud notified it of a ransomware attack on the vendor’s hosting system, which stored the school’s fundraising data.","supporting_quote":null,"technology_involved":["Blackbaud"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-31","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"354885701823616dc6f31b66821163b365d9c24c","impact_type":"data_theft","imported_from":null,"incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10206.pdf"},"notes":null,"org_country":"US","org_id":"751e5dd440fe","org_name":"Auburn University","org_type":"education","ransomware":true,"records_affected":1294,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10206.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10206.pdf"}],"summary":"Auburn University reported that its donor-records vendor Blackbaud experienced a ransomware event involving unauthorized access to certain Auburn information.","supporting_quote":null,"technology_involved":["Blackbaud","donor record-keeping services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6a93540960ea76ea3ba979e0840109ae02b90c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0ff48230-073b-11ec-bbb9-7de9addd16c3"},"incident_date":"2020-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"1479e2b19a5f","org_name":"2gether","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/2gether-crypto-market-platform-hacked-eur1-3m-in-cryptocurrency-stolen/?utm_source=ReviveOldPost&utm_medium=social&utm_campaign=ReviveOldPost#ftag=RSSbaffb68"}],"summary":"2gether hacked: €1.2m in cryptocurrency stolen, native tokens offered in exchange","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-30","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d4fb710c3096ffd999777b2a8720d251231e166","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Credit%20Pros%20-%20California%20Notification.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"739a88979ca2","org_name":"The Credit Pros International","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The online storage service allowed unauthenticated access requests.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192608"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Credit%20Pros%20-%20California%20Notification.pdf"}],"summary":"The Credit Pros International reported that unauthenticated requests accessed files in its online storage service containing personal information.","supporting_quote":"We recently learned that when the service was built by our vendor, the service allowed unauthenticated access requests.","technology_involved":["online storage service"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1b0950e2c97df2a0acc3ff38e4161b48da322be","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d7617e25a9da","org_name":"Scentbird","org_type":"retail_ecommerce","ransomware":null,"records_affected":5814988,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Scentbird","type":"hibp","url":"https://haveibeenpwned.com/Breach/Scentbird"}],"summary":"Scentbird’s June 2020 data breach exposed personal information and password hashes belonging to 5,814,988 customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"791cbe4172c77454648e19445887c17d5a855006","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"130bebd7a860","org_name":"Appen","org_type":"technology_saas","ransomware":null,"records_affected":5888405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Appen","type":"hibp","url":"https://haveibeenpwned.com/Breach/Appen"}],"summary":"Appen suffered a data breach in June 2020 exposing user details, including names, email addresses, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-29","discovered_date":"2020-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d44fca8677f8058416f90a8b6e90839407a86002","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EH%20Standard%20Notice%20AA977_v03.pdf"},"notes":null,"org_country":"US","org_id":"c554b0e1d1cc","org_name":"Emanate Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192529"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EH%20Standard%20Notice%20AA977_v03.pdf"}],"summary":"An unknown individual accessed PaperlessPay’s SQL server containing employee information associated with Emanate Health, but investigators could not determine whether the data was accessed or acquired.","supporting_quote":null,"technology_involved":["SQL server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PaperlessPay"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"d4acd841e4fc","name":"PaperlessPay"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bff214db1c6dd28ee4bf4211f4aa9f10351c5198","impact_type":"data_theft","imported_from":null,"incident_date":"2020-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"508872783a58","org_name":"Chatbooks","org_type":"retail_ecommerce","ransomware":null,"records_affected":15000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chatbooks","type":"hibp","url":"https://haveibeenpwned.com/Breach/Chatbooks"}],"summary":"Chatbooks suffered a breach in March 2020 in which 15 million user records were put up for sale on a dark web marketplace.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2020-07-28","discovered_date":"2020-03-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a36cde27e35410cadaacbfc79b6f0274fe9a5fc2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2947bcfc5c30","org_name":"Windes, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192476"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notice.pdf"}],"summary":"Unauthorized access to two Windes employee email accounts may have exposed personal information, though the company reported no evidence that information was viewed or misused.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-28","discovered_date":"2020-07-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dec21e162410b43730f1912aa6e1f4faddad1d2b","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice-of-Data-Breach-Mailhouse-FINAL.pdf"},"notes":null,"org_country":"US","org_id":"d629d67df05a","org_name":"Ventura College Foundation","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192468"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice-of-Data-Breach-Mailhouse-FINAL.pdf"}],"summary":"Blackbaud informed the Ventura College Foundation that a ransomware attack affected backup files for its Raisers Edge/NXT database and donor management system, including donor and contact information.","supporting_quote":null,"technology_involved":["Blackbaud Raisers Edge/NXT","database and donor management system backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee70c75853bf50a83ef3a7e3e82401f93a52843b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OTR%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"1eda3f7e1bb7","org_name":"OTR Leasing, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192478"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OTR%20-%20California%20Notification.pdf"}],"summary":"An unauthorized person accessed a limited number of employee email accounts containing personal information, but the investigation could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-28","discovered_date":"2020-01-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10e6a413f4dd6ed3bf9c9c731a4eaa34f746440f","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Front%20Rush%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"f994d25dca44","org_name":"Front Rush","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An Amazon Web Services S3 bucket was publicly accessible from the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Front%20Rush%20-%20Notice%20of%20Data%20Event.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Front%20Rush%2C%20LLC-2020-07-28"}],"summary":"Front Rush reported that an S3 bucket containing personal information was publicly accessible from January 18, 2016, to January 8, 2020, with no evidence that information was accessed or acquired.","supporting_quote":"On or around January 5, 2020, Front Rush was informed by a security researcher that one of its Amazon Web Services S3 buckets (“the S3 bucket”) was publicly accessible from the internet.","technology_involved":["Amazon Web Services S3 bucket"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58d832b2da3af0d8d64a80d9bcdad4f7c1d93686","impact_type":"both","incident_date":"2020-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10204.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"400f5f0bdad2","org_name":"French American School of Puget Sound","org_type":"education","ransomware":true,"records_affected":3172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10204.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10204.pdf"}],"summary":"A Blackbaud backup containing data for the French American School of Puget Sound was copied during a ransomware incident at Blackbaud.","supporting_quote":null,"technology_involved":["Blackbaud Raiser's Edge NXT","ResearchPoint","self-hosted environment"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Blackbaud"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"5314e4b8dcf0","name":"Blackbaud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cb2b1c88493c089274b0099547eb70df19938b9","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8f55c456d061","org_name":"Drizly","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Drizly","type":"hibp","url":"https://haveibeenpwned.com/Breach/Drizly"}],"summary":"Drizly suffered a data breach in approximately July 2020, and data including personal information and bcrypt-hashed passwords was sold online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-07-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55e4c06760df699cde6a381ecef369cabf4b2f38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"406ec8d0-1d30-11eb-866e-51f25f42af12"},"incident_date":"2020-07-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e133d932cf81","org_name":"Century Specialty Script Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ny-century-specialty-script-notifying-customers-and-patients-after-employee-office-account-compromised/"}],"summary":"Century Specialty Script, LLC (“Century”) is a specialty pharmacy in New York. Yesterday, it disclosed a data security incident potentially impacting protected health information.  According to their press release, they do not know when it happened, but one employee’s Microsoft O","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c82faab7cab202bf223dd92afde45bcf6042fcca","impact_type":"data_theft","imported_from":null,"incident_date":"2019-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"8a5f986a2d8c","org_name":"Hurb","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hurb","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hurb"}],"summary":"Hurb suffered a data breach in approximately March 2019, and more than 20 million customer records later appeared online for download.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5421562d8de11d0180114d4079f5bb469b64b7e","impact_type":"data_theft","incident_date":"2020-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Braingenie%20-%20Notice%20of%20Data%20Security%20Incident.pdf"},"notes":null,"org_country":"US","org_id":"e92b63f03dc6","org_name":"CK-12 Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Braingenie%20-%20Notice%20of%20Data%20Security%20Incident.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CK-12%20Foundation-2020-07-27"}],"summary":"Unauthorized actors accessed CK-12 Foundation systems and obtained personal information from a Braingenie test database.","supporting_quote":null,"technology_involved":["QA database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"935d48db71b7e327435e61ad11f705a118000f93","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fe8075e6c478","org_name":"Promo","org_type":"technology_saas","ransomware":null,"records_affected":22000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Promo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Promo"}],"summary":"A breach at Promo exposed 22 million records containing email addresses, IP addresses, genders, names and salted SHA-256 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-07-24","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bdb81e1c98ec245b08d2ce1b408b31859810f83","impact_type":"data_theft","incident_date":"2020-05-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/E_DL_L03.pdf"},"notes":null,"org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/E_DL_L03.pdf"}],"summary":"Individuals broke into Walgreens stores and stole items that may have contained customer health-related information.","supporting_quote":"Sometime between May 26 and June 5, 2020, various groups of individuals broke into multiple Walgreens stores and forced entry into the secured pharmacy a t select locations, including your preferred Walgreens.","technology_involved":["cash registers","pharmacy automation device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6e85c06249c01511e211f3bdb007ab9f0b2fef4","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ply%20Gem%20-%20California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"ea597b6957ca","org_name":"Ply Gem Residential Solutions","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192393"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ply%20Gem%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10202.pdf"}],"summary":"An unauthorized person accessed some employee email accounts between July 26 and November 18, 2019, and the investigation found that emails or attachments contained personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-24","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"661998449b7ab628e6797bb4aab2c5998546a278","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-09-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10201.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"205dab2c3303","org_name":"Entercom Communications Corp.","org_type":"other","ransomware":null,"records_affected":2730,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10201.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10201.pdf"}],"summary":"A backpack containing an external hard drive with personal information was stolen from an Entercom employee’s rental vehicle.","supporting_quote":"On September 18, 2019, a backpack containing an external hard drive was stolen from an Entercom employee’s rental vehicle.","technology_involved":["external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ca9e9133ab5daaa5cfdc2d784e30d88da925e79","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-28","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F6629_REVISED_L02%20Dynavax_Adult%20CM%20CA_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"e25aaca659e1","org_name":"Dynavax Technologies Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192386"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F6629_REVISED_L02%20Dynavax_Adult%20CM%20CA_SAS_PROOF.pdf"}],"summary":"An unauthorized individual accessed a Dynavax employee’s email account after a phishing email incident; the investigation found no evidence that personal information was stolen or misused.","supporting_quote":"Our ongoing investigation into a phishing email incident recently determined that an unauthorized individual gained access to a Dynavax employee’s email account for a brief period of time on February 28, 2020.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6641d238e158f5f3de0a10d1474e54f9a4154e02","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10200.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"380dc6a5755b","org_name":"City of Redmond","org_type":"unknown","ransomware":null,"records_affected":2851,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10200.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ad0aa45889f93af5b29d073201d01e1e4170274b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/PrismaHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f3021968a2e","org_name":"Prisma Health","org_type":"unknown","ransomware":null,"records_affected":30079,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/PrismaHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-22","discovered_date":"2020-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbb44725607eb792013c45f88a63fb58420ec9d8","impact_type":"both","incident_date":"2020-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter.PDF"},"notes":null,"org_country":"US","org_id":"2b15fd49bc40","org_name":"Pivot Technology Solutions, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192305"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter.PDF"}],"summary":"Pivot Technology Solutions reported an attack involving attempted encryption of company infrastructure and exfiltration of limited personal information of US employees and consultants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-07-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8f5382220647bc6b41aaec98c8a103e61aa2b06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf574270-7498-11eb-b6c3-130fdd35ca3d"},"incident_date":"2020-07-21","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b267824dc2b","org_name":"Promo.com","org_type":"technology_saas","ransomware":null,"records_affected":22000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://hotforsecurity.bitdefender.com/blog/promo-com-announces-data-breach-after-22-million-user-records-are-published-online-23823.html"}],"summary":"Promo.com, a video creation platform for businesses and agencies, has confirmed a data breach after bad actors posted a database containing 22 million user records on a hacking forum.  The award-winning video maker, which is partnered with social media venues such as Facebook and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7a7c707d9d718cb6cae6f75054909ae99933ef8","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68d196fe812a","org_name":"Corning Union Elementary School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192266"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-21","discovered_date":"2020-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"753910e84b2f713384ecafee6b8102d1020a582a","impact_type":"both","incident_date":"2020-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20___EXPERIAN_F6415_L01_Collabera%20All%20States.doc_amy.dunn_faegredrinker.com_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"3ccf1267705a","org_name":"Collabera, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192260"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20___EXPERIAN_F6415_L01_Collabera%20All%20States.doc_amy.dunn_faegredrinker.com_SAS_PROOF.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10568.pdf"}],"summary":"Collabera identified malware consistent with a ransomware attack and learned that an unauthorized party had obtained employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7db9ca42b030810abf4fe176569373c60b6f5b35","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10573.pdf"},"notes":null,"org_country":"US","org_id":"105aee0e8a67","org_name":"City Ministries","org_type":"nonprofit","ransomware":null,"records_affected":533,"reviewed":false,"root_cause":"A City Ministries employee clicked a link in a phishing email, allowing an unauthorized individual to access the employee’s email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10573.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10573.pdf"}],"summary":"A phishing email led to unauthorized access to a City Ministries employee’s email account, where information concerning 533 Washington residents may have been accessible.","supporting_quote":"On February 11, 2020, a City Ministries employee clicked on a link in an email that turned out to be part of a phishing scam.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-20","discovered_date":"2019-12-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d49d6ad8a48a0e031e728b83ee9e38440084682","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20SRG.pdf"},"notes":null,"org_country":"US","org_id":"bf671838927d","org_name":"Senior Resource Group LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An individual masqueraded as a recognized person and obtained user credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20SRG.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Senior%20Resource%20Group%20LLC-2020-07-20"}],"summary":"Senior Resource Group reported that a phishing incident gave an unauthorized individual access to certain employee email accounts containing personal information.","supporting_quote":"SRG was the subject of an isolated cyber event called a phishing incident in which unauthorized individual(s) gained access to certain email accounts by masquerading as a reputable and recognized person and gaining user credentials .","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e79c5a33f1d343dd4ca5582881d96245d0de04f5","impact_type":"data_theft","imported_from":null,"incident_date":"2020-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d3d66600bca1","org_name":"Wattpad","org_type":"technology_saas","ransomware":null,"records_affected":268765495,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wattpad","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wattpad"}],"summary":"A breach of Wattpad exposed personal information and bcrypt-hashed passwords, which were later published on a public hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e63dbdbd6bc92e5e80f732ac7d7c10fcfab5c570","impact_type":"unknown","incident_date":"2020-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/REDACTED.%20Adult%20SSN%20%288965550x7AB84%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26e42f4558f1","org_name":"Coalinga Valley Health Clinics, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192161"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2020-07-17","discovered_date":"2020-01-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4aa6d478fdfb89cdce119f3a1a846008e408200a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Verigent%20LLC%20-%20Consumer%20Notification%20Letter%20%28Adult%20SSN%29%20Final.pdf"},"notes":null,"org_country":"US","org_id":"d6ca5e5be538","org_name":"Verigent, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192136"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Verigent%20LLC%20-%20Consumer%20Notification%20Letter%20%28Adult%20SSN%29%20Final.pdf"}],"summary":"Verigent reported unauthorized access to employee email accounts containing personal information that may have been viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-17","discovered_date":"2020-05-21","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e40da2bd22e16912b81004345a578fc66cfcd51","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Frontier%20Bancshares%20-%20Consumer%20Notification%20Letter%20%28California%29_1.pdf"},"notes":null,"org_country":"US","org_id":"c3e33bc0e4c5","org_name":"STRATA Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Frontier%20Bancshares%20-%20Consumer%20Notification%20Letter%20%28California%29_1.pdf"}],"summary":"STRATA Trust Company detected unusual activity involving an employee email account, and determined that personal information could have been accessed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e1b3fb22f3e2e12fce791c00dc7e00e945f938d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Northgate%20Gonzalez%20Ad%20CA%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"96e5563dccc4","org_name":"Northgate Gonzalez, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192131"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Northgate%20Gonzalez%20Ad%20CA%20r3prf.pdf"}],"summary":"Northgate Gonzalez reported unauthorized access to an employee’s email account and certain emails and attachments between January 7, 2019 and January 7, 2020.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20feaf62becdc985f159503e0f6253c98ae8c347","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2020%200717%20Next%20Glass.pdf"},"notes":null,"org_country":"US","org_id":"37d1650267dc","org_name":"Next Glass","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192135"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2020%200717%20Next%20Glass.pdf"}],"summary":"Next Glass reported that BeerAdvocate user email addresses and forum passwords were lost and aggregated into the CouponMom 2014 breach dataset.","supporting_quote":"The exact method of breach could not be determined, due to the incident occurring seven to eight years ago.","technology_involved":["BeerAdvocate forum software user database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-17","discovered_date":"2020-05-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07c5e302f0eb917b811b79671583e44136d849fe","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20Version%201.pdf"},"notes":null,"org_country":"US","org_id":"66dddf27cbb4","org_name":"NCP Healthcare Management Company","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192132"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20Version%201.pdf"}],"summary":"An unauthorized individual accessed an NCP employee’s email account, where personal information was identified.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1bd93f3641790e52d05cce465f2b5aabe81fed5","impact_type":"unknown","incident_date":"2019-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Corresp%20to%20Parents%20reg%20security%206-12-20.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"be2f83b0bc1a","org_name":"Evergreen Union School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192107"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"119b8eaf0292589bcfd87000f64a30b6b91b91aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc3f9a70-0e79-11ed-9a95-4bdaebaab721"},"incident_date":"2020-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"063252113a2b","org_name":"utahgunexchange","org_type":"technology_saas","ransomware":null,"records_affected":195000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.co/wordpress/107124/data-breach/us-gun-exchange-data-breach.html"}],"summary":"On August 10th, a hacker has leaked online the databases of Utah-based gun exchange for free on a cybercrime forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-07-16","discovered_date":"2020-04-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40d08624cb3153f62ce0e7b84a7ad2ed7b07d5ff","impact_type":"data_theft","incident_date":"2020-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20HealthCenter%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"83ab070d91c9","org_name":"US HealthCenter, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192087"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20HealthCenter%20Notice%20Letter.pdf"}],"summary":"US HealthCenter reported unauthorized access to a dedicated email account, where emails and participant forms containing personal and limited health information could be viewed and forwarded.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-07-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d68bbb876f53900842bf2a26c30ab1a339cfced","impact_type":"data_theft","incident_date":"2020-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2020-11-18%20FINAL%20Steel%20Partners%20Resident%20Notification%20Letter%20III.pdf"},"notes":null,"org_country":"US","org_id":"4d888cf7ae21","org_name":"Steel Partners Holdings L.P.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-196400"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192098"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192647"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2020-11-18%20FINAL%20Steel%20Partners%20Resident%20Notification%20Letter%20III.pdf"}],"summary":"An unauthorized party accessed an employee's Steel Partners email account and downloaded the mailbox, which contained documents with personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-16","discovered_date":"2020-05-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c45480e71e8a3becdf44d3c7dede5b2d33008140","impact_type":"unknown","incident_date":"2019-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5979d1d57054","org_name":"Lutheran Community Services Northwest","org_type":"unknown","ransomware":null,"records_affected":447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lutheran%20Community%20Services%20Northwest-2020-07-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-16","discovered_date":"2020-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cff6c123f74019fd2e451fceaf1a7a8778a6fa3e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10572.pdf"},"notes":null,"org_country":"US","org_id":"b8f1b06baa81","org_name":"Gonzales, Gonzales, & Gonzales Immigration Law Offices","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10572.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gonzales%20Gonzales%20%26%20Gonzales%20Immigration%20Law%20Offices-2020-07-29"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10572.pdf"}],"summary":"Gonzales, Gonzales, & Gonzales Immigration Law Offices reported unauthorized access to its computer network between May 28 and June 2, 2020, potentially involving client and personnel information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-16","discovered_date":"2020-06-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c3dd66274464ae326afad537e8d97d6effba6c3","impact_type":"data_theft","incident_date":"2020-06-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Update%20of%20Data%20Breach%20%28Providing%20Credit%20Monitoring%20Services%20Instructions%29__1.pdf"},"notes":null,"org_country":"US","org_id":"a3684e399695","org_name":"FormFactor, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192052"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Update%20of%20Data%20Breach%20%28Providing%20Credit%20Monitoring%20Services%20Instructions%29__1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FormFactor%2C%20Inc.-2020-07-16"}],"summary":"FormFactor reported unauthorized access to its IT systems involving malware and possible access to or loss of personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0910f66bd4597d8c664e238b9312acaf9d911fe","impact_type":"unknown","incident_date":"2017-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20a%20Data%20Incident%20%E2%80%93%20Merani%20Hotel%20Group.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d7412c00b30","org_name":"Merani Hospitality, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192019"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10571.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"excessive_privilege","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-14","discovered_date":"2020-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e5d857d991e02f783c5ccb1cae06d592b751bb1","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OPOS%20Privacy%20Breach%20SharePoint%20Response%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A domain group for all CDCR staff with intranet access was inadvertently granted read-only access to a SharePoint site containing personal identifying information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191984"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OPOS%20Privacy%20Breach%20SharePoint%20Response%20Letter.pdf"}],"summary":"An incorrectly granted SharePoint permission exposed names, Social Security numbers and/or addresses to a domain group of CDCR staff.","supporting_quote":"A dom ain group for all CDCR staff with intranet access was inadvertently given “read only” access to the SharePoint site that contained personal identifying information.","technology_involved":["SharePoint"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e858a9e333406ce2aadb30c654b4720750ac8de","impact_type":"disruption_or_ransomware","incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20Dental%20Data.pdf"},"notes":null,"org_country":"US","org_id":"6e030f301e65","org_name":"City Dental","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20Dental%20Data.pdf"}],"summary":"City Dental reported that hackers made its computer terminals unusable and that it paid a ransom to obtain its data.","supporting_quote":null,"technology_involved":["computer terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7462cdd7e244c61ed5f95d0091bfeee679ad69fc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"caea2e30-f203-11ea-9eb3-fb45745214a6"},"incident_date":"2020-07-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"376d5f72b98f","org_name":"Adit, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/08/11/3-1m-records-tied-medical-software-company-adit-found-exposed-online/"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/medical-software-database-exposes-personal-data-of-3.1m-patients"}],"summary":"More than 3 million user records tied to a medical software company called Adit have been found exposed online and may have been stolen by malicious actors.  Discovered by security researcher Bob Diachenko, who revealed it today, the data included full names, email addresses, hom","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4cc168279f440c0a8b947b46d29f5548c9094a7","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Thomas%20Cuisine.pdf"},"notes":null,"org_country":"US","org_id":"e849e139350b","org_name":"Thomas Cuisine","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191922"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Thomas%20Cuisine.pdf"}],"summary":"Thomas Cuisine found that employees’ email accounts were accessed without authorization, and personal information in an account may have been exposed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1be746a4c6a4350a962c38db2cc9601c67764d49","impact_type":"data_theft","incident_date":"2020-06-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Chronicle%20Individual%20Notice%207.9.2020.pdf"},"notes":null,"org_country":"US","org_id":"7d8645790f12","org_name":"The Chronicle of Higher Education, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized parties exploited a vulnerability in one of The Chronicle’s servers to obtain limited account information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191927"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Chronicle%20Individual%20Notice%207.9.2020.pdf"}],"summary":"The Chronicle reported that unauthorized parties exploited a server vulnerability and obtained account information, including some passwords that became accessible in plain text.","supporting_quote":"Through the investigation, The Chronicle determined that unauthorized parties had exploited a vulnerability in one of The Chronicle’s servers, through which they were able to obtain limited account information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6255ce9ff8f5c4477bdca26a6296b6b45cd4aad3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MS%20-%20Template%20CA%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"868e339a4142","org_name":"Morgan Stanley","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191926"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MS%20-%20Template%20CA%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Morgan%20Stanley-2020-07-10"}],"summary":"Morgan Stanley reported that some decommissioned or missing devices may have retained unencrypted personal and financial data, with no known access or misuse.","supporting_quote":null,"technology_involved":["computer server","computer disks"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-10","discovered_date":"2020-06-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b9dc72a3977f045eeac1d22ed0cfa6d662f3f06","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LACBA%20-%20Consumer%20Notice%20Form%20CCs_2650788_2.pdf"},"notes":null,"org_country":"US","org_id":"6c9ad89c6ffc","org_name":"Los Angeles County Bar Association","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LACBA%20-%20Consumer%20Notice%20Form%20CCs_2650788_2.pdf"}],"summary":"Malicious code was present on portions of LACBA.org, and the compromised information included names, payment card numbers, usernames, and passwords.","supporting_quote":null,"technology_involved":["LACBA.org website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-10","discovered_date":"2020-06-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"45c6b827ffc18ada47a5e405d2110b20d6fef4b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10569.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9c0065d16358","org_name":"Fetch Rewards","org_type":"technology_saas","ransomware":null,"records_affected":128598,"reviewed":false,"root_cause":"A temporary API code misconfiguration caused member profile information to be returned to an unauthorized third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10569.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10569.pdf"}],"summary":"Fetch Rewards reported that a temporary API code misconfiguration exposed member profile information to an unauthorized third party.","supporting_quote":"On or about June 6, 2020, as a result of a temporary API code misconfiguration, certain Fetch member profile information was returned to an unauthorized third party.","technology_involved":["API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"89d4392b146c22ac769c1a1b35e57490f9c305f9","impact_type":"both","incident_date":"2020-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10567.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"60eb5b5cd6b7","org_name":"Boeing Employees' Credit Union","org_type":"financial","ransomware":null,"records_affected":4883,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10567.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10567.pdf"}],"summary":"Skimming devices were installed at six BECU ATMs, and members reported fraudulent transactions involving accounts linked to BECU cards.","supporting_quote":"Based on our continued investigation, we believe that deep insert skimmers were unlawfully installed, and then removed, at six BECU ATM locations in Arlington, Lynnwood, Mill Creek, Renton, and Snohomish, ultimately resulting in the fraudulent transactions.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-08","discovered_date":"2019-05-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"919f6bc72d7816d5835ddcdf886def305a528809","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eshel%20Aminov%20%26%20Partners%20LLC.PDF"},"notes":null,"org_country":"US","org_id":"cecab12e5a9a","org_name":"Eshel, Aminov & Partners LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees' confidential business email accounts were accessed as a result of an email phishing scheme.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eshel%20Aminov%20%26%20Partners%20LLC.PDF"}],"summary":"A phishing scheme gave an attacker access to employees' confidential business email accounts, where documents may have contained personal and financial information.","supporting_quote":"Eshel, Aminov & Partners LLP was the victim of a business email compromise incident during which a cyber attacker gained access, without our permission, to the confidential business email accounts of our employees as a result of an email phishing scheme.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-07-08","discovered_date":"2020-06-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdae894fb87cc130d19a67b7d638fa1a2eb73fb5","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification%20-%20Claires.pdf"},"notes":null,"org_country":"US","org_id":"ab16afa50277","org_name":"Claire's Stores, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191843"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification%20-%20Claires.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Claire%27s%20Stores%2C%20Inc.-2020-07-08"}],"summary":"Claire's Stores found unauthorized code on its e-commerce websites that could copy checkout information and send it out of the system.","supporting_quote":null,"technology_involved":["e-commerce websites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3475f43e04ff97f85a887adf214e63363c82ec14","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10565.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"93cdc2e19998","org_name":"Freddie Mac","org_type":"financial","ransomware":true,"records_affected":596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10565.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10565.pdf"}],"summary":"A vendor hired by Freddie Mac experienced a ransomware attack while storing loan application data, with no evidence that attackers accessed or took the data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c07d05b851983b1f501d9559e0fe5cde47507656","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F6293_Borrower%20notification%20L01%20%28FINAL%2007%2001%202020%29%20%28ALL%20OTHER%20STATES%29%20Final_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"02d81b146fb0","org_name":"Federal Home Loan Mortgage Corporation","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191772"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F6293_Borrower%20notification%20L01%20%28FINAL%2007%2001%202020%29%20%28ALL%20OTHER%20STATES%29%20Final_SAS_PROOF.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Federal%20Home%20Loan%20Mortgage%20Corporation-2020-07-07"}],"summary":"A vendor holding the organization’s loan application data experienced a ransomware attack, but the organization reported no evidence that the data was accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeb8c616506ff28d36af22ad2efb3aeaa5eebdec","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20A%20-%20Ann%20Hale%20Breach%20Notification%20Letter%20-%20SSN%20Compromised.pdf"},"notes":null,"org_country":"US","org_id":"d9344699e135","org_name":"Dr. Ann Hale","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191787"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20A%20-%20Ann%20Hale%20Breach%20Notification%20Letter%20-%20SSN%20Compromised.pdf"}],"summary":"Dr. Ann Hale reported that an individual gained unauthorized access to databases and systems containing patients’ personal health information and medical records.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82e33032a60d6996605a28380132e6c45bf626c8","impact_type":"unknown","incident_date":"2020-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/D.%20Smith%20Initial%20Notification%20Letter%20-%20Taxpayer%20Clients.pdf"},"notes":null,"org_country":"US","org_id":"a49f6803e2fe","org_name":"Douglas M. Smith & Co. CPA","org_type":"professional_services","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191767"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/D.%20Smith%20Initial%20Notification%20Letter%20-%20Taxpayer%20Clients.pdf"}],"summary":"Douglas M. Smith & Co. CPA reported that 30 fraudulent tax returns were filed using taxpayers’ Social Security numbers and said it found no evidence of unauthorized access to its computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal"],"disclosed_date":"2020-07-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e5ed282f4cd78ebee49569680b11e7d9caac07bf","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10564.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6003dea13cf2","org_name":"AARP","org_type":"nonprofit","ransomware":null,"records_affected":1456,"reviewed":false,"root_cause":"Credentials obtained through a breach of another entity were used to attempt access to AARP.org accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10564.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10564.pdf"}],"summary":"AARP reported attempts to access AARP.org accounts using credentials obtained through a breach of another entity.","supporting_quote":"Please be aware that this was not the result of any security failure of AARP; rather, we believe your credentials were obtained through a breach of another entity and were later used by an unauthorized person or entity to attempt access to your AARP.org account using those same credentials.","technology_involved":["AARP.org account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f19c8c396ab1f59a288f8de376704e1918e6152c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a50d8060-01a1-11eb-b177-5f49668a9776"},"incident_date":"2020-07-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"527a9f8622d8","org_name":"Moffitt Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/briefcase-with-4-056-moffitt-cancer-center-patients-info-stolen-from-physician-s-car-4-things-to-know.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wtsp.com/article/news/local/moffitt-cancer-center-investigation-data-breach/67-708b5890-6425-4d5a-9969-49613e05b057"}],"summary":"A Moffitt Cancer Center physician reported two personal electronic storage drives and print outs of clinical schedules that contained information about thousands of patients were stolen from his car.  Four details:  1. The Tampa, Fla.-based cancer center said the physician report","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2633f1c374319905e7bdbc48f82b9c0299537331","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BNL_Final_English.pdf"},"notes":null,"org_country":"US","org_id":"aa042cb62a94","org_name":"Central California Alliance for Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191678"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BNL_Final_English.pdf"}],"summary":"Central California Alliance for Health found that an unknown person had accessed employee email accounts, and limited member health information may have been accessed.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-07-02","discovered_date":"2020-04-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6944b684421a80d2bfa7e4732fa2631bdafc959","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Beverly%20Hills%20Unified%20School%20District%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"098b9a786cc6","org_name":"Beverly Hills Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Aeries software was successfully exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191685"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Beverly%20Hills%20Unified%20School%20District%20Notice_1.pdf"}],"summary":"A vulnerability in the Aeries Student Information System was exploited, allowing an individual to access Beverly Hills Unified School District parent and student data.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual attempted to exploit a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdd0c57eb691943ab42dee5625a916aff9d451bd","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice_4.pdf"},"notes":null,"org_country":"US","org_id":"80b83f4dd5e6","org_name":"Urban Compass","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack led to unauthorized access to agents’ Gmail accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191634"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice_4.pdf"}],"summary":"Urban Compass reported that phishing led to unauthorized access to agents’ Gmail accounts, though the investigation could not determine whether emails or attachments were viewed.","supporting_quote":"We learned that certain of our agents’ Gmail accounts were subject to unauthorized access due to a phishing attack.","technology_involved":["Gmail"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db4c17384a57cf9bdd574093945b429bc437515a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd8d7dc0-74a5-11eb-a956-8766d2dd0181"},"incident_date":"2020-07-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/bill-gates-elon-musk-apple-twitter-accounts-hacked-530548.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/technology/2020/07/15/musk-gates-twitter-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bigcountryhomepage.com/news/tech-news/twitter-says-attackers-successfully-targeted-some-of-our-employees-to-gain-internal-tools/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.windowscentral.com/twitter-says-130-accounts-targeted-45-compromised-security-breach;"}],"summary":"The Twitter accounts of several high-profile users, many of which were “verified” on the social network, have been hacked, with malicious actors posting messages that encouraged followers to send money to a certain Bitcoin address.  The affected Twitter accounts include Bill Gate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"049a2f6ccbef06141e6af8c27fa70c8a40038885","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19cc604b-9ec8-4afb-829d-e7e7ed2d4e97"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"6cb426a6cf2a","org_name":"Thai Beverage Public Company","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://itwire.com/security/maze-used-to-attack-on-big-thai-beverages-company.html"}],"summary":"Thai beverage company hit by Maze randomware. Group posts data to encourage compliance with ransom demand.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6dea369551c619b8d15cdc975fc3b8cb66be12","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cf043040-754a-11eb-a956-8766d2dd0181"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"e45cfea223a0","org_name":"Telecom Argentina","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/ransomware-gang-demands-7-5-million-from-argentinian-isp/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cryptotips.eu/en/news/monero-xmr-ransomware-hits-telecoms-giant-in-argentina/"}],"summary":"A ransomware gang has infected the internal network of Telecom Argentina, one of the country's largest internet service providers, and is now asking for a $7.5 million ransom demand to unlock encrypted files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"KR","motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14cd5e9a751a3faeb2501632f92f72147dbd98d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2c0d6430-2390-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2d52d14ed970","org_name":"Religare Health Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/major-data-breach-at-religare-health-insurance-cyble-warns-of-phishing/"}],"summary":"Dark web sweepers Cyble has claimed that internal data of Gurugram-based Religare Health Insurance has lost 5 Mn records, which is now up for sale. The US-based cybersecurity firm has claimed that the hacked data includes details of Religare, its agents, several sensitive informa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f0b4adba233e0b7b0164d02108774c1a1aac3aa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"214351f0-ee4b-11eb-a0c0-efc7cda0e23f"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"c4dcc0b05317","org_name":"Konica Minolta","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/business-technology-giant-konica-minolta-hit-by-new-ransomware/"}],"summary":"Business technology giant Konica Minolta hit by new ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0409cea8b058e1da42e8bfa91141a57ed704a0e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"744a8b30-74bf-11eb-a956-8766d2dd0181"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"105848ff028d","org_name":"Haldiram","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/maze-gang-leaves-behind-bitter-taste-for-indian-sweets-maker-haldiram-s.html"}],"summary":"In what looks to be an unusual choice of victim, a cyber criminal gang has used the Maze Windows ransomware to attack the well-known Indian sweets manufacturer Haldiram's and has released some data stolen from the company.  Ransomware packages are designed to encrypt files found ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98dd456681d1b3aebbfe1231923a1a877ac1ba92","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"263068f0-c968-11ea-858c-33a6d5171bc6"},"incident_date":"2020-07-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8bee287bf466","org_name":"Durham Radio","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fyimusicnews.ca/articles/2020/07/19/durham-radio-beats-back-ransomware-attack"}],"summary":"Durham Radio, one of the last of the few independent chains in Ontario – with three stations in Oshawa, one in Hamilton and one in Caledonia – was hit with a Pyse ransomware attack that forced the stations off the air recently. Rather than stand down and pay up, Durham used its i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"004e21307ba12031b2a9105f5ee22ce1ed670d3c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee28b4a0-7338-11eb-a956-8766d2dd0181"},"incident_date":"2020-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4fb33ddd73ab","org_name":"Dunzo","org_type":"technology_saas","ransomware":null,"records_affected":3400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://medium.com/dunzo/your-security-is-our-top-priority-def5ebe5db12;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.pymnts.com/news/security-and-risk/2020/india-google-backed-delivery-app-dunzo-hit-by-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesnownews.com/technology-science/article/hyperlocal-delivery-app-dunzo-suffers-data-breach-users-phone-numbers-exposed/620011;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thenewsminute.com/article/dunzo-suffers-data-breach-launches-internal-investigation-128415;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.deccanherald.com/business/dunzos-data-breach-may-have-affected-over-34-million-users-867297.html"},{"fetched_at":null,"title":"Have I Been Pwned: Dunzo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dunzo"}],"summary":"Hyperlocal delivery service provider, Dunzo, on July 11, had revealed a massive data breach in the database of one of its third-party servers. On July 29, in a second wave of communication, the service provider said that that additional Personally Identifiable Information (PII) d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e014db8d153681c66a6db95ece4c39b2f5aa4511","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76fcee40-35d0-11ec-9ec7-15e66f657ea5"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bff5f02eee4","org_name":"Crowder College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fourstateshomepage.com/news/crowder-college-still-feeling-impact-of-ransomware-attack/"}],"summary":"Crowder College dramatically impacted by Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-07-01","discovered_date":"2020-04-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"595232d9f23825ff7244d5b32b66af2d67262cf1","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AL%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"a2ec0a6fcc5a","org_name":"Andrew Lundholm CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AL%20Notice%20of%20Data%20Event.pdf"}],"summary":"An unknown actor accessed Andrew Lundholm CPA's tax filing software and folders containing sensitive information.","supporting_quote":null,"technology_involved":["tax filing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d723a18c885dc8296fb5d423788f5ed05dacf09e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0cb7fc70-238c-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"919134de882e","org_name":"Adif","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/windows-revil-ransomware-used-to-attack-spanish-govt-firm.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.railjournal.com/technology/adif-hit-by-cyberattack/"}],"summary":"Cyber criminals have used the Windows REvil ransomware to attack Adif, an infrastructure company owned by the Spanish Government, and have published data which was stolen from its dark Web site.  The attackers have apparently hit the organisation twice before, and threatened a th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f63eab90a2763a0cc7a8b970bfb365adec268dc7","impact_type":"unknown","incident_date":"2020-05-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/8914276.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e7c0b1bb62c","org_name":"WESTECH International Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191569"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-29","discovered_date":"2020-03-31","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b5bdd739c6045437aabfa3f7cda10429dc24c03","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Young%20Molohan%20Ad%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"2435cbffda7f","org_name":"Young, Molohan, Cohen & Durrett, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The perpetrator broke a window to gain access to the organization's property.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191533"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Young%20Molohan%20Ad%20CA%20r1prf.pdf"}],"summary":"A perpetrator entered the firm's property by breaking a window and stole a hard drive containing former client data that may have been accessed.","supporting_quote":"The perpetrator threw a rock through a window to gain access to YMCD property, and subsequently stole a YMCD hard drive.","technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-29","discovered_date":"2020-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"1f5c44cd17cf7e1885f36a970375852d5d4a3c9a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SteelPartners.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6f9f4881b423","org_name":"Steel Partners Holdings LP","org_type":"other","ransomware":null,"records_affected":3628,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SteelPartners.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SteelPartners.pdf"}],"summary":"Steel Partners reported unauthorized access to an employee's email account, which contained documents with personal and health information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-29","discovered_date":"2020-05-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2da962570181851338d034b61e4aac80ec6f265f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RBJUHSD_Notification.pdf"},"notes":null,"org_country":"US","org_id":"c5c33f2b60fa","org_name":"Red Bluff Joint Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the Aeries software allowed access to student and parent information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191519"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RBJUHSD_Notification.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the District’s Aeries Student Information System and accessed parent and student data.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual attempted to exploit a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e1b4e626ece7d442566d8f48fb730359d1c2aed","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ETI%20-%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"6d5b189df1d4","org_name":"Electrical Training Institute","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ETI%20-%20California%20Notice.pdf"}],"summary":"An unauthorized individual may have accessed information in an Electrical Training Institute email account between December 23 and December 26, 2019.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf92cb0694522f462c6c59e67e38b5aaeae65de3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4b526b10-748f-11eb-b6c3-130fdd35ca3d"},"incident_date":"2020-06-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"bc3ab40a4210","org_name":"BrandBQ","org_type":"retail_ecommerce","ransomware":null,"records_affected":6700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/fashion-retailer-brandbq-seven/"}],"summary":"A European fashion retailer has become the latest big-name brand to expose personal data on millions of its customers after misconfiguring a cloud database.  Researchers at vpnMentor discovered the unencrypted Elasticsearch server on June 28 and parent company BrandBQ finally sec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c667f621334a0aa91141974889d5ba5af0689663","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notcie%20sent%20to%204264.pdf"},"notes":null,"org_country":"US","org_id":"71a66e7704a1","org_name":"Adelanto Elementary School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An attacker exploited a vulnerability in the Aeries software, and the district later installed a patch Aeries made available to remedy it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191465"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notcie%20sent%20to%204264.pdf"}],"summary":"An attacker exploited a vulnerability in Adelanto Elementary School District’s Aeries Student Information System, potentially accessing student and parent information.","supporting_quote":"To help prevent something like this from happening again in the future, we installed the software patch that Aeries made available to remedy the vulnerability that allowed the unauthorized individual to access our Aeries system.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-06-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b902fd743d3deefd97f26fa7e86362936f5fba63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b9f1df80-121d-11eb-a3ae-53136ea5d4e6"},"incident_date":"2020-06-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"9dc72effa04b","org_name":"Ledger","org_type":"financial","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach"},{"fetched_at":null,"title":"Have I Been Pwned: Ledger","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ledger"}],"summary":"Legder experienced a breach using stolen api key ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6b33f6fdde09bbd2266e412bbbbef6c66af6e19","impact_type":"data_theft","incident_date":"2020-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10563.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7689f3899d81","org_name":"BlockFi, Inc.","org_type":"financial","ransomware":null,"records_affected":696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10563.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10563.pdf"}],"summary":"Unauthorized activity accessed personal information in BlockFi accounts for about an hour on May 14, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-24","discovered_date":"2020-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4994c98bd2c50dee70d617008d5d3eae0fcbd1cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aeries%20Password%20Reset%20Parent%20Notification%20Letter%20-%20FINAL_1.pdf"},"notes":null,"org_country":"US","org_id":"72a331435a71","org_name":"Saddleback Valley Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191377"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aeries%20Password%20Reset%20Parent%20Notification%20Letter%20-%20FINAL_1.pdf"}],"summary":"Saddleback Valley Unified School District reported unauthorized access to student and parent information in its Aeries Student Information System.","supporting_quote":null,"technology_involved":["Aeries SIS"],"third_party":{"archetype":null,"involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd198584c2b97a785114e8cd9d57b03b220f0382","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"feb352b8cebc","org_name":"Quidd","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Quidd","type":"hibp","url":"https://haveibeenpwned.com/Breach/Quidd"}],"summary":"A 2019 breach exposed Quidd users’ email addresses, usernames, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-24","discovered_date":"2020-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd25540d90e36fd3f8619b6d83f29ce5f5e71d63","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Version%201%20-%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"9d2486d73319","org_name":"iCanvas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Version%201%20-%20Notice%20of%20Data%20Breach.pdf"}],"summary":"An unauthorized script was placed on the iCanvas checkout page and may have captured customer information entered during credit card checkout.","supporting_quote":null,"technology_involved":["iCanvas Website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-24","discovered_date":"2020-07-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c41348245ffe7f164e13784d0096c76fefef043","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EyeMed%20Sample%20Notification%20Letter.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f8f1ab34532e","org_name":"EyeMed Vision Care","org_type":"healthcare","ransomware":null,"records_affected":1474000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.calhipaa.com/email-account-breaches-at-alameda-health-system-eyemed-vision-care-and-century-specialty-script/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/ny-fines-vision-benefits-firm-600000-for-2020-breach-a-18368"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-194542"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EyeMed%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#EyeMed%20Vision%20Care%20LLC-2020-10-12"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10338.pdf"}],"summary":"An unauthorized individual accessed an EyeMed email mailbox and sent phishing emails; personal information may have been viewed or acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-24","discovered_date":"2020-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"81eb69bf9dbc68717ad001abb763d2943e8624d3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10562.pdf"},"notes":null,"org_country":"US","org_id":"233b4a0401a2","org_name":"Dr. Sid Siahpush","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10562.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10562.pdf"}],"summary":"A patient’s email containing personal and medical information was accidentally forwarded to another patient, who deleted it the same day.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7ca7482ae767151fc57ae472920ab5af5cec1cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eagle%20CCU%20Ad%20CA%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"24cb83cd16ca","org_name":"Eagle Community Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191295"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eagle%20CCU%20Ad%20CA%20r1prf.pdf"}],"summary":"An unauthorized outside party temporarily accessed an Eagle Community Credit Union employee email account that contained some individuals’ personal information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-22","discovered_date":"2020-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81e2f3c0fb7f159589b1d52dbe308d8e4560f785","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-14","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"78cbf065726e","org_name":"GAIN Capital Group, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191230"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification.pdf"}],"summary":"GAIN Capital Group determined that an unauthorized party may have accessed some of its computer servers between April 14 and April 18, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-06-22","discovered_date":"2020-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5edf4908b24838c3620d08347934fc3a1d54f9c9","impact_type":"both","incident_date":"2020-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Florida%20Orthopaedic%20Institute%20-%20Ca.pdf"},"notes":null,"org_country":"US","org_id":"325da85b4db9","org_name":"Florida Orthopaedic Institute","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Florida%20Orthopaedic%20Institute%20-%20Ca.pdf"}],"summary":"Florida Orthopaedic Institute discovered a ransomware attack that encrypted server data, and an investigation found that patients’ personal information may have been accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8694cb241b5d30731db69311691f4cd3ceaf8bbd","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/001.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"684ba0342d9c","org_name":"Chino Valley Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191216"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddd0d239c307fbf9101f07a67ac846915ff33a35","impact_type":"unknown","incident_date":"2019-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Concorde%20California%20Ad%20SSN%20Variable%20%5Bredacted%5D%20%288897773x7AB84%29.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6efd7f4eabdb","org_name":"Concorde Investment Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191195"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbdfb5e11ce46ff65b77dda35eab7dd372b086ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"315a6cb0-74be-11eb-a956-8766d2dd0181"},"incident_date":"2020-06-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d65847107aa","org_name":"Oracle Corporation","org_type":"technology_saas","ransomware":null,"records_affected":1000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/06/19/oracle-bluekai-web-tracking/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thehindubusinessline.com/info-tech/billions-of-records-from-oracles-bluekai-exposed-online-due-to-security-lapse-report/article31877288.ece;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thedigitalhacker.com/oracles-bluekai-exposed-billions-of-records-of-web-tracking-data/"}],"summary":"Billions of records belonging to a database maintained by cloud platform BlueKai were left exposed online due to a security lapse, according to a TechCrunch report.  BlueKai, a startup acquired by Oracle in 2014 maintains a large database acquired through web tracking. It is mean","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2020-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad474fda248a3efd40a413215a66bf0047598ad3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75f2d380-23ab-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-06-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JO","org_id":"5ab0fb2fe3f3","org_name":"Government of Jordan","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zawya.com/mena/en/legal/story/Jordan_govt_refers_official_document_leak_case_to_Cyber_Crimes_Unit-SNG_177614143/"}],"summary":"AMMAN - The government on Friday referred the third case related to a leak of official documents within two weeks to the Public Security Department’s Cyber Crimes Unit to take necessary legal action against public servants involved in the case.  The move is based on a recommendat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483dedd6458b56c9e91a6db0abd343297d289caa","impact_type":"both","incident_date":"2020-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CodeMetro%20California%20Notice%20Letter%20Templates_1.PDF"},"notes":null,"org_country":"US","org_id":"af137f14e1f3","org_name":"CodeMetro","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CodeMetro%20California%20Notice%20Letter%20Templates_1.PDF"}],"summary":"CodeMetro reported a ransomware attack and unauthorized access to a database server, from which criminals copied and removed some patient data.","supporting_quote":null,"technology_involved":["database server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-18","discovered_date":"2020-04-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8be127409cc7d4070403b66d7cf385d25a81a23a","impact_type":"unknown","incident_date":"2019-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31f8fcb48370","org_name":"Zipari","org_type":"unknown","ransomware":null,"records_affected":49510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Zipari-2020-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9059334331ec7c3f0ebe060a8d9e242c888fcff0","impact_type":"unknown","incident_date":"2020-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dcbb3dfa2e2b","org_name":"Umatilla Morrow Head Start, Inc.","org_type":"unknown","ransomware":null,"records_affected":548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Umatilla%20Morrow%20Head%20Start%2C%20Inc.-2020-06-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"AU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65de2bcddfa354d8f4e66bb286505b2d36d94a06","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e5fe7320-f2b2-11ea-8781-7798bdcc4349"},"incident_date":"2020-06-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"da0e29add740","org_name":"St Kilda Football Club","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.smh.com.au/national/victoria/st-kilda-players-medical-files-stolen-in-car-smash-and-grab-20200715-p55cay.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.smh.com.au/national/victoria/st-kilda-players-medical-files-stolen-in-car-smash-and-grab-20200715-p55cay.html"}],"summary":"Private medical information belonging to players at St Kilda Football Club is missing after a bag belonging to the team doctor was stolen from a car parked outside his Kew home last month.  Among the items taken from long-time club physician Dr Ian Stone were written files about ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-18","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12c228a605cffd14f8635b99b27caafa65db2f91","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Le%20Duff%20America%2C%20Inc.%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"7017412aad77","org_name":"Le Duff America, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191125"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Le%20Duff%20America%2C%20Inc.%20-%20CA.pdf"}],"summary":"Le Duff America found that certain employee email accounts were accessed without authorization, and personal information was present in an affected account.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-18","discovered_date":"2019-12-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6815c296b870cdc302be2b6897be9a7e41fb8074","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Medical%20Technologies%20-%20Adult%20Notification%20Letter%20%2812%20Months%29%20V5%20Final.pdf"},"notes":null,"org_country":"US","org_id":"cd73eeebb90e","org_name":"American Medical Technologies","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191114"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Medical%20Technologies%20-%20Adult%20Notification%20Letter%20%2812%20Months%29%20V5%20Final.pdf"}],"summary":"American Medical Technologies reported suspicious activity in an employee email account, and personal and medical information may have been available to the attacker.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-17","discovered_date":"2020-05-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e04fa850f10e60cade7da0ecac30c3020aad1bf3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aeries%20Data%20Breach%20Notification%20to%20Parents.pdf"},"notes":null,"org_country":"US","org_id":"b7772bbbe3b8","org_name":"El Dorado County Office of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aeries%20Data%20Breach%20Notification%20to%20Parents.pdf"}],"summary":"Unauthorized access to the Aeries Student Information System may have exposed parent and student login information and personal details.","supporting_quote":null,"technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-17","discovered_date":"2020-04-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f57da5d0d7f0a9826f291d07b5c84fa171c06c2a","impact_type":"both","incident_date":"2020-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%201.pdf"},"notes":null,"org_country":"US","org_id":"977765850849","org_name":"Cognizant Technology Solutions Corporation","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%201.pdf"}],"summary":"Cognizant reported a ransomware attack in which attackers staged and likely exfiltrated data, including information relating to corporate credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3720dbdf71908701636ac04bbb92b7b466d3ded","impact_type":"data_theft","incident_date":"2019-12-30","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"9e5500db8b90","org_name":"Sonicbids","org_type":"technology_saas","ransomware":null,"records_affected":751700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sonicbids","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sonicbids"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190975"}],"summary":"Sonicbids reported a data breach involving third-party cloud hosting services that exposed user names, usernames, email addresses, and hashed passwords.","supporting_quote":"In December 2019, the booking website Sonicbids suffered a data breach which they attributed to \"a data privacy event involving our third-party cloud hosting services\".","technology_involved":["third-party cloud hosting services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-16","discovered_date":"2020-04-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8935c2f750db5ad56fe43b374793068aa162182","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10561.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0d75fbc26d94","org_name":"Providence Health Plan","org_type":"healthcare","ransomware":null,"records_affected":3324,"reviewed":false,"root_cause":"A coding error made unencrypted Providence Health Plan enrollment documents accessible to unauthorized individuals.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10561.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10561.pdf"}],"summary":"Providence Health Plan enrollment documents were accessible to unauthorized individuals due to a coding error at its service provider, Zipari.","supporting_quote":"Zipari discovered that a coding error had resulted in certa in unencrypted Providence Health Plan enrollment documents being accessible to unauthorized individuals.","technology_involved":["Zipari"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Zipari"},"updated_at":"2026-10-12","veris_action":"error","derived":{"vendors":[{"id":"31f8fcb48370","name":"Zipari"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3edd240d0a8101c3be6b59600d3f5d383474b1e5","impact_type":"both","incident_date":"2020-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TEMPLATE%20CodeMetro%20HIPAA%20Individual%20Notice_2_1.pdf"},"notes":null,"org_country":"US","org_id":"1008098fb406","org_name":"Optima Family Services, Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190982"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TEMPLATE%20CodeMetro%20HIPAA%20Individual%20Notice_2_1.pdf"}],"summary":"Optima Family Services reported that criminals accessed a database server before deploying ransomware and copying and removing patient information.","supporting_quote":null,"technology_involved":["database server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"926fbb4e8c4faeb0432644ad658112a57c1af31b","impact_type":"data_theft","imported_from":null,"incident_date":"2016-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bc78b3d609bd","org_name":"Foodora","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Foodora","type":"hibp","url":"https://haveibeenpwned.com/Breach/Foodora"}],"summary":"Foodora customer data, including personal information and passwords, was breached in April 2016.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2020-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b1491a9840de11a7cd0f32cb1fbb4549478c97f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ca41da0-f206-11ea-9eb3-fb45745214a6"},"incident_date":"2020-06-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38adf14b4c2e","org_name":"A place for mom","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mcknightsseniorliving.com/home/news/a-place-for-mom-wins-preliminary-injunction-against-former-employee-in-trade-secrets-case/"}],"summary":"enior living and care referral service provider A Place for Mom has won a preliminary injunction against a former employee who allegedly stole trade secrets and used proprietary information to solicit customers for a direct competitor.  Lisa Perkins was hired as a healthcare acco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17d0ec7432192bc986bf2cb4d2c972395e84d186","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7156d660-099b-11ec-863c-8359987c65e0"},"incident_date":"2020-06-15","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"150d8d415242","org_name":"Arizona Asthma and Allergy Institute","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/arizona-asthma-and-allergy-institute-provides-notice-of-maze-attack-in-2020/"}],"summary":"Arizona Asthma and Allergy Institute Provides Notice of Maze Attack in 2020","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-15","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc4007e56e2f28b5eb1409abfdb96ddd3970d130","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20notification%20for%20CA%20AG%20submission.pdf"},"notes":null,"org_country":"US","org_id":"a406f67c36dd","org_name":"Andrew Dang, DDS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20notification%20for%20CA%20AG%20submission.pdf"}],"summary":"A computer containing patients’ Social Security numbers was stolen during a break-in at Andrew Dang, DDS’s office.","supporting_quote":"On Sunday, April 19, 2020, during the pandemic and while my business was closed, I went into my office and discovered that a break-in had occurred and my office had been burglarized, including the theft of, among other things, our office computer.","technology_involved":["office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de16ee70a06cd44a3ae87475b3712967c24f9f81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00ff9960-40d7-11ec-b81c-33d442e55df8"},"incident_date":"2020-06-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e00cffd7d5b","org_name":"Sarasota Citgo","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wfla.com/news/sarasota-county/police-find-skimming-devices-at-sarasota-citgo/"}],"summary":"Police find skimming devices at Sarasota Citgo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2020-06-12","discovered_date":"2020-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d42f00627c96e3af0c7c69d2fc6ba38b01318cca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Security%20Breach%20Notice%20Letter%20%28Domestic%29%20%281%29%20Final.pdf"},"notes":null,"org_country":"US","org_id":"5a5206ce412d","org_name":"You Can Trade, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190827"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Security%20Breach%20Notice%20Letter%20%28Domestic%29%20%281%29%20Final.pdf"}],"summary":"You Can Trade, Inc. discovered that unauthorized persons accessed customer and prospective-customer data, including personal information and limited payment-card details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-12","discovered_date":"2020-04-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"18d3341609371f3b9adbdb3c078cbe1c3f98db37","impact_type":"unknown","incident_date":"2019-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9563bbf1b335","org_name":"The Waldorf Center","org_type":"unknown","ransomware":null,"records_affected":606,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Waldorf%20Center-2020-06-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5845d9725f028594eba793e168fdb21153ca9ad0","impact_type":"unknown","incident_date":"2020-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/8878948.PDF"},"notes":null,"org_country":"US","org_id":"3dd264a5e60b","org_name":"McKinney & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/8878948.PDF"}],"summary":"McKinney & Company received notice that some clients’ 2019 federal tax returns had been fraudulently filed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-12","discovered_date":"2020-06-02","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc9d7cec3b7364ba19c3ec200db5548dee18ba16","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KIPP%20SoCal%20Public%20Schools%20GitHub%20Data%20Breach%20Notification%20Letter%20to%20Families%206.11.20.pdf"},"notes":null,"org_country":"US","org_id":"58624b02e07b","org_name":"KIPP SoCal Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An incorrect privacy setting made the GitHub data file searchable.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KIPP%20SoCal%20Public%20Schools%20GitHub%20Data%20Breach%20Notification%20Letter%20to%20Families%206.11.20.pdf"}],"summary":"An incorrect privacy setting made a KIPP SoCal student data file on GitHub searchable, and the organization determined student information had been accessed without authorization.","supporting_quote":"The issue was found when a vendor that we contract with discovered that our GitHub page containing the data file had an incorrect privacy setting, allowing our data file to be searchable within the confines of GitHub from October 3, 2019 through June 2, 2020.","technology_involved":["GitHub"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a6f21366be4b1b5b2307daac0080e641c669d7c","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Apple%20Valley%20notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"42329fa15e64","org_name":"Apple Valley Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190828"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abb911b2fc44eb7aa8a537d5b112cac7f45f3e6d","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20-%20Zoosk.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2a0adb7740f9","org_name":"Zoosk","org_type":"technology_saas","ransomware":null,"records_affected":23927853,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zoosk (2020)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zoosk2020"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20-%20Zoosk.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10556.pdf"}],"summary":"An unauthorized third party accessed Zoosk data stored in a database hosted by a third party, where some profile information may have been readable.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-11","discovered_date":"2020-05-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d8cef973c5cdfc43eb060a0572bfd29dd4b8a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Email%20to%20Parents%20About%20Data%20Breach%202019.pdf"},"notes":null,"org_country":"US","org_id":"bcd876134eb5","org_name":"Yuba City Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual successfully exploited a vulnerability in the Aeries software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190824"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Email%20to%20Parents%20About%20Data%20Breach%202019.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the Aeries Student Information System, and the District could not rule out access to parent and student data.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual attempted to exploit a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-11","discovered_date":"2020-05-05","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1209570e21431e04f53f40dbeb79345366d20500","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SLUSD%20Aeries%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a08e51989263","org_name":"San Leandro Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the Aeries software allowed access to student and parent information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190823"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SLUSD%20Aeries%20Breach%20Notification.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the Aeries Student Information System and may have accessed student and parent information.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual exploited a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ce98fed659a320f270329aa4ecfe1adef82a655","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Amended%20Notice%20of%20Data%20Breach.6.10.2020.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"80d144d6cf83","org_name":"Mt. Diablo Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190791"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-11","discovered_date":"2020-05-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e23f3676071eb218a2a46fab71a7808c6d039fc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-04-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer_Letter%20%2820200610%29.pdf"},"notes":null,"org_country":"US","org_id":"72723e85b02e","org_name":"MaxLinear, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190822"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer_Letter%20%2820200610%29.pdf"}],"summary":"MaxLinear discovered unauthorized access to its systems and files containing personal information, with access occurring from approximately April 15 to May 24, 2020.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfdf7955601764e013646e2b8f44cdc3fae7d2c7","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gonzalez%20CPA%20.pdf"},"notes":null,"org_country":"US","org_id":"b456454faec8","org_name":"Gonzalez CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190819"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gonzalez%20CPA%20.pdf"}],"summary":"Gonzalez CPA notified clients of fraudulent tax filings and said an investigation had not determined whether their information was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef56487c6305ccb1c79a59de635001161f1cfdd7","impact_type":"data_theft","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CUHSD%20Parent%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a1718314d671","org_name":"Corning Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190790"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CUHSD%20Parent%20Notification.pdf"}],"summary":"Corning Union High School District reported unauthorized access through the Aeries SIS that exposed parent and student login information, addresses, email addresses, and password hashes.","supporting_quote":null,"technology_involved":["Aeries SIS"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-11","discovered_date":"2020-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36d204663d602f849fb5a205dced871b35e11098","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bailard%20-%20CA%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"5a9c489310e6","org_name":"Bailard, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190820"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bailard%20-%20CA%20Notice%20of%20Data%20Event.pdf"}],"summary":"Bailard reported unauthorized access to an employee email account containing names and Social Security numbers, with no evidence that the information was viewed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c1471ac83e6bfe0be82448dca20497a96a3abe4","impact_type":"unknown","incident_date":"2020-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Affected%20Beneficiary%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"39f5005bf618","org_name":"Genworth","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190768"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192115"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-06-09","discovered_date":"2020-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e09d29102e1f0e4c14f00224eadf4e68b07e8604","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/10up%20Breach%20-%20SFERS%20Notice%20Website%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"4c0e2b0af10e","org_name":"San Francisco Employees' Retirement System","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190732"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/10up%20Breach%20-%20SFERS%20Notice%20Website%20FINAL.pdf"}],"summary":"A test server operated by 10up containing SFERS member data was accessed by an outside party, but the organization could not confirm whether the information was viewed or copied.","supporting_quote":null,"technology_involved":["test server","database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"10up Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"764b405cf711","name":"10up Inc"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"609a38ae1f7cc7b5101d73c6417718f44d592db5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7d2d670-0d91-11eb-8a4c-a57973eceafd"},"incident_date":"2020-06-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"69c190ff608a","org_name":"Natura & Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":290000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.darkreading.com/application-security/avon-server-leaks-user-info-and-administrative-data/d/d-id/1338468,https://www.scmagazine.com/website-web-server-security/did-avon-attackers-exploit-an-unprotected-web-server-as-a-path-of-least-resistance/,https://securityboulevard.com/2020/07/avon-cosmetics-leaks-7gb-of-personal-and-technical-information-from-unsecured-server/"}],"summary":"unsecure elastic search dtabase","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-08","discovered_date":"2020-05-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b0fc3f84382ae05c57c0bb7521e065a7b29c688","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aeries%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"c09b3b570058","org_name":"Fairfield-Suisun Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual exploited a vulnerability in the Aeries software.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190718"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aeries%20Notice%20of%20Data%20Breach.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the Aeries Student Information System and may have accessed Fairfield-Suisun Unified School District student and parent information.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual exploited a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-08","discovered_date":"2020-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"170576cafee878b55851870fbc153fa3e85adb8c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_4.pdf"},"notes":null,"org_country":"US","org_id":"46645d4af2a2","org_name":"Castro Valley Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190727"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_4.pdf"}],"summary":"Castro Valley Health, Inc. reported that patient information was inadvertently transferred to Docker Hub during 2016–2017 and removed after the organization learned of it.","supporting_quote":null,"technology_involved":["Docker Hub"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"717732feb8826ad306ef1d5558802e88c00d7b2d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BOUSD%20Aeries%20Notice%20of%20Data%20Breach%20to%20Parents%20-%20Official.pdf"},"notes":null,"org_country":"US","org_id":"ca296d8a3a29","org_name":"Brea-Olinda Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BOUSD%20Aeries%20Notice%20of%20Data%20Breach%20to%20Parents%20-%20Official.pdf"}],"summary":"Unauthorized access to the Aeries Student Information System may have exposed parent and student login information, addresses, email addresses, and password hashes.","supporting_quote":null,"technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eb3a9497cbbb7afcf0bdb88341d380ca5dbb4f4","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"75b63754db17","org_name":"Zoomcar","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zoomcar","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zoomcar"}],"summary":"A breach of Zoomcar exposed names, email and IP addresses, phone numbers, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-05","discovered_date":"2020-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2ef457d7dbe19b837eea1af575ac5f6ae62469e","impact_type":"data_theft","incident_date":"2019-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification%20Letter%20-%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"3af0e1a8e086","org_name":"Pen Factory","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification%20Letter%20-%20Redacted.pdf"}],"summary":"Malicious code on Pen Factory’s website collected customers’ checkout information and delivered it to an unauthorized third party.","supporting_quote":"On April 15, 2020, we learned an unauthorized third party placed malicious computer code on our website (https://www.penfactory.com/).","technology_involved":["Pen Factory website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-05","discovered_date":"2020-03-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"da2a13dde0d526f18e5167539c1cc1f98058102d","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/DAKAmericas.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac417e09be12","org_name":"DAK Americas, LLC","org_type":"manufacturing","ransomware":true,"records_affected":1802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/DAKAmericas.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/DAKAmericas.pdf"}],"summary":"DAK Americas reported that an unauthorized actor accessed a legacy virtual server infected with ransomware, which contained employee personal and salary information.","supporting_quote":null,"technology_involved":["virtual server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-05","discovered_date":"2020-05-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c5c5759bb35ca472fe89fc67bdcd275f6ae3237","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notices%20-%20ABCUSD.pdf"},"notes":null,"org_country":"US","org_id":"078e05cd8d50","org_name":"ABC Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An issue in Aeries software allowed unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190664"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notices%20-%20ABCUSD.pdf"}],"summary":"ABC Unified School District reported unauthorized access to data in its Aeries Portal, and said there was no evidence that the data was taken or misused.","supporting_quote":"Aeries Software has since patched the software issue that allowed the unauthorized access to occur.","technology_involved":["Aeries Portal"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"617a596c03ef427afaf30f654957ca8cbe2747d1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5e9054d0-1f98-11ec-aba2-27b717aed560"},"incident_date":"2020-06-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8c216e086bf","org_name":"Columbia College Chicago","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://columbiachronicle.com/breaking-columbia-student-information-at-risk-in-ransomware-attack"}],"summary":"Columbia University is the latest victim in an attack by a group of data hackers known as NetWalker that is threatening to publish students’ private data and sell their personal information on the dark web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e82edaef4765ac77843c2b50cfcc846bbb9d0916","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-03-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c015c73450d5","org_name":"Lead Hunter","org_type":"unknown","ransomware":null,"records_affected":68693853,"reviewed":false,"root_cause":"Personal information was left exposed on a publicly facing Elasticsearch server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lead Hunter","type":"hibp","url":"https://haveibeenpwned.com/Breach/LeadHunter"}],"summary":"Lead Hunter data containing personal information was found exposed on a publicly facing Elasticsearch server.","supporting_quote":"In March 2020, a massive trove of personal information referred to as \"Lead Hunter\" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-03","discovered_date":"2020-03-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d6228a386357e00b8ca9e4f5727970c7c08e5417","impact_type":"unknown","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"579ae4ee3518","org_name":"Grande Ronde Hospital","org_type":"unknown","ransomware":null,"records_affected":1345,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Grande%20Ronde%20Hospital-2020-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8cf42ce0dd3d332650822c6b71de7aed46c4c94","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"0c16ed75492d","org_name":"Bombas LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190612"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notice_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bombas%20LLC-2020-06-03"}],"summary":"Bombas reported that malicious code may have exposed customers’ personal information and payment card data through its e-commerce platform.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01cbdf29b7a3c6b0e8a84cb59311c0120d79d8ea","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2c2e82c0-237a-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-06-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b7fe4e18ff2","org_name":"Arbiter Sports","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Arbiter%20-%20California%20Notification.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.soccerwire.com/news/over-500000-referee-and-sports-accounts-reportedly-exposed-in-hack-of-arbitersports/"}],"summary":"ArbiterSports, the leading platform used by colleges, high schools and youth sports organizations to manage and pay assignments of sports officials, suffered a malicious hack this past summer, according to several public reports and confirmed by SoccerWire through research of cou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07913858d05dc89a60358ae00d13b2c8fb86b913","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/Parent%20Notification%20%28Spanish%29-%20Final%2005.26.20.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98999f7b8eed","org_name":"Yucaipa-Calimesa Joint Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190581"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-02","discovered_date":"2020-04-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"394850fcfe2c1e9a25a9804801785ca8d5b04f78","impact_type":"data_theft","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2020-05-22%20-%20Aeries%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"95cd7da5c8f4","org_name":"San Bernardino City Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual exploited a vulnerability in the Aeries software to access student and parent information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190582"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2020-05-22%20-%20Aeries%20Breach.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in the Aeries Student Information System and accessed student and parent information.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual exploited a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-06-02","discovered_date":"2020-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4d670ac22871b712fb452894ac222ce7d8ab420","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RUSD%20-%20Aeries%20Breach%20Parent%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"7e89d51468c4","org_name":"Rocklin Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RUSD%20-%20Aeries%20Breach%20Parent%20Notification.pdf"}],"summary":"Rocklin Unified School District reported that unauthorized access to its Aeries Student Information System exposed parent and student information.","supporting_quote":null,"technology_involved":["Aeries SIS","on-premise databases"],"third_party":{"archetype":null,"involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"dcb5e96eff4773a8ae5fbbe11b4adf1babc5de4b","impact_type":"data_theft","incident_date":"2020-04-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ListIndustries.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5833bb77dce7","org_name":"List Industries","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ListIndustries.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ListIndustries.pdf"}],"summary":"List Industries reported that a malware attack on April 12, 2020 resulted in unauthorized access to and acquisition of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-06-02","discovered_date":"2020-04-28","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13ad4c433e2ed62898be1475aebbcfafd20a4853","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-04-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notice%20Letter%20%28HB%20Changes%29%20April%202020%20Break%20in%20letter.pdf"},"notes":null,"org_country":"US","org_id":"2b38965ecddd","org_name":"Allergy & Asthma Medical Group of the Bay Area","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice%20Letter%20%28HB%20Changes%29%20April%202020%20Break%20in%20letter.pdf"}],"summary":"A break-in at Allergy & Asthma Medical Group of the Bay Area’s Berkeley office resulted in three stolen laptops that may have contained patient names, dates of birth, identification numbers, physician names, and FeNo results.","supporting_quote":"On April 28, 2020, Allergy & Asthma Medical Group of the Bay Area discovered that its Berkeley physicians' office was broken into during the evening of April 27, 2020.","technology_involved":["laptops"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Maze Group","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c975e0443caa77389187a5b223a27f548948ae0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee72bac0-754d-11eb-a956-8766d2dd0181"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34f7aaeca416","org_name":"VT San Antonio Aerospace","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2020-06-05/vt-san-antonio-aerospace-hit-with-criminal-ransomware-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/us-aerospace-services-provider-breached-by-maze-ransomware/"}],"summary":"VT San Antonio Aerospace Inc., which provides maintenance, repair and overhaul services to aircraft, was hit with a ransomware attack affecting its U.S. commercial operations.  A criminal group known as Maze “gained unauthorized access to our network and deployed a ransomware att","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"mazegroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-01","discovered_date":"2019-08-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9386c6c6a061273cf7b7654cb7890cefa3c22cda","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Sample%20Notification%20Letter%20PQC.pdf"},"notes":null,"org_country":"US","org_id":"a10239e6ad2a","org_name":"Paul Quinn College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Sample%20Notification%20Letter%20PQC.pdf"}],"summary":"Paul Quinn College reported that unauthorized parties accessed employee email accounts containing some personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63255b6212032dd1b9cdb0bf188a045357f3af94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9f5aa390-74a7-11eb-a956-8766d2dd0181"},"incident_date":"2020-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"3844d952572b","org_name":"OneClass","org_type":"education","ransomware":null,"records_affected":8900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tomsguide.com/news/oneclass-data-leak"}],"summary":"The personal information of more than one million students, mostly in North America, who use a Canadian study-aid service could have been accessed by anyone as a result of an improperly secured online database.  The data leak affected e-learning platform OneClass, which offers cl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7704a5fd7ffb256c339bd76609bd8845c910eac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75fb88f0-f6af-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3e0d83fd1dc8","org_name":"North Okanagan Pediatric Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.keremeosreview.com/news/north-okanagan-pediatric-clinic-hacked/"}],"summary":"Canadian Pediatric clinic hacked with ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78de798c148a377a5c90bb1f3a4fbc6e1e8275f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1db1740-04aa-11eb-8c43-8ded27596b66"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06833f51cf99","org_name":"Muskingum Valley Health Centers","org_type":"healthcare","ransomware":true,"records_affected":7447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/ohio-hospital-s-ehr-hit-by-ransomware-attack-exposes-7-000-patients-info.html"}],"summary":"Muskingam Valley Health Centers had their EHR system hit by ransomware encrypting 7447 patient's data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbc291547f20b7eefad17033d804fc85ba51c8fa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66207d00-e641-11eb-b667-c585fe0ca11b"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"d6a7d67ed661","org_name":"MasMovil","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/spanish-telecom-giant-masmovil-hit-by-revil-ransomware-gang/"}],"summary":"MasMovile a Spanish telecom operator got hit by REvil","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0233c5e00cfbed5e043eed1c2ae5c131932e4cc8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e1e0be0-f6c6-11ea-b7b2-2361ceadc5c7"},"incident_date":"2020-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38fd132d5f02","org_name":"Mainecare","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Developer accidentally publishes sensitive information on github","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Netwalker","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fe232d492884b46880d4cb1961dc5362d3b5464","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2c5d350-04ad-11eb-8c43-8ded27596b66"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"186db9c7de5e","org_name":"Lorien Health Services","org_type":"healthcare","ransomware":true,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/lorien-health-services-discloses-ransomware-attack-affecting-nearly-50-000/"}],"summary":"Lorien Health Services in Maryland experienced a name and shame ransomware attack (Netwalker) ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"netwalker"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cd9d0cec5744efb248cee8c7386c0dcb84a22ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b110d310-e7b8-11ea-8ff0-e3594c873b30"},"incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"f377438df192","org_name":"KreditPlus","org_type":"financial","ransomware":null,"records_affected":769000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thepaged.com/kreditplus-data-breach-exposed-900k-users-data/"}],"summary":"KreditPlus is an Indonesian brand providing digital finance service. It was established by PT. Finansia Multi Finance in 2014.  KreditPlus suffered from a huge data breach that exposed over 900k records and the database is now available on different hacking forums","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9080b4f8daa90a8140e00158087b45ed36a6f16","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc7513a0-243a-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9f680f25c73b","org_name":"Hockley General Practice Surgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.birminghammail.co.uk/news/midlands-news/fears-patient-files-hockley-gp-18375560"}],"summary":"THOUSANDS of alerts have been sent to patients at a leading GPs' practice amid fears their medical records have been hacked.  Staff at Hockley Medical Practice, based in the Jewellery Quarter, have acted swiftly after being made aware of the possible cyber attack.  The surgery ha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"attacker known as Netwalker","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31929554d7c3d70a86260e743bc6a09fdeab29a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8e0bbd20-2436-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3729039d492c","org_name":"Crozer-Keystone","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pennsylvania-health-system-hit-by-netwalker-ransomware/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pennsylvania-health-system-hit-by-netwalker-ransomware/"}],"summary":"Netwalker, a ransomware operator that threatens to publish data online if ransoms aren't paid, hacked Springfield, Pa.-based Crozer-Keystone Health System and is auctioning off its data online, according to Cointelegraph.   The ransomware gang is selling the stolen data from Croz","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"attackerknownasnetwalker"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"263ea9426c8d6ce445ea7670219283d69664b407","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7168500-0a54-11eb-a175-e162319ad19d"},"incident_date":"2020-05-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e660c0689ef","org_name":"mycastingfile.com","org_type":"technology_saas","ransomware":null,"records_affected":260000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.safetydetectives.com/blog/mycastingfile-leak-report/"}],"summary":"internet exposed Elastic Search database of 260,000 pii records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2020-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8ee3a42843991923fa9e51b14e5bb5283db5c4e","impact_type":"data_theft","incident_date":"2019-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"6d55cd0f19c3","org_name":"The Crucible","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190506"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%281%29.pdf"}],"summary":"Malicious code on TheCrucible.org skimmed checkout information and saved it to an image file hosted on the site.","supporting_quote":null,"technology_involved":["TheCrucible.org"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-05-29","discovered_date":"2020-01-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c1c99d1b959add84e16dd0f236500d91d2f1abc","impact_type":"data_theft","incident_date":"2019-12-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10554.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"f2baee7afbdb","org_name":"Swedish Health Services","org_type":"healthcare","ransomware":null,"records_affected":12573,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10554.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10554.pdf"}],"summary":"An unauthorized user obtained Providence caregiver credentials and downloaded a file containing Swedish caregivers’ personal and compensation information.","supporting_quote":"We promptly initiated an investigation and determined that the unauthorized user obtained the login credentials of a small number of Providence Health & Services caregivers, including some who support programs involving Swedish caregivers.","technology_involved":["email account"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"Providence Health & Services"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"c93022afa4b8","name":"Providence Health & Services"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-29","discovered_date":"2020-05-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cb3f94b2446920e5988412968d6aefbc01efbde","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Parent%20Letter%20-%20Security%20Breach%20-%20LBUSD%20v6%20%281%29.pdf"},"notes":null,"org_country":"US","org_id":"d12f2f87cf33","org_name":"Laguna Beach Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in Aeries software allowed access to student and parent information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Parent%20Letter%20-%20Security%20Breach%20-%20LBUSD%20v6%20%281%29.pdf"}],"summary":"An unauthorized individual exploited a vulnerability in Aeries software and accessed parent and student data in the district’s Aeries System.","supporting_quote":"In late November 2019, Aeries learned that an unauthorized individual attempted to exploit a vulnerability in the Aeries software that would allow access to student and parent information.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-29","discovered_date":"2020-04-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99d8edc0801fc118d34048b6c4588a1f04d53af3","impact_type":"data_theft","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aeries%20Parent%20Portal%20-%20SPANISH%20%283%29.pdf"},"notes":null,"org_country":"US","org_id":"2a9b621a422b","org_name":"Inglewood Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An attacker exploited a vulnerability in Aeries software that allowed access to parent and student information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190498"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aeries%20Parent%20Portal%20-%20SPANISH%20%283%29.pdf"}],"summary":"An unauthorized person exploited a vulnerability in Aeries software and may have accessed parent and student information in Inglewood Unified School District’s Aeries system.","supporting_quote":"A fines de noviembre del 2019, Aeries se enteró de que una persona no autorizada explotó una vulnerabilidad en el software Aeries que permitiría el acceso a la información de los padres y estudiantes.","technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-05-29","discovered_date":"2019-11-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bad9f4403018f8661bf88e2df9c290b36d09882","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Good%20Samaritan%20%231A%20PHI%20Ad%20SSN%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"4c834893032d","org_name":"Good Samaritan Hospital, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing campaign led to unauthorized access to employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192546"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Good%20Samaritan%20%231A%20PHI%20Ad%20SSN%20r3prf.pdf"}],"summary":"A phishing campaign led to unauthorized access to Good Samaritan Hospital employee email accounts, which may have contained personal, medical, and financial information.","supporting_quote":"Following progress by experts in their thorough investigation, it was ultimately determined that several employee email accounts experienced unauthorized access between October 28, 2019 and November 8, 2019 as a result of the above-referenced phishing campaign.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eef6d901e15ec2306e9ddce406ce6c06bfe7f136","impact_type":"unknown","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5102e9b03026","org_name":"Central School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190499"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","other"],"disclosed_date":"2020-05-29","discovered_date":"2020-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aa32a70c6507fd86171ce261a3c9139a712ca09","impact_type":"disruption_or_ransomware","incident_date":"2020-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Catholic%20Charities_Client.pdf"},"notes":null,"org_country":"US","org_id":"8a80fe57cd07","org_name":"Catholic Charities, Diocese of San Diego","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190468"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Catholic%20Charities_Client.pdf"}],"summary":"Catholic Charities, Diocese of San Diego experienced a ransomware attack that disrupted its system and allowed unauthorized access to client data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c06807c50c6bdfef858acb2a9ceb2d1d7ca78f7","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6f09e488283b","org_name":"Wishbone","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wishbone (2020)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wishbone2020"}],"summary":"Wishbone user information, including personal details and passwords stored as unsalted MD5 hashes, was leaked online.","supporting_quote":null,"technology_involved":["Wishbone mobile app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-28","discovered_date":"2020-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fc010bf33463ead3fd049c480d8deb96137c21f","impact_type":"data_theft","incident_date":"2020-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2b460f4b2aff","org_name":"Minted, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10553.pdf"}],"summary":"Minted reported that unauthorized actors obtained information from its user account database, including names, login credentials, and some contact and address information.","supporting_quote":null,"technology_involved":["user account database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"609a438ed804c091a58998884ac719074a047a57","impact_type":"unknown","incident_date":"2019-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice-Data-Breach-Incident-05282020.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b7b8ed8d280","org_name":"Lassen Union High School Distirict","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190459"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce103673efd7d5e2d77f16c03d44b7d8e157fa5f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-16","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"3aae7798f2bf","org_name":"Amtrak","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter.pdf"}],"summary":"Amtrak reported unauthorized access to certain Amtrak Guest Rewards accounts using compromised usernames and passwords, and said some personal information may have been viewed.","supporting_quote":"We have determined that compromised usernames and passwords were used to access certain accounts and some personal information may have been viewed.","technology_involved":["Amtrak Guest Rewards accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24dbe8628d62c1fa6d07349c414403af0a0dc2aa","impact_type":"unknown","incident_date":"2020-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20to%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"502654373f59","org_name":"SFO","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190404"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2020-05-27","discovered_date":"2020-04-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1d3c8c67f49aa2e785e8ae8c933255b73068b11","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Icahn%20Automotive%20Ad%20CM%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"55040b3b0588","org_name":"Icahn Automotive Group LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Icahn%20Automotive%20Ad%20CM%20r3prf.pdf"}],"summary":"Icahn Automotive Group discovered unauthorized access to an employee’s email account containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-27","discovered_date":"2020-04-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e8279214a7aa3bcf725ba8e1c453ad07706f0a73","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10552.pdf"},"notes":null,"org_country":"US","org_id":"dc21bca59054","org_name":"Car Wash Partners, Inc.","org_type":"other","ransomware":null,"records_affected":805,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10552.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10552.pdf"}],"summary":"Car Wash Partners reported unauthorized access to employees’ email accounts containing personal information of 805 Washington residents.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-26","discovered_date":"2020-05-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c67b106ba2aa39a5a6c4dfbdc7e82f9dd125d94c","impact_type":"data_theft","incident_date":"2020-05-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Weaver%20Notification%20Letter_Gift%20Card%20Redeemed_2.pdf"},"notes":null,"org_country":"US","org_id":"43643d16e9e9","org_name":"Weaver Fundraising, LLC d/b/a Trail’s End","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker obtained the reset password from network traffic and used it to access an account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190327"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Weaver%20Notification%20Letter_Gift%20Card%20Redeemed_2.pdf"}],"summary":"An unauthorized party obtained a reset password from network traffic, accessed Trail’s End accounts, and claimed gift cards.","supporting_quote":"When we sent a new password to your email address, the unauthorized party was able to pull the new password from network traffic.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f93858bad33ccdee00d8e3ada532673edb5ec744","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2eedcd3ded3d","org_name":"PetFlow","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PetFlow","type":"hibp","url":"https://haveibeenpwned.com/Breach/PetFlow"}],"summary":"A December 2017 PetFlow breach exposed email addresses and passwords, and the data later appeared for sale on a dark web marketplace.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8433fed01740acaedd7d79898d2e59e9714aa8ad","impact_type":"data_theft","imported_from":null,"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c1e6f0e026fe","org_name":"LiveJournal","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LiveJournal","type":"hibp","url":"https://haveibeenpwned.com/Breach/LiveJournal"}],"summary":"An alleged LiveJournal breach dating to 2017 exposed usernames, email addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d921d88e72c7c7371b0db1d04eab736fe54d9be","impact_type":"unknown","incident_date":"2020-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/8861373.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e9d43fdbb3ea","org_name":"Duben & Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190369"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d34a7779fe44034e994475e706b8936cc771bc5","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"JP","org_id":"2980426b506f","org_name":"Lifebear","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lifebear","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lifebear"}],"summary":"A breach of Lifebear exposed email addresses, usernames and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3558a78f715d2d33a7ebbd1efe25c9a956ba2efc","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d472ca6d643f","org_name":"Artsy","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Artsy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Artsy"}],"summary":"Artsy suffered a data breach in April 2018 involving account details that later appeared for sale on a dark web marketplace.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2020-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ac6e10958a641c6a731aea42b3357d066da371e","impact_type":"data_theft","imported_from":null,"incident_date":"2020-05-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f96ee643db13","org_name":"Nulled.ch","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nulled.ch","type":"hibp","url":"https://haveibeenpwned.com/Breach/NulledCH"}],"summary":"Nulled.ch was breached in May 2020, and records including email and IP addresses, usernames, passwords, and an administrator's private messages were published to a rival hacking forum.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-22","discovered_date":"2020-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb6bc4e451dd89d9580115db5294f340291c08bf","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mathway%20Breach%20Notice%20Email.pdf"},"notes":null,"org_country":"US","org_id":"0fd526ec5d24","org_name":"Mathway LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190311"},{"fetched_at":null,"title":"Have I Been Pwned: Mathway","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mathway"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mathway%20Breach%20Notice%20Email.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mathway%20LLC-2020-05-22"}],"summary":"Mathway reported that an unauthorized party acquired customer email addresses and hashed, salted account passwords.","supporting_quote":null,"technology_involved":["Mathway customer accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd335213906ff72eaac1e6b7641358f8a80e5451","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78346410-2374-11eb-a2fc-cdee479fbead"},"incident_date":"2020-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da96549d7420","org_name":"Executive Office of the President of the United States","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://slate.com/news-and-politics/2020/05/trump-press-secretary-exposes-private-banking-information.html"}],"summary":"press secretary shows president's bank information publicly at press conference","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4555213d07b4ddf35dcd6467635dceeebc1d75f","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arbonne%20Exhibit%201%20-%20CA.pdf.pdf"},"notes":null,"org_country":"US","org_id":"ae17846084bd","org_name":"Arbonne International, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190320"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arbonne%20Exhibit%201%20-%20CA.pdf.pdf"}],"summary":"Arbonne reported that an unauthorized actor may have accessed a table containing personal information and account passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-21","discovered_date":"2020-04-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"be0d7c6bf8716c8f67ab5d5cc9d5d5e386957137","impact_type":"unknown","incident_date":"2020-01-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"db06c7e3c2e2","org_name":"Gustafson & Company LLC","org_type":"unknown","ransomware":null,"records_affected":2207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gustafson%20%26%20Company%20LLC-2020-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"13b356cd55309a7748c19a3f360a56cddbcba9b1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10550.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"1bfb825129e4","org_name":"Capital Accounting & Tax","org_type":"professional_services","ransomware":null,"records_affected":1277,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10550.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10550.pdf"}],"summary":"Capital Accounting & Tax reported that fraudulent tax returns were filed using information mirroring clients’ 2018 returns and that client tax information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9331653a347a5de7247a87e82945381d85ebcc1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AERIES%20-%20Data%20Breach%20Notification%20FINAL%202020-04-27.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a1fd9db822c","org_name":"Aeries Software, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190283"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-20","discovered_date":"2020-05-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc7b66f8fe3313b6c311d565c130a1c340ac4662","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Aeries%20Data%20Breach%2020200520.pdf"},"notes":null,"org_country":"US","org_id":"9f2d820f2c35","org_name":"Santa Barbara Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Aeries%20Data%20Breach%2020200520.pdf"}],"summary":"Santa Barbara Unified School District said student ID numbers, parent and student emails, physical addresses, and hashed passwords may have been subject to unauthorized access in a breach involving the Aeries Student Information System.","supporting_quote":null,"technology_involved":["Aeries Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf8a68b7967b34de93b9189d72e99372807e100c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b736440-e7b7-11ea-8ff0-e3594c873b30"},"incident_date":"2020-05-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02fe61601b5c","org_name":"Allergy and Asthma Clinic of Fort Worth","org_type":"healthcare","ransomware":null,"records_affected":69777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/69777-patients-impacted-by-allergy-and-asthma-clinic-of-fort-worth-hacking-incident/"}],"summary":"Allergy and Asthma Clinic of Fort Worth has discovered an unauthorized individual gained access to its computer systems and potentially obtained 69k patients’ billing information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-19","discovered_date":"2020-05-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e0e829633a9ee3f9745384977fd94e922da6a1c","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KECSD_Notice_of_Data_Breach_5_14_20.pdf"},"notes":null,"org_country":"US","org_id":"2e4384621d21","org_name":"Kingsburg Elementary Charter School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A bug in the Aeries Student Information System software allowed the data to be exploited and was patched in December 2019.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KECSD_Notice_of_Data_Breach_5_14_20.pdf"}],"summary":"Kingsburg Elementary Charter School District reported unauthorized access to its Student Information System database through a vulnerability in Aeries software.","supporting_quote":"The vulnerability that allowed the data to be exploited was a bug in the Aeries Student Information System software and was patched in December, 2019.","technology_involved":["Aeries Student Information System software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Aeries Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"691bd4999468","name":"Aeries"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"016739ecd13a6de4fc9a0be23dbd1a16df566958","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09287ff0-2443-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aae9a964a173","org_name":"Woodlawn Dental Center","org_type":"healthcare","ransomware":true,"records_affected":14400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckersdental.com/dentists/35621-ohio-dental-office-data-breach-affects-over-14-400-patients.html"}],"summary":"The HHS OCR HIPAA Breach Reporting Tool website, which lists health data breaches impacting 500 or more individuals, shows that Woodlawn Dental reported on May 18 that a breach affected more than 14,400 individuals.   In a notification statement, Woodlawn says on March 18, it suf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-18","discovered_date":"2020-04-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f84cfac0fa4160a5bb03e3b085ae6575a6fdff6","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prime%20Communications.pdf"},"notes":null,"org_country":"US","org_id":"231f452a1106","org_name":"Prime Communications","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190124"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prime%20Communications.pdf"}],"summary":"Prime Communications inadvertently emailed a file containing employee personal information to a former employee.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f861eca4340455d7950ac139cfaf0191ec03688","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28513b80-a0f7-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-05-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5c8289c3c57","org_name":"Illinois Department of Employment Security","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/illinois-blames-glitch-for-exposure-of-applicant-social-security-numbers-private-data/"}],"summary":"The Illinois Department of Employment Security (IDES) has acknowledged a security lapse that exposed the private information of independent contractors and the self-employed.  IDES blamed the security incident on a \"glitch\" in a new system rolled out to process the claims of citi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-05-18","discovered_date":"2020-03-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fab5a87bcbd32c2c173b780e54b98cf8da461e8","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F5301_DRAFT_Employee_Breach%20Notification_050120%20%28004%29.docx_SAS_PROOF_Rev4.pdf"},"notes":null,"org_country":"US","org_id":"8aa6069ab4be","org_name":"City of Torrance","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F5301_DRAFT_Employee_Breach%20Notification_050120%20%28004%29.docx_SAS_PROOF_Rev4.pdf"}],"summary":"The City of Torrance reported that information about employees was found on the internet and that exposed documents may contain personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29cf265b39173f34f02882bb28e1c54aba395056","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4d62af30-0259-11eb-8781-bfb630cdf748"},"incident_date":"2020-05-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"610471bc1449","org_name":"Dynasplint Systems","org_type":"manufacturing","ransomware":true,"records_affected":102800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/dynasplint-systems-data-breach-impacts-almost-103000-individuals/"}],"summary":"Dynasplint Systems were compromised in a ransomware attack potentially impacting 102800 individuals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6076a5460d48bf964494efbc2f8df9ee6baad90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b198a70-a0f6-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-05-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"787539fe80cd","org_name":"Ohio Department of Job and Family Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.news5cleveland.com/news/continuing-coverage/coronavirus/local-coronavirus-news/personal-information-of-applicants-in-ohios-pandemic-unemployment-assistance-program-exposed-in-data-breach"}],"summary":"Personal data of individuals who applied to Ohio’s Pandemic Unemployment Assistance (PUA) program was exposed in a data breach on May 15, causing information of at least two dozen applicants to be seen by other claimants in the program, according to a letter shared by the Ohio De","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0522410bef8f6e68fea2d26c9252036409405de4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"479372ee0cb9","org_name":"Covve","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Data was left exposed on a publicly facing Elasticsearch server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Covve","type":"hibp","url":"https://haveibeenpwned.com/Breach/db8151dd"}],"summary":"Covve user and contact information was exposed on a publicly facing Elasticsearch server.","supporting_quote":"In February 2020, a massive trove of personal information referred to as \"db8151dd\" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f97b181daf635e5dcd30d19028a6381b8cf22ff7","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SDUHSD%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"07983445ed89","org_name":"San Dieguito Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190021"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SDUHSD%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"San Dieguito Union High School District reported unauthorized access to certain employees’ email accounts, though it could not confirm whether the information present in them was accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c226abcee64f949f52ae63ff33e634ed8ea5496","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PCL%20Constructors%20Ad%20Employee%201yr%20r5prf.pdf"},"notes":null,"org_country":"US","org_id":"5d2ce79d8397","org_name":"PCL Constructors, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PCL%20Constructors%20Ad%20Employee%201yr%20r5prf.pdf"}],"summary":"An unauthorized actor accessed a payroll vendor’s database containing current and former PCL employees’ personal and financial information, though PCL reported no direct evidence of misuse.","supporting_quote":null,"technology_involved":["vendor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7cc69ed6c3f3f0e294aa27006e65a27b73c3cef","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a260dfa0-a0f9-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-05-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"8227b9cf95a3","org_name":"MyBudget","org_type":"technology_saas","ransomware":true,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2020-05-15/mybudget-blames-ransomware-for-system-outage-amid-coronavirus/12252316;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2020-06-03/hackers-threaten-to-release-data-stolen-in-mybudget-cyberattack/12313464"}],"summary":"Money management company MyBudget has confirmed a ransomware attack is the cause of a nationwide systems outage that has left 13,000 customers in financial limbo.  The Adelaide-based company said its systems were likely compromised as it quickly moved its employees onto work-from","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d66e978b7ca80d47d9e5d3e400cc61243d59973","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fc3046d0-a0f7-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-05-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"8c8335008127","org_name":"Goa Police Department","org_type":"government","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.heraldgoa.in/Goa/Public-advised-not-to-make-COVID-patients-report-viral/160647"}],"summary":"The Goa Police have advised people to refrain from circulating details of patients; a day after the government ordered an inquiry into the leakage of the confidential lab report.   Details of the first seven COVID-19 patients were leaked into public domain on Thursday. This was f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"486f62e6f20dd2969d560944a35636ed4a676fad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48254d90-74bc-11eb-a956-8766d2dd0181"},"incident_date":"2020-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"5fc90342f543","org_name":"CDEC Express","org_type":"transportation_logistics","ransomware":null,"records_affected":9000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.redpacketsecurity.com/data-of-9-million-customers-of-the-russian-courier-service-cdek-leaked/"}],"summary":"Data belonging to nine million customers of the CDEC Express transportation service was put up for sale on the Web for 70 thousand rubles ($950). This is the largest leak of personal data in Russian delivery services  Telegram channel In4security noticed that the database contain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4edc7e3af55427c97c63237ec9849b9c34b1348d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b77a2a20-1c79-11ec-bbb1-d17b99816d46"},"incident_date":"2020-05-13","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7305ede10b78","org_name":"Virtu Financial","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/bec-scam-costs-trading-firm-virtu-financial-69-million-a-14804"}],"summary":"BEC Scam Costs Trading Firm Virtu Financial $6.9 Million","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce9243e3997e17fd7e95e4ef38c12d4081e7da4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Chronicle%20CA%20Individual%20Notice.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"7d8645790f12","org_name":"The Chronicle of Higher Education","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the server allowed attackers to obtain administrative account credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189946"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Chronicle%20CA%20Individual%20Notice.pdf"}],"summary":"Attackers exploited a server vulnerability to obtain administrative credentials and access a database containing online account credentials.","supporting_quote":"Through our investigation, The Chronicle determined that unauthorized parties exploited a vulnerability in the server, through which they were able to obtain administrative account credentials for the server.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-05-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65882e951c7c31240d33ce020225f66555586778","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d193ecb0-a1b0-11ea-aa67-0b6b068266ad"},"incident_date":"2020-05-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e39d4421730","org_name":"Palm Beach County School District","org_type":"education","ransomware":null,"records_affected":176000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bocanewsnow.com/2020/05/12/coronavirus-massive-palm-beach-county-school-district-student-password-breach/"}],"summary":"BOCA RATON, FL (BocaNewsNow.com) — The Palm Beach County School District is in the midst of a massive computer security crisis that draws into question the authenticity of every assignment completed by every student since “distance learning” began, after BocaNewsNow.com learned t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7da0a5f53784388eefe05cb7c0cc18945ebdf222","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"380541e0-2395-11eb-a2fc-cdee479fbead"},"incident_date":"2020-05-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2c7ea2e536f","org_name":"Wellington property management company","org_type":"other","ransomware":null,"records_affected":31610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nzherald.co.nz/business/data-leak-more-than-30000-lpm-property-management-clients-personal-data-available/QVXRJZNFCCFG7RWZAPAAPAY3AM/"}],"summary":"Exposed database found by security researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0408fa8b11dbc67028465205457060e4d23d74f","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ee48971e4a8d","org_name":"Ulmon","org_type":"technology_saas","ransomware":null,"records_affected":777769,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ulmon","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ulmon"}],"summary":"Ulmon suffered a data breach in January 2020, and data including email addresses, names, and bcrypt-hashed passwords was posted to a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-08","discovered_date":"2020-03-11","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d353e581d8197a7d1e8cd5710fe2332b2412ca5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Santa%20Rosa%20-%20Notice%20to%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"ff3f487d45d5","org_name":"Santa Rosa & Rohnert Park Oral Surgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Santa%20Rosa%20-%20Notice%20to%20CA_1.pdf"}],"summary":"Santa Rosa & Rohnert Park Oral Surgery reported unauthorized access to an email account between December 20, 2019, and March 11, 2020, which contained names and other unspecified information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-08","discovered_date":"2020-05-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3a401fb7c7682460a681da8912571f9b38a96200","impact_type":"unknown","incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53d3144f334b","org_name":"Carestream Health, Inc.","org_type":"unknown","ransomware":null,"records_affected":2427,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Carestream%20Health%2C%20Inc.-2020-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efbc573d185c8e784c4a46860d5faf51a7f9e3d9","impact_type":"unknown","incident_date":"2019-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Participant%20Notification%20Letter%20-%201%20year.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e35a546cfdb7","org_name":"Principal Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189795"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Principal%20Life%20Insurance%20Company-2020-05-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a9f24dfe47e1e31b677503abe27f8e1a9f508ec2","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10547.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"508b84c66744","org_name":"Principal Financial Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":583,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10547.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-07","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ef1afc2f23651dc18b55321684dd0d0996c5d06","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Atria%20Wealth%20-%20Notice%20to%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"aa3d46d200a9","org_name":"Atria Wealth Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189829"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Atria%20Wealth%20-%20Notice%20to%20CA_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Atria%20Wealth%20Solutions-2020-05-07"}],"summary":"Atria Wealth Solutions reported unauthorized access to an email account containing personal information, but could not confirm whether the information was viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-07","discovered_date":"2020-05-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab1e0edf464a6ede5898635c691010253370aa4f","impact_type":"unknown","incident_date":"2020-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb8b3f7f7d9f","org_name":"Angie Marie Priest","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Angie%20Marie%20Priest-2020-05-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-05-05","discovered_date":"2020-01-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0de26a277abdca68d02333a7a97b9a1bc5bf5fbe","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_8.pdf"},"notes":null,"org_country":"US","org_id":"621c8bbcf474","org_name":"Orchard Medical Consulting","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189742"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190458"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_8.pdf"}],"summary":"Orchard Medical Consulting reported that an unauthorized individual potentially accessed an employee’s email account, where personal and limited medical information may have been accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-05","discovered_date":"2019-07-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72aee25790bbdd5e6c2f260de68b9a3e7501597f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Impact%20MHC-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"fe680fa3132f","org_name":"Impact Mobile Home Communities","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189752"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Impact%20MHC-%20Notice%20of%20Data%20Event.pdf"}],"summary":"Impact Mobile Home Communities reported unauthorized access to employee email accounts, where personal information may have been accessible.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06d72fe8ae22821aead9b73b87b4191616264aeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e3d2f80-723f-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-05-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc5a8209020a","org_name":"Granity Entertainment","org_type":"other","ransomware":null,"records_affected":10880000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securitymagazine.com/articles/92303-adult-live-streaming-website-leaks-1088-billion-records;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thenextweb.com/security/2020/05/05/adult-cam-site-cam4s-data-leak-reportedly-exposes-millions-of-emails-and-private-chats/"}],"summary":"Adult live-streaming site CAM4’s unprotected database exposed millions of personally identifiable records including names, emails, user conversations, payment logs, and IP addresses dating back March, according to a worrying report that’s just been published.  The 7TB database wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","internal"],"disclosed_date":"2020-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d837e5b936110f52c507682c4f8cd52546e3ee6a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Fullerton.pdf"},"notes":null,"org_country":"US","org_id":"6275521cb6e8","org_name":"City of Fullerton","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189750"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Fullerton.pdf"}],"summary":"Unauthorized users accessed the City’s internal data storage account on multiple occasions, and confidential City information appeared in unauthorized public website posts.","supporting_quote":null,"technology_involved":["internal data storage account","email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11f7b2910cb5a0972a8b28296657bc5f1c59f337","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e7a4180-23bc-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-05-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"649536c3e80f","org_name":"Big World Technology","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/stalker-online-breach-13-m-user/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailystar.co.uk/tech/gaming/stalker-online-data-breach-exposes-22232009"}],"summary":"Over 1.2 million user records from the popular Stalker Online MMO game were made available for purchase on hacker forums, a new report from CyberNews has revealed today.  CyberNews, n independent cybersecurity research publication with a mission to educate and protect consumers a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ce23aca7297c814be0f3504e79a10ebad923b41","impact_type":"data_theft","imported_from":null,"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"3e115d487641","org_name":"Elanic","org_type":"retail_ecommerce","ransomware":null,"records_affected":2800000,"reviewed":false,"root_cause":"Data was pulled from a test server where it was exposed publicly.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Elanic","type":"hibp","url":"https://haveibeenpwned.com/Breach/Elanic"}],"summary":"Elanic data from a publicly exposed test server was posted to a hacking forum.","supporting_quote":"Elanic confirmed that they had \"verified the data and it was pulled from one of our test servers where this data was exposed publicly\" and that the data was \"old\" (the hacking forum reported it as being from 2016-2018).","technology_involved":["test server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a19716f2319afba8f6216f95dd6bc278cb136c4b","impact_type":"data_theft","incident_date":"2019-11-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"VN","org_id":"7fcfcc60e2fc","org_name":"TaiLieu","org_type":"education","ransomware":null,"records_affected":7327477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TaiLieu","type":"hibp","url":"https://haveibeenpwned.com/Breach/TaiLieu"}],"summary":"TaiLieu allegedly suffered a breach exposing customer records, including personal information and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cc96320ebf0654e729717cec883b986a0aef3a8","impact_type":"unknown","incident_date":"2019-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pacific_Press_Breach%2004%2024%202020%20v2%5B2%5D.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"50a480adee0e","org_name":"Pacific Press Publishing Association","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189687"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1133"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6216d0f22a2fd3160dd08e67eef58a4ba62b2df","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GDDY%20Customer%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"1fe7e487d0d9","org_name":"GoDaddy.com LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-566826"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GDDY%20Customer%20Notice%20Template.pdf"}],"summary":"GoDaddy reported malware on VPS servers that enabled an unauthorized third party to access them remotely over SSH.","supporting_quote":null,"technology_involved":["VPS server","SSH"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2069a69b4025bba0550f1b9cb2c64e2a53d6d23","impact_type":"data_theft","imported_from":null,"incident_date":"2020-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ID","org_id":"3bd2dfe44864","org_name":"Tokopedia","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tokopedia","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tokopedia"}],"summary":"Tokopedia suffered a data breach in April 2020, exposing personal information and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ca2b691f832392b7b219bfd1d623daad49c1280","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7623f660-243f-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZW","org_id":"1d6fdca7066b","org_name":"Zimbabwe Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nehandaradio.com/2020/05/21/abductees-lawyers-sue-police-boss-over-leaked-forensic-nude-pictures/"}],"summary":"Lawyers representing the three MDC Alliance officials allegedly abducted and tortured last week have filed a notice to sue Police Commissioner-General Godwin Matanga over the conduct of one of his officers, who leaked nude pictures of one of their clients captured for the purpose","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4168c8059cba749882206c4765656f64ad7e1a2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43212eb0-04b2-11eb-8c43-8ded27596b66"},"incident_date":"2020-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cc6f5f69c0d1","org_name":"South East Coast Ambulance","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kentonline.co.uk/ashford/news/data-breach-at-ambulance-service-230388/"}],"summary":"South East Coast Ambulance Service left an internal server exposable to internal to unauthorized people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0360a8b9124690c0f28585e202b330cdd338b653","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fa13100-9f79-11ea-bb5f-9176852f1f89"},"incident_date":"2020-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d753c4121e6c","org_name":"Serco","org_type":"professional_services","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/business/2020/may/20/serco-accidentally-shares-contact-tracers-email-addresses-covid-19"}],"summary":"Serco accidentally shares contact tracers' email addresses.  The outsourcing company Serco accidentally shared the email addresses of almost 300 contact tracers recruited to assist in the UK government’s coronavirus “test, track and trace” strategy.  The email addresses were shar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6d91360746a35b9b581ce99da4063b34c6cb8df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"543b4200-9f93-11ea-bb5f-9176852f1f89"},"incident_date":"2020-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7dcbb5bb288b","org_name":"North Bay Parry Sound District Health Unit","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ontario-north-bay-parry-sound-district-health-unit-announces-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.myhealthunit.ca/en/health-topics/dashboard-breach.asp"}],"summary":"The North Bay Parry Sound District Health Unit (“Health Unit”) announced today that there was a privacy breach in relation to its online COVID-19 dashboard. The dashboard contained information related to the number of COVID-19 tests and confirmed cases in the local community. Ina","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6de40ce7d5e51f0d181375377a6eaf83d91e070","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ce713160-a4fc-11ea-9a08-d99599f4dafe"},"incident_date":"2020-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d3e25340fb5d","org_name":"NHS Orkney","org_type":"healthcare","ransomware":null,"records_affected":51,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thenational.scot/news/18488398.nhs-orkney-sends-coronavirus-test-results-local-business-mistake/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scotsman.com/health/coronavirus/dozens-covid-19-test-results-sent-scottish-business-error-2870605"}],"summary":"A HEALTH board sent coronavirus test results and other personal information on more than 50 patients to a business by mistake. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"add1d1966a2342d00acafea9987f65f12344a0d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2aa0bcf0-7241-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"fd743dd8a66f","org_name":"MobiFriends Solutions","org_type":"technology_saas","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/hackers-breach-3-5-million-mobifriends-dating-app-credentials/155590/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/dating-app-mobifriends-silent-on-security-breach-impacting-3-6-million-users/"}],"summary":"  The emails, hashed passwords and usernames of 3.5 million users of the dating app MobiFriends were put up for sale on an underground forum.  The credentials of 3.5 million users of MobiFriends, a popular dating app, have surfaced on a prominent deep web hacking forum, according","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abef4d1e743678b18293019473e2daa51d4a4021","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McKissock%20Investment%20Holdings%2C%20LLC.pdf"},"notes":null,"org_country":"US","org_id":"54eb1acfac9a","org_name":"McKissock Investment Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189649"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McKissock%20Investment%20Holdings%2C%20LLC.pdf"}],"summary":"McKissock reported unauthorized access to a legacy virtual server containing personal information, but could not determine whether an unauthorized actor viewed that information.","supporting_quote":null,"technology_involved":["legacy virtual server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fa8b19ed42de9106006ab2cf959de3949679ed2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"447644c0-74bb-11eb-a956-8766d2dd0181"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9f624cc11f8","org_name":"Mathways","org_type":"technology_saas","ransomware":null,"records_affected":25000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/shinyhunters-hacker-mathway-data-breach-reported/article/572133;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/mathway-investigates-data-breach-after-25m-records-sold-on-dark-web/"}],"summary":"ShinyHunters hackers have hit the education site Mathway, causing a data breach. As a result of the hack, more than 25 million emails and passwords have been stolen. Many of these are most likely to belong to children.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0875a2f439748ba34793ae5ab5f1a6beaa9d1a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1ea6cf0-a1b7-11ea-aa67-0b6b068266ad"},"incident_date":"2020-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"86701a132d3d","org_name":"Jio","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/05/02/jio-coronavirus-security-lapse/"}],"summary":"India’s largest cell network Jio, a subsidiary of Reliance, launched its coronavirus self-test symptom checker in late March, just before the Indian government imposed a strict nationwide lockdown to prevent the further spread of the coronavirus. The symptom checker allows anyone","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ce2f741dece2968d1d3668cdd51d8dbe07a2c8b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af3a3fc0-243c-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"24c6a525124b","org_name":"Indonesian Education and Cultural Ministry","org_type":"education","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thejakartapost.com/news/2020/05/28/hackers-breach-data-of-education-and-culture-ministrys-1-3-million-civil-servants.html"}],"summary":"SHARES The data of up to 1.3 million civil servants at the Education and Culture Ministry have been reportedly breached by unknown hackers. Cybersecurity researcher and consultant Teguh Aprianto revealed the cyberattack on Wednesday through his Twitter account @secgron. Among the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efd92402e5e9b2997ba9bd8d56bfd1dfc645941d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54b753a0-a1b3-11ea-aa67-0b6b068266ad"},"incident_date":"2020-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"5ce624d8ebfe","org_name":"Fresenius","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2020/05/europes-largest-private-hospital-operator-fresenius-hit-by-ransomware/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberscoop.com/fresenius-health-care-cyberattack-coronavirus/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/snake-ransomware-leaks-patient-data-from-fresenius-medical-care/"}],"summary":"Fresenius, Europe’s largest private hospital operator and a major provider of dialysis products and services that are in such high demand thanks to the COVID-19 pandemic, has been hit in a ransomware cyber attack on its technology systems. The company said the incident has limite","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b22140ab0495fabf489ec247386358ac13fc554f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36d36cd0-243e-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"dfe1fba75df6","org_name":"EduCBA","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/online-education-site-educba-discloses-data-breach-after-hack/"}],"summary":"Online education site EduCBA has started notifying customers that they are resetting their passwords after suffering a data breach.  EduCBA is an online education site based out of India that offers over 2,500 online courses and job oriented learning programs focus on finance, te","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f650fcdaf44a8f4bd11ba2d0575fb9f5226c669","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9641f940-a1b5-11ea-aa67-0b6b068266ad"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dcd351b1b55a","org_name":"Dr. Kristin Tarbert Plastic Surgery Offices","org_type":"healthcare","ransomware":null,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/so-much-for-their-moratorium-on-attacking-healthcare-entities-maze-team-attacks-a-plastic-surgeon/"}],"summary":"Despite having proclaimed that they would not be attacking medical entities during the pandemic, Maze Team has attacked another medical entity: a Bellevue, Washington-based plastic surgeon who specializes in surgery of the eye and facial areas. Dr. Kristin Tarbet’s website does n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1f178886293117cf4c5bb0d0505728b6f06c18f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aefd31a0-238a-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e90b1c9cc099","org_name":"CVS Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/cvs-pharmacy-data-breach-affects-21-289-patients.html"}],"summary":"CVS Pharmacy reported vandalism at stores in several markets between May 27 and June 8 resulted in the loss of some patient information.  The HHS Breach Portal shows the incident affected 21,289 individuals. The missing information included paper prescriptions, filled prescriptio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd185b8c650eee6612d776649eae6ee5958432a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6251f40-9f8e-11ea-bb5f-9176852f1f89"},"incident_date":"2020-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4fd3b15e349","org_name":"Colorado Department of Labor and Employment","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reporterherald.com/2020/05/19/colorado-pandemic-unemployment-assistance-informatoin-exposed-coroanvirus-covid/"}],"summary":"All 72,000 people signed up for pandemic unemployment assistance in Colorado are eligible for a year of free credit monitoring after a system error gave six people approved for benefits access to everyone else’s private information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Shiny Hunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b809ff19f31180b8cd3de2246b57ed41ff31226","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9e083bb0-2452-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"508872783a58","org_name":"Chatbooks","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/chatbooks-discloses-data-breach-after-data-sold-on-dark-web/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberscoop.com/chatbooks-data-breach-shiny-hunters/"}],"summary":"A photo-printing startup is alerting its users about a data breach in which hackers stole some customers’ personal information.  Chatbooks, a Utah-based company that sells albums of digital photos, told customers on May 8 it was victimized on March 26 by attackers who accessed Ch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ade8860ecc4a5df07fa11f4e46cae01277eb69ba","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"493ee1d0-94fc-11ec-a39a-3584eb2df2ab"},"incident_date":"2020-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5314e4b8dcf0","org_name":"Blackbaud","org_type":"technology_saas","ransomware":true,"records_affected":1594000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/cloud-provider-stopped-ransomware-attack-but-had-to-pay-ransom-demand-anyway/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.computing.co.uk/news/4021003/blackbaud-ransomware-hackers-access-unencrypted-banking-login-credentials;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thenonprofittimes.com/npt_articles/breaking-blackbaud-hacked-ransom-paid/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Oakwood%20-%20California%20Notification.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wabi.tv/2020/08/19/husson-university-latest-to-announce-data-breach/;"}],"summary":"Blackbaud, one of the world’s largest providers of financial and fundraising technology to nonprofits, was hacked and paid a ransom to have the hijacked data destroyed by the cybercriminals.  Officials learned of the intrusion in May and called in law enforcement and independent ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"ShinyHunters","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39ef55daf3a081e78134851741cbf0efd8f17a3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06e4f000-74bd-11eb-a956-8766d2dd0181"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"2231732fa18a","org_name":"Bhinneka.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":1200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thejakartapost.com/news/2020/05/13/e-commerce-platform-bhinneka-com-reported-to-be-latest-target-of-data-theft.html"}],"summary":"The data of up to 1.2 million Bhinneka.com users is reportedly being sold on the dark web for US$1,200 by a hacker group called ShinyHunters.  This article was published in thejakartapost.com with the title \"E-commerce platform Bhinneka.com reported to be latest target of data th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shinyhunters"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1397aac6005018e3e1f699356b7c927daa7ee1a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c0fa860-2444-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"2b4f43bd8078","org_name":"Awanui Rest Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12334325"}],"summary":"A rest home worker who shared \"disgusting\" photos of dementia patients on social media has apologised for his \"silly mistake\".  The 21-year-old healthcare assistant has come under fire for taking selfies with two residents at the Awanui Rest Home in Auckland, and sharing them wit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3c546674b98bb27b18142d0a1ae8237817c873b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d43647d0-a1ae-11ea-aa67-0b6b068266ad"},"incident_date":"2020-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3677ef1fa381","org_name":"Arkansas Division of Workforce Services","org_type":"government","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ky3.com/content/news/Arkansas-unemployment-system-shut-down-due-to-data-breach-state-passes-4500-cases-570534731.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nwahomepage.com/lifestyle/health/coronavirus/possible-data-breach-on-arkansas-pandemic-unemployment-website/"},{"fetched_at":null,"title":null,"type":"press","url":"https://katv.com/news/local/a-huge-threat-local-business-owner-fears-information-at-risk-with-govt-cyber-breach"}],"summary":"An Arkansas unemployment system centered around the COVID-19 pandemic has shut down after a data breach of secure information.  The system data breach was caused by applicant who illegally accessed the system, according to Hutchinson.  A probe will determine whether any personal ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d15e5592d2c8614522172ffbf1972da0de90f4c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"341eab10-2454-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65a18ea349b1","org_name":"All Points Lodge","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inquisitr.com/6034826/scott-disick-rehab-photo-sue/"},{"fetched_at":null,"title":null,"type":"press","url":"https://oicanadian.com/scott-disick-went-to-rehab-for-substance-abuse/"}],"summary":"Scott Disick reportedly checked into rehab last Tuesday after relapsing into drug and alcohol abuse, but after photos leaked of the star at All Points North Lodge in Colorado, he was apparently so upset that he decided to check himself out.  Read more: https://www.inquisitr.com/6","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-04-30","discovered_date":"2020-04-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bfaee0ebdae9d275a143aaf95c3dc5571c5811b","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SVMHS%20-%20Form%20of%20Patient%20Notification%20%28L01%29%20%20PDF.pdf"},"notes":null,"org_country":"US","org_id":"4ad108441fca","org_name":"Salinas Valley Memorial Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191525"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192562"},{"fetched_at":null,"title":null,"type":"press","url":"https://ryortho.com/breaking/salinas-valley-memorial-healthcare-system-reports-email-hack/"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/SVMHS%20Form%20of%20Patient%20Notification%20%28L01%29.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SVMHS%20-%20Form%20of%20Patient%20Notification%20%28L01%29%20%20PDF.pdf"}],"summary":"Salinas Valley Memorial Healthcare System determined that five employee and contractor email accounts accessed through Outlook Web Access had been compromised, with personal and health information present in an inbox and no evidence it was viewed, retrieved, or copied.","supporting_quote":null,"technology_involved":["Outlook Web Access","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-28","discovered_date":"2020-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b64fbac007b4690cca725fa5594812344ccb7b0","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20notification%20letter%20-%20April%202020%20-%20template%20for%20AG.pdf"},"notes":null,"org_country":"US","org_id":"0e1353952bef","org_name":"Marshall Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189529"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20notification%20letter%20-%20April%202020%20-%20template%20for%20AG.pdf"}],"summary":"An unknown person accessed a PaperlessPay database storing Marshall Medical Center employee information, but investigators could not determine what data was viewed.","supporting_quote":null,"technology_involved":["PaperlessPay","database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PaperlessPay"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"d4acd841e4fc","name":"PaperlessPay"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7ace783e34894733058ba1aaa26dc6379125174","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28CMHS%29%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"173e17007e1c","org_name":"Community Memorial Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189495"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28CMHS%29%20Sample%20Notification%20Letter.pdf"}],"summary":"An unauthorized person gained access to PaperlessPay's SQL server, which stored Community Memorial Health System employee pay stub and tax form data.","supporting_quote":null,"technology_involved":["SQL server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PaperlessPay Corporation"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"d4acd841e4fc","name":"PaperlessPay"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-27","discovered_date":"2020-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c9c42140b78369da345e6b32fa1e7c1000fc3cc","impact_type":"data_theft","incident_date":"2020-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_F4996_Chegg%20Individual%20Notice%20-%20All%20States%20-%20to%20be%20sent%2020200427%20With%20Sig_gordonio_chegg.com_SAS_PROOF.pdf"},"notes":null,"org_country":"US","org_id":"c69135783578","org_name":"Chegg, Inc.","org_type":"education","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_F4996_Chegg%20Individual%20Notice%20-%20All%20States%20-%20to%20be%20sent%2020200427%20With%20Sig_gordonio_chegg.com_SAS_PROOF.pdf"}],"summary":"Chegg reported that an outside hacker may have obtained personal information, including names and Social Security numbers, of approximately 700 current and former U.S. employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2020-04-24","discovered_date":"2020-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b0e6a0a2c240b060e9be3d177a7982133cc701c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20of%20Kavaliro%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"af91dba76e3a","org_name":"Kavaliro","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20of%20Kavaliro%20Data%20Breach.pdf"}],"summary":"Kavaliro reported unauthorized access to multiple email accounts and internal file management systems, which may have contained personal, credential, and financial information.","supporting_quote":null,"technology_involved":["email accounts","internal file management systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2020-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77940b77bebf9f63968d240d68c340347e5548fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2fbec5a0-0e56-11eb-ad9a-2114263f926d"},"incident_date":"2020-04-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"032f901c5a66","org_name":"National Payments Corporation","org_type":"financial","ransomware":null,"records_affected":7260000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/bhim-breach-exposes-millions-of-users/article/576474,https://www.androidcentral.com/bhim-data-breach-exposes-financial-details-7-million-indians"}],"summary":"cloud storage exposed to internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f6b3c137532ae2f64b993005e8ac60cf8ffdc41","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-04-08","initial_access":"unknown","notes":null,"org_country":"NP","org_id":"09148b708927","org_name":"Vianet","org_type":"telecom","ransomware":null,"records_affected":177000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vianet","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vianet"}],"summary":"Vianet reported a breach that exposed customer records including email addresses, names, phone numbers, and physical addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf487cb89223bed8a82a503906d2ae7c2e2dd3a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"257e6940-a0f3-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-04-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America Corp.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/charlotte/news/2020/05/26/bank-of-america-discloses-ppp-data-breach.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190091"}],"summary":"Bank of America Corp. (NYSE: BAC) has revealed a possible data breach on business clients' information for the Paycheck Protection Program.  The breach occurred on April 22, as BofA uploaded PPP applications onto the U.S. Small Business Administration's test platform, according t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecba3ae96bf3c7b3afa9ec7f199728739dfd5b5b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58d2c440-2455-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-04-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce9b4f75bd66","org_name":"Parkview Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cointelegraph.com/news/colorado-hospital-patient-information-system-hit-by-crypto-ransomware"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.techrepublic.com/article/ransomware-attack-on-colorado-hospital-highlights-fears-of-more-healthcare-hostage-situations/"}],"summary":"Hackers have infected the infrastructure of Parkview Medical Center — the largest health center in Pueblo County, Colorado — with cryptocurrency ransomware.  Citing a hospital employee, Fox News reported on April 24 that Meditech — the Parkview Medical Center’s system for storing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-20","discovered_date":"2019-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ceb3f58cab84eb6929746401da76694783908e2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wells%20Fargo%20KDW%20Automotive.pdf"},"notes":null,"org_country":"US","org_id":"0429baca0b44","org_name":"Wells Fargo Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email containing personal information was mistakenly sent to unintended recipients.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189280"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wells%20Fargo%20KDW%20Automotive.pdf"}],"summary":"Wells Fargo mistakenly sent an email containing personal information to unintended recipients, who confirmed deleting it.","supporting_quote":"On December 23rd, 2019, Wells Fargo learned that an email, which included a file with some of your personal information intended for your current 401K service provider, was mistakenly sent to another financial institution and one of our business customers on November 6, 2019.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-20","discovered_date":"2019-10-08","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f61859b29e285848d1602a8e2d41a11319873ba5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10546.pdf"},"notes":null,"org_country":"US","org_id":"963cb688d57a","org_name":"Volusion, LLC","org_type":"technology_saas","ransomware":null,"records_affected":14111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10546.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Volusion%20LLC-2020-04-21"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Volusion.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10546.pdf"}],"summary":"Volusion reported that malware on its e-commerce platform may have exposed customer information entered on merchant clients’ websites between September 7 and October 8, 2019.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22e1b5fa0e08d764ceded70fc368742e483eb0e8","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_7.pdf"},"notes":null,"org_country":"US","org_id":"7554140e10a0","org_name":"Silicon Valley Community Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189302"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_7.pdf"}],"summary":"Silicon Valley Community Foundation reported that compromised email accounts and a shared mailbox may have exposed personal information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fe9aedd51b468d0f420bc9569a09c16242f7fbd","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KandyPens%20-%20Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"273dbafa4826","org_name":"KandyPens","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189316"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KandyPens%20-%20Breach%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#KandyPens%2C%20Inc.-2020-04-20"}],"summary":"KandyPens reported that an unauthorized user accessed its online payment platform, potentially exposing customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["online payment platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82bb79f61552ab9340d7054f058e82e17bbf6040","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10545.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"264b2601e86a","org_name":"Kandy Pens, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10545.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10545.pdf"}],"summary":"Kandy Pens reported that an unauthorized user accessed its online payment platform, putting customers’ names and payment card information at risk.","supporting_quote":null,"technology_involved":["online payment platform","online check-out page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-04-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a5416fee3ffefc556890e810c71eb5c8e22cde9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7b1e5a00-2437-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-04-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e84033522c59","org_name":"Genworth Financial","org_type":"financial","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/fortune-500-insurance-firm-genworth-discloses-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.technadu.com/genworth-financial-announces-noxious-data-breach/104607/"}],"summary":"Genworth Financial,” the American insurance firm with total assets that surpass a hundred million USD and revenues that go beyond $8.6 billion, has announced a catastrophic data breach on its systems. The company realized the security event on April 20, 2020, when they detected u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86e4ec71420236e86ec75d842af439c559afae0d","impact_type":"data_theft","imported_from":null,"incident_date":"2020-04-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cab93d486de7","org_name":"Aptoide","org_type":"technology_saas","ransomware":null,"records_affected":20012235,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aptoide","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aptoide"}],"summary":"Aptoide suffered a data breach that exposed customer records, including email addresses, IP addresses, names, and unsalted SHA-1 password hashes, which were later shared online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-17","discovered_date":"2020-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26e5dfd0ac056075b3f2068612759097ce8952ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Squar%20Milner%20-%20Master%20%28Adult%20-%20General%29.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"8a36557719af","org_name":"Squar Milner LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Squar%20Milner%20-%20Master%20%28Adult%20-%20General%29.pdf"}],"summary":"Squar Milner reported that client tax information may have been accessed without authorization after credentials for the system storing it may have been compromised.","supporting_quote":"Upon receipt of this information, Squar Milner immediately began an investigation through which we determined that credentials required to access the system in which this client’s information was stored may have been compromised.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"825324634f001dc714e3f82838cf34f6f93d6437","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e90b4ac0-f1fe-11ea-9eb3-fb45745214a6"},"incident_date":"2020-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfcc582101d0","org_name":"Pinnacle Clinical Research","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/pinnacle-clinical-research-provides-notice-of-data-breach-301113472.html"}],"summary":"Pinnacle Clinical Research (\"Pinnacle\"), a medical clinical research organization specializing in Hepatological and Gastroenterological research is providing notice to individuals impacted by the exposure of certain protected information.  In April of this year, Pinnacle identifi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-17","discovered_date":"2020-03-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b6bb85e16564e9254f350179bc5171ecae9fdac","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template.pdf"},"notes":null,"org_country":"US","org_id":"4fee7730ce3c","org_name":"Fusion Management Services, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189227"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Template.pdf"}],"summary":"Fusion Management Services reported that an unauthorized third party accessed certain Fusion servers and systems, and information including historical pay information and Social Security numbers may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db097a635f1aa57bbb3ff10c88c90b80bf370e2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99ecfee0-a1c0-11ea-aa67-0b6b068266ad"},"incident_date":"2020-04-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"eb3cf2f4431d","org_name":"Singapore Ministry of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/singapore/moh-suspends-officer-for-alleged-leak-of-virus-figure-reviews-processes"}],"summary":"The Ministry of Health (MOH) said yesterday that it has suspended one of its officers after she allegedly leaked the number of new daily coronavirus cases in Singapore and retrieved a Covid-19 patient's records without authorisation.  The 35-year-old civil servant is a Singaporea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-16","discovered_date":"2020-03-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6739b59bcac95efedff8b40202a4887789d625e3","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Charpentier%20-%20Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"e5e350915a00","org_name":"Lincoln Financial Advisors Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-548758"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189177"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189835"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Charpentier%20-%20Sample%20Letter.pdf"}],"summary":"Lincoln Financial Advisors discovered that an unknown third party possessed a drive containing client data, which may have included personal information.","supporting_quote":null,"technology_involved":["drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-04-16","discovered_date":"2020-03-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"090e5c2b89f3f5615bc5c002832d28cd277a6f96","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-20","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20Draft%20for%20OAG.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"e7d98d8f8889","org_name":"Grimaldi Center for Wellness and Aesthetics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20Draft%20for%20OAG.pdf"}],"summary":"A former employee accessed the center’s electronic medical record system after leaving, and may have viewed or downloaded patient information.","supporting_quote":"On March 11, 2020, our office was performing a routine audit when we noticed that a former employee, who quit on March 2, 2020, had accessed our electronic medical record system after she had quit.","technology_involved":["electronic medical record system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecd4f46328ccfc5f10c204673ecfc863687a900c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"386bbb50-a4e2-11ea-a769-1f53f53c0c37"},"incident_date":"2020-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df0f67046782","org_name":"Oakland County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.clickondetroit.com/news/local/2020/04/16/map-containing-internal-oakland-county-covid-19-data-mistakenly-leaked/"}],"summary":"Oakland county officials accidentally leaked internal COVID-19 tracking data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-04-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53286f7962e71fcd41e7b0ed9a19bc90d01d2660","impact_type":"data_theft","incident_date":"2020-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10543.pdf"},"notes":null,"org_country":"US","org_id":"0534b1f4fa27","org_name":"Applications Software Technology, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10543.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10543.pdf"}],"summary":"An unknown third party accessed an employee’s email and payroll information, including a 2019 W-2 and associated information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9af47498853e5b111966a3a12d88086225704dec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ac1e2a50-0e51-11eb-ad9a-2114263f926d"},"incident_date":"2020-04-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"3b96fcc57911","org_name":"8Belts","org_type":"education","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/education-app-reveals-users-sensitive-information-research-finds/,https://www.securitymagazine.com/articles/92494-000s-of-e-learning-students-exposed-in-8belts-data-breach"}],"summary":"online file storage publicly exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2020-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fed9e792bdf75031e078b827d75cd0eacaee7351","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a00223a0-156f-11eb-b788-65a639ed21e8"},"incident_date":"2020-04-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"69c190ff608a","org_name":"Natura","org_type":"retail_ecommerce","ransomware":null,"records_affected":290001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thehackernews.com/2020/05/natura-data-breach.html,https://www.hackread.com/brazis-cosmetic-giant-natura-leaked-192m-records/,https://secalerts.co/article/192-million-records-compromised-in-cosmetic-giants-data-leak/aaffcaf9,"},{"fetched_at":null,"title":null,"type":"press","url":"https://tecnoblog.net/340039/natura-expoe-dados-pessoais-de-250-mil-clientes-em-servidores-desprotegidos/"}],"summary":"Internet exposed AWS databases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31723ab77689b45f25640eb80f2f90d9020765cd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f722150-a118-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-04-11","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61db24ddf947","org_name":"Magellan Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.foxbusiness.com/technology/hacker-hits-magellan-health-with-ransomware-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/us-health-giant-hooked-with/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/magellan-health-warns-ransomware-attack-exposed-pii/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189886"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-190863"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Magellan%20Health%20Inc.-2020-05-11"}],"summary":"Ransomware name and shame on healthcare company during pandemic.  Magellan Health is warning customers that an April 11 ransomware attack may have affected their personal information.  A Mandiant investigation determined an “unauthorized actor gained access to Magellan’s systems ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eabfeaf2ca4e2a79e5e29e753c19a15c78faffc9","impact_type":"unknown","incident_date":"2020-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e724e4a6e2f","org_name":"Weber and Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188966"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-04-07","discovered_date":"2019-12-31","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f96146619e43a72b98406a84d8ad41c4b478f57a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HRG.pdf"},"notes":null,"org_country":"US","org_id":"aa1c3051bdea","org_name":"Healthcare Resource Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HRG.pdf"}],"summary":"Healthcare Resource Group determined that an employee’s email account had been accessed without authorization, but could not determine whether emails or attachments were accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fc86fadc56d1f617ddb1ed61021445133bc9b08","impact_type":"disruption_or_ransomware","incident_date":"2020-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stockdale%20Radiology%20Sample%20Data%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"f8b25a6818e1","org_name":"Stockdale Radiology","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188888"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stockdale%20Radiology%20Sample%20Data%20Breach%20Notice.pdf"}],"summary":"Stockdale Radiology reported a ransomware attack in which files containing personal and medical information were accessible to an intruder, and a limited number of files were publicly exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"747772b7c8233dc007702e7f9f6c9317fe51af74","impact_type":"data_theft","imported_from":null,"incident_date":"2020-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ES","org_id":"1991344b5a41","org_name":"HTC Mania","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HTC Mania","type":"hibp","url":"https://haveibeenpwned.com/Breach/HTCMania"}],"summary":"A data breach of HTC Mania’s vBulletin-based site exposed member information, including email addresses, usernames, IP addresses, dates of birth, and password data.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-04-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b6a5894bbe73be736af424df7865536151f4650","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7d05f300-04ac-11eb-8c43-8ded27596b66"},"incident_date":"2020-04-06","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cb08f0df235","org_name":"Children's Hospital of Colorado","org_type":"healthcare","ransomware":null,"records_affected":2554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/2-553-patients-affected-in-email-hack-at-children-s-hospital-colorado.html"}],"summary":"Children's Hospital of Colorado had someone hack one of their emails through phishing disclosing 2553 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7172807a76ff0d6a1e9f89d9205063c9d87b1950","impact_type":"data_theft","imported_from":null,"incident_date":"2020-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"dcafbbf5b995","org_name":"OGUsers","org_type":"other","ransomware":null,"records_affected":263189,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OGUsers (2020 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/OGUsers2020"}],"summary":"OGUsers suffered a data breach, and email addresses, IP addresses, usernames, private messages, and hashed passwords were posted to a rival hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5838214567b3515cc02717a59fdf7d36cb58fdc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b1d13ff0-a4e8-11ea-a769-1f53f53c0c37"},"incident_date":"2020-04-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e853e5bf9ad0","org_name":"Welsh NHS","org_type":"government","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-wales-politics-52283236"}],"summary":"13000 letters were mailed to the wrong people from Welsh NHS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c64325ba125ed7a6cfc4871a086b2d413c5e7f38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c448c540-7247-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-04-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a63fe5a79b17","org_name":"PAAY LLC","org_type":"professional_services","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/04/22/2-5m-credit-card-records-belonging-transaction-firm-paay-exposed-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/payment-processor-exposes-2-5m-credit-card-transactions/article/575897;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.idtheftcenter.org/paay-data-exposure-leaves-database-with-credit-card-details-and-transactions-unsecured/"}],"summary":"A database with 2.5 million credit card transactions belonging to New York mobile payments solutions provider PAAY LLC has been found exposed online.  Discovered and revealed today by security researcher Anurag Sen, the database included credit card numbers, expiration dates and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2020-04-02","discovered_date":"2020-02-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f0562e878ca76c4e5481a1161b611b0617ea82e","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data_Breach_Notification__1_Year__1.pdf"},"notes":null,"org_country":"US","org_id":"b5756965a866","org_name":"Total Quality Logistics, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188805"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data_Breach_Notification__1_Year__1.pdf"}],"summary":"Total Quality Logistics reported unauthorized access to two external-facing web applications and access to customer and carrier information.","supporting_quote":null,"technology_involved":["web applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-02","discovered_date":"2020-03-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa4c66812467649a889709e66e83adf27546a1c6","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RLWA%20Data%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"fcd94536d966","org_name":"Ronald L Wolfe & Associates Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188815"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RLWA%20Data%20Breach%20Notice.pdf"}],"summary":"Data thieves breached Wolfe & Associates’ online database and obtained rental applications that may have included personal information.","supporting_quote":null,"technology_involved":["online database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2020-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d11b8325009bfd8a347de2b416de0edf16b8633","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79dfe960-a4fd-11ea-8251-29926a6fbfb5"},"incident_date":"2020-04-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"877faaf63d8a","org_name":"Kent Commercial Services","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-england-kent-52880218"}],"summary":"A gang demanded an £800,000 Bitcoin ransom in a cyber attack on a firm owned by Kent County Council, and leaked its data on the dark web.  Kent Commercial Services (KCS) delivers services and supplies to public authorities, including protective equipment during the Covid-19 crisi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0acc39b634d615cfc06f93799a520e6b9cfc202","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49730ef0-a134-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"b1fd339e1b86","org_name":"Wuhan Institute of Virology","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.businessinsider.com/wuhan-lab-coronavirus-conspiracy-theories-targeted-by-hackers-2020-4"}],"summary":"The Chinese research laboratory at the centre of a conspiracy theory about the origin of the new coronavirus has been targeted by hackers, according to security watchers.  The Wuhan Institute of Virology was among targets including the World Health Organisation whose employees' e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c543e340807836384d10abd5cf31090d7272768","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b8918980-d42b-11eb-a192-c5509024cd4a"},"incident_date":"2020-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"39770684c4d5","org_name":"Singapore department of health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ca.finance.yahoo.com/news/female-public-servant-another-woman-charged-over-covid-data-leak-142130184.html"}],"summary":"Singapore government employee leaks covid numbers before they're officially published","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","medical","personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c82e30c40aa7bd4b69af7e09d4edea9d07a912d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72c72260-120d-11eb-a3ae-53136ea5d4e6"},"incident_date":"2020-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"9f38f92d7d84","org_name":"Service NSW","org_type":"government","ransomware":null,"records_affected":186000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/09/07/186000-customer-records-stolen-australian-state-government-phishing-attack/"}],"summary":"A trove of data relating to 186,000 customers of an Australian state government agency has been stolen in an attack that targeted employee email accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b5097db57c31eae21c7aa29528e576f786df64","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8dfce680-724a-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3134f8f7ab67","org_name":"SeaChange","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/seachange-video-platform-allegedly-hit-by-sodinokibi-ransomware/"}],"summary":"SeaChange video platform allegedly hit by Sodinokibi ransomware. Group posts data to encourage compliance with ransom demand.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"719ba616e27d5347e9501c5c9af7c140d8c2a4d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"025f8a90-722e-11eb-a674-05cfd55ad89e"},"incident_date":"2020-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8c6a0498ed6","org_name":"SCUF Gaming","org_type":"manufacturing","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2020/04/1-1-million-scuf-gaming-customer-records-exposed-online-due-to-faulty-sever-security/"}],"summary":"Scuf Gaming exposed a database without credentials to the world and it got found by a security researcher and by bad guys","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6e2511675979d74963c2693511037df7f1e069d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f0c06c0-a501-11ea-9a08-d99599f4dafe"},"incident_date":"2020-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9348e5e3bf2b","org_name":"Oakland Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sfchronicle.com/local-politics/article/Cybersecurity-breaches-leave-Oakland-and-Berkeley-15188263.php"}],"summary":"In Oakland, the district suffered a more widespread breach of student privacy after administrators inadvertently publicly posted hundreds of access codes and passwords used by teachers and students to log into online classrooms and video conferences.  The codes allowed anyone wit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"552788fd805e72800ce704ed02195afbecf65d28","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-12","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10542.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b96d68dab825","org_name":"Northshore Utility District","org_type":"energy_utilities","ransomware":null,"records_affected":483,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10542.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10542.pdf"}],"summary":"An employee email account was accessed without authorization after an email containing a link enabled unknown actors to gain temporary access.","supporting_quote":"It was discovered that the email contained a link that allowed unknown actors to temporarily gain access to the employee’s email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"462588999143a3c14d78d1a5ebc35637557eca04","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a6c0790-237a-11eb-a2fc-cdee479fbead"},"incident_date":"2020-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"a8a3656aec24","org_name":"Nintendo","org_type":"manufacturing","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://hypebae.com/2020/4/nintendo-account-network-id-nnid-hacked-security-breach-fortnite-v-bucks-user-privacy-confidentiality-switch-gaming,https://arstechnica.com/gaming/2020/04/nintendo-accounts-are-getting-hijacked-including-one-of-ours/,https://www.databreaches.net/nintendo-confirms-some-160000-accounts-mightve-been-hacked/,https://www.popularmechanics.com/science/a32402358/nintendo-source-code-leak/,https://hotforsecurity.bitdefender.com/blog/nintendo-confirms-additional-140000-accounts-compromised-in-april-data-breach-23477.html"}],"summary":"credential stuffing attack against nintendo network ID system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b6310011f114d8c68b67ef84d5acfc82f168af7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d045de80-a1d4-11ea-aa67-0b6b068266ad"},"incident_date":"2020-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"ef9d90e44dcc","org_name":"Netherlands Ministry of Health","org_type":"government","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/proposed-government-coronavirus-app-falls-at-the-first-hurdle-due-to-data-breach/"}],"summary":"A mobile application proposed to the government of the Netherlands as a means to track COVID-19 has already fallen short of acceptable security standards by leaking user data.  The app, Covid19 Alert, was one of seven applications presented to the Ministry of Health, Welfare, and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63e02f0446e1461481fd8fe65fbe8439f73bbb88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aff2b840-8e6a-11ec-a600-657ec2694f8f"},"incident_date":"2020-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"263285a855f8","org_name":"Monroe County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://keysweekly.com/42/massive-data-breach-exposes-county-and-city-workers-officials-private-emails-search-histories/"}],"summary":"A Key's County server was compromised which resulted in the leaking of browsing history of county employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c546d41ee2bb358a36fa2b0d73b630d87364c728","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b927b520-250a-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"40afa29b3270","org_name":"Maropost","org_type":"professional_services","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/04/08/95m-records-exposed-database-belonging-marketing-firm-maropost/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cisomag.com/maroposts-leaky-database-on-google-cloud-server-exposes-95-million-email-records/"}],"summary":"A database belonging to marketing automation platform provider Maropost Inc. has been found exposed online, complete with 95 million individual customer email records and email logs.  Discovered by researchers at Cybernews, the database included more than 19 million unique email ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ccae10927093f1909ea288b582f530a902539f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2c285ba0-0e5a-11eb-ad9a-2114263f926d"},"incident_date":"2020-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"16344db330f3","org_name":"Istituto nazionale della previdenza sociale","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/inps-hack-italys-social-security-website-back-online-following-cyber-attack-claims"}],"summary":"overwhelmed website suffers degredation and information leakage (likely through cached profiles)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"‘THE0TIME","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b91279e2eca33d4a777f8f9981bc1f7de2f2c30d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9857e750-a1bd-11ea-aa67-0b6b068266ad"},"incident_date":"2020-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"fd1cfc3d9d45","org_name":"Huiying Medical","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/huiying-medical-breached-source-code-for-ai-assisted-covid-19-detection-and-experimental-data-of-covid-19-on-sale/"}],"summary":"Cyble researchers have identified a credible threat actor ‘THE0TIME’ claiming to have gained access to Huiying Medical Technology’s COVID-19 detection’s technology source code and COVID-19 experimental data.  As part of the breach, the preparator (sic) claims to have gained acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"the0time"}},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4ccb9b7fd9da36400214ae979f04c0a840caa4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5efbb140-2457-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"95e435b90bc9","org_name":"Holland America Cruise Lines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/canadian-passengers-from-virus-stricken-zaandam-cruise-ship-hit-by-federal-govt-privacy-breach/"}],"summary":"After enduring a cruise with a COVID-19 outbreak and four deaths, the 247 Canadian passengers who were aboard the Holland America Line ship, the MS Zaandam, face a new problem: a privacy breach by the federal government.  […] In a detailed email Global Affairs Canada sent Canadia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afdf714156baa90e38680f132f2ac7b3556add40","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a64fc920-0744-11ec-863c-8359987c65e0"},"incident_date":"2020-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"526c06725a8c","org_name":"CivicSmart","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/smart-parking-meter-vendor-had-data-stolen-in-ransomware-attack/"}],"summary":"A company that sells “smart” parking meters and technology used by parking-enforcement agencies in cities around the world was recently the victim of a ransomware attack that also exposed some of its internal files on a website maintained by the hackers responsible","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65e5c140ac7f140c349b37a6613f1eaf5bba41f6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18f05db0-a0fc-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"151727b0b39b","org_name":"Carillon at Belleview Station","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ktvu.com/news/prosecutors-frontline-worker-stole-engagement-ring-credit-card-from-patient-who-died-of-covid-19"}],"summary":"A temporary frontline worker stands accused of stealing an engagement ring from a patient at an assisted living facility in Denver, Colo., who died of COVID-19. Prosecutors said Elizabeth Daniels, 29, also used the woman’s credit card to purchase a vehicle the day the woman passe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99ab186f6e003583e7fbc4226d1f4730434cbbae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89b859a0-74a8-11eb-a956-8766d2dd0181"},"incident_date":"2020-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MT","org_id":"fdef30cfd51e","org_name":"C-Planet IT Solutions","org_type":"professional_services","ransomware":null,"records_affected":337384,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.maltatoday.com.mt/news/national/101403/over_330000_voters_personal_data_leaked_in_security_breach#.XoXyhYhKhPY;"},{"fetched_at":null,"title":null,"type":"press","url":"https://theshiftnews.com/2020/04/02/old-data-no-excuse-for-severity-of-information-leaked-lawyer/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://timesofmalta.com/articles/view/620-applicants-file-joint-case-against-it-firm-which-exposed-voter.824158;"}],"summary":"The data protection commissioner will be launching an investigation after a massive security vulnerability - in a database containing information on 337,384 voters from Malta that was being held by a Maltese IT company - led it to be exposed without security.  The data includes I","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fe78179a51e396dbe662882dca449cb5253a06d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df942480-8e92-11ec-a600-657ec2694f8f"},"incident_date":"2020-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69e754514643","org_name":"Benefit Recovery Specialists Inc","org_type":"financial","ransomware":true,"records_affected":275000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/billing-vendor-breach-affects-275000-a-14607"}],"summary":"BSRI is breached when an employee's credentials are used to access the environment and deploy ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4011d303685d80b6ecd747da20619e24e69c0de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64579670-a506-11ea-a892-dbe5c33247b8"},"incident_date":"2020-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://edmontonjournal.com/news/local-news/edmonton-health-inspector-violated-church-good-friday/"}],"summary":"An Edmonton woman who filed a complaint about the size of a Good Friday service says she feels her privacy was violated when an Alberta Health Services inspector disclosed her identity to that church.  In an email obtained by Postmedia, the inspector warned a church in the Albert","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"REvil","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23b50d7ed294a3ade3a24e09f0a9774af13ce5a7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91d5b7b0-a4e5-11ea-a769-1f53f53c0c37"},"incident_date":"2020-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"963f2c459d89","org_name":"10x Genomics","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/another-covid-19-research-firm-targeted-by-ransomware-attack,https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/hackers-hit-cononavirus-biotech-researchers/"}],"summary":"REvil group ransomwared and stole data from biotech research group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"revil"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-03-31","discovered_date":"2020-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"436eb454c365c6f8196d2865366b6b28358339ec","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20ASE.pdf"},"notes":null,"org_country":"US","org_id":"0e139d07d33a","org_name":"National Institute for Automotive Service Excellence","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Event%20-%20ASE.pdf"}],"summary":"ASE found malicious code on its checkout page that could capture customers’ payment card information during specified transactions.","supporting_quote":null,"technology_involved":["ASE checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ff990f982482cf4e571e62798557e60b595cccb","impact_type":"data_theft","imported_from":null,"incident_date":"2017-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"207a1b8e2186","org_name":"Dueling Network","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dueling Network","type":"hibp","url":"https://haveibeenpwned.com/Breach/DuelingNetwork"}],"summary":"A 2017 data breach exposed Dueling Network usernames, IP and email addresses, and passwords stored as MD5 hashes.","supporting_quote":null,"technology_involved":["online forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-27","discovered_date":"2019-12-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"96285cc8a7c70bc95f9a377332d86f800047cf6c","impact_type":"unknown","incident_date":"2019-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f98ef04dca5a","org_name":"YMCA of Columbia-Willamette","org_type":"unknown","ransomware":null,"records_affected":805,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#YMCA%20of%20Columbia-Willamette-2020-03-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b779d4d2e4db0c744d39b1c899727e81b1d07461","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-03-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%2372928315v1_ACTIVE_%20-%20Hospice%20by%20the%20Bay%20-%20Individual%20Notice%20Redacted.pdf"},"notes":null,"org_country":"US","org_id":"3b27c53b60e3","org_name":"Hospice by the Bay","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unauthorized individual used a phishing email impersonating an employee to obtain a report containing personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188680"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%2372928315v1_ACTIVE_%20-%20Hospice%20by%20the%20Bay%20-%20Individual%20Notice%20Redacted.pdf"}],"summary":"Hospice by the Bay reported that an unauthorized individual used a phishing email impersonating an employee to obtain an electronic report containing personal health information.","supporting_quote":"We recently learned that, on March 10, 2020, an unauthorized individual sent a phishing email impersonating a Hospice by the Bay employee to obtain an electronic report containing personal information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1b2202b76e4fccc103c97b4563afaed13de93a1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6067b10-2388-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-03-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7378826e4198","org_name":"Frederick W. Howarth III d/b/a TBG West Insurance Services","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/1%20-%20TBG%20West%20Ad%20CA%20Letter.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-192360"}],"summary":"On March 27, 2020, our system was impacted by a ransomware event that encrypted certain files. Upon learning of the situation, we promptly investigated the incident with the help of a leading cybersecurity firm and have taken steps to prevent any recurrence. We also notified law ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0e49aeb1461ebeb3a43323cb0e2699ea5290549","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_4.pdf"},"notes":null,"org_country":"US","org_id":"82dbd8ff070e","org_name":"New Media Trader Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188661"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_4.pdf"}],"summary":"New Media Trader Inc. reported that an unauthorized third party accessed its database and may have accessed customer names and email addresses.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2020-03-25","discovered_date":"2020-02-03","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04246708c718562416f1f37c4d1ac5e40b6ed7bf","impact_type":"data_theft","incident_date":"2019-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Individual%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"82fb8878a720","org_name":"eImprovement, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Individual%20Notice.pdf"}],"summary":"Malicious scripts on eFaucets.com copied checkout information and shared it with fontsawesomes.org.","supporting_quote":null,"technology_involved":["eFaucets.com checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffa282e3c39d1c3658e2f3858e3ebdb709224269","impact_type":"data_theft","imported_from":null,"incident_date":"2020-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"360aeae5c517","org_name":"Tamodo","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tamodo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tamodo"}],"summary":"Tamodo experienced a data breach that exposed account details, including names, email addresses, dates of birth and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2020-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f528e18ea0b119f78707978e7d6b045c3b170d3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"273f11ecc806","org_name":"PropTiger","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PropTiger","type":"hibp","url":"https://haveibeenpwned.com/Breach/PropTiger"}],"summary":"PropTiger’s database file was exposed and later shared, containing customer records, login histories, and personal information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f1a28cafdfc0f9e0bf0d6bb1ce09bc90be39136","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c3ba75a0-a11a-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-03-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"653b5da93926","org_name":"Hammersmith Medicines Research","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2020/03/23/covid-19-vaccine-test-center-hit-by-cyber-attack-stolen-data-posted-online/#5b566ae218e5;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cointelegraph.com/news/hackers-steal-and-publish-medical-data-of-firm-researching-coronavirus-using-ransomware;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.co/wordpress/101247/data-breach/maze-ransomware-hmr-leak.html"}],"summary":"A medical facility on standby to help test any coronavirus vaccine has been hit by a ransomware group that promised not to target medical organizations.  The criminals behind the Maze ransomware attacks have struck again, stealing data from a victim and then publishing it online ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-20","discovered_date":"2020-03-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14d8ec4eea81b928a35566fb2e02ca2117a3638c","impact_type":"unknown","incident_date":"2020-03-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29dc9b0b1614","org_name":"Oregon Department of Human Services","org_type":"unknown","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Department%20of%20Human%20Services-2020-03-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","financial"],"disclosed_date":"2020-03-20","discovered_date":"2020-03-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88e8c6c8686af872eb2349d3af13f78a09e4ec96","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Golden%20Valley%20-%20Notice%20to%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"f67e7041e6de","org_name":"Golden Valley Health Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Golden%20Valley%20-%20Notice%20to%20CA_1.pdf"}],"summary":"Golden Valley Health Centers reported that an unauthorized third party accessed an email account that may have contained billing, insurance, patient referral, and appointment information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-03-20","discovered_date":"2020-02-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"060e9677be54ea74bbd5c4f1a7e2712b8e6862d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GE%20-%20Canon%20HOME%20Letter%2003202020.pdf"},"notes":null,"org_country":"US","org_id":"2f39df5a7d60","org_name":"General Electric Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188474"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GE%20-%20Canon%20HOME%20Letter%2003202020.pdf"}],"summary":"An unauthorized party accessed an email account containing documents with personal information of GE employees, former employees, and benefits beneficiaries maintained on Canon’s systems.","supporting_quote":null,"technology_involved":["email account","Canon workflow routing service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Canon"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"45f5421cc56d","name":"Canon"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"6b85e5f7792f4c5341fa814ce1b4334369a64ebc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Krystal.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e14d42239c5a","org_name":"The Krystal Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":8155,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Krystal.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Krystal.pdf"}],"summary":"The Krystal Company reported an investigation into a security incident involving a payment processing system used at some restaurants, which may have affected payment cards.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-03-17","discovered_date":"2020-01-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bffa745c558a3e7cabe68a2338e551366392ac2","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice_3.pdf"},"notes":null,"org_country":"US","org_id":"5fc6090a9125","org_name":"Tandem Diabetes Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188367"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice_3.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tandem%20Diabetes%20Care%2C%20Inc.-2020-03-17"}],"summary":"An unauthorized person accessed Tandem employee email accounts through phishing, and the accounts may have contained personal and diabetes therapy information.","supporting_quote":"On January 17, 2020, we learned than an unauthorized person gained access to a Tandem employee’s email account through a security incident commonly known as “phishing.”","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2020-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11ded84f4fff4f13e696edde3fea6ed2f6b42308","impact_type":"data_theft","imported_from":null,"incident_date":"2019-09-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"b6870891649b","org_name":"The Halloween Spot","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Halloween Spot","type":"hibp","url":"https://haveibeenpwned.com/Breach/HalloweenSpot"}],"summary":"The Halloween Spot suffered a data breach involving customer contact details, addresses, IP addresses, and order histories from an old shipping information database.","supporting_quote":null,"technology_involved":["shipping information database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-16","discovered_date":"2019-07-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"a2314d589dc6ddd70a757421448363dc936b471d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AvalonHealthcare.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"28a580578df6","org_name":"Avalon Health Care Management, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1861,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Avalon%20Health%20Care%20Management%2C%20Inc.-2020-03-16"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AvalonHealthcare.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10539.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AvalonHealthcare.pdf"}],"summary":"Avalon Health Care Management reported suspicious activity in its email system and an employee email account that may have been accessed without authorization, potentially exposing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-03-13","discovered_date":"2020-01-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88a2da25500108829aba9700b212ff782a3ec3ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FMI%20Individual%20Breach%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"85a39b6a961c","org_name":"Foundation Medicine","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee may have fallen victim to phishing communications, resulting in unauthorized access to the employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FMI%20Individual%20Breach%20Notice.pdf"}],"summary":"An unauthorized user accessed a Foundation Medicine employee's email account after the employee may have fallen victim to phishing communications.","supporting_quote":"It appears that the employee may have fallen victim to phishing communications, resulting in unauthorized access to the employe e’s email account on December 17, 2019 and January 14 , 2020.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":"the CLOP ransomware group","variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal","secrets"],"disclosed_date":"2020-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c01d154d2854b47463bd42719383af7085c58336","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ae1b6a50-a1bb-11ea-aa67-0b6b068266ad"},"incident_date":"2020-03-13","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75411acc73c5","org_name":"ExecuPharm","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2020/04/cybercriminals-leak-execupharm-internal-documents-after-ransomware-attack/"}],"summary":"A successful ransomware attack was deployed on March 13 against ExecuPharm, a subsidiary of the U.S. Biopharmaceutical giant Parexel, according to a recent announcement made by the company.  Unlike typical ransomware attacks, where bad actors encrypt data and demand payment in ex","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"theclopransomwaregroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-12","discovered_date":"2020-01-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b8bb4a3a6e950f722de6c3061e9d959714488fcd","impact_type":"unknown","incident_date":"2019-09-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6fec6b613aa","org_name":"NorthWest Investment and Retirement Group, LLC","org_type":"unknown","ransomware":null,"records_affected":293,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NorthWest%20Investment%20and%20Retirement%20Group%2C%20LLC-2020-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","credentials"],"disclosed_date":"2020-03-12","discovered_date":"2020-03-11","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5d0f26185d27cbe4fa28b0e1bdeaf9bbbafb7dc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-03-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"dd9cccf8a106","org_name":"New Heights Ventures Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A manager entered his email credentials after receiving a deceptive email and trying to open a document.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188238"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Letter.pdf"}],"summary":"New Heights Ventures reported that a manager entered email credentials after receiving a deceptive email, allowing an outside entity to access the account and potentially employee files.","supporting_quote":"The member of management, whose account was breached, realized he had received an email seemingly from an employee of another agency and entered his email and password on 3/6/2020 to try to open a document.","technology_involved":["email","cloud-based server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-03-11","discovered_date":"2020-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01f6baeb41f308b6db0f7d26ae3fcc7d2968dadf","impact_type":"both","incident_date":"2020-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Woods%20%26%20Woods%20Ad%20CA-DE%20r2prf.pdf"},"notes":null,"org_country":"US","org_id":"8915a1203965","org_name":"Woods & Woods LLC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Woods%20%26%20Woods%20Ad%20CA-DE%20r2prf.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10540.pdf"}],"summary":"Woods & Woods reported that a ransomware attack resulted in the theft of some information, including potentially personal, medical, and financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6494b5d8f6f1bde6233fb0d8747f959d0d198a86","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wichita%20State%20Notification%20Letter%20-%20California_v4%20%28FINAL%29_2.pdf"},"notes":null,"org_country":"US","org_id":"0cdfac97b57f","org_name":"Wichita State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188178"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wichita%20State%20Notification%20Letter%20-%20California_v4%20%28FINAL%29_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10538.pdf"}],"summary":"Wichita State University reported unauthorized access to a server containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-11","discovered_date":"2020-02-11","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b7d2b71a467e8ef0b8d3e5010e9a9a55a5a008d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10541.pdf"},"notes":null,"org_country":"US","org_id":"ebeccad8a1e4","org_name":"Washington State Patrol","org_type":"government","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":"The law firm returned the thumb drive in a manner that did not adequately protect it from loss, and it was lost in transit.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10541.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10541.pdf"}],"summary":"A thumb drive containing personal information was lost in transit after a law firm mailed it back to the Washington State Patrol.","supporting_quote":"As a result, the letter envelope the thumb drive was placed in, to send back to WSP, was breached and the thumb drive lost.","technology_involved":["thumb drive"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c649bbc8b71d0a6ba010a53e817e70eb70d1cb6d","impact_type":"unknown","incident_date":"2019-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TrueFire%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1d2c4b2953a","org_name":"TrueFire LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188123"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2020-03-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65e90d0a1a4697dd08e502cb7e814e56784ca96d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4225740-0256-11eb-8781-bfb630cdf748"},"incident_date":"2020-03-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00abf14fc5c1","org_name":"Corporate Benefit Marketing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Patriot%20CBM%20Breach%20Letter.pdf"}],"summary":"Stolen credentials leading to email account being accessed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6d8c1cbff7f0cab69627e765aedddc4e73cfd979","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/RacineCounty.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6936427af5ce","org_name":"Racine County, Wisconsin","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/RacineCounty.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a95d5187dc412d13309d95363cf211e02ae9bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eversana%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"c584e5addb5e","org_name":"Eversana Life Sciences Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188081"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eversana%20-%20CA.pdf"}],"summary":"Unauthorized access affected certain EVERSANA email accounts, where personal information was potentially accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fb87878d27d0570545cf74b936a6976e99d0699","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Entercom%20-%20CA%20Notice%20of%20Data%20Event.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"205dab2c3303","org_name":"Entercom Communications Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Entercom%20-%20CA%20Notice%20of%20Data%20Event.pdf"}],"summary":"An unauthorized actor accessed Radio.com user information in database backup files held in third-party cloud hosting services.","supporting_quote":null,"technology_involved":["Radio.com","database backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-03-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"435a3efd3b1af61f1340a20df90fcc102c1a67ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a63c0cd0-2f29-11eb-be94-ff2f41197b3c"},"incident_date":"2020-03-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"321e02f7a0c3","org_name":"AST LLC","org_type":"professional_services","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.technadu.com/ast-llc-announces-data-breach-circulates-notices-employees/99052/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189123"}],"summary":"AST LLC suffered a databreach when an outside party accessed one of their user's email address and took information regarding w2 and other tax info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2914645217ec9a9f4522dd10fb5933c4b5ac83d2","impact_type":"data_theft","imported_from":null,"incident_date":"2020-02-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"31a05e7faf10","org_name":"AnimeGame","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AnimeGame","type":"hibp","url":"https://haveibeenpwned.com/Breach/AnimeGame"}],"summary":"AnimeGame suffered a data breach that exposed subscribers’ email addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"baef168432ebd3e3570d20977b810027cd19c757","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1932b490-3597-11ec-9ec7-15e66f657ea5"},"incident_date":"2020-03-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NP","org_id":"7890fa06fd37","org_name":"Foodmandu","org_type":"transportation_logistics","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techlekh.com/foodmands-users-data-compromised-nepal/"}],"summary":"Foodmandu’s 50 Thousand User’s Data Has Been Compromised ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-03-06","discovered_date":"2020-01-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22052590eacafd3e6f1e434d535af00c5e67795d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notice%20for%20AG.pdf"},"notes":null,"org_country":"US","org_id":"c602881aa38c","org_name":"Torrance Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The radiology vendor's server storing patient images was unsecured and potentially accessible to unauthorized people.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188027"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice%20for%20AG.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10537.pdf"}],"summary":"Torrance Memorial reported that an unsecured server used by its outside radiology vendor temporarily stored patient images and related information, with no evidence of unauthorized access.","supporting_quote":"On January 6, 2020, Torrance Memorial was notified that a server used by its outside radiology vendor to receive radiological images from Torrance Memorial was unsecured and potentially accessible to unauthorized people.","technology_involved":["radiology image server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d5a22be05d01b41757d4ffd5c727d70d7f733c90","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/OtisRBowen.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68db9c5db736","org_name":"Otis R. Bowen Center for Human Services","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/OtisRBowen.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02b90a007c2bb3e72f76c8e053b385577fc20dc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Neal%27s%20Yard%20Remedies%20-%20Notice%20of%20Data%20Event%20-%20CA%20.pdf"},"notes":null,"org_country":"US","org_id":"bdc1ffa0f668","org_name":"Neal's Yard Remedies","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188018"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Neal%27s%20Yard%20Remedies%20-%20Notice%20of%20Data%20Event%20-%20CA%20.pdf"}],"summary":"Unauthorized individuals accessed Neal's Yard Remedies user email accounts, where personal information was potentially accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","medical"],"disclosed_date":"2020-03-06","discovered_date":"2019-09-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e230414fe2ed36462bbb379da27612755a6983a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Athens%20Insurance_Notice.pdf"},"notes":null,"org_country":"US","org_id":"376752ca953e","org_name":"Athens Insurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189397"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-188003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Athens%20Insurance_Notice.pdf"}],"summary":"Athens Insurance Services, Inc. reported unauthorized access to an employee email account that may have exposed personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2020-03-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dee413ac50b5dec88b722aa6e5c8a6b12cfd076d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20B%20-%20Sample%20Consumer%20Notification%20US.pdf"},"notes":null,"org_country":"US","org_id":"3d56a7bc2932","org_name":"Carnival Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187901"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20B%20-%20Sample%20Consumer%20Notification%20US.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10536.pdf"}],"summary":"An unsanctioned third party accessed some employee email accounts containing personal information about guests between April 11 and July 23, 2019.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-03-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87ad1df1986c8876e1b000ad964ebb91400a2204","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2.7.2020%20Incident%20-%20Multi-state%20notification%20short%20form%202.20.2020%20FINAL.PDF"},"notes":null,"org_country":"US","org_id":"1579c5a07f42","org_name":"J.Crew Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2.7.2020%20Incident%20-%20Multi-state%20notification%20short%20form%202.20.2020%20FINAL.PDF"}],"summary":"An unauthorized party used a customer's email address and password to log into a J.Crew account, where personal and payment-related information was accessible.","supporting_quote":"Based on our review, we believe your email address (used as your jcrew.com username) and password were obtained by an unauthorized party and in or around April 2019 used to log into your jcrew.com account.","technology_involved":["jcrew.com customer account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93d0a9f8394bc7d79add38f7df13bfedc7c774d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a5dafe0-4897-11ec-be64-495e033b0bce"},"incident_date":"2020-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0969d6a0dafb","org_name":"Vertafore","org_type":"technology_saas","ransomware":null,"records_affected":27700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/info-of-27-7-million-texas-drivers-exposed-in-vertafore-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vertafore.kroll.com/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.click2houston.com/news/local/2020/11/14/texas-drivers-license-information-possibly-exposed-during-data-breach-company-says/"}],"summary":" Info of 27.7 million Texas drivers exposed in Vertafore data breach  Vertafore blames incident on human error after user data was stored on an unsecured external storage service. The files were accessed by an external party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"116b07db0b267c8c4202ebeb4e03e1c0ebb0a737","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"acd6d3f0-a4fe-11ea-9a08-d99599f4dafe"},"incident_date":"2020-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"308837695141","org_name":"University Hospital Brno","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.2-spyware.com/hospital-brno-in-czechia-hit-by-a-cyberattack-during-the-covid-19-virus-crisis;"},{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/03/16/ransomware-targets-hospitals-medical-providers-coronavirus-pandemic/"}],"summary":"The second attack, far more insidious, involves the Brno University Hospital in the city of Brno in the Czech Republic. The second biggest hospital in the country, the ransomware was detected March 14 and caused computers across the hospital to shut down delaying surgery and coro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbb831f2120c7362ef815eaaaf6997a3ecd383d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22d1a2d0-2397-11eb-a2fc-cdee479fbead"},"incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"3bd2dfe44864","org_name":"Tokopedia","org_type":"retail_ecommerce","ransomware":null,"records_affected":91000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-leaks-15-million-records-from-tokopedia-indonesias-largest-online-store/,https://en.tempo.co/read/1338058/tokopedia-confirms-attempted-data-theft"}],"summary":"Hackers steal online store user database and try and sell it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d2397c26760ec47e68f3ae1f3658c46dc7593d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7df0e000-a1d7-11ea-aa67-0b6b068266ad"},"incident_date":"2020-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"f26be7e6a94a","org_name":"the Karnataka health department","org_type":"government","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.deccanherald.com/national/privacy-of-suspected-covid-19-patients-breached-810992.html"}],"summary":"In a major breach of privacy, the Karnataka health department released personal details of all those quarantined in the state in the wake of COVID-19 virus to the media, complete with names, mobile numbers, temporary and permanent addresses. These ...  Read more at: https://www.d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e3140c9f6e47537349bcffabfc0676e4be3b0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"120386b0-0999-11ec-863c-8359987c65e0"},"incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0b7efe26c383","org_name":"Stone Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/customers-bank-details-stolen-as-hackers-target-staffordshire-firm/"}],"summary":"Customers' bank details stolen as hackers target Staffordshire firm Stone Refurb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1080725cb6f3f2ad95a962b4d5b191821c9fea9e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cccdaf20-a10d-11ea-878c-ff8a51fa1e8f"},"incident_date":"2020-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f10a6c20062b","org_name":"Small Business Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbsnews.com/news/business-owners-say-their-personal-data-is-being-leaked-on-federal-loan-site/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnbc.com/2020/04/21/small-businesses-seeking-loans-may-have-had-personal-data-exposed.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/bank-of-america-blames-ppp-applications-leak-on-faulty-sba-test-server/"}],"summary":"Small businesses across the U.S. have reported personal data leaks after applying for a disaster loan from the Small Business Administration. The SBA, whose website was plagued by maintenance shutdowns in late March, did not acknowledge the leaks until Saturday evening. The agenc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccfacd616be7cf042df0f7d5f9a1b39364d299be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d7c9cb0-2398-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"77dc25ab69a0","org_name":"NHS Lanarkshire","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailyrecord.co.uk/news/local-news/nhs-lanarkshire-apologise-over-hundreds-22316349"}],"summary":"NHS Lanarkshire have apologised after more than 400 incidents of data breach were recorded since March.  Hundreds of patients had their COVID-19 data breached in Lanarkshire, a statistic the Conservative party called “worrying”.  There were 414 data breaches between March 12 and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"821397c778a107a1f1562242513c9bafee75b1ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6227850-f1fb-11ea-9eb3-fb45745214a6"},"incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f79c03fa0d3f","org_name":"Mental Health Center of Boulder County Inc. dba Mental Health Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/co-mental-health-partners-discloses-email-hack-potentially-compromised-employee-and-patient-data/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/mental-health-partners-notifies-clients-and-employees-of-data-security-incident-301116631.html"}],"summary":"an employee email account compromise discovered in late March.  An investigation revealed that the personal information of some MHP clients and current and former employees may have been accessed or taken during the incident.  The information involved may have included names; dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"484419e17aad6f5ca56bd6b4a662dd1d665bf0ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8eb10b30-a4fd-11ea-9a08-d99599f4dafe"},"incident_date":"2020-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"caed85ae15f1","org_name":"Kerala State Health Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cisomag.com/hackers-attack-database-of-indias-covid-19-patients-and-potential-suspects/"}],"summary":"Kerala, one of the worst-hit states in India’s COVID-19 crisis, reported five positive cases from Aythala in Ranni-Pazhavangady panchayat. The database of all the active patients, and those who came in direct contact with them, was maintained on the district administrator’s offic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1788adfc49427a2adb7a5a40e968bc955c3d3393","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2a735790-2522-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ce3e9fb725fd","org_name":"Keepnet Labs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://iapp.org/news/a/keepnet-labs-breach-exposes-5-billion-records/"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.co/wordpress/100198/data-breach/uk-security-firm-data-leak.html"}],"summary":"The expert Bob Diachenko has discovered an unsecured Elasticsearch install belonging to a UK security firm that contained 5 billion records of data leaked in previous incidents that took place between 2012 and 2019.   “On March 16th I have found an unprotected and thus publicly a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42404b293f4bc03a4e05659d95d670655cd7af20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5449b810-72d5-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2553bf373783","org_name":"Comcast","org_type":"technology_saas","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.denverpost.com/2020/03/05/comcast-xfinity-customer-privacy-release/"}],"summary":"Nearly 200,000 Xfinity customers nationwide who pay for their phone numbers to remain unlisted or unpublished had their contact information mistakenly posted online last fall, the company confirmed Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d48bbec313e5729f0538bece034201fd5ae4683","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4763b80-a4ff-11ea-9a08-d99599f4dafe"},"incident_date":"2020-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae3af24d87f4","org_name":"Champaign-Urbana Public Health District","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/illinois-public-health-website-hit-with-ransomware-amid-coronavirus;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/ransomware/ransomware-halts-health-organizations-ability-to-inform-public-on-covid-19/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govtech.com/security/Illinois-Health-System-Hacked-Amid-Coronavirus-Response.html"}],"summary":"Illinois Public Health Website Hit With Ransomware Amid Coronavirus Hackers infected an Illinois Public Health provider website with ransomware during the coronavirus pandemic; Maze Team exploits, phishing, malware, and a PACS incident complete this week’s breach roundup.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aede0f4a3a8b0eea50f0cced66ef7ef593fa6199","impact_type":"exposure_no_theft_confirmed","incident_date":"2020-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Walgreens%20Mobile%20Messaging%20letter%20v2%20%28WAG%20version%29-Final.pdf"},"notes":null,"org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187787"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Walgreens%20Mobile%20Messaging%20letter%20v2%20%28WAG%20version%29-Final.pdf"}],"summary":"Walgreen Co. reported that another customer might have viewed names, prescription details, store numbers, and shipping addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-02-28","discovered_date":"2019-11-01","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82177c3ad30c205d768d8969c400e5208413ab73","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"09e89b48c5c1","org_name":"Kaiser Health Plan, Southern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An error caused former addresses to be used for mailings.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187783"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notification%20Letter.pdf"}],"summary":"Kaiser Health Plan, Southern California reported that an address error led correspondence containing personal, medical, and billing information to be mailed to former addresses.","supporting_quote":"During a project to improve mailing addresses for correspondence with Southern California members, an error caused your former address to be temporarily used for one or more mailings to you between October 6 and December 20, 2019.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3719a3266fdad42a4cb1d84f273c227d7d96ba4","impact_type":"unknown","incident_date":"2020-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"77dfa0ce189c","org_name":"Allstate Benefits","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187784"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f42b6ee9513d91942e5bb246e6c285b8d0bc85a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IL","org_id":"7301cfb1b770","org_name":"Straffic","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The Elasticsearch database was publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Straffic","type":"hibp","url":"https://haveibeenpwned.com/Breach/Straffic"}],"summary":"Straffic exposed a publicly accessible Elasticsearch database containing personal data.","supporting_quote":"The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2020-02-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de54e4e9874fdbd874cb258ef670a6ec531ca72","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d994b160-72c0-11eb-a46e-831b23dc7360"},"incident_date":"2020-02-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ef30915720e9","org_name":"Simon Fraser University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.citynews1130.com/2020/03/02/breach-of-privacy-affecting-personal-information-at-sfu/"},{"fetched_at":null,"title":null,"type":"press","url":"https://bc.ctvnews.ca/personal-information-of-students-faculty-at-b-c-university-exposed-in-recent-data-breach-1.4835336"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/british-columbia/sfu-ransomware-attack-1.5732027"}],"summary":"A canadian college was the victim of a ransomware attack which also exposed staff and student data who joined the college before june 20, 2019.  faculty, staff, students, alumni, and retirees saying electronic data was exposed on Feb. 27 and informed people to change their passwo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a976b866be4643e5b1eb0a3d2921f18e97308a87","impact_type":"disruption_or_ransomware","incident_date":"2020-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20US%20Individual%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"e9612b8ace15","org_name":"RailWorks Corporation","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187766"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20US%20Individual%20Notification.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10535.pdf"}],"summary":"An unauthorized third party encrypted RailWorks Corporation’s servers and systems, potentially involving access to personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ac900f2651d03294537a9b45483c97d6da43f40a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ConwayMedical.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a326e7e326c1","org_name":"Conway Hospital, Inc.","org_type":"unknown","ransomware":null,"records_affected":30087,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ConwayMedical.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-26","discovered_date":"2019-10-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d8b193e8583865f2d0788cced55412639c715ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Moss%20Adams%20-%20Sample%20Consumer%20Notification%20Letter%20%28CA%29_1.pdf"},"notes":null,"org_country":"US","org_id":"b5386de79af7","org_name":"Moss Adams LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Moss%20Adams%20-%20Sample%20Consumer%20Notification%20Letter%20%28CA%29_1.pdf"}],"summary":"An unauthorized third party accessed a Moss Adams employee’s email account containing personal information, though the company did not know whether that information was accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-25","discovered_date":"2019-10-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5611237a32191bc61b530a9d817352b1e5ce2a99","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AFTRA%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_1.pdf"},"notes":null,"org_country":"US","org_id":"f4a0ba7c9c95","org_name":"AFTRA Retirement Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AFTRA%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AFTRA%20Retirement%20Fund-2020-02-25"}],"summary":"AFTRA determined that files and folders may have been subject to unauthorized access between October 24 and October 28, 2019, but could not confirm that files containing individuals’ information were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"220ee44a5cc31fb603680d826e341b03fe5033e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vibrant%20Healthcare%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"ab397c452b45","org_name":"VibrantCare Rehabilitation, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vibrant%20Healthcare%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"VibrantCare reported unauthorized access to an employee email account, where personal information may have been present.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2020-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b71f4cdad2f288c05a5b1fc65063266fd1478ff","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2020-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"494074832b7e","org_name":"Slickwraps","org_type":"retail_ecommerce","ransomware":null,"records_affected":857611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Slickwraps","type":"hibp","url":"https://haveibeenpwned.com/Breach/Slickwraps"}],"summary":"Slickwraps exposed customer and newsletter subscriber records containing email addresses and other personal information.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-02-21","discovered_date":"2020-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a4f4c75237c6c41ee192316c6b2bbf88a3c0fb5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RCHSD%20-%20Sample%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"835d87b817b6","org_name":"Rady Children's Hospital San Diego","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187605"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RCHSD%20-%20Sample%20Consumer%20Notification%20Letter.pdf"}],"summary":"Rady Children's Hospital San Diego reported that patient information was accessed without authorization via an Internet port.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d3c5ea92a965cd1d373aa915efb0203ae18d671","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"03b49f1b849d","org_name":"MGM Resorts","org_type":"other","ransomware":null,"records_affected":10600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MGM Resorts","type":"hibp","url":"https://haveibeenpwned.com/Breach/MGM"}],"summary":"MGM Resorts discovered a breach of a cloud service in July 2019, exposing guest records containing personal information that was later shared online.","supporting_quote":null,"technology_involved":["cloud service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dd5b2cb130a7593095ecf05380ab618ba6da76d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a482b280-a1db-11ea-aa67-0b6b068266ad"},"incident_date":"2020-02-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"34078f102f4d","org_name":"Hong Kong Office of Government Chief Information Officer","org_type":"government","ransomware":null,"records_affected":122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hongkongfp.com/2020/02/20/coronavirus-data-breach-concerns-theft-hong-kong-govt-phones-containing-details-quarantined-residents/"}],"summary":"Two government mobile phones containing the personal data of 122 residents in mandatory coronavirus quarantine have gone missing, raising concerns over a potential data breach.  The Office of the Government Chief Information Officer (OGCIO) announced the suspected theft on Wednes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-02-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d60c2038dd28efea1fdecd2dcfe1627b2bb10126","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28daba60-251b-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f361f2c73f01","org_name":"Center for Health Education, Medicine & Dentistry (\"CHEMED\")","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/center-health-education-medicine-dentistry-230000048.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.chemedhealth.org/images/website-notice.pdf"}],"summary":"March 27, 2020·6 min read LAKEWOOD, N.J., March 27, 2020 /PRNewswire/ -- Center for Health Education, Medicine & Dentistry (\"CHEMED\") is providing notice of an incident that may affect the security of some of its patients' personal information. While CHEMED currently has no indic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f7c6399ebfbeb4869607849d7e0a00e2ebfa2d65","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ADP.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"afdbb440e93c","org_name":"Automatic Data Processing, Inc","org_type":"unknown","ransomware":null,"records_affected":74,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ADP.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-17","discovered_date":"2019-11-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"744bbf10a37d7e0d2014945b76cd4e1d87edd048","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pacific%20Guardian%20Life%20-%20California%20Attorney%20General%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5272f81a9e41","org_name":"Pacific Guardian Life Insurance Co. Ltd.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187404"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pacific%20Guardian%20Life%20-%20California%20Attorney%20General%20Notification.pdf"}],"summary":"Pacific Guardian Life reported unauthorized access to an employee email account, where emails may have been viewed or downloaded and personal information may have been present.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2020-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b4420017b9e83f7f5650dbcf3df969b9daa12cd2","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10533.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"680317c0eba2","org_name":"Smile Surfers","org_type":"unknown","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10533.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2020-02-14","discovered_date":"2019-08-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f6e791167c991f55510b17152a8289fb4a0141c","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aveanna%20-%20Notice%20of%20Data%20Breach%20-%20Exhibit%201%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"7323a909b1f3","org_name":"Aveanna Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aveanna%20-%20Notice%20of%20Data%20Breach%20-%20Exhibit%201%20-%20CA.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10532.pdf"}],"summary":"Aveanna Healthcare reported unauthorized access to certain employee email accounts, where personal information for some patients and employees may have been accessible.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85ce83654a5b08fbe18f5cd213aed34ea37c7863","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f44895d0-72ca-11eb-a46e-831b23dc7360"},"incident_date":"2020-02-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"452739eb4eaf","org_name":"State of Israel Likud party","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thedailybeast.com/app-used-by-netanyahus-party-leaks-personal-data-of-over-6-million-israelis"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.jpost.com/Israel-Elections/Personal-info-of-6m-Israelis-leaked-after-Likud-uploads-voter-info-617048"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.algemeiner.com/2020/02/12/following-likud-app-breach-regulator-descends-on-offices-of-suspected-developer/"}],"summary":"The personal information of over six million citizens was leaked after Benjamin Netanyahu’s Likud party uploaded the full register of Israeli voters to an app, Haaretz reported Sunday. The information includes full names, identity card numbers, addresses, genders, phone numbers, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-13","discovered_date":"2020-01-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f3e21a958f3fedf576a423e71af10ff894af3d26","impact_type":"unknown","incident_date":"2020-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06f85a11fae3","org_name":"Multnomah Education Service District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Multnomah%20Education%20Service%20District-2020-02-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-02-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad3f5b9201b5f7458d9e6333defe4a13f9328c3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e5a18d70-2383-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-02-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d62f6936855c","org_name":"FHN (Family Healthcare Network)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://chicagomorningstar.com/fhn-sends-mails-to-patients-regards-a-recent-privacy-breach-incident"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/data-breach-at-illinois-healthcare/"}],"summary":"A limited number of FHN employees’ email accounts may have been accessed by an unauthorized person. FHN said on April 20, 2020, that their investigation found a privacy incident that happened with some of their employees. Now, FHN notified their patients whose information may hav","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ad43cd33b1778fc97dca708e93e25c4d853ec0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a723c10-72c6-11eb-a46e-831b23dc7360"},"incident_date":"2020-02-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"84419fd31a6e","org_name":"NextMotion","org_type":"healthcare","ransomware":null,"records_affected":900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/plastic-surgery-images-and-invoices-leak-from-unsecured-database/"}],"summary":"Thousands of images, videos and records pertaining to plastic surgery patients were left on an unsecured database where they could be viewed by anyone with the right IP address, researchers said Friday. The data included about 900,000 records, which researchers say could belong t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2020-02-07","discovered_date":"2019-12-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76ac95b660f07a33b21d487ca9f2ef63be455456","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-12-06","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Overlake%20Hospital%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8236d80e516a","org_name":"Overlake Medical Center & Clinics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Staff members were deceived by a phishing email into entering their Overlake account credentials on a linked web page.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187100"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Overlake%20Hospital%20Notice.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Overlake%20Medical%20Center%20%26%20Clinics-2020-02-07"}],"summary":"Overlake Medical Center & Clinics reported that phishing emails stole employee email credentials, which were used to access email accounts containing potentially sensitive information.","supporting_quote":"The third parties acquired the credentials by sending a deceptive email to Overlake’s staff members asking them to enter the username and password of their Overlake account on a web page that was linked in the emails.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-07","discovered_date":"2020-01-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53199b4a1554ae9465eb003e607e01ed9a103b1d","impact_type":"unknown","incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b43b3cc4aba","org_name":"LaCrosse Footwear, Inc.","org_type":"unknown","ransomware":null,"records_affected":406,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LaCrosse%20Footwear%2C%20Inc.-2020-02-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"26be7de3a467aa348de4dcbeb7d6fc7792327e3d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SiouxCity.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"04e1570cdf31","org_name":"The City of Sioux City, Iowa","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SiouxCity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a895e24e60648e9cea29550997ed1d176377f33b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ba434dc0-22da-11eb-b221-a300329fb9cf"},"incident_date":"2020-02-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc7c2ff05c97","org_name":"Indiana University","org_type":"education","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://indianapublicmedia.org/news/iu-student-gpas-accidentally-made-available-to-all-university-students.php"}],"summary":"Software made available to allow students to calculate their GPA unintentionally gave all students access to all other students' grades.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3366d933b08a3ccac7dcfa1043062a301a30c1fd","impact_type":"data_theft","incident_date":"2019-11-04","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Altice%20USA%20Ad%20Current-Former%20Employee%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"a763a7704fb1","org_name":"Altice USA","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing incident led to unauthorized access to employees’ email account credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-187076"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Altice%20USA%20Ad%20Current-Former%20Employee%20r3prf.pdf"}],"summary":"An unauthorized third party used credentials obtained through phishing to access Altice USA employees’ email accounts and download some mailbox contents.","supporting_quote":"In November 2019, an unauthorized third party gained access to certain Altice USA employees’ email account credentials through a phishing incident.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a41ad3cae11d5b1ed5e4c669000dd59758a603e1","impact_type":"data_theft","imported_from":null,"incident_date":"2016-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bd8d8afdd70c","org_name":"Adult FriendFinder","org_type":"other","ransomware":null,"records_affected":169746810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adult FriendFinder (2016)","type":"hibp","url":"https://haveibeenpwned.com/Breach/AdultFriendFinder2016"}],"summary":"The October 2016 breach exposed Adult FriendFinder usernames, passwords, spoken languages, and email addresses.","supporting_quote":null,"technology_involved":["Adult FriendFinder website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-05","discovered_date":"2020-01-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14b08e076dc6b2707193930906d14aa52add58fb","impact_type":"unknown","incident_date":"2019-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"173a8443a351","org_name":"Health Share of Oregon","org_type":"unknown","ransomware":null,"records_affected":654362,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Health%20Share%20of%20Oregon-2020-02-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-05","discovered_date":"2020-01-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ee27c6fef8e400d16532f9702ce063f8331bf28","impact_type":"unknown","incident_date":"2020-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ae33f1b031dc","org_name":"Hamilton & Naumes, LLC","org_type":"unknown","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hamilton%20%26%20Naumes%2C%20LLC-2020-02-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f703cff6fda6b060cf6950225a7eb800d91c9697","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d8f1f1a0-72d4-11eb-a46e-831b23dc7360"},"incident_date":"2020-02-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"50d1ecad7e88","org_name":"Breach Candy Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://tech.economictimes.indiatimes.com/news/internet/one-million-healthcare-records-leaked/73911735"},{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/india-healthcare-data-leak-over-120-mn-medical-images-exposed/"}],"summary":"Nearly one million medical files and 107 million related medical images of Indian patients, including X-rays and scans, are freely accessible on the internet, an investigation by German security firm Greenbone Networks has found.  The records and images include details such as pa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d95c5277262f74420f33442fbff741a7d1c1d877","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6a8b490-2091-11ec-82c4-4d3486f21395"},"incident_date":"2020-02-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0c3019ce1ed","org_name":"City of  Paducah","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.paducahsun.com/news/local/city-paid-threat-actor-k-over-breach/article_e755dc70-9696-5000-a822-166dc023c013.html"}],"summary":"City of Paducah government recovering from computer server hack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95ebe2bc67bc485e991fbc75250dd75c14e87b6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"309071f0-17cd-11ec-b2e1-af958f712d05"},"incident_date":"2020-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"4f0262f75112","org_name":"University of Tasmania","org_type":"education","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailymail.co.uk/news/article-8754721/Private-details-20-000-Australian-university-students-leaked-online-massive-data-breach.html"}],"summary":"Extraordinary blunder results in the private details of almost 20,000 Australian university students leaked online in massive data breach - University of Tasmania","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50b7bd62c23694df9f1f7998c5fc779bad941b6b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70704a30-da78-11eb-bcc7-b7194a064c3e"},"incident_date":"2020-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cbae4a6c065","org_name":"Rockland County, GA","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ajc.com/news/breaking-news/ransomware-attack-hits-rockdale-county-servers-impacts-some-services/gfYVTZ93c1Sbr1UbObEqKP/"}],"summary":"Rockland County GA impacted by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"669370f5ac8b6eb366f682409405f356a504ef4b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b4d77900-72d6-11eb-a674-05cfd55ad89e"},"incident_date":"2020-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"b376e74f0e41","org_name":"Le Figaro","org_type":"technology_saas","ransomware":null,"records_affected":7400000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/french-daily-le-figaro-database-exposes-users-personal-info/"}],"summary":"French newspaper Le Figaro leaks data through unsecured  ES database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ec2b2f7cea9a1ecbf62c9c73e55192280c7134b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47209780-1574-11eb-b788-65a639ed21e8"},"incident_date":"2020-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CY","org_id":"479372ee0cb9","org_name":"Covve","org_type":"technology_saas","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/covve-revealed-as-source-of-data-breach-impacting-23m-individuals,https://www.bankinfosecurity.com/developer-in-cyprus-claims-breach-contacts-app-a-14295"}],"summary":"exposed ES database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":["CVE-2019-19781"],"data_types":["internal"],"disclosed_date":"2020-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34009522a1c540d3c19b2ed3599ea9f3ffc9e05e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"818273e0-0749-11ec-863c-8359987c65e0"},"incident_date":"2020-02-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"1c2b07f1d8a5","org_name":"Bretagne Télécom","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://diriga.com/2020/02/26/bretagne-telecom-fell-victim-of-doppelpaymer-ransomware-attack/"}],"summary":"Bretagne Télécom Fell Victim Of DoppelPaymer Ransomware Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2019-19781","kev_added":"2021-11-03","name":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","days_listed_before_incident":-641,"product":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-31","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75d1a7c81823bc4d097037a01e10b5e0626e1c1e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-30","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Golden%20-%20CA%20Attachment.pdf"},"notes":null,"org_country":"US","org_id":"0fbf1f959c15","org_name":"Golden Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186886"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Golden%20-%20CA%20Attachment.pdf"}],"summary":"Golden Entertainment reported that phishing led to unauthorized access to some employees’ email accounts, which contained personal information.","supporting_quote":"Our investigation into an email phishing incident determined that an unauthorized individual obtained access to some employees’ email accounts.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00a6c0d98d12a9675d968ea4347e9cd0b33bd350","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"204a4440-250e-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d890cf95a55e","org_name":"Colorado Mental Health Institute at Pueblo","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.chieftain.com/news/20200408/potential-data-breach-reported-at-cmhip"}],"summary":"Officials from the Colorado Department of Human Services Office of Behavioral Health said on Wednesday that the Colorado Mental Health Institute at Pueblo experienced a potential data breach.  A folder containing protected health information on a shared internal drive was found, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-31","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"455d693f2c23d2246d0710e3b07cdf7189cc3c2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Los%20Banos%20-%20California%20Template%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"205f0d00db77","org_name":"City of Los Banos","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Los%20Banos%20-%20California%20Template%20Notification%20Letter.pdf"}],"summary":"The City of Los Banos reported that a stolen, unencrypted city-owned laptop may have contained personal information.","supporting_quote":"We recently learned that a city-owned laptop containing personal information was stolen from an employee’s vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b78bd75e868f0417e0746a7758b7054edb3bcb87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54c44f00-72c4-11eb-a46e-831b23dc7360"},"incident_date":"2020-01-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"467bfd5d21b5","org_name":"Institute of International Education (IIE)","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/education-nonprofit-leaks-data/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/business/international-education-institute-involved-in-major-data-breach/article/567106"}],"summary":"A US education non-profit appears to have unwittingly leaked the personal information of thousands of students after leaving two online MongoDB databases exposed.  The privacy snafu was discovered by noted researcher Bob Diachenko and affected the Institute of International Educa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d498ebbe2eb3390e1623de1e54f91cf7dcf2777","impact_type":"data_theft","imported_from":null,"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"fc5159c5cd3a","org_name":"DailyObjects","org_type":"retail_ecommerce","ransomware":null,"records_affected":464260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DailyObjects","type":"hibp","url":"https://haveibeenpwned.com/Breach/DailyObjects"}],"summary":"Customer records from DailyObjects were leaked online, including personal information and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fbba9cc176f1f7842c5fcb146e3cf2064a97ad4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c643efb0-237c-11eb-b77f-316b5c5dd5eb"},"incident_date":"2020-01-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad54d7f09cee","org_name":"St. Peter's Health Partners Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":1789,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/new-york-medical-practice-reports-1-789-patients-info-missing-from-bank-deposit-bags.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.sphpma.com/assets/documents/public_notice_saratoga_cardiology_associates.pdf"}],"summary":"Saratoga Cardiology Associates, a practice of St. Peter's Health Partners Medical Associates (SPHPMA), notified 1,789 individuals that certain payment information contained in bank deposit bags between January 27, 2020, and April 8, 2020, may be missing. In the notification lette","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc0ed23072230ad4d1b4860757663b41d0c45e56","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"544da580-d9a8-11eb-96ea-fd8a03dbb673"},"incident_date":"2020-01-27","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3f81ecceabc","org_name":"ITI Technical College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wafb.com/2020/02/03/iti-technical-college-latest-victim-ransomware-attacks/"}],"summary":"15039","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c8c435176b63ac481c22a25b5a54b28b1e4443a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fc8fef30-251e-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9751a30a9e1a","org_name":"Hawaii Pacific Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/hawaii-health-system-fires-employee-after-wrongfully-viewing-patient-records.html"}],"summary":"Honolulu-based Hawaii Pacific Health has fired an employee after discovering the employee had inappropriately accessed patient medical records.  The employee worked at Straub Medical Center. The health system found that the employee had wrongfully accessed patient records between","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71a8902a19d7b60a0d0eda82f4fec10f5f026345","impact_type":"data_theft","imported_from":null,"incident_date":"2014-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"56b0d850e47f","org_name":"Tout","org_type":"technology_saas","ransomware":null,"records_affected":652683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tout","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tout"}],"summary":"Tout suffered a data breach that exposed user email addresses, names, IP addresses, locations, bios, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-24","discovered_date":"2019-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3c45227cd0abceb22078d46759db17e3c783c33","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PSIC%20-%20CA%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"64113177c5ce","org_name":"Pacific Specialty Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186395"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PSIC%20-%20CA%20Notice%20of%20Data%20Event.pdf"}],"summary":"Unauthorized actors accessed certain Pacific Specialty employee email accounts between March 20 and March 30, 2019, and personal information may have been accessible.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"02fe345741b0723310b8ae807ee68c540ed5c772","impact_type":"disruption_or_ransomware","incident_date":"2019-12-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10531.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"a2f951994471","org_name":"Oostra Rouw & Associates, Inc.","org_type":"professional_services","ransomware":true,"records_affected":2376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10531.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10531.pdf"}],"summary":"Oostra Rouw & Associates, Inc. experienced a ransomware attack on December 26, 2019, potentially exposing personal information present on affected computers.","supporting_quote":null,"technology_involved":["computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e65f19c8ea60a07c759473d86eb9acd37e01a69c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"251f6910-72d8-11eb-a46e-831b23dc7360"},"incident_date":"2020-01-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"275453cfbd91","org_name":"Buchbinder","org_type":"other","ransomware":null,"records_affected":3100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.n-tv.de/wirtschaft/Datenpanne-bei-Autovermieter-Buchbinder-article21526642.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://borncity.com/win/2020/01/23/datenleck-beim-autovermieter-buchbinder/"}],"summary":"German car rental company Buchbinder exposed the personal information of over 3.1 million customers including federal ministry employees, diplomats, and celebrities, all of it stored within a ten terabytes MSSQL backup database left unsecured on the Internet.  The German company ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-01-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04620acfde365c20379bace47803c9dbed81d275","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c59a8e0-04b7-11eb-8c43-8ded27596b66"},"incident_date":"2020-01-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01c7bc460d65","org_name":"Ambry Genetics","org_type":"healthcare","ransomware":null,"records_affected":230001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/genetic-testing-lab-hack-affects-233000-a-14182"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189258"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10544.pdf"}],"summary":"Ambry Genetics reported an breach when unauthorized person access an employees email account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-01-21","discovered_date":"2019-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"426d48a8005901f5d5a21be1e34a89d7cf6f6c93","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_4.pdf"},"notes":null,"org_country":"US","org_id":"32c21eaa5244","org_name":"Sunshine Behavioral Health Group, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A cloud-based system was inadvertently configured to make patient records available on the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186209"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_4.pdf"}],"summary":"Sunshine Behavioral Health Group reported that patient records were inadvertently made available on the Internet through a misconfigured cloud-based system.","supporting_quote":"On September 4, 2019, Sunshine became aware that a cloud-based system used to store certain patient records on behalf of the above health care providers was inadvertently set-up in such a manner that permitted the records to be made available on the Internet.","technology_involved":["cloud-based system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66f64ae73f92ef95690fc316aa3b0ccf4d39693e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-29","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ex_A-notice-general.pdf"},"notes":null,"org_country":"US","org_id":"811818dfdaa9","org_name":"The UPS Store, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186206"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ex_A-notice-general.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10530.pdf"}],"summary":"A phishing incident gave an unauthorized person potential access to local store email accounts containing documents with personal information.","supporting_quote":"Between approximately September 29, 2019 and January 13, 2020, a small percentage of The UPS Store, Inc. local store locations were the victim of a phishing incident in which an unauthorized person potentially had access to a limited number of local store email accounts.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2020-01-20","discovered_date":"2019-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"afac8eb02da3d3f5cd9577111379650cc3bc53d1","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AmeriHealthCaritas.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5692d6c2b54b","org_name":"AmeriHealth Caritas Family of Companies","org_type":"healthcare","ransomware":null,"records_affected":5563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AmeriHealthCaritas.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AmeriHealthCaritas.pdf"}],"summary":"A former employee downloaded company confidential information, including files that may have contained providers’ personal information, to a personal hard drive.","supporting_quote":"On or about November 15, 2019, we learned that a former AmeriHealth Caritas employee improperly downloaded company confidential information to a personal hard drive.","technology_involved":["personal hard drive"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-13","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dce008b0247ff9e7ae3f11e0303a6b29d7696f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-19","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TCS%20-%20CA%20AG%20Exhibit%201-Cover%20letter%20deleted.pdf"},"notes":null,"org_country":"US","org_id":"7273ab10294b","org_name":"The Crack Shack Enterprises, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TCS%20-%20CA%20AG%20Exhibit%201-Cover%20letter%20deleted.pdf"}],"summary":"The Crack Shack reported that malware on a payment card processing server may have exposed customer payment card information.","supporting_quote":"Through this investigation, it was discovered that payment card information may have been accessed as a result of the installation of malware on a server used to process payment card data at the Encinitas location.","technology_involved":["payment card processing server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1133"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-17","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1deb291edeb67fa3fb8a2005a9bc6e52ddf044a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/J.D.%20England%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201%20-%20Cover%20letter%20deleted.pdf"},"notes":null,"org_country":"US","org_id":"ddb143b836e3","org_name":"J.D. England Management, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/J.D.%20England%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201%20-%20Cover%20letter%20deleted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#J.D.%20England%20Management%2C%20Inc.-2020-01-17"}],"summary":"J.D. England Management determined that a front desk computer at the Best Western Inn Tooele was accessed remotely without authorization and a folder containing guest information was viewed.","supporting_quote":null,"technology_involved":["front desk computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e29c4e5800a750ec66542fb8647249c42c89f85","impact_type":"unknown","incident_date":"2019-10-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ec7a86c2d9e","org_name":"Community Action Partnership of Kern","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186190"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-01-17","discovered_date":"2019-12-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"780105d43a5d4fc7194c0ac60ccad3eb42906e32","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10529.pdf"},"notes":null,"org_country":"US","org_id":"0ee053df482f","org_name":"City of Sioux City","org_type":"government","ransomware":null,"records_affected":3563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10529.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10529.pdf"}],"summary":"The City of Sioux City reported that malicious code inserted into its Click2Gov payment portal could have captured payment card information from potentially affected accounts.","supporting_quote":null,"technology_involved":["Click2Gov"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba9562535a8f94c6e404cdb55b70e9812857a7ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aca41790-2518-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca87e5cfb131","org_name":"VA Sierra Nevada Health Care System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://carsonnow.org/story/03/24/2020/va-sierra-nevada-health-advises-veteran-patients-families-potential-privacy-breach"}],"summary":"RENO — The VA Sierra Nevada Health Care System on Tuesday announced a potential medical privacy breach of veteran records.  In January, a vacated office at the medical center was found to contain several boxes of veteran records. The files contained patient identifying informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"158458c2e7efa119d781c8b02c49f266075bb550","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-25","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_31.pdf"},"notes":null,"org_country":"US","org_id":"844bce7ce05e","org_name":"Legalinc Corporate Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the database used to store customer business formation documents may have allowed access to files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_31.pdf"}],"summary":"A vulnerability in Legalinc's database may have been used to access a limited number of files containing personal information.","supporting_quote":"It is possible that the security consultant used this vulnerability to gain access to a limited number of files, which contained personal information about certain individuals.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94f586abab8bd24315ea66a173aabeeaa9c131d3","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hanna_Multi-State%20Master__Rev1.pdf"},"notes":null,"org_country":"US","org_id":"3ec3f483ed80","org_name":"Hanna Andersson, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-186060"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hanna_Multi-State%20Master__Rev1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hanna%20Andersson%2C%20LLC-2020-01-15"}],"summary":"An unauthorized third party accessed information entered during purchases on Hanna Andersson’s website between September 16 and November 11, 2019.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d99f3b0f4179ff4028f34d640e801384a73045ff","impact_type":"data_theft","imported_from":null,"incident_date":"2019-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"89eaaaa5eba0","org_name":"europa.jobs","org_type":"other","ransomware":null,"records_affected":226095,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: europa.jobs","type":"hibp","url":"https://haveibeenpwned.com/Breach/EuropaJobs"}],"summary":"A breach at the European jobs website europa.jobs exposed personal information and passwords, and the data was later redistributed on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61e038ba95aa6f3e89683a7198b3a92bfb0bddcd","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Decron%20Properties%20Corporation%20-%20Notice%20of%20Data%20Event%20_1.pdf"},"notes":null,"org_country":"US","org_id":"bf9abb93bc45","org_name":"Decron Properties Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185942"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Decron%20Properties%20Corporation%20-%20Notice%20of%20Data%20Event%20_1.pdf"}],"summary":"Decron Properties Corporation confirmed unauthorized access to certain email accounts, where personal information was potentially accessible.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-14","discovered_date":"2019-12-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"adbe1cb6ad0bdd25e4ffe54079ecb5d97cff091f","impact_type":"unknown","incident_date":"2019-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40b60bfbedf9","org_name":"City of Bend","org_type":"unknown","ransomware":null,"records_affected":5171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20Bend-2020-01-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2f245aa782f07c765e948c07514ed0fdade11dbc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/QuakerSteak.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"031d0eb977f0","org_name":"Quaker Steak & Lube of South Carolina, LLC","org_type":"unknown","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/QuakerSteak.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea48bfd985d2c1624a656744a5b77db01ba22903","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"93f9ea3fed8e","org_name":"Planet Calypso","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Planet Calypso","type":"hibp","url":"https://haveibeenpwned.com/Breach/PlanetCalypso"}],"summary":"The Planet Calypso forums’ vBulletin-based forum exposed email addresses, IP addresses, usernames, and salted-MD5-hashed passwords.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcfafa9cd1f6175c8b400283acf5db2d39bc53fd","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"63255de6f18b","org_name":"Go Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Go Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/GoGames"}],"summary":"Go Games suffered a data breach exposing customer email and IP addresses, usernames, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2020-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"178cd9e746221c6823606be0ef52fbef61662412","impact_type":"data_theft","imported_from":null,"incident_date":"2019-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f8ea6de9a64d","org_name":"BtoBet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BtoBet","type":"hibp","url":"https://haveibeenpwned.com/Breach/BtoBet"}],"summary":"Data from gambling sites was linked to BtoBet as a common source, including user records and gambling histories.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea2feec262897fb41d0a39b23ff20b81fda32d6d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d16bb780-25c3-11eb-a3b1-07c4769263ea"},"incident_date":"2020-01-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa21d485a5f1","org_name":"RANDLEMAN EYE CENTER","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/randleman-eye-center-notice-data-191200480.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/north-carolina-provider-hit-by-malware-attack.html"}],"summary":"Randleman Eye Center is taking action after becoming aware of an incident in which some of our systems were accessed by an unauthorized person. While there is no evidence that suggests that any data was actually taken, we have notified individuals for whom we have contact informa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8488ca763c101fa4eeca7d92bfd08cb0cb80ace4","impact_type":"unknown","incident_date":"2019-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PIH%20Health%20-%20Sample%20Notification%20Letter%20v2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0feee93ab4df","org_name":"PIH Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185839"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51a47d0f8aeb10863b081996b335950e7ffa1475","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-10-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"0670f6017ba1","org_name":"Indian Railways","org_type":"transportation_logistics","ransomware":null,"records_affected":583377,"reviewed":false,"root_cause":"The website left records exposed on an unprotected Firebase database instance.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Indian Railways","type":"hibp","url":"https://haveibeenpwned.com/Breach/IndianRailways"}],"summary":"Indian Railways left records, including email addresses, usernames, and plain-text passwords, exposed on an unprotected Firebase database.","supporting_quote":"In November 2019, the website for Indian Rail left more than 2M records exposed on an unprotected Firebase database instance .","technology_involved":["Firebase database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Firebase"},"updated_at":null,"veris_action":"error","derived":{"vendors":[{"id":"78ca4b4b0545","name":"Firebase"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd9afecb7cda0b38b5da10b610db788687dfdc20","impact_type":"unknown","incident_date":"2018-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Attachment_1_Notice%20only_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89bfc13110b0","org_name":"Health Quest Systems, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185843"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0217cd94cb5465634318d882d2143ae761218f9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Treloar%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"},"notes":null,"org_country":"US","org_id":"3f28be2471e3","org_name":"Treloar & Heisel, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185792"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Treloar%20-%20Notice%20of%20Data%20Event%20-%20CA.pdf"}],"summary":"A Treloar employee’s stolen laptop may have contained locally stored personal information.","supporting_quote":"In May, 2019, a Treloar employee’s laptop was stolen from their car.","technology_involved":["laptop","email account","cloud-based storage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb74a03662eb028345ce312bc9d4b8ec9ecc252c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1511a700-22dc-11eb-b221-a300329fb9cf"},"incident_date":"2020-01-07","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39f94b5820f1","org_name":"City of Las Vegas","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/city-of-las-vegas-said-it-successfully-avoided-devastating-cyber-attack/,https://www.cbronline.com/cybersecurity/breaches/las-vegas-hacked/"}],"summary":"(ransomware?) compromise some las vegas city assets but segmentation prevented widespread damage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f232314fc59872ef4b6a15d1d22f0a8688cf2f51","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc51d670-0d65-11eb-835c-77358de149b1"},"incident_date":"2020-01-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"408a059ee793","org_name":"Riverview Health","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/indiana-hospital-alerts-2-600-patients-of-human-error-data-breach.html"}],"summary":"Riverview Medical accidentally mailed people with the wrong patient name embedded in the lette","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2020-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0237f2c7174cfa00e2a4645e1b825f44544e045","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"RU","org_id":"b7f4f53b60b9","org_name":"Universarium","org_type":"education","ransomware":null,"records_affected":564962,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Universarium","type":"hibp","url":"https://haveibeenpwned.com/Breach/Universarium"}],"summary":"Universarium suffered a breach in approximately November 2019 that exposed email addresses and passwords in plain text.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2957f2eb692dcb066484800cc4a2c7ece23c9d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/States%20Logistic%20Services%20-%20Notice%20of%20Data%20Event%20-%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"6faa72016c49","org_name":"States Logistics Services, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185572"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/States%20Logistic%20Services%20-%20Notice%20of%20Data%20Event%20-%20CA_1.pdf"}],"summary":"States Logistics Services reported unauthorized access to an employee email account on August 30, 2019, but could not determine whether emails or attachments were viewed.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b27987f22bd3b4b739f8738a26c2b64c411f179","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0e555c80-721f-11eb-a74a-79ed152e0098"},"incident_date":"2020-01-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbf68e32c412","org_name":"Pussycash.com","org_type":"other","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.9news.com.au/world/data-leak-exposes-sensitive-details-of-thousands-of-porn-actors/1194a3f7-f69e-407e-922e-305f810c1a80"}],"summary":"Pussycash accidentally left an S3 bucket open exposing 4k adult performers personal information. Oppsie ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2020-01-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b175fb024f15ef918caaf81776de988d2f43dd9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36d29450-d9aa-11eb-96ea-fd8a03dbb673"},"incident_date":"2020-01-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12d758e264a0","org_name":"Beaumont Hospital","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.detroitnews.com/story/business/2020/07/28/beaumont-hospital-announces-security-breach-accounts/5530757002/"}],"summary":"Beaumont Hospital staff had email accounts access by unauthorized third party resulting in a breach notification for 6k people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"453807c458edf7f17b4c8a99e5bdd58fe96ad8c6","impact_type":"unknown","incident_date":"2019-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Generic%20Consumer%20Data%20Breach%20%20Notification%20%28California%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb47a676d6fd","org_name":"AmeriSave Mortgage Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185603"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-02","discovered_date":"2019-11-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"144752b76d1521199c80febfcf36c1c8d7402d2f","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af9ec124e653","org_name":"Klamath County","org_type":"unknown","ransomware":null,"records_affected":1002,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Klamath%20County-2020-01-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ad9a8dfaa84180c816352ab238c7fcfee3626f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9fc33e80-74a9-11eb-a956-8766d2dd0181"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f09e488283b","org_name":"Wishbone","org_type":"technology_saas","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/popular-teen-app-wishbone-hacked-again-40-million-users-info-being-given-away/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-selling-40-million-user-records-from-popular-wishbone-app/"}],"summary":"A hacker has put up for sale today the details of 40 million users registered on Wishbone, a popular mobile app that lets users compare two items in a simple voting poll.  The data is being advertised across multiple hacking forums and being sold for 0.85 bitcoin (~$8000), accord","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6294bac2fa24746f28b37ebccbaede74afb5179","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36a32ab0-d42a-11eb-a192-c5509024cd4a"},"incident_date":"2020-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"9e81b1b23e41","org_name":"Wilson Parking","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nzherald.co.nz/business/wilson-parking-machines-at-hospitals-hit-by-card-skimming-police-investigation-launched/SK7AR2PFIHSPSW2WXGH7GSOOYM/"}],"summary":"Hospital car parking machines had card skimming devices installed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1ecee51361e9d5810cbd342cd3ebc3948d3d964","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f3fa2580-72bb-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"52f874000a15","org_name":"Virgin Media","org_type":"technology_saas","ransomware":null,"records_affected":900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/virgin-media-exposes-data-of-900000-users-via-unprotected-marketing-database/"}],"summary":"Virgin media left a database unprotected and exposed the data of 900,000 users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b149d96618621e0ef78abad28bd1b4a3ab8a4a76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f47b5580-04b4-11eb-8c43-8ded27596b66"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"19cae1fd0ef8","org_name":"Unacademy","org_type":"education","ransomware":null,"records_affected":11000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/unacademy-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.livemint.com/technology/tech-news/over-20-mn-unacademy-user-accounts-exposed-in-data-breach-report-11588775083410.html"}],"summary":"Online Indian university Unacademy experienced a databreach with the 22m user records being sold on the darkweb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"285ad76321a1c7d54b3f504836ec2ad92cb79289","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87484cb0-2517-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"fa4cf132952b","org_name":"Ukrainian Ministry of Infrastructure","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.unian.info/society/10943570-classified-defense-data-leak-in-ukraine-name-of-suspected-official-revealed.html"}],"summary":"The name has been revealed of a Ukrainian official who is being suspected of transferring to an undisclosed third party of a classified document relating to the government's defense measures in eastern Ukraine, the Black and Azov seas, and in the Kerch Strait.  The alleged perpet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d8f1555a58108541083679f7f967f3866c98575","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f41cb70-f91a-11eb-98bb-95028a4c8b05"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09400d3188e7","org_name":"Town Sports International","org_type":"other","ransomware":null,"records_affected":600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/09/23/new-york-sports-clubs-owner-breach/"}],"summary":"Town Sports International accidentally left a server unsecured which exposed various internal documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed6174e9079fcce5c7f769831bf2f69a60efdfb8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"020b29c0-72c2-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"3bd2dfe44864","org_name":"Tokopedia","org_type":"retail_ecommerce","ransomware":null,"records_affected":9100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://en.antaranews.com/news/151854/tokopedia-notifies-authorities-of-third-party-over-data-breach"}],"summary":"Tokopedia had their database stolen and sold on criminal forums which contained like 91m users account information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8158fdc78556a94ac48f89f760b549e9b34c3252","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81bcac30-025a-11eb-8781-bfb630cdf748"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"5108578c67b8","org_name":"Televisa","org_type":"technology_saas","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/fut-fantastico-data-breach/"}],"summary":"Fut Fantastico had a misconfigured S3 bucket which leaked info on 150k users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"090d6967fefba1b5022571b23188c85e2d122ec8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc1d49b0-72c2-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6a5d9e2d4b5","org_name":"Telegram","org_type":"technology_saas","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pymnts.com/news/security-and-risk/2020/telegram-breach-exposed-millions-user-data/"}],"summary":"A Telegram database of users was for sale on the dark web as hackers abused look up contact information to enumerate users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f4c21a8e4ed71a1dfccb1f03d80474594074be6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45cdacb0-2451-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f31cba8f622","org_name":"StorEnvy","org_type":"retail_ecommerce","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/e-commerce-firm-storenvy-hacked-accounts-leaked/"}],"summary":"The popular e-commerce website StorEnvy known for its online store building and social marketplace has been hacked. As a result, personal details of over 1.5 million customers and merchants have been leaked online on a hacker forum for free download, Hackread.com has learned.  La","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":["CVE-2019-19781"],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7eb3c2dd7b83497d71a9ca6136f98edb07d16f0f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32363f40-3022-11ec-a5c2-337d0141f916"},"incident_date":"2020-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ed7dc4f14e3","org_name":"State of New York","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/new-york-state-investigates-network-hack-a-14124"}],"summary":"State of New York experienced a breach due to a unpatched vulnerability in citrix ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2019-19781","kev_added":"2021-11-03","name":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","days_listed_before_incident":-672,"product":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b23c8df949da81eeb13749a0895c96446e00f759","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a033b0c0-0712-11eb-ab9e-fb89bdbaf0c7"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"922bbc25a9e3","org_name":"Star Tribunal","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kstp.com/minnesota-news/star-tribune-warns-of-possible-data-breach-urges-subscribers-to-take-precautions/5727429/"}],"summary":"Hackers stole 1 million records from Star Tribunal and are selling it on their forums","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bd8bec404bb4891455fee0e0c7b764333b9fdc8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49b96ff0-e7c3-11ea-8ff0-e3594c873b30"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735dcc996996","org_name":"Square Panda","org_type":"education","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/data-breaches-on-e-learning-platforms/"}],"summary":"The U.S.-based online education platform Square Panda lost around 15,000 personal records (1MB) of parents and teachers due to misconfiguration","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf7faec41f2c31f60346989bd980b1eb0887e653","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c2b6f70-72c7-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cd948afb552c","org_name":"South Yorkshire Police","org_type":"government","ransomware":null,"records_affected":8600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailymail.co.uk/news/article-8305991/Data-breach-left-millions-car-trips-exposed.html"}],"summary":"UK Police left a system exposed that collected license plate information and bunch of other travelers data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"088640f77a903046444b8af027da3176e2eaa429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7b58a9b0-179b-11eb-a388-210bf038e9e5"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aeca750ab6f6","org_name":"Software MacKiev","org_type":"professional_services","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/leak-exposes-private-data-of-genealogy-service-users/157612/"}],"summary":"Software MacKiev, makers of the Family Tree Maker software, exposed the data of 60,000 users in an unsecured ElasticSearch server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3c711e0df4fd40b2a0f07324a96092d5f80b712","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10861410-f2bb-11ea-8781-7798bdcc4349"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2d52d14ed970","org_name":"Religare Health Insurance","org_type":"financial","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/major-data-breach-at-religare-health-insurance-cyble-warns-of-phishing/"}],"summary":"Dark web sweepers Cyble has claimed that internal data of Gurugram-based Religare Health Insurance has lost 5 Mn records, which is now up for sale. The US-based cybersecurity firm has claimed that the hacked data includes details of Religare, its agents, several sensitive informa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7313684dffd8b9f73d92510b223f3551daf828cf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c5516ea0-0d5d-11eb-835c-77358de149b1"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fce71ae8bbb2","org_name":"R1 RCM","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2020/08/medical-debt-collection-firm-r1-rcm-hit-in-ransomware-attack/"}],"summary":"R1 RCM a medical debt collection agency was hit by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ca754e2453084eb83de3239ad454462fcbbb7ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d496f1c0-0c93-11eb-ac0d-91a70ee1d655"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d34e51555e4e","org_name":"Quantum Imaging and Therapeutic Associates","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pennlive.com/crime/2020/07/x-rays-of-male-genitalia-may-have-been-shared-online-by-central-pa-imaging-employee-police.html"}],"summary":"Employee shared X-Ray of patients on social media ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c44a32551d30802d92764c4edcfd1366945a23e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0eb22d90-8e87-11ec-a600-657ec2694f8f"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"1e221c9cd81a","org_name":"Prestige software","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techtimes.com/articles/253972/20201108/hotels-com-booking-expedia-fall-victim-latest-data-breach-exposing.htm"}],"summary":"Presitge Software accidently misconfigured their s3 buckets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a2d46145d420b9f73cd7a85e3d0478ba8a3967d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"127031e0-8e85-11ec-a600-657ec2694f8f"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7f6e4fc2411","org_name":"PlutoTV","org_type":"technology_saas","ransomware":null,"records_affected":3200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/hacker-shares-32-million-pluto-tv-accounts-for-free-on-forum/"}],"summary":"PlutoTV compromised and data sold on hackerforum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f4b55acda118acf1b2b56dd892f7a41b4a3f0c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dea65e00-e7c5-11ea-8ff0-e3594c873b30"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f082af58797","org_name":"Playground Sessions","org_type":"education","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/data-breaches-on-e-learning-platforms/"}],"summary":"US-based virtual learning platform Playground Sessions’ data leak exposed nearly 4,100 user records through s3 bucket misconfiguration","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ee733c21f9a4d1bdf42a4d1d597b13cbc377dbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a0af9dc0-327c-11ec-a962-0f8a4d8d5131"},"incident_date":"2020-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"4feb66da9403","org_name":"Pepperstone","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.financemagnates.com/forex/brokers/pepperstone-blames-3rd-party-vendor-for-users-data-breach/"}],"summary":"3rd party partner was compromised via malware which resulted Pepperstone's client data being taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d265921e5837982b7ea7cdd5eb7808189d554194","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a66aaf0-f13f-11eb-8c8a-5968a0b53910"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12b2dc69bbdd","org_name":"Pell City","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.annistonstar.com/the_daily_home/free/some-pell-city-utility-customers-may-have-suffered-data-breach-free-content/article_3fd1b022-02c3-11eb-bc53-f7a536e70fa7.html"}],"summary":"Some Pell City utility customers may have experienced a databareach through a service provider","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0c4acd1e3215ab9d02b2997fc73747e38388d21","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4680b990-3cd3-11ec-b63a-33c287a8ec4a"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"d340d7b422a6","org_name":"PayMyPark","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insurancebusinessmag.com/nz/news/cyber/parking-payment-app-hit-by-ransomware-attack-216698.aspx"}],"summary":"PayMyPark, a parking payment app used by several city councils in New Zealand, has gone offline after falling victim to a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5f6eb7290ad59006732d6a8df91b09f583e5d7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b846db90-e7c0-11ea-8ff0-e3594c873b30"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KZ","org_id":"411cd7caa434","org_name":"Okoo","org_type":"education","ransomware":null,"records_affected":7200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wizcase.com/blog/educational-breaches-research/"}],"summary":"Elearning platform Okoo based in Kazakhstan left an elasticsearch database open to the internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73a7ec8be8153c99b9ec7987a729ea5edd50f685","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1a0d7c10-3024-11ec-a5c2-337d0141f916"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d7abb75e7a82","org_name":"Nova Scotia Workers Compensation Appeals Tribunal","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/nova-scotia/nova-scotia-government-saying-little-privacy-breach-1.5566936"}],"summary":"Workers’ compensation appeal decisions, including workers’ personal information, were accidentally posted online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcafc0918778999a7f84cb3654c9667285bd562a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebb53ce0-f6bc-11eb-9352-c36534d585e1"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6dd83114600","org_name":"Northwestern Memorial","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://chicago.cbslocal.com/2020/12/31/data-breach-at-northwestern-memorial-hospital-says-no-evidence-of-fraud/"}],"summary":"At Northwestern Memorial a temp employee was inappropriately accessing patient data for two months","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b825ff1bcbc7d40c6e074d276a01c9b1887f78ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"edb8ae70-1ae1-11ec-8477-47d0f236e203"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5c54b827e44","org_name":"Netsentinal","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.statesman.com/story/news/2021/02/07/austin-police-surveillance-operation-leaked-documents-raise-questions/4221649001/"}],"summary":"Hackers leaked nearly 2,000 incidents of Austin surveillance. Here's what they found ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6b94c0c02d76d4c1094bde5b75b8def199c9c5a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6cfc590-72e1-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b760b6717130","org_name":"nCourt","org_type":"professional_services","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/04/07/ncourt-bills-fines-exposed/"}],"summary":"nCourts left a webserver unsecured with a bunch of data on their customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96310f6503cbdc11bb32b21bcf119adfecce7667","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7996ef70-05bf-11ec-a755-057d35a918cc"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"9405340a00f8","org_name":"National Highways Authority of India","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itwire.com/security/criminals-uses-windows-maze-ransomware-to-attack-indian-highways-authority.html"}],"summary":"Cyber criminals have used the Maze ransomware that can be used to attack Windows systems to hit the infrastructure of the Indian public sector body, National Highways Authority of India, and released data that they have stolen prior to encrypting it on-site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec9b9eb026c553e15192fb12726d16d3b59dc2a4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a92b3d0-1642-11ec-8258-83f74c3914c9"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"addadb1e3df7","org_name":"Nashville Plastic Surgery Institute, LLC","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nashville-plastic-surgery-center-hit-by-ransomware/"}],"summary":"Nashville plastic surgery center hit by ransomware - Nashville Plastic Surgery Institute, LLC, dba Maxwell Aesthetics","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"554c7baa848adfb50655e179411bf04aba564568","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ca0c07d0-e7be-11ea-8ff0-e3594c873b30"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"806f79c239e0","org_name":"MyTopDog","org_type":"education","ransomware":null,"records_affected":800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/data-breaches-on-e-learning-platforms/"}],"summary":"South Africa-based online learning platform MyTopDog lost over 800,000 students’ personal records (40-50MB) through misconfigured s3 buckets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"300e6112e1e31c92f569769d1b38df449e7c1cb0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aded0c10-1a1d-11ec-9cee-0b92cf8d85df"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"e04eb3410176","org_name":"Mexican Economy Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-mexico-economy-cyberattack/mexicos-economy-ministry-hit-by-cyber-attack-idUSKCN20J0BI"}],"summary":"Mexico's economy ministry hit by cyber attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60dd0774d200e57ac97714612cd31396ea0ad078","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3668e080-25c5-11eb-a3b1-07c4769263ea"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"327718d522f2","org_name":"Medicaid","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inquirer.com/news/pennsylvania/philadelphia-pill-mill-okolo-fallouh-doctors-evelyn-smith-montgomery-county-20200310.html"}],"summary":"Four people, including two doctors, were charged Tuesday with operating a pill-mill scheme by stealing the Medicaid information of homeless people and veterans living in three Tioga rowhouses and writing fake prescriptions in their names, Pennsylvania Attorney General Josh Shapir","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Maze","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08f0e8e3b1b48790ed898bb363da99d1f582b289","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ec925e0-14a0-11ec-8c2b-dbe37200ecd4"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72723e85b02e","org_name":"MaxLinear Inc","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cybersecurity-insiders.com/maze-ransomware-attack-on-maxlinear-inc/"}],"summary":"Chipset maker Max Linear was the victim of a ransomware attack by Maze group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"maze"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0e3ea4cf00c53b435fcc911e7893806e5b8c2c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91032590-72e2-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87b477d03739","org_name":"Marriott","org_type":"other","ransomware":null,"records_affected":5200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/marriott-discloses-new-data-breach-impacting-5-2-million-hotel-guests/"}],"summary":"Hackers used two employees stolen credentials to access customer information from the app's backend","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a1418f8237852f7a3dcf8efb761555acb682ef3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3226e3d0-0254-11eb-8781-bfb630cdf748"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CY","org_id":"e5e176a100e2","org_name":"Mailfire","org_type":"technology_saas","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-mailfire-leak/"}],"summary":"Email marketing company misconfigured elasticsearch database expose 100ks of user information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed228cdc3eaf469d9bda5db154738e3f2917ef7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04ace9c0-0fde-11ec-8c66-bd734728b5ba"},"incident_date":"2020-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aab9d4529750","org_name":"Lombard Metals","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mainlinemedianews.com/mainlinetimes/lower-merion-police-report-bala-cynwyd-company-loses-cash-in/article_65fbf75e-0246-11ea-bb49-abec592fff30.html"}],"summary":"Lombard Metals was duped into giving a spoofed client 136k dollars","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3ce9a9d3500fc95efcb83eb65dffd8a22ffa656","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6cc85c30-1217-11eb-a3ae-53136ea5d4e6"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"9dc72effa04b","org_name":"Ledger","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach"}],"summary":"Ledger exposed data via unsecured api key","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d6925ec31fe4d1ecc638ea33ca0c2faee41eb1e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24fa4a50-f91e-11eb-98bb-95028a4c8b05"},"incident_date":"2020-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b570a3a0aea","org_name":"Lake County Behavioral Health Services Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lakecountyca.gov/Page8515.aspx?SourceId=1&ArticleId=13313"}],"summary":"Lake County Behavioral Health Services Clinic experienced a breakin where patient records were stolen ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d338799819d53d300aa9195ad6dd205d779c258d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ab9f1f90-72c8-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"f9480818abeb","org_name":"Kinoapp","org_type":"technology_saas","ransomware":null,"records_affected":42000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-kinomap-leak/"}],"summary":"Kinomap app left an unsecured database with over 42m records which was discovered by security researchers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f9b782098becbfde1f942b92bf1206f55ed6442","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fc8a4190-2468-11eb-b042-01be07ea3379"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"596462a0dab9","org_name":"Key Ring","org_type":"technology_saas","ransomware":null,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/key-ring-app-data-leak-exposes-44m/,https://www.itsecuritynews.info/key-ring-app-data-leak-exposes-44-million-images/"}],"summary":"exposed s3 bucket found by security researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0577de595c548bff52ec0e971cb57fe1e916430","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69741330-25c2-11eb-a3b1-07c4769263ea"},"incident_date":"2020-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aeb34fc4551a","org_name":"Health Share","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idtheftcenter.org/health-share-data-breach-exposes-member-pii-after-laptop-is-stolen/"}],"summary":"A Health Share data breach has exposed the personal information of many of its members. This comes after a laptop was stolen from a company vehicle.     Advances in cybertechnology mean that a hacker can sit anywhere in the world and potentially break into a computer network. New","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cab2c447a363e07955ee7ff2a20228b7570b1e5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a314b070-0746-11ec-863c-8359987c65e0"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"493eca6a766a","org_name":"Havenly","org_type":"professional_services","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/havenly-discloses-data-breach-after-13m-accounts-leaked-online/"}],"summary":"Havenly, a US-based interior design web site, has disclosed a data breach after a hacker posted a database containing 1.3 million user records for free on a hacker forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cdaabbe0e49ab800abfe4b36d927211a4cc4fb4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6c9e240-d510-11eb-8806-c7cd39544f5b"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f7a32cfa0c9","org_name":"Guns.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/hacker-dumps-guns-com-database-customers-admin-data/"}],"summary":"Guns.com got their database, source code and credentials stolen and sold on the crime forums","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c048e9a66bbdbc548e6d82b2cf681d2d689d977","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b95f16d0-07d4-11eb-9be5-67f56bbd8cb4"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"cb576ed3f2ba","org_name":"Georgian Government","org_type":"other","ransomware":null,"records_affected":4934863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/personal-details-for-the-entire-country-of-georgia-published-online/"}],"summary":"Hacker posted database file of 4.9 million Gerogians on forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86a839ca6c84f2ad8aa6b23ef2f553e4fa0b9b44","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2b219d40-2393-11eb-a2fc-cdee479fbead"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2dd928464e42","org_name":"Georgia MLS","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://atlantaagentmagazine.com/2020/08/27/georgia-mls-announces-security-breach/"}],"summary":"unknown actions used to compromise server with user database. (May have been malware on server rather than exposed database.)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3935a095eb13b4bfb05a5d208c0f6fa67ae5528","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14590920-6c8d-11eb-aa83-f564cd4131c9"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"58b47110cb5a","org_name":"General Election Commission","org_type":"government","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-indonesia-cyber-breach/indonesia-probes-breach-of-data-on-more-than-two-million-voters-idUSKBN22Y15K"}],"summary":"Hacker publishes 2m voter records from Indonesia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f60c2fbe3e86540ae1cbce6e388c8442e2eee0c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f1580f0-72d0-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f994d25dca44","org_name":"Front Rush","org_type":"professional_services","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vice.com/en_ca/article/g5xggy/front-rush-college-athlete-recruiting-software-exposed-medical-information-grades"}],"summary":"College athlete recruiting software exposed students' medical info and grades","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa88c4938befcb0b34a5600f3b9cf4db55501054","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e9af58f0-2290-11eb-940b-ff2256f17cee"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5dde95ebe6b7","org_name":"Friendemic","org_type":"professional_services","ransomware":null,"records_affected":2700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/marketing-firm-friendemic-customer-records-exposed/"}],"summary":"Friendemic left an unsecured s3 bucket which leaked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8eb162de250520963ddbf2c02578445458cf3ec5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"da684490-723d-11eb-b847-53c7fcddcc7a"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"715c5c082509","org_name":"Estee Lauder","org_type":"manufacturing","ransomware":null,"records_affected":440336851,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/estee-lauder-440m-records-email-network-info/152789/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2020/02/11/estee-lauder-data-leak-440-million-records-exposed/#15111f152590"}],"summary":"A non-password protected cloud database containing hundreds of millions of customer records and internal logs for cosmetic giant Estée Lauder has been found exposed online, according to researchers.  In all, 440,336,852 individual data pieces were exposed, according to researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a25053c55f10ed69d0736f4ae39cfddf9706b759","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a02fa8c0-e7bb-11ea-8ff0-e3594c873b30"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"231d8bbf541b","org_name":"Escola Digital","org_type":"education","ransomware":null,"records_affected":75000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/data-breaches-on-e-learning-platforms/"}],"summary":"Insecure cloud storage exposes Escola Digital, a Brazil-based online learning platform,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6bf248b5adc1794b9af6fa3a3bf938e444aa414","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c08b400-10ae-11ec-ac2c-abfc822846a5"},"incident_date":"2020-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d5346d94979","org_name":"Erlanger Health System","org_type":"healthcare","ransomware":null,"records_affected":4938,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/erlanger-vendor-loses-backup-cds-containing-almost-5-000-patients-info-during-software-update.html"}],"summary":"Erlanger vendor loses backup CDs containing almost 5,000 patients' info during software update ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4736853c7004b832921dc4f949d312db23c46279","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74513c70-2814-11eb-8365-4f57e2156a07"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86adb8d18c5e","org_name":"Eerie Community College","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wkbw.com/news/local-news/erie-community-college-hit-with-ransomware-attack"}],"summary":"Eerie Community College as hit by Ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4487fb33632203c12f56893895ae733b1e207a2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a0394090-7232-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"25b38938ce28","org_name":"Dutch Ministry for Health, Wellness and Sport","org_type":"government","ransomware":null,"records_affected":6900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/dutch-government-loses-hard-drives-with-data-of-6-9-million-registered-donors/"}],"summary":"Dutch government lost a harddrive that contained 6.9m organ donors","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff4cfd79b5ca7361e903ed1fa541a6db9ee10ed3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f78a6060-0fcf-11eb-afe7-87eff9df4bdb"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f55c456d061","org_name":"Drizly","org_type":"retail_ecommerce","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/07/28/drizly-data-breach/"}],"summary":"Drizly compromised by hacker which resulted in 2.5m customer records being lost and sold","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"137b0db9e50c85e244bacd5283c11b47f8d3f3b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8c3de2d0-e645-11eb-b667-c585fe0ca11b"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aaa6f72a9186","org_name":"Dreamhost","org_type":"technology_saas","ransomware":null,"records_affected":851000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/dreamhost-database-leak-exposed-815-million-records-of-customer-data/"}],"summary":"Dreamhost leaked over 815 million customer records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8107aaa63867e6d4ea4b2a9e76097fa60f2d97f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28369a20-04b9-11eb-ab9e-fb89bdbaf0c7"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e1ef45662dba","org_name":"Dr.Martin Jugenburg","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ibtimes.com/canadian-surgeon-accused-secretly-filming-patients-during-procedure-without-their-2996840"}],"summary":"Surgeon accused of secretly filming patients during procedure without consent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8221d9ccd2523b3bfcc8a3475369f12022e26cbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c9545a0-07db-11eb-9be5-67f56bbd8cb4"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"4ce86b28f9e9","org_name":"Decathlon","org_type":"retail_ecommerce","ransomware":null,"records_affected":123000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/sports-giant-decathlon-leaks-123/"}],"summary":"Decathlon misconfigured database resulting in leaking 123 million records, which includes personal data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f66276ef0b6642e61a7e5864d0e3dc22ac5fde12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"820a17b0-4645-11ec-b26b-73b5a62f8946"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2553bf373783","org_name":"Comcast","org_type":"technology_saas","ransomware":null,"records_affected":1500000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securitymagazine.com/articles/94550-researchers-discover-exposed-comcast-database-containing-15-billion-records"}],"summary":"Researchers discover exposed Comcast database containing 1.5 billion records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2788b8e4b63b65766062ccb00b1de8fa2ad35f5f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7327e020-3cd0-11ec-b63a-33c287a8ec4a"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1116e4ff58a","org_name":"CoinMarketCap","org_type":"financial","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.republicworld.com/technology-news/other-tech-news/data-of-over-3-million-coinmarketcap-users-leaked-questions-raised-on-storage-techniques.html"}],"summary":"Data of Over Three Million CoinMarketCap Users Breached and sold on forums through unknown methods","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5de9a5d9278be45c69a482a92a19f7e861bf1f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9e6d7ba0-72be-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e25d30af3e7","org_name":"Clubilion","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2020/07/data-leak-on-online-gambling-app-puts-millions-of-users-at-risk-of-cyber-attacks/"}],"summary":"Clubilion a creator of mobile gambling apps left an elasticsearch database open with no creds none the less","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4c79e90f18c16fe6578c94788976fb30a60d3aa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd0b63f0-f93b-11eb-86f9-41a68a9542ff"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"526c06725a8c","org_name":"CivicSmart","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://statescoop.com/smart-parking-meter-vendor-data-stolen-ransomware-attack/"}],"summary":"CivicSmart was breached and ransomed by REvil/Sodinokibi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da2ec1aed74a9db9721bb00e9f1f3d0dcfb59d56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2922e280-0d57-11eb-835c-77358de149b1"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7585df58258b","org_name":"Chowbus","org_type":"other","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.businessinsider.com/chowbus-data-breach-leaked-information-hundreds-thousands-users-2020-10"}],"summary":"Asian food delivery service emailed customer data  to customer after being compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82a73f2b936683f2338a7abe6576f2ee3fec54ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e6aa06a0-72bd-11eb-a674-05cfd55ad89e"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e09954679172","org_name":"Checkpeople.com","org_type":"technology_saas","ransomware":null,"records_affected":56250000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2020/01/09/checkpeoplecom_data_exposed/"}],"summary":"Checkpeople.com left a database containing 56.2m US residents information open","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f35918c9277194d778052a639cd8ad39b6164bb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fcc0ac60-e4ae-11eb-8ef6-fbb8d39928b9"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"469ba1f0f97a","org_name":"Centre for Development of Imaging Technology","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://english.mathrubhumi.com/news/kerala/data-leak-on-kerala-scholarship-website-resolved-claims-c-dit-1.5034523"}],"summary":"The Centre for Development of Imaging Technology left backup data unsecured on a server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf590cf22d79045ba296893cd67f591cf6cd2004","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a3e1770-f6b7-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02631baf8ce3","org_name":"Cense","org_type":"technology_saas","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securethoughts.com/medical-data-of-auto-accident-victims-exposed-online/"}],"summary":"Cense, a AI bot system, misconfigured a system that leaked 2.5 million medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a851fc537e3f23daaf43f4383501c8f35e546bd9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7f8c1a60-c9f9-11eb-8af5-ed6b4a3c0fb5"},"incident_date":"2020-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2353a043f76","org_name":"Brooklyn Defender Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/brooklyn-defender-services-identifies-and-addresses-data-security-incident-301190878.html"}],"summary":"Brooklyn Defender Services recently discovered that an unauthorized person gained access to some of Brooklyn Defender Services' employees' email accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d921e7a3aea945598fe0c0ce569d1f1925b240c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e91449c0-c9fa-11eb-8af5-ed6b4a3c0fb5"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ccc2b15952dd","org_name":"British Dental Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/dentists-bank-details-stolen-data/"}],"summary":"Hacker stole data from the British Dental Association and offered it on the darkweb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f83980cb1a0782d6a920a379333b805c7d6132dd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4c3d68a0-2501-11eb-af35-ed9bb3f10d5f"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0eeeb9d8f45c","org_name":"Brandywine Counseling and Community Services","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://amp.delawareonline.com/story/news/2020/04/10/clients-personal-information-stolen-brandywine-counseling/5132881002/"}],"summary":"lients' personal information was taken from servers used by Brandywine Counseling and Community Services, the organization announced Friday. It has begun sending letters to affected clients.   After discovering some servers were infected with ransomware on Feb. 10, BCCS took step","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca0bc221825fa61fb589f8be45df312e63acc896","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d598c560-0fe1-11ec-8c66-bd734728b5ba"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"59d0908cff22","org_name":"Boy Genius Report","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cio.economictimes.indiatimes.com/news/digital-security/bgr-india-hacked-company-says-old-data-dumped-online/74410972"}],"summary":"BGR India hacked, company says old data dumped online through an unsecured s3 bucket","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1bfeee3c3625c12d7f775336443eea275cb3526","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4a774680-04b3-11eb-8c43-8ded27596b66"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"56166a6ffb83","org_name":"Bigfooty.com","org_type":"other","ransomware":null,"records_affected":50000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2020/05/bigfooty-com-leaks-70-million-records-from-sports-fan-members/"}],"summary":"Bigfooty.com had a big oopsy and leaked 70m records through an open elasticsearch server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1024b6897890db5b85e4e6deec3c07a6ecebf86e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"636ac800-35c3-11ec-be76-613d00a742ca"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e704100a4b1","org_name":"Athens City Schools","org_type":"education","ransomware":null,"records_affected":120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.enewscourier.com/news/local_news/stealing-from-the-state-ex-superintendent-to-be-sentenced-in-march/article_1c062980-fae7-11eb-ac37-3bc0bd8e1f6b.html"}],"summary":"A former Limestone County Schools official and two others who pleaded guilty to federal crimes earlier this year will have to wait until next March for sentencing, records show.  Former LCS Superintendent Tom Sisk's case was originally set for sentencing July 29, but the decision","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee023c26f0a317b067747fc878a27e5a2a484a50","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92464dd0-1575-11eb-b788-65a639ed21e8"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dcff4d6da711","org_name":"Artech Information Systems","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/"}],"summary":"ransomware by unknown action, but blackmail data leaked as well.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e76908f19b5a7fbc78bf6ae479e3cba20606d825","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ed14820-1216-11eb-a3ae-53136ea5d4e6"},"incident_date":"2020-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PT","org_id":"cab93d486de7","org_name":"Aptoide","org_type":"technology_saas","ransomware":null,"records_affected":20000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/details-of-20-million-aptoide-app-store-users-leaked-on-hacking-forum/"}],"summary":"Aptoide a third party app store found 20m user records for sale on hacker forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b47a4df4d782eb3f1efef094c310a558260c577","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79d04680-1a19-11ec-9cee-0b92cf8d85df"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"f5ab43468169","org_name":"Apodis Pharma","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/apodis-pharma-leaked-over-1-7-tb-of-confidential-data-online/"}],"summary":"‘Apodis Pharma’ Leaked Over 1.7 TB of Confidential Data Online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3921bdef980ab8a735cea107d84ef8ab740d3181","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"827ac000-0fd7-11eb-afe7-87eff9df4bdb"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1d99358c59b","org_name":"Andrews Braces","org_type":"healthcare","ransomware":true,"records_affected":16600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/phi-of-16600-patients-potentially-compromised-in-ransomware-attack-on-andrews-braces/"}],"summary":"Andrews Braces a NV orthodontics practice experienced a ransomware attack that impacted 16k patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8114ff29021d57d1a57e3e5f9a219b06ed9c8ae1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a78379f0-2823-11eb-8365-4f57e2156a07"},"incident_date":"2020-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"291b81dc0432","org_name":"Air India","org_type":"transportation_logistics","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://simpleflying.com/air-india-presidential-boeing-777-leak/"}],"summary":"Air India crew members were fired for taking a picture of Air India One","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c9b8dfccf61a8c38ee9296e9b61f53788b8767a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0faac9b0-6c95-11eb-aa83-f564cd4131c9"},"incident_date":"2020-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ca3d747dbf2","org_name":"Activision","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.computerweekly.com/news/252489430/Activision-shoots-down-data-breach-claims"}],"summary":"Activision credential stuffed resulting in 500k user data at risk","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a2010e5b6c5731bc2cb7f8963a30f533ae3d957","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b450930-f6c9-11ea-b7b2-2361ceadc5c7"},"incident_date":"2020-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e40a429ca068","org_name":"AccQData","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"AccQData accidentally published private repo with customer medical data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c0e7fd9479ce15a8479790771c5621ad3e72ed8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29cbf740-1d0f-11eb-a925-afd7acbe9906"},"incident_date":"2020-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"490c669fbd5c","org_name":"Aban Offshore","org_type":"other","ransomware":true,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbronline.com/news/nefilim-hackers-publish-oil-firm"}],"summary":"A cyber criminal group known for its Nefilim (Netfilim) ransomware is continuing to target energy companies and has published an array of sensitive data belonging to India’s largest offshore drilling company Aban Offshore this week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2020-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12ad6411e04b1274ecbcd6ba0525876e653b5007","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5f9d6a90-1795-11eb-a388-210bf038e9e5"},"incident_date":"2020-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news9.com/story/5e345f443196993fcfd05fc0/2-men-wanted-for-credit-card-skimming-activity-at-okc-gas-pumps"}],"summary":"Two men wanted for placing various skimmers on 711 gas pumps","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-31","discovered_date":"2019-12-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd58ec601d5dcc8e612266b2bc83d2f053925e97","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"844bce7ce05e","org_name":"Legalinc Corporate Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":2670,"reviewed":false,"root_cause":"Legalinc's document storage system had a security vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185511"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice.pdf"}],"summary":"Legalinc reported that personal information associated with Stripe Atlas users may have been accessed through a vulnerability in its document storage system.","supporting_quote":"We discovered on December 11, 2019, that our service provider Legalinc Corporate Services Inc. (“Legalinc”) had a security vulnerability in its document storage system.","technology_involved":["document storage system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Legalinc Corporate Services Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2ab402fe3bbc","name":"Legalinc Corporate Services Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d6299a7c800756f1b74f32153d701b027eacc76","impact_type":"data_theft","incident_date":"2019-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Attachment%20%28Notice%20Only%29.pdf"},"notes":null,"org_country":"US","org_id":"6f55df3b49ba","org_name":"Landry's, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185516"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Attachment%20%28Notice%20Only%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Landry%E2%80%99s%2C%20Inc.-2019-12-31"}],"summary":"Landry's reported unauthorized access to systems supporting payment processing and notified affected people about payment-card information.","supporting_quote":null,"technology_involved":["payment processing systems","point-of-sale terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-31","discovered_date":"2019-12-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"04bbc10af473148d956c4358cb6744d71dae68cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10527.pdf"},"notes":null,"org_country":"US","org_id":"4cc99143e804","org_name":"Evolucion Innovations Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":4899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10527.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10527.pdf"}],"summary":"Evolucion Innovations reported unauthorized code on evo.com that could have captured customers’ checkout information.","supporting_quote":null,"technology_involved":["evo.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-31","discovered_date":"2019-12-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d5e85a7f88d875ded59d44dce4dca85bef8803","impact_type":"unknown","incident_date":"2019-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Attachment%20%28Notice%20Only%29.pdf"},"notes":null,"org_country":"US","org_id":"4cc99143e804","org_name":"Evolucion Innovations Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185507"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Attachment%20%28Notice%20Only%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Evolucion%20Innovations%20Inc.-2019-12-31"}],"summary":"Unauthorized code on evo.com may have captured customer information entered during checkout.","supporting_quote":null,"technology_involved":["evo.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-30","discovered_date":"2019-10-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c961988c2be8402f62a63589293a427a84d6ed2","impact_type":"unknown","incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"322eadaee46b","org_name":"Unum Group","org_type":"unknown","ransomware":null,"records_affected":8887,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Unum%20Group-2019-12-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-12-30","discovered_date":"2019-12-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fbb9bc6f0d86329e385264a07eeca813868c96f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Imperfect%20Foods-%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"801b14573d0a","org_name":"Imperfect Foods","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185495"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Imperfect%20Foods-%20Consumer%20Notice.pdf"}],"summary":"Imperfect Foods discovered a software error that may have caused some customers’ usernames and passwords to be stored in website error logs, with no indication of unauthorized access or use.","supporting_quote":null,"technology_involved":["website login error logs"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f80e3f7a2e561103b840e3eadfb4f92442ea5703","impact_type":"data_theft","imported_from":null,"incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Letter%20CA.pdf"},"notes":null,"org_country":"US","org_id":"161effc352da","org_name":"Active Network, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185468"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Letter%20CA.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ACTIVE%20Network%2C%20LLC-2019-12-30"}],"summary":"Unauthorized third parties may have accessed or acquired personal information from Blue Bear webstore users.","supporting_quote":null,"technology_involved":["Blue Bear platform","Blue Bear webstore"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-27","discovered_date":"2019-09-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1f660a6c0c25669f13008b5019d3cfbe356439","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SharesPost%20Multistate%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"318e88a5c6e0","org_name":"SharesPost, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SharesPost%20Multistate%20Proof.pdf"}],"summary":"An unauthorized party accessed a SharesPost employee email account, which contained a shareholder application with personal information and, in some cases, a bank account number.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-26","discovered_date":"2019-11-20","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e4378c7155575caeeb4f5a9d7391d7506242c6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-11-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACCO%20-%20%28Notice%20Only%29.pdf"},"notes":null,"org_country":"US","org_id":"5aa93fa33343","org_name":"ACCO Engineered Systems, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACCO%20-%20%28Notice%20Only%29.pdf"}],"summary":"ACCO reported that an employee’s laptop and mobile phone were stolen, and that personal and direct deposit bank account information may have been present on the laptop; access to the data was not confirmed.","supporting_quote":"On November 20, 2019, ACCO discovered that an employee’s company laptop and mobile phone had been stolen.","technology_involved":["company laptop","mobile phone"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other"],"disclosed_date":"2019-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2741b9c8acf0795b83ad26a2c8664101b6dd00e0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-03-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c937bf02829c","org_name":"Factual","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Factual","type":"hibp","url":"https://haveibeenpwned.com/Breach/Factual"}],"summary":"A file containing business information and email addresses attributed to Factual was exchanged, but Factual said the information was publicly available.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-24","discovered_date":"2018-09-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864c3dfc824b5694c83de96d6d3364556ba3377b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Avid%20Technology-%20Notice%20of%20Data%20Event-%20%28Notice%20Only%29.pdf"},"notes":null,"org_country":"US","org_id":"93cff432d97c","org_name":"Avid Technology, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185408"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Avid%20Technology-%20Notice%20of%20Data%20Event-%20%28Notice%20Only%29.pdf"}],"summary":"Avid identified unauthorized access to employee email accounts, where personal information may have been accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-23","discovered_date":"2019-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7afd6d567c284b779b98967ae332ca563e08635d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice%20Z507_v02.PDF"},"notes":null,"org_country":"US","org_id":"ec7f8a5c4eb3","org_name":"HelloTech, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"HelloTech independent contractor data was inadvertently publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185382"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice%20Z507_v02.PDF"}],"summary":"HelloTech contractor data, including names, addresses, and driver license information, was inadvertently publicly accessible.","supporting_quote":"On November 15, 2019, we were notified by a neutral party that they had accessed some HelloTech independent contractor data that inadvertently was publicly accessible.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-20","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e22c249dd26a47261eeccc5106cda3c6d1cb6d65","impact_type":"unknown","incident_date":"2019-11-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb0fc0efc6d2","org_name":"Pension Planners Northwest","org_type":"unknown","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Planners%20Northwest-2019-12-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ad75d147890bd41caf1f36ae41ad63509b999f0","impact_type":"data_theft","imported_from":null,"incident_date":"2019-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"458cb370aa4f","org_name":"Zynga","org_type":"other","ransomware":null,"records_affected":172869660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zynga","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zynga"}],"summary":"A September 2019 data breach at Zynga exposed email addresses, usernames, and salted SHA-1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-19","discovered_date":"2019-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8e273d102ae11d8fadb042885b6e116067a3879","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wawa%20Data%20Security%20Incident%20Notice%2012_19_2019.pdf"},"notes":null,"org_country":"US","org_id":"72b9e85d1854","org_name":"Wawa, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185312"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wawa%20Data%20Security%20Incident%20Notice%2012_19_2019.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wawa%2C%20Inc.-2019-12-19"}],"summary":"Malware on Wawa's in-store payment systems affected payment card information used at in-store terminals and fuel dispensers.","supporting_quote":null,"technology_involved":["in-store payment processing systems","in-store payment terminals","fuel dispensers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-12-19","discovered_date":"2019-08-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c83e0bb5877ca9227e74303cb2cf28ad574afbc","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10525.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"74037b06d7bd","org_name":"Vimly Benefits Solutions","org_type":"professional_services","ransomware":null,"records_affected":91807,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10525.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10525.pdf"}],"summary":"Vimly reported possible unauthorized access to employee email accounts, but a later investigation concluded that no Vimly information was acquired.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-19","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"87796efee95e825ac3e06e80f260695758716393","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f17516e300a3","org_name":"Vimly Benefit Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":46299,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vimly%20Benefit%20Solutions%2C%20Inc.-2019-12-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-12-19","discovered_date":"2019-11-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd9af58b485dea9fc063ce3fca688048e97affa9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20of%20ToonDoo%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"3a8698767114","org_name":"Jambav, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185317"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20of%20ToonDoo%20Data%20Breach.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10524.pdf"}],"summary":"Jambav reported a breach involving ToonDoo users’ email addresses, usernames, passwords, and gender, and became aware of it on November 11, 2019.","supporting_quote":null,"technology_involved":["ToonDoo website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e5d377d7579c27a3363cf79a9f33c7b46722231","impact_type":"unknown","incident_date":"2019-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Islands%20Press%20Release%20and%20Sub%20Notice%2C%20Champagne%20press%20release%2C%20sub%20notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"78f39771e927","org_name":"Island Restaurants, LP and Champagne French Bakery Cafe","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185316"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-12-13","discovered_date":"2019-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24a362dbab9d1a789f073ec0d8f0dffa868a2983","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WHA_Notices_Sample.pdf"},"notes":null,"org_country":"US","org_id":"e4833f101d3f","org_name":"Western Health Advantage","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WHA_Notices_Sample.pdf"}],"summary":"A contracted vendor's computer system error resulted in Western Health Advantage files being downloaded to another company's server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-12-13","discovered_date":"2019-11-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"027afc07399d951be3b796691fe3130f2a15611a","impact_type":"disruption_or_ransomware","incident_date":"2019-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%23601426225v1_USA_%20-%20Notification%20Letter%20CA%20-%20TMT.pdf"},"notes":"attack_techniques without supporting words dropped: T1489","org_country":"US","org_id":"5664333a7bfb","org_name":"The Master's Touch, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%23601426225v1_USA_%20-%20Notification%20Letter%20CA%20-%20TMT.pdf"}],"summary":"A malware attack on The Master's Touch's eNoticesOnline server caused a system crash, and an investigation could not determine whether files were viewed.","supporting_quote":null,"technology_involved":["eNoticesOnline","server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-12-12","discovered_date":"2019-10-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"383fa237f74c9a42c436f77899148a7f4aefa8d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notice%201.pdf"},"notes":null,"org_country":"US","org_id":"ddb1b5242b86","org_name":"Blue Cross Blue Shield Association","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor programming change inadvertently altered app permissions, allowing some adult family members to access summary claims information without affirmative permission.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-185087"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notice%201.pdf"}],"summary":"A vendor programming change altered fepblue mobile app permissions, making some members’ summary claims information accessible to adult family members without affirmative permission.","supporting_quote":"We recently learned that a programming change made by th e vendor on September 28, 2019 to update the fepblueTM mobile app inadvertently altered some permission functionalities in error.","technology_involved":["fepblue mobile app"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54303530e9c59e0240b7e81440fff24952d41ed4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44f031a0-f45d-11eb-821b-d1ebb09f37f0"},"incident_date":"2019-12-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb87fd624fee","org_name":"Walla Walla University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govtech.com/public-safety/walla-walla-university-recovers-from-december-cyberattack.html"}],"summary":"Walla Walla University hit by ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-12-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7154c8d09d5b3d5868d80af2138cb6cdabc403bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8cc49c40-0a66-11ec-9d35-0d797e3f6b54"},"incident_date":"2019-12-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"9cdbfd706a3b","org_name":"Love, Bonito","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/love-bonito-apologises-to-customers-after-personal-data-breach/"}],"summary":"Malicious code was found on Love, Bonito's e-commerce website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2019-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d07c85d8db62284c84273d968dd883dc51ec8fc","impact_type":"unknown","incident_date":"2019-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Sample.pdf"},"notes":null,"org_country":"US","org_id":"8af8403b732e","org_name":"CJGO Fulfillment, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Sample.pdf"}],"summary":"A malicious script was added to CoffeeAM’s checkout page and may have compromised customer information entered there.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c6222f51ab08526a60619b49f752e711ba76dcd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18417270-212d-11ec-82c4-4d3486f21395"},"incident_date":"2019-12-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c35f1bdae30","org_name":"Nexus Mods","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/nexus-mods-game-modding-site-discloses-data-breach/"}],"summary":"Nexus Mods Game Modding Site Discloses Data Breach from exploit in their legacy code","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10813db792dca94ba2d9f6cb283634e0f75ede98","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Exhibit%201%28Notice%20Only%29.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"e0f8ba60806f","org_name":"Arthur J. Gallagher & Co.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A lawyer at an outside law firm copied data onto an unencrypted hard drive that was misplaced while traveling.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Exhibit%201%28Notice%20Only%29.pdf"}],"summary":"Data provided to an outside law firm was copied to an unencrypted hard drive that was misplaced while traveling; Gallagher reported no evidence that the information was accessed.","supporting_quote":"JWbV]cb =OZZOUVS`ka OeO`S\\Saa ]` ^S`[WaaW]\\% O\\ W\\RWdWROZ Ob O\\ ]cbaWRS ZOe l`[ OaaWabW\\U eWbV legal proceedings transferred data provided on an encrypted drive to an unencrypted hard drive and subsequently [Wa^ZOQSR bVS R`WdS eVWZS b`OdSZW\\U'","technology_involved":["unencrypted hard drive"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1b3c496977bf37bdaa4490750215f2740c0285f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d3f376b0-72d9-11eb-a46e-831b23dc7360"},"incident_date":"2019-12-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"technology_saas","ransomware":null,"records_affected":250000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/microsoft-discloses-security-breach-of-customer-support-database/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2020/01/22/microsoft-security-shocker-as-250-million-customer-records-exposed-online/#6d9d08894d1b"}],"summary":"Microsoft disclosed today a security breach that took place last month in December 2019.  In a blog post today, the OS maker said that an internal customer support database that was storing anonymized user analytics was accidentally exposed online without proper protections betwe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d230d06726b44fd3f4b6cf36456387b133ff3b9","impact_type":"unknown","incident_date":"2019-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40af385e1f2c","org_name":"Magellan Rx Management","org_type":"unknown","ransomware":null,"records_affected":739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Magellan%20Rx%20Management-2019-12-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aab4c13bcc6116641c5458f02442b0fa7297751e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0f77c10-07e0-11eb-9be5-67f56bbd8cb4"},"incident_date":"2019-12-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e8bb23d01c8","org_name":"Wyze Labs","org_type":"manufacturing","ransomware":null,"records_affected":2400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.geekwire.com/2020/smart-camera-startup-wyze-sued-following-data-breach-exposed-customer-information/"}],"summary":"Wyze a smart device vendor misconfigured their ES instance and leaked details on 2.4 million customers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-12-04","discovered_date":"2019-11-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d92dcfab54a89a88f27b339667a06a9c314295f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CVWD%20C2G%20Incident%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"32086a8e929e","org_name":"Cucamonga Valley Water District","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CVWD%20C2G%20Incident%20Notification%20Letter.pdf"}],"summary":"A script was found in the Click2Gov web payment portal, potentially exposing customer names, billing addresses, and credit card information entered during the affected period.","supporting_quote":null,"technology_involved":["Click2Gov","web payment portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6b8dde3714bc66a5b7531bcd01e761ef76a69ad","impact_type":"data_theft","imported_from":null,"incident_date":"2019-09-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"PL","org_id":"d9e58b8ad60f","org_name":"AgusiQ-Torrents.pl","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AgusiQ-Torrents.pl","type":"hibp","url":"https://haveibeenpwned.com/Breach/AgusiQTorrents"}],"summary":"A breach of AgusiQ-Torrents.pl exposed 90,478 member records containing email and IP addresses, usernames, and MD5-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ce7b4be7f9c3b99cdcb72224ea72a3c644fec25","impact_type":"unknown","incident_date":"2019-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Mailing%20-%20Data%20Breach.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"012717116671","org_name":"Farmers Insurance","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184787"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5b44f5cc9eb4f52e26b1fbfa06a19fe1c06e716","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/OntheBorder.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb08bffe2d45","org_name":"On The Border","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/OntheBorder.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","secrets"],"disclosed_date":"2019-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6002357cd7124ad2f37077953cdd994b6209528f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc4a4b80-07dd-11eb-9be5-67f56bbd8cb4"},"incident_date":"2019-12-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7536a6764c00","org_name":"Medical Diagnostic Laboratories","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/maze-ransomware-not-getting-paid-leaks-data-left-and-right/"}],"summary":"Medical Diagnostic Laboratories got hit with Maze ransomware and had it's data leaked by the threat actor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cfc484a3d68a20a490b7b37ed6800ff8d4532be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8482a830-1194-11ec-a044-77090c8577a4"},"incident_date":"2019-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54f4a0bf20a1","org_name":"Witchita State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thesunflower.com/49658/news/wsu-student-faculty-staff-information-potentially-compromised-in-december-data-breach/"}],"summary":"Witchita University experienced unauthorized access to personal information of students, staff and faculty","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5a5a7ac4cf123469c585c4f9f79db0b4de7f99b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b8e9150-2817-11eb-8365-4f57e2156a07"},"incident_date":"2019-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b58b249598dd","org_name":"Prison Rehabilitative Industries and Diversified Enterprises","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/ransomware-hits-florida-pride-on-saturday-systems-still-down/"}],"summary":"Prison Rehabilitative Industries and Diversified Enterprises Inc (PRIDE) was hit by ransomware impacting payroll, email and vendor lists.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24de4fe0d811d35df99ec15645dd6124f50af957","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43e4b860-0fcc-11eb-afe7-87eff9df4bdb"},"incident_date":"2019-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e5296e7ed97","org_name":"Oklahoma Department of Securities","org_type":"government","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.governing.com/security/Oklahoma-Accused-of-Negligence-in-Massive-Data-Breach.html"}],"summary":"Oklahoma Department of Securities misconfigured a firewall exposing more than 300k ppl's sensitive information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f45d2df3b0eb2d3c324ebcc7f3b3711f23f132c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18bfa490-07e5-11eb-9be5-67f56bbd8cb4"},"incident_date":"2019-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d284fba403b","org_name":"Hackensack Meridian Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nj.com/business/2019/12/hackensack-meridian-hospital-chain-confirms-ransomware-attack-last-week.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hackensack-meridian-we-paid-ransom-to-hackers-to-stop-hospital-cyber-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.app.com/story/news/health/2019/12/13/hackensack-meridian-ransom-hackers-cyber-attack-hospitals/2638701001/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.app.com/story/money/business/consumer/2019/12/04/computers-hackensack-meridian-health/2614012001/"}],"summary":"Hackensack Meridian health network confirms ransomware attack last week","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57c0a808f91adb08460440d4345f34ac3c1f46f8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4bdf80d0-2f2b-11eb-be94-ff2f41197b3c"},"incident_date":"2019-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6273350a92f","org_name":"Center for Health Care Services","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/criminals-pull-hard-before-xmas-attack-us-health-industry/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-san-antonio-mental-health-and-substance-abuse-services-provider-hit-by-ransomware-attack/"}],"summary":"Ransomware attacks yet another hospital, this time the Center for Health Care Services (CHSC) ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"BE","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9abcbf54fd5d43404acb16e60eeec5532a8fa045","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4771d6b0-7238-11eb-b847-53c7fcddcc7a"},"incident_date":"2019-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"0ed53dfbf101","org_name":"Allianz Partners","org_type":"financial","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.brusselstimes.com/news/business/86376/about-160000-belgian-clients-of-allianz-partners-affected-by-strongbox-theft-in-the-netherlands/"}],"summary":"An Allianz Partners strongbox containing back-up copies of data related to disaster claims was stolen in the Netherlands in August, the insurance and assistance company disclosed on Friday.  According to an audit and analysis of the documents concerned, the strongbox contained da","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d05d1f043d636738a1ec76243358b2a96b48704a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6aa1ef50-7236-11eb-b847-53c7fcddcc7a"},"incident_date":"2019-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"827d581ea277","org_name":"Airtel","org_type":"technology_saas","ransomware":null,"records_affected":300000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/airtel-gets-rid-of-bug-granting-hackers-access-to-personal-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theweek.in/news/sci-tech/2019/12/07/airtel-data-breach-exposes-personal-details-of-300-million-users.html"}],"summary":"Worsening its woes, telecom major Bharti Airtel was hit with a major data breach after a security flaw in its mobile app exposed the details of more than 300 million users. Confirming the breach, Airtel said that it has fixed the security flaw associated with its app's API (appli","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","internal","personal"],"disclosed_date":"2019-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26fd24253b6b28165037b6b55b61ab10680a84ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a9ccdc50-72e3-11eb-a674-05cfd55ad89e"},"incident_date":"2019-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"28ca2f5f0738","org_name":"Advantage Capital Funding","org_type":"financial","ransomware":null,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/financial-apps-leak-425gb-in-company-data-through-open-database/"}],"summary":"Advantage Capital Funding left a s3 bucket open with a bunch of sensitive information for financial companies","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccaa001e235fda29749e6b35df815abdf9a5810a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63053270-25eb-11ec-8021-93be7268887c"},"incident_date":"2019-11-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"9949705c7706","org_name":"Gladsaxe Municipality","org_type":"government","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thelocal.dk/20181211/computer-with-data-on-20000-people-stolen-in-denmark/"}],"summary":"Confidential data on 20,000 residents in Gladsaxe, a municipality in central Zealand, were saved locally on a computer stolen that was recently stolen from the town’s city hall","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c88d36357793b3d3a35f7102d518f0a7bb9d2e34","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice_2%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"e4dfc2c27036","org_name":"Choice Hotels International, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Safari could place information typed on the reservation page into the page URL after a browser crash, which the website’s tracking technology then sent to third parties.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice_2%20%28notification%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Choice%20Hotels%20International%2C%20Inc.-2019-11-29"}],"summary":"Choice Hotels reported that information entered on its reservation page could be exposed to third parties when Safari crashed and its website tracking technology transmitted the page URL.","supporting_quote":"The issue involved information entered by a visitor to Choice’s website being inadvertently accessible to third parties, with whom Choice has a business relationship, when the visitor’s web browser crashed while on the site.","technology_involved":["Safari","Choice website"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2f61bcfbd4ff06f3a93b8f959b3b946beeccb019","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10522.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3b408089bb0e","org_name":"Washington State Employees Credit Union","org_type":"financial","ransomware":null,"records_affected":2355,"reviewed":false,"root_cause":"An error caused the WSECU account number to appear on the publicly recorded deed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10522.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10522.pdf"}],"summary":"An error caused WSECU account numbers to appear on publicly recorded deeds for home equity loans or lines of credit.","supporting_quote":"We recently concluded an investigation into an error that caused your WSECU account number to appear on the deed for your home equity loan or home equity line of credit.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ced417d09b992e03eccf43a0f199db6b777dde19","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_6%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"811818dfdaa9","org_name":"The UPS Store, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_6%20%28notification%29.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10521.pdf"}],"summary":"A phishing incident potentially exposed personal information in documents contained in local store email accounts.","supporting_quote":"We recently determined that between October 11 and 22, 2019, a small percentage of local store locations were the victim of a phishing incident in which an unauthorized person potentially had access to a limited number of local store email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5131e045c930361ab59f2bca5141e66c35b52c3f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/IvyRehabPhysicalTherapy.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d69c17b8e495","org_name":"Ivy Rehab Network","org_type":"unknown","ransomware":null,"records_affected":2494,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/IvyRehabPhysicalTherapy.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","credentials"],"disclosed_date":"2019-11-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8afe1e351f510803333288eea7a824c0320b38db","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KPRS%20--%20Consumer%20notification%20letter%20%28California%20version%29_PRINT%20PROOF.pdf"},"notes":null,"org_country":"US","org_id":"da437b17d841","org_name":"KPRS Construction Services, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184651"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KPRS%20--%20Consumer%20notification%20letter%20%28California%20version%29_PRINT%20PROOF.pdf"}],"summary":"KPRS reported that an unknown person may have accessed employees’ email accounts, potentially exposing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bcf226f3a0ccbaf7a8c1c5ce680da1d251414b3c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/ChurchsChicken.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e67cd2e2e3c7","org_name":"Cajun Operating Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/ChurchsChicken.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2019-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb0310e4b61269ea640ed3be1db75a040bc0dee2","impact_type":"disruption_or_ransomware","incident_date":"2019-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"6c2a63a6fe3a","org_name":"Cadence Aerospace","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20Letter_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10520.pdf"}],"summary":"Cadence Aerospace reported that ransomware was launched on its systems and that human resources information and business documents on company servers may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2019-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f67a24ecf5528b382d6c340bb67cd025a791e89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0c06e1d0-4166-11ec-b81c-33d442e55df8"},"incident_date":"2019-11-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23f427ff56bd","org_name":"Telecom Fiber","org_type":"technology_saas","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://lawstreetmedia.com/tech/telecom-fiber-sues-for-misappropriation-of-trade-secrets/"}],"summary":"Telecom Fiber Sues For Misappropriation of Trade Secrets by stealing documents from the dropbox before quitting a few months later","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c469c8ba69baa74c89820d1ed21999171f1795b2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-10-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8b9bcde568ba","org_name":"Unidentified PDL Customer","org_type":"unknown","ransomware":null,"records_affected":622161052,"reviewed":false,"root_cause":"A customer failed to properly secure the Elasticsearch database, leaving it exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Data Enrichment Exposure From PDL Customer","type":"hibp","url":"https://haveibeenpwned.com/Breach/PDL"}],"summary":"An unidentified PDL customer left an Elasticsearch server holding personal data exposed.","supporting_quote":"The server was not owned by PDL and it's believed a customer failed to properly secure the database.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f5caed43d401a0e021221453f1a71ed195067e0","impact_type":"unknown","incident_date":"2019-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20AG%20Notification%20%28notification%29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4a9a1cce26c","org_name":"LifeMark Securities, Corp.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184526"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2019-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ecb9e379620e6028b6aaa447c754b01db2d2028","impact_type":"data_theft","imported_from":null,"incident_date":"2019-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"205bf28c4732","org_name":"GateHub","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GateHub","type":"hibp","url":"https://haveibeenpwned.com/Breach/GateHub"}],"summary":"Data from a GateHub breach included email addresses, mnemonic phrases, encrypted keys, and hashed passwords.","supporting_quote":null,"technology_involved":["cryptocurrency wallet service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"d52af7ad89c0dfd8f73ab3a8910157979e5e70f0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CollinsAerospace.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"386755120384","org_name":"Collins Aerospace","org_type":"manufacturing","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":"A processing error caused a copy of a 2018 W-2 to be accidentally sent by email to another individual.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CollinsAerospace.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CollinsAerospace.pdf"}],"summary":"A processing error caused Collins Aerospace to email a copy of a person's 2018 W-2 to another individual.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7b67086907e98254f3af6a140047f9ef6d3e5c96","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10519.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"888111c4f516","org_name":"ARINC Incorporated","org_type":"manufacturing","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10519.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10519.pdf"}],"summary":"ARINC Incorporated reported that a processing error led to a copy of a customer’s 2018 W-2 being sent by email to another individual.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-20","discovered_date":"2019-10-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88a8a569754cba6a42a34013a987d2e2637c2b61","impact_type":"unknown","incident_date":"2019-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"888111c4f516","org_name":"ARINC, Incorporated","org_type":"unknown","ransomware":null,"records_affected":1496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ARINC%2C%20Incorporated-2019-11-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-19","discovered_date":"2019-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb4767bc6f756f42ce64c9998827eb3b2e6d22d1","impact_type":"data_theft","incident_date":"2019-05-14","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wescom%20Central%20Credit%20Union%20-%20CA%20Notice%20of%20Data%20Event%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"403594552e5b","org_name":"Wescom Central Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184514"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wescom%20Central%20Credit%20Union%20-%20CA%20Notice%20of%20Data%20Event%20%28notification%29.pdf"}],"summary":"An unauthorized party downloaded backup files containing historical Wescom member information from its eBudget provider Geezeo.","supporting_quote":"On May 14, 2019, an unauthorized party downloaded database backup files belonging to Geezeo, the provider for Wescom’s eBudget services.","technology_involved":["eBudget","database backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Geezeo"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"877a61d02493","name":"Geezeo"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-11-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"068d40739e027b8c6ffea67c3b5a507b969f84aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f5614260-ee48-11eb-a0c0-efc7cda0e23f"},"incident_date":"2019-11-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e2936579cb4","org_name":"Sweaty Betty","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2019/12/05/uk-activewear-retailer-sweaty-betty-falls-prey-to-magecart-attack/"}],"summary":"Sweaty betty experienced a breach of credit card data via implanted javascript","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57fbfde054ca42010c60d10973715d09e24559dd","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0f98e97e90da","org_name":"GPS Underground","org_type":"other","ransomware":null,"records_affected":669584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GPS Underground","type":"hibp","url":"https://haveibeenpwned.com/Breach/GPSUnderground"}],"summary":"GPS Underground records, including usernames, email and IP addresses, dates of birth, and salted MD5 password hashes, were included in a breach of vBulletin websites.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a34af53dbaf5f78d13bdf83ea38c2c6f8fe3d553","impact_type":"data_theft","imported_from":null,"incident_date":"2019-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"01bc3ec3ad24","org_name":"EpicBot","org_type":"technology_saas","ransomware":null,"records_affected":816662,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: EpicBot","type":"hibp","url":"https://haveibeenpwned.com/Breach/EpicBot"}],"summary":"A breach of EpicBot exposed subscriber usernames, email and IP addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-19","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26dbec106c7f2ec3bbeabca4d46f935599b8d0b4","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-18","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Atria%20Ad%20CM%20CA%20r4prf.pdf"},"notes":null,"org_country":"US","org_id":"f31f952e54f1","org_name":"Atria Senior Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184521"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Atria%20Ad%20CM%20CA%20r4prf.pdf"}],"summary":"Atria Senior Living reported that an unauthorized person accessed some employees’ email accounts in a phishing incident.","supporting_quote":"Our ongoing investigation into an email phishing incident recently determined that an unauthorized person had gained access to some of our employees’ email accounts.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-15","discovered_date":"2019-10-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"e8cf0979e02482b6bbd54af66e636f7ef7bebbeb","impact_type":"data_theft","incident_date":"2019-10-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/All%20State%20MCOM%20Consumer%20Notice%20Proof%20111419.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"053330a31248","org_name":"Macy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":135152,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#macys.com-2019-11-15"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184363"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/All%20State%20MCOM%20Consumer%20Notice%20Proof%20111419.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10517.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/All%20State%20MCOM%20Consumer%20Notice%20Proof%20111419.pdf"}],"summary":"An unauthorized third party added code to two Macy's website pages that could capture information submitted by customers.","supporting_quote":null,"technology_involved":["macys.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b7c7ca312a61613ab8bc1817912fc0e4fd0b33b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10518.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dee3e85e5ff0","org_name":"City of Lacey","org_type":"government","ransomware":null,"records_affected":6209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10518.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10518.pdf"}],"summary":"City of Lacey reported that malicious code was installed on the portal hosting its utility bill payment system, potentially compromising visitors’ payment card data.","supporting_quote":null,"technology_involved":["utility bill payment system","online payment system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a8483143016ed9cc28812984a122641e3900dba","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20-%20CPA%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"dba8e5236dbc","org_name":"Capital Planning Advisors, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20-%20CPA%20%28notification%29.pdf"}],"summary":"An employee email account may have been accessed without authorization, and personal information was present in the account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b59bc7712c199c26841e985319b34b10d56c721d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/259198_01_IDExperts_Green%20Roads%20StaticProof_General_1.pdf"},"notes":null,"org_country":"US","org_id":"9606ee77f8f5","org_name":"Green Roads of Florida, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A compromised administrator account in the outsourced hosting provider's web server was identified as the root cause.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184337"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/259198_01_IDExperts_Green%20Roads%20StaticProof_General_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10416.pdf"}],"summary":"Green Roads of Florida reported that customer names and credit card information from website orders were potentially compromised after an administrator account on its outsourced hosting provider's web server was compromised.","supporting_quote":"It was determined that the root cause of the incident was a compromised Administrator account in the web server of our outsourced hosting provider.","technology_involved":["web server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98a49db76e30706878ff0fb0eee9b500d607fb6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f122b840-1c4f-11ea-a7e6-812a11e02697"},"incident_date":"2019-11-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0ea84d4abb6","org_name":"Claremont NH Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vnews.com/Claremont-police-seek-suspects-in-ATM-skimming-30411624"}],"summary":"a “skimming” device to an ATM over Veterans Day weekend.  The illegal device, which captures private account information when customers use their bank cards at an ATM, was affixed to one of the ATMs at the Claremont Savings Bank on Broad Street","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-13","discovered_date":"2019-06-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abeda9c5f1104668122feaa396d9cb5ac9d06cf5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-02","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Solara%20CA%20Exhibit%201%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"bc57a1f4153b","org_name":"Solara Medical Supplies, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email campaign resulted in an unknown actor gaining access to employee Office 365 accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184310"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Solara%20CA%20Exhibit%201%20%28notification%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Solara%20Medical%20Supplies%2C%20LLC-2019-11-13"}],"summary":"Solara Medical Supplies determined that a phishing email campaign led to access to employee Office 365 accounts, where personal information may have been accessed or acquired.","supporting_quote":"On June 28, 2019, Solara determined that an unknown actor gained access to a limited number of employee Office 365 accounts, from April 2, 2019 to June 20, 2019, as a result of a phishing email campaign.","technology_involved":["Office 365"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-13","discovered_date":"2019-08-20","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79aec39f523e88287e834cbd184b41732af4ebac","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GFS%2C%20Inc%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA%20%28notification%29.pdf"},"notes":null,"org_country":"US","org_id":"4295fd1a36dd","org_name":"GFS, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184304"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GFS%2C%20Inc%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA%20%28notification%29.pdf"}],"summary":"GFS, Inc. reported unauthorized access to an office computer, with personal information potentially impacted but no evidence that it was viewed or taken.","supporting_quote":null,"technology_involved":["office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8f5b0bf1663c172b5769c4862b4928431725730","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ab61e530-7228-11eb-a74a-79ed152e0098"},"incident_date":"2019-11-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"239a817d9bed","org_name":"Conor Solutions","org_type":"professional_services","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/south-african-it-firm-conor-behind-the-leak-of-1-million-web-browsing-records/"}],"summary":"Over 890GB of browsing log data of all online activities of over 1 million users has been revealed due to an unencrypted database hailing from a web filter app built by Conor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a460a20a83f55af94ebabe25162d5915b4fb68cb","impact_type":"data_theft","imported_from":null,"incident_date":"2019-08-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"82902e3babe0","org_name":"ToonDoo","org_type":"technology_saas","ransomware":null,"records_affected":6002694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ToonDoo","type":"hibp","url":"https://haveibeenpwned.com/Breach/ToonDoo"}],"summary":"ToonDoo suffered a data breach in August 2019, and subscriber information including salted password hashes was subsequently redistributed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbf49055db868a4158a4e7547fa1a45c1ff51906","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20cfe670-0c8d-11eb-ac0d-91a70ee1d655"},"incident_date":"2019-11-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e843e80b9b4","org_name":"Central Kansas Orthopedic Group","org_type":"healthcare","ransomware":true,"records_affected":17214,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/ransomware-attack-at-kansas-medical-group-may-have-exposed-17k-patient-files.html"}],"summary":"Central Kansas Orthopedic was hit by ransomware and had to restore from backups","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-08","discovered_date":"2019-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce84351f062426a13d2f209e78d5511515b142d3","impact_type":"data_theft","incident_date":"2019-08-12","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_4.pdf"},"notes":null,"org_country":"US","org_id":"7969815ac28d","org_name":"River Valley Farms LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee of the payroll administrative services company sent employee reports to a personal email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184207"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_4.pdf"}],"summary":"A former employee of the company administering River Valley Farms LLC’s payroll sent employee reports to a personal email account.","supporting_quote":"The emails were discovered as part of an investigation into suspected theft committed by this former employee, which was first identified by the administrative services company on September 23, 2019.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-08","discovered_date":"2019-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7e8e3e4fb6f46763efb313d5b85699bee8b620d","impact_type":"data_theft","incident_date":"2019-08-12","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_2.pdf"},"notes":null,"org_country":"US","org_id":"1200dae2762d","org_name":"Reiter Brothers, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee of the administrative services company sent employee reports to a personal email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184205"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_2.pdf"}],"summary":"A former employee of the administrative services company administering Reiter Brothers' payroll sent employee reports to a personal email account.","supporting_quote":"The emails were discovered as part of an investigation into suspected theft committed by this former employee, which was first identified by the administrative services company on September 23, 2019.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-08","discovered_date":"2019-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e8507f03468aac601b4621ada2905c7c0e95c64","impact_type":"data_theft","incident_date":"2019-08-12","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A.pdf"},"notes":null,"org_country":"US","org_id":"077fa2e9931b","org_name":"Reiter Berry Farms, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184202"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A.pdf"}],"summary":"A former employee of Reiter Berry Farms’ payroll administrator sent reports containing employee information to a personal email account.","supporting_quote":"The emails were discovered as part of an investigation into suspected theft committed by this former employee, which was first identified by the administrative services company on September 23, 2019.","technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c60956cdb9746893ae51ee0c853c2a277d12ebda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80c3cb40-d8ef-11ea-b677-2b9ec926ea06"},"incident_date":"2019-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d902d50c3022","org_name":"Rand Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ewnews.com/undetermined-number-of-patient-medical-records-lost-in-gb"}],"summary":"There was a significant number of patient medical records lost at the Rand Memorial Hospital, during the passage of Hurricane Dorian, Public Hospitals Authority (PHA) Managing Director Catherine Weech said yesterday.  “We’ve lost a number of the records as a result of the floodin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-08","discovered_date":"2019-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e58ea2d5864842cf24d8bb5a1d37f6054b04eaf","impact_type":"data_theft","incident_date":"2019-08-12","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_3.pdf"},"notes":null,"org_country":"US","org_id":"07b9e9ca3074","org_name":"Jal Berry Farms LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee of the payroll administrative services company sent reports containing employee information to a personal email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184206"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reiter%20Affiliated%20Companies%20-%20Notice%20of%20Data%20Event%20-%20Ex.%20A_3.pdf"}],"summary":"A former employee of Jal Berry Farms LLC’s payroll administrative services company sent employee reports to a personal email account.","supporting_quote":"The emails were discovered as part of an investigation into suspected theft committed by this former employee, which was first identified by the administrative services company on September 23, 2019.","technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-11-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7846a310f7fe457555342757382f6b75829e2b7","impact_type":"data_theft","incident_date":"2019-04-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/First%20Aid%20Beauty%20-%20Individual%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"17b1a0183db9","org_name":"First Aid Beauty Limited","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184197"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/First%20Aid%20Beauty%20-%20Individual%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#First%20Aid%20Beauty%20Limited-2019-11-08"}],"summary":"An unauthorized third party placed malicious code on the firstaidbeauty.com website, which appears to have enabled access to customer information including payment card details.","supporting_quote":null,"technology_involved":["firstaidbeauty.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a796392c28d304a4a2e108d06bbd8428a577e500","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EmployBridge%20Individual%20Template%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"72cd5ef4b178","org_name":"EmployBridge","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184195"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EmployBridge%20Individual%20Template%20Notice%20Letter.pdf"}],"summary":"EmployBridge reported that an unauthorized individual may have accessed imaged garnishment documents containing personal information stored on third-party agent Corporate Creations' systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Corporate Creations"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"48f9b992a404","name":"Corporate Creations"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-08","discovered_date":"2019-08-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dd0cead012a717236791b6f7556c623f7e7e4244","impact_type":"unknown","incident_date":"2019-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a7780fbe02cb","org_name":"Arizona Dental Insurance Service, Inc. d.b.a. Delta Dental of Arizona","org_type":"unknown","ransomware":null,"records_affected":12886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Arizona%20Dental%20Insurance%20Service%2C%20Inc.%20d.b.a.%20Delta%20Dental%20of%20Arizona-2019-11-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2019-11-05","discovered_date":"2019-10-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd684064abe6975c7a5b414825796cfb6cb0d0b4","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Email%20-%20template%20%28final%29.pdf"},"notes":null,"org_country":"US","org_id":"cc96fd0a0967","org_name":"Web.com Group, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184127"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Email%20-%20template%20%28final%29.pdf"}],"summary":"Web.com reported that an unauthorized third party accessed a limited number of computer systems and account information for current and former customers may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"091b724b2e41e8016197eb09d6fb3971b44a7bc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"814ce820-35b0-11ec-be76-613d00a742ca"},"incident_date":"2019-11-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"68d3da5ff867","org_name":"Singapore Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.yahoo.com/police-officer-charged-seeking-relationship-woman-exchange-help-case-035449776.html"}],"summary":"SINGAPORE — A police sergeant was charged on Thursday (2 September) for allegedly seeking a romantic relationship with a female individual, in exchange for helping her with her case.  Singaporean Sean Teo, 25, was handed a charge each under the Computer Misuse Act, Official Secre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bc589443efc8ae7f50b42af12f942a64c24d2a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07c93380-1061-11ea-9257-5f79bcff5761"},"incident_date":"2019-11-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"291b8f260219","org_name":"Government of Nunavut","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/JSavikataaq/status/1190727062690115586,https://www.facebook.com/GovofNunavut/posts/2533848170026447,https://nunatsiaq.com/stories/article/government-of-nunavut-slowly-rebuilds-computer-network-following-ransomware-attack/,https://nunatsiaq.com/stories/article/government-of-nunavut-says-its-computer-backups-are-ok-despite-ransomware-attack/,https://www.theregister.co.uk/2019/11/04/ransomware_freezes_nunavut_canada/,https://www.zdnet.com/article/canadian-nunavut-government-systems-crippled-by-ransomware/,https://securityboulevard.com/2019/11/nunavut-governments-it-system-struck-by-ransomware-attack/"}],"summary":"unknown actions lead to ransomware in local government","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f789b86b653c9716647a2d38d6d827a9d23ae1d","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"47dc8da55cbe","org_name":"Vedantu","org_type":"education","ransomware":null,"records_affected":686899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Vedantu","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vedantu"}],"summary":"Vedantu reported a 2019 data breach that exposed personal information and bcrypt-hashed passwords belonging to users.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d4cc961d5154806227e6829caabaf43a40e31c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d3b74ea0-120e-11eb-a3ae-53136ea5d4e6"},"incident_date":"2019-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f35c1df234ab","org_name":"TrueDialog","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-truedialog-leak/?=truedialog-exposed-data"}],"summary":"TrueDialog accidentally left a database open containing millions of sms messages","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b3b51c883946bee2188364e077ac4abea0d2faa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38cd2510-1d02-11ea-aaae-134977653bb1"},"incident_date":"2019-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83b9e30c45a7","org_name":"The Walt Disney Company","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.telegram.com/news/20191128/star-wars-rise-of-skywalker-actor-who-caused-script-leak-comes-forward"}],"summary":"John Boyega, who plays storm trooper-turned-resistance-fighter Finn in the new trilogy, confessed to the crime Wednesday on “Good Morning America” days after director J.J. Abrams and costar Daisy Ridley refused to reveal his name. True to Abrams’ original account, the British sta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"affc1fddc4cc2d2637664a72cb5eb10ebf55f472","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c0e96510-7230-11eb-a674-05cfd55ad89e"},"incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7556259eb4d","org_name":"Social Bluebook","org_type":"technology_saas","ransomware":null,"records_affected":217000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2020/03/27/social-bluebook-hacked/"}],"summary":"Social Bluebook had their database compromised exposing social media influencers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8bb900d676d08431705ca9edf092a94cc1aa8b64","impact_type":"unknown","incident_date":"2019-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8934f4849b89","org_name":"SELCO Community Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SELCO%20Community%20Credit%20Union-2019-11-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2019-11-01","discovered_date":"2019-08-29","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ceb6af04643007f575b250c2e80a043b4223a510","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/PrismaHealth.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f3021968a2e","org_name":"Prisma Health","org_type":"healthcare","ransomware":null,"records_affected":14197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/PrismaHealth.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/PrismaHealth.pdf"}],"summary":"Compromised login credentials provided access to patient pre-registration and volunteer registration forms on the Palmetto Health website.","supporting_quote":"We promptly and extensively investigated, and determined that the login credentials provided access to patient pre-registration and volunteer registration information forms previously completed on Palmetto Health’s website at www.palmettohealth.org.","technology_involved":["Palmetto Health website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"044bbc30ca3534f002fe63bc4a23876ca11102d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0907daf0-162a-11ec-8258-83f74c3914c9"},"incident_date":"2019-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3175d598174b","org_name":"Pierson High School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sag-harbor-school-computers-impacted-by-ransomware-attack/"}],"summary":"Pierson High School Computers Impacted by Ransomware Attack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49096f50abeff0703c40c8254eec81b6903afb1f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b9274b0-28eb-11ea-a520-cb05efb19081"},"incident_date":"2019-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a8150272bfc","org_name":"Penn-Harris-Madison School Corp","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.southbendtribune.com/news/education/penn-harris-madison-schools-working-to-restore-network-after-ransomware/article_fa7359e7-9805-51cd-94d3-34bd65edb461.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wvpe.org/post/phm-schools-recovering-ransomware-attack"}],"summary":"Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fb1b672830e2ba7e48183656d0632b8b36ea0a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6fde2a0-72d5-11eb-a674-05cfd55ad89e"},"incident_date":"2019-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"a57fda11a401","org_name":"Lighinthebox.com","org_type":"technology_saas","ransomware":null,"records_affected":12000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2019/12/16/lightinthebox_data_breach_1_5bn_customer_records/"}],"summary":"Chinese e-commerce site LightInTheBox.com bared 1.3TB of server logs, user data and more through an unsecured elasticsearch server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed7e83fb57837b51d768a236b0843254b0c03b28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38db2720-23a3-11eb-b77f-316b5c5dd5eb"},"incident_date":"2019-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc43786cbd9","org_name":"Grace and Porta","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/grace--porta-benefits-provides-notice-of-a-data-breach-301082332.html"}],"summary":"BRIGHTON, Mich., June 23, 2020 /PRNewswire/ -- Grace & Porta Benefits (\"Grace & Porta\") provides notice of an incident that may affect the security of some information relating to certain individuals associated with Grace & Porta.  What Happened?  On or about February 7, 2020, Gr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d50a9e12255f3472e192801a216a901cee405591","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44324af0-2bf5-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"18204b23f610","org_name":"Australian Broadcasting Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.news.com.au/national/unprofessional-unethical-unsafe-abc-breaches-rape-victims-privacy-in-new-tracey-spicer-documentary/news-story/584bcc2fc1bb28c534ff8d7a79e660f1;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.news.com.au/finance/business/media/sexual-assault-survivors-exposed-by-metoo-documentary-starring-tracey-spicer-speak/news-story/6262c9f2d81e90afb4259c908b154dda"}],"summary":"The ABC has been accused of violating women’s privacy and compromising their safety, after circulating a documentary which included the real names, faces and personal stories of rape and domestic violence victims, without the survivors’ knowledge or consent. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c77dca890cde3e91230e5120b4c8618a536bf296","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc7deb10-359b-11ec-9ec7-15e66f657ea5"},"incident_date":"2019-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailydot.com/debug/apple-employee-fired-texting-customers-photos/"}],"summary":"Apple Store employee fired after texting customer’s personal photos to himself","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-31","discovered_date":"2019-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5062157e407a9e1afd6ccf119bc49a5cc2b69fc9","impact_type":"data_theft","incident_date":"2019-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/8439950.PDF"},"notes":null,"org_country":"US","org_id":"82ef5bfc082f","org_name":"Title Boxing, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-184003"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/8439950.PDF"}],"summary":"Title Boxing reported that customer names and payment-card information may have been obtained from its payment portal during online purchases.","supporting_quote":null,"technology_involved":["e-commerce server","payment portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-10-30","discovered_date":"2019-03-25","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad299be05f458dc214c44e7ec5b1c20a6593d41b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Guidance%20Center%20-%20Sample%20Notification%20Letter%20%28CA%29.pdf"},"notes":null,"org_country":"US","org_id":"183c9ca49a12","org_name":"The Guidance Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183952"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Guidance%20Center%20-%20Sample%20Notification%20Letter%20%28CA%29.pdf"}],"summary":"The Guidance Center reported unauthorized access to employee email accounts that contained protected health information belonging to current and former clients.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-30","discovered_date":"2019-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09d5b32287d2dc0b5f0ab2c04fe63eff4fc6a2dd","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"0275ed6bc2d5","org_name":"Marriott International","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice.pdf"}],"summary":"An unknown person accessed a document containing Marriott associates’ personal information through the network of an outside vendor.","supporting_quote":"Marriott learned on September 4, 2019, that an unknown person gained access to information about certain Marriott associates by accessing the network of an outside vendor formerly used by Marriott.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2019-10-29","discovered_date":"2019-09-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6025e4c5ac878242b6e58d0b290df8d1304c228","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"6eb3ede69ce7","org_name":"Gazelle Transportation, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183923"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notification%20Letter.pdf"}],"summary":"Gazelle Transportation reported unauthorized access to its servers, with no evidence that information was removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["credentials"],"disclosed_date":"2019-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a0d584a39c07b84b5d81b27c70a436e6b885fb9","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bed%20Bath%20%26%20Beyond%20--%20Final%20CA%20Notice%20%2810-29-19%29.pdf"},"notes":null,"org_country":"US","org_id":"02f7b0ac65df","org_name":"Bed Bath & Beyond Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bed%20Bath%20%26%20Beyond%20--%20Final%20CA%20Notice%20%2810-29-19%29.pdf"}],"summary":"A third party used externally acquired email and password information to access a limited number of Bed Bath & Beyond online accounts, and security challenge questions and answers may have been visible.","supporting_quote":"We recently discovered that a third party used email and password information acquired outside Bed Bath & Beyond and Buy Buy Baby to access a limited number of online accounts during the period of September 4 – 27, 2019.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2019-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e8242fcf92dd24c77eaccdb8bf11f8be8226caa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08d700e0-0a49-11ea-9821-617d71ee6253"},"incident_date":"2019-10-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5db3230efd1c","org_name":"KickBack Apps","org_type":"professional_services","ransomware":null,"records_affected":138000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securitydiscovery.com/prankdial-data-leak/"}],"summary":"Prank Calling service left database exposed over a million records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-28","discovered_date":"2019-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9716ecc7dbdf665808d86816cefc00a2d4370c4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-08-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Auto%20Approve%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201.pdf"},"notes":null,"org_country":"US","org_id":"f7884d265906","org_name":"Auto Approve, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A system vulnerability following a maintenance release made personal information accessible to external parties.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183864"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Auto%20Approve%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Auto%20Approve%2C%20LLC-2019-10-28"}],"summary":"A system vulnerability made Auto Approve customers’ personal information accessible to external parties for approximately three weeks.","supporting_quote":"As a result, certain personal information that you previously shared with Auto Approve, in relation to an auto loan, was accessible to external parties for approximately three weeks.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c61c6de2c4fd9bd99e4c3797b973cda6a8bf5639","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c35e170-2f2e-11eb-be94-ff2f41197b3c"},"incident_date":"2019-10-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd8795eb8ae5","org_name":"Children's Choice Pediatrics","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/texas-children-s-healthcare-provider-alerts-patients-of-ransomware-attack.html"}],"summary":"Children's Choice Pediactrics experienced a ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-25","discovered_date":"2019-08-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"caaaae031f5aa42ed771bb26a07fe81b597f556b","impact_type":"unknown","incident_date":"2019-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"03b0b04111b1","org_name":"Fix My Blinds","org_type":"unknown","ransomware":null,"records_affected":18743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Fix%20My%20Blinds-2019-10-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-10-25","discovered_date":"2019-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1482d4380f761f36cb0f9da2a133c88009fd5376","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Sample%20Letters.pdf"},"notes":null,"org_country":"US","org_id":"cd29c7e8633b","org_name":"BookShark LLC","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample%20Letters.pdf"}],"summary":"BookShark found unauthorized code on its website that was designed to capture information entered during customer login and checkout.","supporting_quote":null,"technology_involved":["www.bookshark.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical","credentials"],"disclosed_date":"2019-10-24","discovered_date":"2019-07-29","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a03d50ee1b1201922b889a8f964380e9bbecea9a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Central%20Valley%20--%20California%20Attorney%20General%20Notification%20Letter%20--%202019.10.24.pdf"},"notes":null,"org_country":"US","org_id":"c6ba76f4e3a7","org_name":"Central Valley Regional Center","org_type":"nonprofit","ransomware":null,"records_affected":11990,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183781"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Central%20Valley%20--%20California%20Attorney%20General%20Notification%20Letter%20--%202019.10.24.pdf"}],"summary":"Central Valley Regional Center reported that an unauthorized third party may have accessed an employee email account containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75de03c76bedc68c0a18630818c56f40d125632c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10b98c60-15de-11ea-ba54-075d8b11bbd2"},"incident_date":"2019-10-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"509b91d95aa3","org_name":"Oregon Health authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.statesmanjournal.com/story/news/crime/2019/11/05/hossein-heydari-shut-down-oregon-medicaid-computers-gets-home-detention/4163994002/,https://www.oregonlive.com/crime/2019/11/laid-off-hewlett-packard-employee-who-shut-down-oregons-medicaid-computers-gets-home-detention.html"}],"summary":"hacking actions by fired employee denied availability of medicaid systems for one day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-10-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac95033e9bd11d76edf20b40ab1661e1ef1cf87a","impact_type":"data_theft","imported_from":null,"incident_date":"2019-10-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"NL","org_id":"3be264f98ba2","org_name":"Hookers.nl","org_type":"other","ransomware":null,"records_affected":290955,"reviewed":false,"root_cause":"An unpatched vulnerability in the vBulletin forum software was used to access member data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hookers.nl","type":"hibp","url":"https://haveibeenpwned.com/Breach/HookersNL"}],"summary":"Hookers.nl member data was accessed through an unpatched vulnerability in its vBulletin forum software.","supporting_quote":"The IP and email addresses, usernames and either bcrypt or salted MD5 password hashes of 291k members were accessed via an unpatched vulnerability in the vBulletin forum software.","technology_involved":["vBulletin"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"vBulletin"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"46fb5ad409d8","name":"vBulletin"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-10-22","discovered_date":"2019-08-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05d5f178c823934590cb2ebb210f96c4d54b8152","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KRH%20-%20Consumer%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"6aaf57f29d1f","org_name":"Kalispell Regional Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees were deceived by emails into providing their KRH login credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183730"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KRH%20-%20Consumer%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kalispell%20Regional%20Healthcare-2019-10-22"}],"summary":"Employees provided their KRH login credentials after receiving deceptive emails, and patients’ personal information may have been accessed without authorization.","supporting_quote":"This summer we discovered that several employees were victims of a well-designed email that led them to unknowingly provide their KRH login credentials to malicious criminals.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2019-10-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56d52069a2e327cfb8fa06e65574deb082ec66fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9adb1a10-4167-11ec-b81c-33d442e55df8"},"incident_date":"2019-10-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"956862d8f8b5","org_name":"Audio Visual Services Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-191812"}],"summary":"Audio Visual Services Group experienced a breach when someone accessed their email to attempt a BEC","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dab68008f616f8738c50596ab7abf74f31030cc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1accaab0-1d19-11ea-93dd-ad92e007263c"},"incident_date":"2019-10-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"346fa065ca28","org_name":"San Bernardino School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/ransomware/san-bernadino-city-schools-hit-with-ransomware/"}],"summary":" The San Bernadino City Unified School District has been knocked offline by a ransomware attack.  The California school system reported the attack on October 20, stating the district files have been locked and are inaccessible and school personnel are reverting to paper to proces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-10-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95cafc707a1e4844621540a55dcabc8219312b4a","impact_type":"data_theft","imported_from":null,"incident_date":"2019-09-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fb493474de8e","org_name":"Zooville","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unpatched vulnerability in the vBulletin forum software was used to access member data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zooville","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zooville"}],"summary":"Zooville member data was accessed through an unpatched vulnerability in its vBulletin forum software and later distributed online.","supporting_quote":"The usernames and email addresses of 71k members were accessed via an unpatched vulnerability in the vBulletin forum software then subsequently distributed online.","technology_involved":["vBulletin forum software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"vBulletin"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"46fb5ad409d8","name":"vBulletin"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a70e15067112450f05bee07dfd5ac16af18f3a41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17446090-1d14-11ea-93dd-ad92e007263c"},"incident_date":"2019-10-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c33b99e67332","org_name":"Adobe, Inc.","org_type":"professional_services","ransomware":null,"records_affected":7500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2019-10-25/adobe-exposed-data-of-more-than-7-million-software-users"}],"summary":"Adobe Inc. exposed the data of 7.5 million of its creative-software customers, a person familiar with the matter said, in the latest example of a company leaving consumer information visible on the internet.  Adobe addressed the vulnerability the same day it was discovered, Oct. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcb36c1b3bddd8fa699e4a24c6c301d3bb15401e","impact_type":"unknown","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Tribune%202%20-%20Regulator%20Notice%20-%20CA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71f5f2585c8b","org_name":"Tribune Publishing Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183589"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e4c4ffd7b45d294caee2373ccc3ba74a1e8324","impact_type":"unknown","incident_date":"2018-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A%20-%20EBD%20Notification%20to%20Group%201%20Customers.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"540fbaff70f9","org_name":"Eye Buy Direct, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183581"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10514.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-17","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b6cc0f5bbb9f44cf9496df146d6608152d7acdb","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PKF%20LLP%20CA%20Template.pdf"},"notes":null,"org_country":"US","org_id":"60207848e856","org_name":"PKF LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PKF%20LLP%20CA%20Template.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PKF%2C%20LLP-2019-10-17"}],"summary":"A PKF-owned laptop containing files with personal information was stolen; PKF confirmed the files included names and Social Security numbers.","supporting_quote":"We recently discovered that a PKF owned, password protected, but unencrypted, laptop was stolen during a theft.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17ab16741606a8fda608fe9b51802c8c14789764","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c59e4430-0d5f-11eb-835c-77358de149b1"},"incident_date":"2019-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ef2104362e7c","org_name":"EasyJet","org_type":"transportation_logistics","ransomware":null,"records_affected":9002000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/thomasbrewster/2020/05/19/easyjet-hacked-9-million-customers-and-2000-credit-cards-hit/#61295a081ae1"}],"summary":"Easy Jet was hit with a sophisticated attack that resulted in a breach of 9million of it's users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89405f19e875e0d79ce8654a0dfc13756ec8bed9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"688da860-1c35-11ea-a0aa-479da677bbbc"},"incident_date":"2019-10-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"186764e6d48f","org_name":"People Data Labs (PDL)","org_type":"professional_services","ransomware":null,"records_affected":4000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/data-enriched-profiles-1-2b-leak/150560/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/story/billion-records-exposed-online/"}],"summary":"First found on October 16 by researchers Bob Diachenko and Vinny Troia, the database contains more than 4 terabytes of data. It consists of scraped information from social media sources like Facebook and LinkedIn, combined with names, personal and work email addresses, phone numb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-16","discovered_date":"2019-09-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e9d6ace65793f13bed3cd71ee07a4451fa142ea","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20%28Nutrafol%20-%20CA%29.pdf"},"notes":null,"org_country":"US","org_id":"8e84c8872a69","org_name":"Nutraceutical Wellness Inc. dba Nutrafol","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183532"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter%20%28Nutrafol%20-%20CA%29.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nutraceutical%20Wellness%20Inc.%20dba%20Nutrafol-2019-10-16"}],"summary":"Nutrafol reported that an unauthorized third party may have accessed names, addresses, and credit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-16","discovered_date":"2019-09-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed7dbe6f0aa4480eb021039768382173b0e077c4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10515.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"96914a70a3b2","org_name":"Neutraceutical Wellness, Inc","org_type":"other","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10515.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10515.pdf"}],"summary":"Neutraceutical Wellness reported that an unauthorized third party may have accessed names, addresses, and credit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2019-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12764155945d67e2819633222cd5210a8a11cb2a","impact_type":"data_theft","incident_date":"2019-09-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/R%26H%20-%20Data%20Breach%20Notification%20-%202019-10-15.PDF"},"notes":null,"org_country":"US","org_id":"2a44dd56efe3","org_name":"The Rodgers & Hammerstein Organization","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A security vulnerability on the RNH.com website allowed a hacker to access and download user online account information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183439"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/R%26H%20-%20Data%20Breach%20Notification%20-%202019-10-15.PDF"}],"summary":"A hacker exploited a vulnerability on the RNH.com website to access and download user online account information.","supporting_quote":"On September 9, 2019, RNH.com experienced a security incident wherein a malicious hacker exploited a security vulnerability on the RNH.com website in order to gain access to and download certain user online account information.","technology_involved":["RNH.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b86c7ef3a7b05773ffe332872d223238ae2dd8a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"874b3280-1d21-11ea-93dd-ad92e007263c"},"incident_date":"2019-10-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"361505ac0c13","org_name":"Gyeonggi-do Fire and Disaster Headquarters","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kpopstarz.com/articles/290385/20191021/firefighters-who-revealed-sullis-death-info-are-sacked.htm"}],"summary":"Head of the Gyeonggi-do Fire and Disaster Headquarters, Lee Hyung Chul, confirmed in a speech the dismissal of duty of the aforementioned firefighters during the National Administrative Safety Committee on Friday, October 18.  \"We confirmed the two employees who leaked the report","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-13","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c94b3af436f2d5e1b05490386652600e7cc859f","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1415c5c227ae","org_name":"South Pacific Financial Corporation","org_type":"unknown","ransomware":null,"records_affected":16166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#South%20Pacific%20Financial%20Corporation-2019-10-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-10-11","discovered_date":"2019-09-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"2b5c3ee76e4415cf816f9580fa334cef8c78577d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Art.com_.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"16a5cb25becb","org_name":"Art.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Art.com_.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Art.com_.pdf"}],"summary":"An unknown actor accessed an Art.com associate’s corporate email account for approximately eight weeks, and personal information in the account may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-10-09","discovered_date":"2019-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea263decc577d641a0f4fe7449d7e3a9386bea04","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/258938_01_IDExperts_Hunt%20Memorial%20StaticProof_1G.PDF"},"notes":null,"org_country":"US","org_id":"1174cbbe5bb0","org_name":"Hunt Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183273"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/258938_01_IDExperts_Hunt%20Memorial%20StaticProof_1G.PDF"}],"summary":"Hackers gained access to patient personal information at Hunt Regional Medical Center, and patient medical records may have been accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22b62e7339a5d93cf28f0f01f7129c0a3e5a699b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c88fbc70-057f-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-10-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"599d622a29c1","org_name":"Freedom Healthcare","org_type":"healthcare","ransomware":null,"records_affected":90,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/a-leak-report-quietly-disappears-leaving-questions-in-its-wake/"}],"summary":"Unauthenticated database with test data and some real data left discovered by cybersecurity researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cb6314fa3862186a56d4ef3b59294f3dd7c64fd","impact_type":"data_theft","imported_from":null,"incident_date":"2016-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4d3ea3abb536","org_name":"StreetEasy","org_type":"other","ransomware":null,"records_affected":988230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: StreetEasy","type":"hibp","url":"https://haveibeenpwned.com/Breach/StreetEasy"}],"summary":"StreetEasy experienced a data breach in approximately June 2016 that exposed email addresses, names, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a5adb3704ee8e6728f0424c2344fbbb09636b8f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fdb82f7f9669","org_name":"Sephora","org_type":"retail_ecommerce","ransomware":null,"records_affected":780073,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sephora","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sephora"}],"summary":"A breach affecting Sephora customers in Southeast Asia, Australia and New Zealand exposed email addresses and personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5253debef87e1a1ed1d7650e7838920a2afd573a","impact_type":"data_theft","incident_date":"2019-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bakersfield%20CA%20Individual%20Notice%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"c5d6a14c1269","org_name":"City of Bakersfield","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183190"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bakersfield%20CA%20Individual%20Notice%20Letter.pdf"}],"summary":"Unauthorized code in Bakersfield’s Click2Gov online payment system captured payment card and other information entered between July 30 and September 5, 2019.","supporting_quote":null,"technology_involved":["Click2Gov"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-03","discovered_date":"2019-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e47fe0ddd9cb5d9052eeb12b66334c7683084168","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10512.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4e28eebd87aa","org_name":"Toyota Financial Services","org_type":"financial","ransomware":null,"records_affected":2352,"reviewed":false,"root_cause":"An isolated administrative error caused customer information intended for other Toyota dealers to be shared with unauthorized dealers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10512.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10512.pdf"}],"summary":"Toyota Financial Services reported that an administrative error led to customer information being shared with unauthorized Toyota dealers.","supporting_quote":"We are writing to notify you that as a result of an isolated administrative error, a limited amount of your personal information may have been shared with an unauthorized third party.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-10-03","discovered_date":"2019-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27c9ec4b05f120d1911382280884e7fe111876b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pt%20Notif%20Ltr_FINAL_filed%20online%20State%20AG.pdf"},"notes":null,"org_country":"US","org_id":"00ec2994fd3d","org_name":"San Francisco Department of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A computer error caused renewal letters to be sent to incorrect addresses.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pt%20Notif%20Ltr_FINAL_filed%20online%20State%20AG.pdf"}],"summary":"A computer error caused Healthy San Francisco renewal letters containing personal and health-related information to be sent to incorrect addresses.","supporting_quote":"On August 8, 2019, Alluma, a third party company that processes Healthy San Francisco enrollments, informed us that due to a computer error, some letters to Healthy San Francisco participants were sent to the wrong addresses between November 2018 and August 2019.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"Alluma"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"2abcd5d0d5fd","name":"Alluma"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2c322dd8b0ad9fcc3a58b408461ef4e81a06b6f9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/McAlistersDeli.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9627e1288f8a","org_name":"McAlister's Corporation, Moe's Stores LLC, Schlotzsky's Stores LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/McAlistersDeli.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"509f4bcb3c5afe8866c48212a560d00c228ed60f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CapitalOne.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c70318fb455f","org_name":"Capital One, N.A.","org_type":"unknown","ransomware":null,"records_affected":2371,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CapitalOne.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aff149da358bea1e3df8ce83ee596cecdfc93e93","impact_type":"data_theft","incident_date":"2019-04-29","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"8822b2b2f49b","org_name":"Moe's Stores LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183110"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice_1.pdf"}],"summary":"Unauthorized code was installed at certain Moe’s Southwest Grill locations and searched payment card track data routed through restaurant servers.","supporting_quote":"It appears that unauthorized code designed to copy payment card data from cards used in person was installed in certain corporate and franchised restaurants at different times over the general period of April 29, 2019 to July 22, 2019.","technology_involved":["payment card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c52ac477144f4d1de1c2a72bb0cafa4ad01d39b4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"887834f0-0e82-11ed-9a95-4bdaebaab721"},"incident_date":"2019-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"656a39d47812","org_name":"Town of Concord","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/massachusetts/concord/update-2019-data-breach-incident-identity-monitoring-offers-information"}],"summary":"Harddrives containing citizen information were stolen in Town of Concord MA","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2abf43784700a96038499121472945f238486630","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a65b77a0-1c38-11ea-a0aa-479da677bbbc"},"incident_date":"2019-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79a945d01543","org_name":"Queer Chart","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stanforddaily.com/2019/11/19/queer-chart-startup-exposes-student-data/"}],"summary":"A security flaw allowed users of Queer Chart, a startup founded by Stanford students to link members of the campus queer community, to access all users’ names, profile pictures, email addresses, dates of birth, pronouns, schools and anonymous IDs, its founders have acknowledged. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63bb57476211a9bd9fa0ad5b02309fcbd1581fdf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56a403d0-0ad6-11ea-9821-617d71ee6253"},"incident_date":"2019-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6ab03f70740","org_name":"Magnolia Pediatrics","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theadvocate.com/baton_rouge/news/communities/ascension/article_b6194b7a-eba2-11e9-a388-5b6eedc7c596.html,http://databreaches.net/la-magnolia-pediatrics-notifying-patients-after-attack-on-it-vendor-resulted-in-ransomware-infection/,https://www.beckershospitalreview.com/cybersecurity/louisiana-clinic-hit-by-ransomware-attack.html"}],"summary":"Magnolia Pediatrics in Prairieville, La., is working with the FBI and has alerted patients' families of an August ransomware attack,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfa9bd0b4c85463837fde31f1e4b075335e72476","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31dfa8b0-1c77-11ec-bbb1-d17b99816d46"},"incident_date":"2019-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e0073709720","org_name":"LiveRamp","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/hackers-infiltrated-a-big-facebook-data-partner-to-launch-scams/"}],"summary":"Hackers infiltrated a big Facebook data partner, LiveRamp, to launch scams ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d7b897911e35a96565da28ecacbc7fdda4420f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6e8216d0-72d2-11eb-a674-05cfd55ad89e"},"incident_date":"2019-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5b1d5a17c72f","org_name":"Lifelabs","org_type":"healthcare","ransomware":null,"records_affected":15000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/british-columbia/lifelabs-cyberattack-15-million-1.5399577"}],"summary":"Lifelabs in Canada got compromised and data was exfiled on 15m customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-10-01","discovered_date":"2019-03-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae523f0b0154f7898268be9d393ce02caa20e4ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_-_CA.pdf"},"notes":null,"org_country":"US","org_id":"02d413f2ad8a","org_name":"Drury Hotels Company, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-179448"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_-_CA.pdf"}],"summary":"Drury Hotels reported that reservation transaction records held by a third-party service provider were involved in unauthorized access.","supporting_quote":"The service provider initially advised us that the unauthorized access to transaction records related to reservations in its network began on December 29, 2017 and ended on March 13, 2019.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfdf29a5ebdf1aeb20e9d2218ec6bf35d4fc647e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71899560-2bf7-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"87a9bd4b1e86","org_name":"Deutsche Bahn","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wz.de/nrw/duesseldorf/daten-panne-bei-der-deutschen-bahn-in-duesseldorf_aid-46338819"}],"summary":"Data protection - in this day and age a very sensitive topic. All the more surprising that you do not give much to such a big company like Deutsche Bahn. In front of the airport station, several boxes of carelessly thrown papers appeared, according to a report by the Express. The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e71f87da25b0a68b9674b1d9c0ffa9b3b89d9df","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f09201d0-f0dd-11e9-84f3-1937a4e658d4"},"incident_date":"2019-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4972a70110b","org_name":"DCH Health System","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.al.com/news/2019/10/dch-health-system-still-grappling-with-ransomware-attack.html"}],"summary":"DCH Regional Medial Center got hit by ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a1aeae1360231341ab6315a9e524f3200216e2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"221b2860-f0db-11e9-84f3-1937a4e658d4"},"incident_date":"2019-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"e270f92e4fd7","org_name":"City of Jerez de la Frontera","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenextweb.com/hardfork/2019/10/04/ransomware-spain-jerez-frontera-bitcoin-cryptocurrency-attack/"},{"fetched_at":null,"title":null,"type":"press","url":"https://btcmanager.com/spanish-city-ransomware-attack-hackers-bitcoin/?q=/spanish-city-ransomware-attack-hackers-bitcoin/,https://thenextweb.com/hardfork/2019/10/04/ransomware-spain-jerez-frontera-bitcoin-cryptocurrency-attack/"}],"summary":"Spanish city of Jerez de la Frontera is hit by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c20f2efe4a068e7331cb53cc803dbf4fc9bfe4c8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5d8128c0-28ec-11ea-a520-cb05efb19081"},"incident_date":"2019-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eaa27d4fa7f6","org_name":"Alphabroder","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.asicentral.com/news/newsletters/promogram/october-2019/alphabroder-suffers-ransomware-attack/"}],"summary":" Alphabroder Suffers Ransomware Attack  The promo products industry’s largest supplier said it was hit by SODINOKIBI malware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"GH","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54a75f6c70816f670163ef73ebd28485871327b1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e37e400-2bf8-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GH","org_id":"ae71f4e849e9","org_name":"Accra High Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.graphic.com.gh/news/general-news/ghana-news-accra-high-court-trial-records-stolen.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.pulse.com.gh/news/local/hard-disk-containing-opuni-trial-stolen-from-court/syn7wqz"}],"summary":"Computer accessories including hard drives have been stolen from about four different courtrooms serving the Accra High Court located at the Law Court Complex in Accra.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcb9ecc503fc235fd22b2aaa6b970f5900489568","impact_type":"data_theft","incident_date":"2019-08-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notification%202019.09.30.pdf"},"notes":null,"org_country":"US","org_id":"458cb370aa4f","org_name":"Zynga","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150949"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification%202019.09.30.pdf"}],"summary":"Zynga reported that outside hackers may have accessed player account information, including usernames and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"518227188aef0f5cf3dbee14a8071ca0f187a0d5","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4ee58cb57d33","org_name":"Wanelo","org_type":"retail_ecommerce","ransomware":null,"records_affected":23000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wanelo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wanelo"}],"summary":"Wanelo suffered a data breach in approximately December 2018 that exposed email addresses, password hashes, names, shipping addresses, and IP addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4cd4a80a278beb1ba57fcff24d317c061d6f769","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64d305c0-1d03-11ea-b94e-893211cca703"},"incident_date":"2019-09-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"afd0297719a0","org_name":"Hard Rock Stadium","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.local10.com/news/florida/miami-dade/vendor-arrested-after-charging-fan-724-for-2-beers-during-dolphins-game"}],"summary":"A beer vendor was arrested Sunday at Hard Rock Stadium after using a Square reader to charge more than $700 to a fan's credit card during a Miami Dolphins game, police said.  Nathaniel Collier, 33, faces charges of third-degree grand theft and possession of a skimming device.  Ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-09-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bce09888b0fdc3e2e811f8e0acdd03d6c051a5e","impact_type":"data_theft","imported_from":null,"incident_date":"2019-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"2afce3505241","org_name":"DoorDash","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150916"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10511.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#DoorDash%2C%20Inc.-2019-10-28"}],"summary":"An unauthorized third party accessed some DoorDash user data on May 4, 2019, including personal information and partial bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-27","discovered_date":"2019-07-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3e9d7a0871f4e78ebafb237edfd09cbc5344e32f","impact_type":"unknown","incident_date":"2019-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b5bd823ea33","org_name":"Cancer Treatment Centers of America at Southeastern Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":3290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America%20at%20Southeastern%20Regional%20Medical%20Center-2019-09-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-09-26","discovered_date":"2019-08-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df41e16a59c8628515fbc713be5afd84c2dc0c46","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Letter%20Template_NCal%20email%20incident_092619_FINAL.pdf"},"notes":null,"org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150863"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Letter%20Template_NCal%20email%20incident_092619_FINAL.pdf"}],"summary":"A Kaiser Permanente provider’s email account containing protected health information was compromised for approximately thirteen hours, with no evidence that the information was viewed, used, or copied.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02c3cccf10cf898d6647a6c88c37e8977428955f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"822f04f0-0491-11ea-ad43-7952870528d4"},"incident_date":"2019-09-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d87954b9961c","org_name":"Listowel Wingham Hospitals Alliance","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/kitchener-waterloo/rural-hospitals-in-southwest-ontario-hit-by-ransomware-attack-1.5301947,http://lfpress.com/news/local-news/two-southwestern-ontario-hospitals-hit-by-cyber-attack/wcm/37654a62-dae4-4350-91e8-50ccf21830ab"}],"summary":"Two hospitals shut down after ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-24","discovered_date":"2019-07-24","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca556ec0a98fbf30a1e1eaf4423e0e3eaa682c1e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10510.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"eb4dc59f61f7","org_name":"Majoris Health Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Majoris%20Health%20Systems%2C%20Inc.-2019-09-24"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10510.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10510.pdf"}],"summary":"Majoris Health Systems detected unauthorized access to personal information through malicious use of its website on or about July 24, 2019.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93e35b28ab62a4aadce7ed34429d1697138ab6a1","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-12","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JCF%20-%20CA%20-%20Notice%20of%20Data%20Event.pdf"},"notes":null,"org_country":"US","org_id":"e330dae85017","org_name":"Jewish Community Federation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JCF%20-%20CA%20-%20Notice%20of%20Data%20Event.pdf"}],"summary":"A phishing attack gave an unknown actor access to certain Jewish Community Federation employee email accounts where personal information was present.","supporting_quote":"Through a detailed and exhaustive investigation, we confirmed that an unknown actor(s) gained access to certain Federation employee email accounts as the result of a phishing attack.","technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bdadbb92e4b2c19c58f7285e83ee15b3e508ef9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5d6ab240-20e3-11ea-8baf-97ebc0c111f5"},"incident_date":"2019-09-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f1fd0e571ab","org_name":"Southeastern Minnesota Oral & Maxillofacial Surgery","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/ransomware-attack-on-minnesota/"}],"summary":"ransomware at healthcare facility","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb4a9c4940873291f90daf038139c6acd510cc48","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e0dcb00-722c-11eb-a74a-79ed152e0098"},"incident_date":"2019-09-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d42a09211fc7","org_name":"Saint Francis Healthcare System","org_type":"healthcare","ransomware":true,"records_affected":107000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/ferguson-medical-group-reports-data-loss-from-ransomware-attack"}],"summary":"Ferguson Medical Group, owned by Saint Francis Health, was infected with ransomware in September, which caused some data loss;","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c3ca62b74849f0dd847b7eb8c749c5163220810","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"504ff4e0-0fc6-11ea-997d-ff527b87f439"},"incident_date":"2019-09-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"571b05142cc9","org_name":"Campbell County Memorial Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wyomingbusinessreport.com/current_edition/campbell-county-memorial-hospital-hit-with-cyber-crime/article_2ffdc34e-f2e3-5b23-b4de-e90c39d00735.html"}],"summary":"Many emergency and routine health services at a 90-bed hospital in Gillette came to abrupt stop Sept. 20 when the facility’s 1,500 computer systems were disabled by a cyberattack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-18","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7fd17357fadaca760c98c82bf7b0b84afe46962b","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84be8b292079","org_name":"Salem Health","org_type":"unknown","ransomware":null,"records_affected":749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Salem%20Health-2019-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-18","discovered_date":"2019-06-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e3666414dc07f27b6b3dc4e12b41f9fb0e4a43a5","impact_type":"unknown","incident_date":"2019-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3bdc0aec6c7","org_name":"Medico of South Carolina, Inc.","org_type":"unknown","ransomware":null,"records_affected":6489,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Medico%20of%20South%20Carolina%2C%20Inc.-2019-09-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d195040cbc2042e1f0e9ce874e56319c47c82100","impact_type":"data_theft","imported_from":null,"incident_date":"2019-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d5529bc46ee5","org_name":"Minehut","org_type":"technology_saas","ransomware":null,"records_affected":396533,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Minehut","type":"hibp","url":"https://haveibeenpwned.com/Breach/Minehut"}],"summary":"Minehut reported that a database backup was obtained in a May 2019 breach, exposing email addresses and bcrypt password hashes.","supporting_quote":null,"technology_involved":["database backup"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2019-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5911ab50997f9ba1755fe91055eb7d4ce440013a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d9159784e0f9","org_name":"Kiwi Farms","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KiwiFarms","type":"hibp","url":"https://haveibeenpwned.com/Breach/KiwiFarms"}],"summary":"Kiwi Farms disclosed that email and IP addresses, dates of birth, and member-created content were exposed in a September 2019 data breach.","supporting_quote":null,"technology_involved":["online forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","secrets"],"disclosed_date":"2019-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1e73ae824c8ef5f0386b72c3a6e62901de5263e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8b34b220-0ae0-11ea-a7de-15b14f857e77"},"incident_date":"2019-09-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c2889bfbeb44","org_name":"Scotiabank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/data-breach/report-scotiabank-exposed-source-code-and-credentials-on-github-repositories/,https://www.itworldcanada.com/article/scotiabank-source-code-credentials-found-open-on-github-news-report/421992,https://www.theregister.co.uk/2019/09/18/scotiabank_code_github_leak/"}],"summary":"bank publishes internal information in public github repository","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-09-13","discovered_date":"2019-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7494c8139071da8de5ed79f3fb220cd556897b56","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AAU-%20Notice%20of%20Data%20Event-%20CA%20Exhibit%201.pdf"},"notes":null,"org_country":"US","org_id":"eb1045663d6d","org_name":"Amateur Athletic Union","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150546"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AAU-%20Notice%20of%20Data%20Event-%20CA%20Exhibit%201.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Amateur%20Athletic%20Union-2019-09-13"}],"summary":"Malicious code on AAU’s play.aausports.org site could capture personal and payment card information entered on its checkout page.","supporting_quote":null,"technology_involved":["play.aausports.org"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-12","discovered_date":"2019-08-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e0c7dfcdf5ec3d11b06223944c76b09b9a763caa","impact_type":"unknown","incident_date":"2019-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1c49232b2c53","org_name":"Peoples Injury Network Northwest (\"PINN\")","org_type":"unknown","ransomware":null,"records_affected":13269,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Peoples%20Injury%20Network%20Northwest%20%28%22PINN%22%29-2019-09-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-09-12","discovered_date":"2019-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"71fa960a4ff16246dd591ffa79ad5691f887d56d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10508.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"142899361958","org_name":"Peoples Injury Network Northwest","org_type":"healthcare","ransomware":true,"records_affected":12502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10508.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10508.pdf"}],"summary":"Peoples Injury Network Northwest reported that ransomware infected three servers, and a forensic review found no evidence of access or exfiltration but could not rule it out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2019-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e861927868ec35bdf7afc7c437d4137015a79b1","impact_type":"data_theft","imported_from":null,"incident_date":"2019-06-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ba9cf0b61bdd","org_name":"Void.to","org_type":"other","ransomware":null,"records_affected":95431,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Void.to","type":"hibp","url":"https://haveibeenpwned.com/Breach/VoidTO"}],"summary":"Void.to suffered a data breach that exposed email and IP addresses, usernames, private messages, and password hashes from its MyBB-based forum.","supporting_quote":null,"technology_involved":["MyBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0bf9b230471f56e2292f84dd426f1ffe7a877c3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29dc9b0b1614","org_name":"Oregon Department Of Human Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Department%20Of%20Human%20Services-2019-09-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-09-11","discovered_date":"2019-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30843c74a4fa3041419691bfc51f13baf6e1336f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Coyuchi%20Customer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"63f27b25b66c","org_name":"Coyuchi","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150477"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coyuchi%20Customer%20Letter.pdf"}],"summary":"Coyuchi discovered malicious code on its website designed to collect checkout information, including payment card details and personal information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14bed1299d710a13ec1b04b407c501f6304ba778","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cornerstone_CA_Sample_Notices.pdf"},"notes":null,"org_country":"US","org_id":"c0342cec8389","org_name":"Cornerstone Building Brands, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cornerstone_CA_Sample_Notices.pdf"}],"summary":"An unauthorized person accessed two employees’ email accounts and may have viewed emails and attachments containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06f4c5080fdfb599b5ab6f96ca07b05ad0b27cb8","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calibre%20CPA%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201.pdf"},"notes":null,"org_country":"US","org_id":"adc3a9f5097d","org_name":"Calibre CPA Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150374"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calibre%20CPA%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10513.pdf"}],"summary":"Calibre CPA Group reported unauthorized access to certain employee email accounts and a computer server, with personal information potentially accessible.","supporting_quote":null,"technology_involved":["employee email accounts","computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-09-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc04b927639248289e93acb9d41d0b3f608ab099","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b7413570-ee3a-11eb-a0c0-efc7cda0e23f"},"incident_date":"2019-09-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"963cb688d57a","org_name":"Volusion","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/card-data-from-the-volusion-web-skimmer-incident-surfaces-on-the-dark-web/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-189299"}],"summary":"Volusion, an online store provider was hacked and had modified javascript upload to steal payment card data from over 6589 online stores it manages","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15aa28938a293865d758d0adabf369d97a9eaf08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ea5e180-e5e8-11e9-a0ce-353e27116082"},"incident_date":"2019-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b21d8506986","org_name":"Verlo Mattress Factory","org_type":"manufacturing","ransomware":null,"records_affected":387604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/mattress-company-leaks-data-records-of-387k-customers/148530/,https://securitydiscovery.com/verlo-mattress-company/"}],"summary":"exposed database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37d63a4e264472c74ddc74e022a7fca33a63b362","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26ea7100-fb1e-11e9-ac31-5797fdf8a397"},"incident_date":"2019-09-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f04f8a6f9496","org_name":"Wolcott school district","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/ransomware-attack-hits-school-district-twice-4-months,https://www.databreaches.net/wolcott-school-officials-provide-information-on-district-wide-cyber-attack/,https://www.wfsb.com/news/wolcott-school-officials-provide-information-on-district-wide-cyber-attack/article_0aa5ded0-de77-11e9-9525-7341c35e3348.html"}],"summary":"ransomware based on unknown entry at high school.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d2e56d2b8269ee1d16cc9a68aafd158eac71eee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ca136300-06ef-11ea-8714-b997dc99273b"},"incident_date":"2019-09-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"9a7badf8fd42","org_name":"Sberbank","org_type":"financial","ransomware":null,"records_affected":60000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.bitcoin.com/why-bitcoin-is-better-than-banks-major-credit-card-breach-exposes-60m-accounts/,https://tass.com/economy/1081626,https://www.pymnts.com/news/security-and-risk/2019/russias-sberbank-investigating-client-data-leak/,https://www.sberbank.ru/en/press_center/all/article?newsID=04885252-1561-44c0-8532-2c4f33cd729f&blockID=1539&regionID=77&lang=en&type=NEWS,https://www.techradar.com/news/russias-sberbank-hit-with-huge-data-leak"}],"summary":"Internal actor misused access to download database of 60M current and former CC numbers w/ PII, but not logins/passwords or CVV numbers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-09-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99d36d1a1e858c797e6f2c0f5e5e3b8e828d947b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d9a4b1e0-0585-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-09-04","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"631c5ad4c169","org_name":"InterMed","org_type":"healthcare","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://wgme.com/news/local/hack-may-have-exposed-information-on-30000-maine-patients"}],"summary":"InterMed, a Maine-based health care provider, said it was hacked and about 30,000 patients may have had their information compromised.  InterMed serves patients through their practice sites in Portland, South Portland, and Yarmouth.  InterMed said on Tuesday an “unauthorized indi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2019-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f9a9b3f95ef3b454b213f60c8c40f377915c960b","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10507.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"636da8ba28dd","org_name":"CafePress, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":187238,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10507.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CafePress%20Inc.-2019-09-05"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CafePressIncorporated.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10507.pdf"}],"summary":"CafePress reported that an unidentified third party obtained customer information from a CafePress database without authorization.","supporting_quote":null,"technology_involved":["CafePress database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a5a9acb8d07620aa1894720328f91cb8ac2a5a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4d201e50-0a0b-11ea-9821-617d71ee6253"},"incident_date":"2019-09-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"46dc47a3d894","org_name":"Paderborn Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nw.de/lokal/kreis_paderborn/paderborn/22571455_Datenpanne-in-der-Paderborner-Kreisverwaltung.html"}],"summary":"Misconfiguration of permissions exposed Paderborn district to unauthorized employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb7f7592a8797072fd77e7978583b83673effb4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Foxit%20Notice%20of%20Data%20Breach-for%20US.pdf"},"notes":null,"org_country":"US","org_id":"c87e8e03ab9a","org_name":"Foxit Software","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150242"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Foxit%20Notice%20of%20Data%20Breach-for%20US.pdf"}],"summary":"Foxit reported unauthorized access to some data systems, including My Account user account data, that may have exposed users’ personal information and passwords.","supporting_quote":null,"technology_involved":["Foxit My Account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12b2b3b1838791b019aace53e765cb2ba35d8519","impact_type":"unknown","incident_date":"2019-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Andy%20Frain%20Services%20-%20Proof%20-%20A%20-%20California%20.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cc321bd784bb","org_name":"Andy Frain Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150243"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4171d132bd89f236854edf95fdcc81209e36af41","impact_type":"data_theft","imported_from":null,"incident_date":"2018-05-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e7702fe9f0b8","org_name":"Poshmark","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Poshmark","type":"hibp","url":"https://haveibeenpwned.com/Breach/Poshmark"}],"summary":"A breach exposed Poshmark user account information, including email addresses, names, usernames, genders, locations and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d894cc140a1128025be1192668a94a0b9334f0ea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0381c9b0-0588-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-09-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f67efbcb410","org_name":"People’s Health Centers","org_type":"healthcare","ransomware":true,"records_affected":152000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.jdsupra.com/legalnews/152-000-patients-affected-by-st-louis-95747/"}],"summary":"Yet another health clinic hit by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc38879f748bfa90f81574deaf19c2ec061735c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0bc75e50-e0ad-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"637d20e281fe","org_name":"Yves Rocher","org_type":"professional_services","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.oodaloop.com/briefs/2019/09/03/data-leak-hits-2-5-million-customers-of-cosmetics-giant-yves-rocher/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/data-leak-impacts-millions/147908/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.informationsecuritybuzz.com/expert-comments/yves-rocher-third-party-data-breach-exposes-millions-of-customer-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-aliznet-leak/"}],"summary":"Security researchers with vpnMentor recently discovered that retail consultancy firm Aliznet was leaking the data of 2.5 million Canadian Yves Rocher customers via an unsecured Elasticsearch database. The exposed data includes names, phone numbers, email addresses, dates of birth","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29de1640ba7af95907a6a6212b371424e70ef707","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1ede32e67ac5","org_name":"XKCD","org_type":"technology_saas","ransomware":null,"records_affected":561991,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: XKCD","type":"hibp","url":"https://haveibeenpwned.com/Breach/XKCD"}],"summary":"The XKCD forum suffered a data breach that exposed usernames, email and IP addresses, and passwords.","supporting_quote":null,"technology_involved":["phpBB forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6670f2dcfcbcaed488308125ba5f62cb7e24f16","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18d0bfd0-1d13-11eb-a925-afd7acbe9906"},"incident_date":"2019-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RO","org_id":"96f875e58a25","org_name":"TAROM","org_type":"transportation_logistics","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.paddleyourownkanoo.com/2019/12/05/romanias-tarom-airlines-fined-e20000-after-employee-leaks-passenger-details-online/"}],"summary":"TAROM airline employee gained access to passenger information and posted a picture of it to social media","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ace741f4f7071caa8760cf12ac7931a20d6e292c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6882810-de05-11e9-92e6-b7a271e742aa"},"incident_date":"2019-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3288c38dfac2","org_name":"Plaza at Clover Lake Nursing Home Facility","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dailyvoice.com/new-york/cortlandt/police-fire/area-health-aide-worker-charged-with-identity-theft-grand-larceny/775245/"},{"fetched_at":null,"title":null,"type":"press","url":"https://midhudsonnews.com/2019/09/10/new-windsor-health-aide-arrested-in-putnam-county-on-id-theft-grand-larceny-charges/"}],"summary":"A health aide worker from the area working at a facility in Putnam is facing charges after allegedly stealing from an elderly resident, investigators announced.  Takara Baldwin, 29, of New Windsor in Orange County, an employee at the Plaza at Clover Nursing Home Facility in Patte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40d6687523571b8512fd43e4a0243bb2c74c9058","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ed1e620-e458-11e9-a93a-d3a3d34c5869"},"incident_date":"2019-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EC","org_id":"708a6ca49878","org_name":"Novaestrat","org_type":"technology_saas","ransomware":null,"records_affected":20800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theinquirer.net/inquirer/news/3081589/creepy-data-on-nearly-every-one-of-ecuadors-citizens-has-leaked,https://www.miamiherald.com/news/nation-world/world/americas/article235137087.html,https://www.forbes.com/sites/daveywinder/2019/09/16/personal-data-from-entire-166m-population-of-ecuador-leaked-online/#5aad04393705,https://www.verdict.co.uk/ecuador-data-breach-assange/,https://www.databreaches.net/arrest-made-in-ecuadors-massive-data-breach/"}],"summary":"Database left online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb36ff48ef6faa77f0a83c0379d4d90425d99085","impact_type":"data_theft","imported_from":null,"incident_date":"2019-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"DE","org_id":"396037ed8048","org_name":"Mastercard Priceless Specials","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mastercard Priceless Specials","type":"hibp","url":"https://haveibeenpwned.com/Breach/MastercardPricelessSpecials"}],"summary":"Personal data, including names, email and IP addresses, phone numbers and partial credit card data, from Mastercard Priceless Specials members was circulated online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f41b14d3644144eaa1e1825c29cb8bbf288de412","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"736fa460-2c00-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e66723d92240","org_name":"Manor Care East","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/illinois/palos/nursing-home-employee-swipes-visitors-credit-cards-police"}],"summary":"A nursing home employee is accused of stealing credit cards and blank checks from elderly patients' visitors and then going on a shopping spree. Andrea Hart, 30, of Willowbrook, appeared before Cook County Judge John Mahoney on felony charges of unlawful possession of fictitious ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"009f3505a0d2048fba6c49e4537c60fbdd5cc1a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86daf0f0-2376-11ea-a520-cb05efb19081"},"incident_date":"2019-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a06ac77b457","org_name":"Las Cruces Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kvia.com/news/education/2019/11/20/accidental-data-breach-at-las-cruces-public-schools-discloses-vendor-social-security-numbers/"}],"summary":"Las Cruces Public Schools now confirms it accidentally sent out an email back in September containing the social security numbers of vendors the district uses.  That email was sent to about 150 district employees, officials said.  Vendors were advised to place a fraud alert on th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc6933b19885aa5bc8710341ca553b37fc6f3dc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89c2e320-3596-11ec-9ec7-15e66f657ea5"},"incident_date":"2019-09-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af9ec124e653","org_name":"Klamath County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.heraldandnews.com/news/local_news/county-veterans-service-office-announces-data-breached/article_995c0146-cb9d-5eae-acb0-7eac0d971504.html"}],"summary":"Klamath County Veterans Service Office announces data breached after suspicious email activity","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d85dbf74594d8599ca3299e977699c0c6babc408","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1063e430-8de2-11ec-a600-657ec2694f8f"},"incident_date":"2019-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"933fcf2d28da","org_name":"Henderson County Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.blueridgenow.com/story/news/2021/06/30/former-henderson-county-social-worker-arrested-stealing-over-80-k/7813131002/"}],"summary":"Former Henderson County social worker charged with stealing $80K in state funds","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3324fc293c670cd0273ab386926b2152300c5c6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35c6e540-259a-11ea-b8c8-4fa7e4328c98"},"incident_date":"2019-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37cbecd7281f","org_name":"Elizabeth Family Health","org_type":"healthcare","ransomware":null,"records_affected":28375,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.elizabethfamilyhealth.com/wp-content/uploads/2019/11/4855659-Substitute-Notice-.pdf,https://www.beckershospitalreview.com/cybersecurity/colorado-medical-center-alerts-28-000-patients-of-data-breach.html"}],"summary":"Someone broke in, vandalized the place and stool things like server backups","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4500195b9ac22a35c75349c21f873ec6678c9be1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97eb8690-e5e4-11e9-a0ce-353e27116082"},"incident_date":"2019-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EC","org_id":"7a07acce7adf","org_name":"DataBook","org_type":"technology_saas","ransomware":null,"records_affected":20000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2019-09-24/ecuadorians-personal-data-found-on-unsecured-database-again,https://www.computing.co.uk/ctg/news/3081923/ecuador-data-breach"}],"summary":"exposed database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"569663bb0d0621df4f5a46acbc7ff10dfc1100e9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6b5a2150-30dc-11ec-9798-915a6ecdc137"},"incident_date":"2019-09-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e150511fe4c","org_name":"City of Ocala","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/bec-fraudsters-divert-742-000-from-ocala-city-in-florida/"}],"summary":"BEC Fraudsters Divert $742,000 from Ocala City in Florida","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3959c3be1f1d65f0603cf955af4fbd4b3349d0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"db154c10-df29-11e9-9ff0-a5a30eaf0927"},"incident_date":"2019-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"519263f17ecb","org_name":"Charing Cross Gender Identity Clinic","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-gender-identity-clinic-leaks-almost-2000-patients-email-addresses/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/technology-49611948;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/society/2019/sep/06/nhs-gender-identity-clinic-discloses-email-contacts-data-breach"}],"summary":"A London gender identity clinic has mistakenly exposed details of close to 2,000 people on its email list.  The Charing Cross Gender Identity Clinic sent patients an email about an art competition, with hundreds of others CC-ed in.  The clinic later tried to recall the message bu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c24b6ec8bbbfbecf7abcd5e6e93c2bb929a28657","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e258cf20-2bfe-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57434477b51c","org_name":"Buddy Dyer Campaign","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.orlandosentinel.com/politics/os-ne-dyer-campaign-mailer-20190924-ecg6bd2msfeinofpr7nhmi5jve-story.html"}],"summary":"  A mailer sent to some Orlando voters features Mayor Buddy Dyer standing with a group of children, stating a vote for him will “help Orlando reach new heights.”  But what prompted concerns from some was on the backside: A request form for a vote-by-mail ballot, with the voter’s ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-30","discovered_date":"2019-07-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd3fb9498fb2c2c245ffed86a3ce9064a26d692e","impact_type":"unknown","incident_date":"2019-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0500bfa64775","org_name":"NTCA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#NTCA%20-%20The%20Rural%20Broadband%20Association-2019-08-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2882505c91049a1d616aba8bbb1c7f07869d128","impact_type":"data_theft","imported_from":null,"incident_date":"2017-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1d2b5730f47b","org_name":"Coinmama","org_type":"financial","ransomware":null,"records_affected":478824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Coinmama","type":"hibp","url":"https://haveibeenpwned.com/Breach/Coinmama"}],"summary":"Coinmama reported a 2017 data breach affecting 478,824 subscribers, with email addresses, usernames, and password hashes exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f58f02c8a8d2baa20461994cb316503103a9cc50","impact_type":"data_theft","incident_date":"2019-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Carl%27s%20Golfland%20Notification%20California%20Letter%20Master3%204832-8611-8562%20v.2.pdf"},"notes":null,"org_country":"US","org_id":"df5928a14f09","org_name":"Carl's Golfland","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150216"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carl%27s%20Golfland%20Notification%20California%20Letter%20Master3%204832-8611-8562%20v.2.pdf"}],"summary":"Carl's Golfland reported that an individual obtained customer information through a breach of its online shopping website.","supporting_quote":null,"technology_involved":["online shopping website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce21c23131e6c13103f67f1252b40ec7b00a48c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f82ee030-de12-11e9-92e6-b7a271e742aa"},"incident_date":"2019-08-29","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"36464aba6119","org_name":"Taipei Hosptial","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.taipeitimes.com/News/taiwan/archives/2019/09/01/2003721498"}],"summary":"Department of Information Management Director Parng I-ming (龐一鳴) said that the ministry received information about a ransomware attack initiated early on Thursday at the ministry’s Taipei Hospital in New Taipei City.  However, the hospital restored the system within two hours and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"455eb9c7907e1e4e7d6032ead22e2bd0520c4f4e","impact_type":"data_theft","incident_date":null,"initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/RussellStover.pdf"},"notes":null,"org_country":"US","org_id":"42a506c62e6a","org_name":"Russell Stover Chocolates, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/RussellStover.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/RussellStover.pdf"}],"summary":"Russell Stover reported that malware at its retail stores’ POS systems may have enabled an unauthorized actor to acquire payment card data.","supporting_quote":"We recently became aware that an unauthorized actor had possibly gained access to Russell Stover’s point-of-sale (POS) systems through malware at Russell Stover’s retail stores.","technology_involved":["point-of-sale (POS) systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-29","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"e5103483fcdb0331dacbe7eaed27fc0fae9f95f9","impact_type":"data_theft","incident_date":"2019-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CorporateCreations.pdf"},"notes":null,"org_country":"US","org_id":"48f9b992a404","org_name":"Corporate Creations","org_type":"professional_services","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CorporateCreations.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CorporateCreations.pdf"}],"summary":"Corporate Creations reported unauthorized access to an office computer between July 17 and 24, 2019, and said personal information may have been acquired.","supporting_quote":null,"technology_involved":["office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc9fd2b2f26793a813908966992c5ba40f7dd4cd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"950bc800-de09-11e9-92e6-b7a271e742aa"},"incident_date":"2019-08-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48b1adcaeb2b","org_name":"Temple University Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kywnewsradio.radio.com/articles/news/temple-university-health-system-back-online-after-hack"}],"summary":"A Philadelphia hospital is getting back online after falling victim to a cyber attack.  Temple University Health System's computer system was hacked last week, according to officials.  They say the cyber attack compromised numerous operations from email to scheduling.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-28","discovered_date":"2019-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"11ddaedfabc3d4152a8edb8f9ae5e6c33ed477d1","impact_type":"unknown","incident_date":"2019-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b547b16d5b3","org_name":"Oregon Judicial Department","org_type":"unknown","ransomware":null,"records_affected":6607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Judicial%20Department-2019-08-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06833cae2ed38da5d48ac8603a3307f0f292614c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72a93f40-df21-11e9-9ff0-a5a30eaf0927"},"incident_date":"2019-08-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"d3ba15c2eddd","org_name":"UNICEF","org_type":"nonprofit","ransomware":null,"records_affected":8253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.devex.com/news/unicef-data-leak-reveals-personal-info-of-8-000-online-learners-95558;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.informationsecuritybuzz.com/expert-comments/unicef-data-leak-reveals-personal-info-of-8000-online-learners/"}],"summary":"The United Nations children’s agency, UNICEF, has inadvertently leaked personal information belonging to thousands of users of its online learning portal Agora.  The website offers free training courses to UNICEF staff and members of the public on issues such as child rights, hum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"GandCrab team","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e058f2b182410ca40bd0cf2c438c90e8e1eac8f8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6ba26d40-cfe8-11e9-aa40-01794b8efffe"},"incident_date":"2019-08-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b2dd694836a","org_name":"PerCSoft","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/,https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/,https://www.lawrencesystems.com/sodinokibi-ransomware-encrypts-hundreds-of-dental-practices-via-it-proviter-percsoft/"}],"summary":"Attackers attacked cloud backup vendor and used ransomware to encrypt customer data.  Vendor paid ransom.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"gandcrabteam"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-08-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dcba0159d4c258f90553c929185a29eb8630e86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c29df010-070a-11eb-ab9e-fb89bdbaf0c7"},"incident_date":"2019-08-26","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2088b92638bc","org_name":"Mille Lacs Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.messagemedia.co/millelacs/community/health/mlhs-email-security-breach/article_7a8149d2-a4e8-11ea-b433-b7fe621219bd.html"}],"summary":"Mille Lacs Health System email accounts were access by unauthorized external parties","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3ccde3828fae8ca6ea57375f0e6497e7eac6e81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ec145b70-1c2b-11ea-a0aa-479da677bbbc"},"incident_date":"2019-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5f94a5f474c","org_name":"Tots and Teens Pediatric Medicine","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.caller.com/story/news/local/2019/11/25/pediatric-office-corpus-christi-robstown-sends-letter-breach/4298840002/"}],"summary":"A pediatric facility sent a letter to parents of patients saying they had a data breach in August.   Tots and Teens Pediatric Medicine sent a notification letter to patients in November. The pediatric facility has offices in Corpus Christi and Robstown. The letter said names, add","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-22","discovered_date":"2019-07-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f95f1172c940a5c264f6a967b44c79c192d9613","impact_type":"unknown","incident_date":"2019-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"971fa6b69d05","org_name":"The UPS Store #3604","org_type":"unknown","ransomware":null,"records_affected":383,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20UPS%20Store%20%233604-2019-08-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a396fd7cfa4de735ad206b30dce65549555718c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ESS%20-%20CA%20Sample%20of%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c1c2a87071a8","org_name":"Eye Safety Systems, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ESS%20-%20CA%20Sample%20of%20Notice.pdf"}],"summary":"Eye Safety Systems said emails were sent from the server hosting its website to an unauthorized email address, and the incident may have involved names, addresses, and payment card information.","supporting_quote":null,"technology_involved":["website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e444fbcd3d23f1f453766e533f78f161fee1ff12","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CharlestonCounty.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"34fd435301ec","org_name":"Charleston County Human Resources","org_type":"unknown","ransomware":null,"records_affected":824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CharlestonCounty.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-20","discovered_date":"2019-05-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e08f1432b2d60a4203ed806dc3c0f3bd69f8059a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enclosures%20Joint.pdf"},"notes":null,"org_country":"US","org_id":"ec61d2eac1d4","org_name":"Alight Solutions LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149919"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enclosures%20Joint.pdf"}],"summary":"Alight Solutions disclosed that system-generated emails sent to SmartBenefits participants included Social Security numbers in email properties.","supporting_quote":null,"technology_involved":["email","SmartBenefits website","Federal Reserve Benefits Center"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-19","discovered_date":"2019-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fa503c65f66c02fea1a1dc8610bd3479cc6452b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notice%20of%20Data%20Breach.pdf"},"notes":null,"org_country":"US","org_id":"a757f96085cc","org_name":"Los Angeles Police Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149865"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notice%20of%20Data%20Breach.pdf"}],"summary":"A credit card systems vendor mistakenly sent an encrypted file containing members’ personal and financial information to another credit union, which certified that it destroyed the file.","supporting_quote":null,"technology_involved":["credit card systems"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6be19e4ba0601ce5b711ca0d6d1461e8c677214d","impact_type":"disruption_or_ransomware","incident_date":"2019-07-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"840188cf202c","org_name":"Hospice of San Joaquin","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149855"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification.pdf"}],"summary":"Hospice of San Joaquin reported a ransomware attack in which malicious software accessed its servers and may have accessed personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32b0e9b11c443569f3d71c4e11c3d9d83f6bb195","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8afc1710-daea-11e9-aa50-b778a2874faa"},"incident_date":"2019-08-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3d5869c034c","org_name":"Dealer Leads, LLC","org_type":"technology_saas","ransomware":null,"records_affected":198000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/198m-car-buyer-records-exposed-online/148231/,https://securitydiscovery.com/dealer-leads/,https://www.scmagazine.com/home/security-news/misconfigured-database-exposes-198m-records-on-prospective-auto-buyers/"}],"summary":"ES database left exposed to internet with PII and financial information of potential car buyers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-16","discovered_date":"2019-07-26","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82641a8164fd16e1c4190b8ed46eaa0b536d19af","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10505.pdf"},"notes":null,"org_country":"US","org_id":"c1884000ab9e","org_name":"Regence","org_type":"healthcare","ransomware":null,"records_affected":642,"reviewed":false,"root_cause":"The spreadsheet lacked a label for the Social Security number, so the print vendor mistook it for a mailing tracking number.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10505.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10505.pdf"}],"summary":"Regence members’ Social Security numbers were mistakenly printed on welcome-packet envelopes after a print vendor misinterpreted an unlabeled spreadsheet column.","supporting_quote":"As a result, your Social Security number was mistakenly included above your name on the address block of the welcome packet sent to you.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fedc9f4cb1b30904434bbd2add1a9cb0ad4f9fa","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c69135783578","org_name":"Chegg","org_type":"education","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Chegg","type":"hibp","url":"https://haveibeenpwned.com/Breach/Chegg"}],"summary":"Chegg suffered a data breach in April 2018 that exposed subscriber information, including passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74342b41febcab74d2485d17dfde0bbf9e30b8ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Business%20Client%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"321765b0b470","org_name":"Marks & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A social engineering scam allowed an unauthorized party to access an employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Business%20Client%20Notification.pdf"}],"summary":"Marks & Associates reported that a social engineering scam enabled unauthorized access to an employee email account and that personal information may have been exposed.","supporting_quote":"We were unfortunately the victims of a social engineering scam that allowed an unauthorized party or parties to access one of our employee’s email accounts and other portions of our network in November 2018.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"367224daf0ba873387ca2a376d9c903ff10f491d","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10504.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"734e9bf2b9ff","org_name":"Grays Harbor Community Hospital","org_type":"unknown","ransomware":null,"records_affected":88000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10504.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08fb22073c066eecaffb8869d625d483b8ea03ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc7270f0-ffde-11e9-830f-9f9afa6b578d"},"incident_date":"2019-08-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bb644f5613d","org_name":"Credit Karma","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/08/14/credit-karma-glitch-accounts/"}],"summary":"victim site serving personal information to the wrong customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-13","discovered_date":"2019-04-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33018c5e11a3cf0413a730e4c31a2079b65ff75c","impact_type":"unknown","incident_date":"2010-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d75fbc26d94","org_name":"Providence Health Plan","org_type":"unknown","ransomware":null,"records_affected":122411,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Providence%20Health%20Plan-2019-08-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2019-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8ab3d7c622ea7cdfb4e6164e09f76123d5add6c","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9fa36eee3276","org_name":"Cracked.to","org_type":"other","ransomware":null,"records_affected":749161,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cracked.to","type":"hibp","url":"https://haveibeenpwned.com/Breach/CrackedTO"}],"summary":"Cracked.to suffered a data breach that exposed email and IP addresses, usernames, private messages, and password hashes from its MyBB-based forum.","supporting_quote":null,"technology_involved":["MyBB-based forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e46265dab3be9af1a0e71bb3de95c63c07993a1","impact_type":"unknown","incident_date":"2019-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Capital%20One%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f467159d707f","org_name":"Capital One","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-539507"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149653"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150460"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Capital%20One-2019-09-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-08-09","discovered_date":"2019-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d365ad50176fe5de536b306d8bdec0e804c1a1e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/StockX%20Customer%20Notification%208-8-19%20FINAL.pdf"},"notes":null,"org_country":"US","org_id":"941bf8d93525","org_name":"StockX LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149617"},{"fetched_at":null,"title":"Have I Been Pwned: StockX","type":"hibp","url":"https://haveibeenpwned.com/Breach/StockX"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/StockX%20Customer%20Notification%208-8-19%20FINAL.pdf"}],"summary":"StockX reported unauthorized access to customer data from its cloud environment, including names, contact details, hashed passwords, and purchase history.","supporting_quote":null,"technology_involved":["cloud environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2019-08-06","discovered_date":"2019-07-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6317043ab8f871c2a78660ed56603bed820d2a9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vitagene_2_State%20Consumer%20Raw%20Genotype.pdf"},"notes":null,"org_country":"US","org_id":"0bea6e11e36e","org_name":"Vitagene, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149501"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vitagene_2_State%20Consumer%20Raw%20Genotype.pdf"}],"summary":"Vitagene reported that an archive database containing wellness reports and related data was potentially accessible to unauthorized individuals.","supporting_quote":null,"technology_involved":["archive database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"25e9c8a56382638e1d99286ed240ff7f14b26be6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/EatStreet.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"315752e11293","org_name":"EatStreet, Inc.","org_type":"unknown","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/EatStreet.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3fe05c2c72d059888ffee611e035ae480fd9699","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TBIM%20-%20CALIFORNIA%20Consumer%20Notificatoin%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fcb88befffb5","org_name":"TBI Mortgage Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149473"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c16c94c4f3f16dc548d55fa7b566c79fc76f8226","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8fdeb5b0-1d09-11ea-b94e-893211cca703"},"incident_date":"2019-08-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"310d354dcd76","org_name":"Mazankowski Alberta Heart Institute","org_type":"healthcare","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/records-of-650-patients-on-missing-computer-hard-drive-alberta-health-services/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.660citynews.com/2019/10/08/records-of-650-patients-on-missing-computer-hard-drive-ahs/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://edmonton.ctvnews.ca/patient-privacy-compromised-after-theft-from-the-mazankowski-1.4627715"}],"summary":"Alberta Health Services (AHS) says a computer hard drive that contained the personal health information of about 650 patients has been missing since August.  The agency says the external drive vanished from a cardiac outpatient clinical lab at the Mazankowski Alberta Heart Instit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d406694439c6a0a00d071953d1bfab0f48ab4c25","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/MansfieldEnergySimplified.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eab9081c879f","org_name":"Mansfield Energy Corp.","org_type":"unknown","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/MansfieldEnergySimplified.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-05","discovered_date":"2019-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5e6d966f67d228060619640ad7e09151a004d4b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jofit_Ad_CA_r3prf.pdf"},"notes":null,"org_country":"US","org_id":"c58ff311f9ea","org_name":"Jofit, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149466"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jofit_Ad_CA_r3prf.pdf"}],"summary":"Jofit reported potential unauthorized access to payment card information entered on its website checkout page.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-08-05","discovered_date":"2019-06-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f23ec051e2461ac5abb6be43303f738528e070c8","impact_type":"data_theft","incident_date":"2018-05-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Issue%20-%20Individual%20Notification.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"1fb82b895f91","org_name":"Amarin Pharma, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor database was misconfigured, allowing information to be accessed without proper authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149444"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Issue%20-%20Individual%20Notification.pdf"}],"summary":"Amarin reported that information in a vendor-maintained database was accessed and acquired after a database misconfiguration allowed unauthorized access.","supporting_quote":"On July 11, 2019, the vendor informed us that due to a database misconfiguration, information could have been accessed without proper authorization between May 2, 2018, and June 20, 2019.","technology_involved":["database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4647e14a145c14c3b98a5b376b9224dae19569d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ce76ba10-0a45-11ea-9821-617d71ee6253"},"incident_date":"2019-08-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.petri.com/data-leak-office-365-admin-center,"}],"summary":"The danger of making mistakes when changing cloud systems that run at massive scale was demonstrated on Thursday evening (August 3) when the Office 365 Admin Center suddenly started to reveal usage data belonging to other tenants. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-02","discovered_date":"2019-05-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d080369160603ac73791c615cb354ff76ab35be","impact_type":"data_theft","incident_date":"2018-09-23","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sark%20Notice%20of%20Data%20Security%20Incident%20%28California%29_1.PDF"},"notes":null,"org_country":"US","org_id":"2f88164cf931","org_name":"Sark Technologies LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Attackers exploited vulnerabilities in the SuperINN Plus web application, including an image upload vulnerability and SQL injection.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149410"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sark%20Notice%20of%20Data%20Security%20Incident%20%28California%29_1.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10501.pdf"}],"summary":"Attackers exploited vulnerabilities in Sark Technologies' SuperINN Plus web application and exported personal and cardholder data.","supporting_quote":"One or more attackers identified a vulnerability in an image upload function of the SuperINN Plus web application available to authenticated users that allowed the attacker to upload PHP web shells.","technology_involved":["SuperINN Plus web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-08-02","discovered_date":"2019-06-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"e4711a46a463ceeff9c5391711281265066af79c","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-09","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSN%20Final%20Proof%20%28Updated%29-07-30-2019.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e0d0c6db0f89","org_name":"Presbyterian Healthcare Services","org_type":"healthcare","ransomware":null,"records_affected":183370,"reviewed":false,"root_cause":"A deceptive email sent to employees led to unauthorized access to their email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Presbyterian%20Healthcare%20Services-2019-09-20"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSN%20Final%20Proof%20%28Updated%29-07-30-2019.pdf"}],"summary":"Presbyterian Healthcare Services reported unauthorized access to some employees’ email accounts after a deceptive email, exposing personal and medical information.","supporting_quote":"El 6 de junio del 2019, Presbyterian descubrió que hubo acceso anónimo no autorizado que se obtuvo mediante un mensaje engañoso enviado por correo electrónico a algunos de los empleados de Presbyterian alrededor del 9 de mayo del 2019.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-08-02","discovered_date":"2019-06-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4d6925254b3737b301f53ebfd73937ca14b3e42","impact_type":"data_theft","imported_from":null,"incident_date":"2018-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Baseball%20HoF%20Ad%20CA%20r5prf.pdf"},"notes":null,"org_country":"US","org_id":"0675bf83e2dd","org_name":"National Baseball Hall of Fame and Museum","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Baseball%20HoF%20Ad%20CA%20r5prf.pdf"}],"summary":"Malicious code on the Hall of Fame web store may have exposed customer personal and payment information.","supporting_quote":null,"technology_involved":["web store e-commerce system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a81ee030f63f0af6f933d5553d3bff881fe8458","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%2010_3_2019.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"1b969091e21b","org_name":"Telecare Corp","org_type":"healthcare","ransomware":null,"records_affected":821,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/hackers-try-to-divert-payments-to-telemedicine-company-into-fraudulent-bank-accounts.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-183191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%2010_3_2019.pdf"}],"summary":"Unauthorized parties accessed a Telecare email account containing information that may have included personal and health information, while imposters attempted to divert payments to a fraudulent bank account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b6cd5d16190061b563e5a3be191f455b942d141","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17f8b720-1c3d-11ea-a0aa-479da677bbbc"},"incident_date":"2019-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32c21eaa5244","org_name":"Sunshine Behavioral Health, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/exclusive-more-than-90000-patient-billing-files-from-an-alcohol-and-drug-addiction-treatment-network-exposed-online/"}],"summary":"Sunshine Behavioral Health, LLC is a private network of drug and alcohol addiction treatment facilities with locations in California, Texas, and Colorado. At some time as yet unknown to DataBreaches.net, approximately 93,000 patient files related to billings for patients at their","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["credentials"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84c75552a97eece21621d2baaae13496e1f6e7a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-07-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"d46432e6ffb9","org_name":"State Farm Mutual Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Letter.pdf"}],"summary":"A bad actor used credentials obtained from another source to attempt access to State Farm online accounts, and no sensitive personal information was viewable.","supporting_quote":"State Farm recently detected an information security incident in which a bad actor used a list of user IDs and passwords obtained from some other source, like the dark web, to attempt access to State Farm online accounts.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-08-01","discovered_date":"2019-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bb21f8dee686c208e1070f48b0b9b3ad4050265b","impact_type":"unknown","incident_date":"2019-06-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b91cfc3ee60e","org_name":"pickett dummigan mccall llp","org_type":"unknown","ransomware":null,"records_affected":278,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#pickett%20dummigan%20mccall%20llp-2019-08-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0985980659247627fc94a969da0cb70f951352ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49f30070-2099-11ec-82c4-4d3486f21395"},"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f81b6856206","org_name":"Network Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2019/12/domain-provider-network-solutions-announces-data-breach/"}],"summary":"Web.com disclosed a breach which resulted in unauthorized access to client data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9dae4fa5cce6fa5064060c1641656e3e3e7a6d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0e72f460-1d08-11ea-b94e-893211cca703"},"incident_date":"2019-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"92da60404b69","org_name":"National Nuclear Energy Generating Company of Ukraine","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://safehaven.com/news/Breaking-News/Security-Breach-Reveals-Crypto-Mining-In-Ukrainian-Nuclear-Plant.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.unian.info/economics/10658847-sbu-busts-cryptocurrency-miners-at-ukrainian-power-plant.html"}],"summary":"Ukrainian news media is reporting that last month an illegal cryptocurrency mining operation was discovered and confiscated on the site of a state-owned nuclear power plant in southern Ukraine. On July 10th Ukranian law enforcement and counterintelligence agencies discovered cryp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8fd6004dc125e9aaa8b3005716425109dd0d3ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e5ba380-cda9-11e9-b4e5-4769cce343a0"},"incident_date":"2019-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9e17e7495e9","org_name":"MUSC Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/musc-health-nurse-posted-unauthorized-photo-of-infant-patient-on-social-media.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.live5news.com/2019/08/29/live-investigates-babys-photo-posted-by-hospital-worker-without-permission/"}],"summary":"Charleston, S.C.-based MUSC Health recently notified the parent of an infant patient of a privacy breach in which an employee posted a photo of the baby on social media without parental consent, CBS affiliate WCSC reports.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","internal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6472df5dc7a3f1dd1128a051adfc9cba4a95ad37","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9e9a5030-ca6d-11e9-a165-8941f678e264"},"incident_date":"2019-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6334a6a5dcd8","org_name":"MoviePass","org_type":"technology_saas","ransomware":null,"records_affected":16100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/13935"}],"summary":"https://techcrunch.com/2019/08/20/moviepass-thousands-data-exposed-leak/,https://www.informationsecuritybuzz.com/expert-comments/moviepass-exposes-161m-records/,https://www.tvovermind.com/the-nightmare-continues-for-moviepass-with-massive-data-leak/","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d903444d92b2a5b5b1c013c266af5b605d0118","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a22fb320-0c89-11eb-ac0d-91a70ee1d655"},"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e15caa66973c","org_name":"MGM","org_type":"other","ransomware":null,"records_affected":10683188,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/exclusive-details-of-10-6-million-of-mgm-hotel-guests-posted-on-a-hacking-forum/"}],"summary":"Hackers share 10.6 million user records of MGM guests gathered through unknown hacking methods","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10103d68cb285f5c25419e0e2bfb7d2591984c18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d5ad6b30-cd0a-11e9-a052-6392f3b8c0e8"},"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LT","org_id":"766c38c78b01","org_name":"Hostinger","org_type":"technology_saas","ransomware":null,"records_affected":14000001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/08/25/web-host-hostinger-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?rct=j&sa=t&url=https://www.zdnet.com/article/hostinger-resets-customer-passwords-after-security-incident/&ct=ga&cd%EF%BF%BDEYACoUMTgxMzM5NzUxMzg2NjE3NjAxODAyGjUzZjc5ODdhMDkwMTNlMjc6Y29tOmVuOlVT&usg%EF%BF%BDQjCNGtVEPZnas5Q0zJ_2m5ZutIgp4Q6w;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hostinger.com/blog/security-incident-what-you-need-to-know/"}],"summary":"Hostinger, one of the biggest web hosting providers on the internet, has disclosed today a security incident that impacted its platform and users. n a blog post today, the company said a hacker gained access to an internal server, where he found an authorization token for an inte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b1f9871af9d40beee2ed817e79c2c4ba6e427a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e2f6e0e0-8e79-11ec-8536-fdd879d89dfb"},"incident_date":"2019-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e989dec9372c","org_name":"Equiniti","org_type":"financial","ransomware":null,"records_affected":740,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.financialreporter.co.uk/finance-news/hundreds-of-police-officers-sue-equiniti-over-pensions-data-breach.html"}],"summary":"In August 2019, Equiniti distributed 750 annual pension benefits statements on behalf of Sussex Police force after receiving updated contact details for the force’s officers. But Equiniti failed to properly update their database, resulting in pension statements being sent to the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36173ee8e986ede95d384db02e64654d6825bf24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46e17640-25c8-11eb-a3b1-07c4769263ea"},"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc1762d6db81","org_name":"Entercom","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/entercom-radio-giant-says-data-breach-exposed-user-credentials/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.crossingbroad.com/2020/03/entercom-hackers-obtained-radio-com-user-information.html"}],"summary":"Entercom says in a notice of data breach sent to affected customers and filed with California's Office of the Attorney General that the data breach was detected while investigating a cyberattack that took place in September 2019.     \"As part of our investigation into that attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7f8da359030b2d40cc373cffe87bbe030be393d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"efa4b7e0-0bf7-11ec-9c8a-d72b813bc8ca"},"incident_date":"2019-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9fcf5cdcd09","org_name":"City of Kaufman","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inforney.com/local-news/kaufman-among-texas-municipalities-targeted-in-ransomware-attack/article_b525c6da-c447-11e9-b660-d77b3cc25710.html"}],"summary":"Kaufman is among more than 20 Texas municipalities targeted in a coordinated August 16 ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aba4190995a8d0cd2064a2e4b09d16418e0ff21f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26feef20-cf47-11e9-89a9-015b821d7cea"},"incident_date":"2019-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc52b91a2767","org_name":"Chevron","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mercurynews.com/2019/08/27/credit-card-skimmers-discovered-at-woodside-gas-station/"}],"summary":"Credit Card skimmer found by employee on gas pump in Woodside CA","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5a8f643553f00d5ee48cdbba2ccfdbbc05582e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56aecca0-2b6c-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2da7c7ea648a","org_name":"Bowlin’s, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kvoa.com/news/local-news/2019/08/26/two-card-skimming-devices-found-at-gas-station-near-benson/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bensonnews-sun.com/news/article_5b433652-c8cf-11e9-82e9-a3fd62be7f9d.html"}],"summary":"skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80d301697c035b01adfe2515e1e66abc154aa992","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3535c790-ce60-11e9-b4e5-4769cce343a0"},"incident_date":"2019-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"fd7d68c8fd71","org_name":"Bavarian Red Cross","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.focus.de/digital/internet/bericht-ueber-datenskandal-bayerisches-rotes-kreuz-hat-sensible-blutspender-daten-an-facebook-gesendet_id_11072984.html"}],"summary":"The blood donation service of the Bavarian Red Cross has sent health-related data from potential donors to Facebook, including intimate information on HIV infections, pregnancies, drug use or diabetes. This reports the \"Süddeutsche Zeitung\" in her Tuesday edition.  The blood dono","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eb5f85ae5bd44c6d05a663a90dcd72b54a030cd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0ffd1380-1792-11eb-a388-210bf038e9e5"},"incident_date":"2019-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"7e6358f4cff9","org_name":"3Fun","org_type":"technology_saas","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/08/08/group-dating-app-3fun-security-flaws/"}],"summary":"Poorly designed swinger friendly app 3Fun was found to have many unfun vulnerabilities which disclosed a lot of very private information on all of their users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c75de34e1d59ff14a4fc50c56cdffdb50ae415c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"656b4d50-15e0-11ea-ba54-075d8b11bbd2"},"incident_date":"2019-07-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"54ef077ba047","org_name":"SEVEN-ELEVEN JAPAN CO.,LTD.","org_type":"retail_ecommerce","ransomware":null,"records_affected":808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/14068"}],"summary":"https://www.mobileworldlive.com/money/news-money/security-breach-brings-down-shutters-on-7pay/,https://www.theverge.com/2019/7/6/20684386/7-eleven-japan-shut-mobile-payments-app-7pay-security-flaw-cybersecurity,https://www.databreaches.net/security-breach-brings-down-shutters-on-","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ee218549f701c73869671ac6023634db5e6c68e","impact_type":"unknown","incident_date":"2019-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SaveDay%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3ad2a1837995","org_name":"SaveDay, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149374"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31734ea0ee1a74370f241e3589a9d99817b44f61","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"77811a7609ef","org_name":"Club Penguin Rewritten","org_type":"technology_saas","ransomware":null,"records_affected":4007909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Club Penguin Rewritten (July 2019)","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClubPenguinRewrittenJul2019"}],"summary":"A July 2019 breach exposed email addresses, IP addresses, usernames, and bcrypt-hashed passwords from Club Penguin Rewritten accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-07-29","discovered_date":"2019-06-25","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13a1959cef57af87dbe4a379fc43c7e1ff1ec939","impact_type":"data_theft","incident_date":"2019-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TTA_CA_Source.pdf"},"notes":null,"org_country":"US","org_id":"9beb3a6f84dd","org_name":"Trusted Tours & Attractions, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TTA_CA_Source.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Trusted%20Tours%20%26%20Attractions%2C%20LLC-2019-07-29"}],"summary":"An unauthorized person added code to Trusted Tours & Attractions’ e-commerce website that copied payment card information entered by purchasers and sent it to an external location.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2019-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e20a3ca469c8090d61f0b95225446f7b5009d120","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2019_0529_Final%20DraftLtr_CCTT%20Interface%20Record_Inadvertent%20Data%20Release_CDFA_BCC_MM_Admin%20ver.pdf"},"notes":null,"org_country":"US","org_id":"04263fd76ec0","org_name":"California Department of Food and Agriculture","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2019_0529_Final%20DraftLtr_CCTT%20Interface%20Record_Inadvertent%20Data%20Release_CDFA_BCC_MM_Admin%20ver.pdf"}],"summary":"The California Department of Food and Agriculture inadvertently emailed a file containing account manager and cannabis license information to an address associated with a state-licensed cultivator.","supporting_quote":null,"technology_involved":["California Cannabis Track-and-Trace system (CCTT)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f70a1457192ea1221c95dad84582a381629dcc3","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"253924648013","org_name":"Anime-Planet","org_type":"other","ransomware":null,"records_affected":368507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Anime-Planet","type":"hibp","url":"https://haveibeenpwned.com/Breach/AnimePlanet"}],"summary":"Anime-Planet suffered a data breach exposing subscriber usernames, IP and email addresses, dates of birth, and password hashes.","supporting_quote":null,"technology_involved":["Anime-Planet website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c638e6f479b6e4c42e6b52372cc3f6439f6499b","impact_type":"data_theft","imported_from":null,"incident_date":"2015-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d8b21e53036a","org_name":"Snail","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Snail","type":"hibp","url":"https://haveibeenpwned.com/Breach/Snail"}],"summary":"Snail suffered a data breach in March 2015 that exposed subscriber usernames, IP and email addresses, and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":["gaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a491d3c12938f24606d963c5c8b778933c004d2e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"dc8900e6bd4e","org_name":"LimeLeads","org_type":"technology_saas","ransomware":null,"records_affected":17838396,"reviewed":false,"root_cause":"An Elasticsearch server was exposed without security.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: LimeLeads","type":"hibp","url":"https://haveibeenpwned.com/Breach/LimeLeads"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/49-million-user-records-from-us-data-broker-limeleads-put-up-for-sale-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/49-million-user-records-from-us-data-broker-limeleads-put-up-for-sale-online/"}],"summary":"LimeLeads exposed contact records after an unsecured Elasticsearch server was accessible.","supporting_quote":"In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server.","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62d72ba2ec9066b6ac56a160c100bdf1bbdd6158","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ff78afec0131","org_name":"EpicNPC","org_type":"retail_ecommerce","ransomware":null,"records_affected":408795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: EpicNPC","type":"hibp","url":"https://haveibeenpwned.com/Breach/EpicNPC"}],"summary":"EpicNPC suffered a data breach affecting subscribers, exposing usernames, IP and email addresses, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"50d43df9d74941fbfabb17b40d703f034b783279","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10502.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bf80550163d2","org_name":"Community Psychiatric Clinic","org_type":"healthcare","ransomware":null,"records_affected":6600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10502.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10502.pdf"}],"summary":"Community Psychiatric Clinic reported unauthorized access to four employees’ Office365 email accounts, with no signs of data exfiltration and an attempted fraudulent wire transfer whose funds were recovered.","supporting_quote":null,"technology_involved":["Microsoft Office365","Outlook Web Access","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2019-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8953098801928cbbe2153eaa5f95f31bc5d1ed6a","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3bc084309e31","org_name":"Clash of Kings","org_type":"technology_saas","ransomware":null,"records_affected":1604957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Clash of Kings","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClashOfKings"}],"summary":"The Clash of Kings game forum suffered a data breach affecting subscribers, with usernames, IP and email addresses, and passwords stored as MD5 hashes included in the data.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f2ad644bd5f7dc6a669946823bd1f52b49932d2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9525f0f0-1c29-11ea-a0aa-479da677bbbc"},"incident_date":"2019-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74c50923b050","org_name":"Equinox","org_type":"healthcare","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesunion.com/news/article/Former-current-Equinox-clients-affected-by-data-14887304.php"}],"summary":"Equinox, the Albany-based human services agency, has learned of a data breach that may impact the protected health information of more than 1,000 current and former clients.  The agency reported Friday that on July 26, staff discovered unusual activity within its \"digital environ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-24","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95486e77868523b225c12d143bc7136d6aee772e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Western%20Pathology%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"f27e2ee80b2e","org_name":"Western Pathology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149197"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Western%20Pathology%20Sample%20Notification%20Letter.pdf"}],"summary":"Western Pathology reported unauthorized access to an AMCA database containing information belonging to its patients.","supporting_quote":null,"technology_involved":["AMCA website payment page","AMCA database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMCA"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2019-07-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9b1ca56bd5600523162240655800c4d49d3d0cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f0ddc780-15e2-11ea-ba54-075d8b11bbd2"},"incident_date":"2019-07-24","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c090e4fae1ce","org_name":"Niche.com Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Niche%20_%20Notice%20of%20Data%20Breach%20Letter.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149877"}],"summary":"credential stuffing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-24","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"752974eb81bd9616e796a92d6c896f67934ef255","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lab%20Medicine%20Consultants%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"a27c2480ddb7","org_name":"Laboratory Medicine Consultants, Ltd.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149195"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lab%20Medicine%20Consultants%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10500.pdf"}],"summary":"Laboratory Medicine Consultants reported that an AMCA incident involved unauthorized access to an AMCA database containing information belonging to its patients.","supporting_quote":null,"technology_involved":["AMCA website","AMCA database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMCA"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e30b1c734a4d711d1cd540f3111cf86ed35400e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72fa6fe0-1c53-11ea-ac81-937b5ec4147f"},"incident_date":"2019-07-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eee073e6385b","org_name":"Aegis Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gainesville.com/news/20191111/mount-dora-medical-company-reports-minor-data-breach"}],"summary":"A Mount Dora medical company caught an employee trying to sell patient information earlier this year, according to a statement sent Friday.  An apparent data breach at Aegis Medical Group, a Mount Dora-based healthcare network, was revealed to the group by the U.S. Secret Service","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8295046fba2ddc3cd2df3b1905bb121cfb04c46f","impact_type":"data_theft","incident_date":"2019-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ZBC%20Customer%20Notice%207-23-19.pdf"},"notes":null,"org_country":"US","org_id":"051ac8dbd3c2","org_name":"Zions Bancorporation, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ZBC%20Customer%20Notice%207-23-19.pdf"}],"summary":"Zions Bancorporation reported unauthorized access to its computer network around June 1, 2019, with some online banking customer records viewed or exported.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3da7be27ebdcddd0e41347e571113ce749566c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CM%20CA%20Client.pdf"},"notes":null,"org_country":"US","org_id":"e12731c500d8","org_name":"SterlingRisk","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-149137"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CM%20CA%20Client.pdf"}],"summary":"An unauthorized person accessed a SterlingRisk employee’s email account in a phishing incident, and the investigation could not determine whether personal information was viewed or acquired.","supporting_quote":"On April 17, 2019, we completed our forensic investigation into an email phishing incident and determined that an unauthorized person gained access to an email account belonging to a SterlingRisk employee on April 3, 2019.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e3405720c1a9cd4e7617930632f5d8cd8313c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e730f320-0ad8-11ea-9821-617d71ee6253"},"incident_date":"2019-07-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"cf4f4a88f34f","org_name":"YouHodler","org_type":"financial","ransomware":null,"records_affected":86000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-youhodler-leak/?=1b,https://tokenpost.com/Crypto-loan-startup-YouHodler-exposed-unencrypted-data-of-86-million-customers-assures-no-one-was-affected-2796"}],"summary":"Cryptocurrency loan startup YouHodler has reportedly exposed reams of private financial data including credit card information and various user transactions after it forgot to protect its server with a password","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e222e2bba2276d399877e45cea484b5fc81c31f","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0ed3b4724152","org_name":"Xiaomi","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Xiaomi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Xiaomi"}],"summary":"A breach of the Xiaomi user forum exposed email addresses, usernames, IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":["Xiaomi user forum website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c73de0fd0a18e26112b9b102efd7e1cf39df25e3","impact_type":"data_theft","imported_from":null,"incident_date":"2018-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6cff56c860e3","org_name":"Stronghold Kingdoms","org_type":"technology_saas","ransomware":null,"records_affected":5187305,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Stronghold Kingdoms","type":"hibp","url":"https://haveibeenpwned.com/Breach/StrongholdKingdoms"}],"summary":"A July 2018 breach of Stronghold Kingdoms exposed email addresses, usernames, and passwords stored as salted SHA-1 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e661cee45f395512237dd7d4a4547903ee193c4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c72c0920-0ae2-11ea-a7de-15b14f857e77"},"incident_date":"2019-07-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"e48c6370a724","org_name":"Oranga Tamariki","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/national/114436456/domestic-violence-victims-privacy-breached-by-oranga-tamariki"}],"summary":"ministry for children releases customer address to abusive ex spouse in error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e110eb7b7bd38f8743e37a0696b542396585e79d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e6dd9320-de0e-11e9-92e6-b7a271e742aa"},"incident_date":"2019-07-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"44e4f1d9a362","org_name":"neoclinical","org_type":"professional_services","ransomware":null,"records_affected":37000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/upguard-finds-information-on-over-37000-australia-and-new-zealand-clinical-trial-participants-in-the-wild/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.smh.com.au/business/companies/thousands-of-medical-histories-exposed-in-data-breach-20190807-p52euq.html"}],"summary":"A database containing information on individuals from Australia and New Zealand has been uncovered, with the exposed data connected to clinical trials.  As UpGuard detailed in a blog post, the database belonged to Neoclinical, an Australia-based company that matches individuals w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8b66aea1c0db9a9823bd8f4ef8735bf3458f489","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e23e14e30149","org_name":"GameSalad","org_type":"technology_saas","ransomware":null,"records_affected":1506242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GameSalad","type":"hibp","url":"https://haveibeenpwned.com/Breach/GameSalad"}],"summary":"A February 2019 breach exposed GameSalad account email addresses, usernames, IP addresses, and SHA-256-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc30fa67034db012f1ed1dd887d3728ef39defdd","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"58a3ca18c14d","org_name":"Flash Flash Revolution","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Flash Flash Revolution (2019 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/FlashFlashRevolution2019"}],"summary":"Flash Flash Revolution suffered a 2019 data breach exposing member email and IP addresses, usernames, dates of birth, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9a7efe471225b4651c568cf59a4d25890484a5a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4748f77b5772","org_name":"Armor Games","org_type":"technology_saas","ransomware":null,"records_affected":10604307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Armor Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/ArmorGames"}],"summary":"Armor Games reported a breach affecting email addresses, usernames, IP addresses, birthdays, and passwords stored as salted SHA-1 hashes.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-19","discovered_date":"2019-07-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0f3d40d2d029ccce997a919312ffc611443942c","impact_type":"unknown","incident_date":"2019-04-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e0e731136d39","org_name":"The Party Source, Inc.","org_type":"unknown","ransomware":null,"records_affected":1028,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Party%20Source%2C%20Inc.-2019-07-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f88a17b6f9300fde53f6983a18761959fba2dc33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5891e600-0584-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-07-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6066f361f44d","org_name":"Texas Health Resources","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.texashealth.org/arlington/about-texas-health-arlington-memorial/a-message-to-our-patients,https://healthitsecurity.com/news/texas-health-resources-data-breach-impacts-82k-patients"}],"summary":"Texas Health Resources recently filed 15 breach notifications, stemming from a misconfiguration error in its billing system that compromised the data of 82,577 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a84d4a3554d651dc76408defbe2092f8db4531f7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1b3f71bea265","org_name":"Roll20","org_type":"technology_saas","ransomware":null,"records_affected":3994436,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Roll20","type":"hibp","url":"https://haveibeenpwned.com/Breach/Roll20"}],"summary":"Roll20 reported a December 2018 data breach that exposed customer email and IP addresses, names, password hashes, and partial credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-19","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c95250e8d4e341681ba14c98eccb0638528e8012","impact_type":"unknown","incident_date":"0001-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d3141b73f80c","org_name":"Oregon State University","org_type":"unknown","ransomware":null,"records_affected":627,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20State%20University-2019-07-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16a0f527068684206fcd81bebdf5a3fe98cba766","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-06-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"c66126589e6d","org_name":"Artvalue.com","org_type":"professional_services","ransomware":null,"records_affected":157692,"reviewed":false,"root_cause":"A file containing subscriber data was publicly exposed on the Artvalue.com website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Artvalue.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Artvalue"}],"summary":"Artvalue.com publicly exposed subscriber names, usernames, email addresses, and password hashes in a text file on its website.","supporting_quote":"In June 2019, the France-based art valuation website Artvalue.com (now defunct) left their 158k member subscriber base publicly exposed in a text file on their website.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de38d8b3a3712efa410ebe85fbafb07aee515fee","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9617b4a5014d","org_name":"YouNow","org_type":"technology_saas","ransomware":null,"records_affected":18000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: YouNow","type":"hibp","url":"https://haveibeenpwned.com/Breach/YouNow"}],"summary":"Data associated with YouNow users appeared for sale on a dark web marketplace, including email addresses, IP addresses, names, usernames, and social media profile links.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"745346dacb4107b6511742eb8b8636a9ddb04940","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d8dec40-c8ed-11e9-9c16-3f32faecab86"},"incident_date":"2019-07-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"417aa4e73076","org_name":"Clinicare Walk-in Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-patient-horrified-after-medical-information-left-at-curb-outside-london-walk-in-clini/"}],"summary":"Ontario's information and privacy commissioner is investigating after a clear plastic bag containing documents with patient names and medication information was left at the curb outside a London walk-in clinic.   One patient whose information was in the bag said she's furious the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b8c453df443178c429d891276ba6cc27f9b9632","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BG","org_id":"35d431642633","org_name":"Bulgarian National Revenue Agency","org_type":"government","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bulgarian National Revenue Agency","type":"hibp","url":"https://haveibeenpwned.com/Breach/BulgarianNationalRevenueAgency"}],"summary":"Data attributed to the Bulgarian National Revenue Agency, including personal and taxation information, circulated online in July 2019.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7945407ed05c8950b853ac4ec005c49910a2776a","impact_type":"unknown","incident_date":"2015-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Slack%20User%20Notices.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b38ec632978a","org_name":"Slack Technologies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148983"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7c38790fd47b3e3be6b4147fd8b0c4311fe1900","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian_E7574_L01_SAS_Proof.PDF"},"notes":null,"org_country":"US","org_id":"f202faf7de21","org_name":"C&S Wholesale Grocers, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian_E7574_L01_SAS_Proof.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/C%26SWholesaleGrocers.pdf"}],"summary":"C&S Wholesale Grocers notified affected people of an incident involving certain personal information they had provided to the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b0fa4600bd0638c1aea8b5791137533dd5680d5","impact_type":"data_theft","imported_from":null,"incident_date":"2019-07-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5e9900326465","org_name":"BlackSpigotMC","org_type":"other","ransomware":null,"records_affected":140029,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BlackSpigotMC","type":"hibp","url":"https://haveibeenpwned.com/Breach/BlackSpigotMC"}],"summary":"BlackSpigotMC’s XenForo forum site was allegedly compromised by a rival hacking website, and leaked data included user information and bcrypt password hashes.","supporting_quote":null,"technology_involved":["XenForo forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-17","discovered_date":"2019-06-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"089f8243b1db9f17acfeda13275b1d6aabda58a2","impact_type":"unknown","incident_date":"2019-06-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0510b8863ddf","org_name":"Applied Ecological Services","org_type":"unknown","ransomware":null,"records_affected":497,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Applied%20Ecological%20Services-2019-07-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e68dd24d5c04da57023ee712912c8cf7582553f1","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7702dbe1cd1a","org_name":"piZap","org_type":"technology_saas","ransomware":null,"records_affected":41817893,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: piZap","type":"hibp","url":"https://haveibeenpwned.com/Breach/piZap"}],"summary":"A breach of piZap exposed user email addresses, personal details, Facebook profile links, and some SHA-1 hashed passwords.","supporting_quote":null,"technology_involved":["piZap"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc396cedc0523447747400a437cae173a97efd06","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b136c3a0-c35a-11e9-a1ca-07083fc9ae26"},"incident_date":"2019-07-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69a04f6ba519","org_name":"iNSYNQ","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/"}],"summary":"cloud services company hit by ransomware encrypting their and their customer's data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-24","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0562731c794431607b667bc1922fd4a8c7407397","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Zero%20Technologies%20-%20Regulator%20Notice%20-%20CA-Cover%20document%20Deleted.pdf"},"notes":null,"org_country":"US","org_id":"d7abafccdf95","org_name":"Zero Technologies, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability on Zero's website permitted access to customer payment card information when exploited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148911"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Zero%20Technologies%20-%20Regulator%20Notice%20-%20CA-Cover%20document%20Deleted.pdf"}],"summary":"Zero Technologies reported that an exploited website vulnerability allowed unauthorized access to obfuscated payment card information and potentially other customer information.","supporting_quote":"On or around May 24, 2019 we determined that there was evidence that the vulnerability was exploited and that there was unauthorized access to obfuscated payment card information used at www.zerowater.com.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d6a00a064b6f0d07dcf6fe7f7191d37124ed698","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sunrise%20Letter%20Enclosure%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"2da9dddb9d74","org_name":"Sunrise Medical Laboratories, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148939"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sunrise%20Letter%20Enclosure%20-%20Sample%20Notification%20Letter.pdf"}],"summary":"Sunrise Medical Laboratories reported that an AMCA incident involved unauthorized access to an AMCA database containing information belonging to Sunrise patients.","supporting_quote":null,"technology_involved":["AMCA website payment page","AMCA database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMCA"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1b662215c3e816b4fc2311df18d5f3a23187258","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"db508db0-3027-11ec-a5c2-337d0141f916"},"incident_date":"2019-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43ed7384d9f4","org_name":"PrimoHoagies Franchising, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/primohoagies-notifies-customers-of-data-security-incident/"}],"summary":" PrimoHoagies Franchising, Inc. experienced a breach that resulted in multiple months worth of payment cards being taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43a9ee87db0cb1f085829aa9b25104891ff2f227","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Northwood%20CA-Cover%20document%20deleted.pdf"},"notes":null,"org_country":"US","org_id":"865eeec9d331","org_name":"Northwood, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email captured an employee’s login credentials, enabling access to the employee’s email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148920"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Northwood%20CA-Cover%20document%20deleted.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwood%2C%20Inc.-2019-07-15"}],"summary":"A phishing email captured an employee’s login credentials, allowing an unauthorized individual to access the employee’s email account; Northwood could not confirm whether personal information was accessed.","supporting_quote":"On May 6, 2019, Northwood became aware of suspicious activity relating to an employee email account, as a result of a phishing email that captured the employee’s login credentials.","technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f78fb460dca23835248b0644d9a1c2765bede7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1bfcc1f0-d56a-11e9-8558-6543aabf247e"},"incident_date":"2019-07-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"b0ae32b07f4b","org_name":"Librería Porrúa","org_type":"technology_saas","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2019/08/06/attackers-ransom-booksellers-exposed-mongodb-database/"}],"summary":"breach 1: researcher found and disclosed public mongoDB database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06e5fd82e7452a0015cf6665b4ce7edf2d4256d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Template.pdf"},"notes":null,"org_country":"US","org_id":"6e0d82a8fb72","org_name":"Laboratory Corporation of America Holdings","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148937"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Template.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/LabCorp.pdf"}],"summary":"LabCorp disclosed that its collection agency AMCA experienced unauthorized access to a web payment system that may have exposed patient information.","supporting_quote":null,"technology_involved":["AMCA web payment page"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"American Medical Collection Agency"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6303dd7a412e84939655d0836d630c4a6fd54edb","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clinical%20Path%20Labs%20-%20Letter%20Enclosure%20-%20Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"25f2ba8378cf","org_name":"Clinical Pathology Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148940"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clinical%20Path%20Labs%20-%20Letter%20Enclosure%20-%20Sample%20Notification%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10647.pdf"}],"summary":"Clinical Pathology Laboratories reported that an incident involving its vendor AMCA’s payment page and database may have exposed patients’ personal, service, balance, and treatment-provider information.","supporting_quote":null,"technology_involved":["AMCA website payment page","AMCA database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMCA"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-07-15","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59ea5ebb6f906990c4c2dadafdc94d54e6ee02e6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CBLPath%20-%20Notification%20Letters%20-%20Enclosure.pdf"},"notes":null,"org_country":"US","org_id":"2b9f5d9ea397","org_name":"CBLPath, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148938"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CBLPath%20-%20Notification%20Letters%20-%20Enclosure.pdf"}],"summary":"CBLPath patient information was involved in unauthorized access to an AMCA database during an incident affecting AMCA’s payment page.","supporting_quote":"On May 15, 2019, we were notified that AMCA experienced a data security incident that involved the payment page on AMCA’s website and unauthorized access to an AMCA database containing information belonging to CBLPath’s patients.","technology_involved":["AMCA website payment page","AMCA database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AMCA"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-15","discovered_date":"2019-05-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b150d64bb22fac1be9055105b94c52cebbe319b4","impact_type":"unknown","incident_date":"2019-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7b5bd823ea33","org_name":"Cancer Treatment Centers of America at Southeastern Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":4559,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America%20at%20Southeastern%20Regional%20Medical%20Center-2019-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-15","discovered_date":"2019-06-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cf04e517921ebfc50077a011285111d93489a4a9","impact_type":"unknown","incident_date":"2019-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c5007ba1943","org_name":"Cancer Treatment Centers of America at Eastern Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":3904,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America%20at%20Eastern%20Regional%20Medical%20Center-2019-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other","personal"],"disclosed_date":"2019-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a616d6c1d25fa64ce014f3d7cde07573d359771e","impact_type":"unknown","incident_date":"2019-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"8204c8a4e1d2","org_name":"Mindjolt","org_type":"unknown","ransomware":null,"records_affected":28364826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mindjolt","type":"hibp","url":"https://haveibeenpwned.com/Breach/MindJolt"}],"summary":"In March 2019, the online gaming website MindJolt suffered a data breach that exposed 28M unique email addresses . Also impacted were names and dates of birth, but no passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-07-13","discovered_date":"2019-05-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9512bf9aba2dec2936aab26aa21ccbfc7943db41","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10645.pdf"},"notes":null,"org_country":"US","org_id":"6e0d82a8fb72","org_name":"Laboratory Corporation of America Holdings","org_type":"healthcare","ransomware":null,"records_affected":18330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10645.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Laboratory%20Corporation%20of%20America%20Holdings%20%28LabCorp%29-2019-07-17"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10645.pdf"}],"summary":"An unauthorized user accessed the former vendor American Medical Collection Agency’s system, potentially exposing LabCorp patient and payment information.","supporting_quote":"AMCA has told LabCorp it appears that an unauthorized user had access to AMCA’s system between August 1, 2018 and March 30, 2019 and that AMCA cannot rule out the possibility that personal information on AMCA’s system was at risk during that time period.","technology_involved":["web payment page"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"American Medical Collection Agency"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"63b450677d57","name":"AMCA"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-12","discovered_date":"2019-06-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b298b368c896ff24048e347a51d1cad232d93047","impact_type":"unknown","incident_date":"2019-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a9747343dc6e","org_name":"Otak, Inc.","org_type":"unknown","ransomware":null,"records_affected":1145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Otak%2C%20Inc.-2019-07-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed7b64a9d09fe7dec5aa74c578e8c27c303f1b2f","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"a3c3705955b0","org_name":"Zhenai.com","org_type":"other","ransomware":null,"records_affected":5024908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Zhenai.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zhenai"}],"summary":"A December 2011 data breach at Zhenai.com exposed subscribers’ email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20a57b083e83c4c955140dd636146cd05e90f1a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33b78050-6c8b-11eb-ae4f-03e1e00a9a54"},"incident_date":"2019-07-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"5ad7339ec1ba","org_name":"Gekko Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/leemathews/2019/11/23/hotel-giant-leaks-1tb-of-data-including-customer-credit-cards/?sh=5e6e03a67f36"}],"summary":"Misconfigured server from Travel booking giant, Gekko Group, leaks 1tb of data including customer credit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-07-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6ba5e62f37fac4b07891c666a0d5dfa65ec40b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Miller%20Kaplan%20--%20Consumer%20Notification%20Letter%20--%20ID%20Experts%202019.08.20%20Proof.pdf"},"notes":null,"org_country":"US","org_id":"790f94f72844","org_name":"Miller Kaplan Arase LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150465"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148817"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Miller%20Kaplan%20--%20Consumer%20Notification%20Letter%20--%20ID%20Experts%202019.08.20%20Proof.pdf"}],"summary":"An unauthorized individual accessed an employee email account, which may have contained personal, financial, and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0667b60b9676e643ff0761000a065421fa7c0a7f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a2d88230-0c70-11ea-bb2f-edf349509116"},"incident_date":"2019-07-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17fe2609a72a","org_name":"Syracuse City School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.syracusecityschools.com/districtpage.cfm?pageid=10978,https://www.syracuse.com/news/2019/07/syracuse-cyber-attack-experts-say-schools-easy-prey-for-ransomware.html,https://securityboulevard.com/2019/07/syracuse-ransomware-operators-increase-their-demands-as-victims-miss-payment-deadlines/"}],"summary":"ransomware at school district","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-09","discovered_date":"2019-06-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b39b860ae19f2502378c0f6ddc7effcbd8deed7","impact_type":"unknown","incident_date":"2018-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f5f848b91dc8","org_name":"Datamars Inc.","org_type":"unknown","ransomware":null,"records_affected":117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Datamars%20Inc.-2019-07-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7567e0eb40ca318eebd6be52c8fc3984f6738be2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f7a051f0-1f95-11ec-aba2-27b717aed560"},"incident_date":"2019-07-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a8e0cbf6bef","org_name":"Premier Family Medical","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.modernhealthcare.com/cybersecurity/utah-practice-says-320000-patient-records-hit-ransomware-attack"}],"summary":"More than 300,000 patients had data compromised in a July ransomware attack at Premier Family Medica","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2a1b3f530cef14161f4489b267aeda40a7e3a8a","impact_type":"unknown","incident_date":"2019-03-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nemadji%20CA%20AG%20-%20Exhibit%201-Cover%20document%20deleted_1.pdf"},"notes":null,"org_country":"US","org_id":"f71bb36d011c","org_name":"Nemadji Research Corporation d/b/a California Reimbursement Enterprises","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nemadji%20CA%20AG%20-%20Exhibit%201-Cover%20document%20deleted_1.pdf"}],"summary":"Nemadji Research Corporation reported a security incident and said it took steps to prevent further access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-08","discovered_date":"2019-05-31","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5c6d6bd36ce5c7a4d129f999af970b2d64cc941f","impact_type":"unknown","incident_date":"2019-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c516495b1d52","org_name":"Multnomah County Dept of Human Services","org_type":"unknown","ransomware":null,"records_affected":713,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Multnomah%20County%20Dept%20of%20Human%20Services-2019-07-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-08","discovered_date":"2019-05-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f1d03505fba1a43d1a4c3514bc2aa0d35b8e045","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ameritas%20Ad%20r1prf.pdf"},"notes":null,"org_country":"US","org_id":"efab6167daab","org_name":"Ameritas Life Insurance Corp.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Associates were tricked by a phishing campaign into providing their email credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148741"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ameritas%20Ad%20r1prf.pdf"}],"summary":"Ameritas reported that a phishing campaign compromised several associates’ email inboxes.","supporting_quote":"On May 9, 2019, Ameritas discovered a few associates fell victim to a phishing campaign that was designed to trick the recipient into providing their email credentials.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"692ff2b510c5c4d1dee8b9fe3ba4e39e1a5afbb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe3911d0-c8f0-11e9-9c16-3f32faecab86"},"incident_date":"2019-07-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"1f9289ed78ee","org_name":"Honda Motor Manufacturing","org_type":"manufacturing","ransomware":null,"records_affected":134000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/honda-motor-company-leaks-database-with-134-million-rows-of-employee-computer-data/"}],"summary":"On the eve of releasing its financial earnings for the past quarter, Honda created a situation described by one security researcher as “a hacker’s dream”. According to Verdict, 40GB of critical company data – amounting to 134m rows of system data – was stored on an unsecured Elas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad6c19763b589edf68606019ace1203bca658a3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Samsung%20Customer%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"b4254b586791","org_name":"Sprint","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Samsung%20Customer%20Letter.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10644.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Sprint.pdf"}],"summary":"Sprint notified affected people that personal information, including account and billing details, may have been viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-07-03","discovered_date":"2019-06-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6ba04bdac70f115dcac6ff8d02648df40f52528","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SkinSolutions%20MD%20Ad%20CA.pdf"},"notes":null,"org_country":"US","org_id":"8f185236c4ec","org_name":"SkinSolutions.MD LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SkinSolutions%20MD%20Ad%20CA.pdf"}],"summary":"SkinSolutions.MD LLC reported that an unauthorized individual may have accessed its checkout website and information entered there, including names and payment card details.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-07-03","discovered_date":"2019-06-24","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"595a6aef84eb20ab3ad80dac97836a55f76c2888","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-06-14","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10643.pdf"},"notes":null,"org_country":"US","org_id":"76e4ec4076bc","org_name":"Riggs Wealth Management","org_type":"financial","ransomware":null,"records_affected":1205,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10643.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10643.pdf"}],"summary":"An unauthorized person accessed an employee’s email account at Riggs Wealth Management after a phishing email incident; the account contained personal and financial information.","supporting_quote":"On June 24, 2019, RWM’s ongoing investigation into a phishing email incident determined that an unauthorized person had obtained access to an email account belonging to an RWM employee.","technology_involved":["email account","OneDrive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09ce639534d83ef1094c101ebc5c8fe48883a7af","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0190acb0-b476-11e9-b6ed-d1eb4820968c"},"incident_date":"2019-07-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb1299bccc3e","org_name":"PM Consultants","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://tdn.com/news/local/local-dental-offices-hit-by-malware-forced-to-cancel-appointments/article_d4a6fc1e-f4c4-5ef0-9974-3b7bee11bab8.html"}],"summary":"Ransomware on a software as a service infrastructure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4250e68bbddb948639af3a424585240175f3c854","impact_type":"unknown","incident_date":"2019-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20AG%20Notification%20Letter%20-%20Submission-%20letter%20to%20AGO%20deleted.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ac2db48305e","org_name":"FlexCare, LLC d/b/a FlexCare Medical Staffing","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148662"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbc035fdf6306eb45d2f4f8b29ea2c7edd5a29cb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48789bf0-c8f4-11e9-9c16-3f32faecab86"},"incident_date":"2019-07-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7c7833fb7b2e","org_name":"St John's Ambulance","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spamfighter.com/News-22327-St-John%27s-Ambulance-become-victim-of-a-ransomware-attack.htm"}],"summary":"St John's Ambulance, the first-aid charity, confirmed that it become victim of a ransomware attack that occurred at 9am on Tuesday (i.e. on July 2, 2019). The charity, which offers volunteer medical services, said that the attack temporarily blocked them from accessing the data t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"949526072a244612fdab86ee6966d8314d6ad5f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45e6cf90-c81a-11e9-994f-43faafd7feda"},"incident_date":"2019-07-02","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f9a27f7445d","org_name":"choice hotels","org_type":"other","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.com/choice-hotels-700000-guest-records-exposed-a-12913"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/700000-choice-hotels-records-leaked-in-data-breach/"}],"summary":"700,000 records belonging to Choice Hotels have reportedly been stolen with hackers demanding payment for their return.   Comparitech, in collaboration with security researcher Bob Diachenko, found an unsecured database containing data belonging to the hotel franchise on July 2, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-07-02","discovered_date":"2019-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed73944eb822a0ea3d871d4374e46c6dc940e600","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%2012%20month%20generic.pdf"},"notes":null,"org_country":"US","org_id":"df38401841af","org_name":"Backcountry Edge, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%2012%20month%20generic.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Backcountry%20Edge%2C%20Inc.-2019-07-02"}],"summary":"Backcountry Edge reported that a cyberattack on its website may have resulted in unauthorized access to customers' personal and payment information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e99fd2dbe4d83d37d6c9b878c19734565655112d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0c2d7550-2f35-11eb-be94-ff2f41197b3c"},"incident_date":"2019-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbf4852126a3","org_name":"Truman Medical Centers","org_type":"healthcare","ransomware":null,"records_affected":114446,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/stolen-laptop-potentially-exposes-114-000-missouri-hospital-patients.html"}],"summary":"Truman medical staff had their laptop stolen from their car which contained 114,446 patient's information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1480f73c256980ad83ff64fe4d1955bcbfab5bc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80fdb430-beb1-11e9-b2db-f769187145bf"},"incident_date":"2019-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"fa2e95fa6726","org_name":"QuickBit","org_type":"financial","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://tokenpost.com/Major-crypto-data-leak-impacts-300K-users-2730;"},{"fetched_at":null,"title":null,"type":"press","url":"https://bitcoinmagazine.com/articles/quickbit-confirms-data-leak;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.americancryptoassociation.com/2019/07/23/swedish-cryptocurrency-exchange-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://investor.quickbit.eu/pressreleases/uppdatering-om-dataincident-2/"}],"summary":"Swedish crypto exchange QuickBit recently confirmed that it had indeed committed a major blunder in the form of a data leak that could impact as many as 3,00,000 users of the platform. This involves essentially placing customer data on an unprotected database that was accessible ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbf974be8e55b3dd46f1c672e6674b7c2b297e21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6352dbb0-de08-11e9-92e6-b7a271e742aa"},"incident_date":"2019-07-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2cc5d34c0777","org_name":"Michigan Medicine","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spamfighter.com/News-22389-Around-5500-patients-PHI-exposed-in-phishing-attack-on-the-Michigan-Medicine.htm"}],"summary":"Around 5,500 patients of the Michigan Medicine are getting notified regarding the phishing email campaign, which might have exposed a few of their PHI (Protected Health Information).     In July 2019, employees of the Michigan Medicine were targeted in a huge scale phishing campa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4b05fe0a7406b82640fb7acd4c8c046fbffd429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f591ce10-2820-11eb-8365-4f57e2156a07"},"incident_date":"2019-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"0ac99e39692a","org_name":"Mahaveer Pharma","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://economictimes.indiatimes.com/industry/healthcare/biotech/pharmaceuticals/pharma-company-accountant-held-for-sharing-its-data-with-rival-firm/articleshow/70853844.cms"}],"summary":"Employee of Mahaveer Pharma stole data to sell to a competitor ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65af70ce8cf3cd008f77192e36b4ec390bba649a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d02a6ea0-0591-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43e527d0aa89","org_name":"Leadership for Educational Equity","org_type":"education","ransomware":null,"records_affected":3600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securitydiscovery.com/leadership-for-educational-equity/"}],"summary":"Leadership for Education Equality left public open elastic search database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71dd7ad8eb2920ce89fa75cce9e73c7ad244a72e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"117a9da0-c4f9-11e9-8a5a-abdcbb867af8"},"incident_date":"2019-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"85d1e2eec3c6","org_name":"Deutsche Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.businessinsider.sg/deutsche-bank-fired-employees-had-access-to-emails-2019-7/"}],"summary":" Deutsche Bank has launched a probe into whether there was a potential data leak after roughly 50 former employees still had access to their emails despite being dismissed weeks ago, reports the Financial Times.  The Financial Times reported that one equity sales person sent over","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6595965a2d81bef2bda0c8d4a87ff41946d87aaf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2534b7a0-de07-11e9-92e6-b7a271e742aa"},"incident_date":"2019-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ffab99ae4a0","org_name":"Democratic Senate Campaign Electoral Committee","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/08/06/democratic-senate-millions-emails/"}],"summary":"A political campaign group working to elect Democratic senators left on an exposed server a spreadsheet containing the email addresses of 6.2 million Americans.  Data breach researchers at security firm UpGuard found the data in late July, and traced the storage bucket back to a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd4f34622aa4bb3c86081732cfc8cf39946244ad","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"be705500-058a-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0021322363d8","org_name":"Brooklyn Hospital Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tbh.org/notice-data-event"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/american-cancer-society-finds-e-skimming-malware-on-store-website,https://www.bleepingcomputer.com/news/security/brooklyn-hospital-loses-patient-data-in-ransomware-attack/"}],"summary":"Brooklyn Hospital Center hit with ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a5a95025fd04b66bc4804ae4474e7a01e3122fa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3dfc4200-c9b0-11e9-9a33-13e06a29212c"},"incident_date":"2019-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23925add7d07","org_name":"Bilancione Dental Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/regional-cancer-care-associates-notice-230000917.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.orlandosentinel.com/news/breaking-news/os-ne-maitland-dentist-victim-of-ransomware-20190724-nvv6yxfxebdtfbnzlb4f2ckhfu-story.html"}],"summary":"A dentist office in Maitland is the latest victim of a ransomware attack in Seminole County.   Dr. Carl Bilancione said all of his Quickbooks accounting files were encrypted and a pop-up screen instructed him to pay $10,000. Every 48 hours, the ransom would double, according to t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f06f14c1b227a7c78269724d623525159538a136","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92142c80-ca79-11e9-9a33-13e06a29212c"},"incident_date":"2019-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"8db6df7210ca","org_name":"Bayamon Medical Center y Puerto Rico Women And Children’s Hospital","org_type":"healthcare","ransomware":true,"records_affected":520000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cyware.com/news/two-hospitals-in-puerto-rico-suffer-ransomware-attack-impacting-over-520000-patients-data-d2a87121"}],"summary":"The ransomware infection encrypted all computer files that contained patients’ personal information. The incident impacted nearly 422,496 Bayamón Medical Center patients and 99,943 Puerto Rico Women And Children’s Hospital patients. What is the issue?  Bayamón Medical Center and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36e45cd930de9e8364c23e4c4eba5e28ba55e4cb","impact_type":"data_theft","imported_from":null,"incident_date":"2019-06-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AT","org_id":"b516f89d6b4f","org_name":"Wiener Büchereien","org_type":"government","ransomware":null,"records_affected":224119,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wiener Büchereien","type":"hibp","url":"https://haveibeenpwned.com/Breach/WienerBuchereien"}],"summary":"Wiener Büchereien suffered a data breach in June 2019, and the exposed data included personal information that was later posted to Twitter by the alleged perpetrator.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20f3bbe1e1f26b88a46704ed0b85f2752e9f9c90","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccd25020-de17-11e9-b511-f75921c18742"},"incident_date":"2019-06-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fceaae628471","org_name":"Wickenburg County Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wickenburgsun.com/around_town/article_22277088-a32f-11e9-8625-8b98da90bbf3.html"}],"summary":"In the early morning hours of June 28, the Wickenburg Community Hospital computer network was victim to a ransomware attack, according to President and CEO Jim Tavary.  He explained, “Essentially, data on the network was encrypted in such a way that it was not recoverable by the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0518f25ae99b8b8a37955997ca1ddd2f00795a2b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ae51e440-ca8e-11e9-9a33-13e06a29212c"},"incident_date":"2019-06-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff34a8422063","org_name":"Wickenburg Community Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wickenburgsun.com/around_town/article_22277088-a32f-11e9-8625-8b98da90bbf3.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wickhosp.com/blog/ransomwareattack/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.azcentral.com/story/news/local/arizona/2019/07/30/how-4-technicians-saved-arizona-hospital-hacker-ransomware-wickenburg-community-hospital/1842572001/"}],"summary":"The cyber-attack affected hospital and clinic phone systems, allowing outbound calls but not inbound calls and, shared files were not accessible.    According to information provided by the FBI, suspected Ryuk ransomware encrypts files on network shares and an infected computer’s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2019-06-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"472c26d1f74b2691b09b316609064ecc7894439d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4041a7b0-246a-11eb-b042-01be07ea3379"},"incident_date":"2019-06-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a98e5590f7b6","org_name":"TransUnion","org_type":"other","ransomware":null,"records_affected":37001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/credit-info-exposed-in-transunion-data-security-incident/,https://www.itworldcanada.com/article/canadian-credit-reporting-agency-compromised-through-third-party/422576,https://www.scmagazine.com/home/security-news/stolen-credentials-used-to-access-transunion-canadas-consumer-credit-files/,"}],"summary":"credential stuffing on financial website breaches PII (enough for identity theft)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-28","discovered_date":"2019-05-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2721ec830f3a23e5eef8a128d8d55726595ada2","impact_type":"unknown","incident_date":"2019-03-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ca02aac5fb0a","org_name":"Summa Health","org_type":"unknown","ransomware":null,"records_affected":7989,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Summa%20Health-2019-06-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-06-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98ad7371512907ba19630d3a1d2dee82c5c7836d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"992d1e40-0233-11ea-ad43-7952870528d4"},"incident_date":"2019-06-28","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd3343c62b88","org_name":"Geisinger Health Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lewistownsentinel.com/news/local-news/2019/10/ghp-notifies-its-members-of-potential-vendor-email-breach/,https://www.dailyitem.com/news/security-breach-may-have-exposed-some-geisinger-health-plan-member/article_5b1be84e-f44f-11e9-b36a-9b7454042945.html"}],"summary":"Partner is breached through email phishing resulting in patient information disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-06-27","discovered_date":"2019-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1e614248069d55d91dfbf5267ecb8858eb7e3f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20%28Notice%20Only%29.pdf"},"notes":null,"org_country":"US","org_id":"953a73a28b6f","org_name":"Micro-Mom Scooters LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148459"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%201%20%28Notice%20Only%29.pdf"}],"summary":"Micro Kickboard reported that malware may have stolen customers’ payment card information entered on its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-26","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd8fff93977710cf252b5ae1734dda4bd969537e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20letter%20to%20individuals.pdf"},"notes":null,"org_country":"US","org_id":"af78af33f457","org_name":"The Union Labor Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":615,"reviewed":false,"root_cause":"An employee opened a fraudulent link that allowed access to the employee’s email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148434"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20letter%20to%20individuals.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10656.pdf"}],"summary":"A fraudulent link led to unauthorized access to an employee’s Outlook email account, where records containing participants’ personal information were present.","supporting_quote":"The link was in fact fraudulent and allowed access to the employee’s email account.","technology_involved":["Outlook email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0736800bb3e4507119ba8b5797a1ea5a22498016","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Loungefly%20California%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"495e63736cdc","org_name":"Loungefly, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Loungefly%20California%20Notice.pdf"}],"summary":"Unauthorized code was placed on the system operating Loungefly's online store, potentially affecting customer payment card information and account credentials.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19602a2780102aa892a5d80ea069816c7df50da6","impact_type":"unknown","incident_date":"2019-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cc880744cd6","org_name":"IM Shopping, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148456"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-25","discovered_date":"2019-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1e264bfdf3e633a1a6a4ca1e8deb7010f1c55be7","impact_type":"unknown","incident_date":"2019-06-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1616cc47f945","org_name":"Rogue Valley Council of Governments","org_type":"unknown","ransomware":null,"records_affected":580,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rogue%20Valley%20Council%20of%20Governments-2019-06-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-06-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f6cac592cab4ee44463ee83a3a44401e4f58fab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"294c7c30-0fbf-11ea-936a-1ffb751fb68b"},"incident_date":"2019-06-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cdc2c5273a2d","org_name":"Mid-Valley Behavioral Care Network","org_type":"financial","ransomware":null,"records_affected":12804,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/sonoma-valley-hospital-website-email-addresses-hijacked"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mid-Valley%20Behavioral%20Care%20Network-2019-08-09"}],"summary":"Nearly 11,000 Mid-Valley Behavioral Care Networks (BCN) are being notified of a potential breach of their data, after a phishing attack on two employee email accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"663aad0a9f4fa1a2300c00c1dc5c52560d2c1a15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebbf14d0-0498-11ea-ad43-7952870528d4"},"incident_date":"2019-06-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"338a00a04c6e","org_name":"K12 Inc","org_type":"education","ransomware":null,"records_affected":6988504,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenotebook.org/articles/2019/08/22/cyber-operator-exposed-students-personal-data-part-of-a-growing-threat/"}],"summary":"K12 Inc left student data exposed through insecure mongodb ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7c47cf349b0159911808ceff679b397a60732e7a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/DominionNational.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"656185894e86","org_name":"Dominion Dental Services, Inc., Dominion National Insurance Company, & Dominion Dental Services USA","org_type":"unknown","ransomware":null,"records_affected":3439,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/DominionNational.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-25","discovered_date":"2019-04-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e7d515267ae5515def848baec608282e6b9baff","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCSF%20CA%20CM%20Adult%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"8818b3f7d44a","org_name":"City College of San Francisco","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148422"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCSF%20CA%20CM%20Adult%20Notice.pdf"}],"summary":"City College of San Francisco reported that an unauthorized individual may have accessed an employee email account containing personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e3d5db1300ebcead34f10300d6c0673673af9f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yogurtland%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"5b237e893955","org_name":"Yogurtland Franchising, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yogurtland%20Notification.pdf"}],"summary":"An unauthorized individual accessed the iOS Yogurtland App, potentially exposing Real Rewards members’ usernames and passwords.","supporting_quote":null,"technology_involved":["iOS Yogurtland App","Real Rewards program"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"681c0f55e05f10f6bc0f6c1c2a60a7056fb8587d","impact_type":"data_theft","imported_from":null,"incident_date":"2019-06-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"376af359fbc9","org_name":"Social Engineered","org_type":"other","ransomware":null,"records_affected":89392,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Social Engineered","type":"hibp","url":"https://haveibeenpwned.com/Breach/SocialEngineered"}],"summary":"Social Engineered’s MyBB forum database was breached, exposing email addresses, usernames, IP addresses, private messages and hashed passwords.","supporting_quote":null,"technology_involved":["MyBB forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a87a63639b34a7a6bcde3cb3c09d8bba0e03ac5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0dff3590-c8f6-11e9-b2db-f769187145bf"},"incident_date":"2019-06-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3a4bb2eeb393","org_name":"K12.com","org_type":"technology_saas","ransomware":null,"records_affected":7000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.engadget.com/2019/07/10/k12-exposed-student-data/"}],"summary":"  K12.com, an online education platform, inadvertently exposed the personal information of nearly seven million students, according to security researchers at Comparitech. The exposed database contained full names, email addresses, birthdates and gender identities, as well as the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-06-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26d74b7ebacbffd890a52abcde6107903fef8145","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a4df4420-0cc8-11eb-9ca0-972c112a0cb8"},"incident_date":"2019-06-21","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"758cc5ab2e4b","org_name":"Southeastern Pennsylvania Transportation Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inquirer.com/news/septa-data-breach-cyber-crime-hack-tech-philadelphia-20190919.html"}],"summary":"magecart attack on e-commerce site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b7700784f660ab15fe866027e54444aee277ded","impact_type":"unknown","incident_date":"2010-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Dominion%20National%20CA%20Individual%20Notices.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63333a5f8c07","org_name":"Dominion Dental Services, Inc., Dominion National Insurance Company, and Dominion Dental Services USA, Inc. (hereinafter referred to collectively as “Dominion National”).","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148325"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"590346c2562df2fc58c7a9bd55da4913e1e05f8d","impact_type":"unknown","incident_date":"2010-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"186aed8297f9","org_name":"Dominion Dental Services, Inc., Dominion National Insurance Company, and Dominion Dental Services US","org_type":"unknown","ransomware":null,"records_affected":3119635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dominion%20Dental%20Services%2C%20Inc.%2C%20Dominion%20National%20Insurance%20Company%2C%20and%20Dominion%20Dental%20Services%20US-2019-06-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"47601b12d2d79f17b17fbff930df0820e7275755","impact_type":"exposure_no_theft_confirmed","incident_date":"2010-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10641.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"26af4cafbdb4","org_name":"Dominion Dental Services Inc.","org_type":"unknown","ransomware":null,"records_affected":34455,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10641.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8ecb3bba0db944b07b622e4b8790f5b2d5356e3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7b33b410-ef57-11e9-8b51-736a93581b2e"},"incident_date":"2019-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"092241fa1243","org_name":"Iranian Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/tech-policy/2019/08/us-hack-attack-hobbles-irans-ability-to-target-oil-tankers-nyt-says/"}],"summary":"US deletes Iranian revolutionary guard database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4188383d8740612bb0388ff154380bb9e080b80b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b6a2e00-ce5b-11e9-b4e5-4769cce343a0"},"incident_date":"2019-06-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a938945fcbe2","org_name":"Rhode Island Ear, Nose and Throat Physicians","org_type":"healthcare","ransomware":null,"records_affected":2943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/rhode-island-physician-network-alerts-3-000-patients-of-data-breach.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed1d50f151b9d1b8d07465f8fe8a2b7c6ff8d573","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PUHSD%20Total%20Registration%20Data%20Vulnerability%20Parent%20Letter_%2005.17.19.pdf"},"notes":null,"org_country":"US","org_id":"0d5d693f4453","org_name":"Placer Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148251"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PUHSD%20Total%20Registration%20Data%20Vulnerability%20Parent%20Letter_%2005.17.19.pdf"}],"summary":"Student registration reports held by Total Registration were viewable in plain text for 48 hours, with no evidence that personal information was accessed.","supporting_quote":null,"technology_involved":["Total Registration"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Total Registration"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"e68aed844219","name":"Total Registration"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91a152d1bc68bc6e5f26d49c5adb23778d000b88","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5be15eb0-0fc2-11ea-936a-1ffb751fb68b"},"incident_date":"2019-06-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd2be6e36075","org_name":"WMNF 88.5-FM","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cltampa.com/news-views/local-news/article/21078735/ransomware-attack-could-cost-tampas-wmnf-more-than-5000,https://www.itsecurityguru.org/2019/07/18/ransomware-attack-hits-us-ration-station/"}],"summary":"Tampa-based community radio station WMNF 88.5-FM is stepping up cybersecurity after its computer systems were hobbled by ransom-seeking hackers last month","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-06-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96e6e2e6cac9766bfbc0b1af0fa27086b58ac0b6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50a96550-cfe5-11e9-aa40-01794b8efffe"},"incident_date":"2019-06-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd591f0ce05d","org_name":"Virginia Gay Hospital","org_type":"healthcare","ransomware":null,"records_affected":5031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.communitynewspapergroup.com/vinton_newspapers/virginia-gay-hospital-data-breach-impacts-about-initiates-security-changes/article_27757e12-0645-5bdd-8fb7-19a558d5e2a7.html,http://www.spamfighter.com/News-22393-Virginia-Gay-Hospital-notified-their-patients-about-the-data-security-incident.htm"}],"summary":"phishing email stole email creds and potentially breached PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ccd69b7f3f6806a18c05966e886949fe11370e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89816380-1d0d-11ea-93dd-ad92e007263c"},"incident_date":"2019-06-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"75d061a376c9","org_name":"Sweetser Mental Health","org_type":"healthcare","ransomware":null,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://waldo.villagesoup.com/p/sweetser-hack-releases-22-000-patients-information-to-unauthorized-third-party/1839596"}],"summary":"Sensitive client information was hacked through two Sweetser employee email accounts last June. Details about 22,000 people’s identification information and medical conditions may have been released to the hackers, according to Sweetser spokesperson Susan Pierter.  On Oct. 28, Sw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a19887027afe06e588531092d93b2d13c3d4d4d5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90b84b10-359c-11ec-9ec7-15e66f657ea5"},"incident_date":"2019-06-17","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08547f0c655f","org_name":"Spotsylvania school system","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fredericksburg.com/news/crime_courts/search-warrant-affidavit-details-information-regarding-the-massive-theft-from/article_0882ed32-ac2a-5a35-a18d-7f6135f9c20c.html"}],"summary":"Spotsylvania school system were the victims of a BEC attack for $623,597","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2019-06-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"852f363a1400db43728c292fd3ed3cebe56c5fe0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e420150-daec-11e9-aa50-b778a2874faa"},"incident_date":"2019-06-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/vulnerabilities-exposed-2-million-verizon-customer-contracts,https://daleys.space/writeup/0day/2019/09/09/verizon-leak.html"}],"summary":"insecure direct object reference vulnerability in employee website exposed contract information when id number brute forced.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2019-06-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef753add651a7e208829a5a00acc076b4cc2eed8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ba47a4d0-1b81-11ea-aa10-8d551748dadb"},"incident_date":"2019-06-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02dc063f47d5","org_name":"Loudoun Medical Group d/b/a Comprehensive Sleep Care Center (CSCC)","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ptcommunity.com/wire/loudoun-medical-group-dba-comprehensive-sleep-care-center-provides-notice-data-privacy-event,https://www.databreaches.net/loudoun-medical-group-d-b-a-comprehensive-sleep-care-center-notifies-patients-after-employee-email-account-compromise/"}],"summary":"email compromise leads to potential disclosure of sensitive data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12d9f047779b8cd4351a8d86913c93d026452fa9","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2b7a17701fae","org_name":"D3Scene","org_type":"other","ransomware":null,"records_affected":568827,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: D3Scene","type":"hibp","url":"https://haveibeenpwned.com/Breach/D3scene"}],"summary":"A breach of D3Scene’s vBulletin forum exposed email addresses, IP addresses, usernames and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-06-14","discovered_date":"2017-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ca274c910c1a58da12fe8924d75ba22237b54c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_ACID_20180627_UCSD501_R1_1.pdf"},"notes":null,"org_country":"US","org_id":"b5c3e169fc62","org_name":"UC San Diego Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148112"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_ACID_20180627_UCSD501_R1_1.pdf"}],"summary":"An unauthorized third party accessed a medical transcription platform operated by Nuance Communications that contained UC San Diego Health patients’ medical information.","supporting_quote":"On December 22, 2017, UC San Diego Health learned from one of our business associates, Nuance Communications that an unauthorized third party accessed one of its medical transcription platforms, which contained your medical information.","technology_involved":["Nuance Communications","medical transcription platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Nuance Communications"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0a6408965996","name":"Nuance Communications"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e180b35a68396b81b6a657225182bfa98c9b8c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"499b8730-c8eb-11e9-9c16-3f32faecab86"},"incident_date":"2019-06-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"555180e064d0","org_name":"Grays Harbor Community Hospital and Harbor Medical Group","org_type":"healthcare","ransomware":true,"records_affected":85000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/hackers-demand-1m-in-grays-harbor-ransomware-attack"}],"summary":"August 14, 2019 - Hackers infected Washington-based Grays Harbor Community Hospital and Harbor Medical Group with ransomware and demanded a payment of $1 million to unlock patient files, according to a report from the Daily World.  The report sheds light on the EHR downtime the p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-06-14","discovered_date":"2019-05-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b849b79705a1661c8c47d5b3c05f572006d6a35","impact_type":"data_theft","incident_date":"2019-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EatStreet%20Delivery%20r3prf.pdf"},"notes":null,"org_country":"US","org_id":"315752e11293","org_name":"EatStreet, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148118"},{"fetched_at":null,"title":"Have I Been Pwned: EatStreet","type":"hibp","url":"https://haveibeenpwned.com/Breach/EatStreet"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EatStreet%20Delivery%20r3prf.pdf"}],"summary":"An unauthorized third party accessed EatStreet’s database and acquired information about delivery partners.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2019-06-14","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"427c9c4465d76899f829be88053a7ed1ae4e3bf1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5822eae0-ffce-11e9-81dd-7371e517d223"},"incident_date":"2019-06-14","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"b0dada6e2bfe","org_name":"Avast","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gdpr.report/news/2019/10/21/privacy-avast-discloses-security-breach-impacting-its-internal-network/"}],"summary":"Avast finds that attacker compromises employee's VPN credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a695b51a0de8d66ecc9a2536e196899bf1f6243","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_28.pdf"},"notes":null,"org_country":"US","org_id":"3f086a6be4e7","org_name":"American Medical Response, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees were deceived by phishing emails soliciting their email-system login information, which was then used to access their email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148040"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_28.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#American%20Medical%20Response%2C%20Inc.-2019-06-11"}],"summary":"American Medical Response reported that phishing emails led to unauthorized access to employee email accounts containing personal information.","supporting_quote":"We learned that an outside entity sent phishing emails to certain of our employees soliciting their login information to our email system.","technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be71fc4d59dd8799543bd1a8a620aa83c7de1d19","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ba349d8f06c5","org_name":"Emuparadise","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Emuparadise","type":"hibp","url":"https://haveibeenpwned.com/Breach/Emuparadise"}],"summary":"A breach of Emuparadise’s vBulletin forum exposed email addresses, IP addresses, usernames and passwords.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-06-07","discovered_date":"2019-04-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1be691461261f7a1abe24b8de866b8f2a0d1458a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DBI%20Consumer%20Info%20Letter%20%233%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"aa459abe2ac8","org_name":"Timepieces International Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147946"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DBI%20Consumer%20Info%20Letter%20%233%20California_0.pdf"}],"summary":"Timepieces International discovered an attack on its web store that potentially accessed customer transaction data.","supporting_quote":null,"technology_involved":["web store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-06-07","discovered_date":"2019-04-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed95d438786f88ee82fbfb2a0d6adefff8c4977d","impact_type":"unknown","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Princess%20Polly%20Group%20Pty%20Ltd%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%28notice%29_2.pdf"},"notes":null,"org_country":"US","org_id":"8587cbaac476","org_name":"Princess Polly Group Pty Ltd","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Princess%20Polly%20Group%20Pty%20Ltd%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%28notice%29_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Princess%20Polly%20Group%20Pty%20Ltd-2019-05-30"}],"summary":"Princess Polly was notified of suspicious activity related to credit cards used in transactions on its Australian website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-06-07","discovered_date":"2019-03-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ada972d12640282d227d49a8a87e7587212281b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Darwin%E2%80%99s%20Natural%20Pet%20Products%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"8ac7796d170f","org_name":"Darwin’s Natural Pet Products","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147945"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Darwin%E2%80%99s%20Natural%20Pet%20Products%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Darwin%E2%80%99s%20Natural%20Pet%20Products-2019-06-07"}],"summary":"Darwin’s reported that customer names and payment-card information used on its new customer checkout page may have been subject to unauthorized access or acquisition.","supporting_quote":null,"technology_involved":["online checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-07","discovered_date":"2019-04-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e62d18d6f6a6c7e43782782de60ef114e81254b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CNP%20-%20Notice%20Letter%20%5BCA%5D_0.pdf"},"notes":null,"org_country":"US","org_id":"7a6a5cab07e7","org_name":"California Natural Products","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CNP%20-%20Notice%20Letter%20%5BCA%5D_0.pdf"}],"summary":"California Natural Products reported a phishing attack on its email system that potentially compromised sensitive employee information.","supporting_quote":"We want to follow up with you regarding a recent phishing attack on CNP’s email system that potentially compromised sensitive employee information from approximately March 21, 2019 to April 4, 2019.","technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a61f1006a5845a13a663483b6c96b15bc47d2862","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-05-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PRIVILEGED%20AND%20CONFIDENTIAL%20-%20Sample%20General%20Data%20Subject%20Notice%20_0.pdf"},"notes":null,"org_country":"US","org_id":"44fa9a1893ea","org_name":"Avalara, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in an eCompli code update allowed unauthorized access to personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147956"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PRIVILEGED%20AND%20CONFIDENTIAL%20-%20Sample%20General%20Data%20Subject%20Notice%20_0.pdf"}],"summary":"An employee of a customer accessed personal information through a vulnerability in an eCompli code update.","supporting_quote":"The third party that discovered the vulnerability informed us of the vulnerability and subsequently certified to us that they did not share with any other party, and deleted all copies of, the information they accessed via the vulnerability.","technology_involved":["eCompli"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0fdfa0c796fe58275198164afd2fb22e5caf1a87","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b160929cfcee","org_name":"ZOLL Services LLC","org_type":"unknown","ransomware":null,"records_affected":277319,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ZOLL%20Services%20LLC-2019-06-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-06-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d017485fb1c8d22b947f5f77214630fd75b48d22","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20-%20Optometry%20Records%202-2019_0.pdf"},"notes":null,"org_country":"US","org_id":"36c442e6a769","org_name":"Gardner Family Health Network","org_type":"healthcare","ransomware":null,"records_affected":5064,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147941"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%20-%20Optometry%20Records%202-2019_0.pdf"}],"summary":"An unauthorized individual entered Gardner Family Health Network’s optometry records room, potentially exposing information relating to 5,064 patients.","supporting_quote":"On February 19, 2019 we were notified that an unauthorized individual entered the records room.","technology_involved":["Optometry Records Room"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-06-06","discovered_date":"2019-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e03882c1b22319bc88cf728c4f23ff4c82219251","impact_type":"data_theft","incident_date":"2019-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"f1bedfe3a4ed","org_name":"Evite","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147940"},{"fetched_at":null,"title":"Have I Been Pwned: Evite","type":"hibp","url":"https://haveibeenpwned.com/Breach/Evite"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice_1.pdf"}],"summary":"An unauthorized party acquired an inactive data storage file containing old Evite user data, including passwords and personal information.","supporting_quote":null,"technology_involved":["inactive data storage file"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-06","discovered_date":"2019-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"7730d725bf975ec38f5c4473e2d12fae0dd817c7","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10638.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"bf20883173a0","org_name":"Acrisure LLC","org_type":"professional_services","ransomware":null,"records_affected":1295,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Acrisure%20LLC%2C%20d/b/a%20Filice%20Insurance%20Agency-2019-06-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10638.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Filice%20Insurance%20-%20Egnyte%20-%20Consumer%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10638.pdf"}],"summary":"Acrisure LLC reported that unauthorized access to a third-party cloud storage service may have affected client personal information.","supporting_quote":null,"technology_involved":["cloud storage service"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-06-04","discovered_date":"2019-05-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8aff8b0ee298dd18bc2704f1c4edca177a93222c","impact_type":"data_theft","incident_date":"2019-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HistEmp%20CA%20Sample%20Consumer%20Letter%20for%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"bd1ca7ffa136","org_name":"Historical Emporium, inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147827"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HistEmp%20CA%20Sample%20Consumer%20Letter%20for%20AG_0.pdf"}],"summary":"Malware in Historical Emporium’s website payment processing code may have exposed or stolen customers’ payment card information.","supporting_quote":null,"technology_involved":["website payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-04","discovered_date":"2019-04-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"314379e0e9d33b6080000531fcb134a7760b9f4d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/APPROVED%20LETTER%20TEMPLATE%20-%20Experian_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"fed38df82b78","org_name":"Delta Health Systems","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A billing statement containing personal information was publicly accessible through a link to the website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147825"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/APPROVED%20LETTER%20TEMPLATE%20-%20Experian_0.pdf"}],"summary":"Delta Health Systems reported that a billing statement containing personal information was publicly accessible through a link to its website.","supporting_quote":"On April 18, 2019, TID notified us that your personal information was publicly accessible through a link to our website.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a1279babc82aba8c0441ea36cd00d59194ef5685","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10637.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8186e93f7b8e","org_name":"Washington Department of Health","org_type":"unknown","ransomware":null,"records_affected":1336,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10637.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-06-03","discovered_date":"2019-03-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"34e6dc6d4db069eb0cec5ceae7ee3940072979d9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10636.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4cbca284797e","org_name":"Retrieval Masters Creditors Bureau Inc.","org_type":"financial","ransomware":null,"records_affected":94643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10636.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Retrieval-Masters%20Creditors%20Bureau%2C%20Inc.%20%28d/b/a/%20American%20Medical%20Collection%20Agency%29-2019-06-05"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/RetrievalMastersCreditBureauInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10636.pdf"}],"summary":"Retrieval Masters Creditors Bureau reported unauthorized access to its system from August 1, 2018, through March 30, 2019, and said personal information may have been at risk.","supporting_quote":null,"technology_involved":["web payments page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-03","discovered_date":"2019-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"820ed0c94aa2ffa5af68f7c4c3cceec664ad7cdf","impact_type":"unknown","incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63a96e3f5d7d","org_name":"Inmediata Health Group, Corp","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Inmediata%20Health%20Group%2C%20Corp-2019-06-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b2349455e470332be5a8b8899833df63cbc4e3c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"258d0010-de23-11e9-b511-f75921c18742"},"incident_date":"2019-06-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59dfbca6aead","org_name":"X Social Media","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2019/06/19/xsocialmedia-exposed-150000-records-containing-personal-and-medical-information/"},{"fetched_at":null,"title":null,"type":"press","url":"https://connectingvets.radio.com/articles/ad-agency-data-leak-includes-combat-injuries-thousands-veterans"}],"summary":"The latest victim to emerge is a Facebook advertising agency – XSocialMedia which runs marketing campaigns for medical malpractice lawsuits. As revealed by researchers, XSocialMedia exposed a large amount of records containing personal and medical information through an unsecured","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91262687a6f53a03754824371622649f263fe016","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75899070-8d5f-11e9-b19c-fdab26daa332"},"incident_date":"2019-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6004a130f7b7","org_name":"White Sox","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ticketnews.com/2019/06/white-sox-accidentally-expose-200-fans-email-addresses-in-data-breach/"}],"summary":"White Sox fans who purchased tickets to an event in June were sent another email promoting an event in September, but the email list had not been placed in the BBC field, exposing the private email addresses of 200 ticket buyers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d87b0ac83644d2a145364adf9e94185ad349e65b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44a33c60-d8cb-11e9-80ba-0957c6f5f6bb"},"incident_date":"2019-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"fa2f06101180","org_name":"University of Western Australia","org_type":"education","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thewest.com.au/news/wa/uwa-student-data-may-be-compromised-after-laptop-theft-ng-b881272938z;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cio.com.au/article/664703/laptops-holding-30-years-worth-student-data-stolen-from-uwa/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.uwa.edu.au/data-loss-notification"}],"summary":"Stolen laptop.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c22fba3900ea8954885883b31dbf5d8ae5135579","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b3d19430-d8ce-11e9-ad21-67a23ae027d2"},"incident_date":"2019-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e1434c0cf23","org_name":"University of Nebraska-Lincoln","org_type":"education","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.omaha.com/news/education/higher-education/laptop-stolen-in-rome-unl-warns-nearly-current-former-ag/article_68db83ea-9a02-58ee-90fd-22284d77e773.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://journalstar.com/news/local/unl-offering-identity-protection-after-laptop-with-personal-information-stolen/article_161c5924-15cf-5fd6-911d-7061c625ed67.html"}],"summary":"Laptop is stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f556b4b60f0eec55431c86a832f1bf22753b2b5f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6e47360-359f-11ec-9ec7-15e66f657ea5"},"incident_date":"2019-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"f4798c292bb5","org_name":"Singapore Accountancy Commission","org_type":"government","ransomware":null,"records_affected":6541,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/security-lapse-exposes-personal-data-of-6500-singapore-accountants/"}],"summary":"Singapore Accountancy Commission sent email messages to multiple parties attached with a folder containing personal data of 6,541 accountants","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0086b92cb8821456dd50f3e788bac544e7d522b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6fbb5ec0-ce65-11e9-b4e5-4769cce343a0"},"incident_date":"2019-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa2a38cded65","org_name":"Marin Community Clinics","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.marinij.com/2019/06/24/marin-community-clinics-hit-with-ransomware-attack/"}],"summary":" Marin Community Clinics was able to resume use of its computer system Friday night after being hit by a ransomware attack between 9 a.m. and 10 p.m. Wednesday.  “We’re not totally out of the woods, but we’re feeling good because we’ve had the system up three days now.” said Mite","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e10ce62e1b8cb6ac6aa93a1041d9e625b5d4334","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8bea9fa0-1b7e-11ea-aa10-8d551748dadb"},"incident_date":"2019-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"032c595e0af5","org_name":"Healthcare Administrative Partners","org_type":"other","ransomware":null,"records_affected":17694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/healthcare-administrative-partners-warns-18-000-patients-of-data-breach.html"}],"summary":"phishing leads to email compromise at healthcare organization","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e32c9e384f0442d1da0752ca746025d19c52e24c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0c1eb30-0250-11eb-8781-bfb630cdf748"},"incident_date":"2019-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"141bee03ea47","org_name":"Geisinger","org_type":"healthcare","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesleader.com/news/802549/802549"}],"summary":"Employee misuses access to patient data to look up patients not required or their job","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f730cebe694bd502274a7fa189219a7564a3709","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"615e70a0-ca7e-11e9-9a33-13e06a29212c"},"incident_date":"2019-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BG","org_id":"35d431642633","org_name":"Bulgarian National Revenue Agency","org_type":"professional_services","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-steals-data-of-millions-of-bulgarians-emails-it-to-local-media/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-bulgaria-cybersecurity/hackers-steal-millions-of-bulgarians-financial-records-tax-agency-idUSKCN1UB0MA"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/massive-data-breach-in-bulgaria-compromises-the-countrys-entire-adult-population/"},{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/live-constant-fear-bulgaria-data-093148055.html"}],"summary":"A mysterious hacker has stolen the personal details of millions of Bulgarians and has emailed download links to the stolen data to local news publications.  The data's origin is believed to be the country's National Revenue Agency (NRA), a department of the Bulgarian Ministry of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-05-31","discovered_date":"2019-04-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b12834eee87f0928c21e01c4b639b20fc75a085e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_Mediant_Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"632035be113a","org_name":"Jackson National Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147726"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_Mediant_Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jackson%20National%20Life%20Insurance%20Company-2019-06-04"}],"summary":"An unknown party may have accessed Mediant business email accounts containing personal and financial information associated with Jackson policyholders.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Mediant Communications Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"1c8fcc933ec3","name":"Mediant Communications Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52331cf5bd9fe2282062231483ddb47f20cc5871","impact_type":"unknown","incident_date":"2019-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hannibal%20Industries%20Inc%20AG%20Notice%20053119_0.pdf"},"notes":null,"org_country":"US","org_id":"496e1a4fd290","org_name":"Hannibal Industries","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147763"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hannibal%20Industries%20Inc%20AG%20Notice%20053119_0.pdf"}],"summary":"A California Attorney General filing contains a consumer notification letter concerning a security incident at Hannibal Industries.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-30","discovered_date":"2019-05-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffa1c37651a32e70b530d6e9e6c5b5614defe077","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Total%20Registration%20Parent%20Letter%20LH%20%285%29_0.pdf"},"notes":null,"org_country":"US","org_id":"8bd24dc4357b","org_name":"Capistrano Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A developer misconfigured a setting in Total Registration's Amazon S3 file storage service, potentially exposing files stored there.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Total%20Registration%20Parent%20Letter%20LH%20%285%29_0.pdf"}],"summary":"A misconfigured Amazon S3 file storage service used by Total Registration may have exposed student exam registration information.","supporting_quote":"On May 10, 2019, Total Registration informed us that it had received notice of a misconfigured server that allowed for the potential unauthorized access to some of the information that Total Registration stores on its systems.","technology_involved":["Amazon S3"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Total Registration LLC"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"e68aed844219","name":"Total Registration"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e759821caafeb174a9a389c1d4da4dfd77babad2","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Checkers%20Drive-In%20Restaurants%20Inc%20-%20Substitute%20Notice%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"4d8262f53459","org_name":"Checkers Drive-In Restaurants","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147626"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Checkers%20Drive-In%20Restaurants%20Inc%20-%20Substitute%20Notice%20FINAL_0.pdf"}],"summary":"Malware on certain point-of-sale systems at some Checkers and Rally’s locations appears to have enabled an unauthorized party to obtain guests’ payment card data.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-28","discovered_date":"2019-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2630733c5e3fef7d364efa12ff5b5553bf62e9bc","impact_type":"data_theft","incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Mediant_%20General_0.pdf"},"notes":null,"org_country":"US","org_id":"1c8fcc933ec3","org_name":"Mediant Communications Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147615"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Mediant_%20General_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mediant%20Communications%20Inc.-2019-05-28"}],"summary":"A malicious party accessed Mediant Communications business email accounts and obtained investor information, including personal information.","supporting_quote":null,"technology_involved":["business email accounts","email server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6f497e19a926581e17c1998d77ed55dc515a83a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d563260-1d0b-11ea-93dd-ad92e007263c"},"incident_date":"2019-05-28","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15929e12b17b","org_name":"Magellan Health Systems","org_type":"healthcare","ransomware":null,"records_affected":65000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.miamiherald.com/news/health-care/article237179858.html"}],"summary":"A data breach at Magellan Health, Inc. has put the personal information of Florida Blue members at risk, the company announced Friday.  Florida Blue says “less than 1 percent” of its approximately 5 million members were affected.  The breach, which reportedly occurred on May 28, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Anonymous Italy","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f84a4f7694a2a3bd1cc6501f5a4d3973a50577e1","impact_type":"data_theft","imported_from":null,"incident_date":"2019-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IT","org_id":"c9cad195de9b","org_name":"Ordine Avvocati di Roma","org_type":"professional_services","ransomware":null,"records_affected":41960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ordine Avvocati di Roma","type":"hibp","url":"https://haveibeenpwned.com/Breach/OrdineAvvocatiDiRoma"}],"summary":"Ordine Avvocati di Roma suffered a data breach in May 2019, and data including contact information, email addresses, messages, and passwords was taken and redistributed online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"anonymousitaly"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47331fa613c570cc3f7fb1a3ade15d13896e7dc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5799e650-de04-11e9-92e6-b7a271e742aa"},"incident_date":"2019-05-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d40d9bb2193","org_name":"Philadelphia’s Department of Behavioral Health and Intellectual disAbility Services (DBHIDS)","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.philadelphiaweekly.com/news/dbhids-announces-hippa-breach-after-a-laptop-containing-sensitive-information/article_3c4bf8fc-b483-11e9-b6f3-2780e00e25ad.html"}],"summary":"A personal information security breach was recently discovered at Philadelphia’s Department of Behavioral Health and Intellectual disAbility Services (DBHIDS) after an employee lost (while taking public transit) his briefcase that contained a laptop that was password-protected bu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-05-24","discovered_date":"2019-04-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a30c156bdd622f3af6115c2508a795d4805fb92","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Wildlife%20Federation%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%20%28notification%29_0.pdf"},"notes":null,"org_country":"US","org_id":"cf253fd66b84","org_name":"National Wildlife Federation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147558"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Wildlife%20Federation%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%20%28notification%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20Wildlife%20Federation-2019-05-24"}],"summary":"The National Wildlife Federation reported unauthorized access to a third-party-hosted database containing Ranger Rick Zoobooks customer information, including payment card details.","supporting_quote":null,"technology_involved":["back-end database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-24","discovered_date":"2019-04-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ca08571df4c27e01bd1c0689a02df79730051c85","impact_type":"unknown","incident_date":"2018-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a52b842576ab","org_name":"Huggins Insurance","org_type":"unknown","ransomware":null,"records_affected":5725,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Huggins%20Insurance-2019-05-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"227600941a9b88d51720e02295376ce9d3ad8571","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10634.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02d413f2ad8a","org_name":"Drury Hotels Company, LLC","org_type":"unknown","ransomware":null,"records_affected":102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Drury%20Hotels%20Company%2C%20LLC-2019-05-24"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10634.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/DruryHotels.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"645be787dd252eab6330ee36effc75beb0d28de7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_5.pdf"},"notes":null,"org_country":"US","org_id":"a2a2e13a9841","org_name":"Dawn Food Products, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An outside individual solicited employees' email login information and used it to access their mailboxes.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_5.pdf"}],"summary":"An outside individual solicited Dawn Foods employees' email login information and used it to access mailboxes containing personal information.","supporting_quote":"We learned that an outside individual sent emails to certain Dawn Foods employees soliciting their login information to our email system.","technology_involved":["email system","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a20ead9991fcdc518386e3eb7a7169402e1f9bbe","impact_type":"data_theft","imported_from":null,"incident_date":"2019-05-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"AU","org_id":"ed2ba4c533a3","org_name":"Canva","org_type":"technology_saas","ransomware":null,"records_affected":137272116,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Canva","type":"hibp","url":"https://haveibeenpwned.com/Breach/Canva"},{"fetched_at":null,"title":null,"type":"press","url":"https://smallbiztrends.com/2019/06/change-passwords-regularly.html,https://siliconangle.com/2019/05/27/139m-customer-records-stolen-hack-popular-graphic-design-tool-site-canva/,https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/,https://www.tomsguide.com/us/canva-data-breach,news-30165.html,https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/"},{"fetched_at":null,"title":null,"type":"press","url":"https://smallbiztrends.com/2019/06/change-passwords-regularly.html,https://siliconangle.com/2019/05/27/139m-customer-records-stolen-hack-popular-graphic-design-tool-site-canva/,https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/,https://www.tomsguide.com/us/canva-data-breach,news-30165.html"}],"summary":"A breach of Canva exposed subscriber email addresses, usernames, names, geographic locations, and hashed passwords.","supporting_quote":null,"technology_involved":["Canva"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-23","discovered_date":"2019-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29a160a1489a03f2d48527a617947edf66d4a53a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"93b33c6caa4d","org_name":"Redtail Technology, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A debug log file containing personal information was accessible to Internet users.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147529"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20Breach%20Notification%20Letter_0.pdf"}],"summary":"Redtail Technology discovered that a debug log containing personal information was accessible to Internet users.","supporting_quote":"On March 4, 2019, we discovered that our logging systems inadvertently captured a small subset of personal information that we store for advisors and retained the data in a debug log file that was accessible to Internet users.","technology_involved":["debug log file","logging systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"936d3f2a4be2d3b757020cb6e8ab838992d14440","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76a31710-25cb-11ea-a520-cb05efb19081"},"incident_date":"2019-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e14340d27e92","org_name":"Select Health Network","org_type":"financial","ransomware":null,"records_affected":3582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/indiana-physician-group-warns-3-500-patients-of-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.selecthealthnetwork.com/sites/default/files/Select%20Health%20Website%20Notice%20Updated%2011.12.19%20-%20Final.pdf"}],"summary":"Mishawaka, Ind.-based Select Health Network is notifying 3,582 patients about a data breach that may have exposed their personal health information.  Select Health discovered unusual activity in an employee's email account. Upon further investigation, the physician group determin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21f3eebbcd6fc107462bf39dff09fecffadcaba7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25660520-0fbd-11ea-936a-1ffb751fb68b"},"incident_date":"2019-05-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"708319641496","org_name":"Select Health","org_type":"financial","ransomware":null,"records_affected":3582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/select-heath-network-provides-notice-of-data-security-incident-300957936.html,https://www.hipaajournal.com/solara-medical-supplies-and-select-health-network-report-phishing-attacks/"}],"summary":"The Mishawaka, IN-based physician hospital organization, Select Health Network, has also announced that the protected health information of certain individuals has potentially been compromised as a result of a phishing attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-05-22","discovered_date":"2019-04-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0d61a9268ae3dc65ac0e1cf3f9061280845e20c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Moda%20Operandi%20Inc._0.pdf"},"notes":null,"org_country":"US","org_id":"c73556cb05b7","org_name":"Moda Operandi Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147457"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Moda%20Operandi%20Inc._0.pdf"}],"summary":"Moda Operandi discovered that customer usernames and encrypted passwords had been uploaded to a publicly available database and advised customers to assume the information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0f72257235bfba546f3f0e76efd9a05a597158","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-12-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GT_Notification%20Letter_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b73b2d7153ed","org_name":"Georgia Institute of Technology","org_type":"education","ransomware":null,"records_affected":33458,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147461"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GT_Notification%20Letter_CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10632.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Georgia%20Institute%20of%20Technology-2019-05-22"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/GeorgiaInstituteofTechnology.pdf"}],"summary":"An unauthorized person sent queries through a Georgia Tech web server to an internal database that may have contained personal information.","supporting_quote":"In late March 2019, Georgia Tech identified signs that an unauthorized person had found a way to send queries through a Georgia Tech web server to an internal database.","technology_involved":["web server","internal database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"62910a4f79bd198d76c3e0d92afbace11944735e","impact_type":"unknown","imported_from":null,"incident_date":"2019-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10631.pdf"},"notes":null,"org_country":"US","org_id":"9ad87372eb1d","org_name":"Service Linen Supply","org_type":"other","ransomware":null,"records_affected":1210,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10631.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10631.pdf"}],"summary":"Service Linen Supply reported that its Personnel and Accounting systems were hacked and notified approximately 1,210 Washington residents, while stating it had found no evidence that data was accessed or removed.","supporting_quote":null,"technology_involved":["Accounting systems","Personnel systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-21","discovered_date":"2019-03-19","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1055d9603254ee24e59712f926496f46fcfb4bff","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-12-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/8%20CA%20Pat%20SSN_2.pdf"},"notes":null,"org_country":"US","org_id":"465d8f3b4315","org_name":"Hematology Oncology Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/8%20CA%20Pat%20SSN_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hematology%20Oncology%20Associates%2C%20PC-2019-05-28"}],"summary":"An unauthorized person accessed some employee email accounts, and an email or attachment potentially accessed contained personal information.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-21","discovered_date":"2019-03-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"15988c42b920b04a055f7bd620c17dfaadde0751","impact_type":"unknown","incident_date":"2019-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5332a49e1516","org_name":"Cancer Treatment Centers of America","org_type":"unknown","ransomware":null,"records_affected":16819,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America-2019-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-05-20","discovered_date":"2019-03-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac7f819e0c6f071c802001bf1beaad7957efd38a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Notice%20of%20Data%20Event_0%20%28notification%29_0.pdf"},"notes":null,"org_country":"US","org_id":"d009cf36e089","org_name":"T3 Micro Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Notice%20of%20Data%20Event_0%20%28notification%29_0.pdf"}],"summary":"T3 Micro reported that malware may have stolen customers’ payment-card and personal information from its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b07bcd5cc2d91d85804dd5161547286836d5ae54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a5c3a3c0-111c-11ea-bd5f-71a8176be0a0"},"incident_date":"2019-05-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"1585c2b5e9a5","org_name":"Chan Brothers Travel","org_type":"other","ransomware":null,"records_affected":450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/tech/chan-brothers-travel-under-investigation-by-privacy-watchdog-after-personal-data-found-to-be"}],"summary":"Travel agency Chan Brothers Travel is being investigated by Singapore's privacy watchdog after the personal data of more than 500 of its customers was found to be publicly accessible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2019-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ab27b759097d6a3297284e93bf25da5bc9c53ca","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"dcafbbf5b995","org_name":"OGUsers","org_type":"other","ransomware":null,"records_affected":161143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OGUsers (2019 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/OGUsers"}],"summary":"A December 2018 OGUsers database backup was published on a rival hacking forum, exposing email addresses, IP addresses, usernames, private messages, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["forum database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-17","discovered_date":"2019-04-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5d3ed8815893fac0b807582526f9109506001390","impact_type":"unknown","incident_date":"2018-10-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6371b5926ee8","org_name":"State of Oregon Construction Contractor Board","org_type":"unknown","ransomware":null,"records_affected":8013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#State%20of%20Oregon%20Construction%20Contractor%20Board-2019-05-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e84747eb0a1c24284e7c0b49ff061a77d4bd3677","impact_type":"unknown","incident_date":"2018-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Artsy%20-%20CA%20AG%20-%20Exhibit%201_0%20%28notification%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0a1cbdc346b","org_name":"Art.sy, Inc. d/b/a Artsy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147297"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25f2a489cce17be3f211c3d4507422ae73347787","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0a3ed660-c8ef-11e9-9c16-3f32faecab86"},"incident_date":"2019-05-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"27da3ec65824","org_name":"1to1 Help","org_type":"healthcare","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/a-misconfigured-aws-bucket-exposed-personal-and-counseling-logs-of-almost-300000-indian-employees/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.techdirt.com/articles/20190808/13213742745/indian-counseling-company-files-criminal-complaint-against-blogger-who-informed-it-about-sensitive-data-leak.shtml"}],"summary":"On May 16, a researcher discovered that 1to1Help was exposing data in a misconfigured Amazon s3 bucket. When they eventually had time to look at the data, they found that were were more than 300,000 records with personal and sensitive information in the exposed bucket. The resear","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"547fbb42fc047311180d673feaae9208f5317ed1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36b0b280-b3ab-11e9-8244-abb132467e1d"},"incident_date":"2019-05-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"eef90bd8c802","org_name":"theta360","org_type":"technology_saas","ransomware":null,"records_affected":11000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vpnmentor.com/blog/report-theta360-leak/,https://cyware.com/news/theta360-leak-exposes-11-million-photos-user-data-2fedcb1a"}],"summary":"researchers discovered explosed photo database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c90faa0a4da61d5131fa97c1449cc12ea58b3267","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HNCA%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"b07a2a29b1db","org_name":"Health Net of California and Health Net Life Insurance Company","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A coding error caused addresses to become misaligned, resulting in letters being delivered to incorrect addresses.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147159"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HNCA%20Notification%20Letter_0.pdf"}],"summary":"Health Net of California and Health Net Life Insurance Company reported that a coding error caused letters containing personal information to be delivered to incorrect addresses.","supporting_quote":"A coding error caused addresses to become misaligned.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-10","discovered_date":"2019-05-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1ea2f856eb4edaed9ccf0639a43efb2a6a50d2ec","impact_type":"unknown","incident_date":"2019-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"509b91d95aa3","org_name":"Oregon Health Authority","org_type":"unknown","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Health%20Authority-2019-05-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8279a1d308cbe4f7332b773492b2bbf2a0dae89","impact_type":"unknown","incident_date":"2018-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ODS%20-%20Notice%20to%20Consumers_0.pdf"},"notes":null,"org_country":"US","org_id":"7e5296e7ed97","org_name":"Oklahoma Department of Securities","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147106"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-148278"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ODS%20-%20Notice%20to%20Consumers_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oklahoma%20Department%20of%20Securities-2019-05-10"}],"summary":"The Oklahoma Department of Securities reported an incident that may have affected the security of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acc6cdef8a384891011875ffb407b98b31973b7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b897e480-de21-11e9-b511-f75921c18742"},"incident_date":"2019-05-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8bc933108f63","org_name":"medicaresupplement.com","org_type":"financial","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/data-breach/5-million-exposed-by-misconfigured-medicaresupplement-com-mongodb/"}],"summary":"A MedicareSupplment.com MongoDB containing more than five million records was found open to the public containing a wide range of PII.  The records were found by the security firm Comparitech and researcher Bob Diachenko on May 13 containing first and last name, full address, IP ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-09","discovered_date":"2019-03-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8b6ad743f9d7dc97d357533786f08f1f656c1155","impact_type":"unknown","incident_date":"2018-06-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cfe14e425c0","org_name":"US Oncology","org_type":"unknown","ransomware":null,"records_affected":5168,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#US%20Oncology-2019-05-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"854b1b791e5d3b74b5c99b263ea46c8ecb994a7c","impact_type":"unknown","incident_date":"2019-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BoostMobile_Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"da2d32b0d953","org_name":"Sprint Corporation (\"Boost Mobile\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147075"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-05-09","discovered_date":"2019-03-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e6765c916f5f3683a8306b0408bd2d6e80acbd01","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-02-12","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10629.pdf"},"notes":null,"org_country":"US","org_id":"27a2535de401","org_name":"Sage Advisors LLC","org_type":"financial","ransomware":null,"records_affected":1026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10629.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10629.pdf"}],"summary":"A phishing email incident led to unauthorized access to a Sage employee’s email account, which contained personal and financial information.","supporting_quote":"On April 9, 2019, Sage’s ongoing investigation into a phishing email incident determined that an unauthorized person had obtained access to an email account belonging to a Sage employee.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c0dc327e6e958c958d26a07939802e97424b866","impact_type":"unknown","incident_date":"2019-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AG%20Notice%20Medical%20Information%20no%20SSN_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f9e2eacf8a48","org_name":"St. Vincent Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147052"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f6740e40460be83f5d5b70e7b8db4e22861708c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Coinmama%20Enclosure_0.pdf"},"notes":null,"org_country":"US","org_id":"2d568ca87be6","org_name":"New Bit Ventures Ltd.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146973"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Coinmama%20Enclosure_0.pdf"}],"summary":"New Bit Ventures Ltd. notified affected individuals of a security incident involving account-related information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bacdacb4ffe97561c2c3e965b2892a22ce4a78b","impact_type":"unknown","incident_date":"2019-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Collie%20Accountancy%20AG%20Submission_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01d2aed5e01a","org_name":"Collie Accountancy","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147012"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-06","discovered_date":"2019-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"267541152b116bf4f10880c262e2aef16e37b2af","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AIHS%20-%20individual%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"1f1933d31e2f","org_name":"American Indian Health & Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee forwarded AIHS emails to her personal email account in a manner that conflicted with AIHS policies and procedures.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AIHS%20-%20individual%20notice_0.pdf"}],"summary":"A former AIHS employee forwarded emails containing personal information to her personal email account.","supporting_quote":"On March 7, 2019, AIHS discovered a former AIHS employee forwarded certain AIHS emails to her personal email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-04","discovered_date":"2019-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a58461b425746456facd88c7ca1f375b02cb9cf5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%23%2068374406%20v%202%20%28Envision%20-%20ProviderEmployee%20CA%20SSN%20and%20DL%20%28Epiq%20Final%29%29-c_0.pdf"},"notes":null,"org_country":"US","org_id":"85fd680d6eb7","org_name":"EmCare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146901"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%23%2068374406%20v%202%20%28Envision%20-%20ProviderEmployee%20CA%20SSN%20and%20DL%20%28Epiq%20Final%29%29-c_0.pdf"}],"summary":"An unauthorized third party accessed EmCare employee email accounts containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e67e0a69ea2d0f8d975bb93a111c4df1b12288a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"FR","org_id":"a62f66fc7225","org_name":"Appartoo","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Appartoo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Appartoo"}],"summary":"A March 2017 breach of Appartoo exposed members’ personal information, private messages, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db351fa949e115ce4e4ce949f203754787dfd636","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90c71650-b3c0-11e9-8244-abb132467e1d"},"incident_date":"2019-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"741b2ef49fed","org_name":"Weight Loss Grants","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-weight-loss-grants-posts-customer-health-information-without-consent/,https://globalnews.ca/news/5347720/weight-loss-grants-customer-health-information/"}],"summary":"Company discloses private personal data while rebutting monetary disputes with customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec37b9570907821365d435e3c7190e8d7576dde7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21d207e0-246d-11eb-b042-01be07ea3379"},"incident_date":"2019-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"60415616697e","org_name":"Truecaller","org_type":"technology_saas","ransomware":null,"records_affected":29900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.in/researcher-data-leaked-for-300-million-truecaller-users-a-12519,https://www.livemint.com/technology/tech-news/truecaller-denies-breach-after-data-of-4-75-crore-indians-appear-on-dark-web-11590562442362.html"}],"summary":"company customers scraped pii of other customers stored by company and sold it on criminal marketplaces.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c1aa890be0cf62f57585664bcc12496607dfb58","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"344bcb90-1d16-11ea-b436-a7f38e8d15a2"},"incident_date":"2019-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"941bf8d93525","org_name":"StockX","org_type":"technology_saas","ransomware":null,"records_affected":6800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenextweb.com/security/2019/08/05/online-sneaker-marketplace-failed-to-come-clean-about-6-8m-record-data-breach/,https://www.retaildive.com/news/stockx-reveals-details-about-data-breach/560896/,https://www.detroitnews.com/story/business/2019/08/20/stockx-data-breach-sparks-lawsuit/2058177001/,https://hypebeast.com/2019/8/stockx-password-reset-suspicious-activity,https://techcrunch.com/2019/08/03/stockx-hacked-millions-records/"}],"summary":"unknown action used to compromise user database of victim.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"970edf5be6e99388593cb04ad3acf33429d25ab1","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-04-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BVHM%20-%20LETTER%20Notice%20of%20Data%20Breach%20%5BEnglish%5D%20-%20Google%20Docs_0.pdf"},"notes":null,"org_country":"US","org_id":"b9ca84e47f64","org_name":"San Francisco Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"BVHM staff mistakenly shared an electronic document containing student information with members of the BVHM community, including non-District personnel.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146782"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BVHM%20-%20LETTER%20Notice%20of%20Data%20Breach%20%5BEnglish%5D%20-%20Google%20Docs_0.pdf"}],"summary":"San Francisco Unified School District staff mistakenly shared a document containing student information and default passwords with members of the Buena Vista Horace Mann community.","supporting_quote":"Sharing this information with non-District personnel was a mistake and resulted in some BVHM families having access to this information regarding students other than their own for approximately a 2-hour period.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edb6a4e11769206410fe163f82c8d59b9bbc87c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7bde6b70-0a10-11ea-9e73-f15207d33dcb"},"incident_date":"2019-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"b15132b07ca7","org_name":"Safaricom","org_type":"technology_saas","ransomware":null,"records_affected":11500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nation.co.ke/news/Safaricom-staff-charged-with-Sh300m-fraud/1056-5151978-6ok5a3/index.html"}],"summary":"Safaricom employees unlawfully copied and shared privileged subscriber data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1592a9a3175489b58b4eaa560fc3dbafe2d5ac08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cb44f910-ce63-11e9-b4e5-4769cce343a0"},"incident_date":"2019-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d4d4d1301240","org_name":"Queen Elizabeth Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/prince-edward-island/pei-privacy-health-1.5172124"}],"summary":"P.E.I.'s privacy watchdog wants Health PEI to keep closer tabs on one of its employee's use of patient health records, following a privacy breach last year at Queen Elizabeth Hospital.  That's according to a new report by Information and Privacy Commissioner Karen Rose, posted Ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d31581706a1c22531932e0f5532be765b679df66","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59dde750-aefb-11e9-b3f3-410dc98f333e"},"incident_date":"2019-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8a516618516","org_name":"Post Acute Medical, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://pennrecord.com/stories/512758478-software-firm-health-care-provider-accuse-each-other-of-theft-houston-mayoral-candidate-working-the-case"}],"summary":"Houston mayoral candidate and prominent trial lawyer Tony Buzbee is serving as defense counsel in a federal court lawsuit in Pennsylvania, brought by a health care provider who says the owner and operator of its computerized records database illegally procured and retained its co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bcaf14ff84d961b65bf8df6e524105ac9c0243a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2f135d0-e4a7-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bff07e5a0b4c","org_name":"Oklahoma City Public Schools","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cybersecurity-insiders.com/ransomware-attack-on-oklahoma-city-public-schools/"}],"summary":"Oklahoma City Public Schools on Tuesday have issued a public statement saying that a recent ransomware attack has compromised data on the district’s computer network and the extent of the impact is yet to be analyzed.  The malware variant which encrypted the network is yet to be ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5f0b17d64467d3a8fcd5ae1174115a307827804","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2fcc18c0-ddfd-11e9-92e6-b7a271e742aa"},"incident_date":"2019-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0da317a4c235","org_name":"North West Territories Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com/news/canada/2019/09/12/nwt-faces-lawsuit-over-health-data-breach-that-could-affect-all-residents.html"}],"summary":"The Northwest Territories is facing a lawsuit over a stolen laptop containing medical files that could include information on every resident in the territory.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c918a1f03321e583715d086b68e2b5ae104809e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b1a00430-de1e-11e9-b511-f75921c18742"},"incident_date":"2019-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a185fdefa5f0","org_name":"Ifficient","org_type":"professional_services","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unsecured-survey-database-exposes-info-of-8-million-people/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/unsecured-survey-database-exposes-info-of-8-million-people/"}],"summary":"An unsecured database has exposed the personal information of 8 million people from the U.S. who participated in online surveys, sweepstakes, and requests for free product samples.  […] Sanyam Jain, an independent security researcher and member of the GDI Foundation, discovered a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fde3150f95a4c33c5436c76f3048645059dc3c3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85bd5560-e0ae-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"0e16f419c21a","org_name":"Chtrbox","org_type":"professional_services","ransomware":null,"records_affected":49000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/database-may-have-exposed-instagram-data-for-49-million-a-12503;"},{"fetched_at":null,"title":null,"type":"press","url":"https://z6mag.com/2019/05/27/company-denies-unethical-collection-of-ig-influencer-data-following-online-exposure/"}],"summary":"There's been a potential leak of personally identifiable information from Instagram, but it's not clear yet whether the data came directly came from the social media company.  Security researcher Anurag Sen found a database online that appeared to contain profile data for 49 mill","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c8edc7d56a6c834805ea7318048e2b6aefd1de4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61a2fb30-0ade-11ea-a7de-15b14f857e77"},"incident_date":"2019-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b95ea73c431","org_name":"Beaumont Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wxyz.com/news/i-felt-so-betrayed-woman-sues-beaumont-after-medical-records-turn-up-on-social-media"}],"summary":"employee accesses patient information stored by victim to embarrass her on social media.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20118d3167a7bb63cf66ef3f8fa174fda802919a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"033a0ff0-e0b5-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6db7aea682c","org_name":"American Baptist Homes of the Midwest,","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.albertleatribune.com/2019/05/cyber-security-breach-found-at-american-baptist-homes-of-the-midwest/"}],"summary":"American Baptist Homes of the Midwest, owner of Thorne Crest Senior Living Community and Crest Services in Albert Lea, on Monday announced it had an information security breach that could potentially affect some residents.  According to a press release, an unauthorized party gain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-04-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ad475c53169ff5c86f5188199a4e253c2920478","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Inmediata%20Ad%20No%20SSN%20r3fin_0.pdf"},"notes":null,"org_country":"US","org_id":"2d52c8ca577c","org_name":"Immediata Health Group Corp.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A webpage setting permitted search engines to index pages on the internal website, making patient information publicly available online.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Inmediata%20Ad%20No%20SSN%20r3fin_0.pdf"}],"summary":"Inmediata reported that a webpage setting made patient information on an internal website publicly available online, with no evidence that files were copied or saved.","supporting_quote":"In January 2019, Inmediata became aware that some of its member patients’ electronic patient health information was publicly available online as a result of a webpage setting that permitted search engines to index pages that are part of an internal website we use for our business operations.","technology_involved":["internal website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af4a8f468d7da5be5fc59107846118ff3c227908","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ae39280-1d0f-11ea-93dd-ad92e007263c"},"incident_date":"2019-04-29","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b58b996cc72","org_name":"Washington University School of Medicine's ophthalmology and visual sciences department","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/washington-university-school-of-medicine-notifies-patients-of-data-breach.html"}],"summary":"A limited number of patients within Washington University School of Medicine's ophthalmology and visual sciences department may have had their information viewed by an unauthorized person.  In September, officials at the St. Louis-based university learned that patients had receiv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-29","discovered_date":"2019-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32328279cbd22eb64fe5a82464869b29f4e5460c","impact_type":"data_theft","incident_date":"2018-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CX1%20US%20LTR%20%28no%20MA%20or%20CT%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a610c5ab4a1a","org_name":"Citrix Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146736"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CX1%20US%20LTR%20%28no%20MA%20or%20CT%29_0.pdf"}],"summary":"Cyber criminals had intermittent access to Citrix’s internal network and removed files that may have contained employee, beneficiary, or dependent information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-04-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cf4ac299d24b4c794429158eaaaa7db9b4f4ee6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ba7138d0-3b1f-11ec-ba5b-a1f2db3b8242"},"incident_date":"2019-04-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ef32829adc5","org_name":"National Cardiovascular Partners","org_type":"healthcare","ransomware":null,"records_affected":78070,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/healthcare-breach-email-hack-exposes-78-000-cardiovascular-patients-data"}],"summary":"Healthcare breach: Email hack exposes 78,000 cardiovascular patients’ data - National Cardiovascular Partners","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77d0e7f13f78a451753ff2752b6efabea82d6dd7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10628.pdf"},"notes":null,"org_country":"US","org_id":"fa251f5d5595","org_name":"Port of Seattle","org_type":"government","ransomware":null,"records_affected":3490,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10628.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10628.pdf"}],"summary":"A vulnerability in an externally hosted employee services website may have made employees’ and contractors’ personal information discoverable, but the investigation found no evidence of unauthorized access or acquisition.","supporting_quote":null,"technology_involved":["employee services website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-26","discovered_date":"2019-03-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9edf611711633e5892fc3cc08a33da69b7ba48b8","impact_type":"unknown","incident_date":"2018-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"31eeeecd9a5d","org_name":"Partners In Care","org_type":"unknown","ransomware":null,"records_affected":3048,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Partners%20In%20Care-2019-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac3ff0e607da8bf8086b6b9e9ac00dd7c773afab","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20California%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"495e63736cdc","org_name":"Loungefly, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146708"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20California%20Consumer%20Notice_0.pdf"}],"summary":"Unauthorized code was placed on the part of Loungefly’s computer network that processed payment card transactions for its online store, and payment card information may have been affected.","supporting_quote":null,"technology_involved":["payment card transaction processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-26","discovered_date":"2019-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1b92cecb7b0441bf698a11c31580acc83cfaab6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lancaster%20Archery%20-%20Regulator%20Letter%20-%20CA%20_0.pdf"},"notes":null,"org_country":"US","org_id":"0b8a82978c3d","org_name":"Lancaster Archery Supply, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146707"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lancaster%20Archery%20-%20Regulator%20Letter%20-%20CA%20_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lancaster%20Archery%20Supply%2C%20Inc.-2019-04-26"}],"summary":"Lancaster Archery Supply reported that payment card information used on its websites may have been compromised between July 4, 2018, and February 16, 2019.","supporting_quote":null,"technology_involved":["www.lancasterarchery.com","www.lancasterarcherydealer.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-26","discovered_date":"2018-04-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"41ade38e65624ec02f00f7327f345842765bd75f","impact_type":"unknown","incident_date":"2017-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"08b46df8679f","org_name":"Full Access High Desert","org_type":"unknown","ransomware":null,"records_affected":390,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Full%20Access%20High%20Desert-2019-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2019-04-26","discovered_date":"2018-11-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb1ed9daa66ea651a652b2c051f4689535a9d8c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Abel%20HR%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"0bec98446d72","org_name":"Abel HR","org_type":"professional_services","ransomware":null,"records_affected":710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146693"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Abel%20HR%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"}],"summary":"An unauthorized actor logged into an Abel HR employee’s email account, where personal information was potentially exposed; Abel HR could not confirm that information was acquired.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a123dfb4bc8c8274c4835a7594407a0e4fdbd29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"181ea540-b46c-11e9-a8df-bd69f47bcb14"},"incident_date":"2019-04-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5eb7d3b21d4","org_name":"steps to recovery","org_type":"healthcare","ransomware":null,"records_affected":146316,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/60000-patients-employee-records-breached-in-emcare-email-hack,https://rainbowtabl.es/2019/04/19/steps-to-recovery-recovery-addiction-treatment-center-leak/"}],"summary":"elastic search database on internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-24","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ceafd7ccd71abde07c27a0960f76fe8d3712cc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hot%20Line%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"d6a60f69ee95","org_name":"Hot Line Construction, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146624"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hot%20Line%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Hot Line Construction reported unauthorized access to certain employee email accounts containing personal information.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-24","discovered_date":"2018-12-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b163cd781f367bafd53548eed1386b52a74678b","impact_type":"unknown","incident_date":"2017-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"110131f5b1d5","org_name":"Doctors' Management Service, Inc. (\"DMS\")","org_type":"unknown","ransomware":null,"records_affected":206695,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Doctors%27%20Management%20Service%2C%20Inc.%20%28%22DMS%22%29-2019-04-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-23","discovered_date":"2019-03-28","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6786d660e091392d583f97796a976d9361e56427","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10626.pdf"},"notes":null,"org_country":"US","org_id":"979a65fae900","org_name":"Seattle University","org_type":"education","ransomware":null,"records_affected":2064,"reviewed":false,"root_cause":"An unencrypted University-issued laptop containing personal information was lost.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10626.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10626.pdf"}],"summary":"Seattle University reported that an unencrypted laptop containing employees’ and dependents’ names and Social Security numbers was lost; it found no evidence that the information was accessed by an unauthorized person.","supporting_quote":"On March 28, 2019, Seattle University was informed by an employee that an unencrypted University-issued laptop was lost while the employee was commuting on a bus on March 26, 2019.","technology_involved":["University-issued laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bb8da9915ce091c7d3b2c2bc2168d4d4ee462c1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61633950-de0b-11e9-92e6-b7a271e742aa"},"incident_date":"2019-04-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd9f7928f586","org_name":"Connally Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":7358,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/stolen-laptop-puts-health-information-of-7-000-texas-hospital-patients-at-risk.html"}],"summary":"Floresville, Texas-based Connally Memorial Medical Center is notifying 7,358 patients that their protected health information may have been exposed.  Connally Memorial learned June 21 that a laptop that stored patient information was stolen. The laptop belonged to a business asso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd224ede12edfafcd37c853e04522c31ecb5253d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"77811a7609ef","org_name":"Club Penguin Rewritten","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Club Penguin Rewritten (January 2018)","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClubPenguinRewritten"}],"summary":"Club Penguin Rewritten experienced a breach that exposed email addresses, IP addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-22","discovered_date":"2019-03-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b843d2680370af39a3bfa43ea0b15a8f6921b471","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-15","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10625.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"52a58fd91a22","org_name":"Area Agency on Aging and Disabilities of Southwest Washington","org_type":"professional_services","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10625.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10625.pdf"}],"summary":"A former employee emailed a report containing provider authorization records to a personal email account without permission.","supporting_quote":"The former employee, without AAADSW and/or client permission, encrypted and wrongly emailed the report to a personal email account to understand whether there would be sufficient business to become a contractor.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"856c01eb5d9b537ea31c8b4839ca891c758d46be","impact_type":"data_theft","imported_from":null,"incident_date":"2018-10-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"PL","org_id":"e439184f6436","org_name":"Morele.net","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Morele.net","type":"hibp","url":"https://haveibeenpwned.com/Breach/MoreleNet"}],"summary":"Morele.net's October 2018 breach exposed email addresses, names, phone numbers, and hashed passwords.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6771a3b893a5486095e0dc375ed670646a8d4d5","impact_type":"data_theft","incident_date":"2018-07-05","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"19ac498edf08","org_name":"Vitalize, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146494"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice_0.pdf"}],"summary":"A phishing email led to unauthorized activity involving Bodybuilding.com systems, and some data was removed.","supporting_quote":"Bodybuilding.com engaged one of the leading data security firms to conduct a thorough investigation, which traced the unauthorized activity to a phishing email received in July 2018.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"614954a39f1a284a28eb4941dec1c5b699d57942","impact_type":"unknown","incident_date":"2019-03-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"869b4c1c859a","org_name":"Mikhail Education Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146492"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-19","discovered_date":"2018-11-26","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38fde1c38303f6c048778c491cfeee4b111441f4","impact_type":"disruption_or_ransomware","incident_date":"2018-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4_19_2019_FINAL_Notice_of_Data_Breach__International_Agri-Center__0.pdf"},"notes":"attack_techniques without supporting words dropped: T1133","org_country":"US","org_id":"68e6053e9507","org_name":"International Agri-Center","org_type":"unknown","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146491"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4_19_2019_FINAL_Notice_of_Data_Breach__International_Agri-Center__0.pdf"}],"summary":"An unauthorized user accessed International Agri-Center servers using Microsoft remote assistance tools and deployed ransomware; files may have been accessed, but the organization had no knowledge that personal information was accessed or acquired.","supporting_quote":null,"technology_involved":["Microsoft remote assistance tools"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2019-04-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"153f2c9460b7a366efc5044bb8ccc3e2b6bad68c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ec09cb0-b3b3-11e9-8244-abb132467e1d"},"incident_date":"2019-04-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2104fb45c1de","org_name":"UMass Memorial Community Healthlink","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.masslive.com/news/2019/06/umass-memorial-community-healthlink-in-worcester-reports-data-breach-hacker-gained-access-to-email-accounts.html,https://www.wbjournal.com/article/community-healthlink-reports-data-breach"}],"summary":"victim phished leading to compromise of email account and breach of medical data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0391cc418a8c5e039e18a4913538e7b71d919d40","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b417340-b471-11e9-a8df-bd69f47bcb14"},"incident_date":"2019-04-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"51eddc8f838a","org_name":"TAP30","org_type":"transportation_logistics","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securitydiscovery.com/iranian-ride-hailing-app-database-exposure/,https://financialtribune.com/articles/sci-tech/97520/massive-data-leak-hits-ride-hailing-firm-in-iran"}],"summary":"mongDB database discovered online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-18","discovered_date":"2018-10-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5ea1a0fb029bfe5517c4405070cd49fb11126262","impact_type":"unknown","incident_date":"2018-10-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"718fd1fa0b4b","org_name":"Oregon Institute of Technology","org_type":"unknown","ransomware":null,"records_affected":1116,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Institute%20of%20Technology-2019-04-18"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Institute%20of%20Technology-2019-04-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-04-18","discovered_date":"2019-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcabef30a01418fbd6e6b1b5ce180f40956251ae","impact_type":"unknown","incident_date":"2019-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GWP%20GEN%20LTR_0.PDF"},"notes":null,"org_country":"US","org_id":"09b2a569ddd2","org_name":"Gary W. Peer","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146465"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GWP%20GEN%20LTR_0.PDF"}],"summary":"Gary W. Peer reported that an unauthorized individual may have accessed the patient file system, but the affected files could not be determined.","supporting_quote":null,"technology_involved":["patient file system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78148acc7c4625ae91cae50d14ae5a58a6123f46","impact_type":"both","incident_date":"2019-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dr%20Ip%20Ad%20SSN%201%20Year%20r4fin_0.pdf"},"notes":null,"org_country":"US","org_id":"ff90b8c5d106","org_name":"Dr. T.Y. Steven Ip","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dr%20Ip%20Ad%20SSN%201%20Year%20r4fin_0.pdf"}],"summary":"A ransomware attack on Dr. T.Y. Steven Ip's office gave a criminal access to data, and the investigation found that information had been taken from the system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f6c9204ab2f0431a8326c479666c0ba293bd48c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ID","org_id":"6550cd7be4bb","org_name":"Bukalapak","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bukalapak","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bukalapak"}],"summary":"Bukalapak discovered in March 2019 that a breach of its backups exposed email addresses, IP addresses, names, and hashed passwords.","supporting_quote":null,"technology_involved":["backups"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2019-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dcc40ba60266b7db78306ed71a8a76f3d1b25fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebc24170-c8f5-11e9-9c16-3f32faecab86"},"incident_date":"2019-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59819c0dd56a","org_name":"Regional Cancer Care Associates LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/regional-cancer-care-associates-notice-230000917.html"}],"summary":"HACKENSACK, N.Y., July 23, 2019 /PRNewswire/ -- On May 24, 2019, RCCA MSO LLC (\"RCCA MSO\"), the management services entity for Regional Cancer Care Associates LLC (\"RCCA\") and RCCA MD LLC (\"RCCA MD\" and together with RCCA MSO and RCCA, the \"RCCA Group\") became aware of suspicious","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-16","discovered_date":"2019-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7793c072c288f8873c0a34705da6b592fac2e64b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-23","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LD-Evans-Notification-letter-CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"061234cee620","org_name":"L.D. Evans, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146358"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LD-Evans-Notification-letter-CA_0.pdf"}],"summary":"L.D. Evans, CPA notified clients after an unauthorized third party accessed Citrix ShareFile systems and downloaded documents, though compromise of their information was not confirmed.","supporting_quote":"According to Citrix, an unknown, unauthorized third party gained access to their systems and downloaded documents stored with the Citrix ShareFile environment.","technology_involved":["Citrix ShareFile"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Citrix"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"6ff730cf6d53","name":"Citrix"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-04-16","discovered_date":"2019-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8173976e480e1a698ff653e34a05cdc3efe5de97","impact_type":"disruption_or_ransomware","incident_date":"2019-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Centrelake%20Medical%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"fdca7fe5dc64","org_name":"Centrelake Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146402"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Centrelake%20Medical%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Centrelake Medical Group discovered a virus that blocked access to its files, and said an unknown third party introduced it and had access to servers containing patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7537b4b62b011572f5d4abcd79fb7cdf7f0d3350","impact_type":"disruption_or_ransomware","incident_date":"2019-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10560.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"77586b4ebd43","org_name":"Housing Authority of Thurston County","org_type":"government","ransomware":true,"records_affected":25357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10560.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10560.pdf"}],"summary":"Ransomware encrypted files containing names and Social Security numbers at the Housing Authority of Thurston County.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e776bc9fd913bd686d5893d36d77a7adc452027","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Coinmama.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d2b5730f47b","org_name":"Coinmama","org_type":"unknown","ransomware":null,"records_affected":3941,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Coinmama.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"031b81d2850d8e9c02a5ac6d853fb946a4723167","impact_type":"unknown","incident_date":"2019-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Cal%20AG%20Notification%20Ltr%204.12.2019_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7da7e4e61447","org_name":"The Hartford Life and Accident Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146265"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afa86c374b2163f5a10ed47b92e9cd63c2b3a38e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_E5564_L01.docx_SAS_PROOF%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"6e87ba5fe1bc","org_name":"California Community Colleges Chancellor's Office","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146256"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_E5564_L01.docx_SAS_PROOF%20%281%29_0.pdf"}],"summary":"The letter reports that personal information may have been affected in a data security incident involving Pearson VUE's California Nurses' Aide assessment and licensure services.","supporting_quote":null,"technology_involved":["Pearson VUE"],"third_party":{"archetype":null,"involved":true,"vendor":"Pearson VUE"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"9743f229aa44","name":"Pearson VUE"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-11","discovered_date":"2019-04-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"61f4e182e613f289b4593db62473052c36666734","impact_type":"unknown","incident_date":"2019-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b8e5c06c300","org_name":"RS Medical","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RS%20Medical-2019-04-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-11","discovered_date":"2019-02-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b47932c484459db3cdaaec873c4a9ee383712181","impact_type":"unknown","incident_date":"2019-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8e640944c98","org_name":"Clearway Pain Solutions Institute","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Clearway%20Pain%20Solutions%20Institute-2019-04-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36ff45ac5b9d7159d912046bb8d5cc4599a69342","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fcd242e0-2b69-11ea-b50d-3fd6f00cf940"},"incident_date":"2019-04-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8aa2ea25de15","org_name":"Main Street Clinical Associates, PA","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/main-street-clinical-associates-pa-provides-notice-of-data-security-incident-300954904.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/laptops-cell-phone-printer-stolen-from-north-carolina-provider-may-have-exposed-patient-data.html"}],"summary":"On April 10, 2019, the building adjacent to Main Street's office located in Durham, North Carolina suffered a severe gas explosion. The explosion forced Main Street's employees to immediately evacuate their office without the opportunity to properly store and secure patient infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c52775679254604d923f965bccafc9d6478e4851","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jobscience%20--%20Individual%20Notice%20Template%20--%20DEFAULT_0.pdf"},"notes":null,"org_country":"US","org_id":"bf741b47b859","org_name":"Jobscience, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146168"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jobscience%20--%20Individual%20Notice%20Template%20--%20DEFAULT_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10624.pdf"}],"summary":"Jobscience reported that an unauthorized third party accessed a server used to process job application information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-09","discovered_date":"2019-02-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"813f41bb9165ebba74cf553f0407e80b30c9cf4f","impact_type":"unknown","incident_date":"2018-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d9e7e1cace99","org_name":"New Bit Ventures Ltd. (owner of Coinmama.com)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20Bit%20Ventures%20Ltd.%20%28owner%20of%20Coinmama.com%29-2019-04-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6462b12d49e91e0d5e23faafa6d921602e219b39","impact_type":"data_theft","imported_from":null,"incident_date":"2017-01-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"27fca3b12801","org_name":"DataCamp","org_type":"technology_saas","ransomware":null,"records_affected":760561,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DataCamp","type":"hibp","url":"https://haveibeenpwned.com/Breach/DataCamp"}],"summary":"DataCamp records containing email and IP addresses, names, and bcrypt-hashed passwords were exposed and later circulated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4117e79ea592be19921635a3308f62e60d1333f1","impact_type":"unknown","incident_date":"2017-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"bde845d33dce","org_name":"Canyon Bakehouse LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample_0.pdf"}],"summary":"Canyon Bakehouse notified people of a data security issue involving personal information entered on its website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf0f3e4ee740ad6354f60aa7a45ca9e17dc64c7b","impact_type":"data_theft","imported_from":null,"incident_date":"2018-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"1298d0aff1a2","org_name":"Knuddels","org_type":"technology_saas","ransomware":null,"records_affected":808330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Knuddels","type":"hibp","url":"https://haveibeenpwned.com/Breach/Knuddels"}],"summary":"Knuddels suffered a data breach that exposed email addresses, usernames, names, geographic locations, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"901f9e9d8499464f68b383960716ad2518f4c049","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CoastalRidgeRealEstate.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5551edf7ab92","org_name":"Coastal Ridge Real Estate Partners","org_type":"unknown","ransomware":null,"records_affected":53,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/CoastalRidgeRealEstate.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fc6cc30d42eca66d773b8b2359653b9139a4ca3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad25b8f0-de19-11e9-b511-f75921c18742"},"incident_date":"2019-04-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"455e42aa2824","org_name":"Shingle Springs Health and Wellness Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.spamfighter.com/News-22296-Ransomware-Attack-on-Shingle-Springs-Health-and-Wellness-Center-impacted-more-than-21000-patients.htm"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/california-medical-center-notifies-21k-patients-of-ransomware-attack.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://compliancy-group.com/ransomware-attack-on-california-health-and-wellness-center-leaves-up-to-21500-exposed/"}],"summary":"https://compliancy-group.com/ransomware-attack-on-california-health-and-wellness-center-leaves-up-to-21500-exposed/","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-05","discovered_date":"2019-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bacca132480c8a2e42a2ca6d7abd54af3a0459ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USA01-%2312602455-v1-AG_CA_Notice_-_Urban_One_0.pdf"},"notes":null,"org_country":"US","org_id":"ab388e943d10","org_name":"Urban One, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146060"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USA01-%2312602455-v1-AG_CA_Notice_-_Urban_One_0.pdf"}],"summary":"Urban One discovered unauthorized access to its network and determined that its HR database and credentials entered on company computers may have been accessed.","supporting_quote":null,"technology_involved":["HR database","corporate computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"381ccdbe311514f5fc5190814393949c686f52e3","impact_type":"data_theft","incident_date":"2018-09-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_29.pdf"},"notes":null,"org_country":"US","org_id":"2eb8b8d342fe","org_name":"Pie Five Pizza","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_29.pdf"}],"summary":"Pie Five Pizza reported that malicious software on payment processing systems at some locations captured payment card information.","supporting_quote":null,"technology_involved":["payment processing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-04-05","discovered_date":"2019-01-20","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"375b93b8a47b514c9e9e5eded1da168437c356b5","impact_type":"data_theft","incident_date":"2018-12-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bank%20of%20the%20West%20LS%200319-031%20Campbell%20ATM_0.pdf"},"notes":null,"org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146057"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bank%20of%20the%20West%20LS%200319-031%20Campbell%20ATM_0.pdf"}],"summary":"Bank of the West found that an ATM skimming device collected debit card and PIN information from customers who used its Campbell Branch ATM.","supporting_quote":"Our review found that a device known as an “ATM skimming device” had been installed and removed from our Campbell Branch ATM.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-04-05","discovered_date":"2018-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d5adbe4d0be461e609908c4a5e21df0f5c9b4122","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10622.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3e318f7d52a6","org_name":"Archbright","org_type":"professional_services","ransomware":null,"records_affected":1568,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10622.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10622.pdf"}],"summary":"Archbright reported that an unauthorized individual may have accessed emails or attachments from employee email accounts containing personal information.","supporting_quote":null,"technology_involved":["email system","email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6cfbb9fbbf8d4b1612cca73a0ddb94a30dbc2a7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20ZOLL%20Consumer%20Notice%20With%20Insert_0.pdf"},"notes":null,"org_country":"US","org_id":"b160929cfcee","org_name":"ZOLL Services LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145987"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20ZOLL%20Consumer%20Notice%20With%20Insert_0.pdf"}],"summary":"ZOLL Services LLC reported that personal information in emails stored by a third-party provider was exposed during a server migration.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"873f8d82f0a606d21c77256eeafa375900450776","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"348b2b96af5c","org_name":"Demon Forums","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Demon Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/DemonForums"}],"summary":"A breach of Demon Forums’ vBulletin forum exposed email addresses, usernames, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-04","discovered_date":"2019-03-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16a8b4b94d9082b5c029f37e7dff0a18930acb3f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cali%20Indiv%20Notification%20042019_0.pdf"},"notes":null,"org_country":"US","org_id":"8165fb82b1c7","org_name":"AeroGrow International","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cali%20Indiv%20Notification%20042019_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AeroGrow%20International-2019-04-04"}],"summary":"AeroGrow reported that malicious code on its website may have exposed payment card information entered on an eCommerce vendor’s payment page.","supporting_quote":null,"technology_involved":["eCommerce vendor payment page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32f2b0dd7983ed72479b4ac3241914354a44d9bd","impact_type":"data_theft","imported_from":null,"incident_date":"2019-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f11252129102","org_name":"Everybody Edits","org_type":"technology_saas","ransomware":null,"records_affected":871190,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Everybody Edits","type":"hibp","url":"https://haveibeenpwned.com/Breach/EverybodyEdits"}],"summary":"A breach at Everybody Edits exposed email addresses, usernames, and IP addresses, and the data was later distributed online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-04-03","discovered_date":"2019-03-08","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c325aca7eb544e1fa509db103296c5ab30f144c7","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-03-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%20Altura%20Credit%20Union%2020190327_0.pdf"},"notes":null,"org_country":"US","org_id":"205d7844e4b2","org_name":"Altura Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%20Altura%20Credit%20Union%2020190327_0.pdf"}],"summary":"Altura Credit Union reported that skimming devices installed on its ATMs may have exposed card numbers, PINs, and names.","supporting_quote":"These ATM skimming devices were unlawfully installed on our machines at various points between March 5 to March 8, 2019.","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"851613a58b783df0329aa0103754833d9c89328d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/PalmettoHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb757088b86d","org_name":"Palmetto Health","org_type":"unknown","ransomware":null,"records_affected":2260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/PalmettoHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-02","discovered_date":"2019-02-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b027f5b43d395e0dc57ca0c4a436452bb55d4ec1","impact_type":"unknown","incident_date":"2018-11-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"506535e3e4b4","org_name":"Oregon Endodontic Group","org_type":"unknown","ransomware":null,"records_affected":2952,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Endodontic%20Group-2019-04-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-04-02","discovered_date":"2019-02-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"75d6355ff8f2bf0442d7f4a4e4ba94fc934a9d98","impact_type":"data_theft","incident_date":"2018-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10621.pdf"},"notes":null,"org_country":"US","org_id":"2d568ca87be6","org_name":"New Bit Ventures Ltd.","org_type":"financial","ransomware":null,"records_affected":1221,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10621.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10621.pdf"}],"summary":"An unauthorized party acquired personal information associated with Coinmama user accounts, affecting approximately 1,221 Washington residents.","supporting_quote":null,"technology_involved":["Coinmama.com platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-04-02","discovered_date":"2018-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c21a0d367f6c6d335ba9530892289de873b44b8e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-07","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WEBSITE%20NOTIFICATION%20%28J2477810x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1dad6d251533","org_name":"Key West Hotels, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145893"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WEBSITE%20NOTIFICATION%20%28J2477810x7AD79%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Key%20West%20Hotels%2C%20LLC-2019-04-02"}],"summary":"An intruder used malware to access guest reservation information on the Hotel’s front desk computer system.","supporting_quote":"Using malware, the intruder was able to gain access to and view guest reservation information.","technology_involved":["front desk computer system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87bce58c6a282ce16a767a6b0c4ff6f10a4a6d63","impact_type":"unknown","incident_date":"2019-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"efacd6fbac3a","org_name":"International Rehabilitative Sciences, Inc. dba RS Medical","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145863"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6522551f520ad3df1eb96b05f1ff1d7bc7ad04e5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cef4d060-9378-11e9-96b8-11c597846497"},"incident_date":"2019-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d46a3621c871","org_name":"Valero","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://abc13.com/6-credit-card-skimmers-found-at-north-loop-gas-station/5239397/"}],"summary":"Skimmer on gas pump.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","secrets"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"499476d303885f807671f64e61a884a62f424fd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a8509040-ce6d-11e9-b4e5-4769cce343a0"},"incident_date":"2019-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"346e46aefb8b","org_name":"Samsung","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gdpr.report/news/2019/05/10/samsung-data-leak-exposes-source-code-passwords-and-employee-data/"}],"summary":"Security researcher revealed that sensitive information including source code, credentials and secret keys have been made accessible on GitLab. Mossab Hussein, a security researcher at SpiderSilk,  discovered dozens of exposed files and credentials to the entire AWS account that ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42b4417cb7d02372e01f57187b8d6deb058e5356","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a777e1e0-c9eb-11e9-9a33-13e06a29212c"},"incident_date":"2019-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3e2dab6eff9","org_name":"Quantum Vision Centers and Eye Surgery Center LLC,","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spamfighter.com/News-22302-Files-of-JFJ-Eyecare-were-encrypted-after-a-malware-attack.htm"}],"summary":"JFJ Eyecare Ltd., doing business as the Quantum Vision Centers and Eye Surgery Center LLC, announced about security breach of their systems. This incident has caused a few of its systems getting accessed by the hackers.  As per a press release, the Quantum Vision Centers and Eye ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d299f11e5ada126d7a66bde2949675e4e697a45d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c58162d0-cd8b-11e9-b4e5-4769cce343a0"},"incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce841ea7e74b","org_name":"Providence Health","org_type":"financial","ransomware":null,"records_affected":122000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.oregonlive.com/news/2019/08/122000-providence-health-plan-customers-may-be-affected-by-data-breach.html"}],"summary":"The personal information of as many as 122,000 customers of Providence Health Plan’s dental program in Oregon may have been compromised in a security breach at the program’s administrator, Virginia-based Dominion National.  The timing of the breach? Dominion doesn’t really know, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"274492acbed33e03a54e7b6cd7c39a6baac35871","impact_type":"data_theft","imported_from":null,"incident_date":"2019-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"NZ","org_id":"d0d1747f948e","org_name":"Lumin PDF","org_type":"technology_saas","ransomware":null,"records_affected":15453048,"reviewed":false,"root_cause":"Data was left publicly exposed in a MongoDB instance.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lumin PDF","type":"hibp","url":"https://haveibeenpwned.com/Breach/LuminPDF"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/"}],"summary":"Lumin PDF user data was left publicly exposed in a MongoDB instance, and 15,453,048 records appeared for download.","supporting_quote":"The data had been left publicly exposed in a MongoDB instance after which Lumin PDF was allegedly been \"contacted multiple times, but ignored all the queries\".","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e94f12df87f9e8b477a1c86e1572b623738604eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17f01c60-0a52-11eb-a175-e162319ad19d"},"incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"818d47569a3c","org_name":"EVERSANA","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/eversana-notification-data-privacy-incident-010000660.html"}],"summary":"Unknown activity (on legacy technology?) led to email compromise of PHI.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3c9857b858844fd8efd268cccd11364a24da73d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f7328e40-e446-11e9-ae80-e5ad9aac92e3"},"incident_date":"2019-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"76c332bca412","org_name":"Citycomp","org_type":"professional_services","ransomware":null,"records_affected":312570,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vice.com/en_us/article/d3np4y/hackers-steal-ransom-citycomp-airbus-volkswagen-oracle-valuable-companies;https://www.businessinsider.com/hackers-stole-data-from-citycomp-and-are-blackmailing-the-company-2019-4;https://www.channelfutures.com/mssp-insider/citycomp-ransomware-attack-nabs-financial-data-from-several-large-companies;https://www.citycomp.de/English/enterprise/stellungnahme.html;https://nakedsecurity.sophos.com/2019/05/02/extortionists-leak-data-of-huge-firms-after-it-provider-refuses-to-pay/"}],"summary":"Financial data from some the world’s biggest companies – including Porsche, Oracle, Toshiba and more – has been stolen and published in a ransomware attack on the large, Germany-based IT provider Citycomp.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"396c6338c924951a4932266e8b0e4afb86c10049","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"892a1030-3b15-11ec-ba5b-a1f2db3b8242"},"incident_date":"2019-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1f08cdeaeedd","org_name":"City of Stratford","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kitchener.ctvnews.ca/stratford-paid-75-091-to-end-recent-cyber-attack-1.4601497"}],"summary":"City of Stratford paid $75k after experiencing a ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cef41761a1f1833df0103c291e1ca52ddefeef3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a15200e0-c822-11e9-8a5a-abdcbb867af8"},"incident_date":"2019-04-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f467159d707f","org_name":"Capital One","org_type":"financial","ransomware":null,"records_affected":106000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnn.com/2019/07/29/business/capital-one-data-breach/index.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.documentcloud.org/documents/6224689-Capital-One-breach-criminal-complaint.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.businessinsider.com/how-the-fbi-caught-paige-a-thompson-alleged-capital-one-hack-2019-7;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.bloomberglaw.com/class-action/capital-one-hit-with-first-class-action-over-security-breach;"}],"summary":"A former software engineer named Paige A. Thompson hacked into Capital One's systems and accessed the information of more than 100 million credit-card applicants and customers, federal prosecutors said. An FBI agent said he tracked her down after she talked about it online.  A so","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c940737704e978b53bd0eeb0509de7468ae81ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9357c330-e45b-11e9-a93a-d3a3d34c5869"},"incident_date":"2019-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"722b018e913f","org_name":"AMC Networks","org_type":"technology_saas","ransomware":null,"records_affected":1600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.engadget.com/2019/05/03/amc-sundance-now-shudder-subscriber-exposed-database/"}],"summary":"exposed databases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8b1a01662cd535d520a6420a5d10b313c12feac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8be71c50-099c-11ec-863c-8359987c65e0"},"incident_date":"2019-03-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9535df8f6ba","org_name":"University of Florida Health Shands","org_type":"healthcare","ransomware":null,"records_affected":1562,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/university-of-florida-health-shands-notifies-patients-of-privacy-breach/"}],"summary":"Data breach by former employee exposes 1,500+ in University of Florida Health Shands system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2f236e2e8df7bbe38c87e223ed39e00f50252570","impact_type":"data_theft","imported_from":null,"incident_date":"2018-05-23","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10620.pdf"},"notes":null,"org_country":"US","org_id":"926cd94623df","org_name":"Earl Enterprises","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Earl%20Enterprises-2019-03-29"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10620.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/EarlEnterprises.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10620.pdf"}],"summary":"Earl Enterprises reported that unauthorized individuals installed malicious software on some restaurant point-of-sale systems to capture payment card data.","supporting_quote":"Based on the investigation, it appears that unauthorized individuals installed malicious software on some point-of-sale systems at a certain number of Earl Enterprises’ restaurants.","technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-29","discovered_date":"2018-10-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5c2ecbf29e3a6ed760d66285e198009cb1d1c9fb","impact_type":"unknown","incident_date":"2018-09-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b52caa940a8","org_name":"Columbia Forest Products","org_type":"unknown","ransomware":null,"records_affected":2391,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Columbia%20Forest%20Products-2019-03-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46234ea85b2f54c46048882bbfe35b2ae5acf2de","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10652.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"28a0cac1d4c3","org_name":"HealthMarkets Insurance Agency, Inc.","org_type":"unknown","ransomware":null,"records_affected":39,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10652.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a74615d6bf6f4b2a82e1988eba4e794b8dd71d83","impact_type":"data_theft","imported_from":null,"incident_date":"2016-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9a74ed1f297e","org_name":"Whitepages","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Whitepages","type":"hibp","url":"https://haveibeenpwned.com/Breach/Whitepages"}],"summary":"Whitepages data, including email addresses, names, and hashed passwords, was breached in mid-2016 and sold in early 2019.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b77d51db0de7f186146c947f9b6779a9c5ed93","impact_type":"data_theft","imported_from":null,"incident_date":"2018-07-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ef7ac8b1c7f5","org_name":"500px","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 500px","type":"hibp","url":"https://haveibeenpwned.com/Breach/500px"}],"summary":"A 2018 data breach at 500px exposed user email addresses, names, usernames, genders, dates of birth, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-22","discovered_date":"2019-01-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2bd1598be8d2f923324cffef395521b23242204f","impact_type":"unknown","incident_date":"2018-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b0d249d6777","org_name":"Warn Industries, Inc.","org_type":"unknown","ransomware":null,"records_affected":860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Warn%20Industries%2C%20Inc.-2019-03-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-03-22","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08fc5c6f9e74f838bbd105f32df479f1bf78124e","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VMF%20Notice%20A_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"9ec208fc0381","org_name":"Verity Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VMF%20Notice%20A_0.pdf"}],"summary":"An unauthorized third party accessed a VMF employee’s Microsoft 365 email account, where attachments containing health information may have been exposed.","supporting_quote":null,"technology_involved":["Microsoft 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"450318f4e06efa85130eef2b50befd2b6d27adf4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e5bab70-d3e1-11e9-ab55-b7fffb94511d"},"incident_date":"2019-03-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e5196907cdd","org_name":"Temple University","org_type":"education","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.phillyvoice.com/temple-student-information-leaked-employee/"}],"summary":"Temple University website shared 160 students' private information.Passport numbers, phone numbers and dates of birth were accidentally published online by an employee in March","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-03-22","discovered_date":"2019-03-07","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47da2c13e2a457feb12cb57ffc72e0a3257622b7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Brighton%20Adult%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"895812c06e79","org_name":"Brighton Collectibles, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145665"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Brighton%20Adult%20CA%20Notice_0.pdf"}],"summary":"Brighton Collectibles reported that an unauthorized individual may have accessed its checkout website and information entered there, including names and payment card details.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3447d3af7b6e8f9c9020e0fb0cdcd7acd723bd9c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bridger%20-%20Website%20Notice%20of%20Data%20Breach%20--%203.22.19_0.pdf"},"notes":null,"org_country":"US","org_id":"e6f0129275a9","org_name":"Bridger Insurance Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145653"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bridger%20-%20Website%20Notice%20of%20Data%20Breach%20--%203.22.19_0.pdf"}],"summary":"Bridger Insurance Services reported potential unusual access to a server and said personal information may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"faede9e9e0362ae749c5fc9ce8ba07350c470b5b","impact_type":"data_theft","imported_from":null,"incident_date":"2018-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"213afc45969e","org_name":"Bookmate","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bookmate","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bookmate"}],"summary":"Bookmate's breached data, including personal details and salted SHA-512 password hashes, was sold in early 2019.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"422b23b203e87ce4e9fff991612a425e24183498","impact_type":"data_theft","imported_from":null,"incident_date":"2018-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ddfad4ee778f","org_name":"HauteLook","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HauteLook","type":"hibp","url":"https://haveibeenpwned.com/Breach/HauteLook"}],"summary":"HauteLook customer data, including email addresses, personal details, and bcrypt-hashed passwords, was breached and later sold.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-19","discovered_date":"2018-12-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0fa4508ff9ea94af1f723a64e5efb0b359301a5a","impact_type":"unknown","incident_date":"2018-08-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d75fbc26d94","org_name":"Providence Health Plan","org_type":"unknown","ransomware":null,"records_affected":844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Providence%20Health%20Plan-2019-03-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7ab43c56e5ae8310e3be9fca5e30192185194c13","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/TheHartford.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"341a234ca9dc","org_name":"The Hartford","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/TheHartford.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ea9fecf1af9964ebf3bb4a603a8be2dbd7cb9f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Calif%20Resident%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"4475b0544118","org_name":"Sheet Metal Workers’ Local Union No. 104","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Calif%20Resident%20Letter_0.pdf"}],"summary":"A union employee’s backpack, laptop and flash drive were stolen from a vehicle, and the flash drive may have contained personal information.","supporting_quote":"On February 5, 2019, a Sheet Metal Workers’ Local Union No. 104 employee had a backpack, laptop and flash drive stolen out of a vehicle.","technology_involved":["laptop","flash drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a768d0ecb9debcc674c386ad301d4ce86274b62a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20190201-LAC-01_Letter_EN_Final_1.pdf"},"notes":null,"org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A system error caused member ID cards to be mismatched and mailed to the wrong members.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145516"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20190201-LAC-01_Letter_EN_Final_1.pdf"}],"summary":"L.A. Care Health Plan reported that a system error led to member ID cards being mailed to the wrong members, exposing personal information.","supporting_quote":"A system error resulted in member ID cards being mismatched and mailed to the wrong L.A. Care members.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf4a2d8487389abcbec174211c4c0953309a41e7","impact_type":"data_theft","imported_from":null,"incident_date":"2019-01-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6595df6fb7a6","org_name":"ixigo","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ixigo","type":"hibp","url":"https://haveibeenpwned.com/Breach/ixigo"}],"summary":"ixigo suffered a data breach in January 2019, and the exposed data included personal information and passwords stored as MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-15","discovered_date":"2018-12-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f1b13f47e8b6d6ec06403e5b949dcd63164c168","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-12-07","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/flexPATH_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a0bce9fcf1d2","org_name":"flexPATH Strategies, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145490"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146426"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/flexPATH_CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#flexPATH%20Strategies%2C%20LLC-2019-03-15"}],"summary":"An unauthorized person accessed a flexPATH employee’s email account after a phishing email incident; personal information was found in an email attachment, but whether it was viewed or acquired was undetermined.","supporting_quote":"On December 14, 2018, our ongoing investigation into a phishing email incident at flexPATH determined that an unauthorized person had obtained access to an email account belonging to a flexPATH employee.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-03-15","discovered_date":"2019-02-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c269147c6da15401b1096a01d390f094a7e24e5","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LR%20-%20CECI%20-%20Individual%20Notification%20Letter%2002%2014%2019%20FINAL%20PROOF%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"68ccf9b4fcb9","org_name":"CorVel Enterprise Comp Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145474"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LR%20-%20CECI%20-%20Individual%20Notification%20Letter%2002%2014%2019%20FINAL%20PROOF%20%281%29_0.pdf"}],"summary":"An employee mistakenly emailed a report containing personal and injury information to the wrong recipient, who confirmed it was not opened or retained.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"380a03c5b9286afa20083631e637caee717265b2","impact_type":"unknown","incident_date":"2018-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"faa678baeae6","org_name":"Cherrydale Fundraising","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145480"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71846e475bc4bb64d97ef8855f9f6aa87732ebac","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40b3cf70-ce67-11e9-b4e5-4769cce343a0"},"incident_date":"2019-03-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"783ebee205d7","org_name":"Bloodworks Northwest","org_type":"healthcare","ransomware":null,"records_affected":1893,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.spamfighter.com/News-22235-Bloodworks-Northwest-notifies-the-patients-about-PHI-Exposure.htm"}],"summary":" On Mar. 13, 2019, Bloodworks Northwest discovered a list having the patients' names, medical diagnoses, and dates of birth were missing from one employee's desk. However, the good news is particularly sensitive information like financial information or Social Security numbers wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b065538c12893ac0c0093d6b2824bdb5e48b5e6e","impact_type":"data_theft","incident_date":"2018-05-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/March%202019%20Consumer%20Mailing_0.pdf"},"notes":null,"org_country":"US","org_id":"b9eb426fffb3","org_name":"Advocate Sherman Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145430"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/March%202019%20Consumer%20Mailing_0.pdf"}],"summary":"An unauthorized third party accessed and acquired personal information stored on Jobscience’s server while it processed Advocate Sherman Hospital job applications.","supporting_quote":"According to Jobscience, in or around May 2018, an unauthorized third party was able to gain access to and acquire data contained on Jobscience’s server that was used to process employee application information.","technology_involved":["Jobscience"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Bullhorn, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"f5f240b10b00","name":"Bullhorn, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-03-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b91d49e05495cc66abe42db267704d929455a7c","impact_type":"data_theft","incident_date":"2018-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IVG%20Security%20Incident%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"0ee6769db955","org_name":"International Vapor Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145389"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IVG%20Security%20Incident%20Notification%20Letter_0.pdf"}],"summary":"International Vapor Group reported that malicious code on its e-commerce site may have captured customers’ credit and debit card information.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5664ddcbaeeef7d6f36e8aa0b6d0ce1067c28045","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b6e119abb8d8","org_name":"Houzz","org_type":"technology_saas","ransomware":null,"records_affected":48881308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Houzz","type":"hibp","url":"https://haveibeenpwned.com/Breach/Houzz"}],"summary":"Houzz disclosed a 2018 breach involving email addresses, names, IP addresses, locations, and password hashes or social media authentication links.","supporting_quote":null,"technology_involved":["Houzz website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f614f69ab1f1a708aca83554ab91ae8c56c9062","impact_type":"unknown","incident_date":"2018-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b39cf9164efa","org_name":"ABM Industries Incorporated","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145390"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ABM%20Industries%20Incorporated-2019-03-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1d9d15cfe525c3ffb0ff303db778c196a4f2ae6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-02-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"25760dca87a4","org_name":"Verifications.io","org_type":"technology_saas","ransomware":null,"records_affected":763117241,"reviewed":false,"root_cause":"The data was stored in a MongoDB instance left publicly facing without a password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Verifications.io","type":"hibp","url":"https://haveibeenpwned.com/Breach/VerificationsIO"}],"summary":"Verifications.io exposed 763 million unique email addresses and related personal attributes from a publicly accessible MongoDB instance without a password.","supporting_quote":"Discovered by Bob Diachenko and Vinny Troia , the breach was due to the data being stored in a MongoDB instance left publicly facing without a password and resulted in 763 million unique email addresses being exposed.","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a77c3c35b15511080d0bbf5f9937f1af989ee53e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20190305_relias501_1%20%282%29%20%5B48%5D_0.PDF"},"notes":null,"org_country":"US","org_id":"f69955acb062","org_name":"OnCourse Learning Corporation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145298"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20190305_relias501_1%20%282%29%20%5B48%5D_0.PDF"}],"summary":"OnCourse Learning Corporation reported that an unauthorized third party may have accessed customer personal information, including payment card details and online account credentials.","supporting_quote":null,"technology_involved":["online account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-03-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca418b0376c48f586b8958594fc120a776b2451b","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-05","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Carmel%20Unified%20Phishing%20Incident%20-%20CA%20Attorney%20General%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"103f51795040","org_name":"Carmel Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email resulted in unauthorized access to District employees’ email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145289"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Carmel%20Unified%20Phishing%20Incident%20-%20CA%20Attorney%20General%20Sample_0.pdf"}],"summary":"A phishing email led to unauthorized access to District employees’ email accounts containing documents with personal and medical information.","supporting_quote":"We recently learned that an outside individual sent a “phishing” email to certain District employees that resulted in unauthorized access to some District employees’ email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94bc2eb6146cfdba7ade79ff2e5444b5bf835f8b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa2dafbaa884","org_name":"Jewish Family & Children's Services (\"JFCS\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145248"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-06","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29a1b218854a86b18b754ba395643e3d7736631a","impact_type":"unknown","incident_date":"2018-08-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20RSC%20CA%20Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"72b57e208b52","org_name":"RSC Insurance Brokerage, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145247"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145953"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20RSC%20CA%20Individual%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RSC%20Insurance%20Brokerage%2C%20Inc.-2019-03-01"}],"summary":"An RSC employee’s laptop was stolen, and it may have contained files related to affected individuals.","supporting_quote":"The laptop was stolen on August 23, 2018.","technology_involved":["employee laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-03-06","discovered_date":"2019-01-29","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c09b9424b3f60b16dc644ff286fa05462a2ca73f","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20CA%20Notice%20of%20Data%20Event_0.pdf"},"notes":null,"org_country":"US","org_id":"9d8b6ba2f25c","org_name":"Covenant Care California, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145240"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Covenant%20Care%20-%20CA%20Notice%20of%20Data%20Event_0.pdf"}],"summary":"An unauthorized actor accessed an employee email account containing patient records at Covenant Care California, LLC.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1b9c199ffb226e86207c063b703ceb1300222f43","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/StFrancisPhysicianServices.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94d099a66de9","org_name":"St. Francis Physician Services (SFPS)","org_type":"unknown","ransomware":null,"records_affected":30044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/StFrancisPhysicianServices.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e993f78b057a5098df84b508f26726fd142de9f1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7d949f56d44b","org_name":"Butzel Long","org_type":"unknown","ransomware":null,"records_affected":254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Butzel%20Long-2019-03-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-03-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e320203ca6a2d8d78f3c6216252140bbeac348fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b8a7ad0-ddff-11e9-92e6-b7a271e742aa"},"incident_date":"2019-03-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"700a2b3eb44d","org_name":"Adirondacks Accountable Care Organization","org_type":"technology_saas","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://poststar.com/news/local/about-patients-data-exposed-in-security-breach/article_a2f7bd98-597c-5f65-8257-83f9cb06a416.html"}],"summary":"A hacker got access to an emailed discussion about patients in the North Country who missed a health screening, leading to a massive breach-of-data warning.  About 25,000 patients were on a “gap in care” spreadsheet, identified in a variety of ways. Some were named with their bir","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d43e606bfa097bb4a69103ad1a1c338d1bdfe914","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32ad88d0-c359-11e9-9e37-df5a0636e02f"},"incident_date":"2019-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d6822f10c08","org_name":"St. Louis Community College","org_type":"education","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ksdk.com/article/news/local/stlccs-data-breach-has-students-concerned/63-e6904f06-47b2-4bb4-ade7-8fa8fdbf62d8"}],"summary":"employee emailed student information to other employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"237a8db3c769856918be5e5df95e3ccff1f66a64","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6be4c4b0-0562-11ea-889a-bd9e961d3ab1"},"incident_date":"2019-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a388baf9936","org_name":"Norfolk Admirals","org_type":"other","ransomware":null,"records_affected":4400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pilotonline.com/news/local/norfolk-admirals-data-breach-exposes-customer-names-other-information/article_17767989-ba18-5362-9118-dc814fb59a19.html,http://www.todaysslapshot.com/from-the-ice/echls-norfolk-admirals-suffer-data-breach-exposing-customer-details/,https://wtkr.com/2016/03/30/norfolk-admirals-taking-action-after-data-breach/,http://www.databreaches.net/norfolk-admirals-data-breach-exposes-customers-names-other-information/"}],"summary":"hactivist releases PII when website doesn't respond to security disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2eedd162274020c2612de3e2f6c28b992b4667d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2e84900-111e-11ea-bd5f-71a8176be0a0"},"incident_date":"2019-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccaa20a123b","org_name":"McDonald's","org_type":"other","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://scotteblog.com/2019/03/21/employee-at-mcdonalds-in-columbia-caught-stealing-customers-credit-card-information/,https://foxbaltimore.com/news/local/mcdonalds-employee-charged-with-stealing-credit-card-info-from-14-customers"}],"summary":" A teen employee at a Howard County McDonald's has been accused of stealing customers' credit card information, reported Howard County police.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7287e27537d888ed50248868134437ee8606ff33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"566103b0-ffdb-11e9-ad81-39b9e5fce51c"},"incident_date":"2019-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce4664705936","org_name":"King County","org_type":"government","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kiro7.com/news/local/community-demands-accountability-after-king-county-allowed-ice-agents-to-access-personal-data/969586451,https://www.kiro7.com/news/local/report-finds-king-county-provided-info-to-ice-agents-against-county-law/965394537"}],"summary":"King County gave ICE inappropriate access to prison data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10122dd7926f1672167f7bd24218fdf53fc3e947","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aa644750-ce68-11e9-b4e5-4769cce343a0"},"incident_date":"2019-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3692c08dd8f","org_name":"Healthfirst","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.crainsnewyork.com/health-care/healthfirst-reports-privacy-breach"}],"summary":"New York insurer Healthfirst notified about 1,800 members in late May that information related to their case management may have been sent to outdated addresses, the company disclosed to the U.S. Department of Health and Human Services' Office for Civil Rights.  The company said ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83f85f45700287d15dd4eff31a05a985199a6139","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f47e180-c83a-11e9-a1c3-d539e9b7140e"},"incident_date":"2019-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2d130c1ad899","org_name":"Haylands Primary School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.countypress.co.uk/news/17534563.cyber-attack-at-isle-of-wight-primary-school-personal-data-may-have-been-stolen/"}],"summary":"ransomware and logins at school","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f683229a809a912d0092a6252608a216b7143f5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4b178050-f0e1-11e9-84f3-1937a4e658d4"},"incident_date":"2019-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d8a7952c2cb","org_name":"B.D. Riley's Irish Pub","org_type":"other","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cbsaustin.com/news/local/former-6th-street-bar-employee-accused-of-stealing-credit-card-info-from-customers"}],"summary":"Former 6th Street bar employee accused of stealing credit card info from customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b4ac269b2032838246b8fd72fe02637af2944f3","impact_type":"unknown","incident_date":"2019-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"070f880ac132","org_name":"American Cancer Society, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145135"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-02-28","discovered_date":"2019-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f878559d9424537638e0259c84423b63db19cdb","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ShareThis%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"259e02cc35d0","org_name":"ShareThis","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145099"},{"fetched_at":null,"title":"Have I Been Pwned: ShareThis","type":"hibp","url":"https://haveibeenpwned.com/Breach/ShareThis"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ShareThis%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"ShareThis reported that personal information, including email addresses, dates of birth, and hashed passwords, may have been acquired in a data theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566","T1657"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cde1a694b831a123ddb18630c59c00713b37b039","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-28","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Phillip01_Multi%20States_0.pdf"},"notes":null,"org_country":"US","org_id":"c81ed3ef868a","org_name":"Phillip Capital Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee responded to a phishing email by logging onto a platform believed to be the vendor’s legitimate platform, enabling access to employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145084"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Phillip01_Multi%20States_0.pdf"}],"summary":"Phillip Capital employees responded to a phishing email and an attacker accessed several employee email accounts containing personal and financial information.","supporting_quote":"Phillip Capital responded to this phishing email by logging onto what we believed was the vendor’s legitimate platform.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b42a3a56b685f743afe3a78f7ab975b47b9bc7ba","impact_type":"unknown","incident_date":"2019-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BHR%20General%20Notification%20Sample_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b82414394660","org_name":"Bamboo HR LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145100"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-26","discovered_date":"2018-12-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"035a6cf1ad51778a291025b76163e9a09016cfc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"46f7e6e9cefd","org_name":"San Antonio Winery, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145024"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_2.pdf"}],"summary":"An unauthorized person accessed a San Antonio Winery employee’s email account after a phishing email incident, and personal information in the account may have been viewed.","supporting_quote":"On December 6, 2018, our ongoing investigation into a phishing email incident determined that an unauthorized person gained access to an employee’s email account between November 13, 2018 and November 15, 2018.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-25","discovered_date":"2018-12-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e472514b15a53ad1d8538873fe38db4506bef129","impact_type":"unknown","incident_date":"2018-12-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa8ca03b935f","org_name":"University of Washington Medicine","org_type":"unknown","ransomware":null,"records_affected":974351,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#University%20of%20Washington%20Medicine-2019-02-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-25","discovered_date":"2019-01-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5618d3c18249c355c43ed3f2dedcd3ffab700aac","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-15","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Arcis%20Golf_CA_Notice_2.16.19%204840-6177-9848%20v.1_0.pdf"},"notes":null,"org_country":"US","org_id":"bee90da883f5","org_name":"Evergreen Alliance Golf Limited, L.P.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145001"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Arcis%20Golf_CA_Notice_2.16.19%204840-6177-9848%20v.1_0.pdf"}],"summary":"Malware designed to access payment card data was identified on point-of-sale devices at certain Arcis Golf locations.","supporting_quote":"On January 16, 2019, findings from the investigation identified the operation of malware designed to access payment card data from cards used on point-of-sale (POS) devices at certain Arcis Golf locations.","technology_involved":["point-of-sale (POS) devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45be7e3abbd0fb2ab35cc82066d74d770a7bd75d","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0fd5e889291f","org_name":"Dubsmash","org_type":"technology_saas","ransomware":null,"records_affected":161749950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dubsmash","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dubsmash"}],"summary":"A December 2018 breach exposed Dubsmash user email addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-25","discovered_date":"2019-01-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a77e5df45d107be8c6a61fd7c219744917959ef5","impact_type":"unknown","incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4748f77b5772","org_name":"Armor Games Inc.","org_type":"unknown","ransomware":null,"records_affected":11000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Armor%20Games%20Inc.-2019-02-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-22","discovered_date":"2018-08-02","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4475e56cc351d051599a7118f769074beb3d7cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_3.pdf"},"notes":null,"org_country":"US","org_id":"b2c570ca8fde","org_name":"Welk Resort Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144939"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_3.pdf"}],"summary":"Welk learned that an unauthorized actor accessed an employee email account containing information related to affected individuals.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a83b4f4697d7f7061c63e2c7fe68565bcfdb2131","impact_type":"unknown","incident_date":"2018-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Adult%20SSN%20X059_v04-c_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d3e2b06f635","org_name":"UConn Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144949"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-22","discovered_date":"2019-01-07","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5a9882d99472b36b40bbe560467e032aa0fc9fea","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10616.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"81049f4b422a","org_name":"Seattle Housing Authority","org_type":"government","ransomware":null,"records_affected":687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10616.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10616.pdf"}],"summary":"A laptop containing residents’ personal and bank account information was stolen from a Seattle Housing Authority development office.","supporting_quote":"The investigation determined that the actor(s) stole a laptop computer used by SHA to process rent payments.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","secrets"],"disclosed_date":"2019-02-22","discovered_date":"2019-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cc1a22bc1a3446788abe153d9bb254ee21352c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/data_breach_blog_post_0.pdf"},"notes":null,"org_country":"US","org_id":"8e3b41923815","org_name":"ArmorGames, Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144941"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/data_breach_blog_post_0.pdf"}],"summary":"ArmorGames confirmed that a breach around January 1, 2019 affected a database containing user profile and login information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-21","discovered_date":"2018-12-26","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acfd94c7fa14b6966765cb3d73720611729d5dc5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CustomerNotice%28US%29%282.2019%29_0.pdf"},"notes":null,"org_country":"US","org_id":"b0e16396c95f","org_name":"The Topps Company, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144902"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CustomerNotice%28US%29%282.2019%29_0.pdf"}],"summary":"The Topps Company confirmed unauthorized access to its website that may have exposed customers’ personal and payment information.","supporting_quote":null,"technology_involved":["www.topps.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-21","discovered_date":"2019-01-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae2aaeeaee6f7ea64f9f0feee82f260d258e142","impact_type":"data_theft","incident_date":"2018-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_X108_v02__002__0.pdf"},"notes":null,"org_country":"US","org_id":"d5384c472190","org_name":"Rennline Automotive","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144918"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_X108_v02__002__0.pdf"}],"summary":"Unauthorized code on Rennline Automotive’s e-commerce website copied payment card information entered by purchasers and sent it to an unauthorized server.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96ff50efe7ff279517e56e41dfaa4710e127a2f1","impact_type":"data_theft","imported_from":null,"incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3f952ed51e5e","org_name":"MyFitnessPal","org_type":"technology_saas","ransomware":null,"records_affected":143606147,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyFitnessPal","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyFitnessPal"}],"summary":"A MyFitnessPal breach exposed email addresses, usernames, IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-21","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e09de2e7bc8a223f3c9cc4cde00211c74c6867e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-02-15","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MHH%20Security%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"c733899d0061","org_name":"Martin, Hutchison and Hohman, CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The recipient was deceived into allowing a caller remote access to a computer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144891"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MHH%20Security%20Breach_0.pdf"}],"summary":"A caller posing as a technician obtained remote access to a computer, where tax and other personal documents may have been at risk; the organization did not know whether anything was taken.","supporting_quote":"This was a red flag as I thought I was dealing with a Suddenlink technician.","technology_involved":["computer","remote access software"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2019-02-21","discovered_date":"2019-01-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6731445438f0edd583c3543902daab17c353201a","impact_type":"data_theft","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_Del%20Taco_Cal_%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"aa5832accfe9","org_name":"Del Taco LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Team members' credentials or passwords were inadvertently disclosed through phishing.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144927"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_Del%20Taco_Cal_%20FINAL_0.pdf"}],"summary":"Del Taco reported that phishing may have led to unauthorized acquisition of team members' personal and employment information.","supporting_quote":"On January 28, 2019, we learned through an investigation that certain information of Del Taco company team members may have been acquired without authorization as a result of a computer scheme known as “phishing,” where user credentials/passwords are inadvertently disclosed to an unauthorized party.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2019-02-20","discovered_date":"2018-12-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6093e543eed738e467fd59c0eeffda6a2aba3835","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-12-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UWM%20CA%20notification%20letter%201_0.pdf"},"notes":null,"org_country":"US","org_id":"6b4b8d1e045e","org_name":"University of Washington Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An error in a database configuration made protected internal files available on the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144877"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UWM%20CA%20notification%20letter%201_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10615.pdf"}],"summary":"A database configuration error at University of Washington Medical Center made files containing protected health information available on the internet.","supporting_quote":"On December 26, 2018, UW Medicine became aware of an error in a database configuration that made protected internal files available on the internet earlier that month.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2019-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"810e984ee3ef977f05ccccaa01320b1833fc076d","impact_type":"data_theft","incident_date":"2019-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CafePress%20-%20California%20Notices.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"636da8ba28dd","org_name":"CafePress","org_type":"retail_ecommerce","ransomware":null,"records_affected":23205290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2019/09/23/cafepress_admits_breach_to_customers/,https://www.theregister.co.uk/2019/08/05/cafebreach_breach_23m_user_records/,https://www.forbes.com/sites/daveywinder/2019/08/05/cafepress-hacked-23m-accounts-compromised-is-yours-one-of-them/#4b2989ee407e"},{"fetched_at":null,"title":"Have I Been Pwned: CafePress","type":"hibp","url":"https://haveibeenpwned.com/Breach/CafePress"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150319"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CafePress%20-%20California%20Notices.pdf"}],"summary":"CafePress reported that an unidentified third party obtained customer information without authorization from a CafePress database.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-19","discovered_date":"2019-01-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45ac5fb120e3e8393e9d81b99fbe9ee87c66246e","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pillow%20Pets%20-%20General%20Master%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"05d5081f0fb0","org_name":"CJ Products Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144851"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pillow%20Pets%20-%20General%20Master%20%281%29_0.pdf"}],"summary":"CJ Products Inc. reported unauthorized access to its website code, putting customer names, addresses, and credit card numbers at risk of exposure.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-19","discovered_date":"2019-01-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50e867ea2454dfa89970f792becd9e9ff904ae38","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2019-01-29","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Centinela%20Adult%20Notification%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"fc25f8ce13c3","org_name":"Centinela Valley Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144854"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Centinela%20Adult%20Notification%20Letter%20Sample_0.pdf"}],"summary":"Centinela Valley Union High School District reported that a phishing incident may have exposed employees’ IRS Form W-2 information.","supporting_quote":"On January 31, 2019, we learned that one of our employees received a phishing email designed to appear as if it came from one of our other employees.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-02-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ede338902551bbc44305695ecfeadd14d88f88ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"595aa500-c9bf-11e9-9a33-13e06a29212c"},"incident_date":"2019-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"101ebd82289c","org_name":"Addison County Home Health & Hospice","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spamfighter.com/News-22319-Addison-County-Home-Health-Hospice-exposed-PHI.htm"}],"summary":"Vermont's Addison County Home Health & Hospice notified 758 patients that some of its PHI got exposed due to an email security breach recently. email security breach has been discovered on Apr. 26, 2019. Addison County Home Health & Hospice secured the account immediately and beg","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adc228fbfa3e86320e9ea18ed9322b711f7ac8ff","impact_type":"data_theft","imported_from":null,"incident_date":"2018-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"16fe10643e99","org_name":"EyeEm","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: EyeEm","type":"hibp","url":"https://haveibeenpwned.com/Breach/EyeEm"}],"summary":"EyeEm experienced a data breach that exposed user email addresses, names, usernames, bios, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-15","discovered_date":"2018-10-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"605b6791499749478804686947b6cf7c01ac2af1","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Volt%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"bb37dd1bde61","org_name":"Volt Information Sciences, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144774"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Volt%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"}],"summary":"Volt Information Sciences reported unauthorized access to employee email accounts between August 6 and October 4, 2018, and said some accounts were used to send phishing emails.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e69174396753c5af37cf9471c4a2343fad6c5d10","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Print%20EZ%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"2db72eb28d93","org_name":"Print EZ, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144779"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Print%20EZ%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Print EZ found a suspicious file on its e-commerce website and could not determine how it may have affected information entered during checkout.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda906e569bac38efd32c6a80fbe58f71a342ff6","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hourglass%20-%20Consumer%20Notice%20-%20US_0.pdf"},"notes":null,"org_country":"US","org_id":"dd0f77e1567a","org_name":"Hourglass","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144787"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hourglass%20-%20Consumer%20Notice%20-%20US_0.pdf"}],"summary":"Unauthorized third parties had the ability to access purchase-related information on the Hourglass website from approximately July 3, 2018 to January 30, 2019.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2019-02-15","discovered_date":"2018-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f38675470c49ce1c2792fbddcae231e110059a2","impact_type":"data_theft","incident_date":"2018-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BS%20No%20SSN%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144778"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BS%20No%20SSN%20Notice_0.pdf"}],"summary":"An unknown third party accessed Sharecare servers containing Blue Shield of California members’ personal information and transferred data outside the United States.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sharecare"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"f228fd7cbf01","name":"Sharecare"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-02-15","discovered_date":"2019-02-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79ac4b4c1a583871de4628489fc25b82964bee75","impact_type":"disruption_or_ransomware","incident_date":"2019-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AltaMed%20%28CL%29%20--%20Notification%20--%205.15.19_0_0.pdf"},"notes":null,"org_country":"US","org_id":"6e4ad28bac69","org_name":"AltaMed Health Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147212"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-147718"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AltaMed%20%28CL%29%20--%20Notification%20--%205.15.19_0_0.pdf"}],"summary":"AltaMed reported a virus infection that prevented access to files, while it found no evidence that the third party accessed or acquired protected information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2019-02-14","discovered_date":"2018-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b45284769955b5e5075cd490e14d18e19eae059a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/North%2040%20-Regulation%20Letter%20-%20CA%20-%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"55278d3635c8","org_name":"North 40 Outfitters","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144716"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/North%2040%20-Regulation%20Letter%20-%20CA%20-%20FINAL_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%2040%20Outfitters-2019-02-14"}],"summary":"North 40 Outfitters reported that customer payment-card information and account credentials may have been subject to unauthorized access through its online payment processing platform.","supporting_quote":null,"technology_involved":["online payment processing platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf70a8af53e80ea971623b9335821421e42595fa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"490046f0-ef5e-11e9-8b51-736a93581b2e"},"incident_date":"2019-02-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9706b534a903","org_name":"Mobile gas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wctv.tv/content/news/Skimmers-found-on-gas-pumps-in-Madison-Perry-505895371.html"}],"summary":"gas pump skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-14","discovered_date":"2019-01-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bdf69bad10275315f4ff259942c44b9ecbd74d5","impact_type":"data_theft","incident_date":"2018-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FB_CA_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"51581f772545","org_name":"Five Below","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FB_CA_Notice_0.pdf"}],"summary":"Five Below reported that payment card information entered on its website checkout page may have been obtained by an unauthorized third party.","supporting_quote":null,"technology_involved":["FiveBelow.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-12","discovered_date":"2018-12-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f330cb2a30c201b86ae6f344b960b413b58a6d05","impact_type":"unknown","incident_date":"2018-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fcb82fc4c957","org_name":"Truluck’s Restaurant Group","org_type":"unknown","ransomware":null,"records_affected":13422,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Truluck%E2%80%99s%20Restaurant%20Group-2019-02-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-12","discovered_date":"2019-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a07b4c45089bd593c11c15dfed07eb5a09cf19fb","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_2.pdf"},"notes":null,"org_country":"US","org_id":"f3fc340f9806","org_name":"Stanwich Mortgage Loan Trust A, C, and D","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_2.pdf"}],"summary":"Stanwich loan-related information hosted on OpticsML cloud servers was subject to unauthorized access by foreign IP addresses.","supporting_quote":null,"technology_involved":["cloud servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PairPrep, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"dfab4cfff3df","name":"PairPrep, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2019-02-12","discovered_date":"2019-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dd939d0765e5c815bd28201b432b577c54aaa632","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10613.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"69217ffd2348","org_name":"Stanwich Mortgage Loan Trust","org_type":"financial","ransomware":null,"records_affected":702,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10613.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10613.pdf"}],"summary":"Stanwich Mortgage Loan Trust data hosted on two OpticsML cloud servers was subject to unauthorized access by foreign IP addresses.","supporting_quote":null,"technology_involved":["OpticsML","cloud servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PairPrep, Inc."},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"dfab4cfff3df","name":"PairPrep, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9e89764b22685e8adf9c13bb9ebd837965d54821","impact_type":"unknown","incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7fd985283a3c","org_name":"Breach at: Pairprep, Inc.  Data Owned by: Stanwich Mortgage Loan Trust A, C, and D","org_type":"unknown","ransomware":null,"records_affected":53289,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Breach%20at%3A%20Pairprep%2C%20Inc.%20%20Data%20Owned%20by%3A%20Stanwich%20Mortgage%20Loan%20Trust%20A%2C%20C%2C%20and%20D-2019-02-12"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b11173d80f69b3fef6cdd7620918ad7895ee96c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92cdf2a0-3020-11ec-a5c2-337d0141f916"},"incident_date":"2019-02-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8afa0cc31367","org_name":"Stevenage Police Department","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thecomet.net/news/stevenage-police-officer-dismissed-after-gross-misconduct-6619874"}],"summary":"Herts police officer dismissed for ‘abuse of power’ after using database for personal benefit - Hertfordshire police","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2019-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"261d61be83d35dac98eceb84a9143d79dc490d98","impact_type":"data_theft","imported_from":null,"incident_date":"2019-02-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4c59f2a32c69","org_name":"devkitPro","org_type":"other","ransomware":null,"records_affected":1508,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: devkitPro","type":"hibp","url":"https://haveibeenpwned.com/Breach/devkitPro"}],"summary":"A breach of the devkitPro forum exposed email addresses, forum posts, private messages, and passwords stored as weak salted hashes.","supporting_quote":null,"technology_involved":["phpBB forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-11","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47037790f3a8a2fe296d89e0f124241ace6d9cb4","impact_type":"unknown","incident_date":"2018-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cheatham%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b4f6ef6aafd8","org_name":"David B. Cheatham, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cheatham%20Notice_0.pdf"}],"summary":"A hard drive containing client tax documents was stolen from the organization’s office, but access to the data was not confirmed.","supporting_quote":"On December 8, 2018, a computer hard drive containing some of our clients’ information was stolen from our office.","technology_involved":["computer hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c021a62838e962bfad6a548322cd05ee5a0e6c6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96ea8ae0-1c56-11ea-ac81-937b5ec4147f"},"incident_date":"2019-02-08","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33fa7f1196cc","org_name":"Starling Physicians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ct-starling-physicians-warns-patients-of-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcconnecticut.com/news/local/Starling-Physicians-Warns-Patients-of-Data-Breach-564814302.html"}],"summary":"Starling was the target of a cyber-phishing attack on February 8. When the Connecticut-based healthcare group learned of the breach, they secured the affected email accounts and hired a forensic security firm. On September 12, investigation found that the email accounts affected ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-02-06","discovered_date":"2018-12-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db73f8e2b72b6df9dcea244e2bead4bcae5e197f","impact_type":"data_theft","incident_date":"2018-10-12","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Don%20Best%20-%20Multistate%20Notice%20Draft_0.pdf"},"notes":null,"org_country":"US","org_id":"8531e8c91ed7","org_name":"Don Best Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Don%20Best%20-%20Multistate%20Notice%20Draft_0.pdf"}],"summary":"Don Best reported that a malware attack led to unauthorized access to a database containing customer personal information and passwords.","supporting_quote":"We immediately began an investigation and learned that between October 12, 2018 and October 28, 2018 Don Best suffered a malware attack.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-05","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09ee197235ecad397eb8edc10ed475da96aa470f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bayside%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"5b79102b871d","org_name":"Bayside Covenant Church, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144451"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bayside%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Unauthorized actors accessed certain Bayside employees’ email accounts, which contained personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2019-02-05","discovered_date":"2019-01-19","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"219bc160a0fa445fc6cba0f74d4766d85f00319a","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multistate%20Notice%20Draft_0.pdf"},"notes":null,"org_country":"US","org_id":"ec04c5c3d6bf","org_name":"Abbott Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multistate%20Notice%20Draft_0.pdf"}],"summary":"A third-party auditor misplaced a portable drive containing Abbott employees’ personal and stock-related information.","supporting_quote":"On January 19, 2019, the auditor informed us that the drive was misplaced.","technology_involved":["portable drive"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27c203970637e5b92d0572c02c4129ce9da64a48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b38be3f0-cd2e-11e9-a052-6392f3b8c0e8"},"incident_date":"2019-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"3a1c43cec6f1","org_name":"Toyota","org_type":"manufacturing","ransomware":null,"records_affected":3100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/toyota-announces-second-security-breach-in-the-last-five-weeks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www3.nhk.or.jp/nhkworld/en/news/20190329_38/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securitytoday.com/articles/2019/04/02/toyota-and-lexus-dealerships-hacked-millions-left-vulnerable.aspx?admgarea=ht.airport"}],"summary":"Toyota has confirmed that as many as 3.1 million items of Toyota and Lexus customer data may have been breached following an attack on dealerships in Japan.  The company says that \"information that may have been leaked this time does not include information on credit cards,\" but ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58d3745a9b4bc3a80b747e009099386bc8916060","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0339f180-d3d3-11e9-9298-79b47a23a7bd"},"incident_date":"2019-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c084a01df14","org_name":"Taco Bell","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sanluisobispo.com/news/local/crime/article226647794.html"}],"summary":"employee skimming credit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a365300bab76c377c469f57eee540b6204da80c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53b7b410-246f-11eb-b042-01be07ea3379"},"incident_date":"2019-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EE","org_id":"28354251f99a","org_name":"SyncUI","org_type":"technology_saas","ransomware":null,"records_affected":2900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://siliconangle.com/2020/03/15/blisk-web-developer-browser-exposes-user-data-via-misconfigured-database/"}],"summary":"exposed elastic search database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dce1d1da80ec5b820c3f0cf01fb80de48f876bd1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94caabff14ef","org_name":"Sierra View Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144348"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d99560779aac8f93f865b617ba882e4b49a39d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"edbba120-fb21-11e9-ac31-5797fdf8a397"},"incident_date":"2019-02-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71b813da9532","org_name":"intuit","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ago.vermont.gov/wp-content/uploads/2019/02/2019-02-22-Intuit-Notice-of-Data-Breach-to-Consumers.pdf,https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954"}],"summary":"credential stuffing against tax webapp.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fe62015424f578f6a7c4abbd2c010de73736e005","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/HuddleHouse.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0ec4c491611","org_name":"Huddle House, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/HuddleHouse.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-02-01","discovered_date":"2018-11-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d08465c2e173793581505c4f27b7d40df2d88e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ADF%20-%20%20Data%20Breach%20Notification%20Letter%20Sample_0.PDF"},"notes":null,"org_country":"US","org_id":"23a05c54b48f","org_name":"Applied Data Finance, LLC d/b/a Personify Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144350"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ADF%20-%20%20Data%20Breach%20Notification%20Letter%20Sample_0.PDF"}],"summary":"An unauthorized third party accessed two employee email accounts and viewed their contents, which included personal and account information.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-30","discovered_date":"2018-12-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a564c6a08c4f79fda6b42b33d576130d775e3f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10612.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"4969864862d8","org_name":"Image-I-Nation Technologies Inc.","org_type":"technology_saas","ransomware":null,"records_affected":3991,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10612.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Image-I-Nation%20Technologies%2C%20Inc.-2019-02-04"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/Image-I-NationTechnologies%2CInc.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10612.pdf"}],"summary":"Image-I-Nation Technologies reported unauthorized access to a database containing personal information, which may have been accessed.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3ad8e3cb2fe2ecb8603365adadad75049f0efde","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VMF%20Notice%20-%20A_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566, T1598","org_country":"US","org_id":"9ec208fc0381","org_name":"Verity Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VMF%20Notice%20-%20A_0.pdf"}],"summary":"An unauthorized third party accessed a VMF employee’s Microsoft 365 email account, which contained attachments with personal information; whether the information was viewed is unknown.","supporting_quote":null,"technology_involved":["Microsoft 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f46be158fad46ea123736f7cc7b44e088d07b3a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-27","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/7884921_0.pdf"},"notes":null,"org_country":"US","org_id":"92e99d7f2eea","org_name":"Allen Chern LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144176"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/7884921_0.pdf"}],"summary":"A vendor-hosted database containing UpRight Law clients’ personal information was potentially acquired by an unauthorized individual.","supporting_quote":"We were recently informed by a third-party vendor that its own investigation concluded that a database hosted by the vendor and containing UpRight Law’s clients ’ personal information was potentially acquired by an unauthorized individual between July 27 and July 30, 2018.","technology_involved":["database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2019-01-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69101b1f60349d7d556d360fad5d3cd278d8fced","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VHS%20Notice%20-%201_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"0f3d7d7a0144","org_name":"Verity Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144152"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VHS%20Notice%20-%201_0.pdf"}],"summary":"An unauthorized third party accessed a Verity Health System employee’s Microsoft 365 email account, which contained attachments with health information that may have been accessed.","supporting_quote":null,"technology_involved":["Microsoft 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de5c5a56b38844588f80de9292106307b384320f","impact_type":"unknown","incident_date":"2018-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_29.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144129"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2019-01-25","discovered_date":"2019-01-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b2b181ae4ffe4e65521dc844cb9de9ada1af261","impact_type":"exposure_no_theft_confirmed","incident_date":"2019-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DOR%20Notice%20of%20Data%20Breach%20Letter%20January%202019_OAG_0.pdf"},"notes":null,"org_country":"US","org_id":"ecede4a0b82e","org_name":"Department of Rehabilitation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144124"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DOR%20Notice%20of%20Data%20Breach%20Letter%20January%202019_OAG_0.pdf"}],"summary":"A spreadsheet containing employee classification information and Social Security numbers was saved on the internal G drive and accessed by a DOR employee.","supporting_quote":null,"technology_involved":["internal G drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a71dd8f9995cb50587c0451f9ff3d935b8b1335f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Claimant%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"781502e9cdca","org_name":"Zurich American Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144000"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Claimant%20Notification%20Letter_0.pdf"}],"summary":"Zurich American Insurance Company reported unauthorized access to claim payments through a vendor system, exposing claimants’ personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3964322d07e9654c7d7aa4c05a4f09559326ea7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37a64b40-c8e2-11e9-918d-0fca885a1bcc"},"incident_date":"2019-01-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"7207e4af6aae","org_name":"RupeeRedee","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://tech.economictimes.indiatimes.com/news/startups/lending-firm-rupeeredee-faces-customer-data-breach/67616560"}],"summary":"open cloud storage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-18","discovered_date":"2018-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46ea080a67d467aadfad0dd956284eecff6201a2","impact_type":"data_theft","incident_date":"2018-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pharmaca%20-%20Regulator%20Notice%20-%20CA%20-%20FINAL_0%20%28notice%29_0.pdf"},"notes":null,"org_country":"US","org_id":"568474bf95e0","org_name":"Pharmaca Integrative Pharmacy Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pharmaca%20-%20Regulator%20Notice%20-%20CA%20-%20FINAL_0%20%28notice%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pharmaca%20Integrative%20Pharmacy%20Inc.-2019-01-18"}],"summary":"Pharmaca reported that malicious code on point-of-sale systems may have captured customers’ payment card information and names between July 19 and December 12, 2018.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05e19da3a0f0025762153045c32cbcfb98852213","impact_type":"data_theft","incident_date":"2018-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aetrex-%20Notice%20of%20Data%20Event-%20CA_0%20%28notice%29_0.pdf"},"notes":null,"org_country":"US","org_id":"b05f621e49a0","org_name":"Aetrex Worldwide, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aetrex-%20Notice%20of%20Data%20Event-%20CA_0%20%28notice%29_0.pdf"}],"summary":"An unauthorized third party inserted malicious code into Aetrex's website and obtained customer payment card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67e2e297783ce8c13ce93c399369033ddcab403a","impact_type":"data_theft","incident_date":"2019-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"2385b1b9ea9e","org_name":"Collection #1","org_type":"unknown","ransomware":null,"records_affected":772904991,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Collection #1","type":"hibp","url":"https://haveibeenpwned.com/Breach/Collection1"}],"summary":"In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 mill","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-15","discovered_date":"2018-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0e841c52320031055f279309fb1d50d5866d32d","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20W735_v03_0.pdf"},"notes":null,"org_country":"US","org_id":"e3b4bc1556d9","org_name":"Graeter’s Ice Cream Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143911"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20W735_v03_0.pdf"}],"summary":"Graeter’s found unauthorized code on its website checkout page that could copy customer information entered during checkout.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2019-01-14","discovered_date":"2018-08-17","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df0eb903bde65341f3f399a502b76eacf809e42e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A%26A%20Consumer%20Notice%20Proof%20-%20FINAL%201-9-19_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"29736521922a","org_name":"A&A Global Imports, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143824"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A%26A%20Consumer%20Notice%20Proof%20-%20FINAL%201-9-19_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10609.pdf"}],"summary":"A&A Global Imports reported that unauthorized code on its website may have exposed checkout information and that attackers may have acquired data from its customer database.","supporting_quote":null,"technology_involved":["website","customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-01-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c902fde7282544b64e104347c275077a6249fe0d","impact_type":"data_theft","imported_from":null,"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"DK","org_id":"9cc3f537e87a","org_name":"FaceUP","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"FaceUP identified a SQL injection vulnerability at the time of the breach.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FaceUP","type":"hibp","url":"https://haveibeenpwned.com/Breach/FaceUP"}],"summary":"The 2013 FaceUP breach exposed personal information and passwords after a SQL injection vulnerability was identified.","supporting_quote":"When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-11","discovered_date":"2018-10-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c31166f19934d71dac87a92d2069832e84828cd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Jensen%20-%20CA%20Regulatory%20Notification%20Letter_0%20%28notice%29_0.pdf"},"notes":null,"org_country":"US","org_id":"f8010313b95e","org_name":"Jensen Precast","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143760"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Jensen%20-%20CA%20Regulatory%20Notification%20Letter_0%20%28notice%29_0.pdf"}],"summary":"Jensen Precast reported that an unauthorized individual may have accessed employee email accounts containing personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-11","discovered_date":"2018-10-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad748712ac6dfbc31b563026be9fa677ff446686","impact_type":"data_theft","incident_date":"2018-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/E-Z%20UP%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%20%28notice%29_0.pdf"},"notes":null,"org_country":"US","org_id":"4199a6aa5b34","org_name":"International E-Z UP, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143759"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/E-Z%20UP%2C%20Inc.%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0%20%28notice%29_0.pdf"}],"summary":"Malicious code on E-Z UP’s e-commerce site captured and transmitted customers’ payment information.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-01-11","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"19bceaf945eef06eeba9fe245797e5c2bd17d6f1","impact_type":"data_theft","incident_date":"2018-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10610.pdf"},"notes":null,"org_country":"US","org_id":"ab7499088182","org_name":"Caroline Kline Galland Home","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10610.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10610.pdf"}],"summary":"A file containing a person’s information was stolen from a hospice nurse’s car during a break-in.","supporting_quote":"We are very sorry to report that on that date a file containing information about you was stolen from our hospice nurse’s car during a break-in.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e81bd127d9d311907fbed41c4eebb7592f5ed892","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5d2c3850-ce52-11e9-a07e-2170fe2d70c6"},"incident_date":"2019-01-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a329c18aeec1","org_name":"whatsapp","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/possible-bug-in-whatsapp-may-provide-others-with-access-to-all-your-messages-524516.shtml,https://twitter.com/abbyfuller/status/1083560674884694017"}],"summary":"application sent message history based on email number w/o confirming email number ownership so reuse of email number caused breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d412c144b7f17581b927062191c1c9a4fd954cf4","impact_type":"unknown","incident_date":"2011-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"a87c8b7157ad","org_name":"Dangdang","org_type":"unknown","ransomware":null,"records_affected":4848734,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dangdang","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dangdang"}],"summary":"In 2011, the Chinese e-commerce site Dangdang suffered a data breach . The incident exposed over 4.8 million unique email addresses which were subsequently traded online over the ensuing years.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b6e6c2faa230a521a8066d2501bc273885387f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1efd3060-cd09-11e9-a052-6392f3b8c0e8"},"incident_date":"2019-01-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11b9ec087ef3","org_name":"Columbia Surgical Specialists","org_type":"healthcare","ransomware":true,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/columbia-surgical-specialists-of-spokane-reports-incident-affecting-400000-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spokesman.com/stories/2019/mar/07/spokanes-columbia-surgical-specialists-paid-nearly/"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10617.pdf"}],"summary":"Columbia Surgical Specialists, which operates four medical offices in Spokane and Spokane Valley, says it paid hackers nearly $15,000 to decrypt patient information that was held hostage in a ransomware attack.  In a two-page notice sent to patients Thursday, the company said it ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2019-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f26a0eb4b35a6795ae50c72d8bb8614d62edffcf","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-29","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d5af8ba89237","org_name":"BannerBit","org_type":"technology_saas","ransomware":null,"records_affected":213415,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BannerBit","type":"hibp","url":"https://haveibeenpwned.com/Breach/BannerBit"}],"summary":"BannerBit suffered a data breach involving email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-03","discovered_date":"2018-12-17","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebb1c5965f72504a8d67babad8b18ec3d21a94ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OXO%20International%202%20Ad%20r2fin_0.pdf"},"notes":null,"org_country":"US","org_id":"1d4178db936b","org_name":"OXO International, Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143479"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OXO%20International%202%20Ad%20r2fin_0.pdf"}],"summary":"OXO reported that unauthorized code may have allowed access to personal and credit card information entered on its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a34b6f039d89640f03ee3b3a8c060698d4c20660","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72df7970-3607-11e9-bfa7-0593a63883d2"},"incident_date":"2019-01-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"996d2cd22f26","org_name":"North Country Business Products, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kvrr.com/2019/02/18/data-breach-impacts-local-customers-of-dunn-brothers-coffee-and-others/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.kare11.com/article/news/crime/data-breach-hits-dunn-brothers-chino-latino-several-metro-businesses/89-0c2672fe-0f0c-4483-87de-e03c575d582e;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ncbpdataevent.com/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-144733"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%20Country%20Business%20Products%2C%20Inc.-2019-02-15"}],"summary":"North Country Business Products says customers at these locations and dozens of others across the region could have had their credit cards compromised between January 3 and 24.  An investigation found that someone deployed malware and collected credit and debit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2019-01-03","discovered_date":"2018-11-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d92476ef48961e4c8c2ffe3fba8407325dee3e6c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10608.pdf"},"notes":null,"org_country":"US","org_id":"8dfed22c9016","org_name":"Chaplaincy Health Care","org_type":"healthcare","ransomware":null,"records_affected":1086,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10608.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10608.pdf"}],"summary":"Chaplaincy Health Care reported that an unknown individual breached an email account, potentially accessing emails containing patient information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2019-01-03","discovered_date":"2018-10-11","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5af9144deaaf35d118b295ccf96a6694b874eb7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMC%20-%20FINAL%20CONSUMER%20NOTICE_0.pdf"},"notes":null,"org_country":"US","org_id":"5d83263c6074","org_name":"Centerstone Insurance and Financial Services d/b/a BenefitMall","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email phishing attack exposed employee email login credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143493"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMC%20-%20FINAL%20CONSUMER%20NOTICE_0.pdf"}],"summary":"BenefitMall reported that an email phishing attack exposed employee email login credentials and led to unauthorized access to employee mailboxes that may have exposed personal information.","supporting_quote":"On October 11, 2018, we became aware that Centerstone Insurance and Financial Services, d/b/a BenefitMall, (the “Company”) was the target of an email phishing attack that exposed employee email login credentials.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"080f2b1c24c8c1446cc5c5215c4ced02af5bd581","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/1st%20Email%20Notification%2012-17-18_0.pdf"},"notes":null,"org_country":"US","org_id":"b290c22c4432","org_name":"Hammer Nutrition","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/1st%20Email%20Notification%2012-17-18_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hammer%20Nutrition-2018-12-21"}],"summary":"An intrusion on Hammer Nutrition’s website provider’s systems exposed customers’ payment card data during online orders.","supporting_quote":"Our site is operated for us by a third-party company (our “website provider”), and it was the website provider’s systems that experienced the intrusion.","technology_involved":["website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2019-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b736fa7e49c8ae998737c284f676570646dd5b0f","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"581753d452fa","org_name":"BlankMediaGames","org_type":"technology_saas","ransomware":null,"records_affected":7633234,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BlankMediaGames","type":"hibp","url":"https://haveibeenpwned.com/Breach/BlankMediaGames"}],"summary":"A breach of BlankMediaGames’ Town of Salem website exposed user email addresses, usernames, IP addresses, purchase histories and password hashes.","supporting_quote":null,"technology_involved":["Town of Salem website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1589e1dd8075c5a7f513ce3ba75b883f262a00e","impact_type":"unknown","incident_date":"2018-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Aimbridge%20Hospitality%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_8.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6fd61df9be74","org_name":"Aimbridge Hospitality Holdings, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143451"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aimbridge%20Hospitality%20Holdings%2C%20LLC-2018-12-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c5e420e3adc4b8a089c25c731ca454582a5a864","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71947130-cf39-11e9-89a9-015b821d7cea"},"incident_date":"2019-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"28b294d18988","org_name":"Wolcott Public Schools","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcconnecticut.com/news/local/Ransomware-Attack-Targets-Wolcott-Public-Schools-558610611.html"}],"summary":"School district in CT was hit at the end of the school year by ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45141894826b95091cf649b2d836d2becf23067d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05fd69c0-f6c7-11ea-b7b2-2361ceadc5c7"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc7a2979ce67","org_name":"Waystar","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Developer published private repo containing credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7b84f9fa1cd04fab17e595aaf7acb935ec62257","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1eb841e0-0a43-11ea-9821-617d71ee6253"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0dd9b4dc605","org_name":"Virginia State Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wavy.com/news/local-news/virginia-state-police-trooper-indicted-on-16-criminal-charges/"}],"summary":"Virginia State Trooper found conducting non-work related background checks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe73208d98d23f4d3878e2e7c704d41201448e3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a385f90-22d9-11eb-b221-a300329fb9cf"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34f470103df1","org_name":"Veritas Genetics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/11/07/veritas-genetics-data-breach/,https://www.beckershospitalreview.com/cybersecurity/dna-testing-company-informs-consumers-of-data-breach.html"}],"summary":"unknown action used to access unknown information on DNA company's portal. Unknown discovery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09f03e80c2a4f4d9d0cbf6f387965078e2db56a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf6cdbe0-ccff-11e9-a052-6392f3b8c0e8"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25760dca87a4","org_name":"Verifications IO LLC","org_type":"professional_services","ransomware":null,"records_affected":808539849,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/insecure-database-leads-to-over-800-million-records-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2019/03/10/2-billion-unencrypted-records-leaked-in-marketing-data-breach-what-happened-and-what-to-do-next/#2293ea6c6b0d;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mediapost.com/publications/article/333276/email-vendor-verificationsio-seems-to-be-out-of-b.html"}],"summary":"An unprotected 140+ GB MongoDB database led to the discovery of a huge collection of 808,539,939 email records, with many of them also containing detailed personally identifiable information (PII).  The large database discovered by security researcher Bob Diachenko comprised four","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e09fa458f8843a01c6d5f4680a3e5edca56c8ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1cf9820-0a3c-11ea-9821-617d71ee6253"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d46a3621c871","org_name":"Valero","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mysanantonio.com/news/local/crime/article/16-card-skimmers-found-at-San-Antonio-gas-14416010.php#item-85307-tbla-5"}],"summary":"4 skimmers found on a Valero in San Antonio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9195511af7d5fc1ee20f3252cd440a18c1ef829","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2ee6a70-1df1-11ea-89d1-f1d5c86069c8"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0aa5140dd4bc","org_name":"Unlimited Family Services, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insurancefraud.org/IFNS-detail.htm?key=32773"}],"summary":"A Hartford social worker is facing charges, accused of cheating Medicaid out of thousands of dollars.In December of 2017, Dept. of Social Service (DSS) had notified all masters level social workers, including Service, that they were no longer eligible to bill the Medicaid program","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81f10599fb882580dd0604b8a0411fb159cf3b80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18b5e040-ce57-11e9-b4e5-4769cce343a0"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"03f153cf0a81","org_name":"United States Air Force","org_type":"government","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stripes.com/news/pacific/us-troops-may-be-victims-of-massive-credit-card-hack-in-south-korea-military-says-1.594954"}],"summary":"SEOUL, South Korea — American troops may have been among the victims of hackers who stole information from more than 1 million U.S. and South Korean credit cards and listed it for sale on the dark web over the past three months, the military said.  The thefts targeted unspecified","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12dd689cc065be0d5d6851551393f804206ba47e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52954480-e0b4-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"4b449161dccb","org_name":"Tommy Hilfiger Japan","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thepaypers.com/digital-identity-security-online-fraud/tommy-hilfiger-japan-breach-exposes-hundreds-of-thousands-of-customers-data/778603-26#"}],"summary":"Safety Detective has revealed a security breach in the Tommy Hilfiger Japan client database, exposing personal details of hundreds of thousands of customers.  Tommy Hilfiger’s Japanese website, which received nearly one million visits so far in 2019, runs on an open Elasticsearch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d07995145231cee7685db722f33254bdc1c2eb1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"227bf4e0-07b7-11ea-a8b1-672cf95dfdfd"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea9acc2f5ebf","org_name":"Suprema","org_type":"professional_services","ransomware":null,"records_affected":27800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/zakdoffman/2019/08/14/new-data-breach-has-exposed-millions-of-fingerprint-and-facial-recognition-records-report/#f6b5b2c46c60,https://mashable.com/article/data-breach-biometrics-suprema-biostar-2/"}],"summary":"Suprema biometeric data left unprotected in an elasticsearch server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0fbbdcdf446bf1b0891003e8d65420a604062c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e07cf440-259d-11ea-b8c8-4fa7e4328c98"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3886e280bda0","org_name":"State of California Employment Development Department","org_type":"government","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sacbee.com/news/california/article228537069.html"}],"summary":"Misdelivery of 300 claimants of disability and social services in Cali (the title is a bit exaggerated)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37697433be9d85dd2d7ed4767e928b8e22b8c5d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"580d0030-de14-11e9-92e6-b7a271e742aa"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da180efa8cf4","org_name":"Spotsylvania County Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/email-security/virginia-state-police-recoup-300k-stolen-in-bec-scam/"}],"summary":"The Virginia State Police were able to recover just over half of the $600,000 that was stolen from Spotsylvania County in a business email compromise scheme.  The state police, working with other in and out-of-state law enforcement agencies were able to track down deposits made i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f21daac13cc08043545c5fdfe45f40edc3f5fda2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a0e76430-0236-11ea-ad43-7952870528d4"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"24aead97c1d0","org_name":"Sonic Jobs","org_type":"technology_saas","ransomware":null,"records_affected":29202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.sky.com/story/job-applicants-worried-as-hundreds-of-thousands-of-cvs-exposed-online-11836935"}],"summary":"Misconfigured s3 bucket leaks applicant data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0002902af57e406c923ec5ad233af407d3cc9c6c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3fb14820-e071-11e9-9b3e-615de4b5b4cd"},"incident_date":"2019-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c499994901c5","org_name":"Sarrell Dental","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wtvy.com/content/news/Dental-firm-hit-by-ransomware--560573201.html"}],"summary":"ransomware at dental clinics","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ad0e1fe5c50bea03cffd10e675851992ae93df8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a1da1460-0e80-11ed-9a95-4bdaebaab721"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"490228722ded","org_name":"S&P Dow Jones Indices","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wsj.com/articles/two-n-y-men-accused-of-trading-on-inside-information-from-s-p-dow-jones-indices-11600734328"}],"summary":"An employee of S&P used their insider knowledge to create some insider trading","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a07897331f8f8aa04c00159c3dcf01b70274b265","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f841c060-0a0e-11ea-9e73-f15207d33dcb"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef4248be77cb","org_name":"Ruby Tuesday","org_type":"other","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.floridatoday.com/story/news/2019/10/13/brevard-restaurant-server-accused-stealing-credit-card-information-from-25-victims-viera-melbourne/3971655002/,https://www.sebastiandaily.com/crime/former-sebastian-server-accused-of-stealing-credit-card-information-19270/"}],"summary":"Former server was taking pictures of credit cards and using them to buy and pawn off stuff","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be00b79f82f625921ede3e9595e29b6f878674c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0aa39200-0fc4-11ea-936a-1ffb751fb68b"},"incident_date":"2019-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d14167213c7","org_name":"Riverplace Counseling Center","org_type":"healthcare","ransomware":null,"records_affected":11639,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mn-riverplace-counseling-center-notifies-11639-patients-after-security-incident/,https://www.hipaajournal.com/11639-individuals-impacted-by-riverplace-counseling-center-malware-attack/"}],"summary":"Riverplace Counseling Center in Anoka, MN, has discovered malware has been installed on its systems which may have allowed unauthorized individuals to gain access to patients’ protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53987888e3a78820d113adc9372e426ab8feb61b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cff38370-1f9a-11ec-aba2-27b717aed560"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e16af5f0cc4e","org_name":"Red River Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ktbs.com/news/texarkana/ttpd-arrest-two-men-in-atm-skimming-scam/article_2691a578-1e8f-11e9-9479-5f0f60a03358.html"}],"summary":"TTPD arrest two men in ATM skimming scam - Red River Federal Credit Union","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5abbd3e2b8f0ce15fb2745c2ca71f9a138fbd06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9df6b4e0-2465-11eb-b042-01be07ea3379"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"feb352b8cebc","org_name":"Quidd","org_type":"retail_ecommerce","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/account-details-for-4-million-quidd-users-shared-on-hacking-forum/,http://www.digitaljournal.com/tech-and-science/technology/quidd-data-breach-exposes-4-million-users-including-youngsters/article/572167"}],"summary":"company's internal customer database found for sale online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e6924ba8520b4b4ca4451d4d9e904571da6d6fc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ab68ff30-722a-11eb-a74a-79ed152e0098"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"1b3c530a2fdd","org_name":"Onlinevitalus","org_type":"professional_services","ransomware":null,"records_affected":752000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/12/09/birth-certificate-applications-exposed/"}],"summary":"Onlinevitalus accidentally left an s3 bucket open with like 750k ppl's sensitive information. Way to go","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ee7e2c2c1ee03ee4baf49d7a61e0b46b54377e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f025340-e457-11e9-a93a-d3a3d34c5869"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f0c3986cefa","org_name":"OffSite Image Management, Inc","org_type":"technology_saas","ransomware":null,"records_affected":340000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.propublica.org/article/millions-of-americans-medical-images-and-data-are-available-on-the-internet,https://www.bleepingcomputer.com/news/security/400-million-medical-radiological-images-exposed-on-the-internet/,https://healthitsecurity.com/news/senator-demands-imaging-firm-share-cybersecurity-practices-after-breach"}],"summary":"ProPublica searched the internet for Picture Archiving and Communication System (PACS) servers speaking an old medical imaging sharing protocol (DICOM) and found lots of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb85bf9edc0e4e69a63f726809a92be5cef009a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8984dba0-ce4d-11e9-b4e5-4769cce343a0"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"de570f7fd82d","org_name":"Northern Territory Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2019-08-08/nt-police-admit-breaching-public-servant-privacy/11392444"}],"summary":"Reece Kershaw, the Northern Territory's Police Commissioner and soon-to-be federal police chief, has admitted some of his officers inappropriately accessed the private medical records of a public servant.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8054f053c5f127a60a6da2118344d1e1eeaec566","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9cab9ec0-de25-11e9-b511-f75921c18742"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17463be7eef2","org_name":"Northern Light Acadia Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/me-acadia-hospital-mistakenly-released-confidential-information-of-300-suboxone-patients/"}],"summary":"A communications official at Northern Light Acadia Hospital in Bangor mistakenly emailed the confidential names of 300 patients with prescriptions for Suboxone, a medication used to treat opioid use disorder, to an editor at the Bangor Daily News last week.  In addition to their ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"675cd5cb41a0ed44223c58b8598f5777b5c35e2e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c1a7f4b0-023a-11ea-ad43-7952870528d4"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"d967646a91ce","org_name":"Nokia","org_type":"technology_saas","ransomware":null,"records_affected":800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gizmodo.co.uk/2019/09/exposed-files-leak-details-on-sorm-russias-pervasive-domestic-surveillance-system/"}],"summary":"Nokia Employee accidentally uploaded data to an rsync server that was publicly facing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6e72c939ed72b725872c72be5c3c1aca7bbebf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c3e51ec0-c837-11e9-a1c3-d539e9b7140e"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5e88d6d650d","org_name":"Newport School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pennlive.com/perry-county-times/2019/03/cyber-attack-at-newport-schools-didnt-expose-student-data.html"}],"summary":"Newport gets schooled by virus.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e9abe00649ed9ce6311bc3f10c4122901b8e79c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"942cab40-de0c-11e9-92e6-b7a271e742aa"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"436143b43536","org_name":"NCH Healthcare system","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/73-email-accounts-compromised-in-major-phishing-attack-on-nch-healthcare-system/"}],"summary":"he importance of security awareness training for healthcare employees has been highlighted by a recent phishing attack on Bonita Springs, FL-based NCH Healthcare System.  The attack was detected on June 14, 2019 when suspicious email activity was identified in relation to its pay","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11290901df47b6f838e6f2c0b666028a3410822d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"de435710-e4a6-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"602cf7b9c7a1","org_name":"Nanaimo Regional General Hospital","org_type":"healthcare","ransomware":null,"records_affected":102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timescolonist.com/news/local/privacy-breach-at-nanaimo-hospital-after-health-records-illicitly-accessed-1.23771604;"},{"fetched_at":null,"title":null,"type":"press","url":"https://vancouverisland.ctvnews.ca/island-health-confirms-privacy-breach-at-nanaimo-hospital-1.4354114"}],"summary":" Island Health has fired an employee following a privacy breach of 102 people at Nanaimo Regional General Hospital.  The breach involved an employee who is \"no longer associated with Island Health,\" the authority said.  \"Our employees are well aware the snooping into the health r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7daf2a212d56719ce94ed7cb5929213c21fe251","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21373d90-1d11-11eb-a925-afd7acbe9906"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b186f36eb206","org_name":"Mumsnet","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2019/02/07/mumsnet_breach/"}],"summary":"Mumsnet experienced a caching problem while migrating over that allowed users to be logged into another user's account by accident ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cb9c63e971bed5b8d16907abacaab95484af724","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e23a8d10-e452-11e9-a93a-d3a3d34c5869"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26cd0c137237","org_name":"MobilexUSA","org_type":"healthcare","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.propublica.org/article/millions-of-americans-medical-images-and-data-are-available-on-the-internet,https://www.bleepingcomputer.com/news/security/400-million-medical-radiological-images-exposed-on-the-internet/,https://healthitsecurity.com/news/senator-demands-imaging-firm-share-cybersecurity-practices-after-breach"}],"summary":"ProPublica searched the internet for Picture Archiving and Communication System (PACS) servers speaking an old medical imaging sharing protocol (DICOM) and found lots of data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80ad152305c774fdc5f311de9527cf129de38126","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76221690-1465-11eb-ac54-3bea5c26f172"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e822aa1914df","org_name":"Mixcloud","org_type":"other","ransomware":null,"records_affected":20000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/11/29/mixcloud-data-breach/"}],"summary":"Mixcloud data discovered on sale on crime forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1866fe9b04ec8a589567bd0413c4fcd309888c89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56111900-0ade-11ea-9821-617d71ee6253"},"incident_date":"2019-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/04/13/microsoft-support-agent-email-hack/,https://www.theverge.com/2019/4/13/18309192/microsoft-outlook-email-account-hack-breach-security,https://www.vice.com/en_us/article/xwndwn/microsoft-outlook-msn-hotmail-breach-cryptocurrency-bitcoin"}],"summary":"Earlier this month, Motherboard broke the news that hackers were not only able to access Outlook users’ email metadata as previously reported, but also email content. The breach centered around a hacker getting hold of a Microsoft customer support worker’s login credentials; from","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":"WIZARD SPIDER","variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97ddde4ae98628348e364eb1edde8de1225001d8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1ac8700-f0e6-11e9-84f1-e9d602503a96"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3971a758ba05","org_name":"Michael Garron Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://toronto.ctvnews.ca/east-york-hospital-recovering-after-malware-attack-1.4624628,https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"summary":"hospital infected by ransomware, likely through phishing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"wizardspider"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f37935a2f3feaec801d64f0e6a00acd33af17b6c","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9cfd35b0-dafa-11e9-9ff0-a5a30eaf0927"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5cb52ed7a709","org_name":"Miccosukee Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2019/09/ny-payroll-company-vanishes-with-35-million/"}],"summary":"The four casino workers generated false “coin-in” amounts on the electronic gaming machines, including video slots, which resulted in “fraudulent” credit vouchers for the same totals, the indictment says.  Mechanically, the four workers connected one end of a wire to a device ins","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b25450a8a8b1067006b217c34f1a288347a0b1f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fea1530-15e2-11ea-997d-ff527b87f439"},"incident_date":"2019-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GT","org_id":"ae896a6dd778","org_name":"Mexican Consulate Services","org_type":"government","ransomware":null,"records_affected":4800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/04/19/mexican-embassy-hack/,https://www.engadget.com/2019/04/19/mexico-embassy-guatemala-hack-leaked-documents/"}],"summary":"Thousands of documents containing sensitive information belonging to Mexico's embassy in Guatemala were leaked online this week by a hacker. The stolen cache contained more than 4,800 files related to the embassy's activities including its dealings with personal documents belongi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"054bbb81c17b910ad0e58b7ba10e911d0a0d73e9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a00c2f0-c9b3-11e9-9a33-13e06a29212c"},"incident_date":"2019-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IM","org_id":"2ba7c8c79a82","org_name":"Manx Department of Health and Social Care","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/world-europe-isle-of-man-49076717"}],"summary":"Personal information belonging to dozens of vulnerable people receiving government-funded home care on the Isle of Man has been lost.  Paper records of phone numbers, names and addresses of 33 adults had been \"mislaid\", the Department of Health and Social Care admitted.  Codes to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ea82fafa22135e6f0d7cf9b8a881f56616b1731","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ff4ce50-058d-11ea-a6b7-b9a04765ea4f"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"2d0e13593250","org_name":"Malaysian Ministry of Health","org_type":"government","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com.my/news/nation/2019/10/23/over-17000-patients039-personal-data-exposed-on-national-neurology-registry-website"}],"summary":"In yet another data breach, more than 17,000 patients' personal data have been exposed on the government-linked National Neurology Registry (NNeuR) website due to a scripting error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2deba54000496abee331960dba534905a47287b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71a7c4d0-c4f6-11e9-b9c4-cb3751948e05"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"034268b799e7","org_name":"Luscious.net","org_type":"technology_saas","ransomware":null,"records_affected":1195000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/an-anonymous-hentai-porn-site-exposed-over-a-million-users-emails/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/08/19/anonymous-luscious-hentai-manga-porn-security-lapse/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://z6mag.com/2019/08/19/luscious-leaked-database-with-supposedly-anonymous-user-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/adult-content-sharing-website-leaked-private-user-information/"}],"summary":"A popular hentai porn site that promises anonymity to its 1.1 million users left a user database exposed without a password, allowing anyone to identify users by their email addresses.      You might not have heard of Luscious.net unless you’re into hentai and manga porn but it’s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"220cd0477c0b54f64acc8c02734c61ce0bfeb09d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cbe7c3b0-e075-11e9-9b3e-615de4b5b4cd"},"incident_date":"2019-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"d0d1747f948e","org_name":"Lumin PDF","org_type":"technology_saas","ransomware":null,"records_affected":24386039,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/"}],"summary":"Ransomware on open mongodb database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fb5f728c1c8523a4c0b9095aa87f9a89e59aef0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46b5dce0-f3a1-11eb-821b-d1ebb09f37f0"},"incident_date":"2019-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"49417b8ef133","org_name":"Lower Saxony Bureau for Criminal Investigation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gulf-times.com/story/636308/Important-data-stolen-from-German-state-s-crime-bu"}],"summary":"Files with sensitive data on police informants have been stolen during a burglary from the car of an official at the Bureau for Criminal Investigation for the northern German state of Lower Saxony","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f9e1821f872c5aa30a2f9b2c2a56db80fdcd161","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11aa99b0-2131-11ec-82c4-4d3486f21395"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"020ed6171e61","org_name":"Liberty Income Tax","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.audacy.com/krld/articles/tax-information-found-dumpster-service-offering-free-credit-monitoring"}],"summary":"Tax Information Found In Dumpster; Service Offering Free Credit Monitoring - Liberty Income Tax","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7baa84cdcbc0c03a2e7e2ac5c660df10348765ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"622d4fb0-ce6b-11e9-b4e5-4769cce343a0"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"e456e03daae9","org_name":"Letterkenny University Hospital","org_type":"healthcare","ransomware":null,"records_affected":33,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://newsbeezer.com/ireland/medical-records-found-in-the-public-park-in-co-donegal/"}],"summary":"An investigation was initiated after a personal medical record had been found in a park in Co Donegal.  The large file was found near bushes at the Bernard McGlinchey Park near the Letterkenny University Hospital files containing sensitive medical history about an elderly woman a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afbc18708f181487b860be298825a81bb2b9c0f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"260136e0-0fc1-11ea-936a-1ffb751fb68b"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07f1ecd7e92c","org_name":"Ladders","org_type":"professional_services","ransomware":null,"records_affected":13700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/05/01/ladders-resume-leak/,https://www.nydailynews.com/news/national/ny-ladders-data-exposed-million-job-recruitment-site-20190502-f3govsm7hrcyxfowmees74avqe-story.html"}],"summary":"A security lapse has exposed the data of at least 13.7 million clients of the high-end job recruitment site The Ladders that were stored on an unprotected server hosted by Amazon.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e864e64b70c003acfa24514de4b508638ffe73a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f463200-25ed-11ec-8021-93be7268887c"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e8e7406181b3","org_name":"Kent County Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-england-kent-47390022"}],"summary":"Adoption agency accidentally CC'd everyone instead of BCC","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ce984cfe02af401e26e733d16b09d427bfd7f30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc138e90-2595-11ea-b8c8-4fa7e4328c98"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c7c3b890db4","org_name":"Katherine Shaw Bethea Hospital","org_type":"healthcare","ransomware":null,"records_affected":1486,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/phishing-attacks-reported-by-sunrise-community-health-and-katherine-shaw-bethea-hospital/"}],"summary":"Phishing attack potentially nabs hospital spreadsheet with over 1k records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c0ea593a899e66c8134b3e4adb832451ca5aa41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"695a0b20-1d1c-11ea-93dd-ad92e007263c"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6aaf57f29d1f","org_name":"Kalispell Regional Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/montana-health-system-alerts-130-000-patients-of-data-breach.html"}],"summary":"Kalispell (Mont.) Regional Healthcare began notifying nearly 130,000 patients Oct. 23 that their information may have been exposed due to a phishing attack.  The health system discovered in June that several employees had provided their credentials to an unauthorized third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a33895fad682957445441965653739349f16859b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8da47e0-cd35-11e9-a052-6392f3b8c0e8"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"7188b5486a96","org_name":"JustDial","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/justdial-database-leak-reviewer-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thehackernews.com/2019/04/justdial-hacked-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2019/05/justdial-smacked-by-subsequent-security.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/over-100-million-justdial-users-personal-data-found-exposed-on-the-internet/"}],"summary":"Justdial is a renowned Indian hyper-local search engine which recently became prone to two security breaches in the span of two weeks.  Only a few weeks ago, the database of all the customers of Justdial was laid bare on the dark web and now the reviewers’ data got on the line.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e97c06ca8675fad5b1afa82e033e5bab693e499","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35e9efe0-237d-11eb-a2fc-cdee479fbead"},"incident_date":"2019-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"923710e47118","org_name":"Juniata College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/juniata-college-provides-notice-of-data-incident-300978313.html"}],"summary":"Attackers access email and potentially access PII within","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d4f08f740e9d2f5bd221dbb05b92307c0f26192","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4e99f40-1d22-11ea-93dd-ad92e007263c"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"631a904c78a6","org_name":"Himachal Pradesh State Electricity Board Ltd (HPSEBL)","org_type":"energy_utilities","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nationalheraldindia.com/india/bank-account-details-aadhaar-data-of-himachal-pradesh-power-board-customers-leaked"}],"summary":"In a serious breach of security, personal details including telephone number, bank account details and Aadhaar number of more than 20 lakh customers of Himachal Pradesh State Electricity Board Ltd (HPSEBL) have been leaked online. It includes data of both commercial clients and h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5c60e7fd6f4d0b528c5899a9886e49b487c8625","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"529322f0-df46-11e9-9ff0-a5a30eaf0927"},"incident_date":"2019-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7bb60db23164","org_name":"Gwinnett County Justice Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/judge-said-to-believe-da-hacked-her-computer-is-charged-with-computer-trespassing;"},{"fetched_at":null,"title":null,"type":"press","url":"https://pacga.org/2019/09/18/four-indicted-for-criminal-trespass-by-gwinnett-county-grand-jury/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://apnews.com/0b8f6bfa105845debadd91739a038949;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.law.com/2019/09/18/special-prosecutor-seeks-indictment-of-gwinnett-judge-over-court-computer-hack-292-53725/?slreturn=20190825124146;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.gwinnettdailypost.com/local/gwinnett-superior-court-judge-kathryn-schrader-three-others-indicted-for/article_e008d912-da56-11e9-9861-eb6bd021d473.html;"}],"summary":"A superior court judge in Gwinnett County, Georgia, has been indicted on three counts of computer trespass for allegedly allowing outsiders to access the county computer system, reportedly to investigate whether the district attorney had hacked her computer.  Judge Kathryn Schrad","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93fc2412ef7bac1c5f1c8bbec140367f2678541b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a1a62a00-6c7f-11eb-ae4f-03e1e00a9a54"},"incident_date":"2019-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"205bf28c4732","org_name":"Gatehub","org_type":"professional_services","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2019/11/password-data-dumped-online-for-2-2-million-users-of-currency-and-gaming-sites/"}],"summary":"Cryptocurrency wallet website hacked and 2.2 million user's data posted online on criminal forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88885a048a0867e72809d73508b8b1292884783c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2ae3bc0-72ce-11eb-a674-05cfd55ad89e"},"incident_date":"2019-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f1377986eabe","org_name":"Ganz","org_type":"other","ransomware":null,"records_affected":42000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/hacker-leaks-23-million-usernames-and-passwords-from-webkinz-childrens-game/"}],"summary":"Hacker uploaded Webkinz world data dump that included 22m credentials ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c7760ce329e9eb1d986e49d8b93e1a4630d61b2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8b0654f0-6c7a-11eb-ae4f-03e1e00a9a54"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"5218c48f43de","org_name":"Fut Fantastico","org_type":"professional_services","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cisomag.eccouncil.org/fut-fantastico-data-breach/"}],"summary":"Miscofigured s3 bucket exposed data of Mexican football side, Fut Fantastico","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4304ee2f20eb481b12b535abacd6658ac93dd92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"607b2040-c833-11e9-b045-b11609af3ce0"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"623ecceb5036","org_name":"FBI National Academy Associates","org_type":"nonprofit","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/hackers-reportedly-post-data-on-law-enforcement-officers-a-12380,https://www.nbcnews.com/tech/security/thousands-identities-personal-information-published-fbi-related-hack-n994366,https://techcrunch.com/2019/04/12/police-data-hack/,https://www.nbcnews.com/tech/security/hacker-group-posts-hundreds-law-officer-records-n994231"}],"summary":"law enforcement PII stolen through webapp.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c028686356a7d1be1f90a680848890d52c284962","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d97be680-f939-11eb-86f9-41a68a9542ff"},"incident_date":"2019-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ebae778567e","org_name":"Excela Health","org_type":"healthcare","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://triblive.com/local/westmoreland/theft-of-payroll-documents-left-1800-excela-employees-data-at-risk/"}],"summary":"Excela Health employee had a breifcase containing employee data stolen from their car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a61c105101610f1904907d78f9d4ada214454fd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee3b2830-c81a-11e9-8a5a-abdcbb867af8"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c118651fc7d1","org_name":"EA Games","org_type":"technology_saas","ransomware":null,"records_affected":300000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2019/07/bitglass-security-spotlight-ea-origin-leaves-the-data-of-300-million-accounts-exposed/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/ea-origin-had-a-vulnerability-that-left-300-million-players-potentially-exposed/"}],"summary":"Researchers from Check Point and CyberInt. recently found a vulnerable risk in EA Origin, a gaming server that hosts millions of players online. The discovery shows that up to 300 million gamers had their personally identifiable information (PII) exposed on popular games such as ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e2f978cc10514b8d182cdf40ee0d2c67294ada7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6bbfe1b0-1a17-11ec-9cee-0b92cf8d85df"},"incident_date":"2019-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"bd530330b5e5","org_name":"E-Land","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-stole-2-million-credit-cards-from-e-land/"}],"summary":"Korean Retailer 'E-Land' Suffers Ransomware Attack—Almost Half of its Operations Face Shut Down!","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df4651adac527ffd1f6e02a78dd8aa5539b7d27c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aae96600-c8fb-11e9-9c8c-43e34f445f97"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e6e4b557983c","org_name":"Desjardins Group","org_type":"other","ransomware":null,"records_affected":2700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://montrealgazette.com/business/desjardins-rogue-employee-caused-data-breach-for-2-9-million-members;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/montreal/desjardins-data-breach-1.5183297;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/desjardins-hit-with-two-class-action-suits-after-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.pymnts.com/news/security-and-risk/2019/lender-desjardins-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://montrealgazette.com/news/local-news/hacked-desjardins-data-already-sold-to-criminals-report;"}],"summary":"More than 2.9 million Desjardins Group members have had their personal information compromised in a data breach targeting Canada’s biggest credit union.  The incident stems from “unauthorized and illegal use of internal data” by an employee who has since been fired, Desjardins sa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6feaf7a0d0d19bde9084d3279afc1b26b96d8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d264360-72c4-11eb-a674-05cfd55ad89e"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"f7e3d6becada","org_name":"Delivery Hero","org_type":"technology_saas","ransomware":null,"records_affected":727000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/foodora-data-breach/"}],"summary":"Delivery Hero found it's database up for sale in one of them crime forums","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a29a79b197b2aa35d9371573c1aa9002d7ec3788","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"938e7000-1b84-11ea-aa10-8d551748dadb"},"incident_date":"2019-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d1320675dd6","org_name":"Cobbs Allen","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/notice-of-data-security-incident-300959388.html"}],"summary":"phishing compromises mulitple email accounts leading to disclosure of PHI and PII in those accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b03aaffd9ab44a2303dbadf5d2e4d664f3b04694","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78fccde0-cffd-11e9-b7c0-13a933b7e5d5"},"incident_date":"2019-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c3b986f71555","org_name":"City of Saskatoon","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thepostmillennial.com/saskatoon-city-hall-loses-over-1-million-in-phishing-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/scammer-tricks-city-into-1-million-wire-transfer/;"}],"summary":"Saskatoon city manager Jeff Jorgensen has admitted that the city has lost $1.04 million to a fraudster posing as a construction company’s chief financial officer for weeks. An expert now believes that the money may have been sent overseas and it is possible the city will never se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"854613f880e3a603639a425e80c5c6e8805c6ac0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"825a12f0-72cf-11eb-a674-05cfd55ad89e"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e81038ffd088","org_name":"CHS Consulting","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pcmag.com/news/thousands-of-unsecured-passport-scans-found-online"}],"summary":"CHS Consulting left thousands of passports and other sensitive information unsecured on a s3 bucket","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea6d33f9a8cc0c58e6ebfd6bf2c5bb43a152fb5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d138aa80-0fd3-11eb-afe7-87eff9df4bdb"},"incident_date":"2019-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db69cba8c0ab","org_name":"Choice Health Management Services, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mcknightsseniorliving.com/home/news/senior-living-providers-email-data-breach-affects-residents-employees-third-parties/"}],"summary":"Choice Health experienced a breach when a user's email account was accessed by unauthorized third party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a06dcb15a770939b781e5bb7a5845e68b36ab46","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87c206f0-da79-11eb-bcc7-b7194a064c3e"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a796b9c93cf8","org_name":"Bruno's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fox4now.com/news/local-news/two-local-air-conditioning-companies-battle-over-trade-secrets"}],"summary":"Bruno's accuses competitor of stealing their employees along with their trade secretes. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df49ef0c9989fd6fbc11fc3c0ac0d97409dcd25e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76acb1e0-c5c1-11e9-890f-61c57d05334d"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bb37aa934742","org_name":"Bradford Royal Infirmary","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thetelegraphandargus.co.uk/news/17836523.investigation-claims-student-nurse-shared-patients-39-highly-sensitive-personal-details-snapchat/"}],"summary":"AN INVESTIGATION is underway amid allegations that a Bradford nurse shared patients’ highly-sensitive personal details on Snapchat.  The Telegraph & Argus has had sight of images of posts purporting to have been made by a student nurse. It has not been confirmed whether or not th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7842c66774f83e6d4ce6f180ade5cae9a412a20","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43a62100-1467-11eb-ac54-3bea5c26f172"},"incident_date":"2019-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"f116a9157bda","org_name":"Boy Scouts of America","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.charlotteagenda.com/178386/boy-scouts-affiliate-data-breach-exposed-kids-and-parents-personal-information/"}],"summary":"Boy Scouts partner had a programming error that disclosed their data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a08ca65e7d7b8ea30168ea67efbcea240e650068","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e68cd690-ce61-11e9-b4e5-4769cce343a0"},"incident_date":"2019-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"047c0b729268","org_name":"Belfast health trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.irishnews.com/news/northernirelandnews/2019/03/26/news/information-commissioner-orders-probe-into-data-protection-breach-following-covert-op-by-belfast-trust-1582313/"}],"summary":"THE Information Commissioner has ordered an \"enforcement investigation\" into the Belfast health trust following the loss of \"sensitive personal data\" linked to a covert operation into allegations of sectarianism.  Correspondence sent by the commissioner to a former security guard","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e7d2f127482640b8f3e23e18b751ba0bcf1d00a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59470020-ce58-11e9-b4e5-4769cce343a0"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14d11b59d789","org_name":"Bank of Cardiff","org_type":"financial","ransomware":null,"records_affected":100000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vice.com/en_us/article/43jkzp/one-million-bank-phone-calls-in-amazon-aws-bucket-bank-of-cardiff"}],"summary":"A bank has left more than one million audio recordings of phone calls seemingly made by bank employees exposed to the open internet, letting anyone listen in on sensitive conversations, including ones with potential customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef6b87fb3cbeb9f2fb658746ca4073da5052f440","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f213890-0235-11ea-ad43-7952870528d4"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"066f8b58eab1","org_name":"Authentic Jobs","org_type":"technology_saas","ransomware":null,"records_affected":221130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/data-leak-exposes-more-than-200k-job-seeker-cvs/article/560196"}],"summary":"Data leak exposes more than 200K job seeker CVs SPECIAL LISTEN | PRINT BY TIM SANDLE     OCT 21, 2019 IN TECHNOLOGY Two recruitment firms, US-based Authentic Jobs and UK-based Sonic Jobs, exposed more than 200K job seekers’ CVs. Stephan Chenette, Co-Founder and CTO, AttackIQ prov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5271a5046757ecc32594feb574a4834bd64aaad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6c57370-07b9-11ea-a8b1-672cf95dfdfd"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GU","org_id":"59a07260b7ad","org_name":"Army and Air Force Exchange","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.postguam.com/news/local/man-takes-plea-deal-after-using-ustomer-s-credit-card/article_601e2e94-a489-11e9-8c0c-27e2461c89a4.html"}],"summary":"Army and Air Force Exchange service employee copied over individuals credit card information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffbaf4ed8829c3441404c29b84e0b7285eac6610","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b273d450-caa9-11e9-be6a-93e1b0174537"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37d2d5370b02","org_name":"ApexSMS","org_type":"professional_services","ransomware":null,"records_affected":80000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gdpr.report/news/2019/05/10/80-million-records-exposed-in-sms-spam-operation/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/05/09/sms-spammers-doxxed/u"}],"summary":" ApexSMS suffers data breach exposing the records of 80 million people.  Discovered by security researcher Bob Diachenko, ApexSMS, an SMS text marketing company has suffered a data breach exposing the personally identifiable information of more than 80 million people which was th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e259e5afac8a29bd1d691299e22106937cdf0135","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86d4d9b0-d978-11e9-9ff0-a5a30eaf0927"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fe49a7611f3","org_name":"Anytime Fitness","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc15.com/news/crime/pd-man-woman-defraud-buckeye-fitness-center-of-over-22-000"}],"summary":"Two personal trainers are accused of defrauding a Buckeye fitness center of over $22,000.  Maricopa County Court records show that last week two former fitness trainers at Anytime Fitness in Buckeye were charged with fraud, theft and computer tampering.  The owner of Anytime Fitn","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed76d988e2d80976b474079726f2954cfe490488","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b47f80e0-0493-11ea-ad43-7952870528d4"},"incident_date":"2019-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a27550fe47b","org_name":"AMC Network","org_type":"technology_saas","ransomware":null,"records_affected":1615360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.engadget.com/2019/05/03/amc-sundance-now-shudder-subscriber-exposed-database/"}],"summary":"Someone at AMC Networks done left yet another open database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30607f556d4d651b4f82f74b5554fc8617b48b93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15d34c40-2597-11ea-b8c8-4fa7e4328c98"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"e0d42e295dbe","org_name":"All India Chess Federation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.freepressjournal.in/sports/first-forgery-now-data-theft-and-breach-of-privacy-all-india-chess-federation-scandal-grows-deeper"}],"summary":"Some dude in India was contracted to do work and sneakily sub-contracted the actual work to a non-authorized third party ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6164b8d5af882777be96175fb91dab2cd3fabee0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75a9e620-e9d7-11e9-bcf0-459173902f03"},"incident_date":"2019-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc5374a90233","org_name":"Advocate Christ Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/advocate-christ-medical-center-demonstrates-how-not-to-respond-to-a-hipaa-breach/,https://chicago.cbslocal.com/2019/10/03/man-gets-somebody-elses-medical-records-advocate-christ/"}],"summary":"hospital sent records to wrong person, then denied doing it and refused to pick them back up.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2019-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d24ffd1920bc50cfaacca56cc8375c9d5a3f70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f2b3b0b0-e4a5-11e9-8cfd-bf57b38104b7"},"incident_date":"2019-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4f9a8b636678","org_name":"Advanz Pharma","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/ip-tradesecrets-concordia/advanz-hits-former-partners-with-trade-secrets-case-over-knockoff-drug-idUSL1N21Q1Q2;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.law360.com/articles/1147176/concordia-pharma-sues-over-bowel-drug-trade-secrets"}],"summary":"Canadian pharmaceutical company Advanz Pharma, formerly known as Concordia Pharmaceuticals Inc, has accused two former business partners of misappropriating highly confidential documents in order to launch a “knockoff” version of its irritable bowel treatment Donnatal.  Advanz su","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-12-31","discovered_date":"2018-11-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3877142efee4ec4a610fc062509c38850b581bc4","impact_type":"unknown","incident_date":"2018-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a1f53c8aabf0","org_name":"Housing Authority Of The City Of Salem","org_type":"unknown","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Housing%20Authority%20Of%20The%20City%20Of%20Salem-2018-12-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3281a997d6120d9beba123121e86c0003907ab5b","impact_type":"unknown","incident_date":"2018-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f6c71e4bfe5b","org_name":"Wolverine Solutions Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145681"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143325"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb588fa83e7dc1172d17cfb00abca52cd09f0029","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-26","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHDOCS01-%232634704-v1-AG-CA-Notification-Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"435c54dc895a","org_name":"MJ Insurance, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143317"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHDOCS01-%232634704-v1-AG-CA-Notification-Letter_0.PDF"}],"summary":"MJ Insurance reported unauthorized access to an employee's email account, which contained some individuals' personal information; investigators found no evidence that the information was stolen or misused.","supporting_quote":"It appears that our employee may have been the victim of an email phishing campaign.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"353c52750f2137d5cecb3a8adfbe05e0b49c16d6","impact_type":"data_theft","imported_from":null,"incident_date":"2018-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"88219d414da3","org_name":"GoldSilver","org_type":"retail_ecommerce","ransomware":null,"records_affected":242715,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GoldSilver","type":"hibp","url":"https://haveibeenpwned.com/Breach/GoldSilver"}],"summary":"GoldSilver suffered a data breach in October 2018 that exposed customer and mailing-list information, including email addresses and sensitive personal and financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-26","discovered_date":"2018-12-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76e2b77bb450ce6a43353688e787e267a8791551","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/181226__CA_AG_Notice_Portal_Appendix_-_SJSU_0.pdf"},"notes":null,"org_country":"US","org_id":"94dd20aaa951","org_name":"San Jose State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/181226__CA_AG_Notice_Portal_Appendix_-_SJSU_0.pdf"}],"summary":"An unauthorized third party accessed an SJSU Associated Students server that stored names, email addresses, usernames, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-12-26","discovered_date":"2018-12-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59de5a18286459916f04e9db30b3286efc072768","impact_type":"unknown","incident_date":"2018-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e8018c17872","org_name":"BEL USA, LLC through its website DiscountMugs.com","org_type":"unknown","ransomware":null,"records_affected":70244,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BEL%20USA%2C%20LLC%20through%20its%20website%20DiscountMugs.com-2018-12-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-26","discovered_date":"2018-11-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fadb303eef77f8241fa147b953eca7d09bdfee0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_5.pdf"},"notes":null,"org_country":"US","org_id":"d4d2793e6c5b","org_name":"BEL USA, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143174"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_5.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10606.pdf"}],"summary":"Unauthorized code was inserted into the DiscountMugs.com shopping cart page and was designed to collect information customers entered when placing orders.","supporting_quote":null,"technology_involved":["DiscountMugs.com shopping cart page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["credentials"],"disclosed_date":"2018-12-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a098956a9896fa3b039caaadbbf8f4796e70d98","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"6c230b8fc355","org_name":"Warby Parker","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143124"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Warby%20Parker-2018-12-27"}],"summary":"Warby Parker reported attempts to access customer accounts using usernames and passwords that may have been obtained from breaches at other companies.","supporting_quote":"We began to investigate immediately, and so far we’ve determined that unauthorized parties may have obtained your username and password elsewhere—most likely through security breaches at other companies—and may have used this information to attempt to log in to your Warby Parker account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-20","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc2eea32e6d03f566894e7f5043daa818713e7f5","impact_type":"data_theft","incident_date":"2018-11-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SamDataBreach_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"2169348ea329","org_name":"Michael Koch, dba Lockhart, Britton & Koch","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143022"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SamDataBreach_0.pdf"}],"summary":"A briefcase containing personal information was stolen from a car that was broken into.","supporting_quote":"My briefcase that was locked in the trunk was stolen.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["credentials"],"disclosed_date":"2018-12-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"653cff507daa106be5059b4629f8aeb45371d527","impact_type":"unknown","incident_date":"2018-09-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10651.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"99fea326a13c","org_name":"JAND Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10651.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10651.pdf"}],"summary":"JAND Inc. reported attempts to access Warby Parker customer accounts using usernames and passwords that may have been obtained in breaches at other companies.","supporting_quote":"We began to investigate immediately, and so far we’ve determined that unauthorized parties may have obtained your username and password elsewhere—most likely through security breaches at other companies—and may have used this information to attempt to log in to your Warby Parker account.","technology_involved":["Warby Parker customer accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c72e28440db9bccec3e2cbb6e4e017548bef97f6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"46d8f31a1883","org_name":"Mappery","org_type":"technology_saas","ransomware":null,"records_affected":205242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mappery","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mappery"}],"summary":"Mappery reported a December 2018 breach exposing email addresses, usernames, geographic locations, and passwords stored as unsalted SHA-1 hashes.","supporting_quote":null,"technology_involved":["Mappery website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48c2fe7767a7273cda89f89c8b20c02e9aa15aa0","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_1.PDF"},"notes":null,"org_country":"US","org_id":"b6b55ee834da","org_name":"Springstone Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142663"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_1.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Springstone%20Financial-2018-12-14"}],"summary":"An unauthorized third party accessed a limited number of employee web-based email accounts that contained personal information.","supporting_quote":null,"technology_involved":["web-based email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-14","discovered_date":"2018-09-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b94a35e462d161bb28a4da2dcb26c5ec1f77545a","impact_type":"data_theft","incident_date":"2018-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CVHP%20Notice%20of%20Data%20Breach%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"b640443bf868","org_name":"Citrus Valley Health Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-146046"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142668"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CVHP%20Notice%20of%20Data%20Breach%20Template_0.pdf"}],"summary":"Citrus Valley Health Partners reported that an unauthorized third party accessed Jobscience's server and took data that may have included personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Jobscience"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bf741b47b859","name":"Jobscience"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e670cd8202273e0e6d122de61e8cad70ad788a26","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_27.pdf"},"notes":null,"org_country":"US","org_id":"ec2f74d9d1ac","org_name":"Beverages & More, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142674"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_27.pdf"}],"summary":"An unauthorized individual accessed the BevMo website and installed code on its checkout page that may have captured customer information.","supporting_quote":null,"technology_involved":["BevMo website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-14","discovered_date":"2018-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1ffa1b4bbd7055673238bd0b5e82d390b19a4e6","impact_type":"unknown","incident_date":"2018-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACE-%20CA-%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"c9ad53e5b221","org_name":"ACE Cash Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACE-%20CA-%20Letter_0.pdf"}],"summary":"ACE Cash Express discovered that an unauthorized person attempted to access customer accounts through its Mobile Loans application.","supporting_quote":null,"technology_involved":["ACE Cash Express Mobile Loans application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-12-13","discovered_date":"2018-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33e04b3c248dbd7adf30a5d25e2d5f547cbed0c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-12-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCHP%20CA%20AG%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"74e952736ad9","org_name":"Contra Costa Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The contractor falsified her identity to obtain a contract that provided access to CCHP records.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142655"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCHP%20CA%20AG%20Breach_0.pdf"}],"summary":"A CCHP contractor who falsified her identity to obtain a contract accessed a member’s electronic health record, with no current evidence of further improper use or disclosure.","supporting_quote":"On May 22, 2018, CCHP was made aware that the Contractor had falsified her identity to obtain a contract to provide services to CCHP.","technology_involved":["electronic health record"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2018-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2b6587ddbaff279a7d2405e8b914a587bf9c7a6","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_26.pdf"},"notes":null,"org_country":"US","org_id":"6293c4022950","org_name":"San Bernardino Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_26.pdf"}],"summary":"A District employee inadvertently sent a spreadsheet containing individuals’ information to a community college distribution list.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e0af3f86d39b0723bfbb47cb206864941deb47","impact_type":"unknown","incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Californina%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"7489c1341003","org_name":"ASI Computer Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142614"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Californina%20Exhibit%201_0.pdf"}],"summary":"ASI Computer Systems reported suspicious activity potentially impacting accounts used to access customer service support material and other general information.","supporting_quote":null,"technology_involved":["ASI Computer Systems accounts","ESP Web"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9a598a565ff5895ba00ca2ea45536a2421c932b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MUFG%20-%20California%20Copy%20of%20Notice%20Materials_0.pdf"},"notes":null,"org_country":"US","org_id":"05c2bbe6d779","org_name":"MUFG Union Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The unauthorized party used login credentials believed to have been obtained from third-party sources.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142509"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MUFG%20-%20California%20Copy%20of%20Notice%20Materials_0.pdf"}],"summary":"An unauthorized third party used customer login credentials to access Union Bank online or mobile banking accounts and may have accessed account information.","supporting_quote":"MUFG Union Bank, N.A. (“MUB”) recently determined that an unauthorized third party may have used your login credentials to gain access to your Union Bank Online and/or Mobile Banking account in November 2018.","technology_involved":["Union Bank Online","Mobile Banking"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-11","discovered_date":"2018-09-18","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63c3bfb799eb62c8415f29d22f8ab0675652110b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Farmer%20Brothers%20%20General%20Notification%20Letter%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"a7ca63c31ab0","org_name":"Farmer Bros. Co.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142591"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Farmer%20Brothers%20%20General%20Notification%20Letter%20Final_0.pdf"}],"summary":"Farmer Bros. Co. reported unauthorized access to multiple company email accounts that may have contained personal and financial information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"287ca6f321f2fa0a09168969a7acd54609fd18ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Final%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"969eae8f25f4","org_name":"Titan Manufacturing and Distributing Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Final%20Letter_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Titan%20Manufacturing%20and%20Distributing%20Inc.-2018-12-07"}],"summary":"Titan reported that malware on its system could access online-store shopping carts containing customers’ personal and payment-card information.","supporting_quote":null,"technology_involved":["online store shopping cart"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19fcd18ca5bca3b1860ab3eda46895d0062f5ee8","impact_type":"data_theft","imported_from":null,"incident_date":"2018-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"SK","org_id":"8d87825dc84f","org_name":"Bombuj.eu","org_type":"other","ransomware":null,"records_affected":575437,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bombuj.eu","type":"hibp","url":"https://haveibeenpwned.com/Breach/BombujEu"}],"summary":"A breach of Bombuj.eu exposed email addresses and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f884f01b3e4da6fdff1bf82eb789039953c4e16","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"IN","org_id":"ad601b01ce52","org_name":"Hub4Tech","org_type":"education","ransomware":null,"records_affected":36916,"reviewed":false,"root_cause":"The breach occurred via a SQL injection attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hub4Tech","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hub4Tech"}],"summary":"Hub4Tech suffered a SQL injection breach that exposed email addresses and passwords stored as unsalted MD5 hashes.","supporting_quote":"On an unknown date in approximately 2017, the Indian training and assessment service known as Hub4Tech suffered a data breach via a SQL injection attack.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c51ffc3249594b02013033092cb170f1f77c62f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-10-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2f30200cebc2","org_name":"You've Been Scraped","org_type":"unknown","ransomware":null,"records_affected":66147869,"reviewed":false,"root_cause":"Several unprotected MongoDB instances exposed the records.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: You've Been Scraped","type":"hibp","url":"https://haveibeenpwned.com/Breach/YouveBeenScraped"}],"summary":"Unprotected MongoDB instances believed to be hosted by a data aggregator exposed records believed to have been scraped from LinkedIn.","supporting_quote":"In October and November 2018, security researcher Bob Diachenko identified several unprotected MongoDB instances believed to be hosted by a data aggregator .","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-12-06","discovered_date":"2018-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d0221b5e486f5456176fb8ec7454d1c0f47caba","impact_type":"disruption_or_ransomware","incident_date":"2018-09-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redwood%20-%20AG%20Notification%20-%20California%2012.6.18_0.pdf"},"notes":null,"org_country":"US","org_id":"7194cba59439","org_name":"Redwood Eye Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142414"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redwood%20-%20AG%20Notification%20-%20California%2012.6.18_0.pdf"}],"summary":"A ransomware attack at IT Lighthouse affected a server storing some Redwood Eye Center patient records and temporarily locked access to the records.","supporting_quote":null,"technology_involved":["electronic medical records"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"IT Lighthouse"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"7ae47fd025da","name":"IT Lighthouse"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a0c0d2d8fde98ad626de0ed7ee0ba2622bc53ec","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c5272e0aaa74","org_name":"AerServ","org_type":"technology_saas","ransomware":null,"records_affected":66308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AerServ","type":"hibp","url":"https://haveibeenpwned.com/Breach/AerServ"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#AerServ-2018-12-02"}],"summary":"AerServ suffered a data breach involving personal information and passwords stored as salted SHA-512 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-12-05","discovered_date":"2018-11-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d2dd2c78b737cecb95b121ccb9563fcb6e52c7ca","impact_type":"unknown","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a938c8680b9","org_name":"U.S. Bancorp Investments, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#U.S.%20Bancorp%20Investments%2C%20Inc-2018-12-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-12-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0b7d67e60528c778f2d4e96557c4baaa5fbb176a","impact_type":"data_theft","incident_date":"2018-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10604.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"744e9032d1f8","org_name":"San Diego Hardware","org_type":"retail_ecommerce","ransomware":null,"records_affected":604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#San%20Diego%20Hardware-2018-12-05"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10604.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10604.pdf"}],"summary":"San Diego Hardware's website was compromised by a malicious script that collected consumer credit card data and redirected it to illicit domains.","supporting_quote":null,"technology_involved":["Website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9c958cf122e98c26f59ca0b5d14c360b5f50ba8","impact_type":"data_theft","imported_from":null,"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IT","org_id":"faf11b8c65e0","org_name":"ForumCommunity","org_type":"technology_saas","ransomware":null,"records_affected":776648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ForumCommunity","type":"hibp","url":"https://haveibeenpwned.com/Breach/ForumCommunity"}],"summary":"ForumCommunity suffered a data breach affecting email addresses, usernames, and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":["ForumCommunity"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d4e3c936e8278f958cb6b9242367bc6a53b8328","impact_type":"data_theft","imported_from":null,"incident_date":"2018-11-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"48131d200d6b","org_name":"Technic","org_type":"technology_saas","ransomware":null,"records_affected":265410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Technic","type":"hibp","url":"https://haveibeenpwned.com/Breach/Technic"}],"summary":"Technic disclosed a breach affecting user email and IP addresses, chat logs, private messages, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":["Technic platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2018-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60fe5dc3df8b320f939bd9df993fd14679498f6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a06e67d0-351b-11e9-86d0-2ffc8e66db8e"},"incident_date":"2018-12-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c230b8fc355","org_name":"warby parker","org_type":"retail_ecommerce","ransomware":null,"records_affected":198000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.philly.com/business/warby-parker-wharton-hack-data-breach-20181220.html"}],"summary":"Warby Parker suffers breach which may have compromised creds of 198,000 customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af1ba68a60d4d18366b7fc451134e26e2ad576ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d19ff410-caab-11e9-be6a-93e1b0174537"},"incident_date":"2018-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d3e2b06f635","org_name":"UConn Health","org_type":"healthcare","ransomware":null,"records_affected":326000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcconnecticut.com/news/local/UConn-Health-Says-Data-Breach-Could-Impact-More-Than-300000-506224881.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hartfordbusiness.com/article/20190222/NEWS01/190229955/1002;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/uconn-health-phishing-attack-sees-phi-of-326000-patients-exposed/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.classaction.org/news/uconn-uconn-health-staring-down-class-action-following-phishing-attack-caused-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/patients-sue-uconn-health-over-data-breach-caused-by-phishing-attack"}],"summary":"UConn Health is warning patients about a data breach that could impact more than 300,000 people.   UConn Health released a statement saying they recently learned “that an unauthorized third party illegally accessed a limited number of employee email accounts” and said it has secu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2018-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cf18966aefa5d2ccf4f0760a03942c620a060b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"774b16b0-ded9-11e9-ad75-f56272c47bf9"},"incident_date":"2018-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"31c1c367fb3b","org_name":"Tivit","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/brazilian-it-firm-tivit-suffers-data-leak/,https://www.defcon-lab.org/vazamento-de-dados-tivit/"}],"summary":"Company phished and desktop systems accessed to steal client credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08f4191ad27175d13a3a45898acb1d29055f6fbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b10d5fb0-33bd-11e9-8d6c-aba1b2985f04"},"incident_date":"2018-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"4ee7fbb332ce","org_name":"Boomoji","org_type":"technology_saas","ransomware":null,"records_affected":125000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.verdict.co.uk/boomoji-data-breach/"}],"summary":"Boomooji suffered a data breach that potentially exposed 124 million people's data as a result of an error in which two elasticsearch databases were left without password protection.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"add023beca00c5a19b117855c4684a041fc5b034","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1567a8c0-28d9-11e9-adf7-352895b3dcd2"},"incident_date":"2018-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32438b3951e3","org_name":"Ascension","org_type":"financial","ransomware":null,"records_affected":24000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nationalmortgageprofessional.com/news/69821/data-breach-exposes-millions-loan-documents-online;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/01/23/financial-files/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.housingwire.com/articles/48007-massive-data-breach-involving-millions-of-mortgage-documents-just-got-much-worse;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2019/01/24/mortgage-loan-leak-gets-worse/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krld.radio.com/articles/north-texas-company-warning-customers-about-massive-data-breach;"}],"summary":"A trove of more than 24 million financial and banking documents, representing tens of thousands of loans and mortgages from some of the biggest banks in the U.S., has been found online after a server security lapse.  The server, running an Elasticsearch database, had more than a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aef745f8cce076e99b0f583614996f6d7d3ee3c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10558.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d1770d065eff","org_name":"Ontario Inc.","org_type":"unknown","ransomware":null,"records_affected":540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10558.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"982330a5af266165b32ce3360b099db38eebf9d5","impact_type":"data_theft","incident_date":"2018-09-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Marriott%20Starwood%20Guest%20Reservation%20Database%20Incident%20Email%20Notice%20%28002%29_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"0275ed6bc2d5","org_name":"Marriott International","org_type":"other","ransomware":null,"records_affected":500000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142258"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Marriott%20Starwood%20Guest%20Reservation%20Database%20Incident%20Email%20Notice%20%28002%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marriott%20International%2C%20Inc.-2018-11-30"}],"summary":"Marriott reported unauthorized access to the Starwood guest reservation database, where information was copied and encrypted.","supporting_quote":null,"technology_involved":["Starwood guest reservation database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-30","discovered_date":"2018-09-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b56c664f8cfc47663ec724efeb5478bf7649e163","impact_type":"unknown","incident_date":"2018-05-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5332a49e1516","org_name":"Cancer Treatment Centers of America","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cancer%20Treatment%20Centers%20of%20America-2018-11-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-30","discovered_date":"2018-10-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0052d0c596e9080aa410fd4823f54440c0b196d2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US_CA_Notice_0.pdf"},"notes":null,"org_country":"CA","org_id":"4ff057f4df1a","org_name":"1873349 Ontario, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US_CA_Notice_0.pdf"}],"summary":"1873349 Ontario, Inc. reported unauthorized access to payment card data used on its Canadian Website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3c8d7720cce6c84c3bfb51d0e6747654a77231","impact_type":"unknown","incident_date":"2018-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bc4a2b7c72e6","org_name":"The Tax Specialists, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142232"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-29","discovered_date":"2018-10-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65063ceb23b167eb89c1464fb2ae5326fc2d3158","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian_E1879_Sothebys_Home_Individual_Notification_Letter_11.20.18%20fin..._0.pdf"},"notes":null,"org_country":"US","org_id":"159b00d5ff3b","org_name":"Sotheby's Home","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142209"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian_E1879_Sothebys_Home_Individual_Notification_Letter_11.20.18%20fin..._0.pdf"}],"summary":"Sotheby's Home reported that an unknown third party accessed its website and inserted malicious code that may have transmitted personal information to unauthorized parties.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","other"],"disclosed_date":"2018-11-28","discovered_date":"2018-10-31","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39a2e4e3eb03b5a70531a4ad0b5d37df0d811c9e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter%20Proof_0.pdf"},"notes":null,"org_country":"US","org_id":"f37742055028","org_name":"Dunkin' Brands Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter%20Proof_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/DunkinBrandsInc.pdf"}],"summary":"Dunkin' Brands reported that third parties used usernames and passwords obtained from breaches at other companies to attempt access to DD Perks accounts.","supporting_quote":"These individuals then used the usernames and passwords to try to break in to various online accounts across the Internet.","technology_involved":["DD Perks"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb427b576343f577f81b7b6cdcd01486da9e5c98","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-11-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"524eca5824c9","org_name":"Data & Leads","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unprotected Elasticsearch database exposed the data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Data & Leads","type":"hibp","url":"https://haveibeenpwned.com/Breach/DataAndLeads"}],"summary":"An unprotected Elasticsearch database linked to Data & Leads exposed contact, location, and employment information.","supporting_quote":"In November 2018, security researcher Bob Diachenko identified an unprotected database believed to be hosted by a data aggregator .","technology_involved":["Elasticsearch"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fe5494d0334024f0ad513d6f478c50bee9d59cf3","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10602.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ebeccad8a1e4","org_name":"Washington State Patrol","org_type":"government","ransomware":null,"records_affected":1171,"reviewed":false,"root_cause":"A hard drive containing personal information was stolen from an agency vehicle.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10602.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10602.pdf"}],"summary":"Washington State Patrol notified affected people that a hard drive containing personal information was stolen from an agency vehicle, with no evidence the data was accessed or used.","supporting_quote":"The personal information was contained on a hard drive stolen from an agency vehicle.","technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0220da046ef1dc5d170e872071253b811db40ef3","impact_type":"unknown","incident_date":"2017-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Customer%20Notification%20STEIN%20MART%20NOV%202018_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed277cd892ae","org_name":"Synchrony Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142122"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97d1db0130692f35eb7583e3899fc5015d08bc56","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20181121_paylocity501_CA%20%28SAMPLE%29_0.pdf"},"notes":null,"org_country":"US","org_id":"88a144ff2c05","org_name":"Paylocity Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142152"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20181121_paylocity501_CA%20%28SAMPLE%29_0.pdf"}],"summary":"Paylocity reported that personal information of some Group 1 Automotive employees was temporarily exposed to an administrator of another Paylocity client.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-27","discovered_date":"2018-08-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98f76f18a0f90f09aa5768b4d8a7aea4a1a23d8c","impact_type":"unknown","incident_date":"2016-11-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"385fbe260f6a","org_name":"Family Tree Relief Nursery","org_type":"unknown","ransomware":null,"records_affected":2084,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Family%20Tree%20Relief%20Nursery-2018-11-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff6395497a8ae1c630409878f377955c25b37d51","impact_type":"unknown","incident_date":"2018-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f168fd63b9b4","org_name":"Cancer Treatment Centers of America at Western Regional Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142129"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9e710d524500a5caf1c0c1426d4dc05e2778fcd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/AtriumHealth.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5b4c0ab32864","org_name":"Atrium Health f/k/a Carolinas HealthCare System","org_type":"unknown","ransomware":null,"records_affected":101966,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/AtriumHealth.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72825b6857954a6c181cb8e2b349b69ccda38074","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Individual%20Templates_0%20-%201_0.pdf"},"notes":null,"org_country":"US","org_id":"8452662b0467","org_name":"Atrium Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142128"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Individual%20Templates_0%20-%201_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Atrium%20Health%20%28formerly%20Carolinas%20HealthCare%20System%29-2018-11-27"}],"summary":"An unauthorized third party accessed AccuDoc databases containing billing information belonging to Atrium Health and its managed locations.","supporting_quote":null,"technology_involved":["AccuDoc databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AccuDoc"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"656e38ea3c21","name":"AccuDoc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-27","discovered_date":"2018-10-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04a11a7cb98a2b0ea02674973242ba1d1b2934ad","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SecurityIncidentWebsiteNotice-October16-2018_0.pdf"},"notes":null,"org_country":"US","org_id":"0af66e77421b","org_name":"Artix Entertainment, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142132"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SecurityIncidentWebsiteNotice-October16-2018_0.pdf"}],"summary":"Artix Entertainment reported a vulnerability in its AdventureQuest, DragonFable, and MechQuest websites that may have allowed access to players’ account names, passwords, email addresses, and IP addresses.","supporting_quote":null,"technology_involved":["AdventureQuest","DragonFable","MechQuest"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c58f15bd0c2d59b08c4caa6c077e4891a6c9dbe7","impact_type":"unknown","incident_date":"2018-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3104b05861e9","org_name":"Prosper Marketplace, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142077"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3118019ad871324dcf1171f9fd9e26796d466b24","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%20A%20Packet_0_0.pdf"},"notes":null,"org_country":"US","org_id":"51e432a67ad4","org_name":"Pharmacy Times Office of Continuing Professional Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A file containing PTCE data was publicly available between May 11, 2018 and July 6, 2018.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142081"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Exhibit%20A%20Packet_0_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10594.pdf"}],"summary":"PTCE reported that a file containing personal information was publicly available and may have been accessed without authorization.","supporting_quote":"On September 17, 2018, based on investigative developments to date, PTCE concluded that a file containing its data had been publicly available between May 11, 2018 and July 6, 2018, and on the latter date, may have been subject to unauthorized access by an unknown party.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d2c6d90f9121294f50f737776680cdd9acfb6bcf","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/OwenJRobertsSchoolDistrict.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c66b902c7140","org_name":"Owen J. Roberts School District","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/OwenJRobertsSchoolDistrict.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-26","discovered_date":"2018-09-04","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ff3854a25d0de7372d5645a3200ed13132d27c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Housing%20Authority%20of%20the%20County%20of%20Alameda%20Notice%20of%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"61b8b4727806","org_name":"Housing Authority of the County of Alameda","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142113"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Housing%20Authority%20of%20the%20County%20of%20Alameda%20Notice%20of%20Breach_0.pdf"}],"summary":"An unauthorized individual accessed personal information through a HACA web service between September 2 and 3, 2018.","supporting_quote":null,"technology_involved":["HACA web service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2018-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7aead8c9637e4b658702607925995173e490d4dc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-11-05","initial_access":"misconfiguration_or_exposure","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f443033be9af","org_name":"Adapt","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unprotected database hosted by Adapt exposed records.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adapt","type":"hibp","url":"https://haveibeenpwned.com/Breach/Adapt"}],"summary":"An unprotected Adapt database exposed records containing personal and employer information.","supporting_quote":"In November 2018, security researcher Bob Diachenko identified an unprotected database hosted by data aggregator \"Adapt\" .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a896af0df53efaffce80dffb09c20829e59001cd","impact_type":"unknown","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_27.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142045"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d803f4d81c6715e0bdfaeef81128ab3c366be0f6","impact_type":"unknown","incident_date":"2018-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"760d9f54b26f","org_name":"British Airways Plc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142070"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#British%20Airways%20Plc-2018-11-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-20","discovered_date":"2018-10-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"204fa89115663f38cd75edc62c945e6e13116940","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice%20_0.pdf"},"notes":null,"org_country":"US","org_id":"0a0bcde49ae5","org_name":"R.R. Bowker LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice%20_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#R.R.%20Bowker%20LLC-2018-11-20"}],"summary":"Code added to R.R. Bowker LLC’s website checkout page may have been capable of copying customer information entered during checkout.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1df453a1b0f2f428c10eb153f1f265043babd51","impact_type":"data_theft","imported_from":null,"incident_date":"2018-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0f093f8f6d58","org_name":"HTH Studios","org_type":"technology_saas","ransomware":null,"records_affected":411755,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HTH Studios","type":"hibp","url":"https://haveibeenpwned.com/Breach/HTHStudios"}],"summary":"HTH Studios experienced a breach of customer data repositories, and 411,755 unique email addresses and other personal data and password hashes later surfaced on a hacking forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed357573057042fc31f97e19163c3edf4229121","impact_type":"data_theft","incident_date":"2018-05-08","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/El%20Centro%20SSN%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"02ca8252f850","org_name":"El Centro Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141928"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/El%20Centro%20SSN%20Notice_0.pdf"}],"summary":"Job applicants' information for El Centro Regional Medical Center was stolen from a Jobscience server by an unknown third party.","supporting_quote":"In early-October, Jobscience notified us that, based on their investigation, electronic information that job applicants had submitted when filling out online job applications and applying for positions at ECRMC, had been stolen from their server by an unknown third party.","technology_involved":["Jobscience"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Jobscience"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"bf741b47b859","name":"Jobscience"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-19","discovered_date":"2018-08-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f4520d92ac9fab9be2d058a8f2f5af2197674f91","impact_type":"unknown","incident_date":"2018-03-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"127d54fe15f0","org_name":"The Hanover INsurance Company and its subsidiary and affiliate insurance companies","org_type":"unknown","ransomware":null,"records_affected":460,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Hanover%20INsurance%20Company%20and%20its%20subsidiary%20and%20affiliate%20insurance%20companies-2018-11-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2018-11-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eca5390874c0f2565751fa8e401da554c5781ac8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_4.pdf"},"notes":null,"org_country":"US","org_id":"66ecd39edd22","org_name":"Francesca’s Services Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141913"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_4.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Francesca%E2%80%99s%20Services%20Corporation-2018-11-19"}],"summary":"Unauthorized code in Annex Cloud code used for logins may have captured personal, account, and payment information entered during Francesca’s checkout.","supporting_quote":"Annex Cloud informed Francesca’s that unauthorized code was detected and has since been removed from the code used by Annex Cloud to enable logins.","technology_involved":["Annex Cloud"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Annex Cloud"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"b13711e9bba4","name":"Annex Cloud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc439a7d360c6a24346a627b4bf380dcd322a1ca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9eee6f23a653","org_name":"Unknown organization","org_type":"unknown","ransomware":null,"records_affected":5788169,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Elasticsearch Instance of Sales Leads on AWS","type":"hibp","url":"https://haveibeenpwned.com/Breach/ElasticsearchSalesLeads"}],"summary":"An unidentified owner’s Elasticsearch instance on AWS exposed sales lead information, including 5.8 million unique email addresses.","supporting_quote":"In October 2018, security researcher Bob Diachenko identified multiple exposed databases with hundreds of millions of records .","technology_involved":["Elasticsearch","AWS"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-17","discovered_date":"2018-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26e138e7933217daacd97a95f4340d15fb136756","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Adult_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"c584faefe1dd","org_name":"LPL Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141893"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Adult_Redacted_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10598.pdf"}],"summary":"An unauthorized person accessed a Capital Forensics user account on a third-party file-sharing system containing LPL client information, including personal information.","supporting_quote":null,"technology_involved":["third-party file-sharing system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Capital Forensics"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"e271aba8a874","name":"Capital Forensics"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1c3c03f0bb403aeae8d614d23f2fdbef04e3acd","impact_type":"data_theft","imported_from":null,"incident_date":"2016-04-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"93532e0e48f8","org_name":"KnownCircle","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KnownCircle","type":"hibp","url":"https://haveibeenpwned.com/Breach/KnownCircle"}],"summary":"An external party obtained data from KnownCircle in approximately April 2016, including personal information and a small number of staff password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2062802ec9e74d8bb82082c42e1ef4d7e74d8c0b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10597.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b408089bb0e","org_name":"Washington State Employees Credit Union","org_type":"unknown","ransomware":null,"records_affected":2560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10597.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2018-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38962e6266c4d731aeb3bc06196498dcff6921bf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1dd5670-a22a-11e8-ae61-0fc7f403e976"},"incident_date":"2018-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"747c2f86fdb2","org_name":"SSM Health","org_type":"healthcare","ransomware":null,"records_affected":301000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ssmhealth.com/newsroom/2018/7/notice-of-medical-information-discovered;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/301k-patients-involved-in-st.-marys-paper-records-data-breach"}],"summary":"Recent healthcare data breaches include a St. Mary's Hospital paper records data breach affecting more than 300,000,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29b91d1a4e1fe921c7ba8d743a97539669410d02","impact_type":"unknown","incident_date":"2017-03-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Memorandum-on-Credential-Theft-Incident-CA_0_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ba53e625104","org_name":"OSIsoft, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141865"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49493d080a6cc8c5408ffe20816be106cc100d77","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/12568%20-%20CA%20notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"188bacab9582","org_name":"Metropolitan Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141884"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/12568%20-%20CA%20notification%20letter_0.pdf"}],"summary":"MetLife inadvertently emailed an attachment containing personal information to a benefits administrator for another group customer, who deleted it.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-15","discovered_date":"2018-09-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3afed165bbf993516b42e5a640a0f4b0848e195","impact_type":"data_theft","incident_date":"2018-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_Notice_W218_v02_0.pdf"},"notes":null,"org_country":"US","org_id":"527fcc8913bd","org_name":"Newegg Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141826"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_Notice_W218_v02_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Newegg%20Inc.-2018-11-15"}],"summary":"Newegg reported that unauthorized code may have changed its website checkout page and collected customer order and payment information.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-15","discovered_date":"2018-10-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9078d84465fe9eb9918cafdfdb694bdca404d35e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_AG_Notification_0%20-%20Version%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"51e4ea4a3323","org_name":"HealthEquity","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_AG_Notification_0%20-%20Version%20A_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#HealthEquity%2C%20Inc.-2018-11-15"}],"summary":"Unauthorized logins to two HealthEquity team members’ email accounts exposed accounts containing documents with personal and financial information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b881ab5db323a03958b42b71b6e20b2c570ce7e","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stein_Mart_Sample_P2_CA_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"78283086499c","org_name":"Stein Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141776"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stein_Mart_Sample_P2_CA_Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Stein%20Mart%2C%20Inc.-2018-11-13"}],"summary":"Unauthorized code in Annex Cloud's login service may have captured customer information entered during checkout on Stein Mart's website.","supporting_quote":"Annex Cloud informed Stein Mart that they had detected and removed unauthorized code that had been added to the code used by Annex Cloud to enable logins.","technology_involved":["Annex Cloud login service","website checkout"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Annex Cloud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"b13711e9bba4","name":"Annex Cloud"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-13","discovered_date":"2018-09-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d659d10a5de7382bd735696493ed542317e578b1","impact_type":"unknown","incident_date":"2018-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c79a798640e5","org_name":"Pharmacy Times Office of Continuing Professional Education (“PTCE”)","org_type":"unknown","ransomware":null,"records_affected":128211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pharmacy%20Times%20Office%20of%20Continuing%20Professional%20Education%20%28%E2%80%9CPTCE%E2%80%9D%29-2018-11-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0121116af6083b6f73524a429571df516cad9229","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-28","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Title_Nine_Sample_CA_Individual_Notice_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"95bcb4360c95","org_name":"Title Nine Sports, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141744"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Title_Nine_Sample_CA_Individual_Notice_Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Title%20Nine%20Sports%2C%20Inc.-2018-11-12"}],"summary":"Unauthorized code in Annex Cloud’s login application may have captured customer information entered during checkout on Title Nine’s website.","supporting_quote":"Annex Cloud recently informed Title Nine that they had detected and removed unauthorized code that had been inserted into Annex Cloud’s systems that operate its login application.","technology_involved":["Annex Cloud","login application","checkout website"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Annex Cloud"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"b13711e9bba4","name":"Annex Cloud"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5cdf46f97a3ba06560ec94d9026f390e2e2d99a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f745b6e0-055d-11ea-889a-bd9e961d3ab1"},"incident_date":"2018-11-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b8c85080a11","org_name":"New Jersey Schools Development Authority","org_type":"government","ransomware":null,"records_affected":230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.northjersey.com/story/news/watchdog/2019/03/11/new-jersey-schools-development-authority-promotes-hr-worker-after-data-breach/3106853002/"}],"summary":"email attachment sent to employees contained everyone's pii","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-12","discovered_date":"2018-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e7f0822a2aa9e1560d92a1c4aa8eb41d87d7d4e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10592.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"6970615c183c","org_name":"Collier Heggerness & Bronk CPA's PS Inc.","org_type":"professional_services","ransomware":null,"records_affected":2194,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10592.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10592.pdf"}],"summary":"An unauthorized third party may have accessed clients' personal information pertaining to the 2015 tax year.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e849e8208027052bfddcae3bccd1fcaa3e3dba1f","impact_type":"data_theft","incident_date":"2018-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_CA_City_of_Bakersfield_Notice_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"c5d6a14c1269","org_name":"City of Bakersfield","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141746"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_CA_City_of_Bakersfield_Notice_Letter_0.pdf"}],"summary":"Unauthorized code was inserted into the City of Bakersfield’s Click2Gov payment system to capture payment card and other information entered from August 11 through October 1, 2018.","supporting_quote":null,"technology_involved":["Click2Gov"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4807d6aee74db3941df674a7426943c2fde52420","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54c0b870-06f2-11ea-8714-b997dc99273b"},"incident_date":"2018-11-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cec2156054e","org_name":"Hy-Vee","org_type":"retail_ecommerce","ransomware":null,"records_affected":5300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://topclassactions.com/lawsuit-settlements/privacy/data-breach/926419-hy-vee-class-action-lawsuit-filed-over-data-breach/,https://www.scmagazine.com/home/security-news/data-breach/hy-vee-details-2019-pos-data-breach-incident/,https://kmbz.radio.com/articles/hy-vee-releases-data-breach-store-locations,https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/,https://whotv.com/2019/08/14/hy-vee-warns-customers-of-data-breach/,https://www.usatoday.com/story/money/2019/08/14/hy-vee-data-breach-possible-customer-payment-system-vulnerability-wahlburger-fuel-restaurants-data/2014621001/,https://www.kcci.com/article/developing-hy-vee-investigating-possible-data-breach/28702131"}],"summary":"Unknown actions lead to PoS malware on PoS systems, stealing CC numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6e883db061972c81bb4a867efc7a0c4d3603297","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e4ceac90-d3d7-11e9-9298-79b47a23a7bd"},"incident_date":"2018-11-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"195f95d61f53","org_name":"Brewhouse and Kitchen","org_type":"other","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.co.uk/article/pub-data-leak-brewhouse-and-kitchen,https://www.databreaches.net/this-uk-pub-chain-left-17000-customer-details-exposed-online/"}],"summary":"spreadsheet of customer details left online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-07","discovered_date":"2018-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"611a2821e3d5490f99e1a43e2c3be771356a73d9","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UTC%20--%20Sample%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"ada7239bd0c0","org_name":"Unified Trust Company, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141606"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142183"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UTC%20--%20Sample%20Letter_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10589.pdf"}],"summary":"Unified Trust confirmed unauthorized access to two employee email accounts in February 2018 that contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4951f17cfd28dadc99eac46a41a11cf0cef62044","impact_type":"data_theft","imported_from":null,"incident_date":"2018-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IT","org_id":"2daed75c2bac","org_name":"Società Italiana degli Autori ed Editori","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Società Italiana degli Autori ed Editori","type":"hibp","url":"https://haveibeenpwned.com/Breach/SIAE"}],"summary":"Società Italiana degli Autori ed Editori was hacked and defaced, and data including registered users’ names, email addresses, and passwords was leaked publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e748f0d12aebc4e1aaa38ada811f78c021ced808","impact_type":"data_theft","imported_from":null,"incident_date":"2018-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b1dac0eab3ec","org_name":"Rbx.Rocks","org_type":"technology_saas","ransomware":null,"records_affected":149958,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Rbx.Rocks","type":"hibp","url":"https://haveibeenpwned.com/Breach/RbxRocks"}],"summary":"Rbx.Rocks suffered a data breach involving names, email addresses, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":["Rbx.Rocks website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-07","discovered_date":"2018-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb159d4e060d1931a7b709a970fce0add2021b07","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DC%20International%20Breach%20Letter%20California_DH%20with%20experian_0.pdf"},"notes":null,"org_country":"US","org_id":"fb955dbfb792","org_name":"DC International","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141582"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DC%20International%20Breach%20Letter%20California_DH%20with%20experian_0.pdf"}],"summary":"Malicious code on Leatherology.com may have affected customers’ personal and credit card data between July 20 and September 9, 2018.","supporting_quote":null,"technology_involved":["Leatherology.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71d4dec05d2dfa8373e1417e7ddb943834eda61b","impact_type":"data_theft","imported_from":null,"incident_date":"2018-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d60eedf4b3ab","org_name":"WP Sandbox","org_type":"technology_saas","ransomware":null,"records_affected":858,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WPSandbox","type":"hibp","url":"https://haveibeenpwned.com/Breach/WPSandbox"}],"summary":"WP Sandbox discovered a phishing site hosted on its service that collected email addresses and passwords from 858 people.","supporting_quote":null,"technology_involved":["WP Sandbox"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-11-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b0613c4a8e7ad17977c9557f10d43b790c3e384","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Breach%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"be7b0f7d92f0","org_name":"Tyler Technologies","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A file containing account usernames and passwords was inadvertently accessible through the tylertech.com website search function.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141469"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Breach%20Notification_2.pdf"}],"summary":"Tyler Technologies reported that a file containing tylertech.com account usernames and passwords was inadvertently accessible through its website search function.","supporting_quote":"We recently learned that a file containing a very limited set of usernames and passwords for tylertech.com accounts was inadvertently accessible via the “search” function on the tylertech.com website.","technology_involved":["tylertech.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2018-11-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"22bd6a98549e4b0835792c852a57a71d589c22d3","impact_type":"unknown","incident_date":"2018-05-27","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10588.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7f0fa97c7225","org_name":"Southwest Washington Regional Surgery Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":1690,"reviewed":false,"root_cause":"An employee email account was compromised by an email phishing attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Southwest%20Washington%20Regional%20Surgery%20Center%2C%20LLC-2018-11-06"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10588.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10588.pdf"}],"summary":"An email phishing attack may have compromised an employee email account and led to unauthorized access to the mailbox.","supporting_quote":"We recently learned that an SWRSC employee email account may have been compromised by an email phishing attack resulting in unauthorized access to the email box between May 27 – August 13, 2018.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-06","discovered_date":"2018-09-19","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7aeeea083577382e52a27a661b34cdad18ca1f8f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20-%20PPI_0.pdf"},"notes":null,"org_country":"US","org_id":"d4f121de80e6","org_name":"Professional Publications, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20-%20PPI_0.pdf"}],"summary":"Professional Publications, Inc. reported that a hacker accessed personal and payment information submitted through its website.","supporting_quote":null,"technology_involved":["PPI website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-06","discovered_date":"2018-09-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94a6b450f6f85d49b6c6d59134d5b8946e783491","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAMPLE%20CONSUMER%20NOTIFICATION%20LETTER%20%28J2419814x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"13b2ed6d6c71","org_name":"El Paso – Los Angeles Limousine Express, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141560"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20CONSUMER%20NOTIFICATION%20LETTER%20%28J2419814x7AD79%29_0.pdf"}],"summary":"El Paso – Los Angeles Limousine Express reported that a coding error may have made payment card and customer information on its online ticket-sales website accessible to unauthorized parties.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-05","discovered_date":"2018-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5451e07f71aa286216c9cdf5778b56f868c291f8","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nordstrom%20-%20Individual%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"30900e1acfe7","org_name":"Nordstrom","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141428"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nordstrom%20-%20Individual%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nordstrom%2C%20Inc.-2018-11-05"}],"summary":"Nordstrom investigated a contract worker’s improper handling of employee data on October 9, 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d97dcf3488baadef3478c83c2bc6d185d6ed898","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_3.pdf"},"notes":null,"org_country":"US","org_id":"9280c08a2c6d","org_name":"Transamerica","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141396"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_3.pdf"}],"summary":"A Transamerica employee inadvertently emailed an attachment containing personal and retirement plan information to clients not associated with the recipient’s plan.","supporting_quote":"On August 22, 2018, one of our employees inadvertently sent an email with an attachment containing your some of your personal information to Transamerica clients not associated with your retirement plan.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7d02510ce66503bbdf86329b1f1c2743856f5e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Res%20102923%20PIB%20MAIN%20v3_1.pdf"},"notes":null,"org_country":"US","org_id":"9cafa450d027","org_name":"HSBC Bank USA, National Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Res%20102923%20PIB%20MAIN%20v3_1.pdf"}],"summary":"HSBC reported that unauthorized users accessed online accounts and may have accessed customers’ personal and financial information.","supporting_quote":null,"technology_involved":["HSBC Personal Internet Banking"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-02","discovered_date":"2018-08-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a356358a2ff7de53f0d246dabe58b3a7ef36b256","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-23","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Five%20Guys%20-%20CA%20Employee%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"c9cd5e8fc1cf","org_name":"Five Guys Holdings, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee may have fallen victim to a phishing email, resulting in unauthorized access to the employee’s email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141414"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142256"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Five%20Guys%20-%20CA%20Employee%20Notice_0.pdf"}],"summary":"Five Guys reported unauthorized access to an employee’s email account following a phishing email, and the inbox contained personal and 401K contribution information.","supporting_quote":"On August 6, 2018, we learned that an employee may have fallen victim to a phishing email incident that resulted in unauthorized access to the employee’s email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ff41375c8d71bfb2b21bc8076ef3ebded13aca4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc630a80-d57a-11e9-8597-ff36b2265d64"},"incident_date":"2018-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/atlanta/news/2019/09/05/former-georgia-verizon-employees-indicted-fraud.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ajc.com/news/crime--law/verizon-employees-indicted-accused-opening-bogus-accounts/SbkSrCqiybqphvdoGtUNJI/"}],"summary":"Nearly a half-dozen former employees at Verizon stores in Buckhead, Newnan and Smyrna have been indicted for allegedly opening accounts using stolen identity information and then fraudulently charging tens of thousands of dollars’ worth of merchandise.      The scheme involved a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3244e3a92e6cd6e294cc97c51683fc5e8f159bf8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"150716a0-1775-11ea-bf73-2d1a23feec7f"},"incident_date":"2018-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"408208e01cac","org_name":"United Consumers Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox4kc.com/2018/11/21/after-skimmer-found-on-independence-atm-experts-offer-tips-for-keeping-card-info-safe/"}],"summary":"skimmer found on ATM after infomration stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-11-01","discovered_date":"2018-10-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d49b37a9576744f5d61c1e6e4d115b16d211d0ff","impact_type":"data_theft","incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OXO%20International%20Ad%20r3prf_0.pdf"},"notes":null,"org_country":"US","org_id":"82858e4d9ea1","org_name":"OXO","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OXO%20International%20Ad%20r3prf_0.pdf"}],"summary":"Unauthorized code was inserted on OXO’s e-commerce website and collected information entered on customer order pages.","supporting_quote":null,"technology_involved":["OXO e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e30a18c6a4195d352da63915c18f22cb436cd26","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0c3a054d3f25","org_name":"JoomlArt","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Customer records were inadvertently exposed in a Jira ticket.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JoomlArt","type":"hibp","url":"https://haveibeenpwned.com/Breach/JoomlArt"}],"summary":"JoomlArt inadvertently exposed customer records, including usernames, email addresses, purchases, and hashed passwords, in a Jira ticket.","supporting_quote":"In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket.","technology_involved":["Jira"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ede1a17541dcdd6fec80a3e3d8337d0e44ebaaad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c1ec370-33c0-11e9-8d6c-aba1b2985f04"},"incident_date":"2018-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e9f335c7c68","org_name":"google","org_type":"technology_saas","ransomware":null,"records_affected":52000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbsnews.com/news/google-plus-shutdown-date-moves-up-after-another-security-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://iapp.org/news/a/software-update-results-in-google-data-breach-affecting-52m-users/"}],"summary":"The latest breach allowed developers to see profile information on 52.5 million users, even if set to private, using one of Google's APIs for six days in November.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62bd9394ff22a9489ca719226f4ddc49e2818345","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bbdfe280-20db-11ea-8baf-97ebc0c111f5"},"incident_date":"2018-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44aa5cc4ecdc","org_name":"Epoch Trading Post","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.app.com/story/money/business/consumer/press-on-your-side/2019/01/22/asbury-park-small-business-nearly-killed-hacker-afterrain-epoch-trading-post/2265025002/"}],"summary":"contractor employed to update website, reroutes DNS and hijacks all associated accounts after being fired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff4c6252307f44e8a04be107f6e3faaf6e46b39d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82f7c660-027b-11e9-aee0-f7420d4f3238"},"incident_date":"2018-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc52b91a2767","org_name":"Chevron","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ktvb.com/article/news/crime/thousands-of-dollars-stolen-with-skimmer-devices-found-at-a-meridian-gas-station/277-614272697"}],"summary":"Police on Tuesday uncovered and removed at least three skimmer devices used to steal people's credit card information at a Meridian gas station.  The crooks stole thousands from unsuspecting victims who visited the Jackson's Chevron on Eagle Road and Goldstone Drive.  Meridian Po","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c47f6a09b2f4eb7d39b39913cc840d9836e6485a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71fee0e0-2296-11eb-940b-ff2256f17cee"},"incident_date":"2018-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"796a219adf9b","org_name":"Burlington Police Department, North Carolina","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://abc11.com/hackers-target-burlington-police-chiefs-email-to-steal-information/4648753/"}],"summary":"Email account of police chief got compromised and was used to send out phishing emails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a0f000d8554e2e5d6843391ee59a455366720ab","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b9a65ae0-ce55-11e9-a07e-2170fe2d70c6"},"incident_date":"2018-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5be0b5ef898","org_name":"ally bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Ally%20CA%20Customer%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142630"}],"summary":"partner transimitted victim customer data to an unauthorized financial institution inadvertently","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2018-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03d047ea48564fe8dea766d296168b079e30182e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04ebc920-f6bb-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2018-10-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d5a5197ff4b","org_name":"Xybion","org_type":"technology_saas","ransomware":null,"records_affected":7001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Xybion software developer accidentally published private repo with valid credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-30","discovered_date":"2018-08-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d0d655bda035539079d7f176d942b64e597360a1","impact_type":"unknown","incident_date":"2016-05-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7c02c9fb44aa","org_name":"Tillamook Chiropractic Clinic","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tillamook%20Chiropractic%20Clinic-2018-10-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e1b571c35c77a10899dc39994e12ad848adeb44","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/W026_v02.pdf_CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"fc14e7e534d9","org_name":"NorthBay Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/W026_v02.pdf_CA%20Notice_0.pdf"}],"summary":"An unauthorized individual accessed NorthBay applicant information held in Jobscience’s online employment application management system.","supporting_quote":null,"technology_involved":["Jobscience","online employment application management system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Jobscience, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"bf741b47b859","name":"Jobscience"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":"Fin7","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-30","discovered_date":"2018-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bda46359ae13c26b0eb48d21d0d3c65e09d24352","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-01","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10601.pdf"},"notes":null,"org_country":"US","org_id":"988c0e30c7a8","org_name":"Burgerville LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Burgerville%20LLC-2018-10-30"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10601.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10601.pdf"}],"summary":"Burgerville reported that malware associated with a breach collected payment data, which may have compromised customers' credit and debit card information.","supporting_quote":"The group of hackers had placed malware on Burgervllle's network and were continuing to collect payment data.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware","derived":{"actor_id":"fin7"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7c3d21486b3b2f18c72a3564b8fd3b305e6cffe","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e817080ee18c","org_name":"Mac Forums","org_type":"other","ransomware":null,"records_affected":326714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mac Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/MacForums"}],"summary":"Mac Forums suffered a data breach that exposed usernames, email and IP addresses, dates of birth, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6f3a360efd1ec07aa0c34de0a9cd9815c837aa1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9cc85d40-22d4-11eb-b221-a300329fb9cf"},"incident_date":"2018-10-28","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"479eb9efa207","org_name":"QinetiQ","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nation.lk/online/defence-worker-breached-official-secrets-act-and-put-uk-at-risk-by-leaking-top-secret-details-17911.html"}],"summary":"In revenge defnse employee sends classified information to unauthorized parties by email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72696f5fa0372a3213d5bcc2c075e2aa2ed4b75a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f1705f0-0c74-11ea-bb2f-edf349509116"},"incident_date":"2018-10-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42fc41bee6bb","org_name":"Oregon Construction Contractors Board","org_type":"government","ransomware":null,"records_affected":466,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/oregon-construction-contractors-board-reports-data-breach/,https://www.databreaches.net/oregon-construction-contractors-board-reports-data-breach/,https://www.oregon.gov/CCB/Documents/pdf/JUSTICE-9596167-v1-CCB_-_Data_Disclosure_News_Release.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfa8a7c10bd0b1699e8d6c5142a06c0dec84bd9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9d043c10-2a9b-11eb-9486-e305299943be"},"incident_date":"2018-10-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c2c58ebdc0c8","org_name":"York City","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-york-council-alerted-that-peoples-personal-info-from-council-phone-app-was-accessible-to-others/"}],"summary":"Researcher gained access to the personal data of City of York environmental app when data was accidentally loaded to all users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-26","discovered_date":"2018-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21b23562edd9f03eb66f29c93e8de675c1074300","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_1.pdf"},"notes":null,"org_country":"US","org_id":"1427b24d158a","org_name":"TengoInternet","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141167"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_1.pdf"}],"summary":"TengoInternet reported that an unauthorized individual accessed its consumer database of account usernames and passwords by or before April 2018.","supporting_quote":null,"technology_involved":["consumer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-10-26","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a1ad1ab86b34b0d58609f1f4f9cca32668e8b9d","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"a9a1a41ac6f2","org_name":"Raley's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Notification%20Letter_0.pdf"}],"summary":"A stolen pharmacy laptop may have contained files with patients’ personal and health information.","supporting_quote":"On September 24, 2018, a pharmacy laptop was stolen, which may have contained electronic files with some of your personal information.","technology_involved":["pharmacy laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2847debe779b36b6830924e02e8567aec6657905","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/bankerslife.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5f69aeff7e9","org_name":"Banker's Life and Casualty Company","org_type":"unknown","ransomware":null,"records_affected":33672,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/bankerslife.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-25","discovered_date":"2018-09-24","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0fc059504166b8216ac61f8e7910570d4ac746b","impact_type":"data_theft","imported_from":null,"incident_date":"2018-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Travis%20Mathew.CreditCard.Notification.Letter.CA__0.pdf"},"notes":null,"org_country":"US","org_id":"9c64e413538a","org_name":"TravisMathew, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141159"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Travis%20Mathew.CreditCard.Notification.Letter.CA__0.pdf"}],"summary":"An unauthorized user changed TravisMathew’s website checkout page to collect customer order and payment card information.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-25","discovered_date":"2018-09-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0290dd6aa0d3cbd821b32ccbf6b56f34b4506f11","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"dae54c6db9e7","org_name":"Teeter","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_1.pdf"}],"summary":"Teeter discovered malicious code on its e-commerce platform, which may have exposed customers’ payment card information.","supporting_quote":null,"technology_involved":["e-commerce web platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13c74a6f88e35e3c162e189fa278a359d095b2e7","impact_type":"unknown","incident_date":"2018-09-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Net32%20Sample%20Notice%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"08d87d3dcf76","org_name":"Net32, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141126"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Net32%20Sample%20Notice%20Letter_0.PDF"}],"summary":"Net32 notified recipients of a data security incident that occurred on or around September 22, 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-25","discovered_date":"2018-10-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2bd34a316cd39114532dcd82150dfb572d6e3347","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"bf1dedd49b67","org_name":"GS1 US, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141127"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GS1%20US%2C%20Inc.-2018-10-25"}],"summary":"GS1 US reported that an unauthorized third party may have accessed or acquired personal and payment card information associated with purchases from its online store.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5c1c19bb34618ce566f29598f73a0e3c28315033","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10586.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ab7499088182","org_name":"Caroline Kline Galland Home","org_type":"unknown","ransomware":null,"records_affected":203,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10586.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ea409bf069f54bec84ba2e8cd2f2ed319e9bd1f","impact_type":"unknown","incident_date":"2018-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CNO%20CA1%20Notice%20%282%29%20%282%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"39ef972146cd","org_name":"Bankers Life (BL)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141129"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f49f63ec964066f3550e6bd93c549dc4d396e436","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10585.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"138aba2a1667","org_name":"Bankers Life","org_type":"unknown","ransomware":null,"records_affected":226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bankers%20Life-2018-10-25"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10585.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-24","discovered_date":"2018-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4647563c801ce58ce0965c0d30dba3518b2dd1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ShopStyle%20-%20CA%20Exhibits%20Packet%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"b1943af1287c","org_name":"ShopStyle Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141108"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ShopStyle%20-%20CA%20Exhibits%20Packet%20FINAL_0.pdf"}],"summary":"ShopStyle Inc. reported that an unauthorized third party accessed account credentials and certain user information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ec0fe5170869ae3be57b84c46f826236fb2910e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2008-10-24","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"9f9831997c1e","org_name":"Baby Names","org_type":"other","ransomware":null,"records_affected":846742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Baby Names","type":"hibp","url":"https://haveibeenpwned.com/Breach/BabyNames"}],"summary":"A breach of Baby Names exposed email addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-22","discovered_date":"2018-09-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"54403fd5b39a03ea94b3b0957916b37157ba43b1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10583.pdf"},"notes":null,"org_country":"US","org_id":"4da894c60958","org_name":"Challenger Sports Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":516,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10583.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10583.pdf"}],"summary":"An unauthorized person accessed Challenger Sports' system and may have accessed purchase information from ChallengerTeamwear.com, including payment card details.","supporting_quote":null,"technology_involved":["ChallengerTeamwear.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"542da12a1187bd0e5576b4cea182419c43b753c2","impact_type":"data_theft","incident_date":"2018-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"439a718f4a92","org_name":"Wife Lovers","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wife Lovers","type":"hibp","url":"https://haveibeenpwned.com/Breach/WifeLovers"}],"summary":"Wife Lovers acknowledged a breach affecting names, usernames, email and IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de9367a7e5bb6311fab2d6357c2861794c785274","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2aec3910-e9d9-11e9-bcf0-459173902f03"},"incident_date":"2018-10-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"f1ee9586aa8b","org_name":"trade.io","org_type":"financial","ransomware":null,"records_affected":50000001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/trade-io-hacked-loses-50-million-tokens-worth-7-5-million-523360.shtml,https://coingape.com/trade-io-suffers-rare-cold-wallet-hack/"}],"summary":"cryptoexchange hacked.  They don't know how.  Lost 7.8m of an uncommon cryptocurrency, but hope to fork currency to mitigate loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bdcabd6e671554aab27344152e5268797cd704f9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/RansomHospital.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"487343d569a6","org_name":"Ransom Memorial Hospital","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/RansomHospital.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-18","discovered_date":"2018-06-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"3facb64a0f318c200fc1038184ef94d8ead6663c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/RenPSG-%20Notice%20of%20Data%20Event-CA%20Exhibit%201_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"922b27690e9b","org_name":"Renaissance Philanthropic Solutions Group","org_type":"professional_services","ransomware":null,"records_affected":33663,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Renaissance%20Philanthropic%20Solutions%20Group%20%28%E2%80%9CRenPSG%E2%80%9D%29-2018-10-18"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RenPSG-%20Notice%20of%20Data%20Event-CA%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10582.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RenPSG-%20Notice%20of%20Data%20Event-CA%20Exhibit%201_0.pdf"}],"summary":"Unauthorized individuals logged into RenPSG employee email accounts, where personal information may have been viewed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4929eabdc4cbd63c46762af311b9b8abec3d2f7a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b1e8f5d47eb1","org_name":"Buehler's Fresh Food","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Buehler%27s%20Fresh%20Food-2018-10-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"986a6d26d8176e0d59be809ce4f360c0609deead","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Indio_CA%20Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"84edfc31cb84","org_name":"City of Indio","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Indio_CA%20Notification%20Letter_1.pdf"}],"summary":"Unauthorized access to the City of Indio’s outside vendor Click2Gov may have affected payment-card information submitted for water-bill payments.","supporting_quote":null,"technology_involved":["Click2Gov"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-12","discovered_date":"2018-09-17","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed0f5e30818f64827f4145d3ae8d43f832a78bd","impact_type":"data_theft","incident_date":"2017-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20State%20University%20East%20Bay%20CA%20Notification%20Letter_0_1.pdf"},"notes":null,"org_country":"US","org_id":"416dc1b2177d","org_name":"California State University East Bay","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140680"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20State%20University%20East%20Bay%20CA%20Notification%20Letter_0_1.pdf"}],"summary":"California State University East Bay reported that an unauthorized person accessed a campus web application and copied files containing personal information.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-10-11","discovered_date":"2018-06-21","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65fd852788a7e0542f639bc9ef68514338e1d7d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-18","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BioMarin%20-%20California%20Notification%20Letter%20-%20sample_0.pdf"},"notes":null,"org_country":"US","org_id":"2983bf5a39b0","org_name":"BioMarin Pharmaceutical Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A successful phishing attack enabled the attacker to obtain a temporary employee’s user ID and password and access two email mailboxes.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BioMarin%20-%20California%20Notification%20Letter%20-%20sample_0.pdf"}],"summary":"A phishing attack gave an attacker a temporary employee’s credentials and access to two BioMarin email mailboxes that may have contained personal and health insurance information.","supporting_quote":"On June 21, 2018, we discovered that someone (the “attacker”) had accessed two BioMarin email mailboxes, beginning on June 18, 2018, as a result of a successful phishing attack by which the attacker acquired a te mporary employee’s user ID and password.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31b38389af57d7763edb187f427ac8249ada4ff2","impact_type":"data_theft","imported_from":null,"incident_date":"2018-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Shein%20PressReleaseUS92118v1_0.pdf"},"notes":null,"org_country":"US","org_id":"fa4a9b92fab0","org_name":"SHEIN","org_type":"retail_ecommerce","ransomware":null,"records_affected":39086762,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SHEIN","type":"hibp","url":"https://haveibeenpwned.com/Breach/SHEIN"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140625"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Shein-2018-10-11"}],"summary":"SHEIN discovered a breach involving email addresses and MD5 password hashes in June 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68edc60251627728c7e7b54c3964ed657359089c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20V889_v03_0.pdf"},"notes":null,"org_country":"US","org_id":"3f8ac91adc23","org_name":"Envision Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140632"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20V889_v03_0.pdf"}],"summary":"Envision Healthcare reported that an unauthorized third party may have accessed email accounts containing personal and financial information in July 2018.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-10","discovered_date":"2018-09-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"08cb789750cd41a0c1054e33f7f344fddacec1af","impact_type":"unknown","incident_date":"2018-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2914beb1bb38","org_name":"Cigna","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cigna-2018-10-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f389a21b4619c28ebaf158828582a5005fe778ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RRTS%20-%20July%202018%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"cc53bc037819","org_name":"Roadrunner Transportation Systems","org_type":"transportation_logistics","ransomware":null,"records_affected":463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140607"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RRTS%20-%20July%202018%20-%20Supplemental%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Roadrunner Transportation Systems reported that 463 additional California residents were potentially affected by an incident involving personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"75d7a2d6ffff55082b2dbe604e70bc3a40bd4687","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/NorthAmericanRiskServicesInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3c60a5b8eecb","org_name":"North American Risk Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":1050,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/NorthAmericanRiskServicesInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-10-08","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cc65c284f0de080ea8a9fbac13da664233aee09","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DecisionHR%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"68c17f36ab41","org_name":"DecisionHR Holdings","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140539"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DecisionHR%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized third party accessed the corporate email boxes of three DecisionHR employees, which contained personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37e4a8277ab6e24902eb104835099b9d0eadced7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cbdb8fc0-070f-11eb-ab9e-fb89bdbaf0c7"},"incident_date":"2018-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0352f69a7bb","org_name":"The Little Clinic","org_type":"healthcare","ransomware":null,"records_affected":10974,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tn-the-little-clinic-notifies-more-than-10000-patients-after-discovering-glitch-in-online-appointment-system/"}],"summary":"Technical issue allows Little Clinic patients to be accessible by  unauthorized third party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-10-05","discovered_date":"2018-08-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d21430a3a6f1665622bc80ad43f0b727db2cf41e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10580.pdf"},"notes":null,"org_country":"US","org_id":"b1aaa7e4ea0a","org_name":"Rebound Orthopedics & Neurosurgery","org_type":"healthcare","ransomware":null,"records_affected":1607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10580.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10580.pdf"}],"summary":"An unknown individual accessed an employee’s email account at Rebound, and an investigation found that personal, financial, and health information may have been disclosed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-10-05","discovered_date":"2018-08-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce2164d983b7ef0e14e639e1d86cc7c4f95e977a","impact_type":"unknown","incident_date":"2018-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4cbece7ccfed","org_name":"Northwest Surgical Specialists, P.C.","org_type":"unknown","ransomware":null,"records_affected":2245,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Northwest%20Surgical%20Specialists%2C%20P.C.%20d/b/a%20Rebound%20Orthopedics%20%26%20Neurosurgery-2018-10-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566","T1657"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-10-05","discovered_date":"2018-08-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e213f55d5fb9a649b0ac0b0d19b69c4ea099d2a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-18","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GCHP%20PHI%20Breach%20Notification%20Letter%2010.05.2018_0.pdf"},"notes":null,"org_country":"US","org_id":"3f366d81c968","org_name":"Gold Coast Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140512"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GCHP%20PHI%20Breach%20Notification%20Letter%2010.05.2018_0.pdf"}],"summary":"Gold Coast Health Plan reported that a phishing attack accessed an employee email account containing members’ health information.","supporting_quote":"GCHP recently discovered that it suffered a phishing email attack that had compromised an employee email account and resulted in potential disclosure to an unauthorized third party of your health information.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7c03ef2e61551c251c56e7900f54ae3f25f55fd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-07-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0952d36de7a5","org_name":"Apollo","org_type":"technology_saas","ransomware":null,"records_affected":125929660,"reviewed":false,"root_cause":"Apollo left a database publicly exposed without a password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Apollo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Apollo"}],"summary":"Apollo left a database containing personal and professional information publicly exposed without a password.","supporting_quote":"In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99491141213cfb7ef0702b7a74d7c62208d29a76","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LTR%20to%20Parents%20re%20Data%20Security%20Breach%20100318%20ANW_0.pdf"},"notes":null,"org_country":"US","org_id":"356ac0d9ad00","org_name":"Kennedy High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140393"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LTR%20to%20Parents%20re%20Data%20Security%20Breach%20100318%20ANW_0.pdf"}],"summary":"Kennedy High School inadvertently emailed some parents student names, IDs, email addresses, and telephone numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"513648e5c9ae0ec569ef15df4d651524f0672ade","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10650.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0110d07b9430","org_name":"Zenith American Solutions","org_type":"unknown","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10650.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-10-02","discovered_date":"2018-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5700079942ea347297204b9fb7184abbdf121640","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/APE%20-%20Notice%20Letter%20CA%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"650ce2817358","org_name":"Another Planet Entertainment","org_type":"other","ransomware":null,"records_affected":2357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140302"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/APE%20-%20Notice%20Letter%20CA%20AG_0.pdf"}],"summary":"Another Planet Entertainment reported that an unauthorized individual may have accessed personal information, including names, Social Security numbers, and limited medical information.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d71cd023d60c786813eb3aa552dc894b4b8d4be6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70df8340-3521-11e9-8dbb-275658e06f31"},"incident_date":"2018-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"552fb79f12c9","org_name":"sky brasil","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/sky-brasil-exposes-data-of-32-million-subscribers/"}],"summary":"sky brazil left elastica server open with no password for weeks if not months and exposed the personal data including name, address, phone number and date of birth of 32 million users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afb1149b151f1d37d1bf8bc5681a2eb2175c4e1f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-08-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rite%20Aid-Individual%20Notification%2010-18_0.pdf"},"notes":null,"org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Rite Aid programming update inadvertently included Rite Aid associates in the standard eligibility file sent to Empower.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140275"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rite%20Aid-Individual%20Notification%2010-18_0.pdf"}],"summary":"A Rite Aid programming update caused associates’ personal information to be included in an eligibility file sent to Empower.","supporting_quote":"Due to a programming update made by Rite Aid on August 30, 2018, Rite Aid associates were inadvertently included in the standard eligibility file that goes to Empower.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"Empower"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"da300047af08","name":"Empower"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"895ef02c4667d7bba96fb7b6915fb997e9d22aa7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ecc5ea0-058c-11ea-a6b7-b9a04765ea4f"},"incident_date":"2018-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0b3671378d5","org_name":"Indiana National Guard","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox59.com/2018/10/18/ransomware-attack-hits-server-with-personal-information-on-indiana-national-guard-personnel/,https://www.wishtv.com/news/indiana-news/indiana-national-guard-reports-ransomware-attack-to-server/"}],"summary":"The Indiana National Guard revealed Thursday that a state, nonmilitary server with identifying information of its personnel was the subject of a ransomware attack. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2018-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ba01711adc973abbbad91a26ff13b55273ba2fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bdb1ae20-3cdd-11ec-b63a-33c287a8ec4a"},"incident_date":"2018-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"8d5001b68b36","org_name":"Austral","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2018-11-13/iranian-hackers-suspected-in-austal-cyber-breach/10489310?section=business"}],"summary":"Austral, an Australian ship building company was breached and their data was put up to sale on a crime forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-09-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc2883fc37a3ae41e091d674af3b48f41e2ee9fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f79a5290-2da2-11eb-8132-47626699b560"},"incident_date":"2018-09-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0bddd424d3d2","org_name":"Girl Scouts of Orange County","org_type":"nonprofit","ransomware":null,"records_affected":28001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-girl-scouts-data-breach-20181025-story.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-141136"}],"summary":"Girl Scouts of Orange County experienced a breach when someone gained access to one of their email accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","credentials","medical","financial"],"disclosed_date":"2018-09-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c6ec4cf093e368c29c0ba813d18c2d3a684930f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_25.pdf"},"notes":null,"org_country":"US","org_id":"d7aeb1704fec","org_name":"Quest Nutrition","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An outside individual solicited employee email-system login information by email and used the credentials to access an employee email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140248"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_25.pdf"}],"summary":"An outside individual used employee credentials solicited by email to access a Quest Nutrition employee email account containing personal information.","supporting_quote":"The individual appears to have been able to use these credentials to gain unauthorized access to an employee email account, which contained certain personal information about a limited number of our employees, influencers/partners, and other individuals.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","other"],"disclosed_date":"2018-09-28","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9edfcd841d62c09adbcab8477fa4bfa0cf5fa422","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CALIFORNIA%20HIPPA%20%26%20CM%20ONLY_0.pdf"},"notes":null,"org_country":"US","org_id":"38cb90a009ec","org_name":"Aflac","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140247"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CALIFORNIA%20HIPPA%20%26%20CM%20ONLY_0.pdf"}],"summary":"Aflac reported possible unauthorized access to sales agents’ Microsoft Office 365 email accounts, which may have contained personal and health information.","supporting_quote":null,"technology_involved":["Microsoft Office 365","email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Microsoft"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2204c6a98e58","name":"Microsoft"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-26","discovered_date":"2018-08-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1a9b69e276099bce85d23fe8095c47248b451804","impact_type":"unknown","incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"338138082d2d","org_name":"FirstGroup of America, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FirstGroup%20of%20America%2C%20Inc.-2018-09-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-09-26","discovered_date":"2018-09-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ab815b220f88ad583164e0b30d7e39812414529","impact_type":"data_theft","incident_date":"2018-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20Notice%20Letter%20to%20Consumers_0.PDF"},"notes":null,"org_country":"US","org_id":"c69135783578","org_name":"Chegg, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20Notice%20Letter%20to%20Consumers_0.PDF"}],"summary":"An unauthorized party accessed a Chegg database containing user data, and some account information may have been obtained.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-09-25","discovered_date":"2018-09-05","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caa313ccb47f4194b33e024e52509c76bde18c3a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20breach%20-%20CA%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"15c521df3b1f","org_name":"Travis Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20breach%20-%20CA%20AG_0.pdf"}],"summary":"Travis Credit Union reported that skimming devices placed on a branch ATM may have acquired members’ debit card information.","supporting_quote":"You may have received a telephone call or letter on September 5, 2018 explaining that we discovered a skimming device had been placed on our drive-up ATM at our Dixon branch located at 1470 Ary Lane, Dixon, CA 95620 .","technology_involved":["ATM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2018-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5832881e708ca8257103624e906ab407e990b55","impact_type":"data_theft","imported_from":null,"incident_date":"2016-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"99665010cdfc","org_name":"Real Estate Mogul","org_type":"other","ransomware":null,"records_affected":307768,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Real Estate Mogul","type":"hibp","url":"https://haveibeenpwned.com/Breach/RealEstateMogul"}],"summary":"An unauthorized party downloaded data from a compromised Real Estate Mogul MongoDB instance, including sellers’ names, phone numbers, email addresses, and real estate listings.","supporting_quote":null,"technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0364d2bee0a2d534c221028458066f5eff2a72a6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bfd78b10-034d-11e9-aee0-f7420d4f3238"},"incident_date":"2018-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"955bddab9d07","org_name":"Raley’s Supermarkets","org_type":"retail_ecommerce","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/stolen-raleys-pharmacy-laptop-may-have-contained-phi-of-10000-patients/"}],"summary":"Stolen Raley’s Pharmacy Laptop May Have Contained PHI of 10,000 Patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2018-09-22","discovered_date":"2018-08-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fac558b5643e4f555cd83afb94e152fc819bd4ad","impact_type":"data_theft","incident_date":"2018-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ID%20Experts%20Breach%20Notification%20Letter%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"26c426b25925","org_name":"Mark’s International Wines","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140066"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ID%20Experts%20Breach%20Notification%20Letter%20FINAL_0.pdf"}],"summary":"Malware on The Wine House website collected information entered by visitors, including login, address, and credit card billing information.","supporting_quote":null,"technology_involved":["website","employee account"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee399ad6e993852b8a01cf08f3bd04e0d271e534","impact_type":"unknown","incident_date":"2018-07-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California_4%20%28revised%29_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b9e1181a69e8","org_name":"YRC Worldwide Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140029"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-21","discovered_date":"2018-08-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b79abdbb216c5be0807e63bddc728959e82a0a38","impact_type":"unknown","incident_date":"2018-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"036a5ab744d2","org_name":"Smith Freed & Eberhard, P.C.","org_type":"unknown","ransomware":null,"records_affected":558,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Smith%20Freed%20%26%20Eberhard%2C%20P.C.-2018-09-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"be603fe96f07e0d9a2fc9c9fe29e82f88894c22d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/PerformanceFoodGroupInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"03a28ed025db","org_name":"Performance Food Group, Inc. (PFG)","org_type":"unknown","ransomware":null,"records_affected":548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/PerformanceFoodGroupInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-09-20","discovered_date":"2018-09-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91d16d74ce028e7c6f9e38bda2509fb158409957","impact_type":"disruption_or_ransomware","incident_date":"2018-08-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blood%20Systems%2C%20Inc.%20Data%20Breach%20Donor%20Notice%20Letter_%20Mailed_0.pdf"},"notes":null,"org_country":"US","org_id":"1cb6b9abf0f4","org_name":"Blood Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140011"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blood%20Systems%2C%20Inc.%20Data%20Breach%20Donor%20Notice%20Letter_%20Mailed_0.pdf"}],"summary":"Blood Systems reported unauthorized access to donor profiles in its eDonor portal, with loyalty points fraudulently used to order or attempt to order gift cards.","supporting_quote":null,"technology_involved":["eDonor donor portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-09-19","discovered_date":"2018-03-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d934fc3ade31d11a11d23ab097ce8c635f4bf825","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TAG%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"a0927bc0e48d","org_name":"The Affiliated Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email incident in November 2017 resulted in unauthorized access to a TAG employee email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139990"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TAG%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"}],"summary":"The Affiliated Group reported that a phishing incident led to unauthorized access to an employee email account, where personal, health, and financial information may have been accessible.","supporting_quote":"On or about March 28, 2018, we at The Affiliated Group (“TAG”), confirmed that an earlier phishing email incident in November 2017 involving TAG resulted in unauthorized access to one TAG employee email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-09-19","discovered_date":"2018-08-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff1ed3a8c4cc45fd5b28e709abba4df38e2f681f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-22","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tech%20Rabbit%20LLC%20Sample%20Notice%20of%20Security%20Incident_1.pdf"},"notes":null,"org_country":"US","org_id":"b225f22930c7","org_name":"Tech Rabbit LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tech%20Rabbit%20LLC%20Sample%20Notice%20of%20Security%20Incident_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tech%20Rabbit%20LLC-2018-09-19"}],"summary":"Tech Rabbit confirmed that an unauthorized individual accessed its online product order system and may have viewed or removed customer payment and personal information.","supporting_quote":"According to the forensics investigation, the unauthorized access was made possible thro ugh the use of malicious software in a variety of attacks that took place between February 22, 2017 , and May 22, 2018.","technology_involved":["online product order system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a17c448e7ef3fcb6a1bd729013916da96dbdb5df","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ELS%20Language%20Services%2C%20Inc._0.PDF"},"notes":null,"org_country":"US","org_id":"641115194ce5","org_name":"ELS Language Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee suspected of theft had access to customer records while processing credit card information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139938"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ELS%20Language%20Services%2C%20Inc._0.PDF"}],"summary":"ELS Language Services reported that a former employee was under investigation for suspected theft of credit card information and other personal data from customer records.","supporting_quote":"We recently learned that a former employee of ELS Santa Monica is currently under FBI investigation for suspected theft of certain credit card information and other personal data from our customer records.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d4a1b02e2c393bb47d2d1ef2dd3ce3640761c78","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d7cd7089329d","org_name":"Russian America","org_type":"unknown","ransomware":null,"records_affected":182717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Russian America","type":"hibp","url":"https://haveibeenpwned.com/Breach/RussianAmerica"}],"summary":"Russian America’s website suffered a breach that exposed names, email addresses, phone numbers, and passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"758ea920b71ab12c37c7ff6fc5bba87ec9b07ea7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ffd14c85281d","org_name":"Kayo.moe","org_type":"technology_saas","ransomware":null,"records_affected":41826763,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kayo.moe Credential Stuffing List","type":"hibp","url":"https://haveibeenpwned.com/Breach/KayoMoe"}],"summary":"A collection of email address and plain-text password pairs was uploaded to the kayo.moe file-sharing service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-09-12","discovered_date":"2018-06-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5e2e76a7dab0738ba3d37878c3b57fef8a39ec22","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10579.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e1fe6c44772c","org_name":"Skagit Bancorp Inc.","org_type":"financial","ransomware":null,"records_affected":519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10579.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10579.pdf"}],"summary":"An unauthorized individual accessed a Skagit Bank employee’s email account, which may have contained customers’ personal, financial, and login information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-09-11","discovered_date":"2018-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b46b895d85ff7f29104d82459ade5667e30a4c83","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10649.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"963685090e9e","org_name":"Peaceful Valley Farm Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":20084,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10649.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Peaceful%20Valley%20Farm%20Supply%2C%20Inc.-2018-09-12"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10649.pdf"}],"summary":"Peaceful Valley Farm Supply reported unauthorized access to customer information associated with website orders, potentially including names, addresses, and payment card numbers.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0268141100b7010ff0428f1a48d3e059e185706","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"8c589a08153c","org_name":"Peaceful Valley Farm & Garden Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139750"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_2.pdf"}],"summary":"An unknown third party accessed personal information belonging to customers who placed orders on Peaceful Valley Farm Supply’s website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4978688a656b39989351786529cd1a2d5feeb296","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f3703f80-07bb-11ea-a8b1-672cf95dfdfd"},"incident_date":"2018-09-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71ef12f18eb9","org_name":"Maffi Clinic","org_type":"healthcare","ransomware":true,"records_affected":10465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/maffi-clinic-notifies-10465-after-ransomware-incident/"}],"summary":"Hospital quickly responds and contains ransomware inection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c094bc9b1a04eca4d6576ffe8e3cc515c0f832ed","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20-%20Oak%20Park%20Surgery%20Center_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"12a07d5128fc","org_name":"Surgerical Specialties of Arroyo Grande, LLC, dba Oak Park Surgery Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139711"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b336843441dbd02bdbfc0cc3a45f52426988765c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"82ec2a701852","org_name":"NapsGear","org_type":"retail_ecommerce","ransomware":null,"records_affected":287071,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NapsGear","type":"hibp","url":"https://haveibeenpwned.com/Breach/NapsGear"}],"summary":"NapsGear suffered a data breach in October 2015 that exposed personal information and salted MD5 password hashes for 287,071 customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3612d6faa420dc03597c691faeb87d8f74636b8e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IN","org_id":"79219491a069","org_name":"FreshMenu","org_type":"retail_ecommerce","ransomware":null,"records_affected":110355,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FreshMenu","type":"hibp","url":"https://haveibeenpwned.com/Breach/FreshMenu"}],"summary":"FreshMenu’s July 2016 breach exposed customer personal data, including names, contact details, addresses, and order histories.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83733249042d9570a7e98496b1d826ad066a31b4","impact_type":"data_theft","imported_from":null,"incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ecf1ce25ef57","org_name":"Warmane","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Warmane","type":"hibp","url":"https://haveibeenpwned.com/Breach/Warmane"}],"summary":"A December 2016 breach of Warmane exposed account details, including usernames, email addresses, dates of birth and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23577e43d16111dbd2e3c11a6c3d9cb4a8715f83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32f05ce0-d0a3-11e8-8d86-ff6837032f4a"},"incident_date":"2018-09-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97d141b525ff","org_name":"Ameri-Choice","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox43.com/2018/09/26/police-suspects-install-skimming-device-at-mechanicsburg-store/"}],"summary":"a credit card skimming device was found at an ATM at Ameri-choice on Sporting Green Drive in Mechanicsburg.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27557653646266c2ae47050a72c2210a687c9e0e","impact_type":"unknown","incident_date":"2018-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/WAES%20breach%20notification%20letter_2018-08-29_07-57-07_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"80d144d6cf83","org_name":"Mt. Diablo Unified School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139646"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"98640ba0bc0d8ec3bc714cb5c666003aa30da59e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/AugustaUniversity.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4217d3f73165","org_name":"Augusta University","org_type":"unknown","ransomware":null,"records_affected":31505,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/AugustaUniversity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6379b7d86d30eb66a98984bbe30832f13dacc50a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5cfe6600-d2e5-11e8-812c-4b45ac8f4a86"},"incident_date":"2018-09-03","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10e0c9b7188e","org_name":"Aspire Health","org_type":"healthcare","ransomware":null,"records_affected":124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tennessean.com/story/news/health/2018/09/25/nashville-based-aspire-health-hacked-phishing-scheme-lost-health-information/1420135002/"}],"summary":"Aspire Health, a Nashville based company, occurred after a phishing attack gained access to Aspire’s internal email system on Sept. 3. The hacker then forwarded 124 emails to an external email account, including emails that contained “confidential and proprietary information and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"NL","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35dcf96f680080c287c046a57dc6c3a80517c752","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6e3e25c0-fbe5-11e9-8c71-6b6c5a5368d9"},"incident_date":"2018-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d101adaa7e8","org_name":"grindr","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.queereurope.com/it-is-still-possible-to-obtain-the-exact-location-of-cruising-men-on-grindr/,https://www.databreaches.net/another-security-breach-at-grindr-reveals-users-exact-location/"}],"summary":"Grindr doesn't limit user location, allowing triangulation of users through forged locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2018-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1b5b33dbce9c402b8bcdc94c5e6cd08036abce7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"489fd740-a0c0-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"8b0cdf855270","org_name":"Andhra Pradesh government","org_type":"government","ransomware":null,"records_affected":20000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://telanganatoday.com/data-vulnerability-in-andhra-pradesh-government-websites-exposed"}],"summary":"Security researchers have found that sensitive data of about two crore people in Andhra Pradesh was made available unwittingly by the Government itself through its web portals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3e7097ab7cd37e8b3cf5258cb3ba77d23889cba","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Attorney%20General%20Patient%20Notification%20Letter_Adult%20Hospital%20Patient_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5a021cdf4753","org_name":"Port City Operating Company, doing business as St. Joseph's Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139511"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7a88b305b46540f27d4ff0b0abbd4071727d4e0","impact_type":"unknown","incident_date":"2017-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MM-%20CA-%20Exhibit%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63cbd1a634ac","org_name":"Movement Mortgage LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139484"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Movement%20Mortgage%20LLC-2018-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a164d97fe7387616deb86e891533d37bafa142f2","impact_type":"data_theft","incident_date":"2018-06-17","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"01e00f70eb1e","org_name":"Mortal Online","org_type":"technology_saas","ransomware":null,"records_affected":606637,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mortal Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/MortalOnline"}],"summary":"Mortal Online experienced a data breach in June 2018, and files containing email addresses, password hashes, names, usernames, and physical addresses were distributed online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bda06d4fc88749aefcf0880fe0c58e6574e2b02","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bombas%20-%20Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"0c16ed75492d","org_name":"Bombas LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139516"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bombas%20-%20Sample%20Notice_1.pdf"}],"summary":"Bombas reported that an unknown attacker injected malicious code into its website, potentially exposing customers’ names, addresses, and credit card information.","supporting_quote":null,"technology_involved":["Bombas website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70b62ba09d1035e3f7ad7130e9d94a8f962e6260","impact_type":"data_theft","imported_from":null,"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SE","org_id":"dc83648f9f60","org_name":"SvenskaMagic","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SvenskaMagic","type":"hibp","url":"https://haveibeenpwned.com/Breach/SvenskaMagic"}],"summary":"SvenskaMagic suffered a data breach that exposed usernames, email addresses and MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-29","discovered_date":"2018-08-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"e7b7cdb106943e4cb1577585c7b34bee29d3f96f","impact_type":"unknown","incident_date":"2017-09-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/RichardOwenNursery.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9fd529538eef","org_name":"Richard Owen Nursery, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Richard%20Owen%20Nursery%2C%20Inc.-2018-08-29"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/RichardOwenNursery.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139421"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Richard%20Owen%20Sample-%20All%20States_0.pdf"}],"summary":"Dutch Gardens reported that malware may have infected its website and potentially compromised customers’ personal and credit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d193b1da28aece5d5fca037cd9111743433e0bf6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2c0da10-1c74-11ec-bbb1-d17b99816d46"},"incident_date":"2018-08-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76704195a7d0","org_name":"R&G Travelmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wiscnews.com/wisconsindellsevents/news/local/crime-and-courts/police-find-skimmers-in-wisconsin-dells-pumps/article_b76db853-d24a-5058-b304-c4a30111cf27.html"}],"summary":"Police find skimmers in Wisconsin Dells pumps - R&G Travelmart","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9508ff1c310aa582dfcd5c4d7530e65cbd27e684","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-01","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10578.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3f119ed449e7","org_name":"LILLEbaby","org_type":"retail_ecommerce","ransomware":null,"records_affected":1557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10578.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10578.pdf"}],"summary":"LILLEbaby reported that a third party installed malware on its e-commerce web platform, potentially exposing customers’ payment card information.","supporting_quote":"In June of 2018, we learned of a potential data security incident involving the unauthorized installation of malware by a third party on our e-commerce web platform.","technology_involved":["e-commerce web platform"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b24293bd59e2c18c16a9f007f0f9e5c8f8c1d168","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lillebaby%20--%20Notification%20--%20CA%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"0a86a162ed10","org_name":"LÍLLÉbaby","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139381"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lillebaby%20--%20Notification%20--%20CA%20AG_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#L%C3%8DLL%C3%89baby-2018-08-29"}],"summary":"LÍLLÉbaby reported malware installed by a third party on its e-commerce web platform that could have exposed customers’ payment card information.","supporting_quote":null,"technology_involved":["e-commerce web platform"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a63485e4915a2fc31e022143ba63515d11b65a1","impact_type":"data_theft","imported_from":null,"incident_date":"2018-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"36ddedd795da","org_name":"Atlas Quantum","org_type":"financial","ransomware":null,"records_affected":261463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Atlas Quantum","type":"hibp","url":"https://haveibeenpwned.com/Breach/AtlasQuantum"}],"summary":"Atlas Quantum suffered a data breach that exposed investors’ names, phone numbers, email addresses, and account balances.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2018-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9ec720eca7301546ed20d2a3bce456db6df9ecd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-08-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"affd29500778","org_name":"SpyFone","org_type":"technology_saas","ransomware":null,"records_affected":44109,"reviewed":false,"root_cause":"Misconfigurations within SpyFone's systems exposed the collected data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SpyFone","type":"hibp","url":"https://haveibeenpwned.com/Breach/SpyFone"}],"summary":"SpyFone data, including personal information and passwords, was publicly exposed because of misconfigurations in its systems.","supporting_quote":"Collected surreptitiously whilst the targets were using their devices, the data included photos, audio recordings, text messages and browsing history which were then exposed via a number of misconfigurations within SpyFone's systems.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-24","discovered_date":"2018-07-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58f3c6c12370deae02e2b83da2d2fa9ceb078491","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/70706835_1_Active%20-%20Dorian%20Breach%20Notice%20Letter%20-%20Sample%20Notification%20Letter%20-%20Credit%20Monitoring%20-%20August%2024%2C%202018_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"634b217f6088","org_name":"Dorian Business Systems, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139279"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/70706835_1_Active%20-%20Dorian%20Breach%20Notice%20Letter%20-%20Sample%20Notification%20Letter%20-%20Credit%20Monitoring%20-%20August%2024%2C%202018_0.pdf"}],"summary":"Dorian Business Systems said information from a database table used by Charms Office Assistant was likely taken by an unauthorized party and posted on a third-party website.","supporting_quote":null,"technology_involved":["Charms Office Assistant","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-23","discovered_date":"2018-08-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cfc477d16a3e95f1b43bf39f15b4368b31761d5","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cheddar%E2%80%99s%20Web%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"783e6d01c939","org_name":"Cheddar's Scratch Kitchen","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cheddar%E2%80%99s%20Web%20Notification_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10577.pdf"}],"summary":"Cheddar's Scratch Kitchen reported unauthorized access to a network that could have exposed payment card information used at certain restaurants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2290200fb46f729430ef76653465a53dcb46a71a","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quality-Care%20-%20Sample_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"741877876f8d","org_name":"Quality-Care Pharmacy","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139115"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quality-Care%20-%20Sample_Redacted_0.pdf"}],"summary":"A burglary was reported, involving the possible unauthorized disclosure of patients’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-22","discovered_date":"2018-07-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"29a4877f9282d5275267e56161cb244e8bad11bd","impact_type":"unknown","incident_date":"2018-07-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3597b7c08397","org_name":"Health Management Concepts, Inc.","org_type":"unknown","ransomware":null,"records_affected":2583,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Health%20Management%20Concepts%2C%20Inc.-2018-08-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-21","discovered_date":"2018-06-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cd2ad62d1cecf92a0018695af5776154b821f306","impact_type":"unknown","incident_date":"2018-05-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6f5460ee37bd","org_name":"Legacy Health","org_type":"unknown","ransomware":null,"records_affected":34000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Legacy%20Health-2018-08-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2018-08-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a2730599af98f7fd5ed6bee373b521b0765e2c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LS%200818-088%20GLBA%20Incident_0.pdf"},"notes":null,"org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139041"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LS%200818-088%20GLBA%20Incident_0.pdf"}],"summary":"Bank of the West reported that compromised credentials were used to access employee email accounts at a contracted service provider, potentially exposing business-related personal information.","supporting_quote":"The service provider’s investigation determined that unauthorized third par ties used compromised credentials to log into a limited number of their employee email accounts and may have accessed information associated with your business.","technology_involved":["employee email accounts"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-08-17","discovered_date":"2018-06-21","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"194ad9039674f1d2c58ab6ada7005827d7d6f17d","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notification%20Letters%20submitted%20with%20CA%20Online%20Data%20Security%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"ad51e93f62f9","org_name":"Authentic Recovery Center, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138972"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notification%20Letters%20submitted%20with%20CA%20Online%20Data%20Security%20Breach_0.pdf"}],"summary":"An unauthorized third party accessed an Authentic Recovery Center secure email account, potentially exposing names, client status, and limited clinical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5db86dbef900adb728c9b15bddbfe715d4657048","impact_type":"unknown","incident_date":"2018-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"00e8761d658e","org_name":"The Macaluso Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Macaluso%20Group-2018-08-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-08-16","discovered_date":"2018-06-15","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e3d3428abfc1508b75ef24e79b0112f2cb4e9f2","impact_type":"data_theft","incident_date":"2017-10-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event%20Packet_2.pdf"},"notes":null,"org_country":"US","org_id":"59839e73cf9e","org_name":"Gordon Schanzlin New Vision Institute","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138923"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event%20Packet_2.pdf"}],"summary":"Gordon Schanzlin reported that medical records recovered during a law enforcement raid may be related to unauthorized entry into a storage unit in October 2017.","supporting_quote":"Gordon Schanzlin believes the incident may be related to unauthorized entry in October 2017 into a storage unit where your information was located.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94824c9c31043b0282ad667dc5a264b902114365","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_0.pdf"},"notes":null,"org_country":"US","org_id":"fe688d17a82a","org_name":"Animoto","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Animoto","type":"hibp","url":"https://haveibeenpwned.com/Breach/Animoto"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event_0.pdf"}],"summary":"Animoto reported unauthorized queries of its user database and said user data may have been obtained.","supporting_quote":null,"technology_involved":["user database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65dd696f5bdfcbd1a2a0189974495b4a2cc9f1f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4891e290-b50e-11e8-83b1-efe44b79ad8e"},"incident_date":"2018-08-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6d826a2e1e65","org_name":"Ryde Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ausexual-assault-victims-medical-records-given-to-wrong-person/"}],"summary":"A patient was given the data of another patient who was the victim of a sexual assault and had been treated at the same hospital.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-15","discovered_date":"2018-07-16","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64b77b0fb01cd67c2474b1ae1a3c5c836adc7055","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CNG-Notice%20of%20Data%20Event-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"b1ac1b4b5638","org_name":"CNG Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138904"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CNG-Notice%20of%20Data%20Event-%20CA%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/CNGFinancialCorporationInc..pdf"}],"summary":"A USB drive containing CNG customer information went missing while being sent by courier to a third-party auditing vendor.","supporting_quote":"On July 16, 2018, the vendor reported that the package was delivered by the courier service in a damaged state, and that the device containing the confidential information was missing.","technology_involved":["USB drive"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea00c74e82a948a5ed4b56120a49106613e5ad55","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20re%20Notice%20of%20Data%20Breach_final_0.pdf"},"notes":null,"org_country":"US","org_id":"7271fa82eaa8","org_name":"Delicato Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20re%20Notice%20of%20Data%20Breach_final_0.pdf"}],"summary":"Delicato Vineyards said an outside individual might have accessed personal information in its VINES system, but it had no reason to believe the information was actually accessed.","supporting_quote":null,"technology_involved":["VINES system"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3958a35cb1d46d304611f0f6f7605e5aae594d63","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76b13ad0-1125-11ea-bd5f-71a8176be0a0"},"incident_date":"2018-08-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd2194729201","org_name":"St.Joseph County","org_type":"government","ransomware":null,"records_affected":541,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.southbendtribune.com/news/local/more-than-st-joseph-county-employees-were-affected-by-wage/article_201c0de0-65f7-5160-8eb8-cf67dc2924de.html"}],"summary":"In the letter, the Indiana Department of Workforce Development informed Burnett that wage records from Indiana employers were found on Aug. 10 by a member of the public on his property.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e25ce8420ccda5ae0f760816202cf3b08b6b58f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2018_8_10_CCB_customer_notice_CA_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"85847079d597","org_name":"JPMorgan Chase Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138743"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2018_8_10_CCB_customer_notice_CA_0.pdf"}],"summary":"A Chase employee downloaded customer information to a personal computer and two online storage sites, where third parties could have seen it.","supporting_quote":null,"technology_involved":["personal computer","online data storage sites"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2018-08-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"affabf2051757ad4b51ae3b44903da8ca9c9b3ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b85091d0-3b16-11ec-ba5b-a1f2db3b8242"},"incident_date":"2018-08-10","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb97e9d126bc","org_name":"Association of National Advertisers","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mediapost.com/publications/article/331362/ana-suffers-phishing-attack-possible-theft-of-dat.html"}],"summary":"Association of National Advertisers Suffers Phishing Attack, Possible Theft Of Data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-09","discovered_date":"2018-07-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c156c30dce5331b3d7620b954b17d4599533b0b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c99da5c7237e","org_name":"RBC Wealth Management","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RBC%20Wealth%20Management-2018-08-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b807e9aed2293dde4d92a155d45a6dcf8e9d19f1","impact_type":"data_theft","imported_from":null,"incident_date":"2015-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"cbb66ccb2cda","org_name":"MyFHA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyFHA","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyFHA"}],"summary":"MyFHA disclosed a breach of personal and home-financing information affecting 972,629 people.","supporting_quote":null,"technology_involved":["MyFHA website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c45be835dfacc52fc187943f09012cd3195f38d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-27","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20Remediation%20Letter%2041952117_0.pdf"},"notes":null,"org_country":"US","org_id":"f467159d707f","org_name":"Capital One","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138718"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Notice%20Remediation%20Letter%2041952117_0.pdf"}],"summary":"A former employee may have accessed Capital One 360 account information, including personal and financial information.","supporting_quote":"A former employee may have accessed your Capital One 360 account information between January 27, 2017 \nthrough April 20, 2017 when they shouldn’t have.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30f5b158a91ebc44d83f27a08d99c0ee75a01552","impact_type":"data_theft","imported_from":null,"incident_date":"2018-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"616205de5fb1","org_name":"Lanwar","org_type":"other","ransomware":true,"records_affected":45120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lanwar","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lanwar"}],"summary":"Lanwar staff discovered a breach involving names, email addresses, usernames, and plain-text passwords.","supporting_quote":null,"technology_involved":["gaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92131a29bddd670549f6f38e6fc2a6cc1c1d2de8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72ec7580-a18d-11e8-a695-3d5401d43fff"},"incident_date":"2018-08-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2553bf373783","org_name":"Comcast","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/comcast-vulnerabilities-exposed-sensitive-data-customers-allowed-brute-force-attacks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://9to5mac.com/2018/08/08/comcast-security-flaw/"}],"summary":"Comcast has resolved two critical vulnerabilities which had the potential to expose confidential information belonging to over 26.5 million customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"016f8aea07c035e692529cc64db953a291da3a03","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a02c6430-a18b-11e8-a695-3d5401d43fff"},"incident_date":"2018-08-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de7c4aa5d6b2","org_name":"Professional Golfers' Association of America","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/the-pga-possibly-infected-with-the-bitpaymer-ransomware/"}],"summary":"computers at the PGA of America’s offices have been infected with ransomware. The victims learned they were infected on Tuesday when ransom notes started appearing on their screen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-07","discovered_date":"2018-07-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0b25ab199070e3267a15c5f60d73d65d0f8b7b6","impact_type":"unknown","incident_date":"2018-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3785fb48499d","org_name":"Canyon Rd. Chiropractic and Massage","org_type":"unknown","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Canyon%20Rd.%20Chiropractic%20and%20Massage-2018-08-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-06","discovered_date":"2018-07-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10ec9e3e4867a58ca4e9db7955d1305adca5c6cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TCM-%20CA%20Letter%20Template_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"954257401a4d","org_name":"TCM Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A third-party vendor misconfigured the bank's online application website, making personal information accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138586"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TCM-%20CA%20Letter%20Template_0.pdf"}],"summary":"TCM Bank reported that a third-party vendor's misconfigured online application website may have exposed applicants' personal information.","supporting_quote":"On July 16, 2018, TCM Bank became aware that your personal information may have been accessible due to misconfiguration to the website caused by the third-party vendor.","technology_involved":["online application website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73d042dd506e072498b4bb095d68fcfa73f1b05c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-05-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"441add12c34e","org_name":"Adult-FanFiction.Org","org_type":"other","ransomware":null,"records_affected":186082,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adult-FanFiction.Org","type":"hibp","url":"https://haveibeenpwned.com/Breach/AdultFanFiction"}],"summary":"Adult-FanFiction.Org had user records exposed, including names, email addresses, dates of birth, and passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c88a33a8a2a52d13777364f4ba396dd86aed0635","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2018-08-03%20Gallagher%20Bassett%20AG%20Form%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"17df789d9cfc","org_name":"Gallagher Bassett Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138559"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2018-08-03%20Gallagher%20Bassett%20AG%20Form%20-%20CA_0.pdf"}],"summary":"A formerly licensed physician impersonated a licensed physician to conduct electronic peer reviews of workers’ compensation claims, potentially viewing personal and medical information.","supporting_quote":"We recently learned that a formerly licensed physician impersonated a licensed physician and conducted electronic peer reviews of certain worker’s compensation claims from approximately September 2013 to March 2014 and from November 2016 to August 2017.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a62193b6ca2769e4708b8103606ac3bc26e1747","impact_type":"unknown","incident_date":"2018-03-28","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_CBLife_CA_Resident_Individual_Notice_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"5fdfb6d233d5","org_name":"Colorado Bankers Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138565"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_CBLife_CA_Resident_Individual_Notice_Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Colorado%20Bankers%20Life%20Insurance%20Company-2018-08-03"}],"summary":"A targeted phishing attack compromised some of Colorado Bankers Life Insurance Company’s employees’ cloud-based email accounts.","supporting_quote":"On June 20, 2018, CBLife completed its investigation of a data security incident that involved a targeted phishing attack that compromised some of its employees’ cloud-based email accounts at various times between the dates of March 28, 2018 and April 13, 2018.","technology_involved":["cloud-based email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-08-03","discovered_date":"2018-05-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"701e4680904925ab8fbad45003f62935b593f7fe","impact_type":"unknown","incident_date":"2018-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d81c46147997","org_name":"ChoiceOne / MedSpring Urgent Care","org_type":"unknown","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ChoiceOne%20/%20MedSpring%20Urgent%20Care-2018-08-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4608130c23a87d1f15ad5ce3cf02ce3248ac0f63","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81d08bf0-9cd7-11e8-8225-e3fd0e7757b5"},"incident_date":"2018-08-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e81e17c4d96d","org_name":"Bank of Guam","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.guampdn.com/story/news/2018/08/06/bank-guam-another-skimming-device-found-atm-time-agat/912358002/"}],"summary":"A skimming device was found on on a Bank of Guam automated teller machine at the Agat Subway restaurant Saturday, the bank said in a statement issued Monday.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1327ed25b007ec75f9d95ded52e54ad03e9e31ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-07-05","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20C1807014816_1.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20C1807014816_1.pdf"}],"summary":"An intrusion on Expedia's Orbitz booking platform may have put American Express travel customers' personal and payment card information at risk.","supporting_quote":"Expedia informed American Express of a potential intrusion on its Orbitz travel booking platform, which serves as the underlying booking engine for Amextravel.com and travel booked through Amex Travel Representatives.","technology_involved":["Orbitz travel booking platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Expedia"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fc7a640dc47d","name":"Expedia"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-08-01","discovered_date":"2017-12-04","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96dc05fbef057cb957625a076848f15fec77c662","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welk%20-%20Regulator%20Notice%20Exhibits%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"b2c570ca8fde","org_name":"Welk Resort Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welk%20-%20Regulator%20Notice%20Exhibits%20-%20CA_0.pdf"}],"summary":"Unauthorized actors accessed certain Welk employee email accounts between November 29 and December 4, 2017, where some personal information was present.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c50385c1ad1af76ae8e6c63e7e76f00938418daf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7c403af0-aa06-11e8-a274-afc3aa8c5110"},"incident_date":"2018-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dd6b575614fd","org_name":"Jersey Archive","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://jerseyeveningpost.com/news/2018/08/10/potential-care-inquiry-documents-data-breach/"}],"summary":"A WEBSITE containing documents relating to the Independent Jersey Care Inquiry has been temporarily shut down because of a potential data protection breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1199"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"644fb53450384c88e1542fcdc1e994344a571d1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1199","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_3.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"729b0966004d","org_name":"Compass Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138459"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_3.pdf"}],"summary":"An external BBVA Compass contractor improperly accessed personal and account information belonging to some Compass Bank customers and prospects.","supporting_quote":"Please be advised that an external BBVA Compass contractor improperly accessed some of the personal and/or account information of a limited number of bank customers and prospects in violation of the Bank’s policies and procedures.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2018-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859d6fd7bc251acd3b8309b9206de98c182c6c04","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"f1298159653c","org_name":"Fashion Nexus","org_type":"retail_ecommerce","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fashion Nexus","type":"hibp","url":"https://haveibeenpwned.com/Breach/WhiteRoom"}],"summary":"A July 2018 breach exposed Fashion Nexus records containing personal information, passwords, and purchase data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566","T1657"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-07-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d74b15431478c2c57c7f072360cd92b0d1fe8445","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-14","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UnityPoint%20-%20Notice%20Letter%20Sample%20%287552880x7AB84%29_0.pdf"},"notes":null,"org_country":"US","org_id":"021bf26af99b","org_name":"UnityPoint Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees were tricked by phishing emails into providing sign-in information, allowing attackers to access their internal email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138399"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UnityPoint%20-%20Notice%20Letter%20Sample%20%287552880x7AB84%29_0.pdf"}],"summary":"Phishing emails led employees to provide sign-in information, allowing attackers to access UnityPoint Health internal email accounts containing patient information.","supporting_quote":"The phishing emails tricked some of our employees into providing their confidential sign-in information which gave attackers access to their internal email accounts between March 14, 2018 and April 3, 2018.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a27893b4c835b03edb0ae9005ad48e0d2fe22dfd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"653f4c50-99a9-11e8-bb21-7f662dc72866"},"incident_date":"2018-07-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"74f2e17df0d8","org_name":"Taranaki High School","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/taranaki-daily-news/news/105913739/taranaki-high-school-in-digital-lockdown-after-hacker-demands-us5000-to-release-school-work"}],"summary":"Hāwera High School staff in South Taranaki switched on their computers on Monday to discover a message demanding payment for the return of encrypted data on a server containing students' work and teaching resources, principal Rachel Williams said.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-30","discovered_date":"2018-05-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92f5bb639f4fb1698a300328425ab5d7f6ebef46","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Plant%20Therapy%20-%20California%20AG%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"47cb6bcf4084","org_name":"Plant Therapy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138372"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Plant%20Therapy%20-%20California%20AG%20Notification%20Letter_0.pdf"}],"summary":"Plant Therapy reported malware on its e-commerce web platform that may have compromised customers’ payment card information.","supporting_quote":null,"technology_involved":["e-commerce web platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40afdb781f61c7516daee6444c5d49bafb30ccec","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_24.pdf"},"notes":null,"org_country":"US","org_id":"2d3c5c9fe679","org_name":"Bank of Hope","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138402"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_24.pdf"}],"summary":"Bank of Hope reported that unauthorized individuals may have accessed some account holders’ personal information between June 28 and July 5, 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-27","discovered_date":"2018-06-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ccd9abd59a5e576e9bb064db53c3ba12274fdc08","impact_type":"data_theft","incident_date":"2008-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10575.pdf"},"notes":null,"org_country":"US","org_id":"bbdd82904ca4","org_name":"Yale University","org_type":"education","ransomware":null,"records_affected":1742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Yale%20University-2018-07-27"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10575.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10575.pdf"}],"summary":"Intruders accessed a Yale database and extracted personal information, including names and Social Security numbers, from individuals affiliated with the university.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20c9164fd5190f18bd331b190b91f6a642ab5a29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2a78a570-9b0d-11e8-afb8-29dacb44caa2"},"incident_date":"2018-08-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"418526296c55","org_name":"New England Dermatology","org_type":"healthcare","ransomware":null,"records_affected":16154,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/lane-county-health-human-services-new-england-dermatology-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/lane-county-health-human-services-new-england-dermatology-breach"}],"summary":"The patient records of 16,154 patients were incorrectly disposed of and personal information may have been viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2018-07-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1bcf72ecedb609e4b57bf484410023ba3e4a251","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9b056900-9995-11e8-bb21-7f662dc72866"},"incident_date":"2018-07-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"f0acbbc98a9d","org_name":"KICKICO","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cryptoglobe.com/latest/2018/07/7-7-million-kickico-hacked-through-smart-contract-breach-recovers-funds/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://coinfrenzy.io/kickico-experiences-a-hack-and-loses-7-7-million/"}],"summary":"KICKICO, an initial coin offering (ICO) project launched on top of the Ethereum blockchain protocol, was hacked on July 27 and lost more than 70 million KICK worth $7.7 million","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f28b4d808a37f07d0cc772445fb8158a25db51d1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2412f0c0-a0a1-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/hackers-deface-a-kaiser-website.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hear-me-roar-kaiser-permanente-site-defaced-by-got-fans/"}],"summary":"A Kaiser Permanente website used by employees, physicians and potential employees was hacked July 27 by a group called \"Team Faceless Men,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd0fa3862935b64ca4f2677485fbc58c183c9062","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1d2eb630-9b11-11e8-8050-370b93adfe70"},"incident_date":"2018-07-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4f9da4ebb76d","org_name":"CreditMate","org_type":"other","ransomware":null,"records_affected":18913,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/exclusive-creditmate-in-developers-goof-left-19000-consumers-credit-reports-unsecured/"}],"summary":"On July 27, an independent researcher known as “Flash Gordon” (@s7sins on Twitter) contacted DataBreaches.net and Lee Johnstone to report that during a routine keyword search on Google, he had found numerous credit reports from Indian consumers exposed.  Identifying the owner of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4d292e4c0d2292aa04f83c6bb4d62e9aafa9937","impact_type":"both","imported_from":null,"incident_date":"2017-10-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TradeMotion%20Notice%20of%20Breach_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"6591404a0f53","org_name":"TradeMotion","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The unauthorized person or group used compromised account credentials to extract personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138225"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TradeMotion%20Notice%20of%20Breach_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TradeMotion-2018-07-25"}],"summary":"TradeMotion reported that an unauthorized person or group used compromised account credentials to extract payment card and other personal information from Parts.com.","supporting_quote":"After undertaking an investigation, we concluded that an unauthorized individual or group extracted personal information by using compromised account credentials.","technology_involved":["Parts.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a5d0d9dd47401ae3765e969d2b82f7085871000","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"38403697281f","org_name":"Exactis","org_type":"professional_services","ransomware":null,"records_affected":340000000,"reviewed":false,"root_cause":"Exactis inadvertently publicly exposed personal data, but the text does not state the specific technical cause.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Exactis","type":"hibp","url":"https://haveibeenpwned.com/Breach/Exactis"}],"summary":"Exactis inadvertently publicly leaked 340 million records of personal data in June 2018.","supporting_quote":"In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Shadow Brokers","variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"710e4d54fdeb0f31293f4a65413621180644ac42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"324b3d60-99a7-11e8-bb21-7f662dc72866"},"incident_date":"2018-07-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CL","org_id":"cb1432f7e5f2","org_name":"Banco de Chile","org_type":"financial","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://santiagotimes.cl/2018/07/27/chile-hackers-publish-details-of-14000-credit-cards-online/"}],"summary":"On Wednesday night there was a massive leak of customer data of Chilean banks after hackers gained access to some 14,000 credit card numbers before publishing the credit card numbers, expiration dates and security codes online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shadowbrokers"}},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dce2b98fe330ce3888fd8005d827c6820d015fe6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24f68740-9980-11e8-b882-6b7d0605ee5d"},"incident_date":"2018-07-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"1a81a6fbcb6e","org_name":"State Bank of India","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://timesofindia.indiatimes.com/city/goa/romanians-arrested-for-attempting-atm-data-theft/articleshow/65141098.cms"}],"summary":"ATM Skimming caught by the bank's IDS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46f1083d09274efc990f9b9ea010e1ebe04fc9df","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/HeacockInsurance.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d1ffa1f830a","org_name":"Heacock Insurance Group, LLC and Heacock Payroll, LLC","org_type":"unknown","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/HeacockInsurance.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91378f459a66f288e94c42e792bc240f8823fa3d","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7c099b374475","org_name":"Funny Games","org_type":"other","ransomware":null,"records_affected":764357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Funny Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/FunnyGames"}],"summary":"Funny Games disclosed a breach involving usernames, email and IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81a21dafe0e647b41cdd287bf6b439e5b478c18d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef191cc0-9748-11e8-8342-0f8f10fcd812"},"incident_date":"2018-07-24","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"8f739da94b55","org_name":"China Ocean Shipping Company","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.co/wordpress/74941/malware/cosco-ransomware-attack-followup.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://clicklancashire.com/2018/07/27/ransomware-infection-cripples-shipping-giant-ciscos.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/ransomware-infection-cripples-shipping-giant-coscos-american-network/"}],"summary":"A ransomware infection has crippled the US network of one of the world's largest shipping giants —COSCO (China Ocean Shipping Company).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7634810f7cb925b4d0dc1ad851d7925a3ad08ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5d3444c0-999a-11e8-bb21-7f662dc72866"},"incident_date":"2018-07-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"86debec0378d","org_name":"Dadar, India City Accountant","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://indianexpress.com/article/cities/mumbai/mumbai-ransomware-dadar-office-bitcoins-5281187/"}],"summary":"cyber fraudsters encrypted data belonging to a Dadar-based chartered accountant and demanded money to remove the block on the data on Monday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-07-20","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6fd5ca788f514e22505cdef2391771a8a82aa63","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IoA%20-%20California%20AG%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"801ba79a6185","org_name":"Institute on Aging","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138146"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IoA%20-%20California%20AG%20Notification%20Letter_0.pdf"}],"summary":"Institute on Aging reported unauthorized access to employee email accounts that may have contained personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-20","discovered_date":"2018-06-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f11f2deeabce6689f495fa24408367b3ebbd2dcf","impact_type":"unknown","incident_date":"2018-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"296e50ba73d2","org_name":"City of Medford, Oregon","org_type":"unknown","ransomware":null,"records_affected":1842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20Medford%2C%20Oregon-2018-07-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"836be7bf766ba7c0c00c21561be3a5264ef29cfc","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-11-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Communication%20to%20Users%20-%20FINAL_0.pdf"},"notes":null,"org_country":"BE","org_id":"d94792c2c9b6","org_name":"Massive Media Match NV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Communication%20to%20Users%20-%20FINAL_0.pdf"}],"summary":"A database containing Netlog users’ email addresses and password information was compromised in November 2012.","supporting_quote":null,"technology_involved":["Netlog","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-19","discovered_date":"2018-05-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e2eacde338cec7aca44c302a50f474f2ec328b3f","impact_type":"unknown","incident_date":"2018-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"865adb60ba55","org_name":"Blue Springs Family Care, P.C.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Blue%20Springs%20Family%20Care%2C%20P.C.-2018-07-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c188bed68b40fbb5c628d9e80c0f8384eaf2575","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a4cd4a0-a22b-11e8-ae61-0fc7f403e976"},"incident_date":"2018-07-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"3d5fbd58ecb1","org_name":"Australia National Health Practitioner Ombudsman and Privacy Commissioner","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.smh.com.au/technology/government-left-red-faced-by-health-privacy-commissioner-s-website-bungle-20180717-p4zs1t.html"}],"summary":"A \"misconfiguration\" of the web server hosting the National Health Site led to the homepage displaying an index of all the files hosted on it, including what appeared to be a number of databases, back-ups and log-in credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cddf68fedf2d4236339188c1b2eb0066ed0b30b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef7bb410-9a46-11e8-8652-5d096cfefbb4"},"incident_date":"2018-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebb3c7a2cd0b","org_name":"Georgia Tech","org_type":"education","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govtech.com/education/higher-ed/Georgia-Tech-Mistakenly-Releases-Data-About-Nearly-8000-Students.html"}],"summary":"Georgia Tech students are furious after the university mistakenly emailed personal information of nearly 8,000 College of Computing students to fellow students.  The information included student identification numbers, telephone numbers, dates of birth, addresses, grade-point ave","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8e158273bebce2d6efccf3c5450ca0ad9c5605e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1f388c90-a4ac-11e8-b571-7db57cad93dd"},"incident_date":"2018-07-15","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"840f7712875e","org_name":"Hong Kong Department of Health","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmp.com/news/hong-kong/hong-kong-law-and-crime/article/2158023/after-singapore-medical-data-hack-hong-kongs;"},{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2018/08/05/hong-kong-health-department-computers-hit-by-cyber-attack/"}],"summary":"Hong Kong’s Department of Health has become the latest victim of a cyberattack after three of its computers were hit by ransomware which left data inaccessible, prompting police to open a criminal investigation.  The targeted computers belonged to the department’s Infection Contr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd207c4354527490402cd543bc78b2cbcc55eb26","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2d018410-8ac3-11e8-aafc-8b374e4aa1f3"},"incident_date":"2018-07-13","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"360c71dc4cb3","org_name":"WESTMORELAND COUNTY HOUSING AUTHORITY","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://whjbfm.com/westmoreland-county-housing-authority-hit-with-ransomware-attack/"}],"summary":"A cyber attack has rendered many computers and phones with the Westmoreland County Housing Authority useless last week.  The Tribune-Review reports that the authority issued a statement on Friday saying they were attacked by ransomware, and the ransom to have the computers restor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fe38f8be1fe4e5cd6de7b38cdb516592b800fa0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9bc3fe50-9414-11e8-87f1-7302439b2762"},"incident_date":"2018-07-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbc4i.com/news/local-news/police-skimmer-found-on-atm-in-westerville-cvs/1308035121;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisweeknews.com/news/20180720/skimming-device-found-on-atm-at-westerville-cvs"}],"summary":"Police are investigating after a credit card skimmer was found on an ATM in Westerville.  According to a report from the Westerville Division of Police, the device was found on an ATM inside the CVS pharmacy at 620 S. Cleveland Ave. on Friday. A cashier found the skimmer when he ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2018-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0164574b603f457660662a63a786966ed0f4e083","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13a57c40-8e8f-11e8-8003-e3ff5269fee2"},"incident_date":"2018-07-13","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ba18b3fbfd8b","org_name":"Breast Cancer Network Australia (BCNA)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bcna.org.au/news/2018/07/possible-eligible-data-breach/"}],"summary":"On Friday 13 July, a BCNA staff member opened a file attachment to an email that appeared to be from a known contact.  BCNA now believes this was not a legitimate email, but a phishing email from an external party.  The possible data breach involves access to email addresses for ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa5e1883a4581fa3288b954c83c99289a2d5da16","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12b2d5a0-8aaf-11e8-874b-dd84fb61b260"},"incident_date":"2018-07-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5f2c52b27e93","org_name":"Toronto Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/toronto/officer-suspension-security-leak-1.4750546"}],"summary":"Toronto police have suspended an officer accused of leaking sensitive information about a potential security threat that led to a heightened police presence in downtown Toronto.  The officer is alleged to have shared an \"unapproved operational plan\" with some Toronto media outlet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0da750731dceeb3ab6ae54006c718629b7022f82","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9581.pdf"},"notes":null,"org_country":"US","org_id":"948f610b8a62","org_name":"Overlake Arthritis and Osteoporosis Center","org_type":"healthcare","ransomware":null,"records_affected":627,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9581.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9581.pdf"}],"summary":"Overlake Arthritis and Osteoporosis Center reported that malware was enabled on a medical assistant’s computer and that 627 patient charts may have been breached.","supporting_quote":null,"technology_involved":["Medical Assistant's computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-11","discovered_date":"2018-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"045317f32fcff8598e120842a13fe45d65355fd4","impact_type":"data_theft","incident_date":"2017-11-10","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TC-%20Notice%20of%20Data%20Event-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ba6f72906de3","org_name":"Tommie Copper Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137818"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TC-%20Notice%20of%20Data%20Event-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tommie%20Copper%20Inc-2018-07-11"}],"summary":"Malware on Tommie Copper's website collected payment information and other customer details during periods from November 10, 2017, through January 22, 2018.","supporting_quote":"On or about June 1, 2018, the forensic investigator confirmed that a piece of malware had been inserted into our website that collected certain payment information used at checkout.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2018-07-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ace2d6d56a317fbd4d4663a568d3d95bc4ffdc2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fbbeff00-904d-11e8-8b32-9bc4732308c2"},"incident_date":"2018-07-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45278b3a55a1","org_name":"NPM","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/07/12/npm_eslint/"}],"summary":"An unfortunate chain reaction was averted today after miscreants tampered with a widely used JavaScript programming tool to steal other developers' NPM login tokens.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"429251474bf861cdcb72d202a59965e9bb7077dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef73a1a0-8a8b-11e8-ba1e-e3857583ba43"},"incident_date":"2018-07-10","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"80c415421547","org_name":"University of Sydney","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://honisoit.com/2018/07/usyd-emails-fall-into-mass-phishing-scam/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e142efddfe1af91e0fdb2c476aa7695e1d244d7d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47595c50-d0ca-11e8-bbbb-67b2993a8980"},"incident_date":"2018-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd257cab9855","org_name":"Ohio Living","org_type":"healthcare","ransomware":null,"records_affected":6510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://markets.businessinsider.com/news/stocks/ohio-living-provides-notice-of-data-security-incident-1027518385;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/hacker-accesses-email-accounts-phi-at-retirement-communities?feed=00000152-1262-da4c-af7b-56728d8c0000;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"What Happened? On July 19, 2018, Ohio Living determined that there were potential unauthorized logins into some Ohio Living employee email accounts.  Previously, on July 10, 2018, Ohio Living became aware of suspicious activity relating to an employee email account. They quickly ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-07-10","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0bed69ac91128773f14f603972605fca7f21c9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19c4a8c0-8ac1-11e8-aafc-8b374e4aa1f3"},"incident_date":"2018-07-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"e5a7e9ae317e","org_name":"MyEtherWallet","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ccn.com/myetherwallet-warns-of-another-hack-urges-hola-users-to-move-funds/"}],"summary":"Popular Ethereum wallet interface and token wallet MyEtherWallet is – yet again – at the center of a significant security breach and has warned its users utilizing a popular VPN to move their funds.  MyEtherWallet (MEW) is now reeling from its second major security compromise in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-10","discovered_date":"2018-06-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"01a81004610d45306292e027f5dbd204240c552a","impact_type":"unknown","incident_date":"2018-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0a8a144045b9","org_name":"Campbell Soup Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Campbell%20Soup%20Company-2018-07-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"455547ccbabbb556e189f52d53981568fca204d6","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"15333f3186ea","org_name":"Pemiblanc","org_type":"unknown","ransomware":null,"records_affected":110964206,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pemiblanc","type":"hibp","url":"https://haveibeenpwned.com/Breach/Pemiblanc"}],"summary":"A credential-stuffing list of email addresses and passwords known as Pemiblanc was discovered on a French server and used for account-takeover attacks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"NG","motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2018-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e87c2867bbad5ab62a631ea94ffae5e29717f38e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17904680-974c-11e8-8342-0f8f10fcd812"},"incident_date":"2018-07-09","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d29203df4331","org_name":"Klamath County, OR","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.heraldandnews.com/news/local_news/county-data-breach-from-email-scam/article_36bc9f83-8136-5a40-9a9b-e7b72df73bae.html"}],"summary":"Klamath County discovered that two employees clicked a link in a mass phishing scam email that prompted employees to share their county credentials and sign an online document","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2018-07-09","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeee235a65fc821d5b26de5938d8b74597f89da0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01468660-8ea4-11e8-8003-e3ff5269fee2"},"incident_date":"2018-07-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e692d9ebe31d","org_name":"Cass Regional Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cassregional.org/news/releases/a-special-statement-from-cass-regional/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/cass-regional-medical-center-restoration-90-complete-after-ransomware-attack.html"}],"summary":"Cass Regional Medical Center brought its EHR (electronic health record) back online today for the first time since a July 9 ransomware attack on the organization’s information technology infrastructure prompted a precautionary shut down of the EHR","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a033ac932cfb06a7e42834f775b72f0ea2b14253","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7e65c40-88fa-11e8-82c8-d50e157d53ee"},"incident_date":"2018-07-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"c47edf233d19","org_name":"Bancor","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cointelegraph.com/news/decentralized-crypto-exchange-bancor-reports-security-breach-remains-down-for-maintenance;"},{"fetched_at":null,"title":null,"type":"press","url":"https://bitcoinexchangeguide.com/bancor-bnt-issues-security-breach-warning-message-about-potential-wallet-hack/"}],"summary":"Decentralized cryptocurrency platform Bancor halted operations Monday, July 9, as it investigates what it calls a “security breach,” reportedly involving over $12 mln.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-07-06","discovered_date":"2018-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27ebd69c0b33d6f5dc77cf0cade16c77d68198e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"1a26c6c01baf","org_name":"The International Mission Board","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20International%20Mission%20Board-2018-07-06"}],"summary":"The International Mission Board discovered that an unknown criminal actor had accessed a data file containing personal information and possibly limited health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c509834935a95d37fde3d8a79c38199cf6c864e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e5dd8c10-8f44-11e8-a74f-e5450456a5bf"},"incident_date":"2018-07-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"05aaab1466e7","org_name":"Taf Adoption Agency","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesofisrael.com/police-probe-after-adoption-agencys-files-found-strewn-on-tel-aviv-street/"}],"summary":"A Tel Aviv resident was shocked to find thousands of highly confidential documents from a leading Israeli adoption agency strewn on a sidewalk in the city.  The files from the Taf adoption agency listed names of hundreds of adoptive parents and children between the years 1999-201","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60f60c956869c63c6dbb0c26141b247da5832e07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fce9a620-85f6-11e8-ae9b-a1b647b0d464"},"incident_date":"2018-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71ba27ba0716","org_name":"Lake Oswego School District (Oregon)","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.koin.com/news/local/washington-county/lake-oswego-school-district-twitter-hacked/1288191319"}],"summary":"Lake Oswego School District Twitter hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-07-06","discovered_date":"2018-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7a44e40a43a10c33cfe6af49327d90d2924d625","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9579.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c58b79494393","org_name":"International Mission Board","org_type":"nonprofit","ransomware":null,"records_affected":7783,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9579.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/InternationalMissionBoard.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9579.pdf"}],"summary":"An unknown criminal actor accessed a data file containing personal information and possibly limited health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-06","discovered_date":"2018-01-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fd13c31a5edae4756814edccd8a0a79a9746a80","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-12","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"a05ca167beef","org_name":"Coty, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137727"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9580.pdf"}],"summary":"Hackers used phishing to access Coty employee email accounts, whose contents may have been seen or downloaded.","supporting_quote":"In January and February of this year, hackers using ‘phishing’ techniques accessed a number of Coty employee email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e34fdaf3e9ed9735672297f16a7ba4a9738ac4c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02b0e7f0-85f5-11e8-ae9b-a1b647b0d464"},"incident_date":"2018-07-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"d8e73cb5d857","org_name":"Unidentified Hotel","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://timesofindia.indiatimes.com/city/mumbai/hacker-seeks-400-to-unlock-hotels-data-held-for-ransom/articleshow/64890174.cms"}],"summary":"The hacker used a proxy computer internet protocol (IP) server to hack into the hotel's computer and demanded $400 to unlock it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58d97cd56a66a8a02bbc4a6fd208b2318adc3221","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20Letter2_0.pdf"},"notes":null,"org_country":"US","org_id":"0c27dd30b453","org_name":"MSK Group, P.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137702"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20Letter2_0.pdf"}],"summary":"MSK Group reported unauthorized access over several months and data encryption around May 7, 2018, with personal and medical information potentially affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb1a5d5e34185151b9d7001a80f04153c02af950","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69aecca0-9a73-11e8-b855-9f03b7750df7"},"incident_date":"2018-07-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f39df5a7d60","org_name":"General Electric","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cbs6albany.com/news/local/heavy-fbi-presence-at-niskayuna-home;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/opa/pr/new-york-man-charged-theft-trade-secrets"}],"summary":"Official paperwork accuses Zheng, a GE engineer, of hiding data files belonging to GE in a picture of a sunset, and then emailing the stolen files to himself.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-05","discovered_date":"0001-01-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7f323de98ddfd74dfd28a156ae1ce4c5b2a5314e","impact_type":"unknown","incident_date":"2018-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0b29cf2a6b9c","org_name":"ATI Holdings LLC and its subsidiaries","org_type":"unknown","ransomware":null,"records_affected":45799,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ATI%20Holdings%20LLC%20and%20its%20subsidiaries-2018-07-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c57579ac8c87e3107dfb5c1f68a82d03559a86a3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-03-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_SSN%20DL_0.PDF"},"notes":null,"org_country":"US","org_id":"6f5d5e14ffde","org_name":"211 LA County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee inadvertently misconfigured database settings during an upgrade, making a database file accessible from the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137700"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_SSN%20DL_0.PDF"}],"summary":"211 LA County reported that an employee’s misconfiguration made a database file containing callers’ personal information accessible over the internet.","supporting_quote":"Our investigation determined that the incident was caused by an employee who inadvertently misconfigured the settings during a recent upgrade, which caused a database file to be accessible from the internet.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29a7ca9bc659a6a6cf006666b7de24957701d1c7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"474d53c7c9b3","org_name":"Yatra","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Yatra","type":"hibp","url":"https://haveibeenpwned.com/Breach/Yatra"}],"summary":"Yatra had records containing personal information, PINs, and passwords exposed in a 2013 data breach.","supporting_quote":null,"technology_involved":["booking website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17aba0ad97a8f6981bbc01d33044220b356d4c90","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5314156f1f29","org_name":"Light's Hope","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Light's Hope","type":"hibp","url":"https://haveibeenpwned.com/Breach/LightsHope"}],"summary":"Light's Hope reported a breach affecting 30,484 users, exposing personal information and passwords stored as bcrypt hashes.","supporting_quote":null,"technology_involved":["World of Warcraft service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e42aa1f2d0aa261347e822e1bc38d3f714191b52","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"814e8a70-89ee-11e8-bc39-6bf805ebd808"},"incident_date":"2018-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"ecdc6d825c41","org_name":"Taiwan Democratic Progressive Party's (DPP)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.taiwannews.com.tw/en/news/3473203"}],"summary":"The Democratic Progressive Party's (DPP) official website was attacked by Chinese hackers early Tuesday morning, and the website was replaced with pictures and words reading \"Chinese netizens are supporting Tsai Ing-wen to run for re-election\" in simplified Chinese characters.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf58eecfcd38e5bc4e412eedca34298045733bd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ab9cba50-b634-11e8-9fc1-ef3f92dd4725"},"incident_date":"2018-07-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7452dc549144","org_name":"Sony Pictures Entertainment","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/gaming/2018/07/sony-tries-to-upload-movie-trailer-to-youtube-posts-entire-movie-instead/"}],"summary":"Sony tries to upload movie trailer to YouTube, posts entire movie instead","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"193126ef6cf410f913f6acaf7a1d39f850a3593d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/NorthColonieCentralSchoolDistrict.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8918c964a090","org_name":"North Colonie Central School District (NCCSD)","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/NorthColonieCentralSchoolDistrict.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07f838ec03fa03838e043af26f611bf024cba62f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63b9e450-0e58-11eb-ad9a-2114263f926d"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"75b63754db17","org_name":"Zoomcar","org_type":"other","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gizbot.com/news/zoomcar-data-hacked-3-5-million-user-information-for-sale-067873.html,https://thedigitalhacker.com/zoomcar-data-breach-may-2020/"}],"summary":"unknown actions used to compromise database, records found for sale two years later","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfc291c7f8f9af483725762451d928108bb5b4a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7222bb70-8c19-11e8-bfaf-f7b4555dc539"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZW","org_id":"ce5f07b73a81","org_name":"Zimbabwe Electoral Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.newsday.co.zw/2018/07/security-breach-at-zec-database-hacked/"}],"summary":"Zimbabwe Electoral Commission (Zec) chairperson Justice Priscilla Chigumba has sensationally claimed that suspected hackers recently broke into the electoral management body’s database and stole crucial information on the biometric voters’ roll, escalating fears of electoral mani","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15b0a273ea564fe7f3bf6d570321fe6434a0c716","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18f0c8e0-8abf-11e8-aafc-8b374e4aa1f3"},"incident_date":"2018-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"8af763e5d733","org_name":"Vodaphone","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/business/105436053/vodafone-information-glitch-bad-privacy-breach"}],"summary":"A Vodafone mobile customer was shocked to discover he could see a stranger's personal details when he logged into his account online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46413d3b83fef08c8850cd960e3673170a5f159b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc086300-9a44-11e8-8652-5d096cfefbb4"},"incident_date":"2018-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"ca6d994f1cbd","org_name":"Unidentified Helsinki Contraception Clinic (No Longer in Business)","org_type":"healthcare","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://yle.fi/uutiset/osasto/news/is_patient_data_found_in_helsinki_street/10325596"}],"summary":"Finnish tabloid Ilta-Sanomat reports that a trove of patient data including names and personal ID numbers has been found in the Pasila district of Helsinki. The data is from patient records from a contraception clinic from the 1980s and 1990s.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b47f6e6a6124a73048855403e5caf7e2afeae4cb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56586a40-c24f-11e8-bf07-99bafabab839"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c1e66348c42","org_name":"Tuscon Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://tucson.com/news/local/files-containing-patient-info-left-unsecured-at-tmc-healthcare-property/article_23e440ec-b2d3-11e8-adb9-a796a843c69d.html"}],"summary":"More than a thousand paper files containing patient information were left unsecured during a 2-week time frame at a storage suite on TMC HealthCare property in July.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc70ef9d7c4119420d843e355869fdb2dcf56f4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5be4e610-8e91-11e8-8003-e3ff5269fee2"},"incident_date":"2018-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a66441cf8ac2","org_name":"Thompson Health's M.M. Ewing Continuing Care Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.whec.com/news/snapchat-probe/4993990/"}],"summary":"Thompson Health says a CNA who worked there was accused of taking a picture of one of the patients without their knowledge, sending it out through Snapchat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb2c5f26947c0cbb9b7f73e94a6c09fb3802a03a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5075a9c0-9997-11e8-bb21-7f662dc72866"},"incident_date":"2018-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6a4550882cf7","org_name":"Telstra","org_type":"technology_saas","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-6001527/Im-not-tech-savvy-person-63-year-old-Telstra-user-managed-access-customer-details.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4eee156d44986985492b89cb4e085fc985d0946","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18c454b0-a629-11e8-b571-7db57cad93dd"},"incident_date":"2018-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3e48e922a31","org_name":"RoboCent","org_type":"professional_services","ransomware":null,"records_affected":2584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/robocall-firm-exposes-hundreds-of-thousands-of-us-voters-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/us-voter-data-exposed-by-robocall-firm/"}],"summary":"RoboCent, a Virginia Beach-based political robocall firm, has exposed the personal details of hundreds of thousands of US voters, according to the findings of a security researcher who stumbled upon the company's database online.  The researcher, Bob Diachenko of Kromtech Securit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"535337f4bf12891933955d5fc14fdc713b433219","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"551f3c80-8e92-11e8-8003-e3ff5269fee2"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"789827dbd35c","org_name":"Roblox","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.co.uk/news/amp/technology-44875920"}],"summary":"The BBC understands that the hacker responsible managed to subvert the California-based company's cyber-protection systems, allowing them to upload code that changed the game's rules and made customised animations appear.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38d2eb008c522f0fa668ede1c159aaf2e48cffa9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34636b20-8c16-11e8-bfaf-f7b4555dc539"},"incident_date":"2018-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"2633147a7081","org_name":"Provider One","org_type":"energy_utilities","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.freiepresse.de/chemnitz/versorger-eins-raeumt-daten-panne-ein-artikel10262154"}],"summary":"energy supplier One sends an e-mail to customers with the note that new mail is in the online service portal of the one. This is customary in business transactions when customers only carry out their contract processing, including invoice receipt, online.  The problem with this o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46133d46ca3c06378fab8b187bcf8ce2d151c8f1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6585f8e0-9430-11e8-917e-2d57f68ecfdb"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51a4e6ff4315","org_name":"Panola National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.news-journal.com/news/police/carthage-police-check-atms-after-wireless-camera-found-at-bank/article_240d4968-851c-11e8-a681-eb474f61e71d.html"}],"summary":"Carthage police have been checking ATMs for signs of skimmers after a wireless camera was found this week at a Panola National Bank ATM, Police Chief Jim Vanover said.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5194d2315030d141fa128ba1567014051a3723b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f039760-8ea7-11e8-a076-fd59426460e5"},"incident_date":"2018-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"0b4e1a0871d2","org_name":"Pacific Radiology’s Dunedin Hospital","org_type":"healthcare","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthimaging.com/topics/practice-management/radiology-employee-loses-file-data-26-patients"}],"summary":"An employee from Pacific Radiology’s Dunedin Hospital in New Zealand lost a physical paper file that held personal information of 26 breast cancer patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ccdce1f144ff7a8c1c88e5160a6775c4c2dedc","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"954d27c0-d0c0-11e8-bbbb-67b2993a8980"},"incident_date":"2018-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"422d522ed822","org_name":"Oklahoma Department of Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/phi-data-security-of-19000-toyota-employees-at-risk;"},{"fetched_at":null,"title":null,"type":"press","url":"https://newsok.com/article/5610220/oklahoma-dhs-could-have-sent-private-medical-info-to-wrong-addresses"}],"summary":"Officials at the Department of Human Services said Monday that a small number of clients were affected this year by a computer error that labeled envelopes with incorrect addresses.  A labeling error affected notices that informed patients and their guardians about changes to the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87a70ba42f2ac11f7870d56d8365ed94515a3572","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd290890-9726-11e8-8342-0f8f10fcd812"},"incident_date":"2018-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dc41228e508","org_name":"Newmark Knight Frank","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://therealdeal.com/2018/07/19/newmark-claims-former-broker-stole-trade-secrets-shared-them-with-competitor/"}],"summary":"A former broker in Newmark Knight Frank’s debt and finance group stole company information on his way out the door and then shared it with a competitor, the brokerage claims in a lawsuit.  Steven Sperandio, who started working at the firm in early 2016, violated the terms of his ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"AU","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8f2565a05f196f51baae374bb20ac6b227308f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f3604ef0-9b0f-11e8-8050-370b93adfe70"},"incident_date":"2018-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"622cca1755f7","org_name":"New South Wales Government","org_type":"government","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/triplej/programs/hack/privacy-breach-revealed-nsw-health/10062426"}],"summary":"More than 1,000 confidential medical records have been left on the floor at a derelict former aged care facility operated by the New South Wales Government.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-07-01","discovered_date":"2018-06-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a4ada3e640f746b73f266b29f6ba8c34ede8e9e0","impact_type":"data_theft","imported_from":null,"incident_date":"2018-04-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9578.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"053330a31248","org_name":"Macy's, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":162507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9578.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Macy%27s%2C%20Inc-2018-07-03"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9578.pdf"}],"summary":"An unauthorized third party used valid credentials to access Macy's customer online profiles and view personal and payment information.","supporting_quote":"Based on our investigation, we believe that an unauthorized third party, from approximately April 26, 2018 through June 12, 2018, used valid customer user names and passwords to login to customer online profiles.","technology_involved":["macys.com online profiles"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc399cde678710c17f739cb1d9e26137cec6d6c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df521780-a22c-11e8-ae61-0fc7f403e976"},"incident_date":"2018-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1846e6727f8b","org_name":"Liverpool Football Club","org_type":"other","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailystar.co.uk/news/latest-news/717555/Liverpool-FC-hacked-fans-supporters-bank-details;"},{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2018/07/21/liverpool-fcs-fan-database-hacked/"}],"summary":"A recent hack attack has affected famous football club Liverpool FC, some of their fan database has been compromised affecting 150 season ticket holders. It was confirmed by the club management that there was a security breach on one of the club administrators email accounts whic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","internal","secrets"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d634da4bf17e3a56d44a3f0fc08b222d5930a033","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c3d6abd0-9415-11e8-87f1-7302439b2762"},"incident_date":"2018-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"65144ff613ed","org_name":"Level One Robotics and Controls","org_type":"professional_services","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/massive-data-breach-exposes-huge-trove-of-automakers-secrets/article/527639;"},{"fetched_at":null,"title":null,"type":"press","url":"http://canada.autonews.com/article/20180720/CANADA/307209939/massive-data-breach-at-canadian-company-hits-several-automakers;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2018/07/20/business/suppliers-data-leak-automakers.html"}],"summary":"a security researcher came across tens of thousands of sensitive corporate documents — including many from nearly all of the largest auto manufacturers — on the open internet, unprotected. The trove included material from more than 100 companies that had interacted with a small C","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1c69333c9c36386b2398ee09b96045707993237","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad8c56b0-2291-11eb-940b-ff2256f17cee"},"incident_date":"2018-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c061354312aa","org_name":"Intuition College Savings Solutions","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/usao-ndfl/pr/former-florida-prepaid-college-program-contractor-indicted-conspiracy-mail-fraud-and"}],"summary":"Intuition College Savings Solutions employee fraudulently changed customer records to her own addresss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01237080f5e1a6c69e38e05d87b1f0379acc41c5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"193acb60-997f-11e8-b882-6b7d0605ee5d"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39d40673c994","org_name":"Idaho Department of Corrections","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/us-news/2018/jul/26/idaho-prison-hacking-ipad-transfer-credit"}],"summary":"Prison officials say 364 Idaho inmates hacked hand-held prison tablets and collectively transferred nearly a quarter million dollars worth of tablet credits","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75e57947555e885e418dab91eafcd8922c0ba4ed","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35d1ca70-c117-11e8-a33a-95e6749d3999"},"incident_date":"2018-07-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44a11ecf6750","org_name":"Guardant Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/sanfrancisco/news/2018/09/10/phishing-biotech-guardant-health-ipo-liquid-biopsy.html"}],"summary":"Phishing works","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05293b96ecb3d5928c228ce07a71cccb14ea6e7d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"0cddda21d3c6","org_name":"Gaadi","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gaadi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gaadi"}],"summary":"Gaadi had 4,261,179 records exposed in a 2015 data breach, including personal information and passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d120c5a76db7fc71d33a4ee37c308dc1f674e078","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a8b4f5b0-027d-11e9-aee0-f7420d4f3238"},"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f8ac91adc23","org_name":"Envision Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20V889_v03_0.pdf"}],"summary":"Envision Healthcare Corporation is committed to maintaining the privacy and security of the information provided to us. Based on our records, you may be a former or current provider with Envision or one of its affiliates (“Envision”), or you may have applied or been considered fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c717f600999f33e852486d431f17581d738d6ad","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1d53cd90-aef6-11e9-82a5-498009bfd296"},"incident_date":"2018-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"109fd8b59d41","org_name":"Blueport Wireless","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.capecodtoday.com/article/2019/02/05/244691-Brockton-Man-Charged-Computer-Fraud-and-Abuse;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.capecodtoday.com/article/2019/07/22/247857-Brockton-Man-Sentenced-Prison-Violation-Computer-Fraud-And-Abuse-Act"}],"summary":"A Brockton man was indicted today in federal court in Boston in connection with an August 2018 computer intrusion of a Massachusetts company.  Colby Anderson, 25, was indicted on one count of intentionally causing damage to a protected computer without authorization. In October 2","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0601efb623210137066f0614946dd7ba8f03f7f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18254940-8ac4-11e8-aafc-8b374e4aa1f3"},"incident_date":"2018-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5caf20fc966f","org_name":"BHP Minerals","org_type":"other","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.miningmonthly.com/sustainability/international-coal-news/1342464/employee-privacy-breach-at-bhp-causing-union-outrage"}],"summary":"CFMEU president Tony Maher said a problem with BHP's payroll system has resulted in pay as you go payment summaries being emailed to incorrect email addresses and employees inadvertently being given access to other workers' employment and tax records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7a27cd899a8d200e822df484d7c574156f7b2b3","impact_type":"data_theft","imported_from":null,"incident_date":"2018-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"DE","org_id":"d9c1c806c685","org_name":"8fit","org_type":"technology_saas","ransomware":null,"records_affected":15025407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 8fit","type":"hibp","url":"https://haveibeenpwned.com/Breach/8fit"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/13713"}],"summary":"A July 2018 data breach at 8fit exposed email addresses, names, genders, geographic locations, IP addresses, and bcrypt-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66c146168c51829a75933db685641d93365ff5cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"abe780e0-9725-11e8-8342-0f8f10fcd812"},"incident_date":"2018-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"1b0e74ff3923","org_name":"Unidentified Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/x0rz/status/1013167917448523776"}],"summary":"unsupervised & unlocked computers sitting in an open hallway. Screens showed names + medical data of patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8fe5a971b5074e248ad65aca9bedcb5a82b45be","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7b1d5ab0-d317-11e8-91e9-41882cf52742"},"incident_date":"2018-06-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48e27dcf60ec","org_name":"Fetal Diagnostic Institute of the Pacific","org_type":"healthcare","ransomware":true,"records_affected":40800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fetal-diagnostic-institute-of-the-pacific-notifies-40800-patients-after-ransomware-attack/"}],"summary":"Fetal Diagnostic Institute of the Pacific notifies 40,800 patients after ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-06-29","discovered_date":"2018-06-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"56dc303b17c66e52befd3f4e4d92fe79b0128144","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9577.pdf"},"notes":null,"org_country":"US","org_id":"5eb434b42670","org_name":"Northwest University","org_type":"education","ransomware":null,"records_affected":1434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9577.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9577.pdf"}],"summary":"Northwest University reported that an unauthorized third party accessed documents containing personal information through an employee’s email account and inbox.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-29","discovered_date":"2018-05-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4583b7c338e1c9b9f2eb8b7c0158d5f5b7c056e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/062718%20Breach%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"78fbb6d8fb60","org_name":"East Bay Municipal Utility District","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137582"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/062718%20Breach%20Notification_0.pdf"}],"summary":"The District notified employees that unauthorized individuals may have accessed the third-party hosting environment for its Marconi application, which held employee information.","supporting_quote":null,"technology_involved":["Marconi application","Marconi application database","ersquared.org hosting environment"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-29","discovered_date":"2018-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"510fd33185629b4ae9f2f4f78fe517b4bf88a13f","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/City%20of%20Oxnard%20-%20CA%20Notice%20%287511034x7AB84%29_0.pdf"},"notes":null,"org_country":"US","org_id":"2ee4bf8a3ce8","org_name":"City of Oxnard","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137586"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/City%20of%20Oxnard%20-%20CA%20Notice%20%287511034x7AB84%29_0.pdf"}],"summary":"The City of Oxnard notified customers that information entered into its Click2Gov utility payment system may have been accessed.","supporting_quote":null,"technology_involved":["Click2Gov (Superion)"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Superion"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"a9f1fff54112","name":"Superion"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b984837c3c561cd2f47f2ee572c0aa8d59fb66e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc1611b0-a162-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-06-28","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0bc24395db67","org_name":"South Eastern Regional College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.belfasttelegraph.co.uk/news/northern-ireland/regional-college-staffs-personal-data-at-risk-after-massive-security-breach-37065332.html"}],"summary":"A data breach at one of Northern Ireland's largest further education colleges has put the personal and financial data - including bank account numbers and sort codes - of hundreds of staff at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb1456c6f04ac66e23d54c5b693c6fcec908b81c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc99fbd0-a16f-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-06-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8442eee96b44","org_name":"Middletown School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courant.com/community/middletown/hc-news-middletown-school-ransomware-20180629-story.html"}],"summary":"The Middletown school district is working to restore access to its computer systems after discovering a ransomware virus Thursday that had locked the staff out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2018-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"545b2aac667e581e79bb4344a889346087b5b0ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"862c6310-a158-11e8-8944-973f074c04dd"},"incident_date":"2018-06-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"194e419086c2","org_name":"Gentoo Github","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/linux/file-wiping-malware-placed-inside-gentoo-linux-code-after-github-account-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2018/07/gentoo-repository-compromised-due-to-weak-admin-password/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2018/06/29/linux-distro-hacked-on-github-all-code-considered-compromised/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://archives.gentoo.org/gentoo-announce/message/dc23d48d2258e1ed91599a8091167002"}],"summary":"The Gentoo Linux project has finished investigating the hacking last week of its GitHub-hosted package repository, an incident that resulted in attackers distributing malicious code to users. The point of entry turned out to be a weak admin password that was probably guessed than","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93a093054d855c376093cebf8d2a999f4b89d3da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f218e420-a57e-11e8-b571-7db57cad93dd"},"incident_date":"2018-06-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"aa67c8bc2500","org_name":"SingHealth","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/singapore/personal-info-of-15m-singhealth-patients-including-pm-lee-stolen-in-singapores-most;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/singapore/singhealth-data-leak-committee-of-inquiry-to-probe-cyber-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/singhealth-sends-text-messages-to-patients-affected-by-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://theindependent.sg/govt-reveals-singhealth-data-hack-half-a-month-after-discovering-breach-yet-sph-says-govts-response-to-hack-is-lauded/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.todayonline.com/singapore/singhealth-breach-work-sophisticated-and-state-linked-hacking-group-iswaran"}],"summary":"In Singapore’s worst cyber attack, hackers have stolen the personal particulars of 1.5 million patients. Of these, 160,000 people, including Prime Minister Lee Hsien Loong and a few ministers, had their outpatient prescriptions stolen as well.  The hackers infiltrated the compute","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"44ccb424060a574fd1854ab2a59de1be03b0b3a4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ElmcroftSeniorLivingInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5ae05bab9cf6","org_name":"Elmcroft Senior Living, Inc.","org_type":"unknown","ransomware":null,"records_affected":1037,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ElmcroftSeniorLivingInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c19080b92bfd21cdb7c92523a44a646b95c8430","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ThomasChandlerThomas.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"924b3a54b272","org_name":"Thomas Chandler Thomas & Hinshaw, LLP","org_type":"unknown","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ThomasChandlerThomas.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-06-26","discovered_date":"2018-04-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38f617b372134134d4f02446b4b9345079006b24","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-02-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Amgen%20Data%20Subject%20Notice%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"222e313ddb83","org_name":"Amgen, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137458"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Amgen%20Data%20Subject%20Notice%20FINAL_0.pdf"}],"summary":"Amgen notified people that personal information held by WTW may have been exposed in a phishing incident.","supporting_quote":"On April 23, 2018, we received a letter from WTW informing us that they had suffered a phishing incident that led to a breach of security and the potential unauthorized disclosure of personal information on February 21, 2018.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"WTW"},"updated_at":"2026-10-10","veris_action":"social","derived":{"vendors":[{"id":"b1bc3cce0d99","name":"WTW"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da50a362906a6bb2ac9fbd7aa6a54f56e99356e8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Experian_D9225_Notice%20letter%20for%20Batch%207%20-%20all%20U.S.%20except%20Mass_1954137_...-c_0.PDF"},"notes":null,"org_country":"US","org_id":"84d9809725d9","org_name":"Hasbro","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138767"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Experian_D9225_Notice%20letter%20for%20Batch%207%20-%20all%20U.S.%20except%20Mass_1954137_...-c_0.PDF"}],"summary":"Hasbro reported a targeted incident that may have involved access to personal data, with no evidence that the data was misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcc55e7b213f912b0bd8a6f8f37f72d90b7f6ba2","impact_type":"unknown","incident_date":"2018-01-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_26.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137386"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138035"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"da18fd26c9a5636ba607f5b05592a1e29047212d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/CaptivaMVPRestaurantPartnersLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e6780adc6af","org_name":"Captiva MVP Restaurant Partners, LLP (PDQ)","org_type":"unknown","ransomware":null,"records_affected":91296,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/CaptivaMVPRestaurantPartnersLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-06-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"926e38aa9af12f23dd292d7cf20ce49ea43498ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9576.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"81cd1a526e0d","org_name":"Terteling Company, Inc.","org_type":"other","ransomware":null,"records_affected":941,"reviewed":false,"root_cause":"Employees clicked a malicious phishing email because they believed it was legitimate.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9576.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9576.pdf"}],"summary":"Terteling Company and affiliated businesses reported that employees clicked a phishing email that may have allowed an external hacker to access business email accounts and potentially access personal, payroll, and health plan information.","supporting_quote":"Thinking that this email was legitimate, some employees clicked on the content in the email.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"150c84bc7af1c09f031e1694fd4dd5ee45df961b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f1178b00-972b-11e8-8342-0f8f10fcd812"},"incident_date":"2018-06-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"4a3e520d9359","org_name":"Kerry Group","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.irishexaminer.com/breakingnews/ireland/court-hears-kerry-group-worker-alleged-to-have-stolen-sensitive-information-on-brewing-ingredients-854507.html"}],"summary":"Mr Oliveira has acted in breach of restrictive covenants in his contract of employment.  He had come into the company premises on June 23 last with a suitcase and backpack and there is concern property of the company may have been taken, counsel said. A filing cabinet had been em","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-22","discovered_date":"2018-03-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa552e31ba927e75b2f4a69ca37f7b3575a8d6d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event%20Packet_0.pdf"},"notes":null,"org_country":"US","org_id":"d62077244800","org_name":"Tuskegee University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137340"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event%20Packet_0.pdf"}],"summary":"Tuskegee University reported that phishing led to unauthorized access to faculty and staff email accounts containing personal information.","supporting_quote":"Tuskegee was the victim of an email phishing attack which resulted in unauthorized access to certain faculty and staff email accounts between September 24, 2017 and March 22, 2018.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d84dad15b21fefe80297cd05844e88d28590fa3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"888f2c10-a175-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-06-22","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93db193bc895","org_name":"Innate Therapeutics","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thedailybeast.com/chris-collins-new-york-congressman-charged-with-insider-trading"}],"summary":"Rep. Chris Collins (R-NY) was arrested Wednesday on federal charges of insider trading for allegedly using his position at a pharmaceutical company to leak information to his son, who then used it to dump company stock before it crashed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc89eb06584cf98d67c917932d7cad16099725ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12679140-8aae-11e8-874b-dd84fb61b260"},"incident_date":"2018-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53744f3a8334","org_name":"Pennsylvania Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcall.com/news/nationworld/pennsylvania/mc-nws-pennsylvania-birth-certificate-system-hacked-20180713-story.html"}],"summary":"Pennsylvania Department of Health’s birth certificate system was shut down for nearly a week last month after someone hacked into an internal website but did not take or alter citizens records, a government spokesman said Friday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17c2117208a9e9ea4c7ee9a0c6149c799e77e0c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d8f3cd0-c25b-11e8-bf07-99bafabab839"},"incident_date":"2018-06-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"69953cce4bb9","org_name":"Cleveland UK Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.co.uk/news/uk-england-tees-44738313"}],"summary":"A police file containing personal details of paedophiles and their victims was found dumped in the street.  The notes, containing highly sensitive pages with information identifying people in several cases, were discovered by a Hartlepool dog walker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-06-19","discovered_date":"2018-04-17","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7877696d91c166a77d1ca662a11a33e46345afc","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20180529%20TN%20SKIMMER%20CA%20OPP_0.pdf"},"notes":null,"org_country":"US","org_id":"c69bcb0a64bc","org_name":"Walgreens","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137216"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20180529%20TN%20SKIMMER%20CA%20OPP_0.pdf"}],"summary":"Walgreens discovered unauthorized skimming devices attached to point-of-sale pin pads at two Nashville locations, potentially exposing customers’ payment card details and names.","supporting_quote":"On April 17, 2018, Walgreens discovered unauthorized skimming devices attached to a point-of-sale pin pad in two Nashville Rite Aid locations owned and operated by Walgreens, specifically at 2416 West End Avenue and 700 Gallatin Road.","technology_involved":["point-of-sale pin pad"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-19","discovered_date":"2018-05-25","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cab1ea1029832fc888aeccc43c5048efdca66c2b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"552f72b41dde","org_name":"Relay Resources","org_type":"unknown","ransomware":null,"records_affected":11468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Relay%20Resources-2018-06-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6784b059371f8cf42ccbbc7b0d3c3fb3aa26e34d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RegencyDataBreachAllClear_0.pdf"},"notes":null,"org_country":"US","org_id":"0ea02bb8a295","org_name":"Regency Theatres","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137238"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RegencyDataBreachAllClear_0.pdf"}],"summary":"Regency Theatres reported that an unauthorized third party accessed information provided for ticket-purchase accounts on its website in January 2018.","supporting_quote":null,"technology_involved":["www.regencymovies.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"49db15fe37f94b957260c91f361f542a5a59149c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/GreatBancTrustCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d944ce143aa","org_name":"GreatBanc Trust Company","org_type":"unknown","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/GreatBancTrustCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ada14312644a23ac8049142eb2b769dbe2f795ee","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cb269d10-8929-11e8-8760-271b3d9edf6d"},"incident_date":"2018-06-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"ab1d84fab9bb","org_name":"Euskirchen Prison","org_type":"government","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nrz.de/politik/haeftlinge-finden-usb-stick-mit-daten-der-jva-mitarbeitern-id214750383.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ksta.de/region/euskirchen-eifel/euskirchen/jva-euskirchen-nrw-justizministerium-ueber-datenpanne-massiv-veraergert-30728106?dmcid=f_feed_K%C3%B6lner%20Stadt-Anzeiger"}],"summary":"From Euskirchen Prison, sensitive data about the law enforcement officers may have come into the hands of inmates. A JVA staff should have pulled personal data on a USB stick and have lost it in the parking lot, said a spokesman for the NRW Justice Department on Tuesday in Dussel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aae81ec0d5dbb1b7c2575ef6a8583abab790373","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebdaece0-0a0c-11ea-9e73-f15207d33dcb"},"incident_date":"2018-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b60dd9cac5db","org_name":"Utah Valley Eye Center","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kutv.com/news/local/system-at-utah-valley-eye-center-hacked-info-breached,https://healthitsecurity.com/news/american-cancer-society-finds-e-skimming-malware-on-store-website"}],"summary":"Utah Valley Eye Center web application hacked and customer emails used to Paypal targeting","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bc0af5d68368b2ed66b34931df3fe4c1de764de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e970d2e0-8a8c-11e8-ba1e-e3857583ba43"},"incident_date":"2018-06-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0004feca279f","org_name":"Purdue University","org_type":"education","ransomware":null,"records_affected":26865,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2018/07/14/purdue-university-suffered-data-breach-exposing-more-than-26000-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc7chicago.com/education/purdue-tracking-down-26k-applicants-following-data-breach/3759763/"}],"summary":"Purdue University is tracking down more than 26,000 prospective students to alert them that their names, birthdays, and Social Security numbers were inadvertently sent to the parent of one student applicant.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2018-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddfa5604155ed569608d1777236b5359d3390891","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"901a17f0-a0a4-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42e8fe264d0d","org_name":"Southern College of Optometry","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ago.vermont.gov/blog/2018/07/25/southern-college-of-optometry-security-breach-notice-to-consumers/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-15","discovered_date":"2018-06-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc788de2d702f26f4d40983e1863f7c6e9f1e8b4","impact_type":"data_theft","incident_date":"2017-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"6492254ae20d","org_name":"MyHeritage","org_type":"technology_saas","ransomware":null,"records_affected":92283889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyHeritage","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyHeritage"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137155"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification_2.pdf"}],"summary":"MyHeritage reported that email addresses and hashed passwords for 92,283,889 users were found on a private server outside the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df7343511a15a6632ae20629330c6d448b288b3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fb72ebc0-a16d-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-06-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"17cfeeb7a1c9","org_name":"Amicus Health","org_type":"healthcare","ransomware":null,"records_affected":258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.devonlive.com/news/devon-news/anger-after-data-hundreds-patients-1732193"}],"summary":"Anger after data of hundreds of patients at GP practice is sent out in post - Clare House Surgery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-14","discovered_date":"2018-06-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b90920c93e71e47b5eda6f4dc8be8677672963a5","impact_type":"data_theft","incident_date":"2018-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Reddit%20breach%20notice%20%28email%29_0.pdf"},"notes":null,"org_country":"US","org_id":"91b7afdd86e6","org_name":"Reddit","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-139569"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theinquirer.net/inquirer/news/3036958/reddit-data-breach-2018;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/reddit-discloses-a-breach/"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Reddit%20breach%20notice%20%28email%29_0.pdf"}],"summary":"Reddit reported that an attacker accessed usernames and salted password hashes associated with accounts from 2007.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-14","discovered_date":"2018-04-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d47f8255a4489b51b347737c5e251b466af34b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/POPSUGAR%20Notice%20of%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"e2a1906a0572","org_name":"POPSUGAR Inc.","org_type":"other","ransomware":null,"records_affected":123857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137129"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/POPSUGAR%20Notice%20of%20Data%20Breach_0.pdf"}],"summary":"POPSUGAR discovered that an unauthorized third party accessed account credentials and user information, including names, email addresses, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7563549eba524ecaba508c32946b4da335c4601","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6d56f60-8924-11e8-8760-271b3d9edf6d"},"incident_date":"2018-06-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e04c7e7a464c","org_name":"Mickey’s Convenience Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kdhnews.com/news/local/skimming-device-found-at-copperas-cove-convenience-store/article_dfc4037e-7be7-11e8-bd8c-2fbbd3bd4fa6.html"}],"summary":"A skimming device was discovered on two Copperas Cove gas pumps at Mickey’s Convenience Store at 2101 E. Business Highway 190 on June 20, police announced on Friday.  The devices were located on Pump #1 and Pump #18, and the investigation from Copperas Cove (TX) Police Department","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c1199da35b92df2d578a8c8e92856026836abd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a4dd5350-c25f-11e8-bf07-99bafabab839"},"incident_date":"2018-06-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"eb577926b349","org_name":"Anna Sanjivini Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.huffingtonpost.in/2018/06/17/andhra-pradesh-tracked-you-as-you-bought-viagra-then-put-your-name-and-phone-number-on-the-internet-for-the-world-to-see_a_23459943/"},{"fetched_at":null,"title":null,"type":"press","url":"https://inc42.com/buzz/no-privacy-for-your-medications-in-andhra-pradesh/"}],"summary":"An unsecured dashboard on the Anna Sanjivini website allowed anyone with an internet connection to access the names and phone numbers of everyone who has bought medicines from every single such store.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-13","discovered_date":"2018-06-07","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97b4ef122396e86c71b756e37d92189d1789ab6b","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Confidential%20Security%20Alert_0.pdf"},"notes":null,"org_country":"US","org_id":"67cbf5598977","org_name":"AAA Business Supplies","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137064"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Confidential%20Security%20Alert_0.pdf"}],"summary":"AAA Business Supplies reported compromised accounting email addresses and attempts to redirect payments, with no known financial impact to customers or vendors.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e575f1d3ee5cf1256bc0755bc081fb723b22ba9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b2a2b90-9046-11e8-8b32-9bc4732308c2"},"incident_date":"2018-06-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca7bdcac4382","org_name":"Susquehanna County Emergency Management","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myhometowntoday.com/news/national/statewide/regional-news/local-news/susquehanna-county-pa/susquehanna-emergency-management-official-charged-with-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.pressconnects.com/story/news/public-safety/2018/07/12/susquehanna-county-emergency-management-robert-thatcher-identity-theft-fraud/779162002/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thetimes-tribune.com/news/ex-ema-director-charged-with-stealing-identity-of-former-co-worker-1.2361110"}],"summary":"The former director of the Susquehanna County Emergency Management Agency has been charged with identity theft. Robert Thatcher is alleged to have to have used the identity of a former employee to make online purchases with the invoices directed to his emergency management agency","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7302b39525d30efe520324b760faa60a1a3f93a7","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-06-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"EE","org_id":"3cf8f47b2d21","org_name":"Estonian Citizens","org_type":"other","ransomware":null,"records_affected":655161,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Estonian Citizens (via Estonian Cybercrime Bureau)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Estonia"}],"summary":"A dataset containing 655,161 email addresses and passwords associated with Estonian citizens was made searchable, and police suspected the credentials were being used to access online accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-06-11","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c06a55bc145dbf15464860e042cb65c67d7811c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-28","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NYDOCS01-%239077761-v1-Denise-Bowden---AG-Notification-Letter---CA_0.PDF"},"notes":null,"org_country":"US","org_id":"2101ba713688","org_name":"Denise M. Bowden","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136994"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NYDOCS01-%239077761-v1-Denise-Bowden---AG-Notification-Letter---CA_0.PDF"}],"summary":"A burglary at Denise M. Bowden’s office involved a computer containing patient contact and limited health information that may have been disclosed.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-08","discovered_date":"2018-05-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"05625d4c0c366ce4781c1b627a11cee718035c93","impact_type":"unknown","incident_date":"2018-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15355a0d8001","org_name":"State Accident Insurance Fund Corporation","org_type":"unknown","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#State%20Accident%20Insurance%20Fund%20Corporation-2018-06-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-08","discovered_date":"2018-02-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6474607bed341dd395df6ac1450dc1ac2f59b716","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Manduka%20--%20CA%20AG%20--%20Update_1.pdf"},"notes":null,"org_country":"US","org_id":"2a0cc9e55e7b","org_name":"Manduka","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136968"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Manduka%20--%20CA%20AG%20--%20Update_1.pdf"}],"summary":"Manduka reported malware on its e-commerce platform that affected customers’ payment card information during two periods in 2017 and 2018.","supporting_quote":null,"technology_involved":["e-commerce web platform","Magento"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2018-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"766af7f48eba6ada68e9a8526dfa21ee7274da25","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93233be0-a9fd-11e8-a274-afc3aa8c5110"},"incident_date":"2018-06-08","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b797639b91b5","org_name":"InterAct of Michigan, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1291,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/interact-of-michigan-phishing-attack-exposes-phi-on-1290-people"}],"summary":"On June 8, 2018, InterAct of Michigan, Inc. (“InterAct”) became aware that an unauthorized third party obtained access to an InterAct e-mail account.  On July 30, 2018, InterAct determined that the e-mail account contained certain of its clients’ personal information including th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c6911228f90b3cd7877018853f2de898f107711","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77735fe0-8f47-11e8-a74f-e5450456a5bf"},"incident_date":"2018-06-07","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6f847aa765e","org_name":"University of Pittsburgh Medical Center","org_type":"healthcare","ransomware":null,"records_affected":790,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wellsvilledaily.com/news/20180716/strongupmc-cole-notifies-patients-of-personal-data-breachstrong"}],"summary":"UPMC Cole has notified 790 patients treated at UPMC Cole that their personal information may have been inappropriately accessed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42e12e58b8372bfc01a203e114b6e84bcf28093c","impact_type":"unknown","incident_date":"2018-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LEGAL%2036547669v1%20Systeme%20-%20State%20AG%20Notice%20-%20California_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b686ea0a732e","org_name":"Systeme Software, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136923"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f249615405415d945836b275a4782037e6a59194","impact_type":"data_theft","imported_from":null,"incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a2179dc69a69","org_name":"Linux Forums","org_type":"other","ransomware":null,"records_affected":275785,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Linux Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/LinuxForums"}],"summary":"A breach of the Linux Forums website disclosed email addresses, usernames, IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"109404d34b0ab7913babd48540741cda9eba42b5","impact_type":"data_theft","imported_from":null,"incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"SG","org_id":"60c4b2a8a94a","org_name":"Creative Technology","org_type":"technology_saas","ransomware":null,"records_affected":483015,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Creative","type":"hibp","url":"https://haveibeenpwned.com/Breach/Creative"}],"summary":"A breach of Creative Technology’s vBulletin forum disclosed email addresses, usernames, IP addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-07","discovered_date":"2018-03-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3823ac6b188a4d01e436531e36cfc7769ca6450d","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aimbridge%20Hospitality%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhitbit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"6fd61df9be74","org_name":"Aimbridge Hospitality Holdings, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136921"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aimbridge%20Hospitality%20Holdings%2C%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhitbit%201%20-%20CA_0.pdf"}],"summary":"Aimbridge Hospitality identified unauthorized access to certain employee email accounts and emails accessible to unauthorized individuals.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-07","discovered_date":"2018-03-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"31d68299a2265f4169d050451ba716fc628cda40","impact_type":"unknown","incident_date":"2018-01-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d166da526e50","org_name":"Aimbridge Employee Service Corp.","org_type":"unknown","ransomware":null,"records_affected":29941,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aimbridge%20Employee%20Service%20Corp.-2018-06-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-07","discovered_date":"2018-04-15","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f34c616f5cfc82aafa22ce76bb13e42d1881cbe","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Angelica%20-%20Sample%20Notification%20Letter%20for%20California%201_0.pdf"},"notes":null,"org_country":"US","org_id":"935264bec62e","org_name":"9W Halo OpCo L.P. d/b/a Angelica","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136910"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Angelica%20-%20Sample%20Notification%20Letter%20for%20California%201_0.pdf"}],"summary":"Angelica inadvertently emailed attachments containing multiple employees’ 2017 W-2 forms to former employees who had requested their own forms.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-06","discovered_date":"2018-03-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"384e006bd045c2e9de38fc09ab9a1cd31786c3cf","impact_type":"unknown","incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0da9268ba7d0","org_name":"Holland Eye Surgery and Laser Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Holland%20Eye%20Surgery%20and%20Laser%20Center-2018-06-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-06-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6628ea5eb1f363e0dbb27d1ea6044d63d6a66230","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22879440-c26b-11e8-bf07-99bafabab839"},"incident_date":"2018-06-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"cfaa907d6433","org_name":"AcFun","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globaltimes.cn/content/1106860.shtml"}],"summary":"Hackers attacked a popular Chinese video-sharing site, breaching millions of private data including encrypted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a397cb03e060f66c78b1d6f7fada073cf8fd15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ed289a0-9cbb-11e8-ace0-d908cba85008"},"incident_date":"2018-06-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76cfb15636bf","org_name":"SalesForce","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/salesforce-warns-customers-of-data-leak-caused-by-api-error/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/salesforce-com-warns-marketing-customers-of-data-leakage-snafu/134703/"}],"summary":"Cloud behemoth Salesforce.com is warning customers about an API error that may have leaked data for some users of its Marketing Cloud offering.  The issue was in play between June 4 to July 18,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-04","discovered_date":"2018-05-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91473ba7a1ea5cb8c329cb649627254f15b262e5","impact_type":"data_theft","incident_date":"2018-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PLAE%20Notification%20Letter%20-%20052918%20FINAL_for%20state%20regulators_0.pdf"},"notes":null,"org_country":"US","org_id":"3bf5aeacbedc","org_name":"PLAE","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PLAE%20Notification%20Letter%20-%20052918%20FINAL_for%20state%20regulators_0.pdf"}],"summary":"PLAE reported that an attacker scraped information entered by website visitors in real time, potentially exposing customers’ personal and credit card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-04","discovered_date":"2018-04-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3be01f9fe87b6c40465535068adf6d99e7812ccd","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LGL-11189-A_FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"fe9a6eb62339","org_name":"Edward D. Jones & Co, L.P.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136767"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LGL-11189-A_FINAL_0.pdf"}],"summary":"PricewaterhouseCoopers LLP mistakenly provided an Edward Jones client file to another financial services company through an online portal, where one employee accessed or downloaded it.","supporting_quote":null,"technology_involved":["online portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"PricewaterhouseCoopers LLP"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"ff01fffeb210","name":"PricewaterhouseCoopers LLP"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-04","discovered_date":"2018-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57ed72d5f66af4797063d81786de2393de282a6b","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_U811_v02_0.pdf"},"notes":null,"org_country":"US","org_id":"7cf7c9670a59","org_name":"City of Thousand Oaks","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136764"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_U811_v02_0.pdf"}],"summary":"An unauthorized individual may have accessed a vendor computer used to process City of Thousand Oaks payment transactions, potentially exposing information entered into the Click to Gov payment system.","supporting_quote":null,"technology_involved":["Click to Gov","online payment system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"717182c8adcd6452dbb0753ed37288199f6683ec","impact_type":"both","imported_from":null,"incident_date":"2018-05-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5681d58b39ec","org_name":"Ticketfly","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ticketfly","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ticketfly"}],"summary":"An attacker defaced Ticketfly’s website, took it offline, and posted data including email addresses, names, physical addresses, and phone numbers.","supporting_quote":null,"technology_involved":["Ticketfly website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2018-06-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"340d0c205928f95830e33c8506722a20c1c7a2bd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad9a4f90-89b4-11e8-9447-19cb9b621008"},"incident_date":"2018-06-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/humana-web-sites-hit-by-sophisticated-data-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/payer-issues/humana-suffers-spoofing-cyberattack-on-2-of-its-websites.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/humana-go365-notification-letter-7-4-18.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-143482"}],"summary":"Health insurer Humana has notified an undisclosed number of members about a data breach after it uncovered a sophisticated cyber spoofing attack on the Humana.com web site and its Go365.com wellness site.  The attack, discovered on June 3, apparently came from one or more undiscl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":"Nathalie Collins","variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eb4ac3e79d2cccde93743b9c3dceee3a94d00b5","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_1.pdf"},"notes":null,"org_country":"US","org_id":"4a63b2fe91d7","org_name":"Hair Free Forever","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee stole personal and confidential information from patient files and the database.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136762"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_1.pdf"}],"summary":"A former employee stole personal and medical information from Hair Free Forever patient files and its database.","supporting_quote":"Unfortunately, one of our former employees; Nathalie Collins, stole personal and confidential information from our patient’s files and data base, which is a violation of HIPAA and other privacy laws.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"actor_id":"nathaliecollins"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c84ec979771abb0cf15975c9998e6ea1f7dac9e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a126a5e0-c8f8-11e9-b2db-f769187145bf"},"incident_date":"2018-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"90cba32e53b4","org_name":"Zhaoping","org_type":"technology_saas","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kr-asia.com/two-ex-employees-from-chinese-online-recruitment-platform-zhaoping-on-trial-for-massive-personal-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://technode.com/2019/07/11/zhaopin-employees-resume-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&cad=rja&uact=8&ved=2ahUKEwjAqYj816PkAhUVrp4KHZVoDecQFjADegQIABAB&url=https%3A%2F%2Fsearchinform.com%2Fnews%2Fworld-news%2F2019%2F07%2F11%2F160000-cvs-leaked-to-taobao-by-zhaoping-ex-employees%2F&usg=AOvVaw0LV4SRjEDV930or4QSNqkq"}],"summary":"Zhaoping, one of China’s biggest online recruitment platforms, confirmed on Tuesday that two now former employees were involved in a massive data leak case in which more than 150,000  CVs–written summaries of people’s education and work experience–were copied from the platform. T","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6d388014644e1f947f973fad6c3eaf80a16ae31","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0033ec30-c25d-11e8-bf07-99bafabab839"},"incident_date":"2018-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09348cfb6739","org_name":"Washington Health System","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/at-least-12-washington-health-system-employees-suspended-following-alleged-hipaa-violation.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/washington-health-system-suspends-employees-inappropriate-phi-access/"}],"summary":"Approximately a dozen Washington (Pa.) Health System employees were suspended after an internal investigation of alleged inappropriate access to patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"587a3e550fa45e40acc8dccf4b689809749ffa06","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9575.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f530f44cd4da","org_name":"Transamerica Retirement Solutions","org_type":"financial","ransomware":null,"records_affected":335,"reviewed":false,"root_cause":"Compromised third-party user credentials were used to log into Transamerica systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9575.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9575.pdf"}],"summary":"Unauthorized parties used compromised third-party credentials to access retirement plan account information through the Transamerica Retirement Solutions website.","supporting_quote":"We found no evidence of a compromise of Transamerica’s network and systems, but unauthorized parties used compromised third-party user credentials to log into Transamerica systems and access your account information.","technology_involved":["Transamerica Retirement Solutions website"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75a6475a7c0f657f3a8591e8deed13dcc0c3fe9a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"9280c08a2c6d","org_name":"Transamerica","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Compromised third-party user credentials were used to log into Transamerica systems and access account information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_2.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transamerica%2C%20including%20Transamerica%20Life%20Insurance%20Company%20and%20Transamerica%20Retirement%20Solutions-2018-06-01"}],"summary":"Unauthorized parties used compromised third-party credentials to access retirement plan online account information through the Transamerica Retirement Solutions website.","supporting_quote":"We found no evidence of a compromise of Transamerica’s network and systems, but unauthorized parties used compromised third-party user credentials to log into Transamerica systems and access your account information.","technology_involved":["Transamerica Retirement Solutions website"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c752c0e6998888c1d5edb0c4bdee2e30b5539e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29484280-b63a-11e8-b56a-011002460f8b"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"343eae463354","org_name":"TDECU","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thefacts.com/free_share/article_127e310c-64ee-572e-a04c-5d1fb2c40e85.html"}],"summary":"Skimmers gonna skim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f65bea20d00addabcc5a6fc8a6b1922f723fb61","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73c8eac0-9192-11e8-ad4c-017f2df1a0a0"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd5821a4bd7a","org_name":"TCF Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://minnesota.cbslocal.com/2018/07/17/atm-skimming-machine-crystal/"}],"summary":"The Crystal Police Department says a skimming device is believed to have been placed at an ATM at the TCF Bank location on the 6800 block of Bass Lake Road.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8d8c3f8c0538d2f1b20f5ca8fde37f6cb9285f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8e6bf910-a170-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"5c374a2c8c3b","org_name":"Panini","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sueddeutsche.de/digital/sicherheitsluecke-bei-panini-zehntausende-private-fotos-standen-ungeschuetzt-im-netz-1.4035277"}],"summary":"the Panini publishing house is experiencing an embarrassing mistake that has made personal data and photos of tens of thousands of customers publicly available.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":"Catalin Adrian Capanu","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a046cda1fcd44524b9fc2fc3d49040071e2836e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a86fcc60-a625-11e8-b17d-c5c01e287634"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c62b58cecd5","org_name":"Marine Credit Union","org_type":"financial","ransomware":null,"records_affected":137,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kfiz.com/local-news/capanu-waives-preliminary-hearing-in-skimming-case"}],"summary":"Man charged with planting a skimming device at a Marine Credit Union.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical","derived":{"actor_id":"catalinadriancapanu"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6156f9d1f774239b399700ae7b9f5bf9a7450db","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6752d5e0-9cd1-11e8-875e-27a7b7789f98"},"incident_date":"2018-06-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"462344db6236","org_name":"Israeli Defense Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timesofisrael.com/colonel-faces-disciplinary-hearing-after-classified-papers-stolen/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.jpost.com/Israel-News/IDF-attaches-car-stolen-with-classified-document-inside-561334;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/news/431626-idf-car-files-stolen/"}],"summary":"The military advocate general called for a disciplinary hearing for the head of the IDF’s Commando Brigade, after a number of military documents were stolen from the colonel’s vehicle earlier this month, the army said on Tuesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db99aa4ac965ef6f61100ca860372c4cfbe1ec12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e033310-05ad-11ec-a755-057d35a918cc"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"96b2300407a6","org_name":"Hastings Borough Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-england-sussex-44241494"}],"summary":"Hasting Borough Council accidentally revealed all the emails in it's email list","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dd6f4e5d19a48a0723a3f81ed0d6e0187654fe5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f392a20-a624-11e8-b17d-c5c01e287634"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5377d167701","org_name":"Grant Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc6onyourside.com/news/local/medical-records-mishap-sends-confidential-information-to-westerville-woman"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/hospital-faxes-records-to-wrong-person-in-apparent-hipaa-violation"}],"summary":"An individual has been receiving faxes in error that contain the medical data of patients at Grant Medical Center.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e473ac2133d608eab9d0feacc88c38e55e256a7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80eb6e90-a226-11e8-ae61-0fc7f403e976"},"incident_date":"2018-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"47ee3c77a8f9","org_name":"GoDaddy","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/godaddy-configuration-info-exposed-on-open-s3-bucket-created-by-amazon-employee/article/787940/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://koddos.net/blog/31000-godaddy-servers-divulge-sensitive-data-due-to-a-simple-error/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.engadget.com/2018/08/09/amazon-aws-error-exposes-31-000-godaddy-servers/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.tomshardware.com/news/godaddy-data-leaked-aws-s3-buckets,37579.html"}],"summary":"31,000 GODADDY SERVERS DIVULGE SENSITIVE DATA DUE TO A SIMPLE ERROR","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abe0d831a14912e6b3b2b202c54c8d34bd07d620","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/F21%20Sample%20CA%20Claimant%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"da9e4c59f28d","org_name":"Forever 21","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136761"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137352"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/F21%20Sample%20CA%20Claimant%20Notice%20Letter_0.pdf"}],"summary":"An unauthorized third party accessed two Willis Towers Watson employees’ email accounts containing summary documents related to some Forever 21 insurance claims.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Willis Towers Watson"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"b1bc3cce0d99","name":"WTW"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60ebcdae179c3ac761ee89a11f72cf9c2e827781","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"298f0be0-cd02-11e9-a052-6392f3b8c0e8"},"incident_date":"2018-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a986c15450ca","org_name":"Flipboard","org_type":"technology_saas","ransomware":null,"records_affected":150000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itproportal.com/news/flipboard-suffers-user-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mashable.com/article/flipboard-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2019/05/29/flipboard-confirms-it-was-hacked-twice-150m-users-at-risk-as-passwords-stolen/#296a2f756926"}],"summary":"Flipboard is the latest company to fall foul of a data breach.  The news aggregation app announced in a post that it had identified unauthorized access of some of its internal systems, which contained some Flipboard users' account information and credentials.  For more than nine ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdb21464c0310eda125faa723e7942cf2d72d5ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d4ced90-89c8-11e8-b658-d333758cf8bc"},"incident_date":"2018-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"485f0df9cc7b","org_name":"Cyanweb Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.crn.com.au/news/perth-web-hosting-provider-cyanweb-solutions-hit-by-criminal-hacking-data-and-backups-lost-496455;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyanweb.com.au/"}],"summary":"Digital marketing and web provider Cyanweb Solutions lost nearly all customer data and backups after a “criminal hacking incident” that compromised one of its servers last week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbbfd574b0e4956448cb878e4035edc56488e3a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad362d70-9cb6-11e8-ace0-d908cba85008"},"incident_date":"2018-06-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc6ee88659cf","org_name":"Connecticut Higher Education Trust","org_type":"education","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcconnecticut.com/news/local/14-Million-Stolen-from-CHET-Accounts-During-Security-Breach-486719591.html"}],"summary":"Nearly $1 million was stolen from CHET -- Connecticut Higher Education Trust -- accounts during a security breach and 21 account holders were affected, according to the Office of the State Treasurer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"810ea51c36be726a1240af3c9edabab90491982a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21c55950-89ce-11e8-bc39-6bf805ebd808"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bbf5bf975031","org_name":"Cleveland Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/6695880/secret-police-dossier-of-paedophiles-and-victims-found-dumped-in-a-skip/"}],"summary":"A SECRET police dossier containing personal details of paedophiles and their victims has been found dumped in a street in Hartlepool [UK].","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-06-01","discovered_date":"2018-04-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ed789e307f002df2d5fe3a1c693d803dfeb08351","impact_type":"unknown","incident_date":"2018-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22e6365ddbc6","org_name":"City of Portland","org_type":"unknown","ransomware":null,"records_affected":837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#City%20of%20Portland-2018-06-01"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2c2e4329b3cb1ce451bedd7bef36f9432a3f552","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b3da8ef0-a23d-11e8-ae61-0fc7f403e976"},"incident_date":"2018-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a112e3b1e731","org_name":"Brooke Army Medical Center","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://foxsanantonio.com/news/local/man-accused-of-stealing-credit-card-card-readers"}],"summary":"A man is behind bars, accused of stealing a credit card, check and two credit card readers.  Abelardo Arellano is facing fraud charges.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-05-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9155ceaa20fb5ad678848e48ffe4cab87364989c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"831a94f0-fe7b-11e8-aee0-f7420d4f3238"},"incident_date":"2018-05-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b89bed4c0cf","org_name":"CNO Financial Group","org_type":"financial","ransomware":null,"records_affected":566127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/health-data-breach-compromised-phi-on-566k-cno-customers;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankerslife.com/security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/bankers-life-hack-affects-more-than-566000-a-11691;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.informationsecuritybuzz.com/expert-comments/bankers-life-data-breach-exposes-566127-people/"}],"summary":"On October 25, Fortune 1000 company CNO Financial Group, Inc. submitted a report to the Office for Civil Rights’ Breach Portal at the U.S. Department of Health and Human services. The report revealed that the personally identifiable information of 566,127 people was accessed by a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a874f904d1c33342e4fbdb968b8f9682f5b2fa38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"546c9570-aa09-11e8-a274-afc3aa8c5110"},"incident_date":"2018-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2018/06/26/facebook-sends-weekly-app-emails-to-wrong-people/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/facebook-notifies-800000-users-blocking-bug"},{"fetched_at":null,"title":null,"type":"press","url":"http://money.cnn.com/2018/06/07/technology/facebook-public-post-error/index.html"}],"summary":"Facebook sends weekly app emails to wrong people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2018-05-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d3955c771c739563ff9cb1ce87421d31c674898","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"250973d0-a0a3-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-05-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd20979ec055","org_name":"San Francisco's Institute on Aging","org_type":"professional_services","ransomware":null,"records_affected":3908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/IoA%20-%20California%20AG%20Notification%20Letter_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.sfchronicle.com/business/article/Data-breach-at-SF-s-Institute-on-Aging-may-13135575.php"}],"summary":"A May data breach at San Francisco’s Institute on Aging, a nonprofit that provides home care and other support services for seniors in the Bay Area, may have compromised the personal information of nearly 4,000 clients and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8a03076b63c081eae54d05beb22344f4d55c001","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b81856f0-8e79-11e8-a4dd-a79288b2b9fd"},"incident_date":"2018-05-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72587a89c196","org_name":"Associated Dermatology and Skin Cancer Clinic","org_type":"healthcare","ransomware":null,"records_affected":1254,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/associated-dermatology-and-skin-cancer-clinic-notifies-patients-after-journal-stolen-from-employees-car/"}],"summary":" Associated Dermatology and Skin Cancer Clinic of Helena notified 1,254 patients of a breach of unsecured personal patient protected health information.  On May 26, an Associated Dermatology employee learned that someone had broken into her car and taken a journal she had been ke","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db2ba79eebf4755c41f37b485757d313524ca5ed","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7d0864d0-89b8-11e8-88c8-4f24b24771cb"},"incident_date":"2018-05-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e47ba40c2e0","org_name":"University of Texas, Permian Basin","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktre.com/story/38566809/utpb-data-breach-compromises-information-in-enrollment-portal"}],"summary":"A recently discovered data breach of the UTPB student enrollment problem may have exposed sensitive information of users.   According to the university, the issue was first discovered by a user on May 25 and reported to the IT department on May 29.   While information such as nam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe31bbcad61883a7d17d0c614d30c148b08b6d87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b7d579f0-1d0e-11ea-b436-a7f38e8d15a2"},"incident_date":"2018-05-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd13fd7896a3","org_name":"QuikTrip","org_type":"retail_ecommerce","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.desmoinesregister.com/story/news/crime-and-courts/2018/06/15/polk-county-west-des-moines-skimming-bank-fraud-crime-courts-device/707282002/,https://whotv.com/2018/06/16/two-arrested-after-skimmer-found-at-west-des-moines-atm/"}],"summary":"skimmer on gas pump card reader","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2ff78cf8b8f87f837f9a5ecf755cd8f133b0e4e9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/EmployeeBenefitsCorporation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"58a2a67ced5b","org_name":"Employee Benefits Corporation","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/EmployeeBenefitsCorporation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-25","discovered_date":"2018-04-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f1609718e44ed3618fb395678e581dcf67c9f046","impact_type":"unknown","incident_date":"2018-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d845b7ed813f","org_name":"Care Partners Hospice and Palliative","org_type":"unknown","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Care%20Partners%20Hospice%20and%20Palliative-2018-05-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2018-05-25","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a72a959d3e2b026c83a4b122246368ba45bc6374","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-01-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20180525%20BAAQMD%20Sample%20Breach%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"bff0da6916e6","org_name":"Bay Area Air Quality Management District","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136551"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20180525%20BAAQMD%20Sample%20Breach%20Notice_0.pdf"}],"summary":"Unknown individuals accessed four Air District email accounts, exposing messages containing personal information and attempting fraudulent wire transfers that internal controls prevented.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21669fd67ae885de28c55e80ad803939af3002ec","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"565aa56cc102","org_name":"ViewFines","org_type":"other","ransomware":null,"records_affected":777649,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ViewFines","type":"hibp","url":"https://haveibeenpwned.com/Breach/ViewFines"}],"summary":"ViewFines reported a breach in which records containing personal information and plain-text passwords were exposed.","supporting_quote":null,"technology_involved":["ViewFines website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"22c390eb7aec3436a44c4c0b6bdbcc7f06c3958b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b081bcde0adc","org_name":"The Oregon Clinic","org_type":"unknown","ransomware":null,"records_affected":64487,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Oregon%20Clinic-2018-05-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-05-24","discovered_date":"2018-05-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6ede6d14cf9e4a0f4b09264c1bdb49235f05ba5","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Security%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"f649b3626c0e","org_name":"CBS Interactive","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136534"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Security%20Breach_0.pdf"}],"summary":"CBS Interactive reported that an unauthorized party accessed information submitted by users to TVShowsonDVD.com, potentially including personal and registration information.","supporting_quote":null,"technology_involved":["TVShowsonDVD.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-23","discovered_date":"2018-05-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a915ae2e5d6db2abef6544fca7159b2baaa5bfd9","impact_type":"unknown","incident_date":"2018-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"817dadb040d7","org_name":"Saxon Insurance Services","org_type":"unknown","ransomware":null,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Saxon%20Insurance%20Services-2018-05-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"656d6f8a26389908ecac69c20f76c92ca5621d95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2509fc20-cd06-11e9-a052-6392f3b8c0e8"},"incident_date":"2018-05-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"926cd94623df","org_name":"Earl Enterprises","org_type":"other","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2019/03/a-month-after-2-million-customer-cards-sold-online-buca-di-beppo-parent-admits-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.globenewswire.com/news-release/2019/04/04/1797184/0/en/Data-Breach-Alert-Wolf-Haldenstein-Adler-Freeman-Herz-LLP-is-Investigating-Claims-on-Behalf-of-Customers-of-Buca-Di-Beppo-Planet-Hollywood-Earl-of-Sandwich-Chicken-Guy-Mixology-and.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-145836"}],"summary":" On Feb. 21, 2019, KrebsOnSecurity contacted Italian restaurant chain Buca di Beppo after discovering strong evidence that two million credit and debit card numbers belonging to the company’s customers were being sold in the cybercrime underground. Today, Buca’s parent firm annou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-23","discovered_date":"2018-05-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cd485111220c1c3966dbbe9eadfc74e1ff8a2f79","impact_type":"unknown","incident_date":"2018-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8872dd25e60b","org_name":"Chili's Grill & Bar","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Chili%27s%20Grill%20%26%20Bar-2018-05-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-05-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53c7d43b1c03c85ce05e4d1f13bf375ca5d7196f","impact_type":"data_theft","incident_date":"2018-03-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20CDPH%20Breach%20Notification%20Letter_5_23_18_0.pdf"},"notes":null,"org_country":"US","org_id":"d72a7d7b21c6","org_name":"California Department of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136496"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20CDPH%20Breach%20Notification%20Letter_5_23_18_0.pdf"}],"summary":"The California Department of Public Health reported that documents and a laptop containing personal and health information were stolen from a contractor’s vehicle.","supporting_quote":"On March 12, 2018, a CDPH contractor who performs health facilities inspections on behalf of the department’s vehicle was broken into and some documents and a laptop were stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eaef131db10411e0898623d391a855df9556564","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1b186e0-c268-11e8-bf07-99bafabab839"},"incident_date":"2018-05-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4f778aedd2e","org_name":"Virginia Department of Environmental Quality","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wric.com/news/virginia-news/officials-say-malicious-party-hacked-state-agency-website/1239537625"}],"summary":"A “malicious party” hacked into the Virginia Department of Environmental Quality’s website but no data was lost or compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-05-22","discovered_date":"2018-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9115272c794d72c9d8947a0de64dd46483050e60","impact_type":"data_theft","incident_date":"2017-12-07","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notice%20Template%20%28002%29_0.PDF"},"notes":null,"org_country":"US","org_id":"dc864527a7d7","org_name":"Muir Medical Group IPA","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee took information in Muir IPA's possession before her employment ended.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136437"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice%20Template%20%28002%29_0.PDF"}],"summary":"A former Muir IPA employee took personal and clinical information before her employment ended.","supporting_quote":"On March 7, 2018, we discovered that a former employee of Muir IPA took with her certain information in the possession of Muir IPA before her employment ended with Muir IPA in December 2017.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-22","discovered_date":"2018-05-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"27f724fb9692b9f70eca0a676aa24067b0cfb678","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/LexingtonSchoolDistrictOne.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac4f37aa1190","org_name":"Lexington County School District One","org_type":"education","ransomware":null,"records_affected":5949,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/LexingtonSchoolDistrictOne.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/LexingtonSchoolDistrictOne.pdf"}],"summary":"Lexington County School District One reported that a student may have accessed staff and student information through PowerSchool.","supporting_quote":null,"technology_involved":["PowerSchool"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","credentials","personal"],"disclosed_date":"2018-05-22","discovered_date":"2018-04-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc45d6567709e66af7bdf76002fdfe793916903c","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"6cded446ef84","org_name":"Golden 1 Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Data%20Breach_0.pdf"}],"summary":"Golden 1 Credit Union said payment card information and PINs may have been compromised during use at a branch ATM in Roseville.","supporting_quote":null,"technology_involved":["ATM machine"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-21","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f5ec8cbaac4a3e07bbe278f8db5a416b7d3845c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GeoBlue%20Adult%20CM_0.pdf"},"notes":null,"org_country":"US","org_id":"2d9b24903e6a","org_name":"Worldwide Services Insurance Agency, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email scheme led to unauthorized credentials being obtained for two employees’ email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GeoBlue%20Adult%20CM_0.pdf"}],"summary":"A phishing email scheme led to unauthorized access to two employees’ email accounts, where emails may have contained information including names.","supporting_quote":"an unauthorized party obtained credentials to two employees’ email accounts through a phishing email scheme.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7163885b1a960d848db8a5eb861407e3b6626725","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/UniversityofToledo.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d032c9676f9f","org_name":"University of Toledo","org_type":"unknown","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/UniversityofToledo.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-21","discovered_date":"2018-04-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a8325388d5c27d1e05632aebf9383b67bf38f2f1","impact_type":"unknown","incident_date":"2018-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a7618c6680a","org_name":"Integrated Practice Solutions, Inc.","org_type":"unknown","ransomware":null,"records_affected":480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Integrated%20Practice%20Solutions%2C%20Inc.-2018-05-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02f562379e55e780859ede5c4ba112fce5301ab8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44293100-d2f9-11e8-9b3a-b50b161886e9"},"incident_date":"2018-05-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39c5ffae9186","org_name":"PDQ","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wfla.com/news/local-news/pdq-victim-of-cyber-attack-customer-names-credit-card-info-may-have-been-stolen/1257027748"}],"summary":"PDQ said a hacker exploited part of their computer system and accessed personal information from customers.  It is believed the hacker gained entry through an outside technology vendor's remote connection tool.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-18","discovered_date":"2018-05-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3fb5df167a38b157e108a1ddce27315e1d496490","impact_type":"data_theft","incident_date":"2018-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9574.pdf"},"notes":null,"org_country":"US","org_id":"300f9fd6f336","org_name":"Brinker International","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9574.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9574.pdf"}],"summary":"Brinker International said malware gathered payment card information from payment-related systems at certain Chili’s restaurants.","supporting_quote":null,"technology_involved":["payment-related systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-18","discovered_date":"2018-05-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9950333b7d6a4e02e2105ae952376bc45c6c6d41","impact_type":"data_theft","incident_date":"2018-05-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20notice%205-18-18%20Updated_0.pdf"},"notes":null,"org_country":"US","org_id":"300f9fd6f336","org_name":"Brinker International, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136377"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20notice%205-18-18%20Updated_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/BrinkerInternational.pdf"}],"summary":"Brinker International reported that malware gathered payment card information from payment-related systems at certain Chili’s restaurants.","supporting_quote":null,"technology_involved":["payment-related systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-18","discovered_date":"2015-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7878abaddb2001d4d382857f39864bd9f3fff6fc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bombas%20Ad%20r4prf%20%28002%29_0.pdf"},"notes":null,"org_country":"US","org_id":"0c16ed75492d","org_name":"Bombas, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136345"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bombas%20Ad%20r4prf%20%28002%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bombas%2C%20LLC-2018-05-18"}],"summary":"Bombas reported that malware in the code of its e-commerce platform may have accessed customers’ personal and credit card information.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d1ad603be53019b1def587fe2767d9cb3095eb8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9bf2c270-1c54-11ea-ac81-937b5ec4147f"},"incident_date":"2018-05-17","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"696a3a902dca","org_name":"The University of North Carolina at Chapel Hill School of Medicine","org_type":"education","ransomware":null,"records_affected":3716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://uncnews.unc.edu/2019/11/12/school-of-medicine-notifies-patients-about-data-breach-from-phishing-incident/"}],"summary":"The University of North Carolina at Chapel Hill School of Medicine today announced it is mailing notification letters to an estimated 3,716 persons whose information may have been affected in a cyber phishing incident involving some School of Medicine email accounts.  A leading i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-17","discovered_date":"2018-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff92ad91a6be5e04127b935e34b42cc83a9875e0","impact_type":"data_theft","incident_date":"2017-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSC-%20California%20Notice%20of%20Data%20Event_0.pdf"},"notes":null,"org_country":"US","org_id":"b807809c698b","org_name":"Corporation Service Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSC-%20California%20Notice%20of%20Data%20Event_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Corporation%20Service%20Company-2018-05-17"}],"summary":"An unauthorized third party accessed Corporation Service Company's systems and exfiltrated a database table containing names and government ID or business registration numbers.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-17","discovered_date":"2018-03-26","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"caf87328d5a05d700a2bb0468595a8bcbe87d916","impact_type":"unknown","incident_date":"2017-09-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69f182c5ddd9","org_name":"Sears Holdings Managment Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sears%20Holdings%20Managment%20Corporation-2018-05-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d34bd4a5a2e3f28e30c327e09f011caa6fb5fd5","impact_type":"unknown","incident_date":"2017-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EXPERIAN_D7052_20373915-v3-Sears%20-%20Individual%20-%20CA%20Notification%20Letter%20-..._7.pdf"},"notes":"attack_techniques without supporting words dropped: T1195","org_country":"US","org_id":"807fa61f8f2b","org_name":"Sears Holdings Management Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136293"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EXPERIAN_D7052_20373915-v3-Sears%20-%20Individual%20-%20CA%20Notification%20Letter%20-..._7.pdf"}],"summary":"Sears Holdings reported that an unauthorized individual inserted a malicious script into code from a vendor providing online support services for its websites.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-17","discovered_date":"2018-01-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a0c991788aaa57a3f438aef1980aea425b4b955d","impact_type":"unknown","incident_date":"2018-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0e8247f55d5a","org_name":"Cable Hill Partners LLC","org_type":"unknown","ransomware":null,"records_affected":989,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cable%20Hill%20Partners%20LLC-2018-05-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-17","discovered_date":"2018-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b3de90fb1165566afa44ea301da5348435f37e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20-%20BP_0.pdf"},"notes":null,"org_country":"US","org_id":"e4077a566615","org_name":"Black Phoenix, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136332"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20-%20BP_0.pdf"}],"summary":"Malicious code was found in Black Phoenix's checkout page, where credit card data submitted through AuthorizeNet may have been compromised.","supporting_quote":null,"technology_involved":["web checkout page","AuthorizeNet"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06495a8c34a20eb92965c9ed660d53faf7a03c98","impact_type":"data_theft","incident_date":"2017-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nuance%20PSJH%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"857dd5325d88","org_name":"Providence Saint John's Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136250"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nuance%20PSJH%20Notification%20Letter_0.pdf"}],"summary":"An intrusion into Nuance Communications' computer system resulted in the theft of Providence Saint John's Health Center patients' personal information.","supporting_quote":null,"technology_involved":["Nuance medical transcription software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Nuance Communications, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0a6408965996","name":"Nuance Communications"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"797b5a6ffab74ee4ab297909b38d806f3aebe77b","impact_type":"unknown","incident_date":"2016-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA_Sample_Notification_Letters_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"070c3846294f","org_name":"LifeBridge Health","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136214"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0a72ce533b34cbe0cca7c77eabddf21edbdc955","impact_type":"unknown","incident_date":"2018-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice_23.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"469c839e5334","org_name":"TaskRabbit, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136139"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9572.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-14","discovered_date":"2018-01-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"399f814ea23358e8570c97947179ebdf142d407e","impact_type":"unknown","incident_date":"2018-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b6a39d02f2a8","org_name":"LaPorte & Associates, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#LaPorte%20%26%20Associates%2C%20Inc.-2018-05-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fd68661a47fb35b8fe5fa799c6c0be932c7229b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a007e8c0-8f62-11e8-a74f-e5450456a5bf"},"incident_date":"2018-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f19cbac7d23","org_name":"Billings Clinic","org_type":"healthcare","ransomware":null,"records_affected":8400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/montana-hospital-employee-s-email-hacked-while-traveling-8-4k-patients-data-stolen.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://billingsgazette.com/news/local/billings-clinic-employee-s-email-hacked-during-overseas-travel-breach/article_608e0dcf-c869-5141-a9e5-a79e82e205ff.html"}],"summary":"Billings Clinic reported a data breach Friday that affected 8,400 people.  The hospital's security systems identified unusual activity with an employee's email account on May 14, according to a release from the organization. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03082bf2f0fad307141c5cfe86bb9413e6fb15e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e119ab10-974a-11e8-8342-0f8f10fcd812"},"incident_date":"2018-05-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f98f5d4b424","org_name":"Blue Spring's Family Care","org_type":"healthcare","ransomware":true,"records_affected":44979,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mo-blue-springs-family-care-notifies-44979-patients-after-ransomware-attack/"}],"summary":"Blue Springs Family Care in Missouri reported a ransomware incident to HHS this month that affected 44979 patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"766de5026e3a384c6bc3024eb9f9c5847bc2bebb","impact_type":"unknown","incident_date":"2017-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Signed%20Adult%20Notification%20Ltr%20May%2011%202018_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8debf5c9764a","org_name":"San Francisco Department of Public Health (\"SFDPH\")","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136120"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-11","discovered_date":"2018-04-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"250cb093efc4b17d6edc4001ca1d25873112bbd2","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Farmgirl%20Breach%20Notice%20Sample_3.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"7c945a2d93b1","org_name":"Farmgirl Flowers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136114"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Farmgirl%20Breach%20Notice%20Sample_3.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/FarmgirlFlowersInc..pdf"}],"summary":"Farmgirl Flowers reported unauthorized access involving rogue code inserted into its checkout page, designed to capture customer contact and credit card information and send it to a remote endpoint.","supporting_quote":null,"technology_involved":["checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-11","discovered_date":"2018-03-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c71c10a88755af8473b9e54302bc9962705f2b6","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-07","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_Capitol_Individual_Notice_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"2354914b8a49","org_name":"Capitol Administrators, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing email incident led to unauthorized access to employees’ email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_Capitol_Individual_Notice_Letter_0.pdf"}],"summary":"Capitol Administrators reported that a phishing email incident led to unauthorized access to emails and attachments in some employees’ email accounts.","supporting_quote":"On March 30, Capitol learned through a forensic investigation of a phishing email incident that certain emails and attachments had been accessed by an unauthorized person.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"976181c3ef15d070f2a7d4535072d11f58c51d01","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20d659f0-c8e7-11e9-918d-0fca885a1bcc"},"incident_date":"2018-05-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5bcb1f57c58b","org_name":"Registered Organisations Commission","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/australia-news/2019/jan/18/union-watchdog-accidentally-leaked-secret-emails-from-confidential-whistleblower"}],"summary":"confidential email sent to wrong person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae02c93729be0e5ba767ee10fbb7d875c18dfdd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd9096c0-d2ec-11e8-9b3a-b50b161886e9"},"incident_date":"2018-05-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84c895329196","org_name":"Grimes County Sheriff's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kbtx.com/content/news/County-jailer-former-jailer-accused-of-leaking-sensitive-information-482346591.html"}],"summary":"information, including the name of an informant, was released by a current jailer to a former jail - and that information made its way to a suspect in a theft investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","medical"],"disclosed_date":"2018-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13c6f3c6ae30b4b0071d69129acd5e5f4b914704","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72dc70f0-c8eb-11e9-918d-0fca885a1bcc"},"incident_date":"2018-05-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ae05bab9cf6","org_name":"Elmcroft Senior Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/elmcroft-senior-living-responds-to-data-security-incident-300662429.html,https://www.mcknightsseniorliving.com/home/news/data-breach-puts-personal-information-of-residents-workers-at-risk-elmcroft-senior-living-says/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-136753"}],"summary":"Account used to access personal information by unauthorized 3rd party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62be2a7d62c58d38082ab977e3e4297403ff98c9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3a62f6e0-a150-11e8-8944-973f074c04dd"},"incident_date":"2018-05-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ea9992e14e2a","org_name":"North West Territories Department of Health and Social Services","org_type":"government","ransomware":null,"records_affected":33661,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/north/nwt-health-data-breach-laptop-stolen-1.4726891;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.myyellowknifenow.com/30519/department-of-health-and-social-services-confirms-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cklbradio.com/gnwt-warns-of-possible-health-info-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/north/nwt-health-data-breach-laptop-stolen-1.4726891"}],"summary":"A laptop stolen from a locked vehicle in Ottawa contained health-care information about more than 33,000 N.W.T. residents, according to the territory's health department.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b5cdbae49bb97f9b2d6f3e45423a944c06728995","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9571.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"048377173e4d","org_name":"H&R Block","org_type":"unknown","ransomware":null,"records_affected":2655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9571.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6273064a3b3e1d532aaffebce219c6328abcb7c9","impact_type":"unknown","incident_date":"2018-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/letter_USACS_May%208%202018_0.pdf"},"notes":null,"org_country":"US","org_id":"efc8f7a4e7a3","org_name":"USACS Management Group, Ltd.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135980"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/letter_USACS_May%208%202018_0.pdf"}],"summary":"USACS reported an incident involving some patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-05-08","discovered_date":"2018-02-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc8007729ee670f35eda2d387314965733bbdbef","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RENA%20Customer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"62287ad6290b","org_name":"Rail Europe North America Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135964"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RENA%20Customer%20Notification_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9567.pdf"}],"summary":"Rail Europe North America discovered unauthorized access to its ecommerce websites’ IT platform, where customers’ personal, payment card, and account information may have been involved.","supporting_quote":null,"technology_involved":["ecommerce websites’ IT platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-08","discovered_date":"2018-02-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1cb47567ff8328cc963dd0a82da5c73c850fd8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Global%20University%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e288e9d2b157","org_name":"Global University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A database containing student information was misconfigured and accessible to the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135977"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Global%20University%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Global%20University-2018-05-08"}],"summary":"Global University reported that a misconfigured database containing student names and Social Security numbers was accessible on the Internet.","supporting_quote":"Through this investigation, Global determined on February 23, 2018, that a database containing information related to current and former Global students was misconfigured and accessible to the Internet from December 31, 2017 to January 31, 2018.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-05-08","discovered_date":"2018-03-25","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14da16b1fbc10145a76fbd32a1188cd05aa46be2","impact_type":"data_theft","incident_date":"2018-01-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Deephavensample%20050818_0.pdf"},"notes":null,"org_country":"US","org_id":"62fe989d90cf","org_name":"Deephaven Mortgage LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email phishing attack resulted in unauthorized access to employee email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135979"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Deephavensample%20050818_0.pdf"}],"summary":"Deephaven Mortgage reported that an email phishing attack led to unauthorized access to employee email accounts containing consumers' personal information.","supporting_quote":"Our investigation revealed that Deephaven Mortgage was the victim of an email phishing attack resulting in unauthorized access to and acquisition of the contents of certain employee email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64e44260ddf699ff7a301a451281e0397ca24914","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7df110b0-c29b-11e8-bf07-99bafabab839"},"incident_date":"2018-05-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a19cea2455f3","org_name":"Roseburg Public Schools","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kval.com/news/local/ransomware-attack-freezes-roseburg-public-schools-computers"},{"fetched_at":null,"title":null,"type":"press","url":"https://techtalk.pcpitstop.com/2018/05/09/ransomware-takes-oregon-public-school/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nrtoday.com/news/roseburg-public-schools-servers-remain-down-after-hack/article_b9a4b30c-777b-5849-ac23-64f3cb741157.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://kpic.com/news/local/roseburg-schools-pay-ransom-to-recover-data-from-computer-attack"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nrtoday.com/news/local/roseburg-public-schools-agrees-to-pay-ransom-to-hackers/article_169a76ab-1453-5b10-9db3-cc6282ed4441.html"}],"summary":"A computer ransomware attack froze access to email, websites and software at Roseburg Public Schools and the ransom was paid by victim.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a08c8eb71245403ab5549f38083c3b604e9c5ef6","impact_type":"unknown","incident_date":"2018-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NOTICE%20TO%20CLS%20RE%20MYCASE%20DATA%20BREACH_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c48c167e4a0","org_name":"MASON LAW OFFICE, P.C.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135910"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-05-03","discovered_date":"2018-04-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28b05b0039338e033b8c24a758b7a25f1e5eeb91","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MINOR%20PATIENT%20LETTER%20-%20ENGLISH_1.pdf"},"notes":null,"org_country":"US","org_id":"835d87b817b6","org_name":"Rady Children's Hospital-San Diego","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Patient information was inadvertently included on a CD generated for quality-control purposes and sent to a contracted entity.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MINOR%20PATIENT%20LETTER%20-%20ENGLISH_1.pdf"}],"summary":"Rady Children's Hospital-San Diego inadvertently sent a CD containing patient information to a contracted entity.","supporting_quote":"The receiving entity contacted RCHSD to report that patient information was included on the CD, and ma de immediate arrangements to securely send the CD back to RCHSD.","technology_involved":["CD"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2018-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fc7d2ca87d4ec0189c39e47eb93f48cfc89afbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65c54690-fbe9-11e9-8c71-6b6c5a5368d9"},"incident_date":"2018-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d65a7b843bef","org_name":"Monroe County DMV","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wxxinews.org/post/county-lawmakers-demand-answers-dmv-data-mishandling-nys-will-audit-local-office,https://www.whec.com/news/dmv-tossing-personal-sensitive-customer-information-in-the-trash/4921799/"}],"summary":"Customer frustrated that DMV requests he writes his SSN down, goes dumpster diving after hours and finds sensitive data in the DMV dumpster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3daec10faf2b746525d7538f373f40a2ed805897","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"715f4800-9a49-11e8-8652-5d096cfefbb4"},"incident_date":"2018-05-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f56e5ebd5b8e","org_name":"Matanuska-Susitna (Mat-Su) Borough, Alaska","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/bitpaymer-ransomware-infection-forces-alaskan-town-to-use-typewriters-for-a-week/"}],"summary":"On Monday, officials from Matanuska-Susitna (Mat-Su), a borough part of the Anchorage Metropolitan Statistical Area, said they are still recovering from a ransomware infection that took place last week, on July 24.  The ransomware infection crippled the Borough's government netwo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"360de00f14287a39281f5f1236c281a14a80388a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Hudsons%20Bay%20Company%20(HBC)%2C%2027%20Apr%2018%20-%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"45800f6b3aad","org_name":"Hudson's Bay Company (HBC)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Hudsons%20Bay%20Company%20(HBC)%2C%2027%20Apr%2018%20-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-03","discovered_date":"2018-03-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9659e79819450772c9d479561b818cdd47e6b088","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9569.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"f3395dba4df3","org_name":"Alaska Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":4102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9569.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alaska%20Airlines%2C%20Inc.-2018-05-04"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9569.pdf"}],"summary":"An unauthorized third party appears to have accessed personal information related to Alaska Airlines guest hotel and car reservation transactions on Orbitz's platform.","supporting_quote":null,"technology_involved":["Orbitz platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Orbitz"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"2f6dcad7ee3c","name":"Orbitz"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"523563802ddb778b2025af48076a4d595420c6de","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9568.pdf"},"notes":null,"org_country":"US","org_id":"f0f95f5419c4","org_name":"SunTrust Banks, Inc","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":"A former employee may have inappropriately printed client contact information for use outside SunTrust.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9568.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Suntrust%20Banks%2C%20Inc-2018-05-08"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9568.pdf"}],"summary":"SunTrust reported that a former employee may have printed client contact lists for use outside the company, potentially affecting approximately 1.5 million clients.","supporting_quote":"In mid-April, we learned of the likelihood that the former employee may have inappropriately printed the client contact information for use outside of SunTrust.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee9ed7b939d44154a3a87a08eac7f25554e930a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d51faf20-8a8f-11e8-ba1e-e3857583ba43"},"incident_date":"2018-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9f8bf6f090b","org_name":"Southwest Vermont Supervisory Union","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.burlingtonfreepress.com/story/news/local/vermont/2018/07/16/vermont-schools-lag-cybersecurity-while-risk-hits-pownal-fraud/774632002/"}],"summary":"A cyber thief infiltrated a Vermont supervisory union's computer network and made a $50,000 transfer out of a school bank account, but safe guards on the account alerted staff members to take action.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2018-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa06e7294c7694beee2dd52e2f52b4eae528eb2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fadb42c0-89cb-11e8-b658-d333758cf8bc"},"incident_date":"2018-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"5314156f1f29","org_name":"Light's Hope","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://lightshope.org/news/forum-breach-summary-of-investigation-and-final-report"}],"summary":"On and before the months of May and June, our forums were subject to a mass-bruteforcing attack targeting accounts owned by staff, including administrators and moderators. We began implementing measures to mitigate the attack as soon as we detected it.  We were able to establish ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0473e99c8869d1d4082a9489b58b2d11dc8f7ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f44be660-22d7-11eb-b221-a300329fb9cf"},"incident_date":"2018-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cde0b46669a8","org_name":"Idaho State Tax Commission","org_type":"government","ransomware":null,"records_affected":36,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/11393"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IT","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e11da6e3e7af64bc90b35a7731b13fd3af7f7aa","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4b7533d0-22d6-11eb-b221-a300329fb9cf"},"incident_date":"2018-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2db654bfc5c0","org_name":"idaho legislative services office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idahopress.com/eyeonboise/hackers-phishers-target-state-website-tax-commish-email-account/article_126c6bb9-9c69-59a4-9285-ef89a01c52ad.html"}],"summary":"website defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dc815c1617693419252ac94d03385dd33516540","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"edb07290-9728-11e8-8342-0f8f10fcd812"},"incident_date":"2018-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1407eb948ee3","org_name":"Human Longevity, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiegouniontribune.com/business/biotech/sd-me-human-longevity-sues-jcvi-20180722-story.html"}],"summary":"J. Craig Venter, the San Diego genetic researcher whose drive and insight sped the sequencing of the human genome, has been accused of stealing trade secrets by a company he helped found to exploit one of the great advances in modern science","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e585aba6dbd6275151c7784a92500c585c116eff","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"VN","org_id":"ed4ca3408f33","org_name":"VNG","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: VNG","type":"hibp","url":"https://haveibeenpwned.com/Breach/VNG"}],"summary":"Data associated with VNG customers, including personal information and password hashes, was discovered being traded online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3a95ae556687711b21400756aca2b4dfa6ddc91","impact_type":"data_theft","imported_from":null,"incident_date":"2017-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"015fdb9b69d9","org_name":"TGBUS","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TGBUS","type":"hibp","url":"https://haveibeenpwned.com/Breach/TGBUS"}],"summary":"An alleged 2017 breach of TGBUS reportedly exposed subscriber usernames, email addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f725aa24baad680deb6b3141bf22c20361f681a3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b4d68070-8aaa-11e8-874b-dd84fb61b260"},"incident_date":"2018-04-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2018/07/16/ex-apple-engineer-charged-with-stealing-self-driving-car-secrets/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/former-apple-engineer-pleads-not-guilty-in-trade-secrets-theft-case/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/apple-self-driving-car-project-details-fbi-stolen-trade-secrets-investigation-2018-7"}],"summary":"A former Apple engineer who worked on driverless car technology was arrested on his way to start a new job in China with autonomous vehicle start-up Xiaopeng Motors – a Guangzhou-based company also known as XMotors – Apple charged in federal court on Monday.  A criminal complaint","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d9dd1d588586514e34061f0cd3445818ab954e3","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2ee67681dba7","org_name":"17173","org_type":"technology_saas","ransomware":null,"records_affected":7485802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 17173","type":"hibp","url":"https://haveibeenpwned.com/Breach/17173"}],"summary":"The 17173 gaming site was listed as affected in a late-2011 data breach involving usernames, email addresses and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3628c07151401322ae24cc50ddb50c459b468629","impact_type":"data_theft","incident_date":"2017-07-01","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HBC%20-%20Copy%20of%20Notice%20Materials_0.pdf"},"notes":null,"org_country":"US","org_id":"ff811e9489d1","org_name":"Hudson’s Bay Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HBC%20-%20Copy%20of%20Notice%20Materials_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9566.pdf"}],"summary":"Hudson’s Bay Company reported that malware running on point of sale systems at Saks Fifth Avenue, Saks OFF 5TH and Lord & Taylor locations was designed to collect customers’ payment card information.","supporting_quote":"Based on the investigation to date, we understand that, around July 1, 2017, malware began running on certain point of sale systems at potentially all Saks Fifth Avenue, Saks OFF 5TH and L ord & Taylor locations in North America.","technology_involved":["point of sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-27","discovered_date":"2018-02-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6afa78a1ce02e7771be6d82872797ebcd5682e67","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-08","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CPT_CA_NotificationFinal_0.pdf"},"notes":null,"org_country":"US","org_id":"537a76db9eaf","org_name":"CPT Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135709"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CPT_CA_NotificationFinal_0.pdf"}],"summary":"CPT Group reported that an unauthorized person accessed an employee’s email account, where emails and attachments containing personal information could have been accessed.","supporting_quote":"On February 8, 2018, CPT learned through its ongoing forensics investigation of a phishing email incident that certain emails and attachments could have potentially been accessed by an unauthorized person.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-26","discovered_date":"2018-06-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd2ce2eba2b714b52eb53796b688056d1b4fe5ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-04-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A1%20MCOM%20All%20State%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"053330a31248","org_name":"Macy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137613"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.daytondailynews.com/business/macy-warns-customers-about-recent-data-breach/9hVl1boe4teNzbjsku08yK/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mediapost.com/publications/article/321847/macys-ecommerce-data-breached-via-third-party-co.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/macys-and-bloomingdales-notify-customers-of-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://clark.com/protect-your-identity/bloomingdales-data-breach/"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A1%20MCOM%20All%20State%20Consumer%20Notice_0.pdf"}],"summary":"An unauthorized party used valid credentials to access Macy's customer profiles and view personal and payment-card information.","supporting_quote":"We believe the third party obtained these customer usernames and passwords from a source other than Macy’s.","technology_involved":["macys.com customer online profiles"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8db10ad9929e5feb0f5c08ca13a109074962dc65","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9565.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a38df4ae858f","org_name":"Sears Holdings","org_type":"unknown","ransomware":null,"records_affected":1193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9565.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/SearsHoldings.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a4ccc76beeb0739cc98dc2cecbbf5bd7316d75a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ded5b750-a086-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-04-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f87f4db0710","org_name":"Notre Dame de Namur University","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CA%20Notice_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137267"}],"summary":"Notre Dame de Namur University data breach through employee's email account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b328de380a091a44eb6e850aad6ee130bf139bd5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4a3deb0-a07d-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-04-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"c96b4154a865","org_name":"NameTests.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://medium.com/@intideceukelaire/this-popular-facebook-app-publicly-exposed-your-data-for-years-12483418eff8;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2018/06/28/facepalm-2/"}],"summary":"Nametests.com, the website behind the quizzes, recently fixed a flaw that publicly exposed information of their more than 120 million monthly users — even after they deleted the app.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afa465320bfae39eddba08a4fb42d682f959639a","impact_type":"data_theft","imported_from":null,"incident_date":"2014-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"05a26c267f0b","org_name":"ILikeCheats","org_type":"other","ransomware":null,"records_affected":188847,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ILikeCheats","type":"hibp","url":"https://haveibeenpwned.com/Breach/ILikeCheats"}],"summary":"ILikeCheats suffered a data breach that exposed account usernames, IP and email addresses, and weak MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d2005825fe158a639a85d97bd7649fdef84b5cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5dcae630-fbed-11e9-8c71-6b6c5a5368d9"},"incident_date":"2018-04-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"535452db7053","org_name":"Scott Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kmov.com/news/police-issue-warning-after-skimming-devices-found-in-collinsville/article_2abc2716-7c89-57c4-8750-b6e10aadfac7.html"}],"summary":"skimmers found on atms","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-20","discovered_date":"2018-04-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2583a5bf2dd30a9f4ba92f8e6ca3383192979ba9","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-26","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Grainger_Template%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"a8cc10935770","org_name":"W.W. Grainger, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Grainger_Template%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#W.W.%20Grainger%20Inc.-2018-04-20"}],"summary":"Grainger customers who used guest checkout may have had payment card and personal information accessed during a cyber incident involving [24]7.ai.","supporting_quote":"On April 10, 2018, Grainger was notified by [24]7.ai that [24]7.ai was involved in a cyber incident, which occurred from September 26, 2017 through October 12, 2017.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"[24]7.ai"},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-20","discovered_date":"2018-03-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61139cae358fd5a05d5551b4c1d17f8fbd15c6f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orbitz-%20SW-%20CA%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"3faa8ef14b77","org_name":"Southwest Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135515"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orbitz-%20SW-%20CA%20Letter_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Southwest%20Airlines%20co.-2018-04-20"}],"summary":"Information associated with certain hotel reservations made through Southwest.com was accessed on the Orbitz platform, including some customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["Orbitz platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Orbitz"},"updated_at":"2026-10-10","derived":{"vendors":[{"id":"2f6dcad7ee3c","name":"Orbitz"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-04-20","discovered_date":"2018-05-22","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cae19914e6f8993b0c91d1073259a7a971108076","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9b2c9e60-8c13-11e8-bfaf-f7b4555dc539"},"incident_date":"2018-04-20","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba4cde144248","org_name":"ComplyRight","org_type":"professional_services","ransomware":null,"records_affected":7600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/07/human-resources-firm-complyright-breached/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.complyright.com/data-security-notice;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/business/fl-bz-complyright-data-breach-20180718-story.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-138054"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10648.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ComplyRightInc.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ComplyRight%2C%20Inc-2018-07-25"}],"summary":"Cloud-based human resources company ComplyRight said this week that a security breach of its Web site may have jeopardized sensitive consumer information — including names, addresses, phone numbers, email addresses and Social Security numbers — from tax forms submitted by the com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"265f7c92b64360a311715923602ca81128c9006b","impact_type":"data_theft","imported_from":null,"incident_date":"2016-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"eabd9fc4ba48","org_name":"CashCrate","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CashCrate","type":"hibp","url":"https://haveibeenpwned.com/Breach/CashCrate"}],"summary":"A November 2016 breach of CashCrate exposed names, physical addresses, email addresses, and passwords from 6.8 million records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0053209fda4a8cb833eae93c2a544e601c7c1a65","impact_type":"disruption_or_ransomware","incident_date":"2018-02-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Providence%20COS%20Patient%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"98638eb5debb","org_name":"Center for Orthopaedic Specialists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135457"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Providence%20COS%20Patient%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized party accessed Center for Orthopaedic Specialists’ system and encrypted patient data, which the organization said had not been removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-18","discovered_date":"2018-03-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b3df9a1e33273976b68b8db252881bef6ee06d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-23","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"38da00cc9c81","org_name":"AccessLex Institute","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor inadvertently sent loan files to a business not authorized to receive them.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135410"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20notification%20letter_0.pdf"}],"summary":"AccessLex Institute reported that a vendor inadvertently sent loan files containing personal information to an unauthorized business.","supporting_quote":"On March 28, 2018 we learned that on March 23, 2018 a vendor we use to help provide student loan processing services inadvertently sent a copy of certain loan files, including your file, to another business that was n ot authorized to receive them.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cee18a6f2dd24bcc8dee52bd7935d1ee3179e2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e1df75f0-a228-11e8-ae61-0fc7f403e976"},"incident_date":"2018-04-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b07fd1eb3d4","org_name":"Southwestern Eye Center","org_type":"healthcare","ransomware":null,"records_affected":667,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sweye.com/sec-inc-not/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/301k-patients-involved-in-st.-marys-paper-records-data-breach"}],"summary":"Recent healthcare data breaches include a vendor's refund check mistake.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-16","discovered_date":"2017-12-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c711a36c39164c21e2abd2f9556736a03fd0ce9","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Temp-tations%20CA%20Notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"a9fd2efefee1","org_name":"Temp-Tations Home LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135309"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Temp-tations%20CA%20Notification%20letter_0.pdf"}],"summary":"An unknown third party compromised online user accounts on Tara at Home’s e-commerce system, potentially accessing customer names and payment card information.","supporting_quote":null,"technology_involved":["e-commerce system","online user accounts"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-13","discovered_date":"2018-03-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e82dfeb42fbc8e8a5b8be76f40915a8bbb9b5fa","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2018-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Notification%20of%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"93abcadabf24","org_name":"PF@-Com, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135238"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Notification%20of%20Breach_0.pdf"}],"summary":"PF@-Com, Inc. reported that information entered on four websites may have been captured and potentially sent to unauthorized third parties.","supporting_quote":null,"technology_involved":["aveneusa.com","renefurtererusa.com","kloraneusa.com","glytone-usa.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-04-13","discovered_date":"2018-03-14","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4aeb268e74d366a3db3ed078ea0df5ef6ac4cd0","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Inogen%20-%20CA%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"c5dc9e6e565e","org_name":"Inogen, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135272"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Inogen%20-%20CA%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Inogen%2C%20Inc.-2018-04-13"}],"summary":"Inogen reported that messages in an employee’s email account may have been accessed without authorization and may have contained personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"749ea70d1d2d4a927832e0f6039ea591b83edc86","impact_type":"unknown","incident_date":"2017-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California_3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9dfc9068b7b1","org_name":"Delta Air Lines, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135266"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Delta%20Air%20Lines%2C%20Inc.-2018-04-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdc6b264193f17686683a016a70f76cfe05e244f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Template%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Template%20Final_0.pdf"}],"summary":"Blue Shield of California disclosed that an employee emailed a document containing a member’s protected health information to an unauthorized insurance broker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94627ccf034c99b8eced85cb508db0475f12a394","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-26","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Best%20Buy%20-%20Individual%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"557a5cfb49f9","org_name":"Best Buy Co., Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Malicious code inserted into [24]7.ai's software enabled an unauthorized party to access Best Buy customers' payment information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135278"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Best%20Buy%20-%20Individual%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9562.pdf"}],"summary":"Malicious code inserted into [24]7.ai's software enabled an unauthorized party to access payment information of some Best Buy customers who shopped on BestBuy.com.","supporting_quote":"Based on an internal investigation, [24]7.ai found that malicious code was inserted in its software between September 26 and October 12, 2017.","technology_involved":["[24]7.ai software","BestBuy.com"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"[24]7.ai"},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-12","discovered_date":"2018-03-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"385f9cc5ee6cfa56876d3c1ae06c795c84c99296","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MEP%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"3ad28f413b2f","org_name":"Mise En Place Restaurant Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MEP%20Notification_0.pdf"}],"summary":"Mise En Place Restaurant Services discovered unauthorized access to a server, and personal information may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e459a85a382196cfd94272d07fb29de573c1d9d4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"3dc0b8e52c0b","org_name":"Smogon","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Smogon","type":"hibp","url":"https://haveibeenpwned.com/Breach/Smogon"}],"summary":"Smogon’s XenForo-based forum breach exposed usernames, email addresses, genders, and password hashes.","supporting_quote":null,"technology_involved":["XenForo"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edde71f4bc0cdd56c9029b61556b7dca0203cf25","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"326c1a40-89ed-11e8-bc39-6bf805ebd808"},"incident_date":"2018-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c58b79494393","org_name":"International Mission Board","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bpnews.net/51275/imb-data-breach-prompts-comprehensive-response;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_1.pdf"}],"summary":"A data breach occurred at the International Mission Board that may have exposed personal information of current and former employees, volunteers and applicants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ccb103654f6fc552dec92c23742380d374df4662","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9561.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3d8b442c592","org_name":"Delta Airlines","org_type":"unknown","ransomware":null,"records_affected":24563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9561.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","credentials"],"disclosed_date":"2018-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e82a4e84fadd3787decf4bea645f664eee3d3607","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Indivdiual%20Notification%20California-%20Experian%20%28Client%20Approved%29%20%28153764016_2%29_0.pdf"},"notes":null,"org_country":"US","org_id":"7de6679a4562","org_name":"Walker Advertising, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135102"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Indivdiual%20Notification%20California-%20Experian%20%28Client%20Approved%29%20%28153764016_2%29_0.pdf"}],"summary":"Two Walker employees’ corporate email accounts were hacked, and one account sent phishing emails seeking credentials; potentially accessed information included personal, medical, and account data.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14921b413c0a348e3d3115b675dbbc6b527e9d63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10749060-b3c3-11e9-8244-abb132467e1d"},"incident_date":"2018-04-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2666259dd0fa","org_name":"eHealth Saskatchewan","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-doctors-snooped-into-humboldt-broncos-patient-records-privacy-commissioner-finds/,https://nationalpost.com/news/canada/doctors-snooped-into-humboldt-broncos-patient-records-privacy-commissioner-finds"}],"summary":"medical professionals access EHR they lacked need to know for.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1406792f2f89b5fb37c7a17e157ece9f2dfc8c43","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ddsBreachNoticePII_English_0.pdf"},"notes":null,"org_country":"US","org_id":"1b80cac934e6","org_name":"California Department of Developmental Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135099"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ddsBreachNoticePII_English_0.pdf"}],"summary":"Unknown persons broke into California’s Department of Developmental Services offices, damaging paper files and stealing encrypted laptops; the department reported no evidence that personal information was viewed or taken.","supporting_quote":"On Sunday, February 11, 2018, unknown persons broke into the Department’s legal and audits offices, ransacked the offices and paper files, vandalized property, and started a fire.","technology_involved":["laptop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-06","discovered_date":"2018-03-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60fd5c01a50c04e11fe512ef70394568217243cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blue%20Beacon--CA%20Adult%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"c967c2e27180","org_name":"Blue Beacon International","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135091"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blue%20Beacon--CA%20Adult%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"Blue Beacon International discovered unauthorized access to employee portal accounts, involving current and former employees’ Social Security numbers and portal login credentials.","supporting_quote":null,"technology_involved":["employee portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-04-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43344a7ddc56db5ee936182a18ac0da295eb1db9","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20-%20Data%20Incident%20Consumer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"024613099fe6","org_name":"Dollar Shave Club","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Credentials obtained from another source were tested and used to log in to Dollar Shave Club customer accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20Data%20Incident%20Consumer%20Notification_0.pdf"}],"summary":"Dollar Shave Club customer accounts were accessed using email and password combinations obtained from elsewhere.","supporting_quote":"Essentially, someone obtained a list of emails and passwords from some other source (or potentially used a random password generator to guess at passwords) and then tested them on other platforms (like ours) to see if the passwords work.","technology_involved":["e-commerce accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4959e9c334409504a6981f554fbe299ddc9ffe4b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eccdbd40-99a5-11e8-bb21-7f662dc72866"},"incident_date":"2018-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f669073c9211","org_name":"Pennsylvania Department of Corrections","org_type":"government","ransomware":null,"records_affected":13791,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox43.com/2018/07/23/state-dept-of-corrections-notifies-employees-inmates-of-online-security-incident-with-third-party-vendor/"}],"summary":"A “security incident” at a third-party vendor may have compromised the personal information of employees, inmates and others involved with the PA Department of Corrections","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","medical"],"disclosed_date":"2018-04-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e56b0ae352a117a071e27005faf03266c781a71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dcbd5640-945f-11e8-8a69-45d02d35861b"},"incident_date":"2018-04-03","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fddebc8b24e","org_name":"NorthStar Anesthesia","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://markets.businessinsider.com/news/stocks/re-northstar-anesthesia-notice-of-data-privacy-event-1027387079;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/phishing-attack-results-in-a-breach-and-patient-protection-services-at-texas-anesthesia-practice"}],"summary":"Between May 23 and 24, 2018, NorthStar learned of an email phishing campaign that resulted in the compromise of certain employees' email credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-03","discovered_date":"2018-02-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43e554da19781556901e3c9ed2faece0bcf04016","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter_City%20of%20Thousand%20Oaks_0.pdf"},"notes":null,"org_country":"US","org_id":"7cf7c9670a59","org_name":"City of Thousand Oaks","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-135006"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_City%20of%20Thousand%20Oaks_0.pdf"}],"summary":"An unauthorized individual may have accessed information entered into the City of Thousand Oaks’ Click2Gov payment system through a vendor's computer.","supporting_quote":null,"technology_involved":["Click2Gov"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39e31b4e42d2ce74336675be54b2475812e9b4f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-15","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALP-AisforApple_Sample_Notice_04-03-18_1.pdf"},"notes":null,"org_country":"US","org_id":"ee8ab2ef3db7","org_name":"Autism Learning Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134979"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALP-AisforApple_Sample_Notice_04-03-18_1.pdf"}],"summary":"A response to a former employee’s request inadvertently included W-2 forms for current and former employees, and the former employee reported deleting the file.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-04-02","discovered_date":"2018-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"face87f9d9bc35f18e7bf908ec8583538781d7f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SG031618_HIPAA_Patient%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"58dc758a1c1e","org_name":"Sonoma County Indian Health Project, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SG031618_HIPAA_Patient%20Notification%20Letter_0.pdf"}],"summary":"An employee sent an unencrypted email containing patient information from a Sonoma County Indian Health Project computer to the employee’s personal email address, with no evidence that an unauthorized person viewed it.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e348daeacf7493f2b4dd98fe8733e269a5fc1a39","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ec750d0-bb66-11e8-b9b2-0dc0cc16471e"},"incident_date":"2018-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e4ff8c52cc7","org_name":"Leominster School Disctrict","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegram.com/news/20180426/leominster-pays-10k-in-bitcoin-ransom-to-undo-cyberattack-on-schools"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ded6cc42ad251e379dc941b782e10277ea1cda5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d2796730-1627-11ec-8258-83f74c3914c9"},"incident_date":"2018-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6930b54a1bf2","org_name":"Hornor, Townsend & Kent","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fa-mag.com/news/finra-bars-n-j--broker-for-stealing-client-info-from-former-firm-62194.html?section=3"}],"summary":"Finra Bars N.J. Broker For Stealing Client Info From Former Firm - Hornor, Townsend & Kent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2fcccb0f5020c80c6986a27880c6dfa4786e68a","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"184c631691cf","org_name":"HiAPK","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HiAPK","type":"hibp","url":"https://haveibeenpwned.com/Breach/HIAPK"}],"summary":"An alleged breach of HiAPK around 2014 exposed usernames, email addresses and salted MD5 password hashes for approximately 13.8 million subscribers; the breach is flagged as unverified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2058174db8bcd845f835b5b5c30bbb8eaa3c297b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12ec1710-aa09-11e8-b272-396d7fe012b7"},"incident_date":"2018-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"820b63233fd7","org_name":"Gadsden High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kvia.com/news/education/district-officials-remain-tight-lipped-in-the-wake-of-gadsden-high-cheating-scandal/742250976"}],"summary":"a group of high school students illegally accessed their grades online and made changes to their scores.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aa9bbd1fd05f030c44c5df30ab4ca1bfd9a48b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82f2a2d0-a0be-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e8935c0b0c82","org_name":"Cree, Inc","org_type":"manufacturing","ransomware":null,"records_affected":32000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://abc11.com/cree-employee-charged-with-stealing-company-secrets-worth-more-than-$100m/3900002/"}],"summary":"An employee of a worldwide company based in Research Triangle Park is accused of stealing thousands of documents full of sensitive information and intellectual property worth more than $100 million.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5391a85f8fc6fee134615e233249a9d2d97b9df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d2805fb0-28de-11e9-adf7-352895b3dcd2"},"incident_date":"2018-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c69135783578","org_name":"Chegg","org_type":"retail_ecommerce","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://sg.finance.yahoo.com/news/online-textbook-rental-tutorial-company-191100361.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/data-breach-risks-reminding-chegg-172550591.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://marketbrief.edweek.org/marketplace-k-12/tutoring-company-chegg-acknowledges-data-breach-puts-40-million-users-notice/"}],"summary":"In an SEC filing Tuesday, the online textbook rental and tutorial company said that, in late April, an unauthorized party gained access to a company database hosting user data – including names, emails, shipping addresses, and passwords. Chegg said user data for its family of bra","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"661252baa45bcd4fc804f61dda3ce7b24a5c8d9c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39e096a0-a083-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7bf45939048a","org_name":"Alasks Division of Public Assistance","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.adn.com/alaska-news/anchorage/2018/06/28/officials-say-data-breach-with-links-to-russia-exposed-alaskan-public-assistance-users-to-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.seattletimes.com/nation-world/apxalaska-health-department-reports-data-breach/"}],"summary":"Personal information of hundreds of Alaskans may have been disclosed as part of a security breach involving the state Division of Public Assistance.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4650fe4024e796ee035939dfd5e91634fff1efce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ba9beb0-a07a-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5235c144874","org_name":"Advanced Law Enforcement Rapid Response Training","org_type":"government","ransomware":null,"records_affected":114000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/a-massive-cache-of-law-enforcement-personnel-data-has-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thedailybeast.com/leaked-data-reveals-some-police-departments-unprepared-for-active-shooters"}],"summary":"A data leak that exposed the personal information of thousands of law enforcement officials revealed that some departments are unprepared for active shooter situations, according to ZDNet. The breach is from an active shooter training facility known as Advanced Law Enforcement Ra","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2018-03-30","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96492b1b8d87860449ed79ee6dc20d4025b6a8dd","impact_type":"data_theft","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letters%20to%20California%20Residents_0.pdf"},"notes":null,"org_country":"US","org_id":"d89316ad6e20","org_name":"Thermo Fisher Scientific Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134909"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letters%20to%20California%20Residents_0.pdf"}],"summary":"Thermo Fisher Scientific reported that unauthorized parties used compromised company email credentials to access accounts and acquire emails.","supporting_quote":"Specifically, we believe that unauthorized third parties obtained your company email account username and password and then used those credentials to access your account and acquire certain emails.","technology_involved":["company email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b4ee4539f2f12305f529b88bac41e3383b4e73a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27dc1aa0-bb64-11e8-b9b2-0dc0cc16471e"},"incident_date":"2018-03-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"15a7bcb25ab4","org_name":"John A Moran Eye Center","org_type":"healthcare","ransomware":null,"records_affected":607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthimaging.com/topics/practice-management/investigation-underway-following-data-theft-university-utah-eye-center"}],"summary":"Computer and external drive stolen with PHI stored on them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-30","discovered_date":"2018-03-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b21868ab55187d0ea11f9065f837eeba9e06b0a4","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20customer%20notification%20letter%20-%20final_0.pdf"},"notes":null,"org_country":"US","org_id":"cd11a67e70f5","org_name":"Funding Circle","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134928"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20customer%20notification%20letter%20-%20final_0.pdf"}],"summary":"Funding Circle data may have been exposed in unauthorized access to a data vendor's employees' Microsoft Office 365 email accounts.","supporting_quote":null,"technology_involved":["Microsoft Office 365","email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-03-30","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4627c2a4e097c658ce77e9d32f3b63c616853f95","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"834841683c2e","org_name":"Del Mar Chiropractic Sports Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134927"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Letter_0.pdf"}],"summary":"An employee’s stolen laptop may have contained personal information, clinic notes, and progress notes.","supporting_quote":"On January 31, 2018, we discovered that an employee’s laptop computer was stolen.","technology_involved":["employee laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef747ebfc11ad91f328c632041931ac11ec2edbd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b242b120-9a4b-11e8-8652-5d096cfefbb4"},"incident_date":"2018-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9700f1d8d9b","org_name":"Confluence Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/confluence-health-discloses-patient-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ifiberone.com/columbia_basin/confluence-health-discloses-patient-data-breach/article_d86f19aa-92a4-11e8-8f43-73e8b8ba2357.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/confluence-health-informs-patients-of-phishing-incident/"}],"summary":"Confidential patient information may have been released in an email breach at Confluence Health, the Wenatchee medical organization said in a Saturday press statement.  The information contained in an employee's breached email account may have included \"some patient information\" ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22b6bf7344bad93ed338f6b985d762a99ee8911","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94b701d0-aa2a-11e8-b2b4-5de6d270e153"},"incident_date":"2018-03-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe6880d8de66","org_name":"BancorpSouth Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wjtv.com/news/pine-belt/card-skimmers-found-at-2-bancorpsouth-locations-in-hattiesburg/1089781704"}],"summary":"Payment card skimmers found at two banks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-03-29","discovered_date":"2018-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b99b17a148cdb565eb613c706621a1158ff9a1c5","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MyFitnessPal%20Notice%20and%20Website%20FAQs_0.pdf"},"notes":null,"org_country":"US","org_id":"9a22b03e156d","org_name":"Under Armour","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134903"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MyFitnessPal%20Notice%20and%20Website%20FAQs_0.pdf"}],"summary":"An unauthorized party acquired data associated with MyFitnessPal user accounts, including usernames, email addresses, and hashed passwords.","supporting_quote":null,"technology_involved":["MyFitnessPal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1021.001"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-29","discovered_date":"2018-02-28","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"112308e9cf064f4b39d5e64c64f929bd1c140852","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/M%26H%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"f89949a94915","org_name":"Mendes & Haney, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/M%26H%20notification_0.pdf"}],"summary":"Mendes & Haney, LLP reported unauthorized access through Remote Desktop Protocol, potentially exposing personal and financial information.","supporting_quote":null,"technology_involved":["Remote Desktop Protocol"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fc1d12005b6f36511d78ea970f28396bb49da10","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2dac3c10-c273-11e8-bf07-99bafabab839"},"incident_date":"2018-03-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"739faa83dfa1","org_name":"MedEvolve","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/public-server-exposure-creates-phi-data-security-worries-for-200k"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137784"}],"summary":"MedEvolve, an Arkansas-based practice management software provider, revealed a healthcare data breach exposed the information of more than 200,000 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1acdd79931be07c66195d03614834d867a47092b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8b0b0b80-c335-11e8-be54-d7fc81504f5e"},"incident_date":"2018-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7dd2ca72688","org_name":"Energy Services Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/cyberattack-knocks-energy-services-group-offline/article/755983/"}],"summary":"A cyberattack against Energy Services Group (ESG), which handles customer transactions for natural gas pipelines owned by several energy firms, has knocked the company’s systems offline.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2018-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea4a6a1758e69a4d4e2179360140008a65210e20","impact_type":"data_theft","imported_from":null,"incident_date":"2018-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8c2ffec6ffba","org_name":"Bestialitysextaboo","org_type":"other","ransomware":null,"records_affected":3204,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bestialitysextaboo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bestialitysextaboo"}],"summary":"Bestialitysextaboo was hacked in March 2018, and data including email addresses, usernames, IP addresses, dates of birth, genders, private messages, and password hashes was included in the breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-28","discovered_date":"2018-03-20","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03bd5eb6c09337a0d8faba83b59660a76f2b8996","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ADULT%20Letter_EE_Contractor_Dependent_Beneficiary_vFinal_0.pdf"},"notes":null,"org_country":"US","org_id":"d7872bfaf7a8","org_name":"Shutterfly, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134863"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ADULT%20Letter_EE_Contractor_Dependent_Beneficiary_vFinal_0.pdf"}],"summary":"Unauthorized use of a Shutterfly employee’s credentials accessed the Workday test environment, where employee and dependent data may have been exposed, though no evidence of data theft had been found.","supporting_quote":"On March 20, 2018, we learned that a Shutterfly employee’s credentials were used without authorization to access our Workday test environment on January 11, 2018.","technology_involved":["Workday test environment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-28","discovered_date":"2018-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0067cab01e4754703f39c24b349884d6617b9cc5","impact_type":"data_theft","incident_date":"2017-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Usinger%20Model%20Form%20of%20Notice%20of%20Data%20Breach%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"b93d61fb86a5","org_name":"Fred Usinger, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134869"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Usinger%20Model%20Form%20of%20Notice%20of%20Data%20Breach%20Letter_1.pdf"}],"summary":"Fred Usinger, Inc. reported that customer personal and payment information associated with its e-commerce website was likely acquired by an unauthorized third party.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-28","discovered_date":"2018-02-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cb1af4321ff846e857227203f5fb359ee6b7268","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-10","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CORR%20A.%20Schlidt%20Letter%20to%20CA%20AG%20Data%20Incident%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"a65ca73f992e","org_name":"Applied Plan Administrators","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134841"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CORR%20A.%20Schlidt%20Letter%20to%20CA%20AG%20Data%20Incident%20Notification_0.pdf"}],"summary":"A phishing attack led to unauthorized access to one Applied Plan Administrators email account, with no evidence that personal information was accessed or acquired.","supporting_quote":"Applied Plan Administrators (\"APA\"), a division of TRA, recently fell victim to a phishing attack which resulted in unauthorized access to one APA email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fddab210fe54105e9dfe5a079614c2a49e932c6b","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Prudential%20template%20%28CA-63518%29_0.pdf"},"notes":null,"org_country":"US","org_id":"0c20434d9e3b","org_name":"The Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134811"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Prudential%20template%20%28CA-63518%29_0.pdf"}],"summary":"A vendor inadvertently sent a file containing Prudential annuity holders’ personal and financial information to an unauthorized corporate client, which reported the error and deleted the file without viewing it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-26","discovered_date":"2018-02-22","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c98f0d0fc2233c767cfd4f746e8f15573a8bfff","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Supreme%20Corporation%20Notice%20Letter%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"cb6a8e4fc2ca","org_name":"Paycor, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Paycor employee accidentally mailed the CD to the wrong recipient.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134791"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Supreme%20Corporation%20Notice%20Letter%20-%20CA_0.pdf"}],"summary":"A Paycor employee accidentally mailed a CD containing Supreme Corporation employees’ W-2 information to a recipient at another client company.","supporting_quote":"This limited unauthorized disclosure resulted from this single mailing error by a Paycor employee.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"176785b7141e654b3c29b3d7b068076bd96d7ec4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d30337e0-8907-11e8-82c8-d50e157d53ee"},"incident_date":"2018-03-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f45ec7445b79","org_name":"North Colonie Central School District (NY)","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ny-north-colonie-central-school-district-notifies-retirees-of-data-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ago.vermont.gov/blog/2018/06/27/north-colonie-central-school-district-notice-of-security-incident-to-consumers/"}],"summary":"North Colonie Central School District in New York is notifying some retirees that their personal information was inadvertently exposed on the internet for a period of approximately six weeks.  The breach occurred when a package of information the district made available to vendor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2018-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5a1392e46c4c223cac6edc735327b28e20e6dfa","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"CH","org_id":"bc9e8b5ce632","org_name":"MDPI","org_type":"professional_services","ransomware":null,"records_affected":845012,"reviewed":false,"root_cause":"Data was obtained from an unprotected Mongo DB instance.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MDPI","type":"hibp","url":"https://haveibeenpwned.com/Breach/MDPI"}],"summary":"Data including email exchanges and unique email addresses was obtained from MDPI’s unprotected Mongo DB instance.","supporting_quote":"In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance.","technology_involved":["Mongo DB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b96ec326aaae21868cb8da438e0df57f20d3ddb4","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Branton%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"3d39f45a1c4d","org_name":"Branton, de Jong and Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134775"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Branton%20Notice_0.pdf"}],"summary":"Branton, de Jong and Associates reported unauthorized access to its tax program, with client information potentially accessible.","supporting_quote":null,"technology_involved":["tax program"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ec088b7916841997168e43973b1190fdd7052bf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"046d5440-9728-11e8-8342-0f8f10fcd812"},"incident_date":"2018-03-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"aab38d086360","org_name":"Lloyds and Natwest Banks","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.derbytelegraph.co.uk/news/derby-news/police-want-speak-man-after-1805906"}],"summary":"A fraudster installed a \"skimming device\" at a Derby cashpoint machine and now police want help tracing someone in connection to the crime.  This man was captured on CCTV next to two cash machines outside the Lloyds and Natwest banks in Osmaston Road, Derby, between March 24 and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"566011c80577c876a58180c91bde9873f76884a3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/Presti%26Naegele.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"700e862171f1","org_name":"Presti & Naegle","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/Presti%26Naegele.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9280b6f05ffa6a520be3bf2035e04fdf0aef9598","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SOS001%20Letter%20of%20Security%20Data%20Breach_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ffffef0de10","org_name":"SOS TAX","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134718"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-22","discovered_date":"2018-03-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d8cf23760abfb33ab747833edb1ce6e0a0f5ee2","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20of%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20of%20Notification_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9774.pdf"}],"summary":"American Express Travel Related Services Company notified customers that an attack on Orbitz's booking platform may have put their personal and payment card information at risk.","supporting_quote":"To be clear, this was an attack on the Orbitz platform.","technology_involved":["Orbitz platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Orbitz"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2f6dcad7ee3c","name":"Orbitz"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-21","discovered_date":"2018-03-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a30124c59d1ed55e09f99677fc388f27464b346","impact_type":"data_theft","incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Orbitz%20Sample%20Individual%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"2f6dcad7ee3c","org_name":"Orbitz","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Orbitz%20Sample%20Individual%20Notification_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9773.pdf"}],"summary":"Orbitz determined that an attacker may have accessed personal and payment card information on a legacy travel booking platform.","supporting_quote":null,"technology_involved":["legacy Orbitz travel booking platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-20","discovered_date":"2017-12-21","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e92afddb9036dc5839145c81c9d7f52940daa7f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CareMeridian%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.PDF"},"notes":null,"org_country":"US","org_id":"bddab422b35d","org_name":"CareMeridian, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unencrypted disk containing sensitive information was lost in the mail.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CareMeridian%20LLC%20-%20Notice%20of%20Data%20Event%20-%20Exhibit%201%20-%20CA_0.PDF"}],"summary":"CareMeridian reported that an unencrypted disk containing sensitive information was lost in the mail, with no evidence of actual or attempted misuse.","supporting_quote":"On December 21, 2017, [entity] discovered that an unencrypted disk sent by a third-party software provider containing documents that included sensitive information appeared to have been lost in the mail.","technology_involved":["disk"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-19","discovered_date":"2018-02-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"764b571c51eebc0cfc19848d740f1efe48096fe7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Account%20Holder%20Notification%20v1_0.pdf"},"notes":null,"org_country":"US","org_id":"c534f281bf35","org_name":"NetCredit","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Account%20Holder%20Notification%20v1_0.pdf"}],"summary":"An unauthorized party used valid credentials to access some NetCredit accounts, potentially viewing account holders’ personal and financial information.","supporting_quote":"On or about February 20, 2018, our security team discovered that an unauthorized \nparty used valid email address es and password s to log in to a small percentage of NetCredit accounts.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab9577a8e345585e288f332f732c833bc883af5f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bronson%20Nutritionals%20-%20Template%20Individual%20Notification%20Letter%20%28U.S.%20Residents%29_0.pdf"},"notes":null,"org_country":"US","org_id":"844c85ab0dbb","org_name":"Bronson Nutritionals LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134581"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bronson%20Nutritionals%20-%20Template%20Individual%20Notification%20Letter%20%28U.S.%20Residents%29_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9772.pdf"}],"summary":"Bronson Nutritionals identified malware on certain systems that may have collected payment card information from customers who made purchases between May 15, 2017 and January 30, 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9649d1bb091cdaf68bf1d33f9d6b94769f52cbab","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/SCComHigherEducation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8eed1b2f242","org_name":"SC Commission on Higher Education","org_type":"unknown","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/SCComHigherEducation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14b962605cabc329ff32384233411a5e14754865","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"8c8dc022f955","org_name":"Florida Virtual School","org_type":"education","ransomware":null,"records_affected":368000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Florida Virtual School","type":"hibp","url":"https://haveibeenpwned.com/Breach/FLVS"}],"summary":"Florida Virtual School reported a breach involving an XML file with 368,000 student records that was found circulating.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f9ecd91fcdb5aa82bf3377dccb73c4dfbb80485","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"69dd8e762325","org_name":"MangaFox.me","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MangaFox.me","type":"hibp","url":"https://haveibeenpwned.com/Breach/MangaFox"}],"summary":"MangaFox.me's vBulletin forum exposed approximately 1.3 million accounts, including usernames, email and IP addresses, dates of birth, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-03-16","discovered_date":"2018-01-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48916e406461b4b57780a323c61c8870765c9455","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Taylor-Dunn_CA_Notice_Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"9d6feef7d996","org_name":"Taylor-Dunn Manufacturing","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Taylor-Dunn_CA_Notice_Sample_0.pdf"}],"summary":"Taylor-Dunn Manufacturing found cryptomining malware on a server hosting its online customer care and dealer centers, and a file containing customer information may have been accessed.","supporting_quote":null,"technology_involved":["online customer care and dealer centers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73cb3fbf291194ba02a286ea605231cb03a381fa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40860ae0-8ea3-11e8-8003-e3ff5269fee2"},"incident_date":"2018-03-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"917f7e729cc1","org_name":"University Medical Center Health System, UMC Physicians","org_type":"healthcare","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/texas-physician-group-notifies-18k-of-data-breach-after-email-hack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-umc-physicians-offers-identity-protection-to-18000-patients-after-data-breach/"}],"summary":"The physician group at Lubbock, Texas-based University Medical Center Health System, UMC Physicians, began notifying more than 18,000 patients of a recent data breach that may have compromised their protected health information.  In May, the IT team at UMCP discovered an employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-15","discovered_date":"2018-02-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e6b06a8c69e05bcb69c81e6a0476fbeb4ec0c167","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9771.pdf"},"notes":null,"org_country":"US","org_id":"4c0fea6fbb6d","org_name":"Parker Staffing Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9771.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9771.pdf"}],"summary":"Parker Staffing Services learned that a PDF containing W-2 statements had been inadvertently sent as an email attachment to an outside individual.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ec83acfa64914033039ab7d80b85fe45e1fa6b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f1453680-d3e4-11e9-ab55-b7fffb94511d"},"incident_date":"2018-03-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"58ef798ee1fb","org_name":"Collins Foods","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/when-an-it-manager-falls-victim-to-a-phish-487280"}],"summary":"IT manager for Collins Food fell for phishing email ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f1dcdfd167d34bf4bedb89769fe21b2895cba84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef6f8c20-c274-11e8-bf07-99bafabab839"},"incident_date":"2018-03-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ab46f30dc04","org_name":"Los Angeles County 211 Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-211-data-20180515-story.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/only-researchers-accessed-the-exposed-211-call-logs-los-angeles-county/"}],"summary":"Los Angeles County 211 service had a security incident  caused by an employee who inadvertently misconfigured the settings during a recent upgrade, which caused a database file containing names, driver's license number and ss#'s to be accessible from the internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab012ad7ee0702b1cb72fec2d904b6a2efd32cde","impact_type":"unknown","incident_date":"2014-12-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_25.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134411"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d31f21faa9ac3823b1e80ba98c945f8b7f1a42e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"758694c0-ffd2-11e9-ad81-39b9e5fce51c"},"incident_date":"2018-03-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"2a392f5df23d","org_name":"Zero1","org_type":"technology_saas","ransomware":null,"records_affected":292,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.marketing-interactive.com/local-telco-zero1-slapped-with-sg4k-fine-for-personal-data-breach/,https://www.straitstimes.com/singapore/zero1-fined-4000-for-not-securing-personal-data-first-telco-to-breach-privacy-laws"}],"summary":"Partner posts customer information on website without appropriate security controls","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7488749d8fcb464f7bdba421289ef0b12193d576","impact_type":"data_theft","imported_from":null,"incident_date":"2016-11-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"133817c04844","org_name":"xHamster","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: xHamster","type":"hibp","url":"https://haveibeenpwned.com/Breach/xHamster"}],"summary":"Hackers traded xHamster user records containing email addresses, usernames and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2018-03-08","discovered_date":"2017-08-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c8dfde6f4a76e437c1fdfd1f83737a439fc2946c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9770.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b39cf9164efa","org_name":"ABM Industries Incorporated","org_type":"professional_services","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":"Several employees clicked phishing emails and entered their credentials, after which an unknown actor gained access to certain email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9770.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9770.pdf"}],"summary":"ABM Industries reported that employees entered credentials after clicking phishing emails, and an unknown actor accessed certain email accounts.","supporting_quote":"Several ABM employees had clicked on the phishing emails and entered their credentials.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b2af4f92d3d84bec2e5d9761e7ed129bcc6c4f0","impact_type":"unknown","incident_date":"2018-02-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2814f14a5751","org_name":"Pioneer Pacific College","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pioneer%20Pacific%20College-2018-03-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f8c65383bd72a3bb235012d15bb2a7eb6b06067","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a8fdb420-b210-11e8-800d-891a5c02ea18"},"incident_date":"2018-03-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"462344db6236","org_name":"Israeli Defense Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.middleeastmonitor.com/20180307-top-secret-document-about-idf-capabilities-posted-online/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/news/420744-israel-top-secret-military-leak/"}],"summary":"an error lead to a leak of top secret Israeli IDF details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-06","discovered_date":"2018-01-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e76fdd013ab492d7073448284a2dcb6c378f58d7","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-22","initial_access":"physical_or_paper","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CM%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"71f6fdaac808","org_name":"California State University, Fresno","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134231"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CM%20Notice_0.pdf"}],"summary":"A break-in at California State University, Fresno resulted in the theft of an unencrypted hard drive that may have contained personal information.","supporting_quote":"A break-in occurred in the Athletics Department sometime in the last week of December 2017, during the campus holiday closure.","technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7be8e8462c1aa8b6b82dd5553fed840600b92010","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22ff26f383a7","org_name":"Wofford College","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Wofford%20College-2018-03-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f5e2a75b703e0732bbbf4332988cb7395b491b7a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb118691ec12","org_name":"Trident Technical College","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Trident%20Technical%20College-2018-03-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"IN","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08a8a2a8a680d1fc709346ded98c6bbed7898a2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe6b48d0-b203-11e8-800d-891a5c02ea18"},"incident_date":"2018-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"168a304bf39d","org_name":"SK Institute of Medical Sciences","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kashmirdispatch.com/2018/03/10/top-kashmir-doctor-to-thieves-keep-everything-you-stole-just-return-my-hard-drive/151120/"}],"summary":"a doctor had his bag containing laptop, mobile, hard drive and papers stolen from his car. He pleads with thief to keep the other stuff but return the hard drive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b5e69a8261397017c86feb9fa476ae8724a8f77d","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9769.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"ac4e222f62ac","org_name":"Preferred Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":21687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9769.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9769.pdf"}],"summary":"An unauthorized party accessed reservation and payment card information in Sabre’s system for certain Preferred hotel properties.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"352dd0dca4469ec9c9638a06d9eff73e35b15113","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-06-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_22.pdf"},"notes":null,"org_country":"US","org_id":"c4b1791f751e","org_name":"Preferred Hotel & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134170"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_22.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Preferred%20Hotel%20%26%20Resorts-2018-03-02"}],"summary":"An unauthorized party used credentials to access reservation information in Sabre’s system, including payment card and guest information for certain Preferred hotel properties.","supporting_quote":"an unauthorized party gained access to user credentials that en abled the party to view some reservation information for a subset of hotel reservations that Sabre processed on behalf of some of its customers, including certain Preferred hotel properties.","technology_involved":["Sabre SynXis Central Reservations System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"105bac0a7fd6302b87168a90d9d7704ac553b377","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"b630c8c9eb99","org_name":"Cruzstar LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134164"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification_0.pdf"}],"summary":"Malware was injected into Cruzstar LLC’s Desktop ordering site and was intended to capture credit card information submitted there.","supporting_quote":null,"technology_involved":["Desktop ordering site","MenuDrive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d16b9745ec46575762feb53e4ce329d4954bcf02","impact_type":"unknown","incident_date":"2017-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ventiv-Notice-Keenan.Provider.CA_.02.14.2018_SAS_PROOF_1.pdf"},"notes":null,"org_country":"US","org_id":"41a3123ddee7","org_name":"Ventiv Technology, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134144"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ventiv-Notice-Keenan.Provider.CA_.02.14.2018_SAS_PROOF_1.pdf"}],"summary":"Ventiv Technology notified people of a security incident that may have involved personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22a58a459e0776455d3002e0bed3e06119f6d9b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f334b690-b6a4-11e8-b56a-011002460f8b"},"incident_date":"2018-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"577e1cbec3ed","org_name":"University of Alberta","org_type":"education","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://globalnews.ca/news/4155854/camp-fyrefly-data-breach-edmonton/"}],"summary":"PII downloaded to personal device in breach of policy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","financial","medical"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7414ec0690ff3889ae567f3c189fff5e359b37e6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b05bf50-a4ad-11e8-b571-7db57cad93dd"},"incident_date":"2018-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"021bf26af99b","org_name":"UnityPoint Health","org_type":"healthcare","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unitypoint-warns-1-4-million-patients-their-information-might-have-been-breached-by-email-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.com/iowa-health-group-data-breach-hits-14-million-patients-a-11264?rf=2018-07-31_ENEWS_SUB_DBT_Slot1&mkt_tok=eyJpIjoiTmpNd01ERXlPVFppTUdJMyIsInQiOiJPSDlUU3NCS0t4a2pJVmZTN1NOU1wvaXhRUjFKY0VkczRsVGx2RnJoMHcrXC9reHhEUXFpcjFKbnF3NGFMSXo2MTNpSGgwV0pMeFZSSVdwSnM0d0d5RStCNzdNbVJvaGxjZlY1aU5WY1JmZk14aG1WczlzNjJBd3RTZmw1ckcwWUg4In0%3D;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.desmoinesregister.com/story/news/health/2018/07/30/unitypoint-data-breach-million-patients-email-hack-hacked-phishing-e-mail-health-care-iowa/866760002/"}],"summary":"One of Iowa’s main hospital and clinic systems has notified about 1.4 million patients that their personal information might have been breached.  UnityPoint Health officials said hackers used “phishing” techniques to break into the company’s email system. The company, based in We","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c231e8e9db8b0a720a7f2d45d64fbf81cf0aea6a","impact_type":"unknown","incident_date":"2018-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"826caf270fc7","org_name":"TravCorp USA, Inc. d/b/a The Travel Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134133"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af0bfacb12914fd75f00b8563e3c4ec62df67b72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccc4b440-bd40-11e8-aa8d-730052dce2c2"},"incident_date":"2018-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e2384ae90901","org_name":"The National Lottery","org_type":"government","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-5511033/National-Lottery-warns-10-5m-players-change-passwords.html"}],"summary":"Credential stuffing attack leads to access of 150 accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2018-03-01","discovered_date":"2018-05-17","entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87e758ea122e0658e0aaed4b998f2685e3f87897","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4a728d60-8e96-11e8-8003-e3ff5269fee2"},"incident_date":"2018-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd5a9f6188b6","org_name":"Sunspire Health","org_type":"healthcare","ransomware":null,"records_affected":6737,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.citizentribune.com/news/business/sunspire-health-provides-notice-of-data-incident/article_0c0dbff0-70a4-53cb-924e-c6cf7dd70f47.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.businesswire.com/news/home/20180716005821/en/Sunspire-Health-Notice-Data-Incident;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/sunspire-health-patient-data-at-risk-from-email-breach"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sunspire%20Health-2018-07-27"}],"summary":"Between April 10, 2018 and May 17, 2018, Sunspire learned that its employees became the target of a phishing email campaign that compromised several email accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b689807d1ec4e4e34366ca29f802cda16d16b8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e26d7060-b116-11e8-ac9c-a56a5b5fabb0"},"incident_date":"2018-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"13b774a38651","org_name":"Hillsview Academy","org_type":"education","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gazettelive.co.uk/news/teesside-news/up-100-students-info-sent-14391824"}],"summary":"The personal details of up to 100 students at Hillsview Academy, Teesville , have ended up in the wrong hands.   It involved ‘data checking forms’ - containing everything from contact details to medical history - being delivered to the incorrect parents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"447e57f50b778564a8f8714265d6730bfe58d66c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f4252f0-28dd-11e9-adf7-352895b3dcd2"},"incident_date":"2018-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e9f335c7c68","org_name":"Google","org_type":"technology_saas","ransomware":null,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/technology/2018/oct/08/google-plus-security-breach-wall-street-journal;"},{"fetched_at":null,"title":null,"type":"press","url":"https://apnews.com/ac6087bb51194e158d80fed1dd8a4a2c;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.inquisitr.com/5113338/google-targeted-by-senate-committee-after-massive-data-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.providencejournal.com/news/20181211/ri-pension-system-sues-google-for-not-disclosing-breach"}],"summary":"Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage.  Shortly after the story","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9667492cd1ec24650705a51d6ecdc149827e72a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa70b2d0-fe87-11e8-aee0-f7420d4f3238"},"incident_date":"2018-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"57c0f3985216","org_name":"Cathay Pacific","org_type":"transportation_logistics","ransomware":null,"records_affected":9500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.legco.gov.hk/yr18-19/english/panels/ca/papers/caitbse20181114cb2-222-2-e.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2018/10/24/cathay-pacific-passenger-data-stolen-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.cathaypacific.com/cathay-pacific-announces-data-security-event-affecting-passenger-data;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.news.com.au/travel/travel-advice/flights/cathay-pacific-says-94-million-passengers-affected-by-major-data-leak/news-story/743fc7db7f1bea46fa5392a8e31f6a96;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/business-45974020;"}],"summary":"Cathay Pacific, one of the main airlines in Hong Kong, says records on as many as 9.4 million passengers may have been stolen in a data breach.  The airline said in a statement Wednesday that there was “no evidence” that passenger data had been misused, but warned that passenger ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c30b6021204e93c2171ba46b7800ecad7d5b353a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"239dbd50-33b8-11e9-98e0-dd5a6fccbee9"},"incident_date":"2018-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"b9ce5555fce9","org_name":"Brazil Central Bank","org_type":"financial","ransomware":null,"records_affected":120000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/apache-misconfig-leaks-data-120/"}],"summary":"The identity numbers of 120 million Brazilians have been found publicly exposed on the internet after yet another IT misconfiguration.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-02-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46a455b67db5dd409597113e0c7c6590954c958d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93c98df0-c32b-11e8-be54-d7fc81504f5e"},"incident_date":"2018-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fe4dd608931","org_name":"Scenic Bluffs Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":2889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/scenic-bluffs-healthcare-data-breach-could-affect-2889"}],"summary":"Cyber attackers gained limited unauthorized access to one staff email account within the Scenic Bluffs Community Health Centers system and may have obtained some information relating to patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-27","discovered_date":"2017-11-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3be3e5603daa7bcb5fcf658a331287df4c6805ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice%20Samples_0.pdf"},"notes":null,"org_country":"US","org_id":"cb65a4a0e9e6","org_name":"FastHealth Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134095"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice%20Samples_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#FastHealth%20Corporation-2018-02-27"}],"summary":"FastHealth reported that an unauthorized third party accessed its web server and may have accessed databases containing names.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"52c94d42522556d2646913a6463734aa4763896e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/UWSuperiorAlumniAssociation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"920664ff2650","org_name":"University of Wisconsin-Superior Alumni Association","org_type":"unknown","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/UWSuperiorAlumniAssociation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-02-26","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cc54aea43421b44588b93d57ab9b332f0b94544","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"765c791e5a8b","org_name":"Innovative Artists Talent and Literary Agency, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Notice_0.pdf"}],"summary":"A burglar stole computer equipment from Innovative Artists’ office that may have contained personal information, though unauthorized access to the data was not confirmed.","supporting_quote":"In the course of the burglary, certain computer equipment that may contain some of your personal information was stolen.","technology_involved":["Apple computer hardware"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-26","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42b8ad679cdfa68abd4e78ee461b580d601b69f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCA%20-%20Regulator%20Notice%20-%20CA%20-%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"512c8f90e99e","org_name":"California College of the Arts","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee's laptop was stolen from their vehicle.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCA%20-%20Regulator%20Notice%20-%20CA%20-%20FINAL_0.pdf"}],"summary":"A College employee's stolen laptop may have contained individuals' names and Social Security numbers, but the College found no evidence of misuse.","supporting_quote":"On Friday January 19, 2018, a California College of Arts (the “College”) laptop used by one of our employees was stolen out of the employee’s vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f5d9d346148774d36af7d92f655318c6b26d361","impact_type":"data_theft","incident_date":"2018-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"8d1b63920450","org_name":"2,844 Separate Data Breaches","org_type":"unknown","ransomware":null,"records_affected":80115532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 2,844 Separate Data Breaches","type":"hibp","url":"https://haveibeenpwned.com/Breach/2844Breaches"}],"summary":"In February 2018, a massive collection of almost 3,000 alleged data breaches was found online . Whilst some of the data had previously been seen in Have I Been Pwned, 2,844 of the files consisting of more than 80 million unique email addresses had not previously been seen. Each f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54330881607c56ddd8dee2db9b9d252d25d67cf2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b9dce4a0-b1f7-11e8-800d-891a5c02ea18"},"incident_date":"2018-02-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0f29d6f7e42","org_name":"Zeal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.clickondetroit.com/news/atm-scams-at-two-allen-park-zeal-credit-unions-prompt-investigation"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wxyz.com/news/zeal-credit-union-investigating-atm-skimming-scam-at-allen-park-branches"}],"summary":"two skimmers placed in bank atms. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"BR","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0754ace7faa8612c2f4068ad22ae9032c1be80e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a9a8c670-9b41-11e8-8c28-77aa5b8d940e"},"incident_date":"2018-02-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a61c2d9ccfda","org_name":"Eastern Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stl.news/%E2%80%8Emassachusetts-news-brazilian-national-karem-kawamura-sentenced-role-atm-skimming-scheme/138707/"}],"summary":"Mr. Kawamura placed skimming devices on ATMs in several cities. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-02-23","discovered_date":"2018-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c1cd616f83a10eba74bc1e8bb366efa00cbb310","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/North%2040-%20California%20Form%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"55278d3635c8","org_name":"North 40 Outfitters","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134036"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/North%2040-%20California%20Form%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#North%2040%20Outfitters-2018-02-23"}],"summary":"North 40 Outfitters reported unauthorized access and/or acquisition of customer payment-card information and potentially account credentials used on its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","internal"],"disclosed_date":"2018-02-22","discovered_date":"2017-12-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b3a4293eefbe38319126e0c36349fd1657ec145","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TEMPLATE_Santa_Cruz_Biotechnology_Consumer_Notification_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"04f4697576d7","org_name":"Santa Cruz Biotechnology, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134011"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TEMPLATE_Santa_Cruz_Biotechnology_Consumer_Notification_Letter_0.pdf"}],"summary":"A burglary at Santa Cruz Biotechnology's Santa Cruz office resulted in the theft of two HR computers that may have contained personal information.","supporting_quote":"As a result of our investigation, we have determined that two computers were stolen, both of which were used for HR functions, but neither of which are capable of remotely accessing our systems.","technology_involved":["HR computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2018-02-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ea4421da369e069378efce941a5e1afeeaa2aec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5b43de70-a627-11e8-b17d-c5c01e287634"},"incident_date":"2018-02-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a0cc9e55e7b","org_name":"Manduka","org_type":"other","ransomware":null,"records_affected":9616,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Manduka%20--%20CA%20AG%20--%20Update_1.pdf"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Manduka%20Round%202%20Ad%20r1prf_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134813"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Manduka-2018-03-27"}],"summary":"Manduka had their e-commerce platform infected by malware affecting 9,616 users in February and once again in May.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"019e31016741cc1637417141f84b9b06ef375cf5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67855d00-ad37-11e8-9e5a-c1f99505e93a"},"incident_date":"2018-02-22","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"e05433dce514","org_name":"Independent Accountant","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://timesofindia.indiatimes.com/city/jaipur/city-accountant-hit-in-suspected-ransomware-attack/articleshow/63050394.cms"}],"summary":"Ransomware on a network in India","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fffb8326c4e53fa9c4b01c6be36ff67a2062c680","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Solera%20Holdings_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8d440cdeb595","org_name":"Solera Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133959"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2018-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fb05e2675587c1923a3464119eb4f64820caa3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5c74fa60-ffe3-11e9-830f-9f9afa6b578d"},"incident_date":"2018-02-21","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da7b1ede3b50","org_name":"Oregon Department of Revenue","org_type":"government","ransomware":null,"records_affected":15300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.eastoregonian.com/news/state-worker-who-uploaded-sensitive-information-resigns/article_b8fc4192-265f-5517-9416-472da9b93251.html,https://www.registerguard.com/rg/news/local/36580917-75/oregon-revenue-department-says-security-breach-affected-36000.html.csp,https://www.oregonlive.com/politics/2018/03/oregon_tax_agency_employee_cop.html"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Oregon%20Department%20of%20Revenue-2018-03-27"}],"summary":"employee copies spreadsheets to personal google drive to take the macros to his next employer, but also copies 15k people's worth of PII incidentally.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ffdceb04e0e746797db541bf3c731ea9dcde2db","impact_type":"data_theft","incident_date":"2018-02-14","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LA%20Philharmonic%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Ex%201_0.pdf"},"notes":null,"org_country":"US","org_id":"90f9505f31a2","org_name":"Los Angeles Philharmonic","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A spear-phishing email scheme led to the theft of employees' W-2 information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LA%20Philharmonic%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Ex%201_0.pdf"}],"summary":"The Los Angeles Philharmonic reported that a spear-phishing email scheme led to the theft of employees’ W-2 information.","supporting_quote":"The security breach was the result of a sophisticated “spear phishing” email scheme that led to the theft of W-2 information for individuals employed by the LA Phil in 2017.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7114cffcad2ae614d9d644eac0072b69ce5c264","impact_type":"unknown","incident_date":"2018-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/221725%20Red%20Hawk%20Casino%20-%20Individual%20Letter_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"17df59aee087","org_name":"Ascensus, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133904"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e98d7126ae372a06824e9b10a3145dbeaed54f0","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/White%20and%20Bright%20Dental%20-%20Breach%20Notification%20Letter%20021618_0.pdf"},"notes":null,"org_country":"US","org_id":"5a46daa7febc","org_name":"White and Bright Family Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/White%20and%20Bright%20Dental%20-%20Breach%20Notification%20Letter%20021618_0.pdf"}],"summary":"Cyber criminals accessed a business computer server containing patients’ personal and health information.","supporting_quote":null,"technology_involved":["business computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4239e35d257c1b14cd1ecd469db1ea0f571b334f","impact_type":"data_theft","imported_from":null,"incident_date":"2017-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"0c8444cf1b17","org_name":"Underworld Empire","org_type":"other","ransomware":null,"records_affected":428779,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Underworld Empire","type":"hibp","url":"https://haveibeenpwned.com/Breach/UnderworldEmpire"}],"summary":"A breach of the Underworld Empire vBulletin forum exposed account data that was later posted for download.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"546d2fdebfb96db961dc2c0985ae399acbc75331","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bbd6aaf0-bd3e-11e8-aa8d-730052dce2c2"},"incident_date":"2018-02-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a021689012c3","org_name":"SAMBA Federal Employee Benefit Association","org_type":"financial","ransomware":null,"records_affected":13942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/samba-mailing-error-creates-data-security-concern-for-13.9k"}],"summary":"Misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db55d9f83135f5524844badef8d2278290492c6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d83fdf20-d302-11e8-9b3a-b50b161886e9"},"incident_date":"2018-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79ae7f329a24","org_name":"SAMBA","org_type":"government","ransomware":null,"records_affected":13942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/samba-mailing-error-creates-data-security-concern-for-13.9k"}],"summary":"SAMBA A programming error that occurred during the preparation process for mailing out certain IRS tax forms may have led to documents being sent to the wrong recipients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-16","discovered_date":"2018-02-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"40dd4ff7e76dc528535fdb609815533e24b95c14","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a68a235aa8d7","org_name":"TERRA Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TERRA%20Services%2C%20Inc.-2018-02-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdf40740187438453de03f143f6aadaf25b1f523","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_21.pdf"},"notes":null,"org_country":"US","org_id":"0128190da7bf","org_name":"American Stock Transfer & Trust Company, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_21.pdf"}],"summary":"American Stock Transfer & Trust Company sent shareholder information to financial advisors in a file they could manipulate to access information about other shareholders.","supporting_quote":"On the same day, it was discovered that the financial advisors could manipulate the file to access information relating to shareholders who are not their clients .","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"missing_mfa","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-02-16","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a03691d085b02ba9e1db6310935aeeb5267eb0ae","impact_type":"data_theft","imported_from":null,"incident_date":"2017-06-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":null,"org_country":"unknown","org_id":"77136d80c4ef","org_name":"8tracks","org_type":"technology_saas","ransomware":null,"records_affected":18000000,"reviewed":false,"root_cause":"An employee's GitHub account was used as the attack vector and was not protected by two-factor authentication.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 8tracks","type":"hibp","url":"https://haveibeenpwned.com/Breach/8tracks"}],"summary":"8tracks reported that an attack using an employee’s GitHub account exposed data from 18 million accounts.","supporting_quote":"In their disclosure, 8Tracks advised that \"the vector for the attack was an employee’s GitHub account, which was not secured using two-factor authentication\".","technology_involved":["GitHub"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"GitHub"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"6a05e21126a6","name":"GitHub"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9e6e74c8b304171938ceef44ca78ddee804b85e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"bfb1cbf38a74","org_name":"Guns and Robots","org_type":"other","ransomware":null,"records_affected":143569,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Guns and Robots","type":"hibp","url":"https://haveibeenpwned.com/Breach/Playgar"}],"summary":"Guns and Robots suffered a breach exposing 143,569 records containing email and IP addresses, usernames, and SHA-1 password hashes.","supporting_quote":null,"technology_involved":["gaming website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-14","discovered_date":"2017-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb97b97b035d687b73312c6f70cb0749bf2ec238","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CDFW%20Breach%20Notification-Final_0.pdf"},"notes":null,"org_country":"US","org_id":"926fac5d5899","org_name":"California Department of Fish and Wildlife","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee downloaded personally identifiable information to an unencrypted personal device and took the data outside of CDFW’s secure network.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CDFW%20Breach%20Notification-Final_0.pdf"}],"summary":"A former employee took employee and vendor personal information from the California Department of Fish and Wildlife to an unencrypted personal device.","supporting_quote":"A former employee downloaded personally identifiable information to an unencrypted personal device and took the data outside of CDFW’s secure network.","technology_involved":["personal device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b1aae817348108b85e8553b45cfde994ed99cc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65942fe0-aa0c-11e8-b272-396d7fe012b7"},"incident_date":"2018-02-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5280695f41b","org_name":"SunTrust Bank","org_type":"financial","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocala.com/news/20180309/second-skimmer-reported-at-area-bank"}],"summary":"A second SunTrust bank has had a skimming device installed at an ATM machine and nearly a dozen cards were fraudulently used.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-13","discovered_date":"2017-07-28","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"692d484907f94150656f7f155ab7d9f6ade4410c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Driscoll%27s%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"be4951cda442","org_name":"Driscoll’s, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees’ payroll log-in credentials were compromised after they responded to a phishing email.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133736"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Driscoll%27s%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"A phishing email compromised employees’ payroll log-in credentials and led to unauthorized access to some email accounts containing personal information.","supporting_quote":"On or about July 28, 2017, Driscoll’s determined that some employees’ payroll log-in credentials were compromised when the employees responded to a phishing email.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"48c21989df9c0ebe48b33489e0d0327e8aa32094","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/OneMainFinancial.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ede9a71ca2de","org_name":"OneMain Financial","org_type":"unknown","ransomware":null,"records_affected":58,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/OneMainFinancial.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ca09a7990766f9958cec10633155018d5bc454","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8b660e60-bd43-11e8-aa8d-730052dce2c2"},"incident_date":"2018-02-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cf8ed730d32","org_name":"Innovative Artists","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://observer.com/2018/03/innovative-artists-data-breach-equifax/"}],"summary":"Stolen computer leads to data loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b220279c13f23af2cd6e4a8b499cbe9d65de6ea","impact_type":"unknown","incident_date":"2018-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"4cf8e58ff55f","org_name":"Autocentrum.pl","org_type":"unknown","ransomware":null,"records_affected":143717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Autocentrum.pl","type":"hibp","url":"https://haveibeenpwned.com/Breach/Autocentrum"}],"summary":"In February 2018, data belonging to the Polish motoring website autocentrum.pl was found online . The data contained 144k email addresses and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f7c7956fa681101b982d4888fcf4000b421e1a1f","impact_type":"unknown","incident_date":"2017-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"496599d208f7","org_name":"Equifax Consumer Services LLC","org_type":"unknown","ransomware":null,"records_affected":36,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Equifax%20Consumer%20Services%20LLC-2018-02-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-07","discovered_date":"2017-12-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e79a32645c8634f7cfd4544da743597eb4812d51","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification-PDF_0.pdf"},"notes":null,"org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack allowed an unauthorized individual to access Salem and Green's email system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133637"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification-PDF_0.pdf"}],"summary":"A phishing attack gave an unauthorized individual access to Salem and Green's email system, where personal information related to Sutter Health was potentially viewed, accessed, or downloaded.","supporting_quote":"This allowed an unauthorized individual to access the Salem and Green email system.","technology_involved":["email account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Salem and Green"},"updated_at":"2026-10-10","veris_action":"social","derived":{"vendors":[{"id":"acdaff4e4331","name":"Salem"},{"id":"4c8d3cc24b3e","name":"Green"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"876953a212867ec750c5d13b0106ebb30e36f0a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NARS%20-%20CA%20Exhibit%201_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3c60a5b8eecb","org_name":"North American Risk Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":604,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/hundreds-of-california-residents-affected-by-north-american-risk-services-breach-523086.shtml"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-140508"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NARS%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"North American Risk Services reported unauthorized access to several employee email accounts, where personal information was accessible to the unauthorized actor.","supporting_quote":null,"technology_involved":["employee email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9a049a6dd282932ab19a42c7debebba9f2cae4f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5cdf0770-b115-11e8-ac9c-a56a5b5fabb0"},"incident_date":"2018-02-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7af411f5ab2","org_name":"Chesapeake Regional Health Care Sleep Center","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.13newsnow.com/article/news/data-breach-at-chesapeake-sleep-center-over-2k-patients-affected/291-535985108"}],"summary":"Over 2,000 patients' personal electronic information may have been compromised.  The data breach affected patients who received medical services at the Chesapeake Regional Healthcare Sleep Center from April 2015 to February 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2018-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"350bbd660607fc68e69782f9346dc4ae3fb61d75","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"da0b05e0-ad29-11e8-9e5a-c1f99505e93a"},"incident_date":"2018-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30d118f5c6fe","org_name":"Wisconsin Department of Health Services","org_type":"government","ransomware":null,"records_affected":779,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://madison.com/wsj/news/local/crime/stolen-laptop-had-state-program-participants-personal-info-on-it/article_e7a477b4-3cc3-5fa3-a01c-27f12e961583.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.channel3000.com/news/dhs-theft-of-laptop-theft-possibly-compromises-data-on-hundreds-of-patients/725078322;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hngnews.com/sun_prairie_star/news/article_b859a168-3fcb-59ce-80de-863066711f9e.html"}],"summary":"The Wisconsin Department of Health Services (DHS) and The Management Group (TMG) are notifying IRIS participants of a breach of information due to theft of a laptop and a work bag of a TMG IRIS Consultant on Feb. 5, 2018","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a6ae7bb86bbc85de86e217ef6555b8262d6a373","impact_type":"unknown","incident_date":"2017-12-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Letters%20-%20General_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69a20560008e","org_name":"PAR Electrical Contractors, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133549"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PAR%20Electrical%20Contractors%2C%20Inc.-2018-02-05"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"896ce422bb7c7a12bcc12a7154b81d02dd5412a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"deba13c0-c119-11e8-a33a-95e6749d3999"},"incident_date":"2018-02-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce1ffc532f38","org_name":"DC Public Schools","org_type":"education","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/personal-info-for-2000-dc-students-mistakenly-posted-online/"}],"summary":"Publishing error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1110"],"confidence":"high","control_failure":"unknown","credential_source":"brute_force","cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2018-02-02","discovered_date":"2017-10-03","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e3ebefd9b91ea033f7fb66f27c4f3907b4a170c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1110","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T927_v01.pdf_Prescription_0.pdf"},"notes":null,"org_country":"US","org_id":"10f8ef48ff7c","org_name":"Ron's Pharmacy Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133503"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T927_v01.pdf_Prescription_0.pdf"}],"summary":"An unauthorized individual accessed an employee email account after cracking its password and viewed emails containing personal, prescription, and payment adjustment information.","supporting_quote":"As part of this investigation, we determined that the employee’s email account was subject to unauthorized access and certain emails were viewed as a result of the unauthorized individual(s) using software to crack the employee’s email account password.","technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2018-02-02","discovered_date":"2018-01-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2c81643a43ff1eddb378509fd034d729e70b5fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-29","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample_Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"db7e7614257a","org_name":"Advanced-Online","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample_Notice_0.PDF"}],"summary":"Advanced-Online reported that personal, credential, and payment card information on its online platform may have been subject to unauthorized access.","supporting_quote":null,"technology_involved":["online platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f84726a549449ce68e6272e9e9aef4be49731b99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ff14110-c356-11e9-9e37-df5a0636e02f"},"incident_date":"2018-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d6822f10c08","org_name":"St. Louis Community College","org_type":"education","ransomware":null,"records_affected":362,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kmov.com/news/st-louis-community-college-investigating-possible-student-data-breach/article_3cf4b96a-a234-5e11-8914-322f7ec05023.html"}],"summary":"employee sent many students' information to many students","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a3f3035375b0f397c7652e1f7fca5fb3126d161","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"013d6d40-fbeb-11e9-8c71-6b6c5a5368d9"},"incident_date":"2018-02-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1aaaee60bdc8","org_name":"Sheffield Credit Union","org_type":"financial","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cutoday.info/Fresh-Today/Personal-Data-On-15-000-Members-Stolen-In-Cyber-Attack,https://www.bbc.com/news/uk-england-south-yorkshire-44039296"}],"summary":"brute force used to access and steal customer database from credit union.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31902241175141abecb978eeb3f5dddb1b97d89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f08e7350-a61d-11e8-b17d-c5c01e287634"},"incident_date":"2018-02-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2a1906a0572","org_name":"PopSugar, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":123857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/POPSUGAR%20Notice%20of%20Data%20Breach_0.pdf"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/POPSUGAR%20Notice%20of%20Data%20Breach_0.pdf,https://portswigger.net/daily-swig/hack-at-us-website-popsugar-leaks-124k-users-details"}],"summary":"Attacker hacked in to the network somehow (not stated) and stole credentials of over 100,000 users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47c31e332dc7308810cf3af5c9538bee02fecd60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70395d90-aa0b-11e8-b272-396d7fe012b7"},"incident_date":"2018-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HT","org_id":"ee8b68f5f4a9","org_name":"Oxfam","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.civilsociety.co.uk/news/oxfam-investigated-by-ico-over-personal-data-breach.html"}],"summary":"Oxfam has been investigated by the Information Commissioner’s Office after it circulated a copy of its 2011 report about sexual misconduct in Haiti that was “not securely redacted”. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"82679c29608337bd658ddf30f95aa662e7037153","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9765.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e500180f875c","org_name":"North Beach School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9765.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d047517a34a7d4d7d1ad3b5ceeab5e3ee57eb8f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f1fa920-034e-11e9-aee0-f7420d4f3238"},"incident_date":"2018-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1f39282179d","org_name":"Dover-Phila Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesreporter.com/news/20180306/dover-phila-federal-credit-union-ceo-no-member-will-lose-any-money-due-to-debit-card-issues"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"b3d5b3e8b060ef375263645f11680d93abdc708e","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10506.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"76463206fd2e","org_name":"Creation Entertainment, Inc.","org_type":"other","ransomware":null,"records_affected":2467,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Creation%20Entertainment%2C%20Inc.-2019-08-26"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10506.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-150086"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Customer-Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer-Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10506.pdf"}],"summary":"Creation Entertainment said payment card information in its website ordering system may have been compromised between February 1 and October 10, 2018.","supporting_quote":null,"technology_involved":["website ordering system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c88d6270e5fc4cec95e142bfe2dcaa65d756f4b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3074bb70-b11b-11e8-ac9c-a56a5b5fabb0"},"incident_date":"2018-01-30","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"337dc74c1f3e","org_name":"Rockdale Independent School District","org_type":"education","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kbtx.com/content/news/Rockdale-ISD-data-breach-impacts-350-employees-475697873.html"}],"summary":"More than 350 employees with Rockdale Independent School District had their personal information stolen. District officials said an employee responded to an email from a scammer pretending to be the superintendent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"992d75247c3c7d936e99040c404975eef2bfc677","impact_type":"data_theft","imported_from":null,"incident_date":"2017-11-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"361e5a4f3441","org_name":"TheTVDB.com","org_type":"technology_saas","ransomware":null,"records_affected":181871,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TheTVDB.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheTVDB"}],"summary":"TheTVDB.com suffered a breach in November 2017, and usernames, email addresses, and MySQL password hashes were posted to a hacking forum.","supporting_quote":null,"technology_involved":["MySQL"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-01-29","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bad0569e517ec7f6b1ac60ae10f770c5dc65ea28","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20%20Nevro_0.pdf"},"notes":null,"org_country":"US","org_id":"52a22c1ef49f","org_name":"Nevro Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133229"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20%20Nevro_0.pdf"}],"summary":"Laptops stolen from Nevro’s headquarters contained limited patient information, but the company had no indication that the data was accessed or used.","supporting_quote":"Nevro was recently the victim of a criminal break -in at our corpo rate headquarters in which several laptop computers were stolen.","technology_involved":["laptop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":["CVE-2016-5195"],"data_types":["personal"],"disclosed_date":"2018-01-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d085308900d8e56a4d70c83dbd0edbc188d5aa65","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"238df320-8904-11e8-82c8-d50e157d53ee"},"incident_date":"2018-01-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"8d2110993f34","org_name":"Domain Factory","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/07/09/domainfactory_in_germany_confirms_brdata_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/user-data-exposed-in-domain-factory-hosting-security-breach/"}],"summary":"German hosting company DomainFactory has taken down its forums after someone posted messages alleging to have compromised the company's computers.  Acknowledging the attack, the GoDaddy-owned (via Host Europe, acquired in 2016) company has advised customers to change their passwo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2016-5195","kev_added":"2022-03-03","name":"Linux Kernel Race Condition Vulnerability","days_listed_before_incident":-1495,"product":"Linux Kernel"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-01-26","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4667b32cb79c02b7300c4c521138c0e8e11df687","impact_type":"exposure_no_theft_confirmed","incident_date":"2018-01-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T875_v02%20-%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"458f68d8e008","org_name":"Steven Yang, D.D.S., INC.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133152"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T875_v02%20-%20Notice_0.pdf"}],"summary":"Steven Yang, D.D.S., INC. reported that two laptops containing files that may have included personal and dental-care information were stolen during a burglary.","supporting_quote":"On the morning of January 6, 2018, our dental office was burglarized and two laptops were stolen.","technology_involved":["laptops"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2018-01-26","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e69a42bf05401eb03d153df194c1311b11be22ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Born%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"fc90ef311d94","org_name":"Jeffrey Born, CPA, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133179"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Born%20Notification_0.pdf"}],"summary":"Jeffrey Born, CPA, Inc. reported that two laptops were stolen during a physical break-in and may have contained personal information.","supporting_quote":"On December 31, 2017, I learned that my office was physically broken into and that two password protected laptops were stolen.","technology_involved":["password protected laptops"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-01-25","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cac80afa026972a6fe77ea5537a4f61568c34198","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9764.pdf"},"notes":null,"org_country":"US","org_id":"6fc5bf1f44dc","org_name":"Zachary E. Adkins DDS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9764.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9764.pdf"}],"summary":"A laptop bag containing an external hard drive with backup files from Florida Probe and Dentrix was stolen; access to the files was not confirmed.","supporting_quote":"On November 30, 2017, a laptop bag containing an external hard drive from our office was stolen.","technology_involved":["external hard drive","Florida Probe","Dentrix"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02b16672056776878c9a2f366e6f05a1e41a3730","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b38d2cd0-d3c2-11e8-9659-2bc8d207b0aa"},"incident_date":"2018-01-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"809c7956d6d6","org_name":"BB&T","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.progress-index.com/news/20180130/2-arrested-for-credit-card-skimming-in-colonial-heights"}],"summary":"The Colonial Heights Police Department arrested Antal Kancsal, 50, and Roberto De Miranda Martinez, 42, for “skimming” credit card information at the BB&T Bank on the Boulevard in Colonial Heights on Thursday, Jan. 25.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-23","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b7b14c085c5c55c27913c75ee9a6d663fdb0aba","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-11-30","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9763.pdf"},"notes":null,"org_country":"US","org_id":"848fccaac047","org_name":"Insight Sourcing Group Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":"A criminal phishing attack resulted in unauthorized access to users' email boxes.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9763.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9763.pdf"}],"summary":"A phishing attack resulted in unauthorized access to email boxes belonging to users at Insight Sourcing Group & SpendHQ.","supporting_quote":"We recently learned that a limited number of email users within Insight Sourcing Group & SpendHQ were victims of a criminal phishing attack resulting in unauthorized access to those users' email boxes from approximately November 30, 2017 through December 11, 2017.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7d82116b724dca742f5d9021f8c736ff53548d6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a671e40-8f64-11e8-a74f-e5450456a5bf"},"incident_date":"2018-01-23","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd3541ce1f72","org_name":"Christ the King Manor","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprogressnews.com/news/crime/home-health-caregiver-sent-to-state-prison-after-admitting-to/article_4544ac09-b609-52ac-b108-29cc3764bee1.html"}],"summary":"Jessica D. Robinson, 39, of Brookville, was employed to provide home health services by Christ the King Manor in DuBois and she provided services to a 70-year-old DuBois woman.  The victim reported to DuBois City police that someone used her Pennsylvania State Employees Credit Un","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-22","discovered_date":"2017-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caa74ca3bf2ebfbed351d292a5caa212c8aee01e","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/National%20Stores-Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"aca3e533babb","org_name":"National Stores, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-133027"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/National%20Stores-Consumer%20Notification%20Letter_0.pdf"}],"summary":"National Stores reported that payment card information used at some locations may have been affected by a data security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09e0d77e25d8dc0206da608b6351558cd1ce60e1","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rosewood%20-%20California%20Notification%20Materials_0.pdf"},"notes":null,"org_country":"US","org_id":"5d887d0797ba","org_name":"Rosewood Hotel Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132951"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rosewood%20-%20California%20Notification%20Materials_0.pdf"}],"summary":"An unauthorized party accessed Rosewood guest reservation information maintained on Sabre’s systems, including names and payment card information.","supporting_quote":"Sabre notified us in late December 2017 that it had uncovered evidence that, between May 29, 2016 and January 11, 2017, an unauthorized party had gained access to certain Rosewood guest reservation information that was maintained on Sabre’s systems.","technology_involved":["Sabre"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2018-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36638d73b7393838b52fcdffc66cb4d36e810322","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Template%20Notification%20%28152381521_1%29_0.PDF"},"notes":null,"org_country":"US","org_id":"fef4957ccc3f","org_name":"Mindlance, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132953"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Template%20Notification%20%28152381521_1%29_0.PDF"}],"summary":"Mindlance reported that confidential and proprietary information, including employees’ names and Social Security numbers, was stolen and emailed to employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-18","discovered_date":"2017-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fca6d40f2b9d2c658da5825c9edcb677478c1e7c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employer%20Leasing%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"eb8fc039754f","org_name":"Employer Leasing Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employer%20Leasing%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Employer Leasing Company reported that files containing personal information were temporarily accessible through a directed Google search.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-18","discovered_date":"2017-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d221a207eddcb54f2f78e6d48c37a15108290f36","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Corovan%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"11589789b964","org_name":"Corovan Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Corovan%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Corovan Corporation reported that sensitive files on a company server were briefly browsable through a directed Google search.","supporting_quote":"On October 17, 2017, we became aware that certain Company files containing sensitive information that were stored on a Company server had become browsable for a brief period of time through a directed search on the Google search engine.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15507eaa4a34b86d10cdc7326e2f8be7d85599ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_20.pdf"},"notes":null,"org_country":"US","org_id":"a2ff8962c816","org_name":"American Golf Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132928"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_20.pdf"}],"summary":"American Golf Corporation reported that malicious software was installed on its Golfzing.com website servers to capture payment card information entered by customers.","supporting_quote":null,"technology_involved":["Golfzing.com website","website servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63006d5f7f7fe94b27606131ec6f3aec3ab66dc5","impact_type":"unknown","incident_date":"2017-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PFR%20Standard%20Notification%20Letter%20Sample%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1c90e5343ae","org_name":"Pension Fund of the Christian Church (“Pension Fund”)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132815"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pension%20Fund%20of%20the%20Christian%20Church%20%28%E2%80%9CPension%20Fund%E2%80%9D%29-2018-01-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27d4654923db1617def5f4cd0014adf1890f7ffb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df9d4280-d3ca-11e8-a7ad-fb6ffda5da8b"},"incident_date":"2018-01-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1e2c640a8b6","org_name":"Allied Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":72,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcconnecticut.com/news/local/Dozens-of-Medical-Records-Found-in-Waterbury-Dumpster-469652073.html"}],"summary":"Dozens of medical records were found buried in a dumpster behind Allied Medical Associates in Waterbury on Tuesday. The records contain sensitive and confidential medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a6deb010def7c873134a82de06e65825f008272","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49690c00-f0ec-11e9-84f1-e9d602503a96"},"incident_date":"2018-01-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e53dd7879096","org_name":"ALDI US","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mcall.com/business/mc-biz-aldi-security-credit-skimmers-20180228-story.html,https://patch.com/pennsylvania/limerick/credit-card-skimming-devices-found-aldi-limerick,https://www.nbcphiladelphia.com/news/local/Credit-Card-Skimming-Devices-Found-in-Pennsylvania-ALDI-Supermarkets-471995853.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2018-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8274bca40c5966e79fe2b587c0409b680b6c844c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"21cdbf5334eb","org_name":"The Fly on the Wall","org_type":"other","ransomware":null,"records_affected":84011,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Fly on the Wall","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheFlyOnTheWall"}],"summary":"The Fly on the Wall suffered a data breach involving email addresses, purchase histories, and credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfab5617192f5e5f59a7ec492da79c7e785904c3","impact_type":"data_theft","imported_from":null,"incident_date":"2017-11-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"856327cc84ab","org_name":"Open CS:GO","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Open CS:GO","type":"hibp","url":"https://haveibeenpwned.com/Breach/OpenCSGO"}],"summary":"Open CS:GO suffered a data breach that exposed personal information and purchase histories.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba0ec4c4c0405b17624f6aa76fab76bfd50a9630","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4463fc423c67","org_name":"Lyrics Mania","org_type":"other","ransomware":null,"records_affected":109202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lyrics Mania","type":"hibp","url":"https://haveibeenpwned.com/Breach/LyricsMania"}],"summary":"Lyrics Mania suffered a data breach that exposed usernames, email addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2018-01-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03a1c4eb3dd216ad8ad6e01445aa1746b6bb9b19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08779ee0-8f46-11e8-a74f-e5450456a5bf"},"incident_date":"2018-01-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55cfc72ca3f3","org_name":"Manitowac County","org_type":"government","ransomware":null,"records_affected":438,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbay.com/content/news/Hundreds-of-peoples-personal-health-information-breached-in-Manitowoc-County-487537361.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/phi-stolen-as-a-result-of-manitowoc-county-phishing-attack/"}],"summary":"Manitowoc County detectives say they're investigating an email \"phishing\" attack that may have disclosed hundreds of people's personal health information for months.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"128a70f25e005bd2014cc6cf5e795f9e4a9a1745","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4dc85780-c32d-11e8-be54-d7fc81504f5e"},"incident_date":"2018-01-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"b9ce4adbbf54","org_name":"Careem","org_type":"transportation_logistics","ransomware":null,"records_affected":14558800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arabianbusiness.com/technology/394870-dubais-careem-admits-to-data-breach-affects-14-million-customers"}],"summary":"A cyber-attack on Dubai-based ride sharing platform Careem has resulted in the theft of personal data of up to 14 million people in the Middle East, North Africa, Pakistan and Turkey.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2018-01-12","discovered_date":"2017-11-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1561797b7d92eb935bf451948e2d5c08da01405","impact_type":"data_theft","incident_date":"2017-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pedes%20Adult%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"e24578e8a569","org_name":"Pedes Orange County","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132631"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pedes%20Adult%20CA%20Notice_0.pdf"}],"summary":"A physician from another medical group accessed Pedes Orange County’s electronic medical records database without permission and disclosed database materials to their attorney.","supporting_quote":null,"technology_involved":["electronic medical records database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-12","discovered_date":"2017-09-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd53af417dd13dbafe9163640cde2b8f1b13be5a","impact_type":"data_theft","incident_date":"2017-06-09","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9762.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"d472e04f1edb","org_name":"Guaranteed Rate","org_type":"financial","ransomware":null,"records_affected":2545,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9762.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9762.pdf"}],"summary":"Phishing attacks led to access to Guaranteed Rate employees’ email accounts, where personal information was viewed or downloaded.","supporting_quote":"On or around September 13, 2017, we confirmed a limited number of company email accounts were accessed by unknown actors as the result of these phishing attacks.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-12","discovered_date":"2017-09-13","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3c960deacb06a604260b61c8d6019151e76dcb5","impact_type":"data_theft","incident_date":"2017-06-09","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Guaranteed%20Rate%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"d472e04f1edb","org_name":"Guaranteed Rate, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Phishing attacks led to unauthorized access to company email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132638"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Guaranteed%20Rate%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Guaranteed%20Rate%2C%20Inc-2018-01-12"}],"summary":"Phishing attacks led to access to Guaranteed Rate employees’ email accounts, where actors viewed or downloaded personal information.","supporting_quote":"On or around September 13, 2017, we confirmed a limited number of company email accounts were accessed by unknown actors as the result of these phishing attacks.","technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3dea7ff6081688b7cc6ad6171c17cd63ebd0795","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39cf0580-bd42-11e8-aa8d-730052dce2c2"},"incident_date":"2018-01-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"923ea00d5f5b","org_name":"Front Range Dermatology Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.greeleytribune.com/news/front-range-dermatology-associates-suffers-a-breach-of-medical-records/"}],"summary":"Employee provided data to former employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85fb0292ff108f64e01ca37a62641e2a4aae3f00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4483a670-ac80-11e8-8036-a30436c88231"},"incident_date":"2018-01-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"3a89dca6c858","org_name":"OnePlus","org_type":"manufacturing","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.firstpost.com/tech/news-analysis/oneplus-confirms-security-breach-announces-that-credit-card-details-of-up-to-40000-users-may-have-been-stolen-4311677.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.dnaindia.com/business/report-nearly-40000-oneplus-customers-affected-by-credit-card-data-breach-2576992"}],"summary":"OnePlus has concluded its investigation into reports of a potential data breach on OnePlus.net. Unfortunately for users, the Chinese smartphone maker has concluded that it did indeed suffer a data breach that could potentially affect around 40,000 users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-11","discovered_date":"2017-12-22","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfcf1d5f96a64d809e4ed56fce1064e19e638fbd","impact_type":"data_theft","incident_date":"2017-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20OAG%20-%20Notice%20of%20a%20Data%20Security%20Breach%20dated%201-11-2018_0.pdf"},"notes":null,"org_country":"US","org_id":"23fc67e7f081","org_name":"Jason's Deli","org_type":"other","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132606"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20OAG%20-%20Notice%20of%20a%20Data%20Security%20Breach%20dated%201-11-2018_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jason%27s%20Deli-2018-01-19"}],"summary":"Criminals deployed RAM-scraping malware on Jason’s Deli point-of-sale terminals, and payment card information was obtained.","supporting_quote":null,"technology_involved":["point-of-sale (POS) terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-11","discovered_date":"2017-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"85d87b1786ea0b293550c54731284e29ae18b4c0","impact_type":"data_theft","incident_date":"2017-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9761.pdf"},"notes":null,"org_country":"US","org_id":"e8c3fe51c1d1","org_name":"Deli Management, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9761.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9761.pdf"}],"summary":"Criminals deployed RAM-scraping malware on Jason’s Deli point-of-sale terminals and obtained payment card information.","supporting_quote":null,"technology_involved":["POS terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d3401f4969b28da2f6a3a63647b284b5f889fa85","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Deli%20Management%2C%20Inc.%20dba%20Jasons%20Deli%2C%20Inc.%2011%20Jan%2018%20-%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e8c3fe51c1d1","org_name":"Deli Management, Inc. (","org_type":"unknown","ransomware":null,"records_affected":90984,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Deli%20Management%2C%20Inc.%20%28d/b/a%20Jason%27s%20Deli%2C%20Inc.%29-2018-01-11"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Deli%20Management%2C%20Inc.%20dba%20Jasons%20Deli%2C%20Inc.%2011%20Jan%2018%20-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d4bf234dc6689ccc7e486e41dccf52210de9a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8bf2a770-d3bf-11e8-9659-2bc8d207b0aa"},"incident_date":"2018-01-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db94d5356c45","org_name":"Weis Markets","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fredericknewspost.com/public/more-skimming-devices-found-in-supermarkets-bank-branch-in-frederick/article_48786ba0-52c9-5d6c-87bc-9c6d9916b993.html"}],"summary":"Frederick police are investigating five incidents of skimming devices found on ATMs in grocery stores and at least one bank branch.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-10","discovered_date":"2017-11-29","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4240b95d6e1d5877556477464dc8e9b06b6f55d","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TTF%20Adult%20SSN%20and%20or%20DL%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"e5ce70fe8031","org_name":"talentReef, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TTF%20Adult%20SSN%20and%20or%20DL%20Notice%20Template_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9760.pdf"}],"summary":"An unauthorized individual may have accessed a talentReef employee’s email account containing messages with personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a64b0cc9d275e5711687e1657f10cfe5477110b2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44fb36e0-bb67-11e8-b9b2-0dc0cc16471e"},"incident_date":"2018-01-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"eef77405ceb6","org_name":"Steuben County Adult Protective Home Care Unit","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eveningtribune.com/news/20180408/stronghome-health-worker-charged-with-identity-theftstrong"}],"summary":"Home health worker charged with identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5db479a20fac4f1fc62cefc5d5311a26636db34a","impact_type":"unknown","incident_date":"2017-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fafa1590a853","org_name":"NHS, INC.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132538"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59b6590b9b0aac34be738cff023d8a2c6150e077","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e2dad590-aa2e-11e8-b2b4-5de6d270e153"},"incident_date":"2018-01-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3fe36ddaee62","org_name":"Hancock Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cryptonetix.com/pay-up-or-else-indiana-hospital-latest-victim-of-ransomware-attack/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.indystar.com/story/news/crime/2018/01/17/hancock-health-paid-50-000-hackers-who-encrypted-patient-files/1040079001/"}],"summary":"Hospital pays $50,000 ransom to unlock patient data from ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ef57f41abda44a4a30a98b237420b0f53cf7516","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9054a3d0-aa03-11e8-b272-396d7fe012b7"},"incident_date":"2018-01-09","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26a4cac17389","org_name":"Massachusetts Clean Energy Center","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonherald.com/business/technology/2018/06/phishing_theft_of_93g_at_clean_energy_agency_went_unreported_for_months"}],"summary":"Attacker stole 94,000 in public funds via a fraudulent wire transfer from energy center as result of a phishing attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2018-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c47eee9bff9abb2a290ef4c1c68dc37a682c0bb4","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BE","org_id":"5ca33f47b814","org_name":"2fast4u","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 2fast4u","type":"hibp","url":"https://haveibeenpwned.com/Breach/2fast4u"}],"summary":"The 2fast4u vBulletin message board breach exposed email addresses, usernames, and salted MD5 passwords for 17,706 users.","supporting_quote":null,"technology_involved":["vBulletin message board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-05","discovered_date":"2017-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"eba157fd4cb99eb5f7fee285a6ce79cb001476f8","impact_type":"data_theft","incident_date":"2015-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rea.deeming%20Beauty%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"183dc7f3535c","org_name":"Rea.deeming Beauty, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":18133,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rea.deeming%20Beauty%2C%20Inc.%20dba%20beautyblender-2018-01-05"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132088"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rea.deeming%20Beauty%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rea.deeming%20Beauty%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Rea.deeming Beauty reported that malicious code on its website collected payment card information entered at checkout.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-05","discovered_date":"2017-12-05","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d2c8f7d16522507ec28832157158305f7e5e5ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FlagShip%20Data%20Breach%20Notification%20Letter%20January%202018_0.pdf"},"notes":null,"org_country":"US","org_id":"50871075f2fb","org_name":"FlagShip Facility Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132093"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FlagShip%20Data%20Breach%20Notification%20Letter%20January%202018_0.pdf"}],"summary":"FlagShip Facility Services reported that a missing company HP Elite Laptop contained an image of an individual's U.S. Passport.","supporting_quote":"On or about December 5, 2017, Flagship determined that a company -owned HP Elite Laptop (“Laptop”) was missing from 190 Jefferson, Menlo Park, California 94025.","technology_involved":["HP Elite Laptop","B5000 software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2018-01-03","discovered_date":"2017-12-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f42eefbf1dae00dd102bfe6e7593012d0d46282","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20-%20General%20Letters_0.pdf"},"notes":null,"org_country":"US","org_id":"c07a6882e3f2","org_name":"LiveGlam Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-132015"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20-%20General%20Letters_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9756.pdf"}],"summary":"LiveGlam reported that an unauthorized individual may have accessed customer information stored on a section of its online store that processes orders.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2018-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d37fa57f087f6fc07c8ff83d0cb1c69076cb1a5","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"DK","org_id":"fd402157cb4e","org_name":"HoundDawgs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HoundDawgs","type":"hibp","url":"https://haveibeenpwned.com/Breach/HoundDawgs"}],"summary":"HoundDawgs suffered a breach in December 2017, and publicly dumped data included email addresses, IP addresses, passwords, and torrenting activity.","supporting_quote":null,"technology_involved":["torrent tracker"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-02","discovered_date":"2017-12-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"42ea8730fad695c804653aa7387a41d90f55791e","impact_type":"unknown","incident_date":"2017-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9759.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cae8e05c1e1b","org_name":"Multnomah Athletic Club","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9759.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Multnomah%20Athletic%20Club-2018-01-11"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97ed9b6c4f350c9c4fd29acd376065c3acf594b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf592900-c333-11e8-be54-d7fc81504f5e"},"incident_date":"2018-01-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5dc9e6e565e","org_name":"Inogen","org_type":"other","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fiercehealthcare.com/tech/inogen-data-breach-30k-device-manufacturer-sec"}],"summary":"portable devices that supply oxygen to patients with breathing difficulties and lung diseases, said some non-public financial information was also leaked after an employee's email account was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb835a4a30ee19c4eb85965a156a6d56cde43dd4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27d23230-28d6-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"0a2e76297142","org_name":"Zcall","org_type":"technology_saas","ransomware":null,"records_affected":26000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://portswigger.net/daily-swig/plaintext-offenders-south-korean-delivery-apps-leak-26m-documents"}],"summary":"A data security oversight from a South Korean app developer appears to have caused more than 26 million documents to be leaked over the last month – some of which contained sensitive customer data stored in plaintext.  The issue was uncovered by Justin Paine, director of trust an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44feab3a8303d71d1eca8232a66b97870e5563e3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49cd1eb0-034f-11e9-aee0-f7420d4f3238"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7d69e0b5db75","org_name":"West Midlands police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/uk-news/2017/dec/07/senior-policeman-left-secret-files-in-car-before-they-were-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.eveningexpress.co.uk/news/uk/senior-officer-to-face-disciplinary-panel-over-top-secret-papers-stolen-from-car/"}],"summary":"A senior counter-terrorism officer has been fined after top-secret papers he left in his car were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2152d50d637b9021a1f2fd09750e4120ecf3a7aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad35e030-b69d-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"8b0b03580159","org_name":"Wellington Police Department","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newstalkzb.co.nz/news/licence-use-during-police-training-a-breach-of-privacy/"}],"summary":"Licence use during police training 'a breach of privacy'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2be652db7e06d0b4bc064b404341ca96e8ca23ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60f0d9d0-3525-11e9-8dbb-275658e06f31"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a16b2018916e","org_name":"voxox","org_type":"technology_saas","ransomware":null,"records_affected":26000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__techcrunch.com_2018_11_15_millions-2Dsms-2Dtext-2Dmessages-2Dleaked-2Dtwo-2Dfactor-2Dcodes_&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=vyf_r2D2U8FKT4KZiFIGqkAQW1hVe1x75XDVAWC2CVg&s=l72x2Pvqa63LYau1YY3M_49lRev4Y4vNyCJcAbsmjfw&e="},{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__www.dailymail.co.uk_sciencetech_article-2D6398999_Massive-2Dsecurity-2Dbreach-2Dexposes-2D26-2DMILLION-2DSMS-2Dtext-2Dmessages-2Dcontaining-2Dprivate-2Dcustomer-2Ddata.html&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=vyf_r2D2U8FKT4KZiFIGqkAQW1hVe1x75XDVAWC2CVg&s=RGyHVua5z3QW6ES5bceb1adk0B0fUfYWa4iBOZJm2mI&e="}],"summary":"An exposed server owned by Voxox exposes 26 million sms messages to the internet. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50931e1e576aad5e69d6ac97df247d3cc6c030eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46937300-f6c5-11ea-b7b2-2361ceadc5c7"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9ab7141eb3b","org_name":"VirMedica","org_type":"technology_saas","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Virmedicia accidentally published private repo resulting in disclosure of patient information and credentails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50b909cea5bfc7412fc126c8e7166172392ea342","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2d443700-d3d9-11e9-9298-79b47a23a7bd"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a33233b6724","org_name":"Veteran's Administration","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.disabledveterans.org/2019/09/04/veteran-medical-records-illegally-accessed-in-alleged-smear-campaign/,"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9baf89cff9c5b01d1f12b13d43944561aa365be1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30583be0-bb65-11e8-b9b2-0dc0cc16471e"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"efc8f7a4e7a3","org_name":"USACS Management Group","org_type":"healthcare","ransomware":null,"records_affected":15552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/45000-patient-records-exposed-in-nuance-healthcare-data-breach"}],"summary":"Email account compromised led to PHI loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60b16a828ca1c4d8a728aa27c0f1cb6a6a4b782a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"891ab7a0-28d7-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"f3fe7d12062a","org_name":"Universiti Teknologi Mara (UiTM)","org_type":"education","ransomware":null,"records_affected":1164540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com.my/tech/tech-news/2019/01/25/uitm-students-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.lowyat.net/2019/177033/over-1-million-uitm-students-and-alumni-personal-details-leaked-online/"}],"summary":"A total of 1,164,540 records, belonging to students who enrolled for various courses at Universiti Teknologi Mara (UiTM) between 2000 and 2018 has been breached and leaked online.  The leaked data includes detailed records of students from the UiTM main campus in Shah Alam, as we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd6a7d001f42e9c10c063a8138fe652cc4cdf6bc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f4bd51b0-fe8a-11e8-aee0-f7420d4f3238"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0189af7e255","org_name":"United States Post Office","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesnews.net/Law-Enforcement/2018/09/17/Former-carrier-charged-in-mail-theft-case.html"}],"summary":"A former postal carrier is pleading guilty in federal court after investigators discovered he stole packages of prescription medication from customers on his Rogersville route during a two-month period.  Shawn Ice, 38, of Midway, was charged in a one-count information on Sept. 11","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b9647e555acc141745113fc12d2ae899c1cc318","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1551dfc0-8a89-11e8-ba1e-e3857583ba43"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03f153cf0a81","org_name":"United States Air Force","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bbs.boingboing.net/t/hackers-swiped-an-operator-manual-for-a-fancy-airborne-killing-machine/124262"}],"summary":"a group of hackers got their hands on the Reaper’s operating manual with the intention of selling it online to anyone that wants it for $150 a pop. As with most security flaws, the exploit they used was all too human: they accessed the document through an Air Force Captain’s unde","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8aaeae5383481dfdb15e34177cc7e00f58a024e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5de73950-b69f-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b0e74ff3923","org_name":"Unidentified Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.clickondetroit.com/news/detroit-medical-assistant-charged-with-stealing-patient-information-at-pontiac-doctors-office"}],"summary":"Detroit medical assistant charged with stealing patient information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19cfa29be551de097378e0c9278b22a52da16408","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b3c705d0-c11c-11e8-b08b-65e656f134d2"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"5f05e6fc2544","org_name":"Unidentified Dental Practice","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/usao-sc/pr/three-indicted-health-care-fraud-conspiracy-money-laundering-aggravated-identity-theft"}],"summary":"Misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ec3e5273ada6eca07e9aae12985c9f4b7add79f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f018f870-a07b-11e8-899a-23ad2f84ca7d"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"72a47f8a533c","org_name":"Town of Whitchurch-Stoufville, NY","org_type":"government","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.yorkregion.com/news-story/8699947-stouffville-takes-mayor-justin-altmann-to-court-for-alleged-leaked-documents/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com/news/gta/2018/06/18/stouffville-mayor-accused-of-serious-privacy-breach-by-town.html"}],"summary":"The town of Whitchurch-Stouffville has issued a news release accusing the mayor of being behind a privacy breach that involves making copies of and distributing “confidential information and personnel records” to members of the public.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"474a59958bbb43e317549e2b15edd7409494dfb8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f5a07b90-8c14-11e8-bfaf-f7b4555dc539"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"2cb5b186e779","org_name":"Thomas Cook Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/travel-information-leaked-at/"}],"summary":"A bug finder recently discovered that Thomas Cook Airlines had a security vulnerability for years, making it possible for hackers to systematically download hundreds of thousands of passenger flight details and personal data going back as far as 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f7440218f5c38a36d068f7bf322087c2349b49","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5aa92760-d0a0-11e8-8d86-ff6837032f4a"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10befff50479","org_name":"The Apollo Company","org_type":"professional_services","ransomware":null,"records_affected":200000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2018/10/02/apollo-data-breach-leads-to-more-than-200-million-contact-records-stolen/"}],"summary":"he startup sales revenue and engagement service Apollo suffered a massive hack stealing millions of data records. Precisely, the company lost around 200 million records from its contact database in the Apollo data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"942b8b3cd139c4d2cfee396bc4b8e8bc01671bcb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d2295420-72d0-11eb-a674-05cfd55ad89e"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NG","org_id":"f1ca04dc7821","org_name":"SureBet247","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.iafrikan.com/2020/01/03/privacy-nigeria-surebet-247-data-security-breach-leak-protection-sports-betting/"}],"summary":"Surebet247 left a server open that exposed thousands of customers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ae343fb6f9f440d3736337c0578218104337dd8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"de45a6a0-1495-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f95f5419c4","org_name":"SunTrust Banks Inc.","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Business/wireStory/suntrust-warns-15-million-clients-potential-data-breach-54607794;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2018-04-20/suntrust-says-data-on-1-5-million-customers-may-have-been-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.law.com/dailyreportonline/2018/05/18/suntrust-hit-with-class-action-after-1-5m-customers-data-breached/"}],"summary":"LISTEN TO ARTICLE  2:11 SHARE THIS ARTICLE  Share  Tweet  Post  Email In this article STI SUNTRUST BANKS 55.46USD+0.68+1.24% EXPN EXPERIAN PLC 1,901.00GBp+13.50+0.72% BKX KBW BANK INDEX 90.42USD+0.76+0.85% SunTrust Banks Inc., Georgia’s largest lender, said it’s investigating a f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e04842d86872a3a3e2a453f4eb7a587f24a65dd4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74bd0e50-b6ab-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8081781054","org_name":"Sunoco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wnyt.com/news/schenectady-police-warn-about-skimming-devices-found-at-gas-station-/4824661/"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ccb8b04f46f2d8945ae752780f6375aa220ab80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1bad5930-b6a3-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1fb380da9597","org_name":"Steward Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/steward-must-satisfy-jury-doc-got-sacked-for-hipaa-violation"}],"summary":"psychiatrist gave patient information to police, a violation of HIPAA","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9d3583ef62a3e431a821d3f80a221d501f8206e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3bf32960-8c3f-11e8-bc15-3f53b8a95c12"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"8d36d0d8b514","org_name":"St. Vincent's Hospital","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.smh.com.au/national/nsw/white-hot-anger-st-vincent-s-hospital-email-gaff-reveals-confidential-employee-details-20180608-p4zkcs.html"}],"summary":"Employee's request for termination as part of voluntary reduction in force were disclosed via cc: field","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd7651e88d7497eed26acb333836f48a69dd5aae","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cb7b9190-35d5-11e9-873a-cf0b385b0ca1"},"incident_date":"2018-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa7dfc6ed86d","org_name":"St Peter's Surgery and Endoscopy Center","org_type":"healthcare","ransomware":true,"records_affected":135000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__www.databreaches.net_st-2Dpeters-2Dsurgery-2Dendoscopy-2Dcenter-2Dnotifying-2D135000-2Dpatients-2Dof-2Dcyber-2Dattack-2Din-2Djanuary_&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=VH9QCdHt04WfisVFKKKXRusIUdryuBg4PiETEno4wjc&s=bKCCHOS4KfaWg82CAJL2UuB2ga7TYqlFA5AWRj-54Og&e="},{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__www.timesunion.com_business_article_Hackers-2Dhit-2Dpatient-2Drecords-2Dat-2DSt-2DPeter-2Ds-2Dcenter-2D12723418.php&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=VH9QCdHt04WfisVFKKKXRusIUdryuBg4PiETEno4wjc&s=xqP9z-fzeSOHJUeQXqvLjhA-89NIV-RgPGsUid4fyQE&e="}],"summary":"A hospital in New York state suffered a breach which involved the PII of 135,000 patients and additionally the hospital was hit with a ransomware attack as part of the same breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22f83b82223eb875ec20fa540042210132fe3747","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2fd5270-b6a9-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c595edf9a8f4","org_name":"SportsMEDIA Technology Corp","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://mlb.nbcsports.com/2018/04/06/tech-company-sues-mlbam-alleging-theft-of-its-pitch-tracking-system/"}],"summary":"Company alleges that former employee is using IP at new company (formerly a client)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a29681ebbbf7e67ea922362e9ea52740cc3b08fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"099e0730-aa05-11e8-b272-396d7fe012b7"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cbbaa4b95bf","org_name":"Sportscapers Construction, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.law360.com/articles/1052349/sports-construction-co-says-ex-worker-stole-ip-for-rival-biz"}],"summary":"A construction company specializing in building athletic facilities filed suit against a former employee alleging she stole proprietary information and then left to found rival business. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d94b91ff5887fb604bea91008da5a5b10c6d30d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f6498c10-dedb-11e9-ad75-f56272c47bf9"},"incident_date":"2018-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"89496fb494da","org_name":"Sooke School District","org_type":"education","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bclocalnews.com/news/sooke-school-district-warns-parents-of-privacy-breach/"}],"summary":"one employee is phished.  account is used to phish 15 more.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"182d9591e63b197542f998fb664b597eecc50220","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bfeae920-1197-11ec-a044-77090c8577a4"},"incident_date":"2018-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"615d226d6b6a","org_name":"Shiawassee County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mi-phishing-scam-costs-shiawassee-county-50000/"}],"summary":"Phishing scam costs Shiawassee County $50,000","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"895096277514af6dcfd89e814c113afdd2f71811","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d709d80-143a-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"474a8309abe2","org_name":"San Diego Unified School District","org_type":"education","ransomware":null,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kusi.com/san-diego-unified-school-district-data-breach-could-impact-500000-students/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.sandiegounified.org/datasafety"}],"summary":"The San Diego Unified School District said they have alerted employees and families to an incident involving the security of their personal data on the district’s information systems.  According to the district they have reason to believe some employee and student personal data m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ec4a5ef69139fe3fd73580e889e8a6996fde122","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7023c650-8928-11e8-8760-271b3d9edf6d"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"346e46aefb8b","org_name":"Samsung","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/technology/2018/jul/03/samsung-galaxy-s8-s9-phones-sent-photos-random-contacts"}],"summary":"Samsung phones sent photos to random contacts, users say.   Firm is investigating reports that default messaging app sent pictures without consent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84c7e0a25024e4f9ffbede8b83513166ae794d12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"feb24580-72e7-11eb-a674-05cfd55ad89e"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"020ee308f3e0","org_name":"Royal Enfield","org_type":"manufacturing","ransomware":null,"records_affected":452000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.medianama.com/2020/02/223-royal-enfield-data-breach/"}],"summary":"Royal Enfield failed to set up passwords for three databases thereby exposing the data of 452k users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb0bf631065ebb23822bfef70bb670d98db02e3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6c78aba0-0a15-11ea-9e73-f15207d33dcb"},"incident_date":"2018-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cab672521a75","org_name":"Rosemount-Apple Valley-Eagan School District 196","org_type":"education","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.duluthnewstribune.com/news/4458166-suspended-minnesota-principal-facing-more-charges"}],"summary":"LAKEVILLE, Minn.-Christopher Endicott, the suspended Lakeville middle school principal previously accused of felony burglary and stalking, was charged Friday, June 8, with four more crimes.  Endicott now is accused of stealing personal and financial information from employees of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3d0f488f146d74d2988c3828185f94319cf150c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aeca6d10-0a61-11ec-9d35-0d797e3f6b54"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"294c3214683f","org_name":"Rolls-Royce","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mirror.co.uk/news/uk-news/man-held-over-official-secrets-12702915"}],"summary":"Former Rolls-Royce employee was arrested for passing classified F-35 fighter jet information to China","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb2704e4b70e1816ed6116abfc913e5d081bbeca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8dbdb080-9a45-11e8-8652-5d096cfefbb4"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b0f8c08bc467","org_name":"Riot Games","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cio.com/article/2395205/security0/european-league-of-legends-game-players-have-their-account-data-compromised.html"}],"summary":"Hackers have stolen account data from the European servers of popular real-time strategy game League of Legends (LoL), the game's developer, Riot Games, announced on Saturday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"632fdd63e2507a5fe4febaa9ab5733bf781a1de9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"516085e0-a161-11e8-a73d-8bf9996ed0ad"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ea02bb8a295","org_name":"Regency Theatres","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/RegencyDataBreachAllClear_0.pdf"}],"summary":"Regency Theatres Reports Data Breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ee680c90850b1cf3cd0a079670a9b084d02d0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6fb50b80-143c-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0f428dea002","org_name":"Quora","org_type":"technology_saas","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blog.quora.com/Quora-Security-Update;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/quora-suffers-data-breach-users-names-emails-encrypted-passwords-exposed-524084.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/daveywinder/2018/12/04/quora-hacked-what-happened-what-data-was-stolen-and-what-do-100-million-users-need-to-do-next/#2be7de14f447;"},{"fetched_at":null,"title":null,"type":"press","url":"https://legalnewsline.com/stories/511714918-california-quora-user-files-suit-over-2018-security-breach"}],"summary":"We are writing to let you know that we recently discovered that some user data was compromised as a result of unauthorized access to our systems by a malicious third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af66d0f91cc46fe8c69aa2628a54344d2a76b8af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05e6d5a0-c8e9-11e9-918d-0fca885a1bcc"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd13fd7896a3","org_name":"QuikTrip","org_type":"retail_ecommerce","ransomware":null,"records_affected":78,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kansascity.com/news/local/crime/article218329510.html,https://www.kansascity.com/news/local/crime/article209422604.html"}],"summary":"international atm skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"897a08b25d2b7331944b1c58eab41a518c893e81","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e86b21b0-945b-11e8-8a69-45d02d35861b"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"2ff67ed88c5d","org_name":"Police Service of Northern Ireland","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.irishtimes.com/news/ireland/irish-news/psni-investigating-alleged-major-police-data-breach-1.3571668"}],"summary":"personal data from hundreds of people appeared to have been inadvertently passed onto suspected loyalist paramilitaries by the PSNI. It reported that police were understood to have examined a number of computer devices seized from loyalists but that in returning one of them polic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb39f5aaabad1e1cfee7add27770d7d01543aa75","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38c7a230-b6a0-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"333c288f4bdf","org_name":"Optical Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityprivacyandthelaw.com/2018/06/french-data-protection-authority-imposes-a-record-250000-e-fine-to-optical-center-for-a-security-breach-on-its-website/"}],"summary":"Website for Optical Center was configured where forced browsing could be used to view other customers' invoices","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ef2b97dd406266dc71f9db663ca03c4245fac1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05376890-85f1-11e8-ae9b-a1b647b0d464"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"aecd91537a80","org_name":"NSO Group Ltd.","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.information-management.com/articles/disgruntled-employee-accused-of-peddling-stolen-spyware"}],"summary":"A senior programmer facing dismissal at Israeli spyware developer NSO Group Ltd. has been charged with stealing hundreds of millions of dollars worth of cyberarms technology and trying to sell it on the darknet.  The accused’s actions posed a threat to state security, and could h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6623def814c601a89c1f30a955bac7ef7330339","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a7093520-0581-11ea-a6b7-b9a04765ea4f"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f996a4995621","org_name":"Newfoundland and Labrador Medical Care Plan","org_type":"healthcare","ransomware":null,"records_affected":3300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ntv.ca/minister-explains-privacy-breach-at-mcp-office-in-grand-falls-windsor/"}],"summary":"A binder containing the health information of approximately 3,300 individuals was reported to the minister’s office back in October. However, the binder had gone missing back in January 2018.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72b09c264d3b206f83fcd89b541164e8a35ef8c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b80bab20-9b0e-11e8-8050-370b93adfe70"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"11062bc069e5","org_name":"New Zealand Law Society","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12100056;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.voxy.co.nz/business/5/317491"}],"summary":"The New Zealand Law Society has apologised after a staff member sent confidential information to the wrong person.  The privacy breach occurred when the staff member intended to email a colleague but mistakenly emailed someone with a similar name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"119656be88e6447db01206ac34fb6056ddb8c51f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4078d9b0-b69e-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee76b05a4bd2","org_name":"Neopart Transit LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.law360.com/articles/1053571/bus-parts-distributor-employee-must-face-trade-secrets-suit"}],"summary":"Internal espionage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4998bfae4977f3a9a28054bc04df1d0bd1591ada","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e81b9c0-351f-11e9-aaf8-2b964a89eccb"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6a824b05fda","org_name":"Navionics","org_type":"manufacturing","ransomware":null,"records_affected":261000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/garmin-owned-navigation-unit-exposed-thousands-of-boat-owners-data/"}],"summary":"Navionics, owned by garmin, had an exposed database that contained approximately 261,000 customer names and email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b69ef0c66f064135f814bb05827d152a17a6bc7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"432792b0-7e3a-11e8-8eb3-d1bc5b9c0f05"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a671466533e7","org_name":"National Health Service","org_type":"government","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/technology-44682369?ocid=socialflow_twitter"}],"summary":"The NHS is blaming a coding error for 150,000 patients in England being involved in a data breach. Those affected had requested that their confidential health information only be used to help provide them with care. But it appears that there was a problem with the software used b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9133770646c8c53d77a5879b36617c9610419ae5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e443e940-8e94-11e8-8003-e3ff5269fee2"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e709ac7d0d2","org_name":"MSK Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/msk-group-notifying-patients-of-data-security-incident/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%201%20-%20Letter2_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mskgroup.org/securityevent2018.html"}],"summary":"On May 7, 2018, MSK Group, P.C. discovered that its computer networks experienced a security event that day. MSK Group hired expert information security consultants to investigate, mitigate and assess the extent of this event, and we are continuing to work closely with consultant","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b129c2921935e97f17c5606d4d19e9f7bf16cc97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14096790-352a-11e9-8dbb-275658e06f31"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7de619641ef4","org_name":"mindbody","org_type":"professional_services","ransomware":null,"records_affected":113000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pymnts.com/news/security-and-risk/2018/mindbody-fitness-customer-data-breach/"}],"summary":"two servers owned by fitness company mindbody left 113 million users with PII exposed to internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0b80c833d31afd927aeceb6c2e9216e814fcbbd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e9e9ac90-b6a3-11e8-b56a-011002460f8b"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a2bd373bb01","org_name":"MEDantex","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/04/transcription-service-leaked-medical-records/"}],"summary":"Publishing error during recovery from ransomware led to access of PHI ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9396d53edb3da2e8577439ffe43e7bf7798ab3fc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d2d26f30-8e7e-11e8-8003-e3ff5269fee2"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d81be939c43","org_name":"McGuire Memorial Home","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesonline.com/news/20180629/police-freedom-man-took-nude-photos-of-personal-care-residents"}],"summary":"Zachary L. Dinell, 24, was charged June 4 with the sexual assault of an unconscious woman. Police said officers investigating the assault searched Dinell’s phone and found several saved photos that were “obscene and pornographic.”  The pictures appeared to be taken at a personal-","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c2048b5be57ef87c26b0a6832ef5b9823b32bea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aaed1200-352b-11e9-8dbb-275658e06f31"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00f3a782185e","org_name":"MBM Jewelry","org_type":"retail_ecommerce","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__www.scmagazine.com_open-2Daws-2Ds3-2Dbucket-2Dmanaged-2Dby-2Dwalmart-2Djewelry-2Dpartner-2Dexposes-2Dinfo-2Don-2D13m-2Dcustomers_article_751751_&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=3j__qH7-x-yhNsZv71LOnTm8la9VjlQb8IZ_s-FRUlQ&s=z0nHN_6KqNcUvZSF1vYYSPqzyZo3KbJ98Ro3pi81eVI&e="}],"summary":"A walmart partner MBM Jewelry company leaves database unsecured in Amazon AWS and exposes 1.3 million customers data open to internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57d9cfd51e4ea2451be7a733e4a77cf4372f8b28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87e6a0f0-143d-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87b477d03739","org_name":"Marriott","org_type":"other","ransomware":null,"records_affected":383000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/11/marriott-data-on-500-million-guests-stolen-in-4-year-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.newsweek.com/marriott-hack-massive-data-leak-hits-500-million-customers-hotel-breached-1238449;"},{"fetched_at":null,"title":null,"type":"press","url":"https://viewfromthewing.boardingarea.com/2018/11/30/massive-marriott-data-breach-500-million-bookings-many-with-payment-and-passport-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/marriott-sued-hours-after-announcing-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.staradvertiser.com/2018/12/01/breaking-news/national-class-action-lawsuit-filed-over-marriott-data-breach/;"}],"summary":"On Nov. 30, 2018, the world’s largest hotel chain issued an embarrassing notice that its servers were breached, leaving 500 million guest records in criminal wrong hands. With the help of internal and external forensics and analytics teams, Marriot now knows that the number of af","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f9411372898a73b1ea00e2cb6d77c796948a4a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f67d260-28d5-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PA","org_id":"034268b799e7","org_name":"Luscious.net","org_type":"technology_saas","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ctrlbox.com/2019/01/29/luscious-net-exposed-all-users-emails/"}],"summary":"In an all too common incident, another elastic search engine has ended up exposing all the users' email addresses from  an adult content website, luscious.net.  The leak was discovered on January 26 when the CTRLBOX Open Data Monitor detected an elastic search containing more tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa191275937b730d3337b12cd2d85cf5a8f68edf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"777e8660-c32f-11e8-be54-d7fc81504f5e"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6901a36e8fdf","org_name":"LocalBlox","org_type":"technology_saas","ransomware":null,"records_affected":48000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/data-firm-leaks-48-million-user-profiles-it-scraped-from-facebook-linkedin-others/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/a-private-intelligence-platform-localblox-leaked-48-million-personal-data-records/"}],"summary":"cloud storage repository containing information belonging to LocalBlox, a personal and business data search service, was left publicly accessible, exposing 48 million records of detailed personal information on tens of millions of individuals, gathered and scraped from multiple s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb427dd94482d7de35a5f7917b23f519ea6f695a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97b72df0-2819-11eb-8365-4f57e2156a07"},"incident_date":"2018-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb73c615a475","org_name":"LeafFilter","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.businesswire.com/news/home/20181107005636/en/Federman-Sherwood-Announces-Filing-Class-Action-Lawsuit"}],"summary":"LeafFitler a gutter protection system fell victim to a phishing attack which resulted in the compromise of sensitive information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c6c1cf2d020a3e414a1b6a6cc55f077968ee206","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ec06a90-c11a-11e8-a33a-95e6749d3999"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f3a7791d90ee","org_name":"Kaiser of Colorado","org_type":"healthcare","ransomware":null,"records_affected":1290,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/personal-info-for-2000-dc-students-mistakenly-posted-online/"}],"summary":"Publishing errror","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8bf0a68b47cad7afbd42565f089bf50b01183b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b33bc0d0-28da-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CW","org_id":"2f5e22ba787f","org_name":"kahunacasino.com","org_type":"other","ransomware":null,"records_affected":108000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/online-casino-group-leaks-information-on-108-million-bets-including-user-details/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.casino.org/news/curacao-online-gambling-data-leak-detailed-108-million-bets-exposed-customers-to-fraud"}],"summary":"An online casino group has leaked information on over 108 million bets, including details about customers' personal information, deposits, and withdrawals, ZDNet has learned. More security news      YubiKey: Protect your Facebook, Google, and other online accounts with this hardw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"253452d3536f7d27786efb13870a89255b474b1d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7092e640-8e86-11ec-a600-657ec2694f8f"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"296c97378e8a","org_name":"Inmagine Group","org_type":"professional_services","ransomware":null,"records_affected":8300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/popular-stock-photo-service-hit-by-data-breach-83m-records-for-sale/"}],"summary":"Popular stock photo service, 123RFm hit by data breach, 8.3M records for sale","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"224e7d9ae476b6008e95f8b53be1c3462f8f6276","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02a64550-0a3f-11ea-9821-617d71ee6253"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"f3b25086a121","org_name":"ING Bank","org_type":"financial","ransomware":null,"records_affected":20227,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/13716"}],"summary":"ING Bank Employee misused access to the customer database and emailed information to a third party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f653343ed9c690c6761d188c8a0081dd48d60f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94daf8d0-2903-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0ec4c491611","org_name":"Huddle House","org_type":"other","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/huddle-house-restaurant-chain-announces-breach-of-pos-system/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/home/security-news/data-breach/huddle-house-hit-with-point-of-sale-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/huddle-house-suffers-pos-malware/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/huddle-house-payment-card-breach-could-potentially-impact-300000-customers-researchers/"}],"summary":"Huddle House has become the latest US restaurant chain to suffer a Point of Sale (POS)-related data breach.  The casual dining and fast food operation revealed on Friday that a malware intrusion had affected an unspecified number of its “corporate and franchised locations.  “Crim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d273771458d80a03dfc0fd1e2f905a60f5ca0b8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91826e80-a4aa-11e8-b571-7db57cad93dd"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"61842f95431a","org_name":"Hova Health","org_type":"healthcare","ransomware":null,"records_affected":2373764,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/telemedicine-company-exposed-data-of-more-than-2-millions-patients-in-mexico/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.linkedin.com/pulse/telemedicine-company-exposed-data-more-than-2-mexico-bob-diachenko/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthcareitnews.com/news/telemedicine-vendor-breaches-data-24-million-patients-mexico"}],"summary":"On August 3rd, I have discovered that personal information of 2,373,764 patients from Mexico is publicly available through a misconfigured MongoDB instance. Data included such fields as:  Full name and gender; CURP number (i.e.  Personal ID Code Number, a unique identity code for","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e856ee92d4bcaa327e5808c42ac467b8e0062cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64772ec0-d2eb-11e8-9b3a-b50b161886e9"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3ce358edff4d","org_name":"Holt Medical Practice","org_type":"healthcare","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-data-breach-at-medical-practice-shock-and-disgust-as-150-patients-affected/"}],"summary":"Holt Medical Practice had employee inappropriately view the medical records of 150 patients with a business need to do so.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0c4f167c0a2ce3fba02640e41ad58306dea32c7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7882be30-30de-11ec-9798-915a6ecdc137"},"incident_date":"2018-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c39e89f316cb","org_name":"Hillcrest Country Club","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bartlesvilleradio.com/pages/news/230872020/hillcrest-country-club-hit-by-ransomeware-attack"}],"summary":"Hillcrest Country Club Hit By Ransomeware Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5bf64725d1a3e2146337343fc92fbc12474fe15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d8706d0-1d06-11ea-b94e-893211cca703"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"f5302e1ddc70","org_name":"HealthEngine","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.asia/medical-booking-firm-could-face-penalties-for-selling-data-a-12890"}],"summary":"Australia's fair trading regulator says it's seeking penalties against HealthEngine, an online platform for booking medical appointments, for allegedly selling patient details to private health insurance brokers without disclosure and embellishing patient reviews of healthcare pr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad53d6090259a0bcfff02727f8b5541ecd464cdb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49632f80-d30e-11e8-9b3a-b50b161886e9"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59addb625fda","org_name":"Harper's Magazine","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://motherboard.vice.com/en_us/article/pammz9/harpers-magazine-warns-subscribers-that-passwords-may-have-been-stolen"}],"summary":"hackers stole usernames and passwords for Harper's Magazine website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d70ecc7cb0a13a778aaf3cf5bfec46aa09dac137","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d4f002d0-88fe-11e8-82c8-d50e157d53ee"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6fe060fab3df","org_name":"Government of Newfoundland and Labrador","org_type":"government","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/newfoundland-labrador/sunshine-list-privacy-breach-23-employees-1.4732489"}],"summary":"For the second year in a row the provincial government's salary disclosure includes names and salaries that shouldn't have been released.  The list, which is often called the \"sunshine list\" reveals the names and salary information for anyone making more than $100,000.  The 23 pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IN","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25df045ed7347a596dfe4717b5559ff09e026d8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f21ea5d0-89b9-11e8-88c8-4f24b24771cb"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"39bb4fb424b2","org_name":"Government of India","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.indiatoday.in/india/story/aadhar-data-leaked-from-telangana-government-website-1276317-2018-07-03"}],"summary":"P Santosh Kumar managed to illegally download Aadhar details of thousands of people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50e697800c9dbf93c1d13b1d7912bc6439625a78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37d1eea0-aa0a-11e8-b272-396d7fe012b7"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"dd55ff6c6e78","org_name":"GoAir","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thehindubusinessline.com/news/goair-sues-former-md-over-data-theft/article23731588.ece"}],"summary":"Budget airline GoAir hasd filed a suit against its former CEO Wolfgang Prock-Schauer, accusing him of data theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"266957b698a2c162a71995dcd03720243cb20c7d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e9455230-9a47-11e8-8652-5d096cfefbb4"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb6d3257cf5a","org_name":"Garden city Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gctelegram.com/news/20180726/gccc-investigating-reported-email-breach"}],"summary":"Reports of unauthorized monitoring of several Garden City Community College employees’ emails prompted the college to open an investigation Friday, an action that included starting the probe with the college’s information technology department and placing its three-man staff on s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6374ca686c9a94ea13693ee31afc010d7e1dc42","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e0d06340-0349-11e9-aee0-f7420d4f3238"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"a6cd5956b92d","org_name":"flightradar24","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.austrianaviation.net/detail/hack-datenpanne-bei-flightradar24/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/06/21/flightradar24_data_breach/"}],"summary":"Aviation professionals enthusiasts have been told to change their passwords after flight-tracking site flightradar24 warned of a data breach.  The site offers real-time visualizations of commercial flights in transit with a freemium model. Subscribers get access to more historica","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6ed194373bbff3316d634425efd7aa8922a5390","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe6e7c50-3609-11e9-bfa7-0593a63883d2"},"incident_date":"2018-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":50000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/50-million-facebook-users-affected-by-account-take-over-security-issue-522959.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://newsroom.fb.com/news/2018/09/security-update/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/story/facebook-security-breach-50-million-accounts/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2018/05/facebook-fires-security-analyst-accused-of-using-access-to-stalk-women/"}],"summary":" Facebook believes that spammers, and not a nation-state, are responsible for a devastating recent hack that stole the personal information of 29 million Facebook users, according to a report by The Wall Street Journal on Wednesday.  The report, which cites anonymous sources, say","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"006048c68bb042be5416acb3ea7a91c11683a903","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f7853b60-146f-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52be48afc7dc","org_name":"Employees Retirement System of Texas","org_type":"financial","ransomware":null,"records_affected":1248263,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-statement-and-frequently-asked-questions-about-the-2018-ers-online-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/texas-retirement-agency-portal-breach-affects-125-million-a-11638?rf=2018-10-25_ENEWS_SUB_GIS_Slot1&mkt_tok=eyJpIjoiWlRZeE56QmhaRFE1WWpSaSIsInQiOiJPWlZqYktjQWtjbGJ4b3c2Yk96OStVYkREUVwvMFhQVVNUN0lxVVlGQUQwcUFxVEJ0NVlaemN4SlBoNGRqTHByaDBiZ0dwS2tFR240WEdIU2ltUTZ2OTFSa0dkbng2ajV2cmxHa1M4KzBuamZIUmprQWpKQVFGTXhRVG16SVUrTWwifQ%3D%3D"}],"summary":"Texas Retirement Agency Portal Breach Affects 1.25 Million Coding Error Allowed Some Logged-In Members to View Others' Information.  A coding error in a portal of the Employee Retirement System of Texas inadvertently allowed some users to view the information of others, potential","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"178cf5b16145ba226be850e0fded6e551f595777","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5395af20-070d-11eb-ab9e-fb89bdbaf0c7"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"0c884a68bc1e","org_name":"Email.it","org_type":"technology_saas","ransomware":null,"records_affected":600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/email-provider-got-hacked-data-of-600000-users-now-sold-on-the-dark-web/"}],"summary":"Email.it, an email provider had their entire user data, 600000 users sold on a forum ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aafbc72b916a59bdb4e42a7877f18df2403e0df0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b564b40-228f-11eb-940b-ff2256f17cee"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"ec9659002eb5","org_name":"Eatigo","org_type":"retail_ecommerce","ransomware":null,"records_affected":2800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.straitstimes.com/tech/personal-data-from-28-million-eatigo-accounts-stolen-put-up-for-sale-online"}],"summary":"2.8 million Eatigo accounts were up for sale in criminal forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cf492f64bcfa8bb709b28bf2a7f4125d0b7949d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f2cb230-2aa6-11eb-9486-e305299943be"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"429d06f79ee0","org_name":"Eastern Health","org_type":"healthcare","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/newfoundland-labrador/eastern-health-facebook-privacy-breach-medical-files-claim-1.5773188"}],"summary":"Some jerk posted PHI of patients from Eastern Health on facebook from a \"USB\" he claimed he \"found\" in the \"parking lot\" after being \"escorted\" out of the facility by security guarads. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"486b8c7035e92e6e835760284bd7104854fe686e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c45e53a0-8c18-11e8-bfaf-f7b4555dc539"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"50c59b9314d0","org_name":"DriveHer","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com/news/gta/2018/04/04/driveher-ride-sharing-app-for-women-suspends-service-after-data-breach-exposes-personal-information.html"}],"summary":"The owner of a ride-sharing app created to increase safety and security for women drivers and riders has suspended its services after learning that its user data was vulnerable to a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12d866092f78087683101a4f2352e28e3e14b56c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e77b030-2901-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cec586e31cc","org_name":"Department of Homeland Security","org_type":"government","ransomware":null,"records_affected":247167,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.helpnetsecurity.com/2018/01/05/dhs-oig-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.gizmodo.com.au/2018/01/homeland-security-data-breach-affects-240000-federal-employees-plus-witnesses-and-interviewees/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2017/11/28/us/politics/homeland-security-personal-data-software-stolen.html?"}],"summary":"The US DHS Office of Inspector General (OIG) has confirmed that the “privacy incident” discovered in May 2017 resulted in the theft of personally identifiable information of DHS employees and individuals associated with investigations.  The incident was the result of an attempted","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adabce2b6617735541f349856c3536bd6796e4f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe536a10-034f-11e9-aee0-f7420d4f3238"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"35f19c98aaed","org_name":"Dena Bank","org_type":"financial","ransomware":null,"records_affected":39,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.navhindtimes.in/39-bank-customers-lose-rs-6-5-lakh-in-atm-card-skimming-fraud/"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40ce4b3d3d95b1a4965acb908afb36340836bfda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f99c0a0-918b-11e8-ad4c-017f2df1a0a0"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab2d60d92ad1","org_name":"DC Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://lenpenzo.com/blog/id49967-recent-data-breach-crises-affecting-healthcare-workers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://wjla.com/features/7-on-your-side/dc-government-website-security-breach"}],"summary":"the Department of Health sent this letter to 600 nurses who recently renewed their license thru the website. It mentions a security incident and personal information went public.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92d516c2e33a88f5ded823552443f9407200abeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"019a5060-ef60-11e9-8b51-736a93581b2e"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f66137a7e120","org_name":"Chicago Public School System","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.wttw.com/2018/12/28/cps-ousted-ogden-principal-exposed-private-student-info-new-data-breach"}],"summary":"A principal sent a google drive link to a drive containing sensitive information by email.  The principal was then FOIA'd and sent the email as part of the response, including the link with all the sensitive information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6a82aada208fedda38b8d53dd3da07c14298cd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"552989b0-0fcd-11eb-afe7-87eff9df4bdb"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a2934abcaf85","org_name":"Central Health Newfoundland","org_type":"healthcare","ransomware":null,"records_affected":240,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/newfoundland-labrador/central-health-provacy-breach-1.5665594"}],"summary":"Central health employee was found snooping on 240 people's medical information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7db08a0bf996a43e3d500c17650d1f6bacc89341","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12cd65e0-0279-11e9-aee0-f7420d4f3238"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"493c38e43014","org_name":"CCRM Dallas-Fort Worth","org_type":"healthcare","ransomware":null,"records_affected":1117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ccrm-dallas-fort-worth-notifies-patients-of-data-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ccrmivf.com/wp-content/uploads/2018/11/CCRM-Dallas-Data-Security-Incident.pdf"}],"summary":"CCRM Dallas-Fort Worth has become aware of a potential data security incident that may have resulted in the inadvertent exposure of patients’ personal and health information. Although at this time there is no indication that an unauthorized party actually accessed or viewed patie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40adaaae97bc2d6e9f0f04be81ca7d55d6e2d6e4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d83457a0-85f9-11e8-ae9b-a1b647b0d464"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc959236fbf4","org_name":"Brownsville Fire Department (TX)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/former-brownsville-fire-chief-facing-security-breach-charges/"}],"summary":"he former Brownsville fire chief is facing more charges.  Carlos Elizondo was indicted by a grand jury in an 11-count case of computer security breach charges.  He’s accused of logging into a computer network on 11 occasions to access the emergency reporting system portal for the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f458dcc3793c31e8491a9afcc9dbc80ae47e08c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80ebc250-9cb8-11e8-ace0-d908cba85008"},"incident_date":"2018-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a33b959a8592","org_name":"British RAF","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://sputniknews.com/military/201808051066975825-spy-tinder-f-35-leak/"}],"summary":"A perpetrator hacked a female RAF staffer's dating app profile, using her online presence to sweet-talk a male Royal Air Force employee and stealing secret information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c1c267b378b5ed8ca9fd2d333c1b7c11722eaba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91d42650-9cba-11e8-ace0-d908cba85008"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fe1273e25162","org_name":"British MP","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dutchnews.nl/news/2018/08/security-guard-was-showing-off-to-women-with-wilders-leaks/"}],"summary":"A former security guard involved in protecting far right MP Geert Wilders has gone on trial charged with leaking confidential information.  Read more at DutchNews.nl:","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ce8ed7f84b03e98acc26d4afd7fabc8e1d666c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36bc43f0-1439-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"581753d452fa","org_name":"BlankMediaGames","org_type":"technology_saas","ransomware":null,"records_affected":7600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blog.dehashed.com/town-of-salem-blankmediagames-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.spieltimes.com/featured/massive-town-of-salem-data-breach-over-7-million-accounts-compromised/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/town-of-salem-game-suffers-data-breach-exposing-7-6-million-user-details/"}],"summary":"On 28th of December, BlankMediaGames, developer of online role-playing browser-based game Town of Salem was hacked that resulted in a massive data breach. Over 7 million user data, including but not limited to emails, passwords and IP addresses were leaked and compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94209b4168d1a54a339efd2d235bff46559ab0b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa3fb8c0-1798-11eb-a388-210bf038e9e5"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"4e8b28ecd922","org_name":"BlackRock","org_type":"financial","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.businessinsider.com/blackrock-advisor-leak-information-on-thousands-of-advisors-posted-2019-1"}],"summary":"BlackRock asset management firm accidentally publicly posted a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f6f414ff6565d6ac5d8d09d881ec58ad5bf9243","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a07f8000-2900-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71c0183f1815","org_name":"Bell Canada","org_type":"technology_saas","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://business.financialpost.com/telecom/hacker-steals-data-from-up-to-100000-bell-canada-customers-in-second-breach-in-eight-months;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/business/bell-canada-data-breach-1.4500156"}],"summary":" Hacker steals data from up to 100,000 Bell Canada customers in second breach in eight months BCE says hackers got hold of up to 100,000 customer names and email addresses, and a limited number of phone numbers, user names and/or account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":"Winnti","variety":"state_affiliated"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47aa75e6c16ccfa15af5d162947b05cea42bff91","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af9a1ac0-c4f3-11e9-bbcb-6517d645041f"},"incident_date":"2018-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"daefd3e60b13","org_name":"Bayer","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.technadu.com/bayer-investigating-winnti-cyber-attack/63870/,"},{"fetched_at":null,"title":null,"type":"press","url":"https://in.reuters.com/article/bayer-cyber/bayer-says-has-detected-contained-cyber-attack-idINKCN1RG0NF?rpc=401&"}],"summary":"advanced threat compromises big company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"winnti"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b687cac2dadc79ae2050778bffbe8b0ade33257","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32790640-148c-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"650a532f6304","org_name":"Ballad Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wjhl.com/local/ballad-health-employee-fired-after-accessing-patients-records-without-permission/1311848611;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/ballad-health-fires-employee-who-accessed-patients-records-without-permission.html"}],"summary":"Ballad Health says an employee has been fired for accessing patients' records without an appropriate reason to do so.   The health system says it learned of the data breach on May 28.   According to Ballad, the former employee viewed patients' records, accessing both demographic ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0b2eb898a2e4e9a38aa51bd46a9c20cb251dd2f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c9b2d9c0-8a92-11e8-ba1e-e3857583ba43"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"fc8cc33b1e28","org_name":"Aviation ID Australia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.com/australian-airport-identity-card-issuer-breached-a-11205;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/australian-airport-id-card-issuer-breached-a-11205"}],"summary":"An Australian company that issues identity cards for access to airports has been notifying applicants and cardholders that their personal information may have been compromised, the Australian Broadcasting Corporation reports.  the data exposure occurred after a \"localized portion","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0edcf51f7f3944a41370ab115152019847d3a9ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e436b250-b632-11e8-9fc1-ef3f92dd4725"},"incident_date":"2018-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"bb3053e1495b","org_name":"AT&T","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nypost.com/2018/08/01/valedictorian-allegedly-stole-2m-in-digital-currency-by-hacking-cell-phones/"}],"summary":"In one case Ortiz allegedly walked into an AT&T store and impersonated a victim in order to get a new SIM card,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","medical","secrets"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb087a362eae80130c78401929f407be28e21be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"beffa000-8e7d-11e8-8003-e3ff5269fee2"},"incident_date":"2018-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b2ce6db6edb5","org_name":"Associates in Medicine PA","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.search.txcourts.gov/SearchMedia.aspx?MediaVersionID=78510877-8570-4776-8090-b6591fce95cb&coa=coa14&DT=Brief&MediaID=bda3394f-55b2-4883-ac71-dd0493ea0ffc;"},{"fetched_at":null,"title":null,"type":"press","url":"https://setexasrecord.com/stories/511465908-appellate-court-rules-lower-court-abused-discretion-in-associates-in-medicine-trade-secrets-case"}],"summary":"Associates claims when the doctors quit their practices at Associates and joined Methodist Primary, they “stole trade secrets, tortiously interfered with patient relationships, and committed other actionable conduct,” the opinion states","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7db7466bbec9a36bcd6c19ee91ddf5752567e13b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f8c99890-8e97-11ec-a600-657ec2694f8f"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"835e45b10ff3","org_name":"Argentinian Interior Ministry","org_type":"government","ransomware":null,"records_affected":45000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cpomagazine.com/cyber-security/argentinian-government-database-containing-id-card-information-of-entire-country-made-available-on-dark-web-forum/"}],"summary":"Argentinian Government Database Containing ID Card Information of Entire Country Made Available on Dark Web Forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bab6e7f690c91b1ba6d738a5718cb3bca7939ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4fd426c0-918d-11e8-ad4c-017f2df1a0a0"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"527e307ea2eb","org_name":"Andhra Pradesh Medicinal and Aromatic Plants Board","org_type":"government","ransomware":null,"records_affected":23000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.huffingtonpost.in/2018/07/11/indias-latest-data-leak-is-so-basic-that-peoples-aadhaar-number-bank-account-and-fathers-name-are-just-one-google-search-away_a_23479694/"}],"summary":"The Andhra government has been leaking the personal data of more than 23,000 farmers who have received subsidies from the Andhra Pradesh Medicinal and Aromatic Plants Board","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d87cb70dc880a31bc9b26aeda7f7873a2277d51e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e4d53680-d42c-11eb-a192-c5509024cd4a"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95994d2c5399","org_name":"Anchor Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thedailyworld.com/news/police-looking-for-men-who-skimmed-account-info-at-bank-machine/"}],"summary":"Two men suspected of placing skimming device on bank atm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"918ad78f6bf3f9c758d780af16a4a559e5807bd0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2e51de0-3526-11e9-8dbb-275658e06f31"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4e22287d394a","org_name":"Amex India","org_type":"financial","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__www.pulse.ng_bi_tech_arik-2Dair-2Dsuffers-2Dmassive-2Dleak-2Din-2Dcustomers-2Ddata-2Did9050897.html&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=7yfQRaRncSWj4_E8tf2AecgFLJcI8f-RfLiP6J2-3RA&s=IQjsvkBWDusJ05R3d_XuxV8XjOmh0KUEyu1Wg7-2sZE&e="}],"summary":"https://www.zdnet.com/article/data-of-nearly-700000-amex-india-customers-exposed-via-unsecured-mongodb-server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8719c1eb10da70cad97c8637f58a90badc10d31e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a5d80050-8922-11e8-8760-271b3d9edf6d"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0ffd1f7cc10a","org_name":"Algonquin College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.iheartradio.ca/580-cfra/news/algonquin-college-investigating-data-breach-1.3954505;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ottawacitizen.com/news/local-news/mysterious-algonquin-college-cyber-attack-could-affect-thousands"}],"summary":"Algonquin College is investigating a cyber attack that breached one of the school's servers.  It's unknown at this time how many current and former staff and students may be affected, but the college says it could be thousands.  It's also unclear which data was specifically acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f03eaa8b37bded49f16037319f7f606eac944701","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6833390-3523-11e9-8dbb-275658e06f31"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"75e83d904d6a","org_name":"adapt.io","org_type":"technology_saas","ransomware":null,"records_affected":9000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://urldefense.proofpoint.com/v2/url?u=https-3A__news.softpedia.com_news_almost-2D9-2D5-2Dmillion-2Dpii-2Drecords-2Dleaked-2Dby-2Ddata-2Daggregator-2Dadapt-2D523931.shtml&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=AyjWuOUGf1Sh5VZQQwKl9cd5khJPJB6kxm09TDJMTn0&m=diED_Ako_SKFbrFxTBce7Hg7KRGZSNGeKcXNLGfbpL0&s=qXmG5XqQ9sOCRrWHrXA4WACK20mFXLmT1hv3vXhR41I&e="}],"summary":"an unsecured MongoDB database found by security researcher exposed over 9 million records of PII to the internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5062f1ac08ebf543cbe7e42ef4249f75e5cc970","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fdeecc0-1438-11e9-9b0e-db2459a65ffe"},"incident_date":"2018-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"545a164f5f8f","org_name":"Abine","org_type":"technology_saas","ransomware":null,"records_affected":2400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abine.com/blog/2018/blur-security-update/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/data-of-2-4-million-blur-password-manager-users-left-exposed-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://hackercombat.com/abines-blur-password-manager-latest-victim-of-data-breach/"}],"summary":"On Thursday, December 13th 2018, we became aware that some information about Blur users had been potentially exposed and immediately began working to ensure our systems and data were secure, to determine what happened, and to inform and help our users. We have also retained a lea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3ff228634784361aae8e554c83a679784a86f17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0204afc0-8a92-11e8-ba1e-e3857583ba43"},"incident_date":"2018-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0dde4e445947","org_name":"Aberdeen City Council","org_type":"government","ransomware":null,"records_affected":947,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pressandjournal.co.uk/fp/news/aberdeen/1520597/information-watchdog-launches-probe-into-city-council-data-breach/"}],"summary":"An information watchdog has launched a probe into a data breach at Aberdeen City Council, which resulted in hundreds of confidential tax forms being sent to the wrong employees.  The 947 P11D documents are for members of staff at the local authority, earning more than £8,500 a ye","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2018-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75b352961d1ffc1b8096ea5d6a6a56a33955d8ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71811fd0-28ff-11e9-adf7-352895b3dcd2"},"incident_date":"2018-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"deca8650b935","org_name":"51Jobs.com","org_type":"professional_services","ransomware":null,"records_affected":1950000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://supchina.com/2018/06/18/1-9-million-user-accounts-hacked-at-recruitment-website-51job/"}],"summary":"Private data of more than 1.9 million users of 51Job.com, one of the largest recruitment platforms in China, were reportedly found for sale on the dark web, according to (in Chinese) The Paper.  Judging from sample information provided by the hackers, the breach gave hackers acce","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-29","discovered_date":"2017-11-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bf1e4a076f1e904035475aa16c4c4b9b36d4d333","impact_type":"unknown","incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ec10dfeec683","org_name":"TIO Networks USA, Inc. (TIO.com), Cricket Wireless LLC, and Pacific Gas and Electric Company","org_type":"unknown","ransomware":null,"records_affected":1600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TIO%20Networks%20USA%2C%20Inc.%20%28TIO.com%29%2C%20Cricket%20Wireless%20LLC%2C%20and%20Pacific%20Gas%20and%20Electric%20Company-2017-12-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-12-28","discovered_date":"2017-10-27","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7261e9bf01cb696aeab403761e830272783898b","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAY%20San%20Diego%20Ad%20r4fin_0.pdf"},"notes":null,"org_country":"US","org_id":"b94c17f74291","org_name":"SAY San Diego","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee inadvertently left paper files in a filing cabinet during an office move.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAY%20San%20Diego%20Ad%20r4fin_0.pdf"}],"summary":"SAY San Diego participant files were inadvertently left in a filing cabinet during an office move and later found at a salvage store.","supporting_quote":"We determined that the files were inadvertently left in a filing cabinet by a SAY San Diego employee when SAY San Diego moved to a different office building.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-28","discovered_date":"2017-11-12","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adeb3785d3dc6199634bd3fa5c3b07962bc1faa7","impact_type":"data_theft","incident_date":"2017-11-12","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NextGen%20Global%20Resources%20Breach%20Notice%204815-8586-3255%20v.2_0.pdf"},"notes":null,"org_country":"US","org_id":"c921fe4ed921","org_name":"NextGen Global Resources","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee responded to a phishing email, allowing an unauthorized person to create an email-forwarding rule.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131689"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NextGen%20Global%20Resources%20Breach%20Notice%204815-8586-3255%20v.2_0.pdf"}],"summary":"An employee's response to a phishing email enabled an unauthorized person to create a forwarding rule in the employee's email account, exposing worker information.","supporting_quote":"On November 12, 2017, we discovered that an employee had inadvertently responded to a phishing attack email, allowing an unauthorized person to create an email rule in that employee’s email account automatically forwarding incoming email to an unknown third party.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"358d4d053272ae5d7ff39537b1936ee993836a65","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Forever%2021%20CA%20Substitute%20Notice%2012.28.17_0.pdf"},"notes":null,"org_country":"US","org_id":"da9e4c59f28d","org_name":"Forever 21","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131937"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Forever%2021%20CA%20Substitute%20Notice%2012.28.17_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Forever%2021%2C%20Inc.-2017-12-28"}],"summary":"Forever 21 reported unauthorized network access and malware on some point-of-sale devices that searched for payment card data.","supporting_quote":null,"technology_involved":["point-of-sale (POS) devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8698798ca8d3306b5c49536cdad7eddf8ddb250b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SVSP%20-%20Signed%20Privacy%20Breach%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131611"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46d3fd59ed8f769d4f965657df4c680f3f3d7069","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-11-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"1e6d7e93bfa8","org_name":"Ancestry","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ancestry","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ancestry"}],"summary":"Ancestry’s RootsWeb service suffered a data breach involving email addresses and plain-text passwords that was discovered in late 2017.","supporting_quote":null,"technology_involved":["RootsWeb"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fd39d70479cac2b63c9c9c97f3a6160c6470f51","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RootsWeb%20Breach%20Notice%20_%20Combined%20_0.pdf"},"notes":null,"org_country":"US","org_id":"c6a5b34991eb","org_name":"Ancestry.com Operations, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131600"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RootsWeb%20Breach%20Notice%20_%20Combined%20_0.pdf"}],"summary":"Ancestry reported that a file containing RootsWeb usernames and passwords was created due to how part of the RootsWeb community was set up.","supporting_quote":null,"technology_involved":["RootsWeb surname list","RootsWeb server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2017-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ce5db6024718ddbbe99c4399f9bd1286d52bfff","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TIO%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"266a5ffce84f","org_name":"TIO Networks USA, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131573"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TIO%20notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9757.pdf"}],"summary":"TIO Networks reported unauthorized access to locations on its systems storing personal information, but said it had no proof that the recipient’s data was accessed, acquired, or misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"364c6a16d771f7efa9c6c83939837f9ff0831ddb","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"660f7a9a08af","org_name":"Anaheim Majestic Garden Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131517"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter_0.pdf"}],"summary":"An unauthorized party used a compromised account to access payment card and reservation information processed through Sabre's SynXis Central Reservations System.","supporting_quote":"As per conversation with Sabre, Sabre has removed the compromised account that was used by the unauthorized party.","technology_involved":["SynXis Central Reservations System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59f0f0d57189746a2ae8b6765c0f9d6359f5c6b7","impact_type":"unknown","incident_date":"2017-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/V%26F%20notice%20letters_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8852aa8379c1","org_name":"Veyna & Forschino","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131389"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa554244a0f9286900dc8995521bdf3ecea77c04","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c3e03f0-e44e-11e9-ae80-e5ad9aac92e3"},"incident_date":"2017-12-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3272922c8b5c","org_name":"Subway","org_type":"other","ransomware":null,"records_affected":181,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.derbytelegraph.co.uk/news/local-news/subway-reveals-personal-details-customers-966415"}],"summary":"Customer data for local subway in DE were leaked due to misconfiguration","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-21","discovered_date":"2017-11-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3f18ab040c0145af7974acea59903ef16c27846f","impact_type":"unknown","incident_date":"2017-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0275cd013a57","org_name":"SAIF Corporation","org_type":"unknown","ransomware":null,"records_affected":1751,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SAIF%20Corporation-2017-12-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d1920ee38acfe68e90afd182e75f1c930f7e4c7","impact_type":"unknown","incident_date":"2017-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5688514836eb","org_name":"Dameron Hospital","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131388"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f161354c9a7600145fd8d09df9c1dac6cfd2edeb","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5f7c9780-8c3b-11e8-b87d-7b77fe08a9ae"},"incident_date":"2017-12-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/20180529%20TN%20SKIMMER%20CA%20OPP_0.pdf"}],"summary":"Payment card skimmers found on two PIN pads ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb5f4fb510ae824d29a747faeb3e1c53044242df","impact_type":"disruption_or_ransomware","incident_date":"2017-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Golden%20Optometric%20-%20Individual%20Notice%20%28Privileged%20%26%20Confidential%29_1.pdf"},"notes":null,"org_country":"US","org_id":"f5e0c9e54de9","org_name":"Sheldon M. Golden O.D., Optometric Corporation","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131261"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131259"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Golden%20Optometric%20-%20Individual%20Notice%20%28Privileged%20%26%20Confidential%29_1.pdf"}],"summary":"Golden Optometric’s network server was infected with CrySiS ransomware, which encrypted files containing patient personal and medical information; the investigation found no evidence that files were removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"088cc18fab92544a38b8612595b1cf806b88615b","impact_type":"data_theft","incident_date":"2017-11-24","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2017.12.08%20Pinterest%20User%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"eeb44b164347","org_name":"Pinterest","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Email addresses and passwords may have been obtained through breaches of other websites and used to log in to Pinterest accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131258"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2017.12.08%20Pinterest%20User%20Notice_0.pdf"}],"summary":"Credentials possibly obtained in breaches of other websites may have been used to access Pinterest accounts and send spam.","supporting_quote":"Your email address and password may have been obtained by hackers through a breach of other websites, and that information may have been used to log in to your Pinterest account and send spam.","technology_involved":["Pinterest"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-12-19","discovered_date":"2017-11-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b605eb4b031aa7f5d62c34641f95db45b7d238b6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHLA.Letter.Child__0.pdf"},"notes":null,"org_country":"US","org_id":"8831ab64771a","org_name":"Children's Hospital Los Angeles","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131269"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHLA.Letter.Child__0.pdf"}],"summary":"Children's Hospital Los Angeles learned that a child's confidential health information was inadvertently sent to the wrong insurance payor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9c08ded61e6d4ec1f47f73a8e63c0542e9e0fbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79401f80-918a-11e8-ad4c-017f2df1a0a0"},"incident_date":"2017-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ec02e2eabe8","org_name":"Dr. Ruben U. Carvajal, MD","org_type":"healthcare","ransomware":null,"records_affected":3775,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/ruben-u-carvajal-md-provides-notice-to-individuals-of-data-security-event-300682470.html"}],"summary":"On January 3, 2018, Dr. Carvajal received a report that certain Ruben U. Carvajal, MD patient information may have been accessible on the internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2017-12-15","discovered_date":"2017-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f2fe478e2ec25ed1c936b3ddf611c37da27aeda","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/COSDataBreach12-13-17_0.pdf"},"notes":null,"org_country":"US","org_id":"20d829e0a536","org_name":"Siskiyou Joint Community College District","org_type":"education","ransomware":false,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131195"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/COSDataBreach12-13-17_0.pdf"}],"summary":"First Capitol Consulting, Inc. inadvertently disclosed Siskiyou Joint Community College District information to an employee of another client, who certified that the information was removed and destroyed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"First Capitol Consulting, Inc."},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"444bd5b49802","name":"First Capitol Consulting, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26fb2fa7cbcda7234f00a0eec85db49cd7cd8c9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letter%20%2810721%29_0.pdf"},"notes":null,"org_country":"US","org_id":"2dff43ba3b9e","org_name":"MetLife","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131091"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification%20Letter%20%2810721%29_0.pdf"}],"summary":"A MetLife associate sent a group life enrollment report containing personal and coverage information to associates affiliated with a customer with which the affected person was not employed.","supporting_quote":"On November 9, 2017, a group life enrollment report was sent by a MetLife associate to two associates that are affiliated with a group life customer with which you are not employed.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00f8a80bbbb5d677b52142d4b08c9634b3f55b44","impact_type":"data_theft","incident_date":"2017-01-10","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA.UHaulNotification-withcard.12.11.2017_0.pdf"},"notes":null,"org_country":"US","org_id":"73bba7992705","org_name":"U-Haul Co. of California","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-130936"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA.UHaulNotification-withcard.12.11.2017_0.pdf"}],"summary":"U-Haul reported that malware on a workstation at its independent dealer Solo Tire may have accessed customer rental and payment card information.","supporting_quote":"Findings from our investigation suggest that one computer workstation at this dealership had been infected with malware designed to target payment card information, but which may have also accessed other rental information.","technology_involved":["computer workstation"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Solo Tire"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"4652c4c501ef","name":"Solo Tire"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"768c9b8d2074a1d56cf2c348bf62eb0eb6fb661b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a7f0760-e451-11e9-ae80-e5ad9aac92e3"},"incident_date":"2017-12-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"705673a7ed0f","org_name":"Stanislaus County","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stancounty.com/news-room/news-releases/news-2017/pdf/press-release-20171215-bhrs.pdf"}],"summary":"Stanislaus county compromised by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca8f2e1a2edda525ad7c5cc24d5762d603bf5b21","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0c7c9390-20e2-11ea-8baf-97ebc0c111f5"},"incident_date":"2017-12-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b613e8137a95","org_name":"Brushy Creek Market","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fox7austin.com/news/police-warn-of-skimming-devices-discovered-at-gas-pumps"}],"summary":"skimmer found at gas station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"339c696bd6ad0d96df72383ca7d2798e68366864","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08cb5e30-a09f-11e8-899a-23ad2f84ca7d"},"incident_date":"2017-12-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"5512c15a43cd","org_name":"Klook","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.asiaone.com/business/klook-notifies-customers-of-potential-thirdparty-data-breach-incident"}],"summary":"Klook has become aware that certain customer information may have been accessed without authorisation, as a result of a malicious JavaScript code associated with a third-party web-based analytics tool, SOCIAPlus (the \"third-party provider\"), which Klook used on its website. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d39b2f2d0d20a87d9a318cf27a96c5fcd3105a07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bba336a0-b200-11e8-800d-891a5c02ea18"},"incident_date":"2017-12-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64ed24d55818","org_name":"Jerome School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmvt.com/content/news/Jerome-School-District-falls-victim-to-ransomware--463510223.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sacbee.com/news/business/technology/article195849624.html"}],"summary":"school district falls victim to a ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2017-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed4360c4ca536f5006ef8e5ff69ebaf204078293","impact_type":"data_theft","imported_from":null,"incident_date":"2017-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"BR","org_id":"3a46aec58d9e","org_name":"Netshoes","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Netshoes","type":"hibp","url":"https://haveibeenpwned.com/Breach/Netshoes"}],"summary":"A dataset likely originating from Netshoes was posted publicly, though the company said it had found no indications of an intrusion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cff25121670775493530a3410f37b20a84db688a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-12-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CH","org_id":"e3b9a9d9f127","org_name":"dvd-shop.ch","org_type":"retail_ecommerce","ransomware":null,"records_affected":67973,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: dvd-shop.ch","type":"hibp","url":"https://haveibeenpwned.com/Breach/DVDShopCH"}],"summary":"dvd-shop.ch exposed email addresses and plain-text passwords in a December 2017 data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b98f581a705e7ddaca373b6d30972223deeb609a","impact_type":"unknown","incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"414ca49579db","org_name":"CrackingForum","org_type":"unknown","ransomware":null,"records_affected":660305,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CrackingForum","type":"hibp","url":"https://haveibeenpwned.com/Breach/CrackingForum"}],"summary":"In approximately mid-2016, the cracking community forum known as CrackingForum suffered a data breach. The vBulletin based forum exposed 660k email and IP addresses, usernames and salted MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-08","discovered_date":"2017-09-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da4d2238c09e266bd997eb954485761e48df8ec9","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WEI%20Mortgage%20-%20Notice%20only%200_0.pdf"},"notes":null,"org_country":"US","org_id":"10fc2f6bfd73","org_name":"WEI Mortgage LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-130881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WEI%20Mortgage%20-%20Notice%20only%200_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#WEI%20Mortgage%20LLC-2018-01-03"}],"summary":"WEI Mortgage reported that a phishing attack led to unauthorized access to employee email accounts containing personal information.","supporting_quote":"With the assistance of third-party forensic investigators, we learned our company was the victim of an email phishing attack, resulting in unauthorized access to certain employee email accounts.","technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-12-08","discovered_date":"2017-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"579c2e17362e91c5ff8613536ca90ca936a6107f","impact_type":"disruption_or_ransomware","incident_date":"2017-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NCPC%20Exhibit%201%20to%20CA%20Regulator%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"af42f923c28c","org_name":"National Capital Poison Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-130874"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NCPC%20Exhibit%201%20to%20CA%20Regulator%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20Capital%20Poison%20Center%20%28%E2%80%9CNCPC%E2%80%9D%29-2017-12-08"}],"summary":"The National Capital Poison Center reported a ransomware infection and unauthorized access to a database server, with unauthorized access to stored data unable to be ruled out.","supporting_quote":null,"technology_involved":["database server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47bc8d22265b8400ef1b9f662d3906d9f98e0432","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20%20Draft_12-4-17_0.pdf"},"notes":null,"org_country":"US","org_id":"e17605a81a4b","org_name":"Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-130844"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20%20Draft_12-4-17_0.pdf"}],"summary":"A file containing a person’s name and Social Security number was inadvertently emailed without encryption to an outside entity, with no indication that the information was compromised.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-12-06","discovered_date":"2018-09-20","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e76618131860be8f25751bec5f43d4f726794800","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a00b6d0-ce57-11e9-a07e-2170fe2d70c6"},"incident_date":"2017-12-06","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb3168e1c2fe","org_name":"thesy, llc","org_type":"retail_ecommerce","ransomware":null,"records_affected":226000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://forum.vapelife.com/discussion/4243/anybody-else-get-a-notice-about-the-element-vape-data-breach,https://www.doj.nh.gov/consumer/security-breaches/documents/thesy-20181031.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-142197"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10590.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/ThesyLLC.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Thesy%2C%20LLC-2018-12-05"}],"summary":"e-commerce CC stealing malware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cc4603b1f2c3aeefddbc5e19289204f041aa3b3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"360167d0-15e4-11ea-997d-ff527b87f439"},"incident_date":"2017-12-05","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df8cad58667d","org_name":"Mecklenburg County","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wsoctv.com/news/local/mecklenburg-county-offices-experience-system-wide-computer-outage/658993421,https://www.fox46charlotte.com/news/hackers-freeze-mecklenburg-county-servers-demand-23000,https://blog.knowbe4.com/48-servers-of-north-carolina-county-held-hostage-by-lockcrypt-ransomware,https://spectrumlocalnews.com/nc/charlotte/news/2018/04/17/mecklenburg-county-s-it-proposes-more-funds-for-cyber-security-"}],"summary":"Mecklenburg County North Carolina got hit with ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-12-05","discovered_date":"2017-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"654dd8f647002c5fe87a80e3bf0e01bd80a2d86e","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kaiser%20Permanente%20breach%20notification%20letter_Fontana%20incident_120517_0.pdf"},"notes":null,"org_country":"US","org_id":"505d85b3913c","org_name":"Kaiser Foundation Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-119507"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131834"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kaiser%20Permanente%20breach%20notification%20letter_Fontana%20incident_120517_0.pdf"}],"summary":"Kaiser Permanente learned that an email system containing protected health information had been compromised.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1021.001"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-05","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d56451b7c2f6a3477d148b859c44491924feb62","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HNP%20Notification%20Letters_0.pdf"},"notes":null,"org_country":"US","org_id":"ed2ebd663fe2","org_name":"Hayden, Narey & Persich","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-119500"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HNP%20Notification%20Letters_0.pdf"}],"summary":"A malicious actor accessed Hayden, Narey & Persich’s system through a Remote Desktop application, and the firm said it had found no evidence that affected individuals’ information was accessed.","supporting_quote":null,"technology_involved":["Remote Desktop application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2017-12-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"125736e70ed454d88ffb80e8b3fd35dc23759d79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"994e0190-85f8-11e8-ae9b-a1b647b0d464"},"incident_date":"2017-12-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e401c38f115","org_name":"Albemarle County, VA","org_type":"government","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailyprogress.com/news/local/county/cyber-incident-prompts-albemarle-to-see-security-consultant/article_a5c8cc02-8300-11e8-b7ab-4f145949c684.html"}],"summary":"A December “cyber incident” in Albemarle County is leading the county to seek a contract with a cybersecurity consulting company. On Dec. 5, unauthorized requests were made to change bank deposit routing account numbers for six county employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3362e5ebf82a81a3ba58d3e9ab212407c676d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5061fbd0-eaad-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d68dc46dc81","org_name":"Women’s Health Consultants","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcall.com/news/local/allentown/mc-nws-allentown-watchdog-medical-records-dumped-20170920-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/medical-records-pennsylvania-obsgyn-clinic-improper-disposal/"}],"summary":"Sensitive medical records dumped in public Allentown recycling bin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ef817883c6d9be0f27d7a0dab441367d6f82881","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16588380-aa08-11e8-a274-afc3aa8c5110"},"incident_date":"2017-12-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7690076f1766","org_name":"Timehop","org_type":"technology_saas","ransomware":null,"records_affected":21000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gbhackers.com/21-million-users-timehop-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.technobuffalo.com/2018/07/09/timehop-data-breach-july-2018/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/timehop-reveals-additional-data-compromised-by-hacker-a-11210"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-01","discovered_date":"2017-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1373f41580b2d99aef9f45e72801ffd4b795b657","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stanford%20Notification%20Letter_FINAL_11292017_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"d1b2d57b4c7a","org_name":"Stanford University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Incorrectly changed permissions made confidential files on a shared file server viewable to the Graduate School of Business community.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-118732"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-131599"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stanford%20Notification%20Letter_FINAL_11292017_0.pdf"}],"summary":"Incorrectly changed permissions made files containing employee personal and salary information viewable to the Graduate School of Business community.","supporting_quote":"The permissions on these folders were incorrectly changed around September 2016, and thus the included files were viewable to the GSB community.","technology_involved":["shared file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ff395887c16c0cb52f40056b00d70fbd754904c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ca423640-e916-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cb1a488b4a1b","org_name":"Parklea Jail","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-5173083/Inmate-stole-smuggled-documents-prison-plans.html"}],"summary":"Inmate who was moved from Parklea Jail smuggled stolen documents that contained sensitive information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54ae089f9a0cf4b2e8d85de4ca3407479d3c15a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ff72eef0-0848-11e8-8ccf-e3865b9fabe5"},"incident_date":"2017-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a222434db24d","org_name":"Nissan Canada Finance","org_type":"financial","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ctvnews.ca/autos/nissan-canada-informs-financing-customers-of-possible-data-breach-1.3731485;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.marketwired.com/press-release/nissan-canada-finance-informs-customers-of-possible-data-breach-2243755.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2017/12/nissan-canada-notifies-1-1-million-customers-of-data-breach/"}],"summary":"Nissan Canada is in the process of notifying 1.13 million customers of a data breach that might have exposed their information.  On 11 December, the automobile manufacturer’s Canadian headquarters discovered that both Nissan Canada Finance and INFINITI Financial Services Canada h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-01","discovered_date":"2017-11-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7e84ba0feaa05e2cde3ff0358c8596d52645992","impact_type":"data_theft","incident_date":"2016-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JAM%20Notification%20Letter%20CA%206.15.16%20-%2011.6.17%20Template_0.PDF"},"notes":null,"org_country":"US","org_id":"7a074fcfe847","org_name":"JAM Paper & Envelope","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-119442"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JAM%20Notification%20Letter%20CA%206.15.16%20-%2011.6.17%20Template_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JAM%20Paper%20%26%20Envelope-2017-12-01"}],"summary":"JAM Paper reported that customer names, addresses, and payment card information used on its website may have been obtained by an unauthorized third party.","supporting_quote":null,"technology_involved":["JAM Paper website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32087affa2e4f76bd5e17b7470e8995af5b71ea1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebc19320-a0a5-11e8-899a-23ad2f84ca7d"},"incident_date":"2017-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5485d0df7330","org_name":"Idexx","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.pressherald.com/2018/08/07/idexx-accuses-former-workers-of-theft-and-fraud/"}],"summary":"Idexx says rival company recruited its workers, stole trade secrets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"405659fd328320b10eb7195b0e6bc83e2b78b595","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5e9a14a0-e455-11e9-ae80-e5ad9aac92e3"},"incident_date":"2017-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b35b1dc9419b","org_name":"Hudson Valley Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailyfreeman.com/news/credit-union-customer-accounts-skimmed-at-wallkill-branch/article_630e8bec-1027-52a7-8ba7-c24a327b4266.html"}],"summary":"Credit union customer accounts ‘skimmed’ at Wallkill branch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-12-01","discovered_date":"2017-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d11e81a7cf258b5b3f6e11f8eb8c62f5640a7efb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Humboldt%20-%20FINAL%20PROOF%20-%20CA%20SSN%20%5Bredacted%5D%20%287101397x7AB84%29_0.pdf"},"notes":null,"org_country":"US","org_id":"4063e83b26b6","org_name":"County of Humboldt","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-119438"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Humboldt%20-%20FINAL%20PROOF%20-%20CA%20SSN%20%5Bredacted%5D%20%287101397x7AB84%29_0.pdf"}],"summary":"The Humboldt County Sheriff’s Office recovered County of Humboldt payroll documents while serving a search warrant in Trinity County.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f99e3a799cf78510d9ae4e2cec5b3677732ac4d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9dd2b1c0-8e7c-11e8-8003-e3ff5269fee2"},"incident_date":"2017-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d031bf4b031","org_name":"Children's Mercy Hospital","org_type":"healthcare","ransomware":null,"records_affected":63054,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kansascity.com/news/business/health-care/article214266159.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.secureworldexpo.com/industry-news/kids-information-phishing-attack"}],"summary":"Personal data from more than 60,000 individuals may have been compromised as part of an email phishing scam that targeted Children’s Mercy Hospital employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc6487a9227588f45f93282197ad483c12f15c1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ffca5f10-8ab0-11e8-874b-dd84fb61b260"},"incident_date":"2017-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"24d13d746137","org_name":"Capita","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/07/17/capita_strikes_again_software_bug_in_schools_contact_book_risks_huge_data_breach/"}],"summary":"Capita has admitted a bug in an information management system used by 21,000 UK schools could have incorrectly linked contact details to the wrong pupils – an incident with huge implications for pupils' data protection.  The error, which has been pinned on a December 2017 upgrade","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"749f146ce8fa4a006c89e008feabd27403d5902f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36c5ac00-8c40-11e8-bc15-3f53b8a95c12"},"incident_date":"2017-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"801a6186d4a1","org_name":"Alteryx","org_type":"technology_saas","ransomware":null,"records_affected":12000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-american-households-exposed-in-massive-consumerview-database-leak/#487062577961"}],"summary":"120 Million American Households Exposed In open amazon bucket","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d20182f8ce9f58e1d9f937434343a897d07d7e83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f8dc0ec0-0b84-11e8-827c-bba53cbad290"},"incident_date":"2017-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"e645989ea143","org_name":"Ai.type","org_type":"technology_saas","ransomware":null,"records_affected":31293959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenextweb.com/security/2017/12/05/personal-info-31-million-people-leaked-popular-virtual-keyboard-ai-type/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeepersecurity.com/post/virtual-keyboard-developer-leaked-31-million-of-client-records;"},{"fetched_at":null,"title":null,"type":"press","url":"http://searchsecurity.techtarget.com/news/450431350/Keyboard-data-leak-exposes-millions-of-personal-records"},{"fetched_at":null,"title":"Have I Been Pwned: ai.type","type":"hibp","url":"https://haveibeenpwned.com/Breach/AIType"}],"summary":"Data belonging to 31 million users of the popular smartphone virtual keyboard, Ai.type, has leaked online after the developer failed to properly secure the app’s database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c84ab187006b359cea19516b2fe5739a584165e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dab69220-8a8d-11e8-ba1e-e3857583ba43"},"incident_date":"2017-11-29","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"faf21cf355e7","org_name":"Teal, Becker & Chiaramonte, CPAs","org_type":"professional_services","ransomware":true,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tbccpa.com/notice-cyber-security-incident/"}],"summary":"On February 21, 2018, Teal, Becker & Chiaramonte, CPAs, P.C. (TBC) were alerted by New York State Department of Taxation and Finance (“NYSDTF”) that approximately 50 fraudulent tax returns were filed for 2017 under TBC’s electronic filing ID number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8e527e4f0afd961fda5af82cd2c7b4d52f5777","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BP3%20first-time%20recipient%20CA%20notification%20letter%20sample_0.pdf"},"notes":null,"org_country":"US","org_id":"77b78164beb7","org_name":"Bulletproof 360, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-113868"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BP3%20first-time%20recipient%20CA%20notification%20letter%20sample_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9753.pdf"}],"summary":"Unauthorized code on Bulletproof’s checkout page may have captured customers’ personal and payment card information during the stated period.","supporting_quote":null,"technology_involved":["Bulletproof.com checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"572895ec4832846ad45528aab3b4cac1aefe8eb9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b3ce346f6dcd","org_name":"Bolt","org_type":"technology_saas","ransomware":null,"records_affected":995274,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bolt","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bolt"}],"summary":"Bolt user records from its vBulletin forum were exposed, including email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3aff77200ac32f805c957c92091d757d917f9236","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_0.PDF"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"e36e447f5fc8","org_name":"Uber Technologies","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-112414"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Uber%20Technologies%2C%20Inc.-2017-11-21"}],"summary":"Unauthorized actors accessed an Uber private cloud storage environment containing stored copies of Uber databases.","supporting_quote":null,"technology_involved":["private cloud storage environment","databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"941b97f07e614316e9af6229b73699d5cdd96df4","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DataBreachNotification_0.pdf"},"notes":null,"org_country":"US","org_id":"4748f77b5772","org_name":"Armor Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-112355"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DataBreachNotification_0.pdf"}],"summary":"Armor Games reported that a third party accessed users’ email addresses and hashed passwords, while investigating whether a later file containing plaintext passwords came from its systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"the Dark Overlord","variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2017-11-20","discovered_date":"2017-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92ee042caf119622086a0f9e49d4e179a08e7ee4","impact_type":"disruption_or_ransomware","incident_date":"2017-10-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USA%20Hoist%20-%20Data%20Security%20Breach%20Notification%20Form_0.pdf"},"notes":null,"org_country":"US","org_id":"730599505bb1","org_name":"USA Hoist Company, Inc., Mid-American Elevator Company, Inc., and Mid-American Elevator Equipment Company, Inc.","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-112319"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USA%20Hoist%20-%20Data%20Security%20Breach%20Notification%20Form_0.pdf"}],"summary":"A ransomware attack affected a server used by the companies to store employee and vendor information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae06c9b0fd053447353c0ae9ec9e028dcb942a18","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"404d69687fb0","org_name":"V-Tight Gel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: V-Tight Gel","type":"hibp","url":"https://haveibeenpwned.com/Breach/VTightGel"}],"summary":"Personal information allegedly obtained from V-Tight Gel surfaced in approximately February 2016.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-11-17","discovered_date":"2017-09-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4a9baa266a544d42b999c701e53df35a25bd449c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9751.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"2b1247797a8b","org_name":"The Medical College of Wisconsin, Inc.","org_type":"healthcare","ransomware":null,"records_affected":9500,"reviewed":false,"root_cause":"Employees were victims of a spear-phishing attack targeting MCW’s email system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9751.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Medical%20College%20of%20Wisconsin%2C%20Inc.-2017-11-30"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9751.pdf"}],"summary":"The Medical College of Wisconsin reported that a spear-phishing attack compromised employee email accounts containing personal and medical information.","supporting_quote":"MCW recently learned that a limited number of its employees were victims of a sophisticated spear-phishing attack to MCW’s email system.","technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2017-11-17","discovered_date":"2017-10-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38a5180198fe5b83d2f591d1e7b4c2df760f94b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T425_v01%20-%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"708d8d617a12","org_name":"Brinderson, L.P.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-110862"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T425_v01%20-%20CA%20Notice_0.pdf"}],"summary":"Brinderson reported that an unauthorized individual may have accessed systems containing personal and employment-related information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb87a9f73733c4ed8e6856be984bc35d65246e66","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TEMPLATE%20Notice%20to%20Employees%20%28All%20except%20Mass%20Oregon%29_0.pdf"},"notes":null,"org_country":"US","org_id":"37fd82382cf5","org_name":"Academy of Art University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee failed to remove the spreadsheet attachment before sending the email.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-110849"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TEMPLATE%20Notice%20to%20Employees%20%28All%20except%20Mass%20Oregon%29_0.pdf"}],"summary":"An Academy employee mistakenly emailed an attachment containing employees’ personal information to other Academy employees.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4879b4b20233bec98efd79e3e939add79fb2cd77","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"131c2f30-e915-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6634b7ae58f7","org_name":"St. Lawrence Psychiatric Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.watertowndailytimes.com/news05/st-lawrence-psychiatric-nurse-charged-with-theft-of-cash-checks-and-credit-cards-20171211"}],"summary":"Registered nurse stole property while working at the St.Lawrence Psychiatric Center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-11-16","discovered_date":"2017-07-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96e0e1cd74984f828eb34e53f64684ddb66288fe","impact_type":"data_theft","incident_date":"2017-07-31","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SFDOCS01-%231811613-v1-ClubSport---Notice-to-Employees-Final_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"7e773c365458","org_name":"ClubSport San Ramon and Oakwood Athletic Club","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee sent W-2 information to an unauthorized email address in response to a phishing email impersonating an executive.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-110719"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SFDOCS01-%231811613-v1-ClubSport---Notice-to-Employees-Final_0.pdf"}],"summary":"An employee disclosed W-2 information after receiving a phishing email impersonating an executive.","supporting_quote":"On July 31, 2017, we discovered that an employee was the subject of a phishing attack when they received an email that appeared to be from an executive, requesting copies of employees W-2 wage and tax statements.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ab0f67ff9e9ff2deccd2438bc2d4a8465cf3873f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9750.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"20942efb3305","org_name":"Western State Hospital","org_type":"unknown","ransomware":null,"records_affected":515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9750.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e6a619321edb52f3578335f9afac0a3fbffffb4","impact_type":"data_theft","imported_from":null,"incident_date":"2014-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ea3948d6a02e","org_name":"PoliceOne","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PoliceOne","type":"hibp","url":"https://haveibeenpwned.com/Breach/PoliceOne"}],"summary":"PoliceOne confirmed a data breach involving account information, including email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2143743433003e64ddb72b50c8f6e06583ca2492","impact_type":"disruption_or_ransomware","imported_from":null,"incident_date":"2017-08-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Far%20Niente%20CA%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"4db948b84110","org_name":"Far Niente Winery","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-108214"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Far%20Niente%20CA%20notification_0.pdf"}],"summary":"An individual gained unauthorized access to Far Niente’s computer network, encrypted files, and demanded a ransom; the letter says there was no evidence that information was viewed or obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bfd48d9cba2bda78ae3a084a2ec04f9c12053bf","impact_type":"unknown","incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CafeMom%20Email%2011-6-17_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"de8f74a2481a","org_name":"CMI Marketing, Inc. d/b/a Cafe Media","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-108202"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-15","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f19fe7bd55db905463a61c81ae73e46cd0bb9c81","impact_type":"data_theft","imported_from":null,"incident_date":"2017-07-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cheddars%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"783e6d01c939","org_name":"Cheddar’s Scratch Kitchen","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-110643"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cheddars%20Notification%20Letter_0.pdf"}],"summary":"A break-in at Cheddar’s Scratch Kitchen’s corporate facility resulted in the theft of laptops and a hard drive containing personal information.","supporting_quote":"Early on July 21, 2017, there was a break-in at locked corporate facility for Cheddar's Scratch Kitchen in Texas that resulted in the theft of several laptops and a hard drive containing personal some team members' personal information and very limited guest information.","technology_involved":["laptops","hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-14","discovered_date":"2017-11-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3b4f14d8532ad22dcd19be65cc5a2627b2205f6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-11-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Letter%20regarding%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"aa3e60f534ca","org_name":"Bakersfield City School District","org_type":"education","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":"A report containing personal information was inadvertently attached to an agenda packet posted on the District's website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Letter%20regarding%20Data%20Breach_0.pdf"}],"summary":"Bakersfield City School District inadvertently posted a report containing employees' and substitutes' names and Social Security numbers on its website.","supporting_quote":"In this agenda packet under the Certificated Human Resources Report, a report of certificated extra-time was inadvertently attached.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-14","discovered_date":"2017-08-01","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12b41ef9136f100e3e2d62a310bf1988df253958","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-07","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ABM%20-%20Notice%20only%200_0.pdf"},"notes":null,"org_country":"US","org_id":"b39cf9164efa","org_name":"ABM Industries Incorporated","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Several ABM employees clicked phishing emails and entered their credentials, after which an unknown actor gained access to ABM email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ABM%20-%20Notice%20only%200_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ABM%20Industries%20Incorporated-2017-11-14"}],"summary":"Phishing emails led ABM employees to enter their credentials, after which an unknown actor accessed email accounts containing individuals’ names; ABM reported no evidence that the information was accessed or acquired.","supporting_quote":"Several ABM employees had clicked on the phishing emails and entered their credentials.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70ef1553e4231b500c80f67468ce064ea784cd09","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20LETTER%20-%20LACDMH_0.pdf"},"notes":null,"org_country":"US","org_id":"d063778c2cc4","org_name":"Los Angeles County Department of Mental Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104241"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTICE%20OF%20DATA%20BREACH%20LETTER%20-%20LACDMH_0.pdf"}],"summary":"A LACDMH employee inadvertently emailed candidates a spreadsheet containing personal information, including Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-13","discovered_date":"2017-09-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0c1395d7aadfa68dd292b40f19d1cbb59642c62","impact_type":"data_theft","incident_date":"2017-06-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GNAC%20-%20Notice%20only%20-%20Exhibit%201%20-%20CA_0_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1041","org_country":"US","org_id":"7adef459ac7a","org_name":"Gallagher NAC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GNAC%20-%20Notice%20only%20-%20Exhibit%201%20-%20CA_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gallagher%20NAC-2017-11-13"}],"summary":"Gallagher NAC reported that data left a database tied to a customer web application, and could not rule out that it included personal information.","supporting_quote":null,"technology_involved":["web application","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"124bf0e6e136987fdd7f3e49f620e9d2e4db1c16","impact_type":"unknown","incident_date":"2017-09-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Dignity%20Health%20sample%20notice%20ESS%20Incident%20Individual%20Notif%20Template_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"370744ce57c4","org_name":"Dignity Health - Mercy San Juan Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104222"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f05c7201deef5c7b69257438a11cbacb3349d49d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"094d6740-ac57-11e8-8036-a30436c88231"},"incident_date":"2017-11-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6897a3878821","org_name":"Exxon","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wmar2news.com/news/region/howard-county/skimming-devices-found-at-howard-county-gas-stations"}],"summary":"Within the past two weeks, Howard county police have found skimming devices at two different gas stations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc7e2d6a303563d743bc8a0e6dfaaccb542cbdc5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33004f20-0aa5-11e8-827c-bba53cbad290"},"incident_date":"2017-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3b1edbe0184c","org_name":"TIO Networks","org_type":"technology_saas","ransomware":null,"records_affected":1600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/paypals-tio-networks-reveals-data-breach-impacted-1-6-million-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tionetworks.com/PYPL_News_2017_12_01_General_Releases.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://news.hitb.org/content/paypals-tio-data-breach-16-million-customers-personal-details-stolen-hackers;"},{"fetched_at":null,"title":null,"type":"press","url":"http://weartv.com/news/local/data-breach-could-impact-22k-gulf-power-customers;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.streetinsider.com/Corporate+News/PSE%26G+%28PEG%29+Says+Customers+May+be+Affected+by+Potential+Data+Breach+Involving+Systems+of+PayPals+%28PYPL%29+TIO+Networks/13594645.html;"}],"summary":"PayPal's recently-acquired payment processor TIO Networks has revealed that up to 1.6 million customers have had their information stolen in a recent data breach. Last week, the Vancouver, Canada-based TIO Networks said that following the suspension of operations, evidence has be","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"ISIS","variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f84dde839a94894a7c053c6ee4ac715b8f9f5824","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0ad2eb40-ac56-11e8-8036-a30436c88231"},"incident_date":"2017-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"2651dd4d81f0","org_name":"Bauer Media","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/news/409492-swedish-radio-hacked-isis-anthem/amp/"}],"summary":"Swedish radio listeners hoping to tap their feet to a bit of pop music were shocked when the station played the ISIS recruitment song 'For the Sake of Allah' after being hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"isis"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"077b7309f327630f462ef9984e86eed3b9dbe28f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"429919f0-e931-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-11-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9d4410e2a1c","org_name":"Rutgers University","org_type":"education","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/10572"}],"summary":"Rutgers had an \"administrative error\" that resulted in 1700 student records being exposed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-09","discovered_date":"2017-10-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9f29f2c53f38823b9a8404744fc8b285001834a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Corovan%20-%20notice%20onlyL_0_0.pdf"},"notes":null,"org_country":"US","org_id":"3d659f37135f","org_name":"Klinger Moving Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104174"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Corovan%20-%20notice%20onlyL_0_0.pdf"}],"summary":"Klinger Moving Company files containing personal information were temporarily accessible through a directed Google search, with no evidence of misuse reported.","supporting_quote":"What Happened? On October 17, 2017, we became aware that certain Company files containing sensitive information that were stored on a Company server had become browsable for a brief period of time through a directed search on the Google search engine.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-11-09","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50c1a4bca4c6499c20372741df31d6ae3ba37016","impact_type":"data_theft","incident_date":"2017-09-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20notification%20%2010-17-17_0.pdf"},"notes":null,"org_country":"US","org_id":"8cc64395e204","org_name":"Gary W Janke","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-104191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20notification%20%2010-17-17_0.pdf"}],"summary":"Gary W Janke reported that a thief stole two computers containing tax-return information from his offices.","supporting_quote":"Unfortunately, he stole two old computers from my offices.","technology_involved":["computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f928b0344c4ff51449ab408be8087dddaa891184","impact_type":"data_theft","incident_date":"2014-02-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"55abac92d160","org_name":"Coupon Mom","org_type":"unknown","ransomware":null,"records_affected":11000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Coupon Mom / Armor Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/CouponMomAndArmorGames"}],"summary":"An unverified file allegedly containing data hacked from Coupon Mom included email addresses and plain-text passwords, and was also found to contain data indicating it came from Armor Games.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d83915c569e0b7b0b897b812e0c7da4e206bb68","impact_type":"data_theft","imported_from":null,"incident_date":"2014-04-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"29a06a2acca7","org_name":"CafeMom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CafeMom","type":"hibp","url":"https://haveibeenpwned.com/Breach/CafeMom"}],"summary":"CafeMom suffered a data breach in 2014 involving email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"201009dacb1037d388dcfd2a7a1d5d580254f7aa","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"850686f0-d9a9-11eb-96ea-fd8a03dbb673"},"incident_date":"2017-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"545c8d3fada1","org_name":"Prince Albert Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://saskatoon.ctvnews.ca/prince-albert-police-launch-new-website-after-hack-1.3672142"}],"summary":"Prince Albert Police website was defaced by pro-ISIS hactivists","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-08","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97599463e61a1ef290f207509b352f438bef0071","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Form%20of%20Notice%20Letter%20Regarding%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"016c1f6ff93c","org_name":"Chapman University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103336"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20of%20Notice%20Letter%20Regarding%20Breach_0.pdf"}],"summary":"Chapman University reported that a missing external hard drive may have contained a copy of a recipient’s W9 form from university network drives.","supporting_quote":"Last week an external hard drive went missing from Chapman University’s Harry and Diane Rinker Health Science Campus.","technology_involved":["external hard drive","network drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a37ad582810836885c41d1afb132176ca90203a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e136ede0-e2de-11e7-a8b4-b50015373b0a"},"incident_date":"2017-11-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"85236a3632de","org_name":"University of East Anglia","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.edp24.co.uk/news/education/staff-member-affected-in-second-uea-confidential-data-breach-1-5270842;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/11/09/university_leaks_personal_data_for_second_time_in_five_months/"}],"summary":"An email was sent during the afternoon of Sunday, November 5, to around 300 postgraduate research students in the social science faculty, one of the UEA’s four teaching departments, containing personal information about a member of staff.  The breach occurred due to the accidenta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-11-03","discovered_date":"2017-09-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d8cb9a572e04fae841181a8236c76d80a9d96f0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tween%20Brands%20Notification%20CA1%20and%20CA2_0.pdf"},"notes":null,"org_country":"US","org_id":"30594ad196a0","org_name":"Tween Brands, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103242"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tween%20Brands%20Notification%20CA1%20and%20CA2_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tween%20Brands%2C%20Inc.-2017-11-03"}],"summary":"Tween Brands reported that an unauthorized individual may have accessed a web server and connected to a database containing vendor-portal username and password combinations.","supporting_quote":null,"technology_involved":["web server","database server","vendor portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-11-03","discovered_date":"2017-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d6b029c0fb41d391fd3904ae442761a7a34582a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HumanGood%20-%20letter%20to%20California%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"e0344f4ef8d3","org_name":"HumanGood","org_type":"healthcare","ransomware":null,"records_affected":4844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103240"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HumanGood%20-%20letter%20to%20California%20AG_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9747.pdf"}],"summary":"HumanGood reported that employee personal information maintained by a third-party service provider may have been involved in a data security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29c48a317ad93568178410b5cf171de2c046c591","impact_type":"unknown","incident_date":"2017-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Kimberly-Clark%20Cyber%20Event%20Letter%20-%20Oct%202017%20-%20US_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64c594ac3a43","org_name":"Kimberly-Clark Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103174"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d3a1cec49f86570e968a67951fbf727c9ca085c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc678e80-d63a-11e7-af4f-6b5d4514198e"},"incident_date":"2017-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"553f0b8b97ba","org_name":"Wellington Hospital","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/national/health/99284734/hospital-sends-wrong-records-to-dead-womans-son-in-disappointing-privacy-breach"}],"summary":"Three times John Nelson has asked for his late mother's medical records. Each time, he's been given someone else's.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e55687bb1b7c3d7af0a49eed1b8d1b390c3dbfe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42d737a0-d919-11e7-be42-df02fe7390b5"},"incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e34eadc0df4","org_name":"Washburn Computer Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/11/hack-of-attack-for-hire-service-vdos-snares-new-mexico-man/"}],"summary":"Hack of Attack-for-Hire Service vDOS Snares New Mexico Man - Washburn Computer Group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dbc98cbf6dfbbfe5b7097caeed402b89bb3146a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c731acc0-ac76-11e8-8036-a30436c88231"},"incident_date":"2017-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"835724426d50","org_name":"St. Canices Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kclr96fm.com/data-breach-st-canices-credit-union-kilkenny/"}],"summary":"St Canices Credit Union has notified the Data Protection Commisioner and the Central Bank of Ireland after a small number of members inadvertently received account information relating to other members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cdc37275c99d023912fef5a5916cce2ddd2b91d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6b3dae90-d9d7-11e7-be42-df02fe7390b5"},"incident_date":"2017-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"12b049860056","org_name":"Scottish Appropriate Adult Network","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/info-vulnerable-adults-victims/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.sundaypost.com/fp/fury-vulnerable-witnesses-id-info-leaked-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/scottish-charity-inadvertently-leaks-sensitive-data-rape-victims-volunteers-more-online-1646349"}],"summary":"The names, emails, phone numbers and computer addresses of around 50 people across the country were obtainable on the website of the Scottish Appropriate Adult Network (SAAN).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f19b7925495455f7763d4accc46ed1a9abde51e5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f9e5e50-e935-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"4c1fec08094d","org_name":"Red Rose","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.irinnews.org/investigations/2017/11/27/security-lapses-aid-agency-leave-beneficiary-data-risk"}],"summary":"Aid agencies have put some projects on hold while reviewing the security of a popular online system for handling aid distributions, IRIN has learnt. Sensitive personal and financial data on tens of thousands of people in humanitarian aid projects is at risk from hackers, accordin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1a73c1348dbb5b73afd8ca91f55fa9299c8552c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6968ed30-eaaf-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"3cfc3f80b9e3","org_name":"Philippine Drug Enforcement Agency","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://manilastandard.net/news/national/252955/-suspect-s-hiv-status-privacy-breached-.html"}],"summary":"FOLLOWING the arrest of 11 men in a Manila business district hotel room on Tuesday on suspicion of using illegal drugs, Philippine Drug Enforcement Agency officers unlawfully disclosed that one of the suspects was HIV positive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4ae841ef20e32e2539d382af6cebe640c31992b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d0b64c60-e2dc-11e7-a8b4-b50015373b0a"},"incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c6f82188ff2e","org_name":"Nunavut Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/nunavut-medical-record-privacy-1.4394180"}],"summary":"Earlier this month, Evano Aggark Sr. went to the Arviat health centre to get his arm checked. He said a nurse retrieved what should have been his medical information and walked him to an examination room where the nurse discovered she had the wrong files.  Aggark said that after ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd4cd42ade65ea5754d50b4362ab4b6d3cc0faea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61e3af70-d9e1-11e7-be42-df02fe7390b5"},"incident_date":"2017-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"c5ba6fa84d25","org_name":"Malaysian Dental Association","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.todayonline.com/world/asia/we-knew-about-data-theft-february-dental-group-now-says"}],"summary":"The Malaysian Dental Association (MDA) disclosed on Wednesday (Nov 1) that it had been alerted to a security breach on its online information system containing private data of its members since February.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14d7f2393ad13e7729273b48d60376a6f38e0349","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df0228e0-0b75-11e8-827c-bba53cbad290"},"incident_date":"2017-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50aae7cb263c","org_name":"Fasten","org_type":"transportation_logistics","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fasten-data-leak-nearly-1-million-users-sensitive-data-mistakenly-exposed-by-us-ride-hailing-firm/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/11/13/rideshare_upstart_fasten_data_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/fasten-data-leak-nearly-1-million-users-sensitive-data-mistakenly-exposed-by-us-ride-hailing-firm-1646872"}],"summary":"Boston-based ride-hailing hopeful Fasten has coughed to a million-customer data breach that happened because someone left a database lying around unsecured.  The breach was turned up by cloud-crowd Kromtech, whose Bob Diachenko wrote late last week that the company had a misconfi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6395df8823be5891d34322f54e7eba5c91a20c22","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83029d60-d905-11e7-be42-df02fe7390b5"},"incident_date":"2017-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"400a94502424","org_name":"DJI","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/11/16/dji_private_keys_left_github/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2017/11/dji-left-private-keys-for-ssl-cloud-storage-in-public-view-and-exposed-customers/"}],"summary":"Drone maker DJI left its private SSL, firmware keys open to world+dog on GitHub FOR YEARS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8fcde612c9315b9ba690dd20a50c5febb353704","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0424c6f0-e44b-11e9-ae80-e5ad9aac92e3"},"incident_date":"2017-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d890cf95a55e","org_name":"Colorado Mental Health Institute at Pueblo","org_type":"healthcare","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.colorado.gov/pacific/cdhs/news/oit-completes-assessment-cmhip-privacy-concerns"}],"summary":" The Colorado Mental Health Institute at Pueblo (CMHIP) experienced a potential data breach after a staff member on Nov. 1, unintentionally allowed access to a state-issued computer through a phishing scam.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d016c5e7fc430887965932b3651c8f005b635ae","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"203641a0-c57d-11e7-96ee-efef26e7cb61"},"incident_date":"2017-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"3d60a6cdc7f6","org_name":"Calvary Public Hospital Bruce","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canberratimes.com.au/act-news/calvary-public-hospital-bruce-unsure-how-documents-ended-up-on-barton-street-20171108-gzh6l6.html"}],"summary":"Calvary Public Hospital Bruce is unsure how internal documents detailing the requisition of drugs of dependence ended up on a Barton street.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"b91675173ccccd008dd53c561ae0ea42b945472e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ShopRiteSupermarketsInc..pdf"},"notes":null,"org_country":"US","org_id":"489349473258","org_name":"Shop-Rite Supermarkets, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Shop-Rite%20Supermarkets%2C%20Inc.-2017-10-30"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ShopRiteSupermarketsInc..pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ShopRiteSupermarketsInc..pdf"}],"summary":"Shop-Rite Supermarkets, Inc. filed a consumer notification letter, but the provided text does not describe the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2a1f5a28e46737c7c1a2befef3973ce797bffcf","impact_type":"data_theft","imported_from":null,"incident_date":"2012-03-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7217bc616000","org_name":"JobStreet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: JobStreet","type":"hibp","url":"https://haveibeenpwned.com/Breach/JobStreet"}],"summary":"JobStreet data including personal information and passwords from a March 2012 breach was later posted for sale and made freely downloadable.","supporting_quote":null,"technology_involved":["JobStreet website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2006abc291899f47cd06e363de0921899612c7da","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter-Redact-general_0.pdf"},"notes":null,"org_country":"US","org_id":"81f743c52322","org_name":"Home Box Office, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103102"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter-Redact-general_0.pdf"}],"summary":"An unauthorized third party accessed HBO’s information technology network, including personally identifiable information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d001ac3a947be483e7fd8b484c781739dbfed00","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"d9afc7205141","org_name":"Shotbow","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Shotbow","type":"hibp","url":"https://haveibeenpwned.com/Breach/Shotbow"}],"summary":"Shotbow announced a breach that exposed email addresses, usernames, and salted SHA-256 password hashes.","supporting_quote":null,"technology_involved":["multiplayer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-10-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a684f4b58ceb666b1b24610385dc391c8fb05940","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SoCal%20Soft%20Drinks%20Notification%20Letter_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"af78af33f457","org_name":"The Union Labor Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SoCal%20Soft%20Drinks%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized user accessed an employee’s Outlook email account, sent spam containing links to malicious websites, and may have been able to view personal and health information in emails and attachments.","supporting_quote":null,"technology_involved":["Outlook email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-27","discovered_date":"2017-09-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ce941462f2ffe5c932b31dcf968bf48cc6fb0e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHJ%20Notification%20Letter%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"e8cff01fe166","org_name":"Chiorini, Hunt & Jacobs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The david@chj.com email account credentials were compromised and used to access the externally hosted email server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-103063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHJ%20Notification%20Letter%20FINAL_0.pdf"}],"summary":"Chiorini, Hunt & Jacobs reported that compromised email account credentials were used to access its externally hosted email server and client information may have been exposed.","supporting_quote":"After a thorough investigation, the IT firm has determined that the david@chj.com email account credentials were compromised and used on July 1, 2017 and September 27, 2017 , to access our externally hosted email server.","technology_involved":["email account","externally hosted email server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bda96df1300cbfcf9cfe94acf074a7b80cf0181e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ac51270-d586-11e7-af4f-6b5d4514198e"},"incident_date":"2017-10-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"972cb875c8eb","org_name":"UAB Medicine","org_type":"healthcare","ransomware":null,"records_affected":652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc3340.com/news/local/uab-viral-hepatitis-clinic-warns-patients-of-possible-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.al.com/news/birmingham/index.ssf/2017/11/patients_at_1_uab_medicine_cli.html"}],"summary":"UAB Medicine informed over 600 patients of a possible breach of their protected health information. The Viral Hepatitis Clinic says the breach occurred on October 25 of this year.  The breach stemms from the loss of two USB memory sticks. UAB is uncertain if the data was or wasn'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"515b8d784f898610577e1289c6d51c5b9c5e645d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ce4f7140-c55e-11e7-9e23-d39fd27e665b"},"incident_date":"2017-10-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12c585d75bf3","org_name":"Springfield Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wwlp.com/2017/10/25/skimming-device-found-at-springfield-atm-police-looking-for-suspect/"}],"summary":" Police located a skimming device at an ATM and detectives were able to remove the skimming device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bca8661849d7b9080d16cc11552eeaaf8298225e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c0051190-ac57-11e8-8036-a30436c88231"},"incident_date":"2017-10-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39d6e2095ec4","org_name":"Geauga County, OH","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.geaugamapleleaf.com/news/county-employees-notified-of-data-security-breach/"}],"summary":"Geauga County employees and family members were alerted Dec. 15 to a data security incident involving possible unauthorized access to and acquisition of their personal information provided in connection with their employment with the county.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a93a3a8879585e6b42475a00458cb31c30df1cf1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26f37b00-c561-11e7-9e23-d39fd27e665b"},"incident_date":"2017-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef5c3081d8ad","org_name":"Alameda County libraries","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/california/fremont/alameda-county-library-system-hacked-report"}],"summary":"Alameda County Library System may have potentially been hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebedc4c69cc27514d96b77e41a4ca55dd37351a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4d3c1b10-c55b-11e7-9e23-d39fd27e665b"},"incident_date":"2017-10-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b9861cd8d2a","org_name":"Green Crush","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.law360.com/articles/977566"}],"summary":"Green Crush, a smoothie chain popular in Southern California and Las Vegas, accused a rival store on Monday of imitating its trademarks and misappropriating its trade secrets, saying one of the rival’s employees trained at a Green Crush location just to steal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e7c72ee4fddec79691a527c5f31b45fef86e72d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f41a65a0-aa01-11e8-b272-396d7fe012b7"},"incident_date":"2017-10-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d944ce143aa","org_name":"GreatBanc Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.greatbanctrust.com/img/docs/noticeofBreach.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-137157"}],"summary":"User fell victim to a phishing attack which led to the compromise of customer credentials and other information. The attacker created an email folder and attempted to direct wire transfers to customers but no evidence that they were successful.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72bca41c09fdcf9caaea9c39787a3dd80f85948b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee0b0d80-c565-11e7-9e23-d39fd27e665b"},"incident_date":"2017-10-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://clevelandbanner.com/stories/skimmers-found-on-polk-county-gas-pumps,68390"}],"summary":"Three skimmers found on Polk County gas pumps","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","credentials"],"disclosed_date":"2017-10-23","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62dda23d08cc8607b5effdf63a4d095a90024488","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alliance_for_College_Ready_Public_Schools_-_AG_Notice__0.PDF"},"notes":null,"org_country":"US","org_id":"ad84409be939","org_name":"Alliance for College-Ready Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102921"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alliance_for_College_Ready_Public_Schools_-_AG_Notice__0.PDF"}],"summary":"A security researcher accessed partial student records exposed in the Schoolzilla system, and the organization reported no other access.","supporting_quote":null,"technology_involved":["Schoolzilla"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Schoolzilla"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"28c44c7940a2","name":"Schoolzilla"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-20","discovered_date":"2017-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b4f8d00dd6b9be77098d3ec7c82a91825f6e18c","impact_type":"data_theft","incident_date":"2017-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Combined_0.pdf"},"notes":null,"org_country":"US","org_id":"5c375354b122","org_name":"Whole Foods Market Services, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102871"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combined_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Whole%20Foods%20Market%20Services%2C%20Inc.-2017-10-20"}],"summary":"Unauthorized software on point-of-sale systems at some Whole Foods venues copied customers’ payment card information.","supporting_quote":null,"technology_involved":["point of sale system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7c7b05a38fb4b10af141dcc295322cca75dd4ea","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Palomar%20patient%20notification%20letter%20102017_0.pdf"},"notes":null,"org_country":"US","org_id":"b9736278d02e","org_name":"Palomar Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee unintentionally misdirected an email containing patient-related information to an unintended recipient.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Palomar%20patient%20notification%20letter%20102017_0.pdf"}],"summary":"An employee of Palomar Health unintentionally emailed a patient worklist to an unintended recipient, who reported the error and stated that the email was deleted without further use or disclosure.","supporting_quote":"I regret to inform you that on September 27, 2017, an employee of Palomar Health unintentionally misdirected an email containing a worklist which included certain patient-related information about you to an unintended recipient.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-10-20","discovered_date":"2017-09-21","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acc6e9b8de0b29b9dc406b2c3ad6881708e0686b","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Member%20Notification%20Letter_10.10.17_0.pdf"},"notes":null,"org_country":"US","org_id":"ebef97abf435","org_name":"Kaiser Permanente Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102888"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Member%20Notification%20Letter_10.10.17_0.pdf"}],"summary":"A letter intended for one Kaiser Permanente member was inadvertently mailed to another member and included the recipient’s name and medical record number.","supporting_quote":"On 9/21/17, we discovered that a letter intended for you was inadvertently mailed to another Kaiser Permanente member.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ec70f4aa8615dffd8d931d1e012f4c91384e3ed","impact_type":"unknown","incident_date":"2017-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102832"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102831"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-112325"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95c61d55d953b6c1c111dd0c835c649f538aa710","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85c435f0-c32e-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a39e92cbb8de","org_name":"Ameris Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.news4jax.com/news/2-men-charged-in-connection-with-card-skimming-devices-in-st-augustine-beach"}],"summary":"2 men charged in connection with card-skimming devices in St. Augustine Beach - Ameris Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-18","discovered_date":"2017-10-18","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66063ba6fdf2c477d1b45e354c4729cf62b1a575","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-10-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"ZA","org_id":"11b5dc7900ae","org_name":"Master Deeds","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The database backup was published on a publicly accessible web server with directory listing enabled.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Master Deeds","type":"hibp","url":"https://haveibeenpwned.com/Breach/MasterDeeds"}],"summary":"A database backup containing South African residents’ personal data was found on a publicly accessible web server with directory listing enabled.","supporting_quote":"On 18 October 2017, the file was found to have been published to a publicly accessible web server where it was located at the root of an IP address with directory listing enabled.","technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29f17ed2298585b35c83edf4891d081f001331a7","impact_type":"unknown","incident_date":"2017-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Spark%20Pay%20Online%20Store_End-Customer%20Notice%20of%20Data%20Breach_10-16-2017%20version_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2bf4400b0b07","org_name":"Spark Pay Online Store","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102735"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-10-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dee60dd82280e7f5123fa1f5d9699e5b95d40dbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1252d260-ffd7-11e9-ad81-39b9e5fce51c"},"incident_date":"2017-10-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"0bb7e5477787","org_name":"Homeplus","org_type":"retail_ecommerce","ransomware":null,"records_affected":49000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://koreatimes.co.kr/www/tech/2019/09/694_276234.html"}],"summary":"Homeplus has 49k user accounts hijacked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0e80399a8b0f9e3267491304136437eb09ab014c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10498.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b177645e00ae","org_name":"Capital One Merchants (Spark Pay Online)","org_type":"unknown","ransomware":null,"records_affected":1352,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10498.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b41c04669ee7e017f237cb2f8cba34f3d762f61b","impact_type":"data_theft","imported_from":null,"incident_date":"2013-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"af115ee5f6ae","org_name":"We Heart It","org_type":"technology_saas","ransomware":null,"records_affected":8600635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: We Heart It","type":"hibp","url":"https://haveibeenpwned.com/Breach/WeHeartIt"}],"summary":"We Heart It suffered a 2013 data breach involving user names, email addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73931cec1bd9faecb86cd7bb117be69bc722087e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96678500-c09b-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-10-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6962832c1f7d","org_name":"Sheetz Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ydr.com/story/news/crime/2017/11/01/skimming-device-used-springetts-convenience-store-police-say/821933001/"}],"summary":"Skimming device used at Springettsbury convenience store snags 13 victims, police say - Sheetz","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c85cf2ca50f64060f677368e38d48abe4d08522","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Notice%20%28General%29_0.pdf"},"notes":null,"org_country":"US","org_id":"f946b1e9a6b8","org_name":"Pizza Hut","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102688"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Notice%20%28General%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pizza%20Hut%2C%20LLC-2017-10-16"}],"summary":"Pizza Hut reported that customer information, including payment card details, may have been compromised during a temporary intrusion on its website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c5459a18e8725bdb460bae14563118ed531a7b8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"9280c08a2c6d","org_name":"Transamerica","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Compromised third-party user credentials were used to log into Transamerica systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102679"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Transamerica%2C%20including%20Transamerica%20Life%20Insurance%20Company%20%26%20Transamerica%20Retirement%20Solutions%2C%20LLC-2017-10-13"}],"summary":"Unauthorized parties used compromised third-party credentials to access retirement plan account information through Transamerica Retirement Solutions.","supporting_quote":"We found no evidence of a compromise of Transamerica Retirement Solutions’ networks or systems, but unauthorized parties used compromised third-party user credentials to log into Transamerica systems and access your account information.","technology_involved":["Transamerica Retirement Solutions website"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-13","discovered_date":"2017-09-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"14dc75bbbf409ed07e01e869989692dbdecfc238","impact_type":"unknown","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa5c2dbc7183","org_name":"Owner's Association of Rivertide Suites","org_type":"unknown","ransomware":null,"records_affected":1298,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Owner%27s%20Association%20of%20Rivertide%20Suites-2017-10-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"631ff7dbe0709e8b79ec236bdbc0a9e16360537a","impact_type":"data_theft","imported_from":null,"incident_date":"2014-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"1553ab8f7076","org_name":"diet.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: diet.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/DietCom"}],"summary":"A breach of diet.com exposed user records containing contact details, usernames, plain-text passwords, and dietary information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"de97389753a1279487943f1c711c5bbc16ed9afd","impact_type":"data_theft","incident_date":"2017-07-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Cheddars%2C%20Inc.%2029%20Sept%2017%20-%20Consumer%20Notice.pdf"},"notes":null,"org_country":"US","org_id":"c49a6fe93a1f","org_name":"Cheddar's, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Cheddars%2C%20Inc.%2029%20Sept%2017%20-%20Consumer%20Notice.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Cheddars%2C%20Inc.%2029%20Sept%2017%20-%20Consumer%20Notice.pdf"}],"summary":"A break-in at a Cheddar's corporate facility resulted in the theft of laptops and a hard drive containing personal information.","supporting_quote":"Early on July 21, 2017, there was a break-in at locked corporate facility for Cheddar's Scratch Kitchen in Texas that resulted in the theft of several laptops and a hard drive containing personal some team members' personal information and very limited guest information.","technology_involved":["laptops","hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Heritage Provider Network","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8772e9913de2c06912ee12ad9b3cdae72ef4d4c4","impact_type":"data_theft","incident_date":"2016-02-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Letter%20-%20Clean09132017_0.pdf"},"notes":null,"org_country":"US","org_id":"ebc26e2e9f3f","org_name":"Community Family Care Medical Group IPA, Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A contracted provider may have disclosed CFC member information to people working for Heritage Provider Network or an affiliate without CFC's authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102607"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Letter%20-%20Clean09132017_0.pdf"}],"summary":"Community Family Care Medical Group IPA reported that a contracted provider may have disclosed member information to people working for Heritage Provider Network or an affiliate.","supporting_quote":"If the information was provided it was without the knowledge or authorization of CFC, and in violation of our rules and contracts concerning the disclosure or use of CFC member information.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"actor_id":"heritageprovidernetwork"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27c96555f91dc5199e5d51d1830e15193a2ee7e9","impact_type":"data_theft","imported_from":null,"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f7c7827c7e59","org_name":"Victory Phones","org_type":"technology_saas","ransomware":null,"records_affected":166046,"reviewed":false,"root_cause":"The MongoDB database was publicly facing without a password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Victory Phones","type":"hibp","url":"https://haveibeenpwned.com/Breach/VictoryPhones"}],"summary":"Victory Phones left a MongoDB database publicly accessible without a password, and an unauthorized party downloaded data including personal information.","supporting_quote":"In January 2017, the automated telephony services company Victory Phones left a Mongo DB database publicly facing without a password .","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64528392ef0c07a9710c6f9cbd68109e355311c8","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DROEGE%20redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"d1aefe617727","org_name":"Droege Computing Services","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102563"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DROEGE%20redacted_0.pdf"}],"summary":"Droege Computing Services reported that its StampAuctionNetwork server was hacked and customers’ names and payment card information may have been compromised.","supporting_quote":null,"technology_involved":["StampAuctionNetwork (SAN)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-09","discovered_date":"2017-09-21","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d66ac6521bc6ea01b55e55ff885e7dc58bbdfc72","impact_type":"data_theft","incident_date":"2017-07-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/T126_v03%20-%20Hue%20General%20Notice%20%283%29_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"1ad7dd2d894c","org_name":"Kayser-Roth Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":6488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/T126_v03%20-%20Hue%20General%20Notice%20%283%29_0.pdf"}],"summary":"Customer names, addresses, email addresses, and payment card information for Hue.com orders were accessed in a breach of Aptos’ e-commerce platform.","supporting_quote":"As has become increasingly common on the web in recent years, there was an intrusion into a portion of Aptos’ system that holds payment card data and certain other customer information for online orders placed on Hue.com.","technology_involved":["Aptos e-commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42f25ec42acb3c8936d8d6c33ee127fb8daa33b7","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f488c95e19ae","org_name":"AbuseWith.Us","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AbuseWith.Us","type":"hibp","url":"https://haveibeenpwned.com/Breach/AbuseWithUs"}],"summary":"AbuseWith.Us suffered multiple data breaches in 2016, exposing email addresses and associated usernames, IP addresses, and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2017-10-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6861975875eebc72ba3e13b293d0cb547652020e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ae65710-ac53-11e8-8036-a30436c88231"},"incident_date":"2017-10-07","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25dae8dae55a","org_name":"Clarion University","org_type":"education","ransomware":null,"records_affected":410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.explorechttp://www.exploreclarion.com/2017/12/07/clarion-university-email-compromised-investigation-underway/larion.com/2017/12/07/clarion-university-email-compromised-investigation-underway/"}],"summary":"Clarion University was notified of an email compromise that occurred because of a criminal phishing scam that compromised two email accounts in the registrar’s office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a8172dbe646d8e07906c04aedf90c7ef70cceca","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SyncHR%20Breach%20-%20Sample%20Notification%20Ltr%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"551d14a35afc","org_name":"SyncHR","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102447"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SyncHR%20Breach%20-%20Sample%20Notification%20Ltr%20%28CA%29_0.pdf"}],"summary":"SyncHR reported potential unauthorized access to employee benefit information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3029d518b55a52847fe7cb8192ff1411c4d6c9e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Provo%20Craft%20Consumer%20Notification%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"4a437a9b9de8","org_name":"Provo Craft & Novelty","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Provo%20Craft%20Consumer%20Notification%20Letter_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9743.pdf"}],"summary":"Malicious code infected Cricut’s online checkout page and was designed to capture customers’ payment and contact information.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98d539423f22cfe36fc508d5f0349fd4e89d8841","impact_type":"data_theft","imported_from":null,"incident_date":"2014-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"59bc70cf3056","org_name":"Kickstarter","org_type":"technology_saas","ransomware":null,"records_affected":5176463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kickstarter","type":"hibp","url":"https://haveibeenpwned.com/Breach/Kickstarter"}],"summary":"Kickstarter announced a data breach in February 2014 involving email addresses, usernames, and salted SHA1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-10-06","discovered_date":"2017-09-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2e19871ce6477c7cd08390b412649b950b69198","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Catholic%20United%20Financial%20Template%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"96d9d8cda5f1","org_name":"Catholic United Financial","org_type":"financial","ransomware":null,"records_affected":127310,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Catholic%20United%20Financial%20Template%20Consumer%20Notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9742.pdf"}],"summary":"Catholic United Financial reported that SQL injection attacks against its web server may have allowed access to members’ personal information.","supporting_quote":"On September 20, 2017, the forensic investigator issued its final report which concluded that Catholic United Financial’s web server had been subjected to SQL injection attacks by an unknown person(s).","technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"920526aadcd6fa17abf0c6a82976956f1a929629","impact_type":"data_theft","imported_from":null,"incident_date":"2014-05-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"426208da454a","org_name":"Bitly","org_type":"technology_saas","ransomware":null,"records_affected":9313136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bitly","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bitly"}],"summary":"Bitly suffered a data breach that exposed email addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","other"],"disclosed_date":"2017-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03f9392198b90a7164976396894d8ebbaf820408","impact_type":"both","imported_from":null,"incident_date":"2016-03-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0adba1304484","org_name":"Staminus","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Staminus","type":"hibp","url":"https://haveibeenpwned.com/Breach/Staminus"}],"summary":"Staminus experienced a breach that disrupted service for more than 20 hours and exposed customer credentials, support tickets, credit card numbers, and other data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eed3d0f63788ce4d7f5fce5c1217a5c3451cb8a2","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sub%20Notice%2010-4%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"53123481ffb1","org_name":"Sonic Drive-In","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sub%20Notice%2010-4%20FINAL_0.pdf"}],"summary":"Sonic Drive-In reported that credit and debit card numbers may have been acquired without authorization in a malware attack at certain locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcf375e481d9dd71ac6588372d8ec282cc71227c","impact_type":"data_theft","imported_from":null,"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"dafd008bf837","org_name":"ReverbNation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ReverbNation","type":"hibp","url":"https://haveibeenpwned.com/Breach/Reverb-Nation"}],"summary":"ReverbNation suffered a data breach in January 2014 involving email addresses and salted SHA1 passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63b349ca6677fed0e02d1f559d29cd7259759ff8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d4a7f4c0-d91f-11e7-be42-df02fe7390b5"},"incident_date":"2017-10-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5c9d934687cb","org_name":"Dudley Group NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dudleynews.co.uk/news/15645133.Confidential_information__may__have_been_in_stolen_hospital_container/"}],"summary":"Confidential information 'may' have been in stolen hospital container","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb761159e5a1aa8e0dee5c21f08d152270d7c349","impact_type":"unknown","incident_date":"2017-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Cabrillo%20attach_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8de1b93da455","org_name":"Cabrillo Community College District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102435"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a6adba816b8adbb90d43ce8a7788ef5e8f4c5981","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9741.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"68d8479dc3d0","org_name":"SONIC Corp.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9741.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Sonic.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16cca8aa62246fb036cb4e41a0d2d46923c71990","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a9a935a0-c4ab-11e7-bbb6-9b7618286d6b"},"incident_date":"2017-10-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d66e96e11eec","org_name":"Crunchyroll","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://otakukart.com/news/crunchyroll-hacked/"}],"summary":"According to Crunchyroll’s official Twitter account, “Please DO NOT access our website at the current time. We are aware of the issues and working on it.” Currently, users are rerouted to an identical looking site and malware attempts infiltrating the user’s computer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-10-03","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b2552427d4af6620d7c0807158b6ba7223bc1bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-31","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%20Sample%20Client%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"693ee5ad9bb9","org_name":"Northwestern Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Fraudsters used telephone social engineering to gain remote access to the victim's desktop computer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102340"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%20Sample%20Client%20Notification%20Letter_0.pdf"}],"summary":"Fraudsters used telephone social engineering to remotely access a consumer's desktop computer, potentially exposing personal, medical, and financial information.","supporting_quote":"During the course of a telephone call, fraudsters used social engineering methods to gain remote access to my desktop computer on August 31, 2017, and several times thereafter.","technology_involved":["desktop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2017-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d78b0a1bd47b9a160d8eb899a99ade6c46faa3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"030ca130-e922-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-10-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78ae85df68a6","org_name":"Henry Ford Health System","org_type":"healthcare","ransomware":null,"records_affected":18470,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox2detroit.com/news/local-news/personal-information-compromised-for-nearly-20000-henry-ford-health-system-patients;https://www.wxyz.com/news/more-than-18k-henry-ford-health-system-patients-affected-in-data-breach;https://www.healthdatamanagement.com/news/hackers-use-email-credentials-to-get-access-to-data-at-henry-ford"}],"summary":"Attackers gained access to hospital's email accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2017-10-03","discovered_date":"2017-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b6b90c6b6168f10806890947840ec9001923c75","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FlexShopper%20-%20AG%20Notice%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"70a959b99ca3","org_name":"FlexShopper, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A customer database was inadvertently accessible on the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FlexShopper%20-%20AG%20Notice%20-%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9740.pdf"}],"summary":"FlexShopper discovered that a customer database may have been inadvertently accessible on the Internet, potentially exposing personal, credential, and financial information.","supporting_quote":"On August 30, 2017, we discovered that a database containing customer information may have been inadvertently accessible on the Internet.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cef4342e057ab41e6de7ba5f2075258aa6a0d49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b37a3eb0-e1db-11e7-8553-197c24c367d2"},"incident_date":"2017-10-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e050cd488d1a","org_name":"CCRM Minneapolis","org_type":"healthcare","ransomware":true,"records_affected":3300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mn-colorado-center-for-reproductive-medicine-in-minneapolis-warns-clients-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kare11.com/news/edina-fertility-clinic-warns-clients-of-data-breach/496983568"}],"summary":"CCRM Minneapolis, which is located in Edina, says the clinic's servers were targeted by a ransomware attack on October 3, which triggered an investigation to determine if sensitive information had been put at risk. The hacker reportedly demanded a ransom.  The probe confirmed tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11a7a5973c447eaeb6f268857ba55d20578ee629","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5745b4c0-ad38-11e8-9e5a-c1f99505e93a"},"incident_date":"2017-10-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6b34620f0617","org_name":"Bathurst Jean Coutu Drugstore","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/bathurst-pharmacist-to-pay-17000-for-texting-private-information-about-a-patient/"}],"summary":"A Bathurst pharmacist who was caught texting information about a patient to someone outside that person’s “circle of care” has been sanctioned for professional misconduct.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","medical","personal"],"disclosed_date":"2017-10-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da989a350b783043b3dbb560736e0c617392091d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e0e2040-ac55-11e8-8036-a30436c88231"},"incident_date":"2017-10-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b87c1b75350f","org_name":"Sinai Health System","org_type":"healthcare","ransomware":null,"records_affected":11350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/business/ct-biz-sinai-phishing-incident-20171207-story.html"}],"summary":"At least two employees at Sinai Health System had their email accounts compromised in a phishing incident, potentially affecting the information of 11,350 people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"878b9c5fd405df2bb635ce2a787ff98a06e32308","impact_type":"unknown","incident_date":"2017-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07fe1a71918b","org_name":"Kenco Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kenco%20Group-2017-10-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"647980d564c0f9e68adf082b5bdd5086f4c28c2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d51037c0-dc25-11e7-be42-df02fe7390b5"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86e9531efd2e","org_name":"Windward Family Therapy Center","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kitv.com/story/36705195/medical-records-found-in-trash-bins-in-palolo"}],"summary":"Medical records found in trash bins in Palolo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8db17a72c7727b9d2f3d98423d4deab384b0a395","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96860230-a9e1-11e7-8c20-836b8b691ede"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf76e7da4cb9","org_name":"US Bank in Clarksville","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://clarksvillenow.com/local/us-bank-working-with-customers-affected-by-atm-skimming/"}],"summary":"US Bank working with customers affected by ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a593a7b152ff109c0461780bd45e7837efc8a6ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a2ac4db0-ba5f-11e7-92c6-3b362a3baf5b"},"incident_date":"2017-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba6f72906de3","org_name":"Tommie Copper","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nbcdfw.com/news/local/Texas-Based-Tommie-Copper-Says-Its-Customers-Credit-Card-Numbers-Were-Stolen-450671513.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102453"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tommie%20Copper%20Inc.-2017-10-06"}],"summary":"Texas-Based Tommie Copper Says Its Customers' Credit Card Numbers Were Stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6199dd1092c94f150fe47777340b1ced89c240a4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f46d9980-d9de-11e7-be42-df02fe7390b5"},"incident_date":"2017-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfc00c4198aa","org_name":"Texas Children's Health Plan","org_type":"financial","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/business/medical/article/Breach-of-Texas-Children-s-Health-Plan-patient-12312491.php"}],"summary":"Breach of Texas Children's Health Plan patient info feared","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7796fd93e4effa67c85f186857f09a062f2f3a6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37015110-bf0e-11e7-a9c6-17df034f6c5e"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bfac547d4354","org_name":"Tesco Express","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazettelive.co.uk/news/teesside-news/another-skimming-device-found-tesco-13430955"}],"summary":"ANOTHER skimming device found on Tesco Express cash machine in Teesside","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd8cbd3f7db99757914192cb91d40be2d13b1968","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"941063a0-c3d2-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"175faefdad87","org_name":"Tarte Cosmetics","org_type":"retail_ecommerce","ransomware":null,"records_affected":1891928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.msspalert.com/cybersecurity-news/tarte-cosmetics-database-leak/"}],"summary":"Tarte Cosmetics Database Leak: Nearly 2 Million Customers Exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"440a9aa7db2c6f21b56be19942fbaf72b02d095f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10ac6360-af5a-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0162e8da80d5","org_name":"T Moble","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tmonews.com/2017/10/t-mobile-website-bug-allowed-hackers-get-customer-account-data-fixed/"}],"summary":"T-Mobile website bug allowed hackers to get customer account data, but it’s been fixed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a42ae359cc646aab105278f339b2c74410b60c1f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cafc00a0-c3d6-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"8611a2a17959","org_name":"Spanish Ministry of Public Works and Transport","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/anonymous-attacks-spanish/"}],"summary":"Anonymous Attacks Spanish Government Sites","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee4067af2037173b8fc9bdc0f4a4a36a5d730f98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77804fd0-c4b2-11e7-bbb6-9b7618286d6b"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ed022b555bf","org_name":"Shoreview credit union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.twincities.com/2017/10/25/shoreview-atms-hit-with-credit-card-skimmers-suspects-caught-on-camera/"}],"summary":"Shoreview ATMs hit with credit card skimmers; suspects caught on camera","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"276eaaf69e40a918388a1c2725792ddbd742a8ad","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ca2faad0-c595-11e7-8053-ff1e84d2b694"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17cca177f927","org_name":"ShopRite","org_type":"retail_ecommerce","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.poughkeepsiejournal.com/story/news/local/2017/10/14/data-breach-ulster-shoprite-potentially-exposes-customers-personal-medical-data/764486001/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyfreeman.com/general-news/20171013/ulster-shoprite-breach-might-have-exposed-info-about-thousands-of-pharmacy-customers"}],"summary":"An electronic signature device which was improperly discarded caused a potential data breach for customers at ShopRite in the Town of Ulster.  The store \"inadvertently disposed of\" an electronic signature device used in the store's pharmacy in February 2016, resulting in the brea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cb4749e44969acde7b0406c87b3cf9c99da92a0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2103860-c3d4-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0bfc3ad6a59","org_name":"Seidl's Party Supplies & Rentals","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10news.com/news/ramona-business-robbed-customer-credit-card-information-stolen"}],"summary":"Ramona business robbed, customer credit card information stolen - Seidl's Party Supplies & Rentals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ade1e741c0d3a38a0f2fbd57e37289feb307a98f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d4df3450-c3c9-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0779b4a6dcf","org_name":"Rogue Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ktvl.com/news/crime-stoppers/crimestoppers-police-looking-for-suspects-in-debit-card-skimming-case"}],"summary":"Police looking for suspects in debit card skimming case - Rogue Federal Credit Union","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6418f4ffd91967597293aae579b5b6680da4a288","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6cacd910-b342-11e7-9a94-230655e65ca5"},"incident_date":"2017-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3ced3bcb047","org_name":"Revolution Event Design & Production","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://morningsidemaryland.com/former-cfo-of-revolution-pleads-guilty-to-identity-theft-and-wire-fraud/"}],"summary":"Former CFO Of Revolution Pleads Guilty To Identity Theft And Wire Fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7580f3770e37b6e42187e0bbbd372b50723ca8b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ed2cba0-a9e0-11e7-8c20-836b8b691ede"},"incident_date":"2017-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e608da38bf7","org_name":"NFL","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/policy/cybersecurity/353664-private-data-of-more-than-1100-nfl-players-agents-exposed"}],"summary":"Private data of more than 1,100 NFL players, agents exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de542576c9e1013996cf5a566f28776deddf944","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fdfe420-b419-11e7-9de8-4bde146bf807"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e67eb3a0d18","org_name":"Mobil Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://spacecoastdaily.com/2017/10/department-of-agriculture-satellite-beach-police-find-skimmer-at-mobil-gas-station/"}],"summary":"Department of Agriculture, Satellite Beach Police Find Skimmer At Mobil Gas Station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a90d942ae535f4900330a3ca17b43824e7f9089","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6167c00-a199-11e7-9764-c7e1aa1637e1"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c5079fd0c44","org_name":"Midland Regional Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlands103.com/news-centre/x-ray-file-local-penneys-among-hse-data-breaches/"}],"summary":"In a similar case in October, a staff member at Midland Regional Hospital in Tullamore tried to call a palliative care nurse and left a voicemail that included sensitive clinical information about a patient.  They subsequently received a call back from a third party, asking why t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c476912c69b8ac7c0589810c348333e13993bd5a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f01b0f30-b345-11e7-9de8-4bde146bf807"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0518bcd82aa","org_name":"Lukes One Stop gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc7chicago.com/card-skimming-device-found-at-indiana-gas-station/2530163/"}],"summary":"Card skimming device found at Indiana gas station - Lukes One Stop ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"The Dark Overlord","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc97be8ff3656ce02e0ab02ded21ccb4503092f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88185220-dc27-11e7-be42-df02fe7390b5"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"adfadb75b21f","org_name":"London Bridge Plastic Surgery Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://metro.co.uk/2017/10/24/hackers-have-stolen-data-from-a-cosmetic-surgery-clinic-used-by-the-rich-and-famous-7023893/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.christianpost.com/news/hacker-steals-patients-sensitive-photos-and-records-from-top-london-plastic-surgery-clinic-204274/"}],"summary":"Hackers have stolen data from a cosmetic surgery clinic used by the rich and famous - London Bridge Plastic Surgery ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Phineas Fisher","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","internal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f80a55e079734292b5fc95c036a6db4939685e9","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"TR","org_id":"a3db1806d475","org_name":"Justice and Development Party","org_type":"government","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AKP Emails","type":"hibp","url":"https://haveibeenpwned.com/Breach/AKP"}],"summary":"Phineas Fisher accessed approximately 300,000 emails belonging to Turkey's Justice and Development Party, and the messages were later published by WikiLeaks.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"phineasfisher"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Dark Overlord","variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec35f018b23a688c026e754bbd6448c14618887b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cedd5110-0a68-11ec-9d35-0d797e3f6b54"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c05c1567304","org_name":"Johnston School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://who13.com/news/johnston-school-district-provides-update-on-data-breach/"}],"summary":"Johnston School District experienced a breach and were threatened by malicious actors leading to class being canceled ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f57798a37a59a95f06d956ddd8c6d49ec2dd092d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b4a77450-084c-11e8-8ccf-e3865b9fabe5"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"8f28608374d7","org_name":"JobStreet.com","org_type":"other","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lowyat.net/2017/146627/jobstreet-db-confirm-nl/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.lowyat.net/2017/146552/hibp-verify-jobstreet/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com.my/news/nation/2017/12/12/date-breach-case-admins-of-websites-called-in-jailani-johari/"}],"summary":"Jobstreet hack affected 4 million users according to the vicim org.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e1b6f7e9fee7a9ea13172571ecc56d48b93dff5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fdba8b10-af68-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b980d52ca668","org_name":"India State Goverment","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://timesofindia.indiatimes.com/city/goa/for-data-leak-9-coastal-body-staff-sacked/articleshow/60977986.cms"}],"summary":"For data leak, 9 coastal body staff sacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"308db28a75e85081c0b9054715b18ac020a07670","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91588190-c57d-11e7-8053-ff1e84d2b694"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1eb48806fdb7","org_name":"Hay River Regional Health Centre","org_type":"healthcare","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/breach-hay-river-patients-files-1.4379007"}],"summary":"Another privacy breach has occurred at a territorial health care facility — this time at a medical clinic in Hay River. As a result, the Hay River Health and Social Services Authority is commencing a review of patient files.  In a news release, the authority says an internal audi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb5743639e95e559e61957f90b8173bfa1f55248","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7995e320-e2df-11e7-a8b4-b50015373b0a"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bd8475d2e26e","org_name":"Greenworks Medicinal","org_type":"retail_ecommerce","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ottawacitizen.com/news/local-news/patients-of-marijuana-dispensary-upset-after-personal-information-shared-in-email"}],"summary":"The owner of a medical marijuana dispensary in Gloucester has apologized after emails were accidentally sent to 24 patients that revealed the names and addresses of all the store’s customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":"Naudi Reyes Fernandez","variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caffeb6f92de7c92dc2316dabd1c28a45c14447d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42107f50-ca3e-11e7-8487-35d59b80f11b"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"daec387ee924","org_name":"Grafton Road Exxon","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dominionpost.com/Four-face-charges-for-credit-car"}],"summary":"a group of four people installed skimmers in gas stations in west virginia and used credit card data for fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical","derived":{"actor_id":"naudireyesfernandez"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39a6195e8dddd3e1c1b6dc53bf258fbff636b7fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e57c4d0-e91f-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5a48dfbd055d","org_name":"Gloucestershire Hospital","org_type":"healthcare","ransomware":null,"records_affected":56,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gloucestershirelive.co.uk/news/health/private-data-gloucestershire-hospital-patients-880389"}],"summary":"Private data of hospital patients transferred to America by mistake","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32f0197799bc4fbac09d959ed582fe53fa9b3c1a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c43bef70-c884-11e7-ad9d-998b531c9197"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"308be81e202a","org_name":"Federal Teachers Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.14news.com/story/36786087/epd-skimming-device-found-at-credit-union-atm"}],"summary":"Skimming device found at credit union ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"KP","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cfa971e9ac70ff99dc34696982d7ed48b08ccb8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74dbb560-bf0f-11e7-a9c6-17df034f6c5e"},"incident_date":"2017-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"582d5791a533","org_name":"Far Eastern International Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/north-korean-hackers-used-hermes-ransomware-to-hide-recent-bank-heist/"}],"summary":"North Korean Hackers Used Hermes Ransomware to Hide Recent Bank Heist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e4d76a1fc1c13a36753066f277ab705ab1d29ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccd37400-721d-11eb-a74a-79ed152e0098"},"incident_date":"2017-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc7a640dc47d","org_name":"Expedia","org_type":"other","ransomware":null,"records_affected":8800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thehill.com/policy/cybersecurity/379365-orbitz-says-hackers-may-have-accessed-info-on-880000-payment-cards"}],"summary":"Expedia webserver hacked resulting in the breach of 880000 payment cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71e169343ab13cc0d060d782975d251ff6a54c2f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62574c70-ba5e-11e7-92c6-3b362a3baf5b"},"incident_date":"2017-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"acab6df17cf3","org_name":"DHI Group Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.csoonline.com/article/3232096/security/insider-tries-to-scam-dice-after-hacking-company-he-sold-to-dice.html#tk.twt_cso"}],"summary":"Insider tries to scam Dice after hacking company he sold to Dice","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2da58b2fd3cb198250a1b51a53ab615b01fe300d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26f1c730-a9df-11e7-8c20-836b8b691ede"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb8a69056495","org_name":"Citizens Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wpxi.com/news/top-stories/several-police-agencies-investigating-rash-of-credit-card-skimming/619048315"}],"summary":"Several police agencies investigating rash of credit card skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16f9e55a18c7bcea47691dafa78efe11074ce155","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d22736f0-c31e-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c328b4750cdd","org_name":"Chemours","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://whyy.org/articles/former-chemours-employee-charged-trying-sell-company-secrets-china/"}],"summary":"Former Chemours employee charged with trying to sell company secrets to China","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b38a5858752e6fbf1216e0018b028e8f9b87e4c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"554d2b60-e2dd-11e7-a8b4-b50015373b0a"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9369b48badf5","org_name":"Carolina Oncology Specialists","org_type":"healthcare","ransomware":null,"records_affected":1551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/credit-card-applications-cause-data-breach-for-a-physician-practice;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/carolina-oncology-specialists-notifies-1551-patients-of-possible-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://oncology-cos.com/oncology/news-and-announcements/possible-hipaa-privacy-breach-oct-2017/"}],"summary":"Carolina Oncology Specialists, a 12-clinician practice in Hickory, N.C., is alerting patients about a potential incident in which personal information apparently is being used for financial fraud.  The organization recently received several credit card applications addressed to t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08499b5ddc4495f176956a189324bc704e319e4c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00a2d140-e1da-11e7-8553-197c24c367d2"},"incident_date":"2017-10-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d687aafac59","org_name":"Baptist Health","org_type":"healthcare","ransomware":null,"records_affected":881,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/baptist-health-louisville-notifies-880-patients-after-phishing-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/880-patients-baptist-health-louisville-phishing-attack/"}],"summary":"Baptist Health in Louisville, KY has notified 880 patients that some of their protected health information has potentially been accessed and stolen by hackers. The security breach was discovered on October 3, 2017, when irregular activity was detected on the email account of an e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6e12059de0f5cfd0501d20efc8373cf1ed29af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1f85d790-b9af-11e7-99ad-0bd398e0433f"},"incident_date":"2017-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e17e7b0c87dd","org_name":"Baber Psychiatric Group","org_type":"healthcare","ransomware":null,"records_affected":10500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/phi-10500-patients-illinois-psychiatrist-exposed/"}],"summary":"PHI of 10,500 Patients of an Illinois Psychiatrist Exposed - Dr. Riaz Baber, M.D.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"TheDarkOverlord (TDO)","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1442dcb3ccd129bc05f4912c665200d35b7d58ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9bbed460-df4d-11e7-98c9-5b20d709bc39"},"incident_date":"2017-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f82b30c013a","org_name":"Austin Manual Therapy Associates","org_type":"healthcare","ransomware":null,"records_affected":1750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/austin-manual-therapy-associates-patient-data-hacked-thedarkoverlord/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/austin-manual-therapy-notifies-1750-patients-of-data-breach/"}],"summary":"Austin Manual Therapy Associates patient data hacked by The Dark Overlord.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3324e63b8cedc9c9a21a4b008024a61b52a78ade","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"877fee80-c0a3-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/technology/2017/10/30/apple-fires-employee-daughters-video-new-iphone-x-goes-viral/"}],"summary":"An Apple engineer showed his daughter the new iPhone X. Now, she says, he’s fired","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa35771a97809b126e61bba1418ac1dcba5e9dff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7d4b6750-c562-11e7-9e23-d39fd27e665b"},"incident_date":"2017-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63e87b225277","org_name":"API Americas Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/kansascity/news/2017/10/25/hallmark-supplier-ex-employee-stole-trade-secrets.html"}],"summary":"Ex-employee stole trade secrets, gave them to competitor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63f1a6e2bd2d22f19212fdc3467267491b1841bd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30ed8130-b370-11e7-8c05-89053a811f98"},"incident_date":"2017-09-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45c23d86a89a","org_name":"R6DB","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/gaming-service-goes-down-after-hacker-wipes-database-and-holds-it-for-ransom/"}],"summary":"Gaming Service Goes Down After Hacker Wipes Database and Holds It for Ransom","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-29","discovered_date":"2017-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8a742b279019db6eee65d8496a4a3507f8b845b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Combined%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"778083edcb70","org_name":"The Online Traffic School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102294"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combined%20CA_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Online%20Traffic%20School-2017-09-29"}],"summary":"The Online Traffic School discovered that an unauthorized individual had accessed part of its computer network, and payment card and personal information may have been acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-29","discovered_date":"2017-06-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95f3e1a0193e695eca4943663088719a191a67fd","impact_type":"unknown","incident_date":"2017-05-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c83e16b879f","org_name":"Servis One, Inc.","org_type":"unknown","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Servis%20One%2C%20Inc.%20dba%20BSI%20Financial%20Services-2017-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5085e229fb4825b80823b2ef01f55ad42893f369","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/CenturyMartialArtsSupplyInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c3845a19757","org_name":"Aptos, Inc./Century Martial Art Supply, LLC","org_type":"unknown","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/CenturyMartialArtsSupplyInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd87f3e745d6aa8713a86e7f1b9f66efc2651cf9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ad283f0-d55a-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-09-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"870a486c82d9","org_name":"Rocky Mountain Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":909,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/laptop-stolen-rocky-mountain-health-care-services/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Rocky Mountain Health Care Services of Colorado Springs has discovered an unencrypted laptop has been stolen from one of its employees. This is the second such incident to be discovered in the space of three months. The latest incident was discovered on September 28. The laptop c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-28","discovered_date":"2017-06-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"beb7d4360722fbfd671ddee785150f35d3af8ad7","impact_type":"unknown","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2aa425ef74f6","org_name":"Phoenix Inns","org_type":"unknown","ransomware":null,"records_affected":1027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Phoenix%20Inns-2017-09-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"473dd7fbb07b8151f87e4c3897643fbeef35c905","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3222dfd0-a9f8-11e8-b1ba-fd48fe3201a4"},"incident_date":"2017-09-28","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42d524b5c0d6","org_name":"Buresh Building Systems","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://wcfcourier.com/news/local/crime-and-courts/woman-fleeced-hampton-firm-grand-jury-says/article_f77fcd09-9019-51a3-9834-7b882243fbff.html"}],"summary":"A Colombian woman has been charged with bilking a Hampton, IA, company of thousands of dollars after hijacking the business operator’s email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ac73076467dd05bacde315e49c29ac062de8d93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31d58050-a774-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ec0dd87bef0","org_name":"NC A&T University","org_type":"education","ransomware":null,"records_affected":1581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://myfox8.com/2017/09/28/some-nc-at-students-personal-information-leaked-in-security-incident/"}],"summary":"North Carolina A&T State University students’ personal information leaked in ‘security incident’","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-27","discovered_date":"2017-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cda7bdb788406310c12938e3c505e48f993fea1","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fresno%203%20Ad%20Employee%20with%20Minor%20r6fin_0.pdf"},"notes":null,"org_country":"US","org_id":"80687a88a5da","org_name":"Fresno Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102221"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fresno%203%20Ad%20Employee%20with%20Minor%20r6fin_0.pdf"}],"summary":"Unauthorized personal information belonging to Fresno Unified employees, retirees, and dependents was found in the possession of individuals arrested in two California cities.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2017-09-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"311e7269b9dcf17564e33cc07169388566377f1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8d09b830-1d13-11ea-b436-a7f38e8d15a2"},"incident_date":"2017-09-27","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dea7782837ae","org_name":"DXC Technologies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/11/14/dxc_github_aws_keys_leaked/"}],"summary":"org accidentally includes hard-coded cloud creds in code repository that are then abused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-27","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caa440ba9e91b6c4b60af160be284dcaf2323f11","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BSI_-_Sample_Consumer_Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"6344dbc412f5","org_name":"BSI Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BSI_-_Sample_Consumer_Notice_0.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9738.pdf"}],"summary":"An unauthorized third party may have accessed information about customers and their residential mortgage loan accounts through a servicing employee’s business e-mail account.","supporting_quote":null,"technology_involved":["business e-mail account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f138c04692a0e4b9a297f1f11b216e58751f6b0","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"2c32d89ce569","org_name":"7k7k","org_type":"other","ransomware":null,"records_affected":9121434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 7k7k","type":"hibp","url":"https://haveibeenpwned.com/Breach/7k7k"}],"summary":"7k7k was reported to have suffered an unverified data breach affecting approximately 9.1 million subscribers, exposing usernames, email addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3012828ca383ceb47c0132bb268c9232d77a0db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e81f750-a9de-11e7-8c20-836b8b691ede"},"incident_date":"2017-09-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"afdf7cef9c0c","org_name":"North Shore Community Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/illinois/wilmette/atm-skimmer-found-drive-thru-wilmette-bank-police"}],"summary":"ATM Skimmer Found At Drive-Thru Of Wilmette Bank: Police - North Shore Community Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"342001382adb324277cd77cf5a3765d850a07b4a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71333510-ba54-11e7-a4ec-c71ec2b9ee3a"},"incident_date":"2017-09-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5224bb243f05","org_name":"Citizen’s Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/news/20170901/lake-wales-police-seek-2-suspects-in-skimming-case"}],"summary":"Lake Wales police seek 2 suspects in skimming case - Citizen's Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-25","discovered_date":"2017-09-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dff9c9cee85d79fb2fcecb2794ff74a17005e82f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a4cde759177a","org_name":"Brown/Armstrong, PC","org_type":"unknown","ransomware":null,"records_affected":1003,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Brown/Armstrong%2C%20PC-2017-09-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc814cc147bfadf5033d281577a465874ca969d4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"acca83e0-d925-11e7-be42-df02fe7390b5"},"incident_date":"2017-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d30df005865d","org_name":"Ball Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1399,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestarpress.com/story/news/local/2017/11/03/hospital-patient-information-lost-found-bag/830338001/"}],"summary":"Patient information lost, found in bag","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac54dd7a2ba96176b92876a4ab4c9fe0025df03b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cbe2e170-c0a5-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-09-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4216003614d4","org_name":"Wendy's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.the-dispatch.com/news/20171101/wendys-employee-charged-with-theft-of-credit-card"}],"summary":"Wendy’s employee charged with theft of credit card","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18eacf3e2602038463b5d0e8b4c57a9f9a0b88a9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83ec8e30-034f-11eb-9654-9589698754ac"},"incident_date":"2017-09-22","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"540c756991d3","org_name":"Decatur County General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityboulevard.com/2018/02/hospital-warns-24000-patients-that-its-emr-system-was-hacked-to-mine-cryptocurrency/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/decatur-county-general-emr-security-incident-impacts-24k;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tennessee-hospital-notifies-24000-patients-after-emr-system-attacked-with-cryptocurrency-mining-software/"}],"summary":"On November 27, 2017, we received a security incident report from our EMR system vendor indicating that unauthorized software had been installed on the server the vendor supports on our behalf. The unauthorized software was installed to generate digital currency, more commonly kn","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c37a00b38e4702f83ad51ba1bde922202c6f1935","impact_type":"unknown","incident_date":"2017-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sprint%20Customer%20Notification%20Letter%202017-09-20_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b4254b586791","org_name":"Sprint","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102003"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-19","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"523bef925dbc438f7ffcb3acc2f364ff4f433478","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Grainger%20Notification_%20SAMPLE_0.pdf"},"notes":null,"org_country":"US","org_id":"a8cc10935770","org_name":"W.W. Grainger, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101989"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Grainger%20Notification_%20SAMPLE_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9737.pdf"}],"summary":"Grainger reported that a team member’s laptop containing personal information was stolen, with no evidence that the information was accessed or used inappropriately.","supporting_quote":"On August 23, 2017, Grainger learned that a team member’s laptop was stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-19","discovered_date":"2017-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bf6188e85372a01e8c1b4fae6133e8b8260283f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-06-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Signator%20-%20Breach%20Notification%20Letter%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"627abab4ec94","org_name":"Signator Investors, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Signator%20-%20Breach%20Notification%20Letter%20Template_0.pdf"}],"summary":"Signator Investors determined that an unknown third party accessed client records containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-18","discovered_date":"2017-06-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6db76bff5ed5148ad1d6f88de7ea63f6ab0e94f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9b5b17ea5caa","org_name":"TRUEbenefits LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9732.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TRUEbenefits%20LLC-2017-09-18"}],"summary":"An unauthorized person accessed a TRUEbenefits employee’s email account, and some emails may have contained recipients’ names.","supporting_quote":null,"technology_involved":["employee email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-16","discovered_date":"2017-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"172307fbd615ac4c31f323c8f0b60954a14e7245","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9736.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"39f42ecd68c4","org_name":"Whatcom Land Title Company","org_type":"professional_services","ransomware":null,"records_affected":433,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9736.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9736.pdf"}],"summary":"Whatcom Land Title Company reported that unauthorized persons accessed an account containing customer personal information after a phishing scam.","supporting_quote":"Whatcom Land Title Company (WLT) learned August 4, 2017 that it was the target of a phishing scam.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da4e0d32c59255579b2e65c4d4bc6e5d7b73702c","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ba83910-af58-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-09-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://northeasttimes.com/skimming-device-found-at-lawncrest-store-a75b6ad026fc"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/howard/laurel/ph-ll-skimmer-711-20170921-story.html"}],"summary":"Skimming device found at Lawncrest store - 7-Eleven","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-15","discovered_date":"2017-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c35c9d76f552339091d55b5c143a3c179b48bdaf","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/International%20Council%20of%20Shopping%20Centers%20Ad%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"e8036f36260c","org_name":"The International Council of Shopping Centers","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101918"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/International%20Council%20of%20Shopping%20Centers%20Ad%20CA_0.pdf"}],"summary":"The International Council of Shopping Centers found unauthorized code on its checkout page that may have captured information entered there.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-15","discovered_date":"2017-08-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"576104e55164e62f5a6fb3e88631cf0f1146530b","impact_type":"data_theft","incident_date":"2017-08-18","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/E%20%26%20J%20Gallo%20Winery%20%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"32814629f95c","org_name":"E. & J. Gallo Winery","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee obtained employee data without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101919"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/E%20%26%20J%20Gallo%20Winery%20%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"A former employee obtained E. & J. Gallo Winery employee data without authorization, and the company recovered it.","supporting_quote":"On August 30, 2017, Gallo learned that a former employee recently obtained employee data without authorization.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"582cc36a095d8896bd8b13edc1a0df54fcc6f037","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ffbc3140-a782-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4c417972abf","org_name":"Affinity Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/morris/index.ssf/2017/09/cops_investigating_atm_skimmer_at_hanover_bank.html"}],"summary":"Cops investigating ATM skimming device at Hanover bank - Affinity Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Dark Overlord","variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2017-09-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abe35bd341cb76c57be0df4e1411e23c97f6cf84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69c6e940-a954-11e7-bb38-a97a354bfe15"},"incident_date":"2017-09-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a450ef5c70a","org_name":"Sports Medicine and Rehabilitation Therapy","org_type":"healthcare","ransomware":null,"records_affected":16428,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ma-smart-physical-therapy-hacked-by-thedarkoverlord/"}],"summary":"SMART (“Sports Medicine and Rehabilitation Therapy”) Physical Therapy has two locations in Massachusetts:  one in Malden and one in Reading. But it doesn’t matter which one patients may have been treated at, as data from all of their patients was recently hacked by TheDarkOverlor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2017-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af70050338e8a2848a4b18230f8f54d3f6559cfd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ba03c890-ca3f-11e7-8487-35d59b80f11b"},"incident_date":"2017-09-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b5938ac8c7b","org_name":"Roger Williams Medical Center","org_type":"healthcare","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wpri.com/2017/11/10/medical-records-stolen-from-roger-williams-medical-center/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.providencejournal.com/news/20171110/medical-records-stolen-at-roger-williams-medical-center"}],"summary":"An individual broke into the registration area of the hospital on Sept. 13, 2017, and stole paperwork including the medical information of more than 60 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58c53ed83d0b5be05d68921b152286ea3489d672","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ac399ed0-9c7a-11e7-8eb8-67f320c42447"},"incident_date":"2017-09-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LT","org_id":"eddbc94719d4","org_name":"Lithuania's Labour Exchange","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.xinhuanet.com/english/2017-09/13/c_136607203.htm"}],"summary":"Director of Lithuania's Labour Exchange faces a fine due to significant personal data leak from the institution's website discovered a day before, the country's State Data Protection Inspectorate (VDAI) said on Wednesday. Ligita Valyte, head of Lithuania's Labour Exchange, might ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71d084f6988e1ca77ffc14ac40938d2657daae13","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"103e9fa0-c883-11e7-ad9d-998b531c9197"},"incident_date":"2017-09-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"627082e67f72","org_name":"Manasquan Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://jerseyshoreonline.com/howell/atm-skimmer-found-in-howell-tied-to-over-100-fraudulent-transactions/"}],"summary":"ATM Skimmer In Howell Tied To Fraudulent Transactions - Manasquan Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-09-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee56fef1502618c1eea04867c04b59b6b31ddde2","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-25","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ABB%20Sample%20Notification%20Letter%20to%20Individuals_0.pdf"},"notes":null,"org_country":"US","org_id":"57b1055548be","org_name":"ABB, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101735"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ABB%20Sample%20Notification%20Letter%20to%20Individuals_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ABBInc..pdf"}],"summary":"ABB reported suspicious login activity on an employee email account following a phishing email sent to employees, with personal, medical, and financial information potentially involved.","supporting_quote":"ABB, Inc. (“ABB”), received notice on August 25, 2017, that an employee’s email account had suspicious login activity as the result of a hacker sending a phishing scheme email to ABB employees on or around August 25, 2017.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2017-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c816d916e5d9eed1c8b67cd29231aa11257c0c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"000ab490-a4a9-11e8-b571-7db57cad93dd"},"incident_date":"2017-09-10","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4217d3f73165","org_name":"Augusta University","org_type":"education","ransomware":null,"records_affected":417024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ajc.com/news/state--regional/university-breach-risks-health-personal-information-417-000/nPuUSV8qqvQXTQjY0ML8wN/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.augustachronicle.com/news/20180816/personal-health-information-compromised-in-cybersecurity-incidents-at-augusta-university"}],"summary":"A breach of email accounts at Augusta University Health may have exposed sensitive health and personal information of about 417,000 people, including patients around Georgia, the university reported Thursday.  Those at risk are primarily patients of Augusta University Health, inc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62f29e5c89723c2da6a9cb1ec2c475aa45c1a6c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"834d95c0-d9d9-11e7-be42-df02fe7390b5"},"incident_date":"2017-09-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a31fae9e6791","org_name":"St. Paul's Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatchewan/saskatoon-health-patient-information-breach-fax-1.4382203"}],"summary":"Privacy training urged for Saskatoon health workers after patient's test results faxed to computer store","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5cf353a8886be1bb0749fa0747ddb50b6998a01","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notice_3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69549fd66d80","org_name":"Home Point Financial Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101718"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/HomePointFinancialCorporation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-08","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a1993dc481086531a1c185ce9345773327f0b3c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHS%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"be3cf22bf56c","org_name":"Cohn Handler Sturm","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101725"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHS%20Notification_0.pdf"}],"summary":"A partner’s stolen cell phone had access to a work email account containing potentially sensitive client information.","supporting_quote":"On July 29, 2017, a partner’s pin protected cell phone was stolen from his person.","technology_involved":["cell phone","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-07","discovered_date":"2017-08-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"489e694d128b72d8e96e9120ab3adc5104087b96","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SRI%20International%20-%20General%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b4f06977ecbd","org_name":"SRI International","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101687"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SRI%20International%20-%20General%20Notice_0.pdf"}],"summary":"SRI reported that unauthorized parties targeted and improperly accessed internal systems, and personal information may have been accessed.","supporting_quote":null,"technology_involved":["internal SRI fileserver","Identity and Access Management (IAM) Systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-07","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1fbdea26caec07dac399ba1744dcb56193555a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"7620f95be943","org_name":"Sixty Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101684"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20notice_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information in Sabre’s CRS for reservations that included Sixty Hotels.","supporting_quote":null,"technology_involved":["Sabre CRS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7be53906eb201d1e8838195da3d43002d965e68","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa8e89d0-bd9d-11e7-822d-6d41de439a88"},"incident_date":"2017-09-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af7e96659352","org_name":"Seven Peaks School","org_type":"education","ransomware":null,"records_affected":5912,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvz.com/news/lawsuit-alleges-ex-principal-accessed-private-information/627230997"}],"summary":"Lawsuit alleges ex-principal accessed private information - Seven Peaks School","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-06","discovered_date":"2017-08-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eca2658f5f5ccb6b31943704cc192f264c693e31","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%28Final%209-6-17%29_0.pdf"},"notes":null,"org_country":"US","org_id":"68832d87d3b7","org_name":"City of Oceanside","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101661"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20%28Final%209-6-17%29_0.pdf"}],"summary":"The City of Oceanside reported that malicious code infiltrated its online payment system, potentially exposing customers’ names, billing addresses, and credit card information.","supporting_quote":null,"technology_involved":["online payment system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3ed69bf257a9bd13857f0435469b7e51034804d6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AdvancedFinancialServicesInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"44cf1600d522","org_name":"Advanced Financial Services, Inc. & Accu-Pay Payroll and Bookkeeping Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AdvancedFinancialServicesInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b6121b9e6fd09569a20f8ecfcf77253c5829c44","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63507400-e2e3-11e7-a8b4-b50015373b0a"},"incident_date":"2017-09-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab15836f9aa6","org_name":"East Central Kansas Area Agency on Aging","org_type":"government","ransomware":true,"records_affected":8750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/aging-agency-reports-ransomware-attack-8750-patients-impacted/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ottawaherald.com/news/20171102/agencys-data-remains-uncompromised-after-computer-breach"}],"summary":"The Ottawa-based East Central Kansas Area Agency on Aging (ECKAAA) has experienced a ransomware attack that has resulted in the encryption of files on one of the agency’s servers. Those files contained the protected health information (PHI) of 8,750 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec482622ab106a1573af4ab0c99228623e5846f3","impact_type":"unknown","incident_date":"2017-07-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/201708281102_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cefd506ec2c","org_name":"CBS Consolidated Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101593"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#CBS%20Consolidated%2C%20Inc.-2017-09-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bd70c5d34754d3da0bf1baca85e2aefe6df42d5","impact_type":"data_theft","imported_from":null,"incident_date":"2017-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CZ","org_id":"056e55068b12","org_name":"MALL.cz","org_type":"retail_ecommerce","ransomware":null,"records_affected":735405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MALL.cz","type":"hibp","url":"https://haveibeenpwned.com/Breach/MallCZ"}],"summary":"MALL.cz suffered a data breach in July 2017, and account data including email addresses, names, phone numbers, and passwords was later posted online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23cebed687c6a2c3961ef628ce7ee0e0f91fb648","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7030c320-c950-11e7-aa33-c3c39d564c9a"},"incident_date":"2017-09-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b91d3c0aeb6","org_name":"Brevard Physician Associates","org_type":"healthcare","ransomware":null,"records_affected":7967,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/computer-theft-raises-health-data-security-concerns-for-8k"}],"summary":"Computer Theft Raises Health Data Security Concerns for 8K","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1497dc0501752acb72b209cc70ea22c80426e9b6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56a75d70-994d-11e7-a069-d9175a67bd3e"},"incident_date":"2017-09-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ae2833e46104","org_name":"Canoe.ca","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://rdnewsnow.com/article/551765/news-and-entertainment-website-canoeca-says-data-one-million-users-hacked"}],"summary":"Notice of Canoe.ca data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"574739b1e189421191e033e816c3b01407468392","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"889a8550-e218-11e7-a8b4-b50015373b0a"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"20942efb3305","org_name":"Western State Hospital","org_type":"healthcare","ransomware":null,"records_affected":515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://q13fox.com/2017/11/16/western-state-hospital-patient-information-sent-to-wrong-email-address/"}],"summary":"The Department of Social and Health Services’ Behavioral Health Administration confirmed Thursday that a spreadsheet containing private information of 515 patients at Western State Hospital was sent to an incorrect email address.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6483ec5092a01b73b74553f54d217cf3beed234b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2eb79620-a782-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43c7fdfb096a","org_name":"Valero Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.khou.com/news/crime/card-skimming-devices-found-on-pasadena-gas-pumps-police-say/477595387"}],"summary":"Card-skimming devices found on Pasadena gas pumps, police say - Valero","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb3b8ba4b1e428ede94fb29c6718262a3b97523a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60e18700-a9e4-11e7-8c20-836b8b691ede"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d46a3621c871","org_name":"Valero","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kron4.com/2017/09/21/illegal-credit-card-skimmers-found-at-antioch-gas-pumps/"}],"summary":"Illegal credit card skimmers found at Antioch gas pumps - Valero","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ab57734fd01b9d427c13f3582103f74432845bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ee85d340-c59b-11e7-8053-ff1e84d2b694"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91ec2ef4b944","org_name":"University of Pittsburgh Medical Center's Bedford Memorial hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/to-your-health/wp/2017/09/15/hospital-staffers-took-photos-of-a-patients-genitals-and-the-foreign-object-lodged-there/"}],"summary":"Hospital staffers took photos of a patient’s genitals — and the foreign object lodged there","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e64009b01531332fe9d305c1e14bb963cf78e02a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05196ad0-a77a-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9bbef9c42bf","org_name":"Tiger Stop Blue Water Gas Statoin","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.islandpacket.com/news/local/crime/article175873281.html"}],"summary":"Get gas at the Hilton Head exit off I-95 lately? You may have been ‘skimmed’ at the pump - Tiger Stop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a38d3615e44f7dd004aad6dcf54752790c36514d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1f0bdd0-be61-11e7-ada5-4196de8cadbf"},"incident_date":"2017-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8f5940acb88","org_name":"SVR Tracking","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/tech-and-science/technology/data-from-540-thousand-vehicle-tracking-devices-leaked-online/article/503203"}],"summary":"Passwords to Over a Half Million Car Tracking Devices Leaked Online - SVR Tracking","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eabfea35fd2fa85c7fd7c6714c3f2e700b7b46c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d073dd80-a786-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5280695f41b","org_name":"SunTrust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox13news.com/news/local-news/skimming-devices-found-at-ybor-city-suntrust-bank-atms"}],"summary":"Skimming devices found at Ybor City SunTrust Bank ATMs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c16002010f2799a116c8b626d7986c063475fc9b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39805260-a776-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38165ec6fad5","org_name":"Stop and Shop Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcra.com/article/thieves-target-east-sacramento-gas-station-install-card-skimmers/12504735"}],"summary":"Thieves target East Sacramento gas station, install card skimmers - Stop and Shop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47c5b9b5e4bd945f0fbd5dacde4b9b44eba82489","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0af52090-d63f-11e7-af4f-6b5d4514198e"},"incident_date":"2017-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9a4f4791bd9","org_name":"Sports Medicine & Rehabilitation Therapy","org_type":"healthcare","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/7000-patients-extortion-attempt-sports-medicine-provider/"}],"summary":"Massachusetts-based Sports Medicine & Rehabilitation Therapy (SMART) has alerted 7,000 patients to a breach of their protected health information. Potentially, the breach impacted all patients whose information was recorded during a visit to a SMART center prior to December 31, 2","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36397ecf344d72b835a0b6b52034fb953b0daee9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"413f2aa0-b34a-11e7-9a94-230655e65ca5"},"incident_date":"2017-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"58caafb4a2b9","org_name":"Splendora ISD","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.khou.com/news/education/cyber-attack-targets-splendora-isd-students/479699389"}],"summary":"Cyber attack targets Splendora ISD students","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc134b6f2adc8345f787c2b5128a6215f7636b76","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c00be5f0-ad34-11e8-9e5a-c1f99505e93a"},"incident_date":"2017-09-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea28303f1616","org_name":"Spartanburg (SC) County Public Libraries","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.goupstate.com/news/20180130/spartanburg-public-library-computer-system-hit-by-ransomware"}],"summary":"Users of Spartanburg County Public Libraries were unable to check out or return books for a second day Tuesday after a ransomware attack sent out by cybercriminals shut down the library system’s computer network and website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a667daae9cbe8cc6d1f59496f99cdd9429bbfcd","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10451870-c0a5-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53123481ffb1","org_name":"Sonic Drive-in","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.com/sonic-hack-restaurant-confirms-malware-stole-customer-credit-cards-2597810"}],"summary":"Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeec5630554f88e881acde176e618fe92ff83c6a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32164c10-db78-11e7-b589-fd57f91024a3"},"incident_date":"2017-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"7cfdb33e7d4d","org_name":"Royal Adelaide Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.adelaidenow.com.au/news/south-australia/security-breach-feared-after-private-patient-records-found-outside-old-royal-adelaide-hospital/news-story/a2647feb523acd9c33e2ba20f8038443"}],"summary":"Documents were left on loading dock","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57c6fd35848a8f5d900adc9c5118832f6dcc72c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40129740-a9e3-11e7-8c20-836b8b691ede"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"549744b2cc99","org_name":"Pro Move","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/local/north-fulton-county/apartment-placement-company-worker-accused-of-stealing-customers-identity/616940750"}],"summary":"Apartment placement company worker accused of stealing customer's identity - ProMove","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4557cfeb9a5e5502a73325b6b42708fab818c1c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d10a8e80-a2c0-11e7-a67b-81fbdaca3f85"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb20810f30ba","org_name":"Pop Shoppe","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbtv.com/story/36384847/more-charges-in-gas-pump-skimmer-scam"}],"summary":"More charges in gas pump skimmer scam - Pop Shoppe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a14ce5ba933cb99bf15ce6982fc0949e603447db","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"efb46700-d909-11e7-be42-df02fe7390b5"},"incident_date":"2017-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1533f2db008a","org_name":"Pentagon","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc15.com/news/national/pentagon-exposed-some-of-its-data-on-amazon-server"}],"summary":"Pentagon exposed some of its data on Amazon server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bf8811d79060423eda1b389fb28cd051d7962bc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16f2c760-9c6c-11e7-8eb8-67f320c42447"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4b493c93602","org_name":"Penn Jersey Convenience Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lehighvalleylive.com/easton/index.ssf/2017/09/skimming_device_found_on_gas_p.html"}],"summary":"Skimming device found on gas pump in Wilson Borough - Penn Jersey Convenience Store","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c191a95d65d4bca0524931d13b7e92a1faced1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"efd6f200-1fac-11ec-82c4-4d3486f21395"},"incident_date":"2017-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"802cd068fb40","org_name":"Ministry of National Defense","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.chicagotribune.com/nation-world/ct-north-korea-hack-war-plans-20171010-story.html"}],"summary":"Report: North Korean Hackers Stole War Plans","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d80bb794c3fee9ffd3028f328260da45cfc2e47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8eb1d360-a2d2-11e7-a67b-81fbdaca3f85"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"845b49454f10","org_name":"Medical Council of India (MCI)","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://economictimes.indiatimes.com/news/politics-and-nation/cbi-books-army-medical-corps-mci-officials-for-leaking-information/articleshow/60730506.cms"}],"summary":"CBI books Army Medical Corps, MCI officials for leaking information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5a651468a2a568c9e293b59eef6c37baee0a40c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f7eaed0-9a1d-11e7-9c6e-153653ac7780"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"796b1dd4b6e1","org_name":"MainSource Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/2017/09/13/atm_cardskimming_device_found_at_columbus_bank/"}],"summary":"ATM card-skimming device found at Columbus bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a485da827c755417c4ca1555e13cb532d30c24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a965a6b0-0938-11e8-bbae-ed39c73f1398"},"incident_date":"2017-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b84c5746478","org_name":"Instagram","org_type":"technology_saas","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=11914660;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theverge.com/2017/8/30/16229198/instagram-hack-api-bug-selena-gomez-justin-bieber;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbaltv.com/article/up-to-6-million-accounts-on-popular-photo-sharing-app-possibly-leaked/12167625;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberscoop.com/instagram-data-breach-hacker-6m-accounts/"}],"summary":"Instagram said Friday it is continuing to investigate a data breach linked to a flaw in its application programing interface that exposed user names, phone numbers and email addresses — but not passwords.  A hacker claims to have stolen data from 6 million accounts, and is offeri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-09-01","discovered_date":"2017-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ee6bea2b0dd9b7aba3189de9794f5b9ee97cc2c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HRS%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"590bfae55530","org_name":"Hand & Upper Extremity Centers dba Hand Rehabilitation Specialists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101589"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HRS%20Notification_0.pdf"}],"summary":"The organization reported a possible security breach, but law enforcement found no evidence that information had left its system and unauthorized access could not be ruled out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dd2aeba7484c17dbc58a2d53f8998326db08329","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95e96870-c0a8-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3fb15f4743fd","org_name":"Graton Resort and Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressdemocrat.com/news/7478449-181/graton-casino-data-breach-potentially?artslide=0"}],"summary":"Graton casino ‘data breach’ potentially reveals some patrons’ Social Security numbers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86fdf16e9b4880185e0eaa53ccbae0c21276cf0a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"504548b0-d96d-11e7-8b17-fdfed30923dd"},"incident_date":"2017-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9202039795b","org_name":"Garden Estates of Temple","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tdtnews.com/news/article_cf06586e-99d6-11e7-8d83-0feecce1597c.html"}],"summary":"Care worker stole a credit card.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5a1462f974f396f48771a5039e0d0f32053bdc7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8bce88f0-af5c-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e9240b2b77a","org_name":"Fauquier gas stations","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.insidenova.com/news/crime_police/latest-skimming-devices-found-at-two-fauquier-gas-stations/article_5643668e-a394-11e7-8558-87d0e0c2ce9d.html"}],"summary":"Latest skimming devices found at two Fauquier gas stations - WI-Not Stop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f05b1e357f37872702c721edf96318203b4ff959","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ff9eaea0-a2d6-11e7-a67b-81fbdaca3f85"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"8147d8d65f11","org_name":"Ele.me","org_type":"other","ransomware":null,"records_affected":65000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shanghaidaily.com/metro/society/Eleme-worker-leaked-colleagues-data/shdaily.shtml"}],"summary":"AN IT worker of ele.me has been detained for leaking data of over 65,000 employees.  Police said yesterday that the suspect, a man surnamed Xiang, claimed that he did so because the company was being “unfair” to him. Xiang was working as a senior research and development engineer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e44728df21fe2d819dae72d7a7a90414fc2d9a07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14e98e00-da32-11e7-a58f-dff506a792fb"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f463328be6a7","org_name":"E.T. Carmichael","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nugget.ca/2017/09/20/privacy-breach-at-north-bays-et-carmichael"}],"summary":"Misdelivery of paper documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f261c716521bc3cbc76aa940f3441b7b75f55661","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4546c3a0-b35f-11e7-ab44-150a764d3763"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe698dcbfeb2","org_name":"City of Yellowknife","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/city-of-yellowknife-data-breach-1.4352499"}],"summary":"Data breach leads to leak of City of Yellowknife staff emails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fb9b3aff40f29b4425fdcb99970b80dfc06caa7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01b2f600-a9e5-11e7-8c20-836b8b691ede"},"incident_date":"2017-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f2ddbbd56ed","org_name":"City of Ferndale","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://oaklandcounty115.com/2017/09/27/city-of-ferndale-temp-employee-accused-of-credit-card-theft/"}],"summary":"Ferndale temp worker charged with credit card thefts at city hall - Ferndale City Hall","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08a3d2e2261d1d199ddf07d03da2ad9976c0bf68","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"735628f0-a778-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8ee2de54763","org_name":"Chuckles Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mywabashvalley.com/news/credit-card-skimmers-found-at-loogootee-business/812043658"}],"summary":"At 3:12 PM Thursday, Trooper Adam Mcbeth responded to the Chuckles Gas Station on Broadway Street in Loogootee. Employees reported that two skimming devices had been removed from their gas pumps.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Fin7","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f3ba306368e723355c58b3e79c490518b602d4b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44effb40-d0bb-11e8-bbbb-67b2993a8980"},"incident_date":"2017-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"988c0e30c7a8","org_name":"Burgerville","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/burgerville-customer-credit-card-info-stolen-in-data-breach-laid-at-fin7s-feet/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://pdx.eater.com/2018/10/4/17936608/burgerville-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wweek.com/news/2018/10/03/class-action-lawsuit-filed-against-pacific-northwest-burgerville-chain-for-possible-data-breach-damages/"}],"summary":"Burgerville has revealed a data breach impacting the chain which may have led to the theft of detailed credit card information belonging to customers.  Malware was installed on Burgerville systems in order to scrape and steal customer data. Burgerville says that customer credit a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"fin7"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cf859362183db2b6a7b55ee8615818ff01c6b73","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"940162d0-997d-11e7-b039-d34ad5cfc38b"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6606df6ea06c","org_name":"BP Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox45now.com/news/local/credit-card-skimming-device-found-at-a-phillipsburg-gas-station"}],"summary":"Credit card skimming device found at a Phillipsburg gas station - BP","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14c9005437cba67caf13fb5f0109695dc2cb2ed2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d1e3ddb0-a785-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"6fc7dc6e5733","org_name":"BNI Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://coconuts.co/bali/news/2-bulgarians-arrested-bali-using-skimmer-atm-lovina/"}],"summary":"Bali ATM skimming: 2 Bulgarians caught red-handed in Lovina - BNI Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"287ac1c7c2940e90b05491439204a42658935c9e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"498b98a0-a085-11e8-899a-23ad2f84ca7d"},"incident_date":"2017-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"5f0fe286e3f4","org_name":"Biletix","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dailysabah.com/technology/2018/06/29/online-ticket-seller-biletix-posts-data-theft"}],"summary":"Turkey's largest online ticket sales and distribution company Biletix announced yesterday that third parties accessed the personal data and payment information of some of its customers and that they are trying to take precautions in this regard. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c739b271fbf085db42210ee0c328d607742fa956","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4d56f60-af61-11e7-b9af-6daebc71dd3b"},"incident_date":"2017-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6c7e450afe9","org_name":"Bay Sleep Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/exclusive-bay-sleep-clinic-patients-were-viewable-online-during-sleep-studies/"}],"summary":"Bay Sleep Clinic patients were viewable online during sleep studies","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23a736aeecfdee3173322d3f45684d6d6240a57c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ff12a630-af56-11e7-b9af-6daebc71dd3b"},"incident_date":"2017-09-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca9fdecab596","org_name":"AU Medical Center","org_type":"education","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/augusta-university-medical-center-phishing-attack-8971/"}],"summary":"5 Months to Notify Patients of Augusta University Medical Center Phishing Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0660a5e323a5be4bf2523def55c482a399cc8de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"675e9fc0-a77b-11e7-ae18-bd2df8850f54"},"incident_date":"2017-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"599c21c20a8f","org_name":"Amsterdam Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dailygazette.com/article/2017/09/27/skimming-devices-found-on-montgomery-county-gas-pumps"}],"summary":"Skimming devices found on Montgomery County gas pumps - Mobil","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ff76611837f765ed777e4a2f2c6c4792e2f3fcd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4a7bf130-94a9-11e7-9340-f70be1ebf87c"},"incident_date":"2017-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7a16febc518","org_name":"Amazon","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sec.gov/news/press-release/2017-160"}],"summary":"The Securities and Exchange Commission today announced insider trading charges against a former Amazon financial analyst who allegedly leaked confidential information to his former fraternity brother in advance of a company earnings announcement so they could turn an illegal prof","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-09-01","discovered_date":"2017-07-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3057e519b32e83c01499f85840cf12934599262c","impact_type":"data_theft","incident_date":"2016-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Akira%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"90890fa26c9e","org_name":"Akira","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101562"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Akira%20-%20Notice%20of%20Data%20Event%20-%20CA%20-%20Exhibit%201_0.pdf"}],"summary":"Malicious code on Akira’s website collected payment information, which may have been accessed from November 2016 through July 2017.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-31","discovered_date":"2017-07-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1d884d6fb6e4072832996292f945d9144233880d","impact_type":"data_theft","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9734.pdf"},"notes":null,"org_country":"US","org_id":"e65d34201bfd","org_name":"Timberland Bank","org_type":"financial","ransomware":null,"records_affected":5688,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9734.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9734.pdf"}],"summary":"Timberland Bank reported that courier bags containing loan files and paper checks were stolen while in transit between branches.","supporting_quote":"On July 18, 2017, Timberland learned that courier bags containing loan files and paper checks processed by Timberland had been stolen from the company that provides Timberland’s courier services during transit between Timberland branches.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13713d0da6aee8dda8130f7fccde13a745f3280f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter.Final_._0.pdf"},"notes":null,"org_country":"US","org_id":"505d85b3913c","org_name":"Kaiser Foundation Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter.Final_._0.pdf"}],"summary":"Kaiser Foundation Health Plan reported that a document containing protected health information was inadvertently emailed to an external address.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81182a28139be7754ce18fed9bf15badd7f79b2e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d10975b0-bd9e-11e7-822d-6d41de439a88"},"incident_date":"2017-08-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1eb0e21315a","org_name":"Viacom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bgr.com/2017/09/19/viacom-data-leak-security-firm-upguard/"}],"summary":"Media giant Viacom dodges bullet over massive security breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-30","discovered_date":"2017-07-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3949a5a4dd2ad13ed3d56a3e2b4f8ace0c5be8e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"ad4eac1546ef","org_name":"Mr. Cooper","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101498"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Template_0.pdf"}],"summary":"Mr. Cooper discovered that a borrower’s loan number and property address were inadvertently included in another borrower’s letter.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1463505fc87c967439ef3e71e910131b86212d2e","impact_type":"unknown","incident_date":"2017-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cde97fbbb365","org_name":"Wells Fargo Advisors","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101468"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102177"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-29","discovered_date":"2017-08-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7481b08f15e2915076d6b20bb7eb1ce794960e14","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-17","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DRAFT%20-%20General%20Client%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Call center personnel were deceived by social engineering using the agents’ nonpublic personal information, allowing their credentials to be reset.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101464"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DRAFT%20-%20General%20Client%20notification_0.pdf"}],"summary":"A perpetrator impersonated two MassMutual agents to reset their credentials and access business systems containing clients’ personal information.","supporting_quote":"through social engineering tactics, was able to provide such information to the call center personnel to successfully authenticate as the respective agents","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ac72c86729ab7697e60a15b83de0dbd57e3382c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dc32d060-9a23-11e7-9c6e-153653ac7780"},"incident_date":"2017-08-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d747a6a5189","org_name":"Marathon Gas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisweeknews.com/news/20170901/credit-card-skimmer-found-at-worthington-gas-station"}],"summary":"A credit-card “skimming” device was found at a gas station in Worthington, according to a release from the city.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-29","discovered_date":"2017-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd43d331fb6abb17a54a4f2eb8af76f20e6caf0b","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-07-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20CLCR%20Cnsmr%20Notification%20Lttr%20-%20AllClearID%20Identity%20Protection%20Service_0.pdf"},"notes":null,"org_country":"US","org_id":"db0801dc5f1a","org_name":"CoreLogic Credco","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20CLCR%20Cnsmr%20Notification%20Lttr%20-%20AllClearID%20Identity%20Protection%20Service_0.pdf"}],"summary":"An individual accessed CoreLogic Credco’s system without authorization and obtained access to consumer credit-report information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-08-29","discovered_date":"2017-07-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d4116c0e051f63cb95e2464b1b95555ac629d066","impact_type":"unknown","incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"06eae5481df9","org_name":"Bright Wood Corporation","org_type":"unknown","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bright%20Wood%20Corporation-2017-08-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-28","discovered_date":"2017-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdebb0e8f214bf92045e28838ddde11c23adb817","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20ROOSEVELT%20PDF%20%28J2261079x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"89d1ec9da5df","org_name":"The Roosevelt Hotel New York","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101407"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20ROOSEVELT%20PDF%20%28J2261079x7AD79%29_0.pdf"}],"summary":"An unauthorized party accessed reservation pages and payment card and customer information in Sabre Hospitality Solutions’ central reservations system for hotel bookings.","supporting_quote":null,"technology_involved":["Sabre central reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-28","discovered_date":"2017-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb42ef289bdcd3edfd74ca8f7ea45cc92f337df","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20DOMAIN%20PDF%20%28J2261060x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"0287754629f4","org_name":"The Domain Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101403"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20DOMAIN%20PDF%20%28J2261060x7AD79%29_0.pdf"}],"summary":"An unauthorized party accessed reservation pages in Sabre’s central reservations system, exposing payment card and customer contact information for some Domain Hotel reservations.","supporting_quote":null,"technology_involved":["Sabre central reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-28","discovered_date":"2017-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43aca566c3cb01e6f944d33b7711d0d45f879433","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20BICYCLE%20PDF%20%28J2261063x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"585725b92702","org_name":"The Bicycle Casino Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101405"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHR%20SABRE%20GENERAL%20NOTIFICATION%20BICYCLE%20PDF%20%28J2261063x7AD79%29_0.pdf"}],"summary":"An unauthorized party accessed payment card and customer information in Sabre’s central reservations system for hotel reservations.","supporting_quote":"Sabre informed us that an unauthorized party gained access to Sabre’s central reservations system.","technology_involved":["Sabre central reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2017-08-25","discovered_date":"2017-08-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2981968922b08ef61263608eaf0344ab3bbd850","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Zymo%20Research%20Ad%20CA-WY%20r4fin_0.pdf"},"notes":null,"org_country":"US","org_id":"c846f00be15f","org_name":"Zymo Research Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101370"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Zymo%20Research%20Ad%20CA-WY%20r4fin_0.pdf"}],"summary":"Zymo Research Corporation reported unauthorized access to a database containing customers’ personal, password, and credit card information.","supporting_quote":null,"technology_involved":["cloud e-commerce system","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1110"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50c3727d1334833367134a09ae6a5bf7f12e55d5","impact_type":"unknown","incident_date":"2017-07-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1110","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Zazzle%20-%20Individual%20Notice%20-%20CA_20170825_0.pdf"},"notes":null,"org_country":"US","org_id":"1e5f6914c08f","org_name":"Zazzle Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Credentials may have been obtained through breaches of other websites and tried on Zazzle.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101384"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Zazzle%20-%20Individual%20Notice%20-%20CA_20170825_0.pdf"}],"summary":"Zazzle reported unauthorized attempts to log in to accounts using credentials that may have been obtained from breaches of other websites.","supporting_quote":"Given the nature of the incident, Zazzle believes that your username (email address) and password may have been obtained by an unauthorized third party, through a breach of other website(s), who then tried to confirm your credentials on our site.","technology_involved":["Zazzle accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30346a0c219f452135b0f58e123901c590ffe9be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5cb52b10-9980-11e7-b039-d34ad5cfc38b"},"incident_date":"2017-08-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a583e7a41b78","org_name":"Verdian Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wcfcourier.com/news/local/crime-and-courts/camera-footage-released-in-atm-skimmer-investigation/article_f28426ca-564f-5a41-9d09-6c29b2a222cc.html"}],"summary":"Camera footage released in ATM skimmer investigation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94b8779fc4118c4dc524df5b6e6da1a12f77e9d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6aa843a0-9a21-11e7-9c6e-153653ac7780"},"incident_date":"2017-08-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3d60dd45945","org_name":"Sun Trust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.aroundosceola.com/police-searching-for-possible-witness-in-skimming-device-case/"}],"summary":"Police searching for possible witness in skimming device case - SunTrust Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-08-25","discovered_date":"2017-02-06","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af0c895cf2e9a2125661e4f1caed0c3c25393d52","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OPP%20Redacted%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"02085edca4e9","org_name":"Sharp Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OPP%20Redacted%20Letter_0.pdf"}],"summary":"Sharp Memorial Hospital reported that a computer and external memory device containing or potentially containing patient information were missing from a secure storage area.","supporting_quote":"On February 6, 2017, we discovered that a computer and an external memory device were missing from a secure storage area.","technology_involved":["computer","external memory device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-25","discovered_date":"2017-07-27","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8f986c364ef4839c1f9bc6bdec4dfc0d5a471ac","impact_type":"data_theft","incident_date":"2017-07-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Noto%20Final%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"4ae712a6c689","org_name":"Franklin R. Noto, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Noto%20Final%20letter_0.pdf"}],"summary":"A burglar broke into Franklin R. Noto, CPA’s office and stole devices containing password-protected accounting software and personal information.","supporting_quote":"On July 27, 2017, a burglar broke into our locked office.","technology_involved":["accounting software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-24","discovered_date":"2017-08-15","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c2081560d1fd205de15ccadfdc028e7ab1724168","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-12-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9733.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"89b3cf04e7e6","org_name":"Green River Community College","org_type":"education","ransomware":null,"records_affected":3399,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9733.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9733.pdf"}],"summary":"Green River Community College reported that a thumbdrive containing employee information, including Social Security numbers, was mislaid after a spreadsheet was downloaded to it.","supporting_quote":"At some point, the thumbdrive was mislaid and returned to Campus Safety.","technology_involved":["employee computer","thumbdrive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8a4313f78fab921392517a2fb4513bfdffa9c55","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a70d7f0-c951-11e7-aa33-c3c39d564c9a"},"incident_date":"2017-10-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytribune.com/general-news/20171109/clawson-police-warn-of-illegal-card-skimming-device-found-on-atm-at-cvs-store"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonblade.com/2017/08/30/cvs-caremark-exposes-patients/"}],"summary":"Clawson police warn of illegal card skimming' device found on ATM at CVS store","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-24","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f41d3c59e21279b38e5dbeb0e8c5efd79c49c1b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aimbridge%20II%20-Notice%20Only%20%20_0_0.pdf"},"notes":null,"org_country":"US","org_id":"6fd61df9be74","org_name":"Aimbridge Hospitality Holdings LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101324"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aimbridge%20II%20-Notice%20Only%20%20_0_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information processed through Sabre’s SynXis Central Reservations system.","supporting_quote":"Sabre notified us on or about June 6, 2017 that an unauthorized party gained access to account credentials that permitted unauthorized access to unencrypted payment card information, as well as certain reservation information, for a subset of hotel reservations processed through the CRS.","technology_involved":["Sabre SynXis CRS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c911393611f4854affd7fa9bc23ab8bef1c54882","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00886e80-9a28-11e7-9c6e-153653ac7780"},"incident_date":"2017-08-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0daa48d7cbfd","org_name":"Sunoco Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox29.com/news/274719803-story"}],"summary":"Skimming device found at Spring Garden gas station - Sunoco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-08-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6b23a018a5db9dd4e70e344e11bfdbd14399251","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8bd20230-d91b-11e7-be42-df02fe7390b5"},"incident_date":"2017-08-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c860d82baa8c","org_name":"Jewson","org_type":"retail_ecommerce","ransomware":null,"records_affected":1659,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theinquirer.net/inquirer/news/3021084/youre-screwed-jewson-data-breach-exposes-details-of-almost-1-700-customers"}],"summary":"Jewson has warned customers that their financial details may have been exposed in a data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6074906a620165d65311872c62f5f54c4542ef80","impact_type":"data_theft","imported_from":null,"incident_date":"2016-12-02","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1bf2e985d56e","org_name":"Biohack.me","org_type":"other","ransomware":null,"records_affected":3402,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Biohack.me","type":"hibp","url":"https://haveibeenpwned.com/Breach/BiohackMe"}],"summary":"A breach of the Biohack.me forum exposed usernames, email addresses, hashed passwords, and private messages.","supporting_quote":null,"technology_involved":["Biohack.me forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0defd188ba15f15acb7ea99a015349609a395027","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e6ff22d0-a186-11e8-a73d-8bf9996ed0ad"},"incident_date":"2017-08-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9146906c5613","org_name":"Rivers Casino","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://triblive.com/local/allegheny/13952701-74/lawsuit-alleges-casino-employees-snooped-on-text-messages-email-bank-info"}],"summary":"Employees at Rivers Casino zoomed in on the cell phones of two women on the casino floor, capturing text messages, emails and bank account information and sending it to one woman’s ex-husband and his attorney, lawsuits filed last week alleged.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebc9492f2d34dce4bb6a762b092d6db1df54e545","impact_type":"data_theft","imported_from":null,"incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0a3663a8d93e","org_name":"Bin Weevils","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bin Weevils","type":"hibp","url":"https://haveibeenpwned.com/Breach/BinWeevils"}],"summary":"Bin Weevils suffered a data breach in September 2014 involving email addresses, genders, ages, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-17","discovered_date":"2017-06-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8aad6dda075f08728e3cc379e681af3615a77c4d","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dutch%20-%20Notice%20only-%20CA%20-%20Exhibit%201_0_0.pdf"},"notes":null,"org_country":"US","org_id":"c36f55980921","org_name":"Dutch, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dutch%20-%20Notice%20only-%20CA%20-%20Exhibit%201_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Dutch%2C%20LLC-2017-08-17"}],"summary":"Dutch, LLC reported that malicious files on its e-commerce website could collect customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-16","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2785fcccd01adc2bd54386a981e0a0e69a157f27","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sabre%20Customer%20Letter%20-%20Revised_0.pdf"},"notes":null,"org_country":"US","org_id":"45f0ce0acf57","org_name":"South Coast Winery Resort & Spa and Carter Estate Winery Resort","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101137"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101480"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sabre%20Customer%20Letter%20-%20Revised_0.pdf"}],"summary":"Reservation and payment card information processed through Sabre’s system for the resorts was accessed, though the investigation found no evidence it was removed.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26ef6da185ce7df305fa1938d2e2892748398999","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/5789_Native%20Footwear_Notice_US_0.pdf"},"notes":null,"org_country":"US","org_id":"dec26199f80f","org_name":"Native Canada Footwear","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101141"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/5789_Native%20Footwear_Notice_US_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Native%20Canada%20Footwear%20Ltd-2017-09-08"}],"summary":"Native Shoes reported that malware may have infected its website, potentially compromising payment and contact information for customers who purchased through the site.","supporting_quote":null,"technology_involved":["Native Shoes website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-16","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f418903245de7fc8fb05504d0115df97d7b70d4c","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_19.pdf"},"notes":null,"org_country":"US","org_id":"3e795364c6fe","org_name":"Denihan Hospitality","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101136"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_19.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for hotel reservations processed through Sabre’s CRS.","supporting_quote":null,"technology_involved":["SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b6fc13241a3b7c2aee9a74f3cb94c730a970572","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f2c6780-c954-11e7-aa33-c3c39d564c9a"},"incident_date":"2017-08-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46ea0a1d6ef7","org_name":"Home Care by Black Stone","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/home-care-by-black-stone-notifies-individuals-of-security-incident-300525428.html"}],"summary":"Home Care by Black Stone Notifies Individuals of Security Incident ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"78fa2d122eb6b5d75690c8d17bd716feca93872d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Wooster-AshlandRegionalCouncilofGovernments.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a7a09fae2e5c","org_name":"Wooster-Ashland Regional Council of Governments (WARCOG)","org_type":"unknown","ransomware":null,"records_affected":105,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Wooster-AshlandRegionalCouncilofGovernments.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3db6eda6829318a97bcf9d75469c5fe51ce64357","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Performant%20Notice%20to%20Individuals%20-%20CT%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"36313e162b89","org_name":"Performant Financial Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101052"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Performant%20Notice%20to%20Individuals%20-%20CT%20Data%20Breach_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Performant%20Financial%20Corporation-2017-08-14"}],"summary":"An unauthorized individual accessed a C&T network drive containing Performant’s 401K audit files, but it was not determined whether Performant’s files were accessed.","supporting_quote":null,"technology_involved":["network drive"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"C&T"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"a242bd0cc606","name":"C&T"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33a4754d5bd6fd1aadd0c05c1dbe5048ba3413e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e3165020-b416-11e7-9de8-4bde146bf807"},"incident_date":"2017-08-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"606299f9f454","org_name":"Namaste Health Care","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newstribune.com/news/local/story/2017/oct/14/security-breach-reported-at-ashland-clinic/695646/"}],"summary":"Ashland clinic notifies 1,600 patients after ransomware incident - Namaste Health Care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-11","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34090e50b113f2781c09ef40391f4b2fe197443d","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_18.pdf"},"notes":null,"org_country":"US","org_id":"80887b0ecfc8","org_name":"Pacifica Hotel Management, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101039"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_18.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some hotel reservations processed through the SynXis Central Reservations system using account credentials.","supporting_quote":"Sabre notified us on or about June 6, 2017 that an unauthorized party gained access to account credentials that permitted unauthorized access to unencrypted payment card information, as well as certain reservation information, for a subset of hotel reservations processed through the CRS.","technology_involved":["SynXis Central Reservations system (CRS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-11","discovered_date":"2017-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8af39a0d4f37edb26449b41067fc939c897bba20","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Forms_0.pdf"},"notes":null,"org_country":"US","org_id":"af12281a17e4","org_name":"Pacific Alliance Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101011"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Forms_0.pdf"}],"summary":"Pacific Alliance Medical Center reported that a cyber incident affected networked computer systems and may have compromised electronic files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b66f9b8ffb72aa6f60e97349970b8cb86a65a63c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61beb4e0-a2c3-11e7-a67b-81fbdaca3f85"},"incident_date":"2017-08-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"94f8d72a8a1c","org_name":"PeaceHealth Southwest Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.columbian.com/news/2017/sep/15/peacehealth-employee-accessed-patient-info-unnecessarily/?utm_content=buffer0a504&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer"}],"summary":"PeaceHealth employee accessed patient info unnecessarily - PeaceHealth Southwest Medical Center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e85a1f7add3e3f8cc93dd728be0d05c52c1a314","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4270ff0-bda4-11e7-822d-6d41de439a88"},"incident_date":"2017-08-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/cybersecurity/kaiser-permanente-notifies-600-members-of-data-breach-after-email-mix-up.html"}],"summary":"Kaiser Permanente says 600 Riverside area members affected by data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-08-07","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b91d6fa8533dd7c5c601bdec8bc4a1ef3a9ccaba","impact_type":"data_theft","incident_date":"2016-09-27","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHR%20HYATT%20CENTRIC%20LOOP%20CA%20NOTIFICATION%20FINAL%20%28J2253671x7AD79%29_0.pdf"},"notes":null,"org_country":"US","org_id":"e1f80fc54984","org_name":"Integrated Clark Monroe, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100854"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHR%20HYATT%20CENTRIC%20LOOP%20CA%20NOTIFICATION%20FINAL%20%28J2253671x7AD79%29_0.pdf"}],"summary":"Malware on the hotel’s front desk computer system captured guests’ payment card information intermittently from September 27, 2016 to April 28, 2017.","supporting_quote":"An unauthorized person installed malware on the Hotel’s front desk computer system designed to capture credit and debit card information.","technology_involved":["front desk computer system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"33e2e8d89b6c47e4f03067adcfbe252ba7e2495b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9731.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4cf0093f6319","org_name":"Silver Cloud Inns & Hotels","org_type":"unknown","ransomware":null,"records_affected":1382,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9731.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51a13f0b61761368c38a49ade105beda4d8de714","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af4949b0-80f8-11e7-8520-b5d4bef506ca"},"incident_date":"2017-08-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/new-york/bayside/police-searching-men-who-installed-skimming-devices-td-bank-police"}],"summary":"Police Searching For Men Who Installed Skimming Devices At TD Bank: Police","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7354dd51e69dd74b72842d4b9461ecb8d3d2c529","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e9a19260-df4f-11e7-98c9-5b20d709bc39"},"incident_date":"2017-08-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c043cdfa291","org_name":"Chase Brexton Health Care","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/chase-brexton-health-care-notifies-more-than-16000-patients-after-phishing-incident/"}],"summary":"Chase Brexton Health Care notifies more than 16,000 patients after phishing incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"RU","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a74181cf5ab531ad901d8573fa9e33e56bc87055","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7424a4a0-9963-11e7-a069-d9175a67bd3e"},"incident_date":"2017-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"92043b60145d","org_name":"World Anti-Doping Agency","org_type":"other","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreachtoday.com/hacker-group-releases-stolen-health-records-a-10223"}],"summary":"Hacker Group Releases Stolen Health Records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2874b39221669f504cd928ff10220f176dba76ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70824f10-ba69-11e7-92c6-3b362a3baf5b"},"incident_date":"2017-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ae8b4c1c2f8","org_name":"US National Wildfire Coordinating Group","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cointelegraph.com/news/ransomware-sneaked-onto-us-government-website-unclear-if-public-was-harmed"}],"summary":"Ransomware Sneaked Onto US Government Website, Unclear if Public Was Harmed - US National Wildfire Coordinating Group (NWCG)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"790ad0aceaffa61f5577f8c27d0fa4573275f928","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"823cd220-ba55-11e7-a4ec-c71ec2b9ee3a"},"incident_date":"2017-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c89647a447c","org_name":"Time Warner Cable","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-41147513"}],"summary":"Data breach hits four million Time Warner app users","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdb2124305645474668814f7d714bcdbd7f78399","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-08-01","initial_access":"unknown","notes":null,"org_country":"AR","org_id":"11ded595a069","org_name":"Taringa","org_type":"technology_saas","ransomware":null,"records_affected":27971100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Taringa","type":"hibp","url":"https://haveibeenpwned.com/Breach/Taringa"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/latin-american-social-media-giant-taringa-hacked-28m-accounts-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/28-million-users-breached-at/"}],"summary":"Taringa disclosed a breach dating to August 2017 that exposed usernames, email addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc58a7c66d3a2ccfba86b6ea237d988d9b06dde2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d0cdf40-8cc1-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c47cfc1ba931","org_name":"St. Mark’s Surgery Center, LLC","org_type":"healthcare","ransomware":true,"records_affected":33877,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/st.-marks-ransomware-attack-could-affect-33k-patients"}],"summary":"St. Mark's Surgery center says 34,000 patient records potentially breached","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"396d95bd54fc077e50857045829ab4bfe44d9dea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7dec58b0-80fa-11e7-8520-b5d4bef506ca"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d92fc312908","org_name":"Seminole County Public Schools","org_type":"education","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fl-gpas-mistakenly-sent-to-parents-students/"}],"summary":"GPAs mistakenly sent to parents, students - Seminole County Public Schools","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bba9f389eed89f31ccad4c64845fd1f22504a99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f5032310-8ccc-11e7-811e-83915e56fc98"},"incident_date":"2017-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a96814e2042e","org_name":"Penn Medicine","org_type":"healthcare","ransomware":null,"records_affected":48,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbsnews.com/news/pa-nurse-pleads-guilty-to-secretly-recording-female-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://people.com/crime/pennsylvania-nurse-filmed-naked-female-patients/"}],"summary":"A Pennsylvania nurse last week admitted to secretly filming multiple female patients, including a teenage girl, while they were undressed and in his care.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59fa8cfce7c6f98bcf2abf3f29a3c956613166d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a16640f0-842c-11e7-a921-2d695ce70b69"},"incident_date":"2017-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"091dcab1d838","org_name":"Par Pharmaceutical","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lifesciencesipreview.com/news/par-targets-former-employees-over-trade-secrets-2352"}],"summary":"Par Pharmaceutical has sued a pair of former employees who set up a rival company, accusing them of poaching staff to steal trade secrets.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"163fdad8259f591ed74bdfdc4c88983678b617b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a380aa10-8cbf-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"0e1eca2d2ff6","org_name":"North Island medical clinic","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.odt.co.nz/news/national/medical-clinic-breaches-1000-peoples-privacy"}],"summary":"About 1000 people's privacy was breached in an email sent out by a medical clinic.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc43d107f96b259045ab992d7f671c6518791813","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ea68a50-c0a9-11e7-89a5-cb2864f71ca2"},"incident_date":"2017-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb94b7185918","org_name":"Network Health","org_type":"financial","ransomware":null,"records_affected":51000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.postcrescent.com/story/news/2017/09/22/email-phishing-attack-hits-network-health-menasha/694589001/"}],"summary":"Email phishing attack hits Network Health in Menasha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8624f8cea7054059f9129a7442add3e43249b99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c576660-8ccb-11e7-811e-83915e56fc98"},"incident_date":"2017-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"40725581be65","org_name":"Narmada Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehitavada.com/Encyc/2017/8/8/First-case-of-data-theft-at-hospital.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://indiatoday.intoday.in/story/it-head-of-hospital-former-employee-booked-for-data-theft/1/1020758.html"}],"summary":"IT head of hospital, former employee booked for data theft - Narmada Hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2a97175607a320116eaa05850133d2f116745b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95219390-8cbe-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95b1bed42089","org_name":"Mt. Sinai Medical Center,","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/news/local/ATM-Skimmer-Found-in-Mt-Sinai-Medical-Center-Miami-Beach-Police-441037803.html"}],"summary":"ATM Skimmer Found in Mt. Sinai Medical Center: Miami Beach Police","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"568bb62422c462ae8f4a68938a4127287207e841","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6266220-be6a-11e7-ada5-4196de8cadbf"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"082234ecc898","org_name":"Mart Moble Stations","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.berkshireeagle.com/stories/pittsfield-police-probing-card-skimming-scam-after-illegal-devices-found-at-gas-stations,517962"}],"summary":"Card-skimming devices found at two Pittsfield gas stations - Lipton Energy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aeca1c9693dc7c63051299de031b4365283de54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f62baab0-0b56-11e8-985b-1119ad21cbad"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"008b1eece7f5","org_name":"Linn County Board of Supervisors","org_type":"government","ransomware":null,"records_affected":216000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcrg.com/content/news/I9-UPDATE-Linn-County-Auditor-gives-update-on--439519653.html"}],"summary":"Misdelivery of voter record data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6e8f2cf7d9e02d29c88677b7ec93961bb2ba401","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd1a38f0-de1a-11e9-b511-f75921c18742"},"incident_date":"2017-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"49c5ef762cc4","org_name":"Hanatour","org_type":"other","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://coinjournal.net/south-koreas-largest-travel-agency-breached-hacker-demands-bitcoin-payment/"}],"summary":"Last month, Hanatour, South Korea’s largest travel agency suffered a major security breach, as hackers stole the personal information of over one million users. According to local news publications, hackers have demanded that Hanatour pay a one-time ransom payment in Bitcoin but ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29f987747bda09a132f4db8b4cc6266e108ecb46","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f26b770-d9ad-11eb-96ea-fd8a03dbb673"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cded446ef84","org_name":"Golden 1 Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach%20080917_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101238"}],"summary":"Skimmer devices were placed at three different branches of Golden1 Credit Union","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2742727d0f944e876b4a91a56d59ebcd056cc3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15972f60-a198-11e7-9764-c7e1aa1637e1"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1c23a0ab54c6","org_name":"Dara Linn Cherry Orchard Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlands103.com/news-centre/x-ray-file-local-penneys-among-hse-data-breaches/"}],"summary":"In August, a HSE employee attempted to send a fax to Temple Street Hospital containing sensitive information relating to a minor in the care of Child and Adolescent Mental Health Services (CAMHS) at Dara Linn Cherry Orchard Hospital.  They entered the wrong number, however, and t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","medical"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94db40d68d7b26f7484029068f29c6c202678cda","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d5e4b890-8cc2-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"026998b442ba","org_name":"City of Hope","org_type":"healthcare","ransomware":null,"records_affected":3400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/3400-patients-phi-potentially-compromised-city-hope-phishing-attack-8919/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100824"}],"summary":"3,400 Patients’ PHI Potentially Compromised in City of Hope Phishing Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8315fc5a3957246da4d29eefa6683229b7754b42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"120f72d0-9982-11e7-b039-d34ad5cfc38b"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wmfd.com/news/single.asp?story=73443"}],"summary":"The Ashland Police Department and Ashland County Sheriff's Office say skimming devices were discovered at three Ashland area gas stations.  The skimming devices were uncovered at the Circle K stations at 1207 Claremont Avenue and 411 East Main Stree,t as well as the Easy Trip gas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19650be3733f6fb5fef7c1566ca5eceff631fc89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6452210-0939-11e8-bbae-ed39c73f1398"},"incident_date":"2017-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"50888a2c0229","org_name":"CeX","org_type":"retail_ecommerce","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/08/29/cex_servers_hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/data-of-two-million-users-stolen-in-cex-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://uk.webuy.com/guidance/"}],"summary":"Second-hand electronics dealership CeX says two million customers may have had their personal information swiped by hackers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"718c97a22daba89655c1b801056936f683d858c4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47cb7da0-1122-11ea-bd5f-71a8176be0a0"},"incident_date":"2017-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"afa19ed690e3","org_name":"Allied Irish Banks","org_type":"transportation_logistics","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.siliconrepublic.com/enterprise/aib-data-breach-galway,https://www.irishtimes.com/news/ireland/irish-news/aib-employee-loses-banking-details-of-500-customers-1.3218170"}],"summary":"AIB has confirmed a member of staff misplaced sensitive personal data relating to hundreds of its customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e2465723af76cacb961c55166fc21d0b1b60a45","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94308c20-80f2-11e7-8520-b5d4bef506ca"},"incident_date":"2017-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtop.com/fairfax-county/2017/08/police-say-atm-skimmers-rise-fairfax-county/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.insidenova.com/news/crime_police/prince_william/fraud-alert-skimming-devices-found-at-woodbridge-area-atms/article_08871de0-82a7-11e7-aaab-cfaaae232f07.html"}],"summary":"An ATM at a convenience store in the Alexandria section of Fairfax County, Virginia, is the latest that police have found fitted with a skimmer. Thieves use skimmers on ATMs and at gas pumps to steal bank card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-07-31","discovered_date":"2017-05-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49df229a599e28e90f26e4dccb41574a42c1c19f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCLA-SS%26IEO-notification-letter_0.pdf"},"notes":null,"org_country":"US","org_id":"e47821f9ff43","org_name":"UCLA Summer Sessions & International Education Office","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100724"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCLA-SS%26IEO-notification-letter_0.pdf"}],"summary":"An attacker gained unauthorized access to a UCLA Summer Sessions & International Education Office server containing student personal information, but the organization found no evidence that the information was accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fdf22028d1ff7f36a52a7f5f692cde1c7c0b392","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter_4.pdf"},"notes":null,"org_country":"US","org_id":"1f967e2b937b","org_name":"Delaware North Companies, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_4.pdf"}],"summary":"Delaware North Companies said guest reservation and payment card information held in Sabre’s reservation system was unlawfully accessed.","supporting_quote":null,"technology_involved":["Sabre reservation system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"259be3184cadcb1f37557c88c201591a2dd45413","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7866a3c0-e354-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78d712913684","org_name":"Advanced Spine & Pain Center","org_type":"healthcare","ransomware":null,"records_affected":8352,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/advanced-spine-pain-center-notifies-8362-patients-after-two-possibly-unrelated-incidents/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://advancedspineandpaincenter.com/newsroom/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Hacking incident exposes patient data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":["CVE-2017-5638"],"data_types":["personal"],"disclosed_date":"2017-07-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6bd03c660c722cd190d73e009a019646da41a93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"009b2f20-0b66-11e8-827c-bba53cbad290"},"incident_date":"2017-07-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee776572d10e","org_name":"Equifax","org_type":"other","ransomware":null,"records_affected":146693665,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnbc.com/2017/09/07/credit-reporting-firm-equifax-says-cybersecurity-incident-could-potentially-affect-143-million-us-consumers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.equifaxsecurity2017.com/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com/business/2017/09/19/equifax-says-100000-canadians-may-have-been-in-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.co.uk/article/equifax-credit-data-breach-uk-security;"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101693"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Equifax%20Inc.-2017-09-07"}],"summary":"Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. The Equifax hack exposed custo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2017-5638","kev_added":"2021-11-03","name":"Apache Struts Remote Code Execution Vulnerability","days_listed_before_incident":-1558,"product":"Apache Struts"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-28","discovered_date":"2017-05-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c94e94b4e0a7c6d530e531c23c7cfe6d31ddc7ec","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HydroFlask%20-%20Sample%20Customer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"a919a213bbd9","org_name":"Steel Technology LLC dba Hydro Flask","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HydroFlask%20-%20Sample%20Customer%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Steel%20Technology%20LLC%20dba%20Hydro%20Flask-2017-07-28"}],"summary":"Hydro Flask reported that personal information received during visits to its e-commerce website may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca83ace5bea82893997cc4b2de7f01fe08466cc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64328900-a92f-11e7-a3c5-dbae2580635b"},"incident_date":"2017-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2f0c9c01a9d1","org_name":"St Helens and Knowsley Teaching Hospitals NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.publictechnology.net/articles/news/probe-launched-leak-more-500-junior-doctors-personal-details"}],"summary":"St Helens and Knowsley Teaching Hospitals NHS Trust is investigating a data breach that caused the personal details of 500 trainee GPs to be leaked online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"212922727d37304dcc8ad912740cf03b31b0be2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Noble%20House%20-%20Consumer%20Notification%20Letter%20%28Non-Massachusetts%20residents%29_0.pdf"},"notes":null,"org_country":"US","org_id":"64297f85d8a3","org_name":"Noble House Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Noble%20House%20-%20Consumer%20Notification%20Letter%20%28Non-Massachusetts%20residents%29_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9730.pdf"}],"summary":"Reservation information for Noble House Hotels & Resorts may have been accessed without authorization through Sabre’s SynXis Central Reservations system.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-28","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"632bbfc9c12a0c459106fd95569f3db2bbcdeb5c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kimpton%20Hotels%20%26%20Restaurants%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"83b944ecd361","org_name":"Kimpton Hotels & Restaurants","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100657"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kimpton%20Hotels%20%26%20Restaurants%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"Unauthorized access to reservation information in Sabre’s system may have exposed payment card and contact information for Kimpton guests.","supporting_quote":"On June 6, 2017, Kimpton received notification from Sabre that information within Sabre’s system was accessed without authorization.","technology_involved":["Sabre reservation system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2017-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80a78fb60a7e52c340e49d5142d5a6ce647c2c32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c25682f0-b412-11e7-9de8-4bde146bf807"},"incident_date":"2017-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad3a6d098169","org_name":"Rivermend Health","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/rivermend-health-notifies-1300-after-employees-email-account-compromised/"}],"summary":" RiverMend Health notifies 1,300 after employee’s email account compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adb8bb7524f0ff37d4c012907ec15409cbc8781b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3206a8f0-7791-11e7-a457-a5a222e6d450"},"incident_date":"2017-07-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"22e47e03f4ef","org_name":"Mr. Parker","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://privacy.com.ph/news-article/irish-company-mr-parker-informs-customers-potential-data-breach/"}],"summary":"Irish Company Mr. Parker Informs Customers of Potential Data Breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9aff1e5f27c6639135260589c56a199b743a761","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82324bb0-7c58-11e7-8ec0-e369e9638092"},"incident_date":"2017-07-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccaa20a123b","org_name":"McDonald's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2017/07/28/queens-mcdonalds-atm-skimmer/"}],"summary":"ATM skimmer found in fast food restaurant","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-27","discovered_date":"2017-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94b903f72745d0f6eb62bd9a52556070386dbbaf","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hilderbrand%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"9ad6f56498e2","org_name":"Hilderbrand & Clark, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100608"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hilderbrand%20Notice_0.pdf"}],"summary":"Hilderbrand & Clark reported unauthorized access to its system from a foreign IP address, but could not determine which files were accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-27","discovered_date":"2017-06-29","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efa846646cbc9e62e08cfb622452468cd15a6f5f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HZ%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0f0d0958e3d4","org_name":"Hamilton Zanze & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HZ%20Notice_0.pdf"}],"summary":"A stolen work laptop may have contained client personal information, but the company reported no evidence that the information was accessed or used.","supporting_quote":"The employee’s work bag, including an HZ password protected laptop, was stolen.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e94ef16b936e208ab152bc189985d585e41b0f8","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_17.pdf"},"notes":null,"org_country":"US","org_id":"cc5437ee461e","org_name":"Woodside Hotels and Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100577"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_17.pdf"}],"summary":"An unauthorized party accessed reservation and payment card information processed for Woodside through Sabre’s reservation system.","supporting_quote":"Following a forensic investigation, Sabre notified us, by letter dated June 6th, that an unauthorized party gained access to their systems and was able to view some reservation information for a subset of hotel reservations that Sabre processed on behalf of Woodside.","technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-07-26","discovered_date":"2017-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5409aa09fdc4cc32f6764af318f38c4300f432d8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"ed67ba449d4e","org_name":"Virgin America","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100596"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20-%20California_0.pdf"}],"summary":"Virgin America identified unauthorized access to certain computer systems, and a third party may have accessed employee and contractor information, including corporate network login credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1b3413919efcdbd7848ed9929d7809244aeb49d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"005a1fa0-0171-11ea-9d67-277844cc3a60"},"incident_date":"2017-07-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ba092a882bef","org_name":"TSB Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.gazettelive.co.uk/news/teesside-news/another-atm-skimming-device-been-13389368"}],"summary":"atm skimmer at bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-26","discovered_date":"2017-05-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8426f71fc0570d64aae6aa531b8aab15cf55f0e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9729.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"963e1d2cebba","org_name":"Hydro Flask","org_type":"retail_ecommerce","ransomware":null,"records_affected":1780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9729.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9729.pdf"}],"summary":"Hydro Flask reported that personal information received during visits to its e-commerce website may have been compromised.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-26","discovered_date":"2017-06-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f395d7c60ba93dcb6aa447acd4b2636062cb3d8b","impact_type":"data_theft","incident_date":"2016-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9728.pdf"},"notes":null,"org_country":"US","org_id":"afe64a6396ee","org_name":"Al J. Schneider Company","org_type":"other","ransomware":null,"records_affected":791,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9728.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9728.pdf"}],"summary":"Al J. Schneider Company reported that malware on the Galt House Hotel payment card processing system copied guests’ payment card data.","supporting_quote":null,"technology_involved":["payment card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-07-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2590a5d990824f484d8686f1ddfb4566928e36c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f4197b0-da32-11e7-a58f-dff506a792fb"},"incident_date":"2017-07-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8c4126d0140","org_name":"Florida Healthy Kids Corporation","org_type":"financial","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/florida-healthy-kids-corporation-announces-2000-patients-impacted-phishing-scam-8974/"}],"summary":"Phishing for web mail credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-25","discovered_date":"2017-07-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9e5c2ab52570f998d4a04260449362fb495a6ac4","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9727.pdf"},"notes":null,"org_country":"US","org_id":"43ba7d1125ad","org_name":"City of Port Angeles","org_type":"government","ransomware":null,"records_affected":9400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9727.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9727.pdf"}],"summary":"The City received reports of possible credit card compromise affecting utility customers and began an investigation, but the letter does not confirm a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2017-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7d26669bd1d6494206a37624a06fc076cdf04c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"099857a0-e2e0-11e7-a8b4-b50015373b0a"},"incident_date":"2017-07-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5f3dd5bfac9","org_name":"Briggs Stratton Corporation","org_type":"manufacturing","ransomware":null,"records_affected":12789,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/lawnmower-engine-manufacturer-reports-hipaa-breach/"}],"summary":"the breach was a hacking/IT incident resulting a potential unauthorized disclosure of ePHI. Malware was discovered on its systems which potentially gave unauthorized individuals access to the system where ePHI was stored. Access to the system was possible between July 25 and July","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2017-07-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45fe73ad04b71099c4dba9c3a89ec5300cd9d3f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f972a80-b68a-11e8-b56a-011002460f8b"},"incident_date":"2017-07-24","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b52782d98d4c","org_name":"Tuskegee Univerisity","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA-%20Notice%20of%20Data%20Event%20Packet_0.pdf"}],"summary":"Phishing leads to email credential loss and reuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-24","discovered_date":"2017-04-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9e73e5b70f56e4efd2f3dacb75185886b00440a1","impact_type":"unknown","incident_date":"2016-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"59261edc92cb","org_name":"Island Hotel Company Limited","org_type":"unknown","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Island%20Hotel%20Company%20Limited-2017-07-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9bf0f81dc0c9de1e71a8c757b00ca2f666663922","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ApartmentManagementConsultantsLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f826e5c530a","org_name":"Apartment Management Consultants, LLC (AMC)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ApartmentManagementConsultantsLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8718b2f47dca6956b801631f49384ddf6dffcbc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3089ba80-b369-11e7-9de8-4bde146bf807"},"incident_date":"2017-07-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4f527a2b397e","org_name":"Natwest Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stratford-herald.com/73631-card-skimming-device-natwest-cash-machine-stratford-two-arrested-remanded-custody.html"}],"summary":"Card skimming device on Natwest cash machine in Stratford – two arrested and remanded in custody","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07f99704cd670794f78a78b772db7489e24100af","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-10-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5c50e0c38790","org_name":"MCBans","org_type":"technology_saas","ransomware":null,"records_affected":119948,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MCBans","type":"hibp","url":"https://haveibeenpwned.com/Breach/MCBans"}],"summary":"MCBans suffered a data breach in October 2016 that exposed user records containing email and IP addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-22","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d11302b5de80e78ad518614b817b7894c0334eae","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SBE%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f8b6d89e9d49","org_name":"SBE ENT Holdings, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100530"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SBE%20Consumer%20Notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9722.pdf"}],"summary":"SBE ENT Holdings said an unauthorized party accessed payment-card and reservation information processed and stored in Sabre’s SynXis central reservations system.","supporting_quote":null,"technology_involved":["Sabre SynXis CRS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-21","discovered_date":"2017-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"8b20b14a7b26496180e9d36bd2b08d28b9a8cdb2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9724.pdf"},"notes":null,"org_country":"US","org_id":"34af47574de6","org_name":"Value Eyecare Network, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Value%20Eyecare%20Network%2C%20Inc.%20d/b/a%2039DollarGlasses.com-2017-07-21"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9724.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ValueEyecareNetworkInc..pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100477"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/39DollarGlasses%20notice%20only_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9724.pdf"}],"summary":"Value Eyecare Network reported that an unknown individual may have accessed customer names, contact details, and payment card information used at its online store.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-21","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d38cf2dba3e35824c7079e67571358081fb93f5","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sandman%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"1255ee7b557d","org_name":"The Sandman Santa Rosa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100490"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sandman%20Notice_0.pdf"}],"summary":"An unauthorized party accessed reservation and payment card information in Sabre’s system for certain Sandman hotel reservations.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-21","discovered_date":"2017-06-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d38f51dac0e7a194484f32a2ecbd31214fff10e8","impact_type":"unknown","incident_date":"2016-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ecaa28390b6","org_name":"The Buckle, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Buckle%2C%20Inc-2017-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cea742167bcf7567b6488da7eae1a29dff57cacc","impact_type":"unknown","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"skipped","url":"https://oag.ca.gov/system/files/Sample%20Notice_15.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e83996650f3","org_name":"Sydell Partners","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100474"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"36892c8cd88c3805b0b5a2571bc4f21b3c604838","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/SunbeltRentalsInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d81e62338df5","org_name":"Sunbelt Rentals, Inc.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/SunbeltRentalsInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6869d3fdef94b799919135b5ae5a6e4fdc22c59","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_16.pdf"},"notes":null,"org_country":"US","org_id":"ac380a9f80fa","org_name":"Standard International Management LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100497"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_16.pdf"}],"summary":"An unauthorized party accessed reservation and payment card information in Sabre’s system for some hotel reservations processed on behalf of Standard.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-21","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef5ee88d2939fb4f6d0fab5ba053712b41bd47cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-03","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MC%20Customer%20Notification%20Letter_Website%20Version_7.20.17v2_0.pdf"},"notes":null,"org_country":"US","org_id":"84d88d196b16","org_name":"Pacific Hospitality Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100489"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MC%20Customer%20Notification%20Letter_Website%20Version_7.20.17v2_0.pdf"}],"summary":"Pacific Hospitality Group notified guests that an unauthorized party accessed payment card and reservation information processed through Sabre's SynXis CRS.","supporting_quote":null,"technology_involved":["Sabre SynXis CRS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d798aa196208bec512c098cfb564d0d3b90d6f90","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35d789f0-e1f3-11e7-8553-197c24c367d2"},"incident_date":"2017-07-21","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf84c9989cad","org_name":"Medical College of Wisconsin","org_type":"education","ransomware":null,"records_affected":9500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/phi-of-9.5k-possibly-compromised-in-wi-healthcare-phishing-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.biztimes.com/2017/industries/healthcare-wellness/patient-information-compromised-in-medical-college-email-system-attack/"}],"summary":"The Medical College of Wisconsin (MCW) announced that it suffered a healthcare phishing attack and that certain PHI may have been affected as it was in the accessed employee email accounts.  An investigation and manual document review showed that an unauthorized third party acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1133"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-20","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7b7f4d696e7860127d63f666be31fca06c22917","impact_type":"data_theft","incident_date":"2017-05-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice%20Templates_1.pdf"},"notes":null,"org_country":"US","org_id":"55aee21a4937","org_name":"Kevin J Palmer & Co, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100465"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice%20Templates_1.pdf"}],"summary":"Cybercriminals accessed Kevin J Palmer & Co, CPA’s tax filing software and files using what appeared to be a staff member’s credentials.","supporting_quote":"This allowed the cybercriminals to access our system and files, including the use of what appears to be one staff’s credentials.","technology_involved":["remote-access system","tax filing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d97408344177ad4786987a3a21cfe190f5cb83c","impact_type":"unknown","incident_date":"2017-02-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_2.pdf"},"notes":null,"org_country":"US","org_id":"214ea1e12f8b","org_name":"Hathaway-Sycamores Child and Family Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_2.pdf"}],"summary":"Several employees reported fraudulent tax filings, and the organization said information on their W-2 forms may have been involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55b0bc8c420e1032052822202d3aad95fbe0a27a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15b5c460-d560-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-07-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"government","ransomware":null,"records_affected":1915,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kxly.com/news/local-news/data-breach-at-spokane-va-medical-center/640560121"}],"summary":" Two USB hard drives containing personally-identifiable Veteran information were stolen from a Veterans Health Administration contract employee in Oklahoma on July 18, 2017. The Mann-Grandstaff VA Medical Center in Spokane has notified 1915 Veterans whose information might have b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-18","discovered_date":"2017-05-29","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"252975367e6a618413a34d3502647c7bb00a0c80","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Sample%20Customer%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"43f5d12aa5e5","org_name":"SportsMem, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100394"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample%20Customer%20Letter_0.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/SportsMem.pdf"}],"summary":"SportsMem found unauthorized code on its checkout page that may have accessed customer personal and payment card information.","supporting_quote":null,"technology_involved":["checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-18","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26fbd337fa5d4755f55d1975904ac48f5e005e1a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Remington%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"58be5d77a742","org_name":"Remington Lodging & Hospitality, LLC and Affiliates","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100387"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Remington%20Notice_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some hotel reservations processed through Sabre’s SynXis Central Reservations system.","supporting_quote":null,"technology_involved":["SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa9489afd599a6ddc4dd813bc0526b80baf608b7","impact_type":"unknown","incident_date":"2017-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_14.pdf"},"notes":null,"org_country":"US","org_id":"18b5e7fcd0ca","org_name":"Keller Williams Realty, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100388"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_14.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Keller%20Williams%20Realty%2C%20Inc.-2017-07-18"}],"summary":"Keller Williams Realty, Inc. reported a potential security incident involving personal information of current and former associates.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86a06926801211fb64079664d18ffb829e6e5c8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cdf6fc90-af5b-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-07-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56b5311debb9","org_name":"City National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.local10.com/news/crime/chase-bank-teller-arrested-in-connection-with-miami-beach-skimming-scam"}],"summary":"Chase Bank teller arrested in connection with Miami Beach skimming scam - City National Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-14","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"828ac8780428582679e51676d129d29fef5f7d1e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_13.pdf"},"notes":null,"org_country":"US","org_id":"57d4fe054b56","org_name":"Two Roads Hospitality, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100306"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_13.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Two%20Roads%20Hospitality%2C%20LLC-2017-07-14"}],"summary":"An unauthorized party accessed payment card and other reservation information held in Sabre’s SynXis system for reservations associated with Two Roads Hospitality properties.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-14","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39bca71f8c5be4ee942d296ac3531cd6e4a2809a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Historic%20Notification%20Letter%20SHORT_0.pdf"},"notes":null,"org_country":"US","org_id":"e390388cfb35","org_name":"Preferred Hotel Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100315"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Historic%20Notification%20Letter%20SHORT_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9717.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information in Sabre Hospitality Solutions’ SynXis Central Reservations system for some Preferred Hotel Group reservations.","supporting_quote":"Sabre’s investigation determined that the unauthorized party first obtained access to certain unencrypted payment card and other reservation information for a subset of hotel reservations processed through their system on August 10, 2016.","technology_involved":["Sabre Hospitality Solutions","SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-14","discovered_date":"2017-04-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6c7c541b17587746ed222af6fe9623d0f0a900e6","impact_type":"unknown","incident_date":"2017-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"66c931199391","org_name":"Burdette Smith & Bish LLC","org_type":"unknown","ransomware":null,"records_affected":14185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Burdette%20Smith%20%26%20Bish%20LLC-2017-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-14","discovered_date":"2017-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbd51785b52ce8fb9ec23898987a85cb9eca51b4","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%2062217%20US_0.pdf"},"notes":null,"org_country":"US","org_id":"85eb70e8ece7","org_name":"Aqua-Aston Hospitality LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100304"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Letter%2062217%20US_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some Aqua-Aston customers through reservations processed by Sabre’s SynXis Central Reservations system.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-14","discovered_date":"2017-07-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"62d17d56647d488b011ede0f913775ed74d7dab7","impact_type":"unknown","incident_date":"2017-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"431a3d9e1e86","org_name":"Apartment Management Consultants, LLC","org_type":"unknown","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Apartment%20Management%20Consultants%2C%20LLC-2017-07-14"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13cb60c2f10a9cdb2b90b97b44aae6ce94fdfe33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"632842e0-f6c3-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2017-07-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9096c621ee1","org_name":"Texas Physician House Calls","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"TEXAS PHYSICIAN HOUSE CALLS developers publish private repo which includes a hardcoded backdoor and patient information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-13","discovered_date":"2017-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd15ad3f373de43073ca07a2a13a8c4586078c2a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Harvest%20Bible%20Chapel%20dba%20Walk%20in%20the%20Word%20Ministries%20NOTICE%20ONLY%20_0.pdf"},"notes":null,"org_country":"US","org_id":"fb090a349a5d","org_name":"Harvest Bible Chapel d/b/a Walk in the Word Ministries","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100280"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Harvest%20Bible%20Chapel%20dba%20Walk%20in%20the%20Word%20Ministries%20NOTICE%20ONLY%20_0.pdf"}],"summary":"An unknown individual may have accessed payment and personal information used to donate to Walk in the Word Ministries through its website.","supporting_quote":"On May 30, 2017, we were notified by our third-party e-commerce provider that an unknown individual may have accessed your credit card, debit card, or checking account information used to donate to WITW on our website.","technology_involved":["third-party e-commerce system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74f89af804583c6196a5de8d08178d84ef483f82","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd3b7740-ba63-11e7-92c6-3b362a3baf5b"},"incident_date":"2017-07-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6606df6ea06c","org_name":"BP Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wwmt.com/news/state/police-discover-credit-card-skimmer-at-eastern-michigan-gas-station"}],"summary":"Police discover credit card skimmer at eastern Michigan gas station - BP","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2017-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8115e61b20d8c84cd0c2d66fad44f428dd850a8f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/YMCA%20-notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"4e1707725f0c","org_name":"YMCA of San Diego County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100254"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/YMCA%20-notice%20only_0.pdf"}],"summary":"The YMCA of San Diego County inadvertently emailed a spreadsheet containing employee personal, salary, and disability information to certain employees.","supporting_quote":"On or about June 14, 2017, the YMCA became aware that an Excel spreadsheet containing personal information of certain YMCA employees was inadvertently sent over email to certain YMCA employees.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d073d6acbffa720236378883a70e71536b4af2c","impact_type":"unknown","incident_date":"2016-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/La%20%20Quinta%20Center%20for%20Cosmetic_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd72420c8151","org_name":"La Quinta Center for Cosmetic Dentistry","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100236"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36e540166a42eb79fc0b287fbb20d700c65579ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CQ%20Hotels%20%28Notice%20Template%29_0.pdf"},"notes":null,"org_country":"US","org_id":"900ecb06626c","org_name":"Club Quarters Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100249"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CQ%20Hotels%20%28Notice%20Template%29_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9721.pdf"}],"summary":"An unauthorized intruder accessed reservation information in Sabre’s systems, affecting some Club Quarters Hotels reservations.","supporting_quote":"We were notified in June by Sabre that an unauthorized intruder was able to gain access to Sabre’s systems and view certain reservation information during the time period between August 10, 2016, and March 9, 2017, when the unauthorized access terminated.","technology_involved":["Sabre reservation system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Corporation"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87594c3485a74ce5880e61543603c86f12d71ff4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8614cb70-a478-11e7-b5cf-fd750643ba69"},"incident_date":"2017-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac5b121cf745","org_name":"Missouri Managed Care Healthcare","org_type":"financial","ransomware":null,"records_affected":1223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stl.news/2017/08/13/consumer-alert-healthnet-notification-hipaa-disclosure/"}],"summary":"Members of a healthcare plan had personal information mailed to an incorrect address by one of its subcontractors. No important medical data was revealed. Only name, d.o.b and plan member number. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"027d8dea83b407cc35e7e1cdb0f9002e4f854d07","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/PeachtreeNeurologicalClinicP.C..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b2d2a5bec4db","org_name":"Peachtree Neurological Clinic, P.C.","org_type":"unknown","ransomware":null,"records_affected":971,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/PeachtreeNeurologicalClinicP.C..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-10","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2316b319ebbb795634c132f854ee3aa4805d0182","impact_type":"data_theft","incident_date":"2017-06-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9720.pdf"},"notes":null,"org_country":"US","org_id":"117cf5e6618d","org_name":"Pacific Science Center","org_type":"nonprofit","ransomware":null,"records_affected":605,"reviewed":false,"root_cause":"Employees provided employee W-2 forms in response to fraudulent spear-phishing requests.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9720.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9720.pdf"}],"summary":"Pacific Science Center employees provided copies of 2016 W-2 forms in response to spear-phishing requests impersonating management.","supporting_quote":"Unfortunately, copies of all 2016 employee W-2 forms were provided on both dates before the company discovered that the requests were fraudulent.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-10","discovered_date":"2016-09-08","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e348d0c78b6df93193569748c44cc3f80ed0d9e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Movement%20Mortgage%20notice%20only5_0_0.pdf"},"notes":null,"org_country":"US","org_id":"63cbd1a634ac","org_name":"Movement Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100185"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Movement%20Mortgage%20notice%20only5_0_0.pdf"}],"summary":"Movement Mortgage reported unauthorized logins to company email accounts following phishing attacks, where personal and financial information was stored.","supporting_quote":"On September 8, 2016, Movement became aware of suspicious logins to certain company email accounts by an unknown source as the result of sophisticated phishing attacks on its email system.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-07-10","discovered_date":"2017-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bd3aa3bf4698f571e1022b7274f15c8668cda57","impact_type":"disruption_or_ransomware","incident_date":"2017-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"deb9fcf80507","org_name":"Andrea Yaley, DDS","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100184"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20notification_0.pdf"}],"summary":"A hacker accessed the dental office’s email system and may have accessed patient dental health records after hacking its computer systems.","supporting_quote":null,"technology_involved":["email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e03a1d209884691ae2e70f6968d3e0acf0c2b491","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27c67ed0-72d5-11e7-ace1-3bcdf5dc8d5d"},"incident_date":"2017-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0429baca0b44","org_name":"Wells Fargo Bank","org_type":"financial","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2017/07/21/business/dealbook/wells-fargo-confidential-data-release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/lawyers_e_discovery_error_led_to_release_of_confidential_wells_fargo_client#When:14:20:00Z"}],"summary":"When a lawyer for Gary Sinderbrand, a former Wells Fargo employee, subpoenaed the bank as part of a defamation lawsuit against a bank employee, he and Mr. Sinderbrand expected to receive a selection of emails and documents related to the case.  But what landed in Mr. Sinderbrand’","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaa43c30e6c6ae4bc3f9b386d8589aee7aca16a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0ed55c00-778c-11e7-a457-a5a222e6d450"},"incident_date":"2017-07-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3349a9df37b2","org_name":"Redwood Origins Ltd.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.edp24.co.uk/business/application-forms-full-of-jobseekers-personal-details-found-dumped-in-bin-of-norwich-flat-1-5117675"}],"summary":"Application forms full of jobseekers’ personal details found dumped in bin of Norwich flat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48ab56ad518d3dc9d899ec74acc7b316cf3a0edb","impact_type":"data_theft","incident_date":"2017-03-13","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REBS%20Notice%20of%20Breach%207.3.17_0.pdf"},"notes":null,"org_country":"US","org_id":"9b11711303bc","org_name":"Real Estate Business Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100138"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REBS%20Notice%20of%20Breach%207.3.17_0.pdf"}],"summary":"Malware in payment processing software used for store.car.org may have copied and transmitted customers’ personal and payment information.","supporting_quote":"We recently learned that malicious code (“malware”) uploaded by an unauthorized third party was present in payment processing software used for store.car.org.","technology_involved":["payment processing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-07","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"953fc4b06d209a9f72439089133ea9301b5e73e4","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hard%20Rock%20US%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"49160565126c","org_name":"Hard Rock International","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hard%20Rock%20US%20Notice_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some Hard Rock International hotel reservations processed through the SynXis Central Reservations system.","supporting_quote":null,"technology_involved":["SynXis Central Reservations system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-07-06","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f834712515824282b0cec95688b5a2cdc0d12cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BREACH_NOTIFICATION_SAMPLE_LETTER_AG_0.pdf"},"notes":null,"org_country":"US","org_id":"beadc0008701","org_name":"UC Davis Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing event caused the compromise of an employee's email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100113"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BREACH_NOTIFICATION_SAMPLE_LETTER_AG_0.pdf"}],"summary":"A phishing event compromised a UC Davis Health employee's email account, which contained patients' names, addresses, and diagnoses.","supporting_quote":"It was determined that a \"phishing event\" caused the compromise of this employee's email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a34fcbe2c8dec956d2661999575b744c8e7c4590","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SPOS%20-%20Consumer_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"2bf4400b0b07","org_name":"Spark Pay Online Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100107"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SPOS%20-%20Consumer_Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Spark%20Pay%20Online%20Store-2017-07-12"}],"summary":"Malicious code on Spark Pay Online Store’s website may have allowed fraudsters to access customer contact and payment card information.","supporting_quote":null,"technology_involved":["merchant website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-06","discovered_date":"2017-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d6afb091c6ada2f0c85023993ed89332a189291","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice%20re%20Sabre_0.pdf"},"notes":null,"org_country":"US","org_id":"310fac4c95d3","org_name":"Four Seasons Hotels Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice%20re%20Sabre_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9719.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some Four Seasons reservations processed through Sabre’s system; Sabre found no evidence that information was removed.","supporting_quote":null,"technology_involved":["Sabre CRS"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a58fc6feb45c522230c2621401b510504f2b35a1","impact_type":"unknown","incident_date":"2016-08-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Loews%20Hotels%20-%20Notification%20Materials_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01e96094b4c3","org_name":"Loews Hotels & Co.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100074"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9718.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Loews%20Hotels%20%26%20Co-2017-08-18"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-05","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"121dcfe87b8ddc86047e5da12168e6c71d5abeed","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GREENSBORO-_1300995-v1-Kayser-Roth__Consumer_Notification_Example_Nononsense_0.pdf"},"notes":null,"org_country":"US","org_id":"1ad7dd2d894c","org_name":"Kayser-Roth Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":90548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100086"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GREENSBORO-_1300995-v1-Kayser-Roth__Consumer_Notification_Example_Nononsense_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9713.pdf"}],"summary":"An intrusion into Aptos systems exposed personal and payment card information associated with Kayser-Roth's online orders.","supporting_quote":"As has become increasingly common on the web in recent years, there was an intrusion into a portion of Aptos’ systems that holds payment card data and certain other customer information for online orders placed on Nononsense.com.","technology_involved":["Aptos digital commerce solution"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-07-05","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"ff742233de8b1268ffa079a3cb085d6abaa627c6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/KayserRothCorporation.pdf"},"notes":null,"org_country":"US","org_id":"1ad7dd2d894c","org_name":"Kayser-Roth Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":90548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/KayserRothCorporation.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/KayserRothCorporation.pdf"}],"summary":"Kayser-Roth reported that customer information for No Nonsense online orders was accessed in an intrusion into Aptos systems.","supporting_quote":"As has become increasingly common on the web in recent years, there was an intrusion into a portion of Aptos’ systems that holds payment card data and certain other customer information for online orders placed on Nononsense.com.","technology_involved":["Aptos","Aptos digital commerce solution"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos Inc."},"updated_at":"2026-10-13","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65bffc5e344d71c6c56858e73488cfcbc5a7899f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"761a7e70-98e5-11e7-a6db-535ccd646699"},"incident_date":"2017-07-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb671e820621","org_name":"Caro Community Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wnem.com/story/35903543/caro-hospital-falls-victim-to-ransomware-attack"}],"summary":"Ransomware attack on hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2017-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b891c60d168e2b38a7fb01209e71fac85be968ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f2d3c490-6c8e-11e7-8419-7d473c8dcba3"},"incident_date":"2017-07-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"705f08a39535","org_name":"Avanti Markets","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/07/10/malware_scum_snack_on_lunchroom_kiosks/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/07/self-service-food-kiosk-vendor-avanti-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.avantimarkets.com/notice-of-data-breach/?utm_source=avantiwebsite&utm_medium=breach&utm_campaign=databreach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.avantimarkets.com/notice-of-data-breach/?utm_source=avantiwebsite&utm_medium=breach&utm_campaign=databreach"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100543"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102436"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Avanti%20Markets%20Inc.-2017-07-24"}],"summary":"Avanti Markets, a company whose self-service payment kiosks sit beside shelves of snacks and drinks in thousands of corporate breakrooms across America, has suffered of breach of its internal networks in which hackers were able to push malicious software out to those payment devi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b60b1d78d1964db837213fdf90fd6ff177a7c60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f653480-0b70-11e8-827c-bba53cbad290"},"incident_date":"2017-07-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebc469670d5e","org_name":"United States Central Intelligence Agency","org_type":"government","ransomware":null,"records_affected":8761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.repubblica.it/esteri/2017/03/07/news/wikileaks_files_reveal_major_security_breach_at_the_cia-159969039/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.com/2017/03/wikileaks-cia-hacks-dump/"}],"summary":"WikiLeaks just published 8,761 internal documents on the CIA's hacking programme.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"192d9f1bfde860b0324014b28dcda56511430858","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d7c6f20-98e4-11e7-a6db-535ccd646699"},"incident_date":"2017-07-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"928079dd602e","org_name":"NHS hospital","org_type":"healthcare","ransomware":null,"records_affected":31,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-nhs-medic-posts-confidential-patient-data-of-new-mums-on-facebook/"}],"summary":"NHS medic posts confidential patient data of new mums on Facebook","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7b006928c480c60c4b68ae703e50a2395e85d87","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"PL","org_id":"89fbe5f508e8","org_name":"Evermotion","org_type":"technology_saas","ransomware":null,"records_affected":435510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Evermotion","type":"hibp","url":"https://haveibeenpwned.com/Breach/Evermotion"}],"summary":"Evermotion’s vBulletin forum breach exposed 435,510 user records containing email addresses, usernames, dates of birth, and password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7844e808658525310a81f92084402a91aff838fc","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7e3c33bd4d5f","org_name":"XPG","org_type":"other","ransomware":null,"records_affected":890341,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: XPG","type":"hibp","url":"https://haveibeenpwned.com/Breach/XPGameSaves"}],"summary":"XPG suffered a breach that exposed user records containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"991da18b81e3273f6400fd8426cd0d628b36af2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f4a5e60-70a8-11e7-955a-c3e87cda4766"},"incident_date":"2017-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6820d7b8145e","org_name":"World Wrestling Entertainment","org_type":"other","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/leaky-wwe-database-exposes-personal-data-of-3m-wrestling-fans/126710/"}],"summary":"Pro wrestling giant World Wrestling Entertainment notified fans on Thursday that a database containing personal information of three million fans was left on an insecure server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"580eaf2c38cf231fa6019ffcf42ed6d39625e31f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08d88be0-9967-11e7-a8f4-3b6b04fdb9a4"},"incident_date":"2017-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0152e62434d3","org_name":"WestJet","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://calgaryherald.com/news/local-news/westjet-data-breach-reveals-customer-profile-information"}],"summary":"Customer information of airline posted online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87a2837e15dfb7e2b6f06fada2f63424f2d31c5f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48e39c50-72db-11e7-ace1-3bcdf5dc8d5d"},"incident_date":"2017-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VI","org_id":"dbc9417a3cca","org_name":"Virgin Island Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://viconsortium.com/featured/officer-now-fired-allegedly-shared-identifying-information-of-people-who-filed-police-reports/"}],"summary":"OFFICER, NOW FIRED, ALLEGEDLY SHARED IDENTIFYING INFORMATION OF PEOPLE WHO FILED POLICE REPORTS - US Virgin Islands Police Department","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f08a7fce5b1c889436079cf4a4b95b9b8f54d75","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"acd58490-e2e2-11e7-a8b4-b50015373b0a"},"incident_date":"2017-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec51b1eecebe","org_name":"Valley Family Medicine","org_type":"healthcare","ransomware":null,"records_affected":8500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/employee-wrongdoing-at-valley-family-medical-exposes-data-on-8-5k-patients.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/virginia-medical-practice-inappropriate-phi-use/"}],"summary":"Two former employees of Valley Family Medicine in Staunton, VA have been discovered to have inappropriately used a patient list.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"546661f5ffbe0cc066572b2bf37cfaff2a3f89e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48ee6e70-bd9d-11e7-822d-6d41de439a88"},"incident_date":"2017-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"541629b3d60e","org_name":"University of Wisconsin-Madison","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/quality-improvement-project-results-in-a-breach"}],"summary":"University mailing reveals patient treatment info - University of Wisconsin-Madison","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a07d3b7bfb165c621fec233a075fcceabd2fde2c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01751630-b347-11e7-9de8-4bde146bf807"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfac547d4354","org_name":"Tesco Express","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazettelive.co.uk/news/teesside-news/skimming-device-recovered-tesco-express-13350408"}],"summary":"Skimming device recovered from Tesco Express cash machine","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c64956d5559256a3b75c7088a00495cef00f45f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf7ff3a0-7c49-11e7-8ec0-e369e9638092"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"d5d1ca9dffd5","org_name":"State Revenue  Victoria","org_type":"government","ransomware":null,"records_affected":4400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news.com.au/national/breaking-news/vic-taxpayers-hit-by-data-breach/news-story/34a4a857bcef115f843c6fd14845dd69"}],"summary":"4400 overdue notices sent to wrong recipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5476e8694f701a3e1d015ee5ef4bbfe97aa15ef8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b838c6d0-8cd9-11e7-811e-83915e56fc98"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"03beb2f2d4df","org_name":"Shirley Oaks Childrens' Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-london-40756277"}],"summary":"Hundreds of sensitive council documents found in London estate.  Child protection and rent arrears documents - showing names, addresses, and confidential information - were found on the Gauden Estate, Clapham. Campaigners say the find could include files missing from a historical","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b20c607bbc27b1757a9f846aae722d43e0cbcb65","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"baf60230-ba64-11e7-92c6-3b362a3baf5b"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71660ec30d90","org_name":"Shell Food Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcpo.com/news/crime/card-skimmer-found-at-woodlawn-gas-station-auditor-says"}],"summary":"Card skimmer found at Woodlawn gas station, auditor says - Shell Food Mart","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"087cdfbcc1d7ef903914387d549496236ca40ebb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f711e1f0-a38d-11e7-a67b-81fbdaca3f85"},"incident_date":"2017-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a74a89c4442d","org_name":"Ridgeview Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lakerpioneer.com/2017/09/17/data-breach-made-public-ridgeview-says-it-exposed-some-email-addresses/"}],"summary":"Data breach made public, Ridgeview Medical Center says it exposed some email addresses","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f45198007c624979a5d36ee1ade8fc2f477d2911","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44bf8500-9047-11e8-8b32-9bc4732308c2"},"incident_date":"2017-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d4d4d1301240","org_name":"Queen Elizabeth Hospital","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/prince-edward-island/pei-hospital-privacy-breach-investigation-queen-elizabeth-hospital-1.4748392"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.edp24.co.uk/news/health/medical-records-of-norfolk-patients-found-in-a-petrol-station-a-king-s-lynn-restaurant-and-on-the-pavement-1-5150009"}],"summary":"An employee at Charlottetown's Queen Elizabeth Hospital inappropriately accessed the private health information of three patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fbdafd0d793a33249ce03753a555c3662f66beb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"451a22174bfd","org_name":"Programming Forums","org_type":"other","ransomware":null,"records_affected":707432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Programming Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/ProgrammingForums"}],"summary":"Programming Forums exposed user records containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbc561488edc10ca36f8344bc99aed160fa396a3","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"b440e89d6d30","org_name":"Powerbot","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Powerbot","type":"hibp","url":"https://haveibeenpwned.com/Breach/Powerbot"}],"summary":"Powerbot exposed user records containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab68c59b44d66056d26c64d3d38478bc26f86269","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4e03a620-6c8d-11e7-8419-7d473c8dcba3"},"incident_date":"2017-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df7f1e827651","org_name":"Nuance","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/nuance-regains-some-services-after-notpetya-cyberattack"}],"summary":"Nuance regains some services after NotPetya cyberattack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77a6b13283bdf2a26624ca4731f5e8ba6cab3b76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ccdbf1b0-918e-11e8-ad4c-017f2df1a0a0"},"incident_date":"2017-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1bd82406a554","org_name":"Nashville Metro Public Health Dept","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox17.com/news/local/major-data-breach-exposes-hiv-patients-in-tennessee;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.govinfosecurity.com/puzzling-health-dept-privacy-incident-exposes-hiv-data-a-11201;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.newschannel5.com/news/confidential-hiv-patient-information-compromised-by-health-officials"}],"summary":"A major data breach at the Metro Health Department exposes the confidential information of HIV patients who asked for privacy.  This affects men and women in 13 middle Tennessee counties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2656492f30c042a342b277430c8d286ff9afcaf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c4031d0-8c29-11e7-944b-11adeb58a7b7"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"982a10856926","org_name":"MedRecords Distribution Association","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timescolonist.com/news/local/saanich-man-s-medical-records-sent-to-stranger-in-error-1.21277681"}],"summary":"Misdelivery of medical record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b953f4f27a2eeb53f14c279f402f55ae8dc34b0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"195d37c0-b1fa-11e8-800d-891a5c02ea18"},"incident_date":"2017-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4422644a480a","org_name":"Lowe's","org_type":"retail_ecommerce","ransomware":null,"records_affected":46,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox43.com/2018/01/19/lowes-hr-manager-accused-of-stealing-more-than-130k-from-company/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ldnews.com/story/news/2018/01/19/human-resources-manager-defrauded-palmyra-lowes-130-000-police-say/1048562001/"}],"summary":"A human resources manager of Lowe’s in Palmyra is accused of stealing more than $130,000 from the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2876af937adbd576725f43d901f21ad6a44fd51","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1fea1a40-811d-11e7-8520-b5d4bef506ca"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b18bd1a8f1d7","org_name":"Firstrust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/pennsylvania/doylestown/skimming-device-found-doylestown-atm-police"}],"summary":"Skimming Device Found On Doylestown ATM: Police - Firstrust Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"741a149557d4a3c64862108b1654d170c7254a02","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80e24160-0a6c-11ec-9d35-0d797e3f6b54"},"incident_date":"2017-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f4d1605eaab6","org_name":"Daviess County Public Library i","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.owensborotimes.com/features/community/2019/07/ransomware-attack-hinders-library-for-second-time/"}],"summary":"Daviess County Public Library Believes They Were “Targeted” in Ransomware Attack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a86bcd755f21e93850cfe3b384663311053a240f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eb638c40-bda6-11e7-822d-6d41de439a88"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c75b8f475f79","org_name":"City of Seattle","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://crosscut.com/2017/10/seattle-information-technology-department-email-leak-city-scrambles/"}],"summary":"After massive email leak, the city scrambles - City of Seattle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"996851827348c8e4dd3731e5d04232e6600ca352","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9c4031d0-8c29-11e7-944b-11adeb58a7b0"},"incident_date":"2017-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"243e73df27ed","org_name":"Blue Cross Blue Shield of Tenessee","org_type":"financial","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/money/industries/health-care/2017/07/21/bcbst-glitch-sends-erroneous-reports-657-employers/500568001/"}],"summary":"BCBST glitch sends erroneous reports to 657 employers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"206961a6622b7dfb13aebe894ade1444563ef7fc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ec6715a0-9d51-11e7-88fd-d58755d0feda"},"incident_date":"2017-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"686dea75a600","org_name":"Bank of Saga","org_type":"financial","ransomware":null,"records_affected":139,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2017/06/19/national/crime-legal/bank-saga-client-data-allegedly-stolen-handed-suspected-criminals/"}],"summary":"personal information of 169 customers who each have over ¥100 million deposited in the Bank of Saga was likely stolen by a former employee and handed to a group of suspected criminals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"531e07d5e00c240eeec30930fd4a0979a0ad3022","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45b17c30-995c-11e7-a069-d9175a67bd3e"},"incident_date":"2017-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2f13a422956","org_name":"Anesthesia Consultants of Fresno","org_type":"healthcare","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kmph.com/news/local/visalia-womans-personal-information-stolen-her-doctor-is-to-blame"}],"summary":"A Visalia woman's personal information is in the hands of a thief. Robin Walker wasn't hacked, it was stolen from her doctor. She had knee surgery in July. Days before the operation her doctor's car was broken into. She learned that forty patients with Anesthesia Consultants of F","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c2e3e8fd4497ca232c03a6453eae21c142fead0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7de8fcc0-8cc0-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"financial","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthcare.com/payer/aetna-mailings-may-have-exposed-some-members-hiv-status"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aetna%2C%20Inc.-2017-07-10"}],"summary":"Aetna is facing backlash after mailing letters that may have revealed some of its members’ HIV status through the envelope.  The letters, sent July 28, contained instructions for filling prescriptions for HIV medication which in some cases might have been visible without having t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-06-30","discovered_date":"2017-05-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9709b210325869abc2f2ce50ea779f59effcf6a3","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/S027_v05.pdf_Resident%20Notice%20FINAL_1.pdf"},"notes":null,"org_country":"US","org_id":"23dbe1bb705a","org_name":"White Blossom Care Center","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/S027_v05.pdf_Resident%20Notice%20FINAL_1.pdf"}],"summary":"White Blossom Care Center reported that a former employee may have improperly accessed resident data, and files containing personal and medical information may have been acquired.","supporting_quote":"On May 25, 2017, we received information that a former White Blossom employee may have improperly accessed resident data while employed at the facility.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-30","discovered_date":"2017-06-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e864b6d80bc3c27092dc3b19b4ce877bc281c43","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trump%20Hotels%20-%20Notification%20Materials_0.pdf"},"notes":null,"org_country":"US","org_id":"094d86d21dfc","org_name":"Trump Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100019"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trump%20Hotels%20-%20Notification%20Materials_0.pdf"}],"summary":"An unauthorized party accessed payment card and reservation information for some Trump Hotels reservations processed through Sabre's CRS.","supporting_quote":null,"technology_involved":["Sabre SynXis Central Reservations system (CRS)"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"2cc82d4d74a2","name":"Sabre"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2017-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a444d6c553e75f777520812e41c78ed516b6e57e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-12-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISRR%2001061375-2017%20Breach%20Notification%20-%20Adult%20Agent_0.pdf"},"notes":null,"org_country":"US","org_id":"e1b27710e667","org_name":"State Farm Mutual Automobile Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100016"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISRR%2001061375-2017%20Breach%20Notification%20-%20Adult%20Agent_0.pdf"}],"summary":"A former State Farm employee appeared to have transferred files containing consumer information to a portable storage device, and State Farm could not independently verify that the information had been returned.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-30","discovered_date":"2017-05-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2349bc512d4e934ac0366edf4c113ddb90197595","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Meepos%20-%20notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"db79d7451c0b","org_name":"Meepos & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100020"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Meepos%20-%20notice%20only_0.pdf"}],"summary":"Meepos & Company reported unauthorized access to parts of its systems, which may have exposed client information in its tax filing system.","supporting_quote":null,"technology_involved":["tax filing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-29","discovered_date":"2017-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"522f6174e343be1421fd94f6a8d8b97a61a2be0c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Paul%20Stuart%20notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"9f05845df57a","org_name":"Paul Stuart, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99966"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Paul%20Stuart%20notice%20only_0.pdf"}],"summary":"Paul Stuart reported that an unknown individual may have accessed customer payment card information used at its online store.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ebcaa99a95fb5f2a52657f367b03538389bab8c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aca94ed0-8116-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-06-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"03a7bf4d3a0c","org_name":"Kabu.com","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://financefeeds.com/mitsubishis-fx-subsidiary-kabu-com-reports-ddos-attack/"}],"summary":"DDoS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f23a2c01ae4f6d5024408ab47b26e695092bc0c2","impact_type":"data_theft","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Google%20-%20Sabre%20Incident%20Individual%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"0e9f335c7c68","org_name":"Google","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99961"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Google%20-%20Sabre%20Incident%20Individual%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized party accessed personal and payment card information associated with certain Google hotel reservations held in Sabre's SynXis Central Reservations System.","supporting_quote":null,"technology_involved":["SynXis Central Reservations System"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sabre Hospitality Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"faade2edfdc6","name":"Sabre Hospitality Solutions"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"435d0ad9bf80d6ad204d954e524179b2dea08a69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe481a70-6bcf-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-06-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7d242400a849","org_name":"Community Care","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stcatharinesstandard.ca/2017/07/11/community-care-hacked"}],"summary":"Community Care of St. Catharines and Thorold is still reeling from a cyberattack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f36bbef6416bd347c4a23c3c92d46f6e72e5e2c","impact_type":"data_theft","imported_from":null,"incident_date":"2017-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8700ac4c56e3","org_name":"Coachella","org_type":"other","ransomware":null,"records_affected":599802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Coachella","type":"hibp","url":"https://haveibeenpwned.com/Breach/Coachella"}],"summary":"Records associated with Coachella, allegedly taken from its website and vBulletin-based message board, were discovered being sold online.","supporting_quote":null,"technology_involved":["Coachella website","vBulletin-based message board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82387501a84aed817225849aa548ddc408d2af5c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40c10060-6bc1-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-06-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57d69e7ddb4d","org_name":"Brownsburg Public Library","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infodocket.com/2017/07/09/an-indiana-public-library-recovering-from-ransomware-attack/"}],"summary":"An Indiana Public Library Recovers From Ransomware Attack - Brownsburg Public Library","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"NZ","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c49490e41010b43dc2b5e8a15c94afb38f5d7bd6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cf9eb700-c963-11e7-93c5-ff5db9c7b572"},"incident_date":"2017-06-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"5ba22bf34cc1","org_name":"WestPac ATM","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/waikato-times/92025410/card-skimming-device-found-in-taupo-atm"}],"summary":"A card-reading device was discovered on a Tauhara, New Zealand ATM Westpac ATM machine by a local resident last week.  Kelly Church was using the Westpac ATM outside The Bakehouse Cafe on Taharepa Road last Thursday and noticed something wasn't right.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2017-06-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7ef72971feed64259f0b01ecf58ca5ec2472048","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa9a4330-778c-11e7-a457-a5a222e6d450"},"incident_date":"2017-06-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"41cdd785b33a","org_name":"Parliament","org_type":"government","ransomware":null,"records_affected":90,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/politics/2017/jun/24/cyber-attack-parliament-email-access"}],"summary":"Brute force attacks on web based mail pops 90 accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-23","discovered_date":"2017-05-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9e02c60f1c33dcc168205d8d2e7a6b7a879a559","impact_type":"unknown","incident_date":"2017-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"56c01e17f8e2","org_name":"Gracenote, A Nielsen Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gracenote%2C%20A%20Nielsen%20Company-2017-06-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72acf438c81d24e7bf55c3ada86824dd2b326717","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GOLFTEC-Security%20Breach%20Letter%20%286.14.17%29-California%20Version_0.pdf"},"notes":null,"org_country":"US","org_id":"62d76172e61a","org_name":"GolfTEC Enterprises, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99849"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GOLFTEC-Security%20Breach%20Letter%20%286.14.17%29-California%20Version_0.pdf"}],"summary":"GolfTEC reported malicious intrusions into point-of-sale terminals at select centers, potentially compromising customers’ personal and credit card information.","supporting_quote":null,"technology_involved":["point-of-sale terminal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c61d3e10f7c74577de00823bd58deb0b15bd5a47","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85e11d80-94af-11e7-9340-f70be1ebf87c"},"incident_date":"2017-06-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85cedef45b4b","org_name":"Helen Devos Children Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wzzm13.com/news/investigations/13-on-your-side/watchdog/spectrum-stolen-camera-is-a-violation-of-hippa-rights/462052762"}],"summary":"Spectrum Health stolen camera is a violation of HIPPA rights","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e95a914f6d7ac4096fe979e21da7191676768646","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9715.pdf"},"notes":null,"org_country":"US","org_id":"ba909f9cd9f6","org_name":"GOLFTEC","org_type":"other","ransomware":null,"records_affected":653,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9715.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9715.pdf"}],"summary":"GOLFTEC reported malicious point-of-sale terminal intrusions at select centers from March 2 through June 15, 2017, potentially compromising students' personal and credit card information.","supporting_quote":null,"technology_involved":["point-of-sale terminal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2017-06-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e700694c0898fd29e3cf08f010f46c72770fdd3e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d55597b0-db81-11e7-b589-fd57f91024a3"},"incident_date":"2017-06-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"173e17007e1c","org_name":"Community Memorial Health System","org_type":"healthcare","ransomware":null,"records_affected":960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vcstar.com/story/news/local/2017/09/05/community-memorial-health-system-alerts-patients-possible-data-breach/635427001/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vcstar.com/story/news/local/2017/09/05/community-memorial-health-system-alerts-patients-possible-data-breach/635427001/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.pacbiztimes.com/2017/09/05/community-memorial-health-system-in-ventura-suffers-data-security-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101618"}],"summary":"Webmail creds phished","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6b621b0a31c4129bd6a80806b92cbd64152c7ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_11.pdf"},"notes":null,"org_country":"US","org_id":"e637d4236aae","org_name":"Caliber Home Loans, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99077"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_11.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9716.pdf"}],"summary":"Caliber Home Loans reported a security incident that may have affected the personal information of certain individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"The Dark Overlord","variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8148ca5a880db1fabad278d792b9b809f287beb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a5ab5620-81e6-11e7-ace7-c5c15a923e51"},"incident_date":"2017-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d85f0718e190","org_name":"Beverly Hills Dougherty Laser Vision","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/they-view-it-as-hollywood-but-thedarkoverlord-hit-another-medical-entity/"}],"summary":"They view it as “Hollywood,” but TheDarkOverlord hit another medical entity - Dougherty Laser Vision","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-20","discovered_date":"2017-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eeb874ab68bf0159556213bead36db112f68bbc","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SVHS%20Notification%20Letters_0.pdf"},"notes":null,"org_country":"US","org_id":"afd0df7c8cb7","org_name":"Sadd Velazquez Higashi Shammaa, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99016"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SVHS%20Notification%20Letters_0.pdf"}],"summary":"The firm reported unauthorized access to its tax program from May 1 through May 3, 2017, and said there was no evidence that affected individuals’ information was accessed.","supporting_quote":null,"technology_involved":["tax program"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"ideology","name":"Cameron Thomas Crowley aka 'vigilance'","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d0a7d57bc184f244faba5761b2784b4426a59b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"053dcf70-aa07-11e8-b272-396d7fe012b7"},"incident_date":"2017-06-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cddf4d981151","org_name":"Minnesota State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/news/19-year-old-cameron-thomas-crowley-charged-in-connection-to-cyber-attacks-on-state-databases/4937456/"}],"summary":"A man hacked Minnesota state government sites due to grudge for the shooting of a motorist by a police officer. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"cameronthomascrowleyakavigilance"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5e1a1b6d645e73df18a9c46fc5c778f2cc81642","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ca%20notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69549fd66d80","org_name":"Home Point Financial Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-98252"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Home%20Point%20Financial%20Corporation-2017-06-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2017-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88b75607add7a42a0cce25141646cdbc26245d4d","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20170619%20Occidental%20College%20Sample%20Notice-CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ac0e5aa73e42","org_name":"Occidental College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-97508"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20170619%20Occidental%20College%20Sample%20Notice-CA_0.pdf"}],"summary":"Occidental College reported that an unauthorized person may have accessed a file containing names, Oxy ID numbers, and encoded data used by campus debit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"886b1f6b52b4e9f612362729a04a97ff82f77c1d","impact_type":"unknown","incident_date":"2017-05-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Bed%20Bath%20%26%20Beyond%20--%20CA%20attachments_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"02f7b0ac65df","org_name":"Bed Bath & Beyond Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-97500"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b56c5fdaf630cc19dd25026517caebbffda2283","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f70aa850-8ccb-11e7-811e-83915e56fc98"},"incident_date":"2017-06-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4d59d7396df","org_name":"Salina Family Healthcare Center","org_type":"healthcare","ransomware":null,"records_affected":9640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcphersonsentinel.com/news/20170817/security-incident-at-salina-family-healthcare-center"}],"summary":"Security incident at Salina Family Healthcare Center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"468f2b713a62076d0ac6a897535508cc610ff5c7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f09ef60-d55d-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-06-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"870a486c82d9","org_name":"Rocky Mountain Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/laptop-stolen-rocky-mountain-health-care-services/"}],"summary":"Rocky Mountain Health Care Services, which also operates as Rocky Mountain PACE, BrainCare, HealthRide, and Rocky Mountain Options for Long Term Care, also discovered on June 18, 2017 that a mobile phone and laptop computer were stolen from a former employee. The devices containe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf6f1b1563197ba2000d5effd43cf9699d6a534c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08e07080-eabb-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-06-17","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a5f29ef6301","org_name":"Medical Oncology Hematology Consultants","org_type":"healthcare","ransomware":true,"records_affected":19203,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/medical-oncology-hematology-consultants-notifies-19203-patients-after-ransomware-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/delaware-oncology-group-hit-nearly-month-long-ransomware-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthcare-informatics.com/news-item/cybersecurity/delaware-oncology-practice-acknowledges-ransomware-attack-went-unnoticed"}],"summary":"Ransomware incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2017-06-17","discovered_date":"2017-05-16","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"062942f38caca42378354973c00aa1b85c601270","impact_type":"data_theft","incident_date":"2016-11-16","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"ef418a398b12","org_name":"Jewelry.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-97480"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_2.pdf"}],"summary":"Unknown individuals used an employee account to access Jewelry.com’s online boutique and install software that captured payment information entered on the shopping cart page.","supporting_quote":"On May 16, 2017, Jewelry.com discovered that beginning on or about November 16, 2016, unknown individuals gained access to our online boutique through the unauthorized use of an account belonging to one of our employees.","technology_involved":["Jewelry.com website","shopping cart page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-15","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"330c9065d58fc31d5c2c947e2055e92f072ff1d2","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Nielsen%20Gracenote%20Ad%20r3prf.0615_0.pdf"},"notes":null,"org_country":"US","org_id":"a2eddb5d0ef0","org_name":"Gracenote","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-97439"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Nielsen%20Gracenote%20Ad%20r3prf.0615_0.pdf"}],"summary":"A laptop belonging to a Gracenote employee was stolen from a vehicle and may have contained associates' personal information.","supporting_quote":"A laptop belonging to a Gracenote employee was stolen from a vehicle in the California Bay Area on May 18, 2017.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fa39911dda5fcfeab8c06752f45e4033636db29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"004f91e0-c954-11e7-972a-af17ba01ca22"},"incident_date":"2017-06-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7638ae7f1d48","org_name":"US Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ketv.com/article/skimming-theft-device-found-at-bank-near-132nd-and-maple/10199574"}],"summary":"customer found a skimmer on a US Bank ATM in Omaha, NE. Unknown how long it had been there or how many people used it before it was found. github nuber ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d01e28e19be56a7adfd7fcb810bb50cb2bf029f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1584fe70-6b07-11e7-9b43-bf152d61c1c6"},"incident_date":"2017-06-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"096a62efb513","org_name":"The University College London","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://themerkle.com/university-college-london-hit-by-new-ransomware-attack/"}],"summary":"Ransomware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8c32c51eb92c47e2c63122c01f6c1234b97a30b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bb7c24d0-9978-11e7-b039-d34ad5cfc38b"},"incident_date":"2017-06-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11b73ef7e1f2","org_name":"Pacific Alliance Medical Center’s","org_type":"healthcare","ransomware":true,"records_affected":266123,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/los-angeles-provider-potentially-breached-ransomware-attack"}],"summary":"Los Angeles provider potentially breached by ransomware attack - Pacific Alliance Medical Center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2ea5d6b6676b2b24e54b0894811851ce1009049","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2db61a60-c95d-11e7-a5ba-7f961e325ca3"},"incident_date":"2017-06-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a533c0ae2c2e","org_name":"Chevron Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wesh.com/article/skimming-device-found-at-cocoa-gas-station/10036202"}],"summary":"A maintenance worker found skimming devices on gas pumps at a gas station in Cocoa, Florida. No indication of who put them there, how long they had been there or how many cards were compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-09","discovered_date":"2017-04-21","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e282c03a5582411c858d7c3b1dcc8d51d7eb5ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WSU%20Notice%20Adult%20CA%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"9f41bbff0d8c","org_name":"Washington State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72496"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WSU%20Notice%20Adult%20CA%20Sample_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9712.pdf"}],"summary":"Washington State University learned that a safe containing a hard drive with personal information had been stolen.","supporting_quote":"On April 21, 2017, Washington State University learned that a locked safe containing a hard drive had been stolen.","technology_involved":["hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2af7d4da05f602ac0f2df7c42d602901f03b404","impact_type":"disruption_or_ransomware","incident_date":"2017-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Copy%20of%20User%20Communication%20-%20Notice%20of%20Data%20Breach%20for%20Tutti%20Music%20Player_0.pdf"},"notes":null,"org_country":"US","org_id":"cbe65d34f4fa","org_name":"SMH Enterprises LLC","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72494"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Copy%20of%20User%20Communication%20-%20Notice%20of%20Data%20Breach%20for%20Tutti%20Music%20Player_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#SMH%20Enterprises-2017-06-09"}],"summary":"SMH Enterprises LLC reported that ransomware encrypted data on a server containing user email addresses and passwords.","supporting_quote":null,"technology_involved":["data server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-09","discovered_date":"2017-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9c021ebf479ddf86e663f8b2ec0c8d180aaf8df","impact_type":"data_theft","incident_date":"2016-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Select%20-notice%20only_0_1.pdf"},"notes":null,"org_country":"US","org_id":"65ec4ff973f0","org_name":"Select Restaurants, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Select%20-notice%20only_0_1.pdf"}],"summary":"Select Restaurants reported that malware may have stolen guests’ debit and credit card data used at some restaurant locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["other","personal"],"disclosed_date":"2017-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9df11a9c40d89880b76d1d4d9b4e74efa1997ea","impact_type":"data_theft","incident_date":"2017-06-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"3961ad087774","org_name":"Exposed VINs","org_type":"unknown","ransomware":null,"records_affected":396650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Exposed VINs","type":"hibp","url":"https://haveibeenpwned.com/Breach/VINs"}],"summary":"In June 2017, an unsecured database with more than 10 million VINs (vehicle identification numbers) was discovered by researchers . Believed to be sourced from US car dealerships, the data included a raft of personal information and vehicle data along with 397k unique email addre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","other","personal"],"disclosed_date":"2017-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c9be7a1e5e017f0cad04c8f00f99a8e02b2b729","impact_type":"data_theft","incident_date":"2016-12-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"b71c47570635","org_name":"Data Enrichment Records","org_type":"unknown","ransomware":null,"records_affected":8176132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Data Enrichment Records","type":"hibp","url":"https://haveibeenpwned.com/Breach/DataEnrichment"}],"summary":"In December 2016, more than 200 million \"data enrichment profiles\" were found for sale on the darknet . The seller claimed the data was sourced from Experian and whilst that claim was rejected by the company, the data itself was found to be legitimate suggesting it may have been ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c862a7fe2df69f94e25ddfb912fefdb007395608","impact_type":"unknown","incident_date":"2017-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Northern%20Humboldt%20notice%20only%20SecurityBreach2017_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d482295cd85f","org_name":"Northern Humboldt Union High School District","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72412"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b26d3324c86c969d74a77e8a78d931d1f0bba849","impact_type":"unknown","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_1.pdf"},"notes":null,"org_country":"US","org_id":"5976551ad0d5","org_name":"GameStop","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72388"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#GameStop%2C%20Inc-2017-06-05"}],"summary":"GameStop notified customers of a security incident that may have involved their payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-06-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6645960434b62fda0d82d7085d0dc7461dcfecf","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification%20Letter%20%286-5%29_0.pdf"},"notes":null,"org_country":"US","org_id":"7c938d853670","org_name":"Freedom Smokes, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72375"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification%20Letter%20%286-5%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Freedom%20Smokes%2C%20Inc.-2017-06-07"}],"summary":"An unauthorized individual accessed portions of Freedom Smokes’ website and inserted code designed to capture payment information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9adf0b869462a449edb7d6fd555759c63259a677","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"38514ee07e9c","org_name":"Abandonia","org_type":"other","ransomware":null,"records_affected":776125,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Abandonia (2015)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Abandonia"}],"summary":"Abandonia reported exposure of 776,125 user records containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7b6c65c0c4712a615606a101f00cde9eb3a3af7","impact_type":"unknown","incident_date":"2017-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consumer%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c2f93fc0de05","org_name":"Signature Hardware Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-72355"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Signature%20Hardware%20Inc.-2017-06-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"NL","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"341dd96c72a74edb9244defb85f9fb9f675e8c0d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38c01350-72f7-11e7-a859-bd14321ac1c3"},"incident_date":"2017-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"4b8b4ced600d","org_name":"Verelox","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/ex-admin-deletes-all-customer-data-and-wipes-servers-of-dutch-hosting-provider/"}],"summary":"Ex-Admin Deletes All Customer Data and Wipes Servers of Dutch Hosting Provider - Verelox","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18d8a8e79481a895977913024b3e5e08f57597a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b3bf8e0-d96c-11e7-8b17-fdfed30923dd"},"incident_date":"2017-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b5b17ea5caa","org_name":"TRUEbenefits","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://markets.businessinsider.com/news/stocks/Keller-Grover-LLP-Investigating-TRUEbenefits-Data-Breach-1002871356"}],"summary":"Phishing leads to PHI disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9c0ae622f0ca1e7552313b9dd63212a5313bf4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"831e9350-81f1-11e7-ace7-c5c15a923e51"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"202bfdd00c09","org_name":"Tigers Den Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wnep.com/2017/06/02/unusual-device-found-inside-gas-pump-in-saint-clair/"}],"summary":"Unusual Device Found Inside Gas Pump In Saint Clair - Tigers Den","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcffb07c5a43a3e63441b021d212e3c32eca5f38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e839fe90-8cba-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69c81c6f8a18","org_name":"The institute for Women's Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/san-antonios-largest-ob-gyn-provider-breached-keylogger-malware;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/business/local/article/Institute-for-Women-s-Health-notifies-patients-11943303.php;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.ifwh.org/en/newsroom/"}],"summary":"The Institute for Women’s Health warned patients that hackers may have stolen some of their personal information or credit or debit card data, the physicians’ group said Thursday. The San Antonio OBGYN practice said a so-called keylogger virus was installed on its network on June","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df259988b8de4a60ee3593a169afbf68f1a3f609","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9b8ad4b0-a197-11e7-9764-c7e1aa1637e1"},"incident_date":"2017-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e1901b33bdfc","org_name":"St Luke’s Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlands103.com/news-centre/x-ray-file-local-penneys-among-hse-data-breaches/"}],"summary":"In June, a healthcare assistant from St Luke’s Hospital was accompanying a patient on a transfer to another hospital when he left their chart on the roof of the car before setting off.  He realised the mistake only when he arrived at their destination. The chart was later retriev","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"086c4f64999814085c26c50b9fc140b6947dfc75","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05d32b70-93d2-11e7-967f-a9fa27eb51b9"},"incident_date":"2017-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1591628bf65","org_name":"Sport and Spine Rehab","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.benzinga.com/pressreleases/17/08/r9884651/sport-and-spine-rehab-attention-patients-seen-prior-to-may-1st-2016-dat"}],"summary":"On June 3rd 2017, Sport and Spine Rehab was the victim of a ransomware attack that encrypted the data stored on it's servers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29e3ac0d5be580a9d5b411ea2666ebf10012d041","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2b7a8950-72d9-11e7-ace1-3bcdf5dc8d5d"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"859c1a78082a","org_name":"Sebastopol Fast Gas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressdemocrat.com/news/7153480-181/sebastopol-skimming-case-highlights-rise?artslide=0"}],"summary":"Sebastopol skimming case highlights rise of card theft at gas stations, other outlets ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"469596292813324857f5c477cb60f4d12979fd0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eac291b0-9951-11e7-a069-d9175a67bd3e"},"incident_date":"2017-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"cf62f7e87f44","org_name":"Prince Albert Parkland Health","org_type":"healthcare","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://panow.com/article/703416/employee-fired-paphr-snooping-patient-records"}],"summary":"Employee fired from health region for ‘snooping' in patient records - Prince Albert Parkland Health Region","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5bfc4f6978a0b1679e090d042736a57aef76b93","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e796c960-c323-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8e2db1328f61","org_name":"Nottinghamshire Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newarkadvertiser.co.uk/news/2017/05/26/memory-stick-led-to-stolen-computer"}],"summary":"Memory stick led to stolen computer - Nottinghamshire Police","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"state_affiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f6acd55cd6c93977d8bc9e121e2a16886fd0228","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f18b85d0-016c-11ea-ad43-7952870528d4"},"incident_date":"2017-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ddf74eaf41c0","org_name":"Mondelez International","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://zdnet.com/article/notpetya-an-act-of-war-cyber-insurance-firm-taken-to-task-for-refusing-to-pay-out/,https://www.bloomberg.com/opinion/articles/2019-01-11/mondelez-lawsuit-shows-the-dangers-of-attributing-cyberattacks"}],"summary":"Mondelez impacted by Not-Petya seeks coverage from insurance provider Zurich","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"155fc39e8689db6df3a21281eaa096f1eebb4c61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7fe08390-94ae-11e7-9340-f70be1ebf87c"},"incident_date":"2017-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32b8e54229ae","org_name":"MJHS Home Care","org_type":"healthcare","ransomware":null,"records_affected":28000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mjhs-phishing-attack-result-exposure-28000-individuals-phi-8938/"}],"summary":"MJHS Phishing Attack Result in the Exposure of 28,000 Individuals’ PHI.  On June 6, 2017, MJHS learned that an unauthorized individual gained access to the email accounts of several employees of Elderplan Inc., and on June 14, 2017 it was discovered that access was also gained to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15b461c05e92f1d2631b87f36cd0fbbda23c8598","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f38952c0-c48f-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ff8f549061f5","org_name":"Miramar Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressreader.com/new-zealand/the-dominion-post/20170617/281642485161976"}],"summary":"Misdelivery of PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"102789132c5e1f1d0f2e789b983ca202c0fe6092","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a294a030-c495-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b3a661cacbd","org_name":"Kentucky Workers' Compensation Fund","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.workcompcentral.com/news/article/id/1cfd0cfbb042b46729acbbcaf79e976ed0b1d5ab"}],"summary":"Ransomware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1dd33de4eb6a391db105fb83a5fb44158bd5291","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f89e5ec0-c491-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e408762c3036","org_name":"Health and Human Services Commission","org_type":"government","ransomware":null,"records_affected":1842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cw39.com/2017/06/16/officials-announce-data-breach-after-more-than-1800-patient-health-documents-found-near-dumpster/"}],"summary":"Disposal error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"321cfe42b23bf446fab8fd781fb02ad8ab9bd3af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7dc8dc10-6b0a-11e7-9b43-bf152d61c1c6"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07a41a6437b0","org_name":"Giant Food Stores","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox29.com/news/local-news/260874994-story"}],"summary":"Skimming device suspected at self-checkout line in grocery store - Giant Food Store","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4ea0bf8d63ef3c23d455924ed44782c19cde5b4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c3d5e630-9a17-11e7-9c6e-153653ac7780"},"incident_date":"2017-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0e984572ab4","org_name":"CrossFit gym","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox5sandiego.com/2017/09/12/woman-robs-crossfit-gym-uses-banking-info-at-taco-bell-walmart/"}],"summary":"Gym is robbed, documents stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f3e67c62ae1a77bb80a39d302fd602378ab79cf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70abcb80-bf08-11e7-a9c6-17df034f6c5e"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f930973e445d","org_name":"CheckPoint Fluid Systems International","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/new-york/nyc-pastor-arrested-buying-macbook-amazon-suit-article-1.3455253"}],"summary":"Bronx pastor almost arrested after buying Apple laptop off Amazon that had company's sensitive software on it: lawsuit - CheckPoint Fluidic Systems International","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8487817765bb418a7a7306b8a7c2b5b0f982ee2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"866aa3a0-0941-11e8-bbae-ed39c73f1398"},"incident_date":"2017-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"eabd9fc4ba48","org_name":"CashCrate","org_type":"other","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://motherboard.vice.com/en_us/article/hackers-steal-6-million-user-accounts-for-cash-for-surveys-site"}],"summary":"In one of the more bizarre data breaches to surface recently, hackers made off with 6 million accounts for CashCrate, a site where users can be paid to complete online surveys, according to a database obtained by Motherboard.  The data includes user email addresses, names, passwo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1db9e094dbd6ca36795799b565745f2c320bdadc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ba63530-7603-11e7-9d88-ab89f89c69db"},"incident_date":"2017-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e898d7a3e819","org_name":"Calallen Independent School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kristv.com/story/35783260/calallen-isd-networks-hit-by-ransomware-attack"}],"summary":"Calallen ISD networks hit by ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6afca5c4845ef29463f73cc6fc7793daf4aa3f48","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88633b40-8925-11e8-8760-271b3d9edf6d"},"incident_date":"2017-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"920e71ba0a72","org_name":"British Department for Exiting the EU","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mirror.co.uk/news/politics/key-brexit-documents-left-eurostar-12829601;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thetimes.co.uk/article/brexit-almost-derailed-as-theresa-may-aide-oliver-robbins-briefings-left-on-eurostar-train-tc2nvjm2f"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f9836358e4dfa117af0dc1484e34490b8ee74b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c4dbb2a0-da2f-11e7-a58f-dff506a792fb"},"incident_date":"2017-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96466a77a2ee","org_name":"Auburn Eye Care Assoicates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/auburn-eye-care-associates-can-you-see-it-now/"}],"summary":"Hacking via unconfirmed methods results in loss of medical data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5194fa1ba87677f9b574acc2c2978bfac9225081","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5f4adc00-8114-11e7-8520-b5d4bef506ca"},"incident_date":"2017-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ntdaily.com/atm-skimmer-found-at-7-eleven-on-fort-worth-drive/"}],"summary":"ATM skimmer found at 7-Eleven on Fort Worth Drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-31","discovered_date":"2017-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08cc44003d3afed5f1da003deaa28d2ccd53a293","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notification%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"9ddd187b6796","org_name":"Keith M. Southwood, CPA, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69409"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notification%20Sample_0.pdf"}],"summary":"Keith M. Southwood, CPA, Inc. reported unauthorized access to its computer network and possible exposure of personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2017-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fb2f71b0feb6fedb22fe325fceaa131f2c301d4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c5d54650-9b39-11e8-8c28-77aa5b8d940e"},"incident_date":"2017-05-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"83df5939e444","org_name":"Clarkson PLC","org_type":"transportation_logistics","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-shipping-provider-clarkson-discloses-2017-hack-and-ransom-demand/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/08/01/clarksons_breach_update/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/re-clarkson-plc-clarksons-notice-of-data-breach-300688782.html"}],"summary":"On November 7, 2017, Clarksons learned that it was the subject of a cyber security incident in which an unauthorized third party accessed certain Clarksons' computer systems in the UK, copied data, and demanded a ransom for its safe return. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-31","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f87ed5d142885101ce76396be73305602e14dee","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMO%20Harris%20Customer%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"eb5059b12d98","org_name":"BMO Harris Bank N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A production error caused some customers to receive another customer's Form 5498.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69411"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMO%20Harris%20Customer%20Notice%20Template_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BMO%20Harris%20Bank%20N.A.-2017-05-31"}],"summary":"A production error led to some BMO Harris Bank customers receiving another customer's Form 5498, which contained personal and financial information.","supporting_quote":"Regrettably, during the production of 2016 IRS Form 5498 for BMO Harris Bank IRA accounts, which were mailed May 15, 2017, an error occurred and some customers received their own Form 5498 along with another customer’s Form 5498, while other customers didn’t receive their form.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-31","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3686c8ee2b4cb19f6ef53f12af5e92167199c067","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9709.pdf"},"notes":null,"org_country":"US","org_id":"e52efb08e284","org_name":"BMO Harris Bank","org_type":"financial","ransomware":null,"records_affected":47,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#BMO%20Harris%20Bank-2017-05-31"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9709.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9709.pdf"}],"summary":"An error during Form 5498 production led to some BMO Harris Bank customers receiving another customer’s form, exposing personal and financial information.","supporting_quote":"During the production of 2016 IRS Form 5498 for BMO Harris Bank IRA accounts, which were mailed May 15, 2017, an error occurred and some customers received their own Form 5498 along with another customer’s Form 5498, while other customers did not receive any form.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-30","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f52e8053cb98a0ce3398a00411db5062988f343","impact_type":"data_theft","incident_date":"2017-04-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data%20Breach%20WUSDl%20052517_0.pdf"},"notes":null,"org_country":"US","org_id":"452137ff2522","org_name":"Wiseburn Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A configuration error after an upgrade exposed Schoolzilla’s backup files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data%20Breach%20WUSDl%20052517_0.pdf"}],"summary":"A configuration error exposed Schoolzilla backup files containing student information, which an unauthorized security researcher downloaded.","supporting_quote":"After a recent upgrade to our backup systems, a configuration error exposed Schoolzilla’s backup files.","technology_involved":["Schoolzilla data platform","backup system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Schoolzilla Inc."},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"28c44c7940a2","name":"Schoolzilla"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d41e99661f7164ad82522773696900f0fe5df8c","impact_type":"unknown","incident_date":"2017-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20%285.25.17%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5da15f5e5dc7","org_name":"Funding Circle USA, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69212"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1273cf727820d86d05d3d88c8b6ef7ca0305a1f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data-Breach%20DV-052517%20%282%29_0.pdf"},"notes":null,"org_country":"US","org_id":"017c9fa9e0e8","org_name":"Da Vinci Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A configuration error after a backup-system upgrade exposed Schoolzilla’s backup files.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Notice%20of%20Data-Breach%20DV-052517%20%282%29_0.pdf"}],"summary":"A configuration error exposed student information in Schoolzilla’s backup files, which an unauthorized security researcher downloaded.","supporting_quote":"After a recent upgrade to our backup systems, a configuration error exposed Schoolzilla’s backup files.","technology_involved":["Schoolzilla","backup files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Schoolzilla Inc."},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"28c44c7940a2","name":"Schoolzilla"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b7ca8dfe8a1795a743ff7d4a27c20bd48da65442","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9708.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"395fcd291b87","org_name":"Kennewick Public Hospital District","org_type":"unknown","ransomware":null,"records_affected":942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9708.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61350555cf2ab16c991443b79067e57b59343351","impact_type":"unknown","incident_date":"2016-01-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Fast%20Health%20notice%20only_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb65a4a0e9e6","org_name":"FastHealth Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69134"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-26","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c6329aef622f13838b1ed714556741ecc8ebb896","impact_type":"unknown","incident_date":"2017-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4c9051a6ad75","org_name":"Chipotle Mexixan Grill, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Chipotle%20Mexixan%20Grill%2C%20Inc.-2017-05-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3f23db7a3aecfb4dde4a18d20e38576adc1c70f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Chipotle%20-%20Substitute%20Notice%20and%20Press%20Release_0.pdf"},"notes":null,"org_country":"US","org_id":"b0b3ceb5a050","org_name":"Chipotle Mexican Grill","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69120"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Chipotle%20-%20Substitute%20Notice%20and%20Press%20Release_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/ChipotleMexicanGrillInc..pdf"}],"summary":"Malware designed to access payment card data operated on point-of-sale devices at certain Chipotle restaurants between March 24 and April 18, 2017.","supporting_quote":null,"technology_involved":["POS devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-25","discovered_date":"2017-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e77339407eeb775f76df9d8081da754e20afb302","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/R612_v02.pdf_Adult_0.pdf"},"notes":null,"org_country":"US","org_id":"b87bd616ba08","org_name":"Char-Broil, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69079"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/R612_v02.pdf_Adult_0.pdf"}],"summary":"Malicious code was uploaded to the system hosting Charbroil.com and may have exposed payment-card transaction information from online purchases.","supporting_quote":null,"technology_involved":["Charbroil.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7558a221b9f90c7878d688ace4af2f89dec3806","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Meredith%20-%20Final%20consumer%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"65b940aec851","org_name":"Allrecipes.com, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69080"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Meredith%20-%20Final%20consumer%20notice_0.pdf"}],"summary":"Email addresses and passwords entered on allrecipes.com before June 2013 may have been intercepted during account registration or login.","supporting_quote":null,"technology_involved":["allrecipes.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffb930378b5a6b50bb7b4f876fb8395bfb6cc0bf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc2e5360-a92d-11e7-a3c5-dbae2580635b"},"incident_date":"2017-05-24","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d2bd82b6054","org_name":"Kaleida Health","org_type":"healthcare","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/phishing-email-response-compromises-phi-2800-patients-8911/"}],"summary":"A response to a phishing email has resulted in the PHI of 2,789 Kaleida Health patients being made accessible to cybercriminals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d22d4a0c5152ea9f5f0dbf02b128d98dc8e8cfea","impact_type":"unknown","incident_date":"2017-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LS%200517-050%20ATM%20Skimming-GLBA%20Incident_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69075"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-23","discovered_date":"2017-04-24","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd2e975e41033680ccac3ea0f348b26a0b7af303","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Allegis%20-%20CA%20Templates_0.pdf"},"notes":null,"org_country":"US","org_id":"3a62cd54f368","org_name":"TALX Corporation","org_type":"professional_services","ransomware":null,"records_affected":40645,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69058"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Allegis%20-%20CA%20Templates_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9703.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#TALX%20Corporation%2C%20a%20wholly%20owned%20subsidiary%20of%20Equifax%2C%20Inc.-2017-05-23"}],"summary":"Unauthorized third parties reset some employees’ TALX portal PINs and may have accessed their W-2 forms and other account information.","supporting_quote":"the unauthorized third-party(ies) successfully answered personal questions about the affected employees in order to reset the employees’ PINs","technology_involved":["TALX online portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbf2b2c6ec478bd364573af8b0fa6b1008662dce","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aptos%20Incipio%20Ad%20Active%20r2prf_0.pdf"},"notes":null,"org_country":"US","org_id":"e52834823583","org_name":"Incipio, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69059"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aptos%20Incipio%20Ad%20Active%20r2prf_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Incipio%2C%20LLC-2017-05-23"}],"summary":"Aptos reported that its compromised systems exposed customer data associated with Incipio’s online stores.","supporting_quote":null,"technology_involved":["Aptos"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fbb30430d552515eff2186f228c34b860f23cbe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"237094d0-8110-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-05-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e2b305a8845","org_name":"University of Vermont Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/phishing-scam-university-vermont-medical-center-login-credentials-8900/"}],"summary":"Web-based email application credentials phished, PHI disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4b2659e454e93c9ff639bbd0a699c437fcb4040a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/DeckerCarWash.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed4e1bcc3893","org_name":"Decker Car Wash, LLC","org_type":"unknown","ransomware":null,"records_affected":2579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/DeckerCarWash.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2017-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72aed691fe8af97ee668b7b0b6731335e309be24","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"465638e0-70a5-11e7-955a-c3e87cda4766"},"incident_date":"2017-05-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c9eafa9c5ea","org_name":"Vision Care Specialists","org_type":"healthcare","ransomware":null,"records_affected":703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/vision-care-specialists-inc-notice-of-data-breach-300491909.html"}],"summary":"On May 22, 2017, Vision Care Specialists, Inc. (\"VCS\") learned that on or about May 20, 2017 the VCS administrative office was burglarized.  Immediately upon learning of the burglary, VCS contacted law enforcement who investigated the incident.  VCS assessed the items that were s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5bece9f26e9e0efbc4f2fbf266f66b835b4f532","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_10.pdf"},"notes":null,"org_country":"US","org_id":"3e6391ec1358","org_name":"Michael T. Blevins, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-69002"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_10.pdf"}],"summary":"An unauthorized individual accessed the organization’s computer network and may have accessed client tax files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-19","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"255b80d1231fc176d5a8c20b334753e0e6983c10","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9706.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5991876c5e60","org_name":"Zillow","org_type":"technology_saas","ransomware":null,"records_affected":1086,"reviewed":false,"root_cause":"A clerical error caused a former employee to receive a copy of a 2015 W-2 document.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9706.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9706.pdf"}],"summary":"A former Zillow Group employee inadvertently received a copy of a 2015 W-2 document due to a clerical error, and the letter reported no evidence of misuse.","supporting_quote":"On May 9, 2017, a former Zillow Group employee inadvertently received a copy of your 2015 W-2 document due to a clerical error.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41d46fce84cc5391142321885780241bc3bb1992","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fe5f4f30-9972-11e7-b039-d34ad5cfc38b"},"incident_date":"2017-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f9f73b3dbce","org_name":"SwiftQueue","org_type":"professional_services","ransomware":null,"records_affected":1200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/tech/4274225/anonymous-hacker-claims-to-have-stolen-the-nhs-medical-records-of-1-2million-brits/"}],"summary":"Anonymous hacker claims to have stolen the NHS medical records of 1.2million Brits - SwiftQueue","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90b3fb2c11f6bf39068c6e117002285b5a760827","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a39aa960-a15e-11e8-a73d-8bf9996ed0ad"},"incident_date":"2017-05-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"fab55841c045","org_name":"Singapore Taekwondo Federation","org_type":"education","ransomware":null,"records_affected":782,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.channelnewsasia.com/news/singapore/singapore-taekwondo-federation-fined-minors-nric-pdpa-10515338;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.natlawreview.com/article/singapore-taekwondo-federation-fined-personal-data-protection-commission"}],"summary":"The Singapore Taekwondo Federation has been fined S$30,000 after the NRIC numbers of 782 minors were disclosed via PDF documents on its website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14d079cdf41353eccd5788bf6f64016995605e19","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Revised%20Data%20Breach%20Letter%205-12-17_0.pdf"},"notes":null,"org_country":"US","org_id":"80d144d6cf83","org_name":"Mt. Diablo Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A caching problem in the HomeLink Portal caused students’ information to be exposed to other users.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68975"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Revised%20Data%20Breach%20Letter%205-12-17_0.pdf"}],"summary":"A caching problem in the HomeLink Portal exposed student information to other users for one hour, with no unauthorized access confirmed.","supporting_quote":"Eagle Soft and Microsoft have identified the malfunction as a caching problem that has now been repaired.","technology_involved":["HomeLink Portal","Student Information System"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Eagle Soft"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"1e23a99ac1f4","name":"Eagle Soft"}]}},{"actor":{"category":"external","country":"AU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98ec839bc3c833c19df99dfd17e67d524d70f3a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31a0ee90-9cba-11e7-bdec-d715fa410d81"},"incident_date":"2017-05-19","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5a5430c4f2bc","org_name":"Blackburn High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldsun.com.au/leader/east/blackburn-high-school-information-hacked-and-posted-online/news-story/bd49d306d34073a1b58a8ece2dcb9190"}],"summary":"A COMPUTER hack at a high school has led to the personal details of families — including their Medicare details, phone numbers, and addresses — being posted online .","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-05-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e59b71086ea3564ec015a36bc92886ff123fe05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5268e840-970f-11e7-a11c-5542f7e3819f"},"incident_date":"2017-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"cc7aa77af59d","org_name":"Zomato","org_type":"technology_saas","ransomware":null,"records_affected":17000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.welivesecurity.com/2017/05/22/zomato-working-ethical-hacker-improve-security/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thehackernews.com/2017/05/zomato-data-breach.html"},{"fetched_at":null,"title":"Have I Been Pwned: Zomato","type":"hibp","url":"https://haveibeenpwned.com/Breach/Zomato"}],"summary":"India's largest online restaurant guide Zomato confirmed today that the company has suffered a data breach and that accounts details of millions of its users have been stolen from its database.  In a blog post published today, the company said about 17 Million of its 120 Million ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-05-18","discovered_date":"2017-05-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45b010bc40200b1c92f8a80e32da87c2f0a2e7b6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HSX%20Notice%20of%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"75618b179e4a","org_name":"HSX.com","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HSX%20Notice%20of%20Data%20Breach_0.pdf"}],"summary":"HSX.com reported that usernames and passwords may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-05-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"425f14cfa664959fb6c542923dbedb6d90c09e1e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-05-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"89e05feb4b11","org_name":"DaFont","org_type":"technology_saas","ransomware":null,"records_affected":637340,"reviewed":false,"root_cause":"A SQL injection vulnerability was allegedly exploited by multiple parties.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DaFont","type":"hibp","url":"https://haveibeenpwned.com/Breach/DaFont"}],"summary":"DaFont exposed 637,340 records containing usernames, email addresses and passwords after a SQL injection vulnerability was allegedly exploited.","supporting_quote":"Allegedly due to a SQL injection vulnerability exploited by multiple parties, the exposed data included usernames, email addresses and passwords stored as MD5 without a salt.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"800e835b1b8e6c8f10925a63afda2798f70d8b53","impact_type":"data_theft","incident_date":"2017-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rite%20Aid%20Online%20Store%2C%20Inc.%20Individual%20Notification%20Letter_65144423_1_0.PDF"},"notes":null,"org_country":"US","org_id":"363dfbda990d","org_name":"Rite Aid Online Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rite%20Aid%20Online%20Store%2C%20Inc.%20Individual%20Notification%20Letter_65144423_1_0.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9705.pdf"}],"summary":"Unauthorized third parties accessed Rite Aid Online Store’s e-commerce platform and acquired customers’ personal and payment card information.","supporting_quote":null,"technology_involved":["e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce4df76a997d47c8b228d0264722e819ef802213","impact_type":"unknown","incident_date":"2015-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68923"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-99832"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2017-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83a8e1e3872a98f4690c45290577c65c2b4f6d22","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20170502_tatcha501_1_0.pdf"},"notes":null,"org_country":"US","org_id":"9f3fc2a5645a","org_name":"Tatcha, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68868"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20170502_tatcha501_1_0.pdf"}],"summary":"Tatcha reported that an unauthorized person may have accessed information entered during its checkout process, including payment, contact, and account information.","supporting_quote":null,"technology_involved":["Tatcha checkout process"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d20a41c09166d14dc5d1203a5d5fe6aae1de1e3e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NicoPure%20%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f2f1a693fcf4","org_name":"Nicopure Labs, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68891"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NicoPure%20%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nicopure%20Labs%2C%20LLC-2017-05-16"}],"summary":"Nicopure Labs investigated reports of fraudulent payment-card charges after purchases on its website and said checkout information may or may not have been accessed.","supporting_quote":null,"technology_involved":["website checkout"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d13c5981cad44da734690977393b7096f0415ca8","impact_type":"unknown","incident_date":"2017-03-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cadef5b61886","org_name":"Equitable Tax Service","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68892"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"865e77f9886234a88ac631ca6a8ffc96187e7272","impact_type":"both","imported_from":null,"incident_date":"2017-05-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CA","org_id":"560e58e28ebe","org_name":"Bell","org_type":"telecom","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bell (2017 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bell2017"}],"summary":"Bell customer and employee data was exposed and leaked online, with the attacker threatening to leak more.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd0e2ed022d8d13c613ea990333ad2f41f409c5c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0979e7c0-9d53-11e7-88fd-d58755d0feda"},"incident_date":"2017-05-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03db9062efea","org_name":"Utah Department of Family and Child Services","org_type":"healthcare","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ksl.com/?sid=44663808&nid=148"}],"summary":"he private information of 16 people was stolen in May after a Utah Department of Family and Child Services employee’s vehicle was broken into and copies of identification records needed for background checks were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","medical"],"disclosed_date":"2017-05-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fecfd536d09e661135ead3824886bcacddb72bfe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a926740-98e6-11e7-a6db-535ccd646699"},"incident_date":"2017-05-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"beadc0008701","org_name":"UC Davis Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/phishing-attack-uc-davis-health-breaches-data-15000-patients"}],"summary":"Phishing ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a9dc63a50dc6a02a20b10798a5062b143432796","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TA-Sample1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a0eed9e41b42","org_name":"TripAdvisor LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68865"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c86f0cec14749a537a591f97d6a3347ec110420a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-16","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UNMF%20Incident%20Notices_0.pdf"},"notes":null,"org_country":"US","org_id":"c10a95380cb0","org_name":"The University of New Mexico Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UNMF%20Incident%20Notices_0.pdf"}],"summary":"An unauthorized individual accessed systems containing donor information through an account with the Foundation’s security services provider.","supporting_quote":"In mid-April, 2017, we discovered that an unauthorized individual had gained access to our network through an account with our security services provider.","technology_involved":["security services provider account"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-15","discovered_date":"2017-02-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adcad404822fe58b54bba2af7e581a7a7a8089f2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-12-20","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kuru%20-Notice%20ONLY-%20CA%20Exhibit%201_0_0.pdf"},"notes":null,"org_country":"US","org_id":"7018d37a8d32","org_name":"KURU Footwear","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68866"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kuru%20-Notice%20ONLY-%20CA%20Exhibit%201_0_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9702.pdf"}],"summary":"KURU Footwear reported malware that may have stolen payment-card data used on its website.","supporting_quote":"We removed the malware at issue to prevent any further unauthorized access to customer debit or credit card information.","technology_involved":["KURU Footwear website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-15","discovered_date":"2017-04-17","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcf448f94a3b2ccb8a6ab180a9f74b43951d318d","impact_type":"data_theft","incident_date":"2017-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Indigo%20Wild%20--notice%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"5f77266ac20d","org_name":"Indigo Wild","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68843"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Indigo%20Wild%20--notice%20FINAL_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Indigo%20Wild-2017-05-12"}],"summary":"Indigo Wild reported that malicious code inserted into its website may have stolen personal and payment information submitted during purchases.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8ccc98d1d76d22fd8dcf33d9a209228c8e529e8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d833c30-c95f-11e7-a5ba-7f961e325ca3"},"incident_date":"2017-05-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef546a40cd85","org_name":"Little River Healthcare","org_type":"healthcare","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcentv.com/news/local/briefcase-containing-little-river-healthcare-records-stolen/449836151"}],"summary":"Little River Healthcare located in Waco, TX discovered May 12 that a briefcase containing 18 paper charts and a laptop with patient electronic medical records, was stolen from a provider's locked vehicle. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-12","discovered_date":"2017-04-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0621ae0b0a1cca6117b0b57841a5e50508825430","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/D%27Angelo%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"8e612da59ee5","org_name":"D'Angelo & Associates, APC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68842"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/D%27Angelo%20Notice_0.pdf"}],"summary":"D'Angelo & Associates reported unauthorized access to its tax program, and said files accessible during the incident could not be identified.","supporting_quote":null,"technology_involved":["tax program"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fbe091a8cd716669831d46341f63804b2ef9c536","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9700.pdf"},"notes":null,"org_country":"US","org_id":"8917487f8f08","org_name":"Brooks Brothers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9700.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/BrooksBrothers.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9700.pdf"}],"summary":"Brooks Brothers reported that malicious software was installed on some retail and outlet payment processing systems and may have affected customers' payment card data.","supporting_quote":null,"technology_involved":["payment processing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-09","discovered_date":"2017-02-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"352d30cdd3567123eb07008f09e3111c93234df9","impact_type":"unknown","incident_date":"2016-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"29a46f216136","org_name":"Lane Community College Health Clinic","org_type":"unknown","ransomware":null,"records_affected":1911,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Lane%20Community%20College%20Health%20Clinic-2017-05-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2017-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5bacc4e72d47d414a4772216f82e12dc3fa0082","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad2653d0-d3bd-11e8-9659-2bc8d207b0aa"},"incident_date":"2017-05-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16658e220996","org_name":"Partners HealthCare","org_type":"healthcare","ransomware":null,"records_affected":26000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/malware-incident-discovered-in-may-2017-affected-2600-patients-partners-healthcare-system/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/boston/news/2018/02/05/partners-healthcare-says-data-breach-exposed.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bostonglobe.com/business/talking-points/2018/02/05/partners-acknowledges-data-breach-last-year/q0kcjASCdjIPvWy4mM19mI/story.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthcaredive.com/news/partners-notifies-26k-patients-affected-in-data-breach/516464/"}],"summary":"Partners HealthCare, the state’s largest private employer, revealed on Monday that its computer network was breached in May 2017, potentially exposing the private information of up to 2,600 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-08","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f07e44e4661086aa438a9bed48700e8ad60d9c23","impact_type":"unknown","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1ed82ba96a6a","org_name":"Marbles, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Marbles%2C%20LLC-2017-05-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1269d548e03640d75da84620541a277ee009bfba","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GenpactNotice%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"2584f2d6093b","org_name":"Genpact International, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A dataset uploaded to a cloud server lacked some security protocols and was not fully secured.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68655"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GenpactNotice%20FINAL_0.pdf"}],"summary":"Genpact reported that a dataset containing loan and lease application information was not fully secured on one of its cloud servers.","supporting_quote":"As a result, the data was not fully secured from January 12, 2017 to April 2, 2017.","technology_involved":["cloud server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87a0d00681e508fefc10f315bda7792cd0fae1fc","impact_type":"data_theft","incident_date":"2016-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list (unverified by HIBP)","org_country":"unknown","org_id":"9d3bcba92b57","org_name":"Exploit.In","org_type":"unknown","ransomware":null,"records_affected":593427119,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Exploit.In","type":"hibp","url":"https://haveibeenpwned.com/Breach/ExploitIn"}],"summary":"In late 2016, a huge list of email address and password pairs appeared in a \"combo list\" referred to as \"Exploit.In\". The list contained 593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-05","discovered_date":"2017-04-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"18a88845679b1a449d48f82147701e0b3e59b872","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-12","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rand%20CAnotice%20only_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"0f251d0b240d","org_name":"RM Acquisition, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":21237,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#RM%20Acquisition%2C%20LLC%20d/b/a%20Rand%20McNally-2017-05-05"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68604"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rand%20CAnotice%20only_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rand%20CAnotice%20only_0.pdf"}],"summary":"RM Acquisition, LLC reported that malware on its e-commerce store may have collected customers’ personal and credit card information.","supporting_quote":"Through this breach, an unauthorized party may have been able to gain access to your credit card information by installing malware that obtained that information.","technology_involved":["e-commerce store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e66933c0574bd1aef3ad89bee22ecb5608151fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"599bb4d0-bf7b-11e9-a5a0-eb7abaf171bc"},"incident_date":"2017-05-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0c01c8f1c9f","org_name":"Bank of Little Rock","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.arkansasonline.com/news/2019/aug/14/ex-bank-worker-indicted-in-theft-201908-1/"}],"summary":"A former electronic banking manager at Bank of Little Rock has been indicted by a federal grand jury on an embezzlement charge.  The indictment alleges that John Henry Curry Jr., 41, took more than $80,000 from bank customers' accounts between May 5, 2017, and Oct. 5, 2018. It ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5a84ba44c968faf92562cdffeaed51e84ee038a0","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9697.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9a4c231aa17e","org_name":"Metro Parks Tacoma","org_type":"government","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9697.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9697.pdf"}],"summary":"Metro Parks Tacoma unintentionally emailed a page containing personal information for 23 new hires to personal email addresses of new hires.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcb55c54f12189449de2468a8749448c621b247c","impact_type":"data_theft","incident_date":"2016-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5954c62a3a88","org_name":"Anti Public Combo List","org_type":"unknown","ransomware":null,"records_affected":457962538,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Anti Public Combo List","type":"hibp","url":"https://haveibeenpwned.com/Breach/AntiPublic"}],"summary":"The Anti Public combo list contained email addresses and passwords gathered from various online systems and was broadly circulated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-04","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9db5f43596dec278165e21dcdaedab988105c2b7","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Agri%20Beef%20California%20Sample%20Data%20Breach%20Notice%20_0.pdf"},"notes":null,"org_country":"US","org_id":"28b56efef74f","org_name":"Agri Beef Co.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67966"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Agri%20Beef%20California%20Sample%20Data%20Breach%20Notice%20_0.pdf"}],"summary":"Agri Beef reported that customer personal and payment information associated with the Snake River Farms website may have been accessed during an incident involving its hosting partner, Gorilla Group.","supporting_quote":null,"technology_involved":["Snake River Farms website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Gorilla Group"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"636b98ad2ebe","name":"Gorilla Group"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-03","discovered_date":"2017-08-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df5880033e7938c29dc2e53e1fd7a09e8b67e52d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Breach%20uploaded%20to%20Secretary%20of%20State_0.pdf"},"notes":null,"org_country":"US","org_id":"eedf3c6db72b","org_name":"Zinc Auto Finance, Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee accessed account information without a direct business need.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67946"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20of%20Breach%20uploaded%20to%20Secretary%20of%20State_0.pdf"}],"summary":"An employee accessed customer account information without a direct business need.","supporting_quote":"This letter is written to inform you, that on August 21, 2017 we became aware of an employee who accessed your account information without a direct business need.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"Brian Krebs","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"531fb7c24cc10e79c2d33e91b3e31a691fcd3120","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69abdaf0-ca34-11e7-a7a2-ef5723624be0"},"incident_date":"2017-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f389ef5a32","org_name":"Molina Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/molina-healthcare-security-flaw-makes-patient-records-available-online.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/05/molinahealthcare-com-exposed-patient-records/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/breaches-molina-healthcares-show-why-you-cant-skimp-security"}],"summary":"a security flaw allowed any Molina patient to access other patients’ medical claims by simply changing a single number in the URL.  no authentication was required to access patient claims information online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error","derived":{"actor_id":"briankrebs"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2017-05-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cef2527e290369de9f1668a668747cf32a773c5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5b789570-8c24-11e7-944b-11adeb58a7b0"},"incident_date":"2017-05-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e01b2dc5a6b3","org_name":"Community Link, Inc.","org_type":"healthcare","ransomware":null,"records_affected":5525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cli.ngo/notice-to-our-members-regarding-a-privacy-incident/"}],"summary":"Breach notification w. no details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2017-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93eda2d16731f7a354b4470d5a8c6290249a270d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f8477f40-b345-11e7-9a94-230655e65ca5"},"incident_date":"2017-05-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e8c765129f11","org_name":"Cape Breton school","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/nova-scotia/russian-public-stream-webcam-cape-breton-school-children-1.4351372"}],"summary":"Poor security blamed after school surveillance images broadcast on Russian site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2017-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a54471f9ba65bc7020aa146bcd1b55274956c78","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ahluwalia%20Letter%20Version%201_0.pdf"},"notes":null,"org_country":"US","org_id":"c399381d9d43","org_name":"MSA Accounting CPA, Professional Corp.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67943"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ahluwalia%20Letter%20Version%201_0.pdf"}],"summary":"MSA Accounting notified clients about suspicious tax-return activity, but its forensic investigation found no evidence of a network breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-05-02","discovered_date":"2017-04-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58f73415a4b48b788ff4aef3c4d31252d290d8a5","impact_type":"unknown","incident_date":"2017-09-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/McDavid%20CA%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"2ef1d66a6664","org_name":"McDavid, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67942"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/McDavid%20CA%20Sample_0.pdf"}],"summary":"McDavid reported that hidden code was placed on its webservers and may have targeted customers’ personal and payment information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0a9890d7ba0fd305cfe82aea0232679fac745a9b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/GreenwoodSchoolDistrict50.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62a39153832e","org_name":"Greenwood School District 50","org_type":"unknown","ransomware":null,"records_affected":2963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/GreenwoodSchoolDistrict50.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a30f34a07b7d8012fff891863266b4ea5f65ff36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b142cb00-8cc5-11e7-97c0-cfe5b6ac1588"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7565306cad7d","org_name":"Tampa Bay Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":25848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/patient-data-exposure-possibly-impacts-15k-at-fl-center"}],"summary":"On May 5, 2017, Tampa Bay Surgery Center was made aware of a security incident in which certain patient data was posted to a public online file-sharing site by an unauthorized third party.  Law enforcement informed the healthcare center that the information was posted the day pri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d803b528fad19e2ac4cd3a34ae69edeab85dcd9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aec56520-94ab-11e7-9340-f70be1ebf87c"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a230c72cea06","org_name":"PVHS-ICM Employee Health and Wellness, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dojmt.gov/wp-content/uploads/PVHS-ICM-Employee-Health-and-Wellness.pdf"}],"summary":" Almost 12,000 Records Compromised in Two New Ransomware Attacks - PVHS-ICM Employee Health and Wellness, GI Care for Kids Endoscopy Center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e48b26da23e69f90b2e9bbd25514f3c9ba0bdca8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36d6e590-9715-11e7-a11c-5542f7e3819f"},"incident_date":"2017-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"44efe633d33b","org_name":"Plymouth Hospitals NHS Trust","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wired.co.uk/article/nhs-cyberattack-ransomware-security;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/telefonica-tells-employees-to-shut-down-computers-amid-massive-ransomware-outbreak/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.co.uk/article/nhs-trusts-affected-by-cyber-attack"}],"summary":"At least 16 hospitals in the United Kingdom are being forced to divert emergency patients today after computer systems there were infected with ransomware, a type of malicious software that encrypts a victim’s documents, images, music and other files unless the victim pays for a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9873e3875bac70857f3045991598e6b64fcb1356","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/data_breach_letter_0.pdf"},"notes":null,"org_country":"US","org_id":"9d2cacbbf900","org_name":"Palo Alto Unified School District","org_type":"education","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":"A configuration error exposed Schoolzilla’s backup files after an upgrade to its backup systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67904"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/data_breach_letter_0.pdf"}],"summary":"A configuration error exposed Schoolzilla backup files containing partial student records for approximately 14,000 Palo Alto Unified School District students, which a security researcher accessed and downloaded.","supporting_quote":"After a recent upgrade to their backup systems, a configuration error exposed Schoolzilla’s backup files.","technology_involved":["Schoolzilla","off-site backup"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Schoolzilla"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"28c44c7940a2","name":"Schoolzilla"}]}},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60ed931b5f0d97fe6f4e8742d832e5447c242357","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b9560cc0-a7ab-11e7-9f87-7fffd7137a55"},"incident_date":"2017-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"436519876b5d","org_name":"Niskayuna, New York School District","org_type":"education","ransomware":null,"records_affected":945,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news10.com/2017/05/24/niskayuna-school-lap-top-stolen-945-students-personal-information-on-device/"}],"summary":"he personal information of 945 students, both past, and present, was compromised as a result of a thief stealing the laptop of a Niskayuna school psychologist.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8da1d24ef733f7cd28dd0695893621149c447cff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d10e2840-8cd8-11e7-811e-83915e56fc98"},"incident_date":"2017-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78ae85df68a6","org_name":"Henry Ford Health System","org_type":"healthcare","ransomware":null,"records_affected":596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.henryford.com/visitors/expect/privacy/active-breaches"}],"summary":"Henry Ford Health System is notifying patients whose personal health information was stolen in connection with an identity theft incident. This incident is being investigated by federal and local authorities.   The stolen information was in paper form and limited to 596 patients ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56b91e9f5e4883f7a204422aeceac551bf4c6391","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f32cd680-9d61-11e7-88fd-d58755d0feda"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6208f2426b8","org_name":"Florida Department of Agriculture and Consumer Services","org_type":"government","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://clipdraw.com/data-breach-florida-exposes-concealed-carry-permit-owners-data/"}],"summary":"Florida state government inadvertently released the information of of 16,000 concealed carry permit carries when online payment system was breached.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66c3512edf204fa696fa5d1f357f6a221508359a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fa96a70-0942-11e8-bbae-ed39c73f1398"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98eee833ff95","org_name":"Edmodo","org_type":"technology_saas","ransomware":null,"records_affected":77000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.metronews.ca/news/calgary/2017/06/12/cbe-calgary-warns-parents-students-app-data-breach-edmodo.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://motherboard.vice.com/en_us/article/hacker-steals-millions-of-user-account-details-from-education-platform-edmodo"},{"fetched_at":null,"title":"Have I Been Pwned: Edmodo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Edmodo"}],"summary":"A hacker has stolen millions of user account details from popular education platform Edmodo, and the data is apparently for sale on the so-called dark web.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34eb14ef0caf59f79bddbf2b6e69f5e91546dacd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"376ceb50-6be4-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a517bee81bd","org_name":"DOW Jones","org_type":"financial","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/dow-jones-leaks-personal-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.usatoday.com/story/tech/news/2017/07/17/wall-street-journal-parent-exposes-2-2-m-customers-data-cloud-storage-leak/485604001/"}],"summary":"The information of more than 2 million Dow Jones customers was left exposed online after the company made an error in the access preferences on a cloud storage system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d764d2b4fe674c8f5e0f6745204fa1b69791f0f8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ba1d9d80-9e1e-11e7-8b0f-a996d3edc37c"},"incident_date":"2017-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8e345499430","org_name":"Clark County District Court","org_type":"government","ransomware":null,"records_affected":380,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nevada-court-says-juror-id-information-compromised/"}],"summary":" printing company the courts use to send out jury summons, may have engaged in wrongdoing by an employee copying private info to personal email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d50cc3010713c80d4fe562becb63b8b40c6e0f9a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"692b1500-a2de-11e7-b840-f97c87f5ffb5"},"incident_date":"2017-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"323b08ece87a","org_name":"Children and Youth Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eveningsun.com/story/news/2017/07/05/83-children-york-adams-counties-affected-statewide-data-breach/452724001/"}],"summary":"Partner error results in disclosure of sensitive data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c7299a59b3d62a48e2fd4a3e342797520ea5606","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16be08e0-81eb-11e7-ace7-c5c15a923e51"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"642383d654cb","org_name":"Camberwell High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/victoria/camberwell-high-school-becomes-second-target-of-major-privacy-breach-in-two-weeks-20170529-gwf92s.html"}],"summary":"Camberwell High School becomes second target of major privacy breach in two weeks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c8d31a4d2f0b20272d4aafd330ad62734edd5a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36418350-a19d-11e7-bd2e-43ac41b832c9"},"incident_date":"2017-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71d991ac27c0","org_name":"Broward Health Medical Center","org_type":"healthcare","ransomware":null,"records_affected":126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/broward-health-patient-data-stolen-for-fraud-ring/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/news/local/community/broward/article113948298.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.floridabulldog.org/2016/11/broward-health-data-breach-released-patient-info-to-tax-fraud-ring/"}],"summary":"For the second time in three years, a data breach at Broward Health has caused the release of personal patient information in what one district executive called “a ring of thugs.”  Broward Health disclosed the breach on its website last month, saying it was advised by “law enforc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9ef9070974b00965494f84b7bd0b1d0ffc92428","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6eb85f0-b690-11e8-b56a-011002460f8b"},"incident_date":"2017-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"474e1c7e7a01","org_name":"BJC HealthCare","org_type":"healthcare","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://patch.com/missouri/stlouis/bjc-healthcare-notifies-patients-massive-data-breach"}],"summary":"PUblishing error exposed files w/ PHI on public site for 7 months","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c11a2607e1160bf0ccea6b4ed61db8b3ab41e24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5942bad0-0a35-11e8-bbae-ed39c73f1398"},"incident_date":"2017-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71c0183f1815","org_name":"Bell Canada","org_type":"technology_saas","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/05/16/bell_canada_quieting_fears_post_data_heist/;"}],"summary":"Bell Canada said Tuesday 1.9 million customer account details were swiped by hackers – although stressed no payment card numbers or passwords were slurped.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"039fd07ed328b160775446d0316b4919b2737b6c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f063770-9968-11e7-a8f4-3b6b04fdb9a4"},"incident_date":"2017-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57de77be146f","org_name":"Baptist South Medical Center","org_type":"healthcare","ransomware":null,"records_affected":531,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fl-notice-from-baptist-medical-center-south-to-eeg-patients-regarding-a-missing-hard-drive/"}],"summary":"Lost hard drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4af56994cd4f738a488413213c21384840e41ff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e875e50-c321-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a98633f8f41","org_name":"Advanced ENT Head & Neck Surgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.military-technologies.net/2017/05/31/advanced-ent-head-neck-sugery-detects-invasion-of-privacy-and-theft-of-patient-records/"}],"summary":"ADVANCED ENT HEAD & NECK SUGERY DETECTS INVASION OF PRIVACY AND THEFT OF PATIENT RECORDS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42f7b31b187ec9237a93611f738e9b4b8e01f43e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6c1c660-ca62-11e9-a165-8941f678e264"},"incident_date":"2017-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6788705788e0","org_name":"Adrian College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lenconnect.com/news/20171205/jeopardy-champion-jass-accused-of-hacking-emails,https://www.insidehighered.com/news/2018/07/23/former-adrian-college-professor-pleads-guilty-hacking-college-email-accounts,"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.freep.com/story/news/local/michigan/2018/07/20/stephanie-jass-jeopardy-adrian-college/809384002/"}],"summary":"teacher abuses password reset (sending a single temporary password to everyone and asking them to update their passwords) to read colleagues' emails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64deda9241dfa65ead833ef9e544cc72660a96c3","impact_type":"both","imported_from":null,"incident_date":"2017-02-23","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1ef0de4ecb47","org_name":"Retina-X","org_type":"technology_saas","ransomware":null,"records_affected":71153,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Retina-X","type":"hibp","url":"https://haveibeenpwned.com/Breach/RetinaX"}],"summary":"Retina-X was hacked in February 2017, and customer email addresses and unsalted MD5 password hashes were downloaded before the data was wiped from its servers.","supporting_quote":null,"technology_involved":["mobile device monitoring software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566","T1657"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-28","discovered_date":"2017-03-30","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"106a91d1ee84417ac70a443b9c558f8c74a7f440","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-28","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/_gannet501_1_0.pdf"},"notes":null,"org_country":"US","org_id":"42bbb54996da","org_name":"Gannett Company, Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A phishing attack compromised HR employees' Office 365 login credentials.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67895"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/_gannet501_1_0.pdf"}],"summary":"Gannett reported that phishing compromised HR employees' Office 365 credentials, which were used to send further phishing emails and attempt a fraudulent wire transfer.","supporting_quote":"On Thursday, March 30, 2017, we discovered that several members of our HR department were victims of a phishing attack that compromised their Office 365 account login credentials, including their Gannett email.","technology_involved":["Office 365","email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2b900062e20d3826bb43392281d3202d4da509a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Extreme%20Reach%20--%20Notice%20only%20--%20CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"4de46b8704ae","org_name":"Extreme Reach, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67890"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Extreme%20Reach%20--%20Notice%20only%20--%20CA_0_0.pdf"}],"summary":"Extreme Reach notified individuals of a situation that could potentially affect personal information, with no indication that information was accessed, viewed, or used.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70879c860b3ca900649e334b8ada66630979019a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Marbles%20Aptos%20Notice%20_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"502ab5c8195b","org_name":"Aptos, Inc. on behalf of Retailers in Attached Addendum","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67893"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-25","discovered_date":"2017-03-17","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"43143d5aa836f06fac00e0477a2c4effffeade85","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9696.pdf"},"notes":null,"org_country":"US","org_id":"81049f4b422a","org_name":"Seattle Housing Authority","org_type":"government","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9696.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9696.pdf"}],"summary":"Seattle Housing Authority reported that two laptops containing files that may have included clients’ personal information were stolen in a burglary.","supporting_quote":"On March 17, 2017 SHA discovered that the building that houses its housing inspectors had been burglarized and two laptop computers had been stolen.","technology_involved":["laptop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dff162d91509a9ee16978ff57c32d43fdcf8106","impact_type":"data_theft","imported_from":null,"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"77fb93d4716e","org_name":"R2 Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: R2 (2017 forum breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/R2-2017"}],"summary":"R2 Games' forum was hacked in early 2017, exposing user accounts and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566","T1657"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-04-25","discovered_date":"2017-02-22","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bd57214912c54b035ff75cc8756a1feb473761ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9695.pdf"},"notes":null,"org_country":"US","org_id":"427e37c60ed4","org_name":"Hill Country Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":8449,"reviewed":false,"root_cause":"A staff member was tricked by a phishing email into providing her username and password.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9695.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/HillCountryMemorialHospital.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9695.pdf"}],"summary":"A phishing email compromised a Hill Country Memorial Hospital employee's email account, which was used to submit fraudulent invoices.","supporting_quote":"On February 21, 2017, the Director of Hill Country's Emergency Room Department responded to a phishing email that she believed was legitimate, but which was instead used to compromise her account by tricking her into providing her username and password.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"76735d95d8773efab5ee7a9c66f6a83431397e8f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/WashWizardLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5e3234014bee","org_name":"Wash Wizard, LLC","org_type":"unknown","ransomware":null,"records_affected":7796,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/WashWizardLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-24","discovered_date":"2017-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57d68c1edcb8915b69ed7f119ddb05850f74d5e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DataBreachLetter%20040517%20-%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"f0a74035bed7","org_name":"Los Angeles City Employees Retirement System","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67761"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DataBreachLetter%20040517%20-%20Final_0.pdf"}],"summary":"An email attachment containing members’ personally identifiable information was inadvertently sent to one individual, who confirmed deleting it.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-24","discovered_date":"2017-03-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca8f15f57106ebc839e5f9cdb177500fab8c00db","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ILKB%20LLC%20resubmit_0.PDF"},"notes":null,"org_country":"US","org_id":"a035ad0aaefc","org_name":"ILKB LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67759"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ILKB%20LLC%20resubmit_0.PDF"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9692.pdf"}],"summary":"ILKB LLC reported that private information may have been accessed by unauthorized persons during a cyberattack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"033839c4bcbf3dc9ec353deee4770d75abfe9ee5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98f6ea40-a2d2-11e7-b671-fb4cdbd76ea5"},"incident_date":"2017-04-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e20d7b76e12","org_name":"Family Tree Health Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/family-tree-health-clinic-announces-ransomware-attack-8866/"}],"summary":"Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-21","discovered_date":"2017-04-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0faa857f25d266768c5290f18749076384b4052","impact_type":"unknown","incident_date":"2017-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c84a28d28355","org_name":"George Fox University","org_type":"unknown","ransomware":null,"records_affected":1774,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#George%20Fox%20University-2017-04-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1f2675875637e17378aa2598374f207ece36268","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/BestAmericanHospitalityCorp.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7e5e1806d5a7","org_name":"Best American Hospitality","org_type":"unknown","ransomware":null,"records_affected":8165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/BestAmericanHospitalityCorp.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"660f1fd47c2ab15c3a49c85c300b9abe97d50a13","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"136a88726c4c","org_name":"Fashion Fantasy Game","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: FashionFantasyGame","type":"hibp","url":"https://haveibeenpwned.com/Breach/FashionFantasyGame"}],"summary":"Fashion Fantasy Game exposed user accounts and unsalted MD5 password hashes in a late-2016 data breach.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cdf7c7fa267ed73c595a368f4e79e653a974a5f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d0209970-72f9-11e7-a859-bd14321ac1c3"},"incident_date":"2017-04-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"593469e74f5f","org_name":"Cleveland Medical Associates","org_type":"healthcare","ransomware":true,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/cleveland-medical-associates-attacked-with-ransomware-8868/"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/saint-thomas-health-data-breach-from-misplaced-documents"}],"summary":"Cleveland Medical Associates Attacked with Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40cfae05f8ed858e097696c3acb76861531210ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CUHSD%20Sample%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"aac1fca58290","org_name":"Campbell Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67731"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CUHSD%20Sample%20Letter_0.PDF"}],"summary":"Unauthorized access to the district’s electronic data systems may have involved employee Social Security numbers and addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4791324c6f1addf16737b38606cbb64b73bafefb","impact_type":"data_theft","incident_date":"2016-04-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Northrop%20Grumman%20Individual%20Notification%20Letter_64772036_1_0.PDF"},"notes":null,"org_country":"US","org_id":"f745d2f683ef","org_name":"Northrop Grumman Systems Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Northrop%20Grumman%20Individual%20Notification%20Letter_64772036_1_0.PDF"}],"summary":"An unauthorized third party accessed Equifax Workforce Solutions' W-2 portal and may have accessed and downloaded a Northrop Grumman employee's 2016 W-2 information.","supporting_quote":null,"technology_involved":["Equifax Workforce Solutions","W-2 online portal"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Equifax Workforce Solutions"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"cda952b11d16","name":"Equifax Workforce Solutions"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-18","discovered_date":"2017-01-26","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d880a15790eb550cd9f34d7667a5478031f18440","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-23","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9694.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8601fadebaff","org_name":"Pacific Lutheran University","org_type":"education","ransomware":null,"records_affected":813,"reviewed":false,"root_cause":"A fraudulent email prompted recipients to enter their PLU email account credentials, which were then used to access email accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9694.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9694.pdf"}],"summary":"Pacific Lutheran University reported that a phishing email led to unauthorized access to PLU email accounts containing personal information.","supporting_quote":"That email was fraudulently written to appear as if it was sent by university President, Thomas Krise, and prompted recipients to enter their PLU email account username and password.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-18","discovered_date":"2017-04-18","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa1747d3197aad01a373d8cf4526223f1f8fa988","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a94b55f0-c331-11e7-8a32-4d861156a278"},"incident_date":"2017-04-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c8ea22082ef","org_name":"Airway Oxygen, Inc","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/airway-oxygen-ransomware-attack-may-affect-phi-of-500k"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9711.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Airway%20Oxygen%20Inc.-2017-06-16"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","medical"],"disclosed_date":"2017-04-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"581574b0fe606972c06fd3b7010b2d8173423d0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72e06c40-c48e-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-04-17","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c602881aa38c","org_name":"Torrance Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailybreeze.com/technology/20170619/patient-records-stolen-in-computer-breach-at-torrance-memorial-medical-center"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-97527"}],"summary":"Phishing leads to disclosure of web mail credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ec782135d1b5448ff69918dd6935b78f62a25e79","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/InterContinentalHotelsGroupCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"de01d96410f1","org_name":"InterContinental Hotels Group Company","org_type":"unknown","ransomware":null,"records_affected":15757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/InterContinentalHotelsGroupCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a358851533fd616d5da946a60aa42b8e7fc2d851","impact_type":"unknown","incident_date":"2017-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20letter%20Non-CT%20%28110082750_1%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cebefa6d639","org_name":"DLD Accountancy, LLP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67648"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-17","discovered_date":"2017-10-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"fa98779603d3f0accdd123ac2a5b6336f0c23e8a","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9755.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"cba0034db7dd","org_name":"Combat Brands, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":956,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9755.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-116843"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67664"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combat%20-%20Notice%20only_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Combat%20Brands%2C%20LLC-2017-04-17"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9755.pdf"}],"summary":"Malware on Combat Brands’ websites may have compromised customers’ payment card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad288896270dff209fa12e12122a905508315895","impact_type":"data_theft","imported_from":null,"incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"e681e41d57e2","org_name":"Youku","org_type":"technology_saas","ransomware":null,"records_affected":91890110,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Youku","type":"hibp","url":"https://haveibeenpwned.com/Breach/Youku"}],"summary":"A late-2016 breach exposed Youku user accounts, email addresses, and MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"Chris Vickery","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00150b7095d4a8a99b191d53cb6a4e5762d8088f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f3457340-ca32-11e7-a7a2-ef5723624be0"},"incident_date":"2017-04-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"28c44c7940a2","org_name":"schoolzilla","org_type":"technology_saas","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.paloaltoonline.com/news/2017/04/20/pausd-student-data-exposed-in-data-breach"}],"summary":"The names, addresses, birth dates and test scores of 1.3 million current and former students  were accessed by a well-known computer security researcher. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error","derived":{"actor_id":"chrisvickery"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b6d58fd44d98937bb48ca136900f4a62b205bcc","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Westlake%20Substitute-Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f390f0115254","org_name":"Westlake Touchless Car Wash","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67633"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Westlake%20Substitute-Notice_0.pdf"}],"summary":"An intruder had access to customer names and payment card details for customers who used the car wash between February 6 and February 23, 2017.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3eeea76ebb9b341104e76acb1c5c577c23d0fa0","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter%20_7-26-2017_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1110","org_country":"US","org_id":"891a3de089b9","org_name":"The Neiman Marcus Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Automated attempts using user name and password combinations, apparently sourced from credentials stolen in breaches at other companies, enabled access to Neiman Marcus mobile app accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-100573"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67636"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter%20_7-26-2017_0.pdf"}],"summary":"Neiman Marcus said attackers used login and password combinations to access customer accounts in its mobile app environment.","supporting_quote":"The attackers were apparently aware of some of the user name and password combinations used on some mobile app accounts, including your account(s).","technology_involved":["mobile app"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a97bb8832b65587c0a0aaf52758b8b0a5e0ec9b0","impact_type":"data_theft","incident_date":"2016-09-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHG%20Ad%20Ca%20r2prf_0.pdf"},"notes":null,"org_country":"US","org_id":"a2145b2e10ea","org_name":"Six Continents Hotels, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHG%20Ad%20Ca%20r2prf_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Six%20Continents%20Hotels%2C%20Inc.%20%28d/b/a%20InterContinental%20Hotels%20Group%29-2017-04-14"}],"summary":"Malware accessed payment card data processed at the front desk of certain IHG-branded franchise hotels.","supporting_quote":null,"technology_involved":["payment card processing systems","hotel server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ca459171fd4e917fc842e5558dd15437dd9ffc","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DRB%20Substitute%20Notice-Post_0.pdf"},"notes":null,"org_country":"US","org_id":"11ec4ac4a360","org_name":"Jack Anthony Industries","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67641"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DRB%20Substitute%20Notice-Post_0.pdf"}],"summary":"An intruder accessed customer payment card information for customers who used a payment card at Jack Anthony Industries’ location between February 6 and February 23, 2017.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"178421745ae92bc974432479aa30cbddc5d66f5f","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20CA_1.pdf"},"notes":null,"org_country":"US","org_id":"b3b2bccdec47","org_name":"Delta Career Education Corporation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67632"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20CA_1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/DeltaCareer.pdf"}],"summary":"Delta Career Education Corporation reported suspicious activity in an email account and said information including names, addresses, and Social Security numbers may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc3ec3462c82015acd0170bf4d1862d9985650ea","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0cf3c530-9711-11e7-a11c-5542f7e3819f"},"incident_date":"2017-04-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea06cde42095","org_name":"Cove Family and Sports Medicine","org_type":"healthcare","ransomware":true,"records_affected":4300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cove-family-sports-medicine-recovers-from-ransomware-but-loses-some-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://covemedicine.com/files/Krichev_-_Press_Release_Website_Announcement.pdf"}],"summary":"On April 14, 2017, Cove Medicine’s computer system was infected by a ransomware virus that encrypted its electronic medical software containing patients’ medical records. The ransomware demanded monetary payment from Cove Medicine in order to decrypt the files and allow the pract","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c66796fa9cb270397cef18ef32d9c1ab834b920","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c9302500-a921-11e7-a3c5-dbae2580635b"},"incident_date":"2017-04-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"d2fff5dd4909","org_name":"Chris O'Brien Lighthouse (hospital)","org_type":"healthcare","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2017-04-21/confidential-health-records-found-dumped-in-sydney-bin/8460694"}],"summary":"More than 700 public patients and hundreds more in the private system have had their privacy breached after letters from their specialists to GPs were found dumped in a Sydney bin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a0ff9ffb6a306789c0c1dd6ed1c6622b11b9f33","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/72494_California_0.pdf"},"notes":null,"org_country":"US","org_id":"1e4d5fcff185","org_name":"Bluestem Brands, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67606"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/72494_California_0.pdf"}],"summary":"Cyber-attackers accessed information associated with Fingerhut accounts, potentially including names, contact details, and credit account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-13","discovered_date":"2017-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4ef441e1094ffa283a0eb8529a2106d68230630","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Alamo%20Capital%20-%20consumer%20notification%20letter%20-%2004132017_0.pdf"},"notes":null,"org_country":"US","org_id":"8bd93ed0846f","org_name":"Alamo Capital","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67621"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Alamo%20Capital%20-%20consumer%20notification%20letter%20-%2004132017_0.pdf"}],"summary":"Alamo Capital reported a data security incident that may have involved names, dates of birth, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55cbf39f1a7c7a20ba11426774e69b326d3806c5","impact_type":"unknown","incident_date":"2017-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Intrusion%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98bad352ac61","org_name":"WildWater Express Carwash","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67428"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2b6bc6d96295d9abca58ac5ab5d95093dac21c41","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Tempur-Pedic).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d0d37d1521ab","org_name":"Aptos/Tempur-Pedic","org_type":"unknown","ransomware":null,"records_affected":3250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Tempur-Pedic).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97c289c5a6dddcfe23127efa117b3c760470dcb0","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Substitute%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"1ef5afda5be4","org_name":"Acme Car Wash and Clearwater Express","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67429"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Substitute%20Notice_0.pdf"}],"summary":"An intruder had access to customers’ names, payment card numbers, and security codes for cards used at the organization's locations between February 6 and February 23, 2017.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"05667d245996a56d33610ac7512989a22fb05a34","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9691.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b97b747125d8","org_name":"Lake Kennedy McCulluch CPAs PS","org_type":"unknown","ransomware":null,"records_affected":1688,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9691.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45661e3bb269b4341ae34082c8a26e29389eda26","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20d4d930-c499-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-04-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef3b8462fb5e","org_name":"Southwest Community Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.sys-con.com/node/4099994"}],"summary":"Two burglaries within days result in stolen deivces w/ PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d0973675b2f7f609d5e7c3814ec38a245a52156","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"de2c3a20-c3ca-11e7-8b51-4ba52e63b6cc"},"incident_date":"2017-04-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ae74e5b1b33","org_name":"City of Dallas Office of Emergency Management","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/the-intersect/wp/2017/04/09/someone-hacked-every-tornado-siren-in-dallas-it-was-loud/?utm_term=.09849744ea16"}],"summary":"Dallas Tornado siren hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-07","discovered_date":"2017-04-09","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f2f0fc749b71d5387d339114d51afba63f86ac8b","impact_type":"data_theft","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9698.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered; records_affected not found in source; cleared","org_country":"US","org_id":"8d440cdeb595","org_name":"Solera Holdings, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":33,"reviewed":false,"root_cause":"An employee provided requested employee information in response to a phishing email impersonating a Solera executive.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Solera%20Holdings%2C%20Inc.-2017-04-07"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9698.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9698.pdf"}],"summary":"Solera reported that an employee provided employee information after receiving a phishing email impersonating a company executive.","supporting_quote":"On April 9, 2017, our ongoing investigation confirmed that the source of the suspected data compromise was a phishing email that was sent to one of our employees.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9489cec28cde08347720d60a99ff2dceb7947abe","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-03-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b07778780f72","org_name":"Health Now Networks","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Health Now Networks left a database containing medical records exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Health Now Networks","type":"hibp","url":"https://haveibeenpwned.com/Breach/HealthNowNetworks"}],"summary":"Health Now Networks left a database containing medical records exposed in March 2017.","supporting_quote":"In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed .","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-06","discovered_date":"2016-11-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"48d3d881a08d2bd4682b44d01f94ae3d8bcdf259","impact_type":"unknown","incident_date":"2012-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"67eae840e7e2","org_name":"Multnomah County Data Breach","org_type":"unknown","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Multnomah%20County%20Data%20Breach-2017-04-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-06","discovered_date":"2017-03-13","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8aa2692d4a91fd60ccd912468172c5befec53c4","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Edgar%202_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1021.001","org_country":"US","org_id":"b5239b09bcc8","org_name":"Edgar & Associates LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67343"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Edgar%202_0.pdf"}],"summary":"Hackers accessed Edgar & Associates LLP's system, including through Remote Desktop Protocol, and client personal and financial information may have been involved.","supporting_quote":null,"technology_involved":["Remote Desktop Protocol"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27dde992fce03cf3886a5a68ef717d76ce2b13b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5080b2a0-bda3-11e7-822d-6d41de439a88"},"incident_date":"2017-04-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BS","org_id":"f0247cf201f4","org_name":"Bahamas Water and Sewerage Corporation ‘","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thenassauguardian.com/2017/09/27/wsc-disappointed-information-leak/"}],"summary":"Bahamas Water and Sewerage Corporation ‘disappointed’ over information leak","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-04","discovered_date":"2016-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a2f83723da11abecefba640d294d0611bd09582e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9690.pdf"},"notes":null,"org_country":"US","org_id":"20c46b4d42fa","org_name":"Tempur-Pedic","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9690.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Tempur-Pedic-2017-04-12"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9690.pdf"}],"summary":"An unauthorized individual accessed portions of Tempur-Pedic’s hosted website and installed malicious software designed to capture payment card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb7279859c1fdd5fe044ed1c519b46922cf69582","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Substitute-Notice%20RC_0.pdf"},"notes":null,"org_country":"US","org_id":"7d9aa4f0da41","org_name":"Auto Pride Car Wash","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67321"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Substitute-Notice%20RC_0.pdf"}],"summary":"Auto Pride Car Wash reported that an intruder accessed customers’ names, payment card numbers, and security codes for cards used at its locations during February 2017.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"930ccdb56ac5235fe815cbc0366a012da366a1e4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39b8bc90-9d67-11e7-af90-45f1ceac3d54"},"incident_date":"2017-04-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"515f72e20063","org_name":"ask.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.com/askcom-data-leak-search-engine-accidentally-displays-user-searches-public-2522754"}],"summary":"search engine Ask.com was plagued by a technical issue that resulted in the search queries of its users being publicly viewable online for anyone to see.  The log of user actions was available on the Ask.com server status page, which displayed a rolling log of every request sent ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46c2ec970be86f24852bf366fe6fc0724658a2ff","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/PenServPlanServices.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f38a4c194cb","org_name":"PenServ Plan Services","org_type":"unknown","ransomware":null,"records_affected":2271,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/PenServPlanServices.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"464cd33ba8fed174a39524b2295506be456da882","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f30c7610-c499-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f9083754b144","org_name":"UK Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-4394350/UK-trade-secrets-spotted-7-22.html"}],"summary":"Photos taken of Brexit notes were disclosed to media","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f8b4c3fec85072570d6779cfa3fff9d56c0fb17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eec50b20-ec27-11e7-b683-c1703914e4a4"},"incident_date":"2017-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44115d594b54","org_name":"The Neurology Foundation, Inc.","org_type":"healthcare","ransomware":null,"records_affected":12861,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/the-neurology-foundation-inc--notice-of-data-breach-300513207.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/neurology-foundation-unauthorized-phi-access-could-affect-12k"}],"summary":"In late April 2017, The Neurology Foundation, Inc. (the \"Foundation\") learned that an employee had been making unauthorized purchases using a company credit card.  On May 3, 2017, during the employee's exit interview, the Foundation further learned that the employee had transferr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c803cc70570d9312a07bde5f839d0b64b4ed130d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28fada60-811e-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-04-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"050cd9252c15","org_name":"Southern Oregon University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/how-a-single-email-stole-1-9-million-from-southern-oregon-university/"}],"summary":"Business Email Compromise","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a29841118a69d942fad69462e5b3a4339fb1bd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1426fc70-6b04-11e7-9b43-bf152d61c1c6"},"incident_date":"2017-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15fc4a4812e1","org_name":"Saint Thomas Health","org_type":"healthcare","ransomware":null,"records_affected":2859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newschannel5.com/news/local-news/nearly-3000-patients-notified-of-st-thomas-rutherford-health-information-breach"}],"summary":"Documents found on side of road compromise patients' PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f13d66c1e9a52069ee4f468573205c1da5733145","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1eafd320-df70-11e7-98c9-5b20d709bc39"},"incident_date":"2017-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"712c1d7ec4f1","org_name":"Prairie Mountain Health","org_type":"healthcare","ransomware":null,"records_affected":1629,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://winnipeg.ctvnews.ca/personal-information-at-risk-after-security-breach-at-manitoba-health-authority-1.3435484"}],"summary":"Personal information at risk after security breach at Manitoba health authority ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8341bc02c82a6ab698f54171e205af99841277a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9d4957f0-8427-11e7-a921-2d695ce70b69"},"incident_date":"2017-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a952402a1aac","org_name":"NSWC Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fredericksburg.com/news/crime_courts/nswc-credit-union-reports-data-skimming-at-spotsy-atm/article_8a54ab86-72d1-5842-a19e-f8597deda679.html"}],"summary":"NSWC credit union reports data skimming at Spotsy ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85d5e5aceec87e89a20ab06d0028334b2561e919","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"141570a0-c5a3-11e7-8053-ff1e84d2b694"},"incident_date":"2017-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ff4e44c55297","org_name":"My Health Record","org_type":"government","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytelegraph.com.au/technology/optometrists-and-dentists-will-know-if-youve-had-an-abortion-or-mental-illness-in-health-record-bungle/news-story/b73cccfaf20b6fe96862e9c021b49ae0?nk=0c481d229b89f02a4e6766156e2b427f-1510270364"}],"summary":"THE private health records of Australians can be accessed by more than half a million people under the latest bungle with the $2.2 billion electronic My Health Record.  News Corp Australia has learned that the privacy settings on the government’s computerised My Health Record, wh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12697f2ca220e337a94df3e0359c819e86eb55b9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85fdeee0-a195-11e7-9764-c7e1aa1637e1"},"incident_date":"2017-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c5079fd0c44","org_name":"Midland Regional Hospital","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlands103.com/news-centre/x-ray-file-local-penneys-among-hse-data-breaches/"}],"summary":"In April, a patient’s x-ray report with a sticker from another patient was discovered by staff in Penneys, Mullingar. The clothing store posted the report to one of the patients, who contacted the Citizens Information Centre for advice.  They subsequently sent the records back to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e860e1b4b034d3ab5120eae6aa9f5825ed563101","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d6eead0-72f6-11e7-a859-bd14321ac1c3"},"incident_date":"2017-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61599deb9488","org_name":"Louisville Hall of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/computer-stolen-at-the-hall-of-justice-puts-some-at-risk-for-identity-theft/"}],"summary":"Computer stolen at the Hall of Justice puts some at risk for identity theft - Louisville Hall of Justice","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17af69bacce6ab567d268f57d1d0661e62e99c8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57a4cc00-e356-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8a62d1889473","org_name":"Gloucestershire County Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehackersamachar.com/2017/04/serious-security-breach-at.html"}],"summary":"Publishing error exposes data on vulnerable adults.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"362eb93d8e7c4664ab9a33e27fd6eeece5199d7c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef8f0670-e356-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"155702542cdb","org_name":"Erie County Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://buffalonews.com/2017/04/10/1980540/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/hie-provides-hospital-with-vital-patient-data-after-ransomware-attack"}],"summary":"A virus has shut down the entire computer system at Erie County Medical Center and its Long-Term Care at Terrace View facility since between 2:30 and 3 a.m. Sunday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a6ecb60986e639464f013b74343f8e1774c5ce8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23c26aa0-72f4-11e7-a859-bd14321ac1c3"},"incident_date":"2017-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f48ce52e437","org_name":"Alabama Judicial System","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://whnt.com/2017/04/23/alabamas-online-site-for-crime-records-sometimes-includes-victim-information/"}],"summary":"Alabama’s online site for crime records sometimes includes victim information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ab46f9d0055ebf4a1b5e826523bf1164cb7205","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31abe2c0-94b1-11e7-9340-f70be1ebf87c"},"incident_date":"2017-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c028e70884bf","org_name":"Aadhaar Goverment","org_type":"government","ransomware":null,"records_affected":100000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2017/05/03/concern-mounts-at-indian-id-scheme-as-portals-leak-100m-peoples-details/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.in/2017/04/22/in-a-shocking-breach-aadhaar-details-of-a-million-pensioners-le_a_22051319/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cis-india.org/internet-governance/information-security-practices-of-aadhaar-or-lack-thereof-a-documentation-of-public-availability-of-aadhaar-numbers-with-sensitive-personal-financial-information-1"}],"summary":"In A Shocking Breach, Aadhaar Details Of A Million Pensioners Leaked In Jharkhand","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cb4f5bd7c866802b85e6a5242e70100ab420a28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8be0e550-81f2-11e7-ace7-c5c15a923e51"},"incident_date":"2017-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/long-island/crime/7-eleven-in-smithtown-had-skimming-device-suffolk-police-say-1.13381583"}],"summary":"7-Eleven in Smithtown had skimming device, Suffolk police say","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb1c6b02f3f842ec8760db1c0ba9a1537ab0bfb9","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-12-11","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_5.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"62cd845ab5ca","org_name":"ShowTix4U","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67213"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_5.pdf"}],"summary":"ShowTix4U reported that an unauthorized actor accessed a third-party vendor’s server and installed software on its website that could capture payment card information.","supporting_quote":"Based upon an ongoing forensic investigation, it appears that an unauthorized actor was able to gain access to our third-party vendor’s server and install malicious software on our website.","technology_involved":["website"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-29","discovered_date":"2017-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a68008c60d58a371b6386cdff6aa2e8c852318c","impact_type":"disruption_or_ransomware","incident_date":"2017-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Quench%20--%20notice%20only%201%20--%20California_0_0.pdf"},"notes":null,"org_country":"US","org_id":"5d2eb7c5fda5","org_name":"Quench USA, Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67200"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Quench%20--%20notice%20only%201%20--%20California_0_0.pdf"}],"summary":"Quench USA reported that a virus prevented access to files on its Coffee Service server, which held customer company information that may have included payment-card details.","supporting_quote":null,"technology_involved":["Coffee Service server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e0ae6ae544a2bba3b49a284ee1f82af7be83e92","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OGJS%20-%20Security%20Breach%20Notification%20Sample_0.pdf"},"notes":null,"org_country":"GB","org_id":"5a389d7958c5","org_name":"Oilandgasjobsearch.com Limited","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67192"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OGJS%20-%20Security%20Breach%20Notification%20Sample_0.pdf"}],"summary":"Oilandgasjobsearch.com reported unauthorized access to its systems in which candidate account credentials and CVs may have been accessed.","supporting_quote":null,"technology_involved":["Oilandgasjobsearch.com candidate account system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1114","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-27","discovered_date":"2017-03-17","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ec30a737a5d73997f359eb0b5ad111c8a6b4f6","impact_type":"data_theft","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/redacted_MSM_Letter%20to%20Adults_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"689a81746dd8","org_name":"Mollie Stone's Markets","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67171"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/redacted_MSM_Letter%20to%20Adults_Redacted_0.pdf"}],"summary":"Mollie Stone's Markets reported that a phishing email led to possible unauthorized access to employee W-2 information in an email account.","supporting_quote":"On March 17, 2017, we learned that one of our employees received a phishing email designed to appear as if it came from one of our Senior Executives.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-27","discovered_date":"2017-02-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2de0ff79bb6d7e2ff15ab6d2f4983d98c4d33ed","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Easy%20Breathe%20notice%20only0_0.pdf"},"notes":null,"org_country":"US","org_id":"ab8a4c4912e4","org_name":"Easy Breathe, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67162"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Easy%20Breathe%20notice%20only0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Easy%20Breathe%2C%20Inc.-2017-03-27"}],"summary":"Easy Breathe reported that an unknown individual may have accessed customer payment card information used for purchases at its online store.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e884d564386c36c42a5043e60b082d59e7738a3a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2a66115fc0da","org_name":"Bitcoin Talk","org_type":"other","ransomware":null,"records_affected":501407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bitcoin Talk","type":"hibp","url":"https://haveibeenpwned.com/Breach/BitcoinTalk"}],"summary":"Bitcoin Talk was hacked in May 2015, exposing email addresses and other personal data, as well as password hashes and security-question data.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"HK","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1fbf02d2bf4167aa131b4809ed4f401a95a4669","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c54dc480-0a36-11e8-bbae-ed39c73f1398"},"incident_date":"2017-03-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"a16fa24f395f","org_name":"Hong Kong’s Electoral Office","org_type":"government","ransomware":null,"records_affected":3700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/hong-kong/politics/article/2086038/stolen-laptops-carrying-voter-information-triggers-security;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/hong-kong/politics/article/2098002/hong-kong-privacy-watchdog-blasts-electoral-office-massive;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazineuk.com/regs-slam-electoral-office-after-data-theft-of-all-hong-kong-voters/article/669385/"}],"summary":"Last Monday, staff from the electoral office discovered two laptops had been stolen from a storeroom at the AsiaWorld-Expo centre on Lantau Island, which served as a back-up venue for the chief executive election on March 26. The laptops contained the names, addresses and identit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f2bf4d1c0ab22c7f197d7c65a08213bbb90ef76","impact_type":"data_theft","incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20170317_goldenvoice501_1%20%2800275708%29_0.pdf"},"notes":null,"org_country":"US","org_id":"b3f2de9bedf0","org_name":"Goldenvoice, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67136"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20170317_goldenvoice501_1%20%2800275708%29_0.pdf"}],"summary":"Criminal hackers accessed personal information collected in connection with the 2016 Coachella Music and Arts Festival and through the Coachella.com website.","supporting_quote":null,"technology_involved":["Coachella.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-24","discovered_date":"2017-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccd096ceb9f9ff0611422f0d99a0a2f349583d3a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FIRST%20-%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"2582e0085cee","org_name":"For Inspiration and Recognition of Science and Technology","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67116"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FIRST%20-%20CA%20Notice_0.pdf"}],"summary":"FIRST reported that two community forum websites were accessed and may have contained participants’ usernames, email addresses, dates of birth, and encrypted passwords.","supporting_quote":null,"technology_involved":["FIRST Forum","FIRST Tech Challenge Forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e8b583a65775323d42700341e38ee99324e2538","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f2b0f4c0-a47d-11e7-b5cf-fd750643ba69"},"incident_date":"2017-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f289b26bfe0","org_name":"Surgical Dermatology Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/press-releases/2017/08/notice_of_security_breach.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-23","discovered_date":"2017-02-23","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"236c8f9a670c1dccffc85636c51e17de5f7c4706","impact_type":"unknown","incident_date":"2017-02-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"41dfec7f413d","org_name":"Federal Process Corporation","org_type":"unknown","ransomware":null,"records_affected":213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Federal%20Process%20Corporation-2017-03-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bf79e2527a6218a271071268a86e228a45774d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"967e4890-df6c-11e7-98c9-5b20d709bc39"},"incident_date":"2017-03-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7ab52082ab5","org_name":"Children’s Mercy Kansas City","org_type":"healthcare","ransomware":null,"records_affected":5511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/5.5k-patients-affected-in-childrens-mercy-security-incident"}],"summary":"On March 23, 2017, Children’s Mercy Kansas City in Missouri suffered a security incident involving patient information.  Children’s Mercy said it discovered an unauthorized website containing information collected by one of the hospital’s physicians. That employee was reportedly ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95a10e6b1b0594c28fdbbe5ffe6bfc1c7d657736","impact_type":"disruption_or_ransomware","incident_date":"2017-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Urology%20Austin%20-notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"5ddff69cb3bd","org_name":"Urology Austin","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67070"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Urology%20Austin%20-notice%20only_0.pdf"}],"summary":"Urology Austin reported that ransomware encrypted data stored on its servers and that personal and medical information may have been impacted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34970fbbf11afa19dd32bb8724cfab1798149b93","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"42658b75df5f","org_name":"Torrent Invites","org_type":"other","ransomware":null,"records_affected":352120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Torrent Invites","type":"hibp","url":"https://haveibeenpwned.com/Breach/TorrentInvites"}],"summary":"Torrent Invites’ vBulletin forum was hacked in December 2013, exposing account details and website activity.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"613e2d7de64280b05949b91557d02a4270238313","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"SE","org_id":"adb0e516b3bb","org_name":"SweClockers.com","org_type":"other","ransomware":null,"records_affected":254867,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SweClockers.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/SweClockers"}],"summary":"SweClockers.com was hacked in early 2015, exposing usernames, email addresses and salted password hashes for 254,867 accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbc6948e70b3c9faec4f6617372baa3212b1a263","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-06-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5dbabc0edb90","org_name":"HLTV","org_type":"other","ransomware":null,"records_affected":611070,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HLTV","type":"hibp","url":"https://haveibeenpwned.com/Breach/HLTV"}],"summary":"HLTV's website was hacked in June 2016, exposing account names, usernames, email addresses, password hashes, and website activity.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd1efda9f0762cdf4be1d581b78acd657d1cab23","impact_type":"unknown","incident_date":"2017-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SRG%20--%20Notice%20only%20-%20Regulator%20Notice%20CA%20%28002%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ecaab74daf63","org_name":"Schurman Fine Papers dba Schurman Retail Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67056"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f44716a87999fd6ba8ce09aff4587377c4963ad9","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ca_notice_sample_0.pdf"},"notes":null,"org_country":"US","org_id":"b982540fddca","org_name":"Rent the Runway","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67055"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ca_notice_sample_0.pdf"}],"summary":"An unknown party accessed a Rent the Runway account between December 25, 2016 and February 23, 2017, and personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-21","discovered_date":"2017-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e542e21e2f17aee00a8e66f75e1c8aad3b876d52","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Praetorian%20Digital%20notice%20only%20CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"b60b6b1efb60","org_name":"Praetorian Digital","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67050"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Praetorian%20Digital%20notice%20only%20CA_0_0.pdf"}],"summary":"Praetorian Digital reported unauthorized access to and acquisition of information from PoliceOne Forums, including email addresses, usernames, and hashed and salted passwords.","supporting_quote":null,"technology_involved":["PoliceOne Forums"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef11cbcf720465d29c07d3593ee8d5f2103a0a21","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-03","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LYFE%20Kitchen%20Notice%20of%20Data%20Breach_0.pdf"},"notes":null,"org_country":"US","org_id":"87f58bb9242e","org_name":"LYFE Kitchen Companies, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67060"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LYFE%20Kitchen%20Notice%20of%20Data%20Breach_0.pdf"}],"summary":"LYFE Kitchen reported that malware potentially accessed payment card data at point of sale equipment in five restaurants after its POS vendor reported a possible compromise of its network.","supporting_quote":"LYFE Kitchen was notified by its third-party point of sale (“POS”) vendor that the vendor’s computer network potentially had been compromised by a malware data breach.","technology_involved":["point of sale equipment"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"CrimeAgency","variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4442965e5c13ef151774e94ef7842e7447aaea0d","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2b3b4df199fe","org_name":"CrimeAgency vBulletin Hacks","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unpatched vBulletin forums were compromised.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CrimeAgency vBulletin Hacks","type":"hibp","url":"https://haveibeenpwned.com/Breach/CrimeAgencyVBulletin"}],"summary":"An actor known as CrimeAgency compromised unpatched vBulletin forums and extracted usernames, email addresses, and passwords.","supporting_quote":"In January 2016, a large number of unpatched vBulletin forums were compromised by an actor known as \"CrimeAgency\" .","technology_involved":["vBulletin"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"vBulletin"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"46fb5ad409d8","name":"vBulletin"}],"actor_id":"crimeagency"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57cb6da5fce16eb0527d8a3191887207e415d1aa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6608ff20-c5a9-11e7-8053-ff1e84d2b694"},"incident_date":"2017-03-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ed0225f0dec","org_name":"CoxHealth","org_type":"healthcare","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ky3.com/content/news/coxhealth-stolen-patient-data-417510343.html"}],"summary":" CoxHealth says data of about 80 patients were stolen during a burglary at one of its clinics last week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"b9f6ebb4730a68f56c9a83b21ad48225b15e2d6b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bulletproof%20Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"77b78164beb7","org_name":"Bulletproof 360, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":35716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bulletproof%20360%2C%20Inc-2017-09-15"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-101923"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bulletproof%20Notice_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bulletproof%20360%2C%20Inc.-2017-03-21"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bulletproof%20Notice_0.PDF"}],"summary":"Bulletproof 360 reported that payment card information used on its e-commerce website may have been compromised.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b9065767c4d24de0e8377cf766bd325d9eed020","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78c6b7b0-0b6d-11e8-827c-bba53cbad290"},"incident_date":"2017-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4e6a39c2711","org_name":"America’s Job Link Alliance","org_type":"other","ransomware":null,"records_affected":2231000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.totpi.com/topeka-data-firm-investigating-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.usnews.com/news/best-states/oklahoma/articles/2017-03-22/workforce-data-breach-affects-more-than-430-000-in-oklahoma;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcax.com/story/34976139/thousands-of-vermonters-affected-by-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gadsdentimes.com/news/20170322/americas-joblink-data-breach-affects-alabama;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wgme.com/news/local/department-of-labor-confirms-massive-joblink-data-breach;"}],"summary":"Hackers obtained personal data, including Social Security numbers and birth dates, from a Topeka company that manages information services for workforce agencies in 10 states, officials said Wednesday.  America’s Job Link Alliance, a 50-year-old company, provides a web-based syst","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebbabb86e83117308e2202db7f4bd9c780bf7c61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2364fcb0-d951-11e9-baf3-31037743ca61"},"incident_date":"2017-03-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"c90474e19ac7","org_name":"Wind  Tre","org_type":"technology_saas","ransomware":null,"records_affected":5118,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.telecompaper.com/news/over-5000-wind-tre-customers-hit-by-data-breach--1199392,https://www.key4biz.it/data-breach-colpisce-wind-tre-garante-privacy-lazienda-deve-avvertire-5mila-clienti-coinvolti/191820/"}],"summary":"Personal data accidentally exposed on website during maintenance and not deleted. 402 records accessed, 5,118  expose","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5adc1b76ff51d73ffb08fafb33b95aade851125b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71211bf0-b36a-11e7-ab44-150a764d3763"},"incident_date":"2017-03-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dff9a0ad6821","org_name":"Hyatt Hotels","org_type":"other","ransomware":null,"records_affected":640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-hyatt-hotels-cyber/hyatt-hotels-discovers-card-data-breach-at-41-properties-idUSKBN1CH2WP"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-102651"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hyatt%20Hotels%20Corporation-2017-10-12"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10499.pdf"}],"summary":"Hyatt Hotels Suffers 2nd Card Breach in 2 Years ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-18","discovered_date":"2017-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"812aa61793cef812eda58a583e12d079d207d7f7","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Campbell%20EBP%20Notification%20Letter_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"44ad64e98a28","org_name":"Campbell Taylor & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67009"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Campbell%20EBP%20Notification%20Letter_0.pdf"}],"summary":"Campbell Taylor & Company reported unauthorized access to its main network drive between January 27 and February 2, 2017, but could not determine which files were accessed.","supporting_quote":null,"technology_involved":["main network drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d9bf1312089e396ff94638ba9ded92efa81236","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-07-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ed20058b9c45","org_name":"Soundwave","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Production data was used to populate the test database, which was then inadvertently exposed in MongoDB.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Soundwave","type":"hibp","url":"https://haveibeenpwned.com/Breach/Soundwave"}],"summary":"Soundwave inadvertently exposed production data, including personal information and password hashes, in a MongoDB test database.","supporting_quote":"The breach stemmed from an incident whereby \"production data had been used to populate the test database\" and was then inadvertently  exposed in a MongoDB.","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-17","discovered_date":"2016-10-20","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"854fcaa873f278b7b7d619fb994c27bec4992f0b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-20","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9688.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"86b97a805fb4","org_name":"People for People","org_type":"nonprofit","ransomware":null,"records_affected":821,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9688.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9688.pdf"}],"summary":"People for People reported that an unauthorized individual briefly accessed an employee’s email account, where personal information may have been accessed.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-17","discovered_date":"2017-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"851f456a552e2a4e34df6c7b295041f7d4d7e5f6","impact_type":"data_theft","incident_date":"2017-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_email_0.pdf"},"notes":null,"org_country":"US","org_id":"7e49ed6ec0bc","org_name":"Hampton Jitney, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67007"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_email_0.pdf"}],"summary":"Hampton Jitney reported that an unauthorized user accessed customer accounts and some customer data, including unencrypted passwords, was stolen.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-17","discovered_date":"2017-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a358f8fd8c65d7aa43aa1e2100fd7b82ff08a71","impact_type":"data_theft","incident_date":"2017-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/American%20Tire%20Security%20Breach%20Notification%20-%20NOTICE%20ONLYCA%20Agency%20Letter%20March%2016%202017_0%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"8903297a910c","org_name":"American Tire Distributors Holdings Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67004"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/American%20Tire%20Security%20Breach%20Notification%20-%20NOTICE%20ONLYCA%20Agency%20Letter%20March%2016%202017_0%20%281%29_0.pdf"}],"summary":"American Tire Distributors Holdings Inc. reported that a third party fraudulently obtained a file containing 2016 W-2 information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c189a5d88dadf6990267687bfc9393dc33f4ea2f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e8a26ab0-c49c-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-03-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b377a9b2c50","org_name":"SunTrust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/news/20170405/skimming-device-discovered-at-haines-city-bank-suspects-sought"}],"summary":"ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-16","discovered_date":"2017-01-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"55a5caac6c1940c75b248e7ad8aabaded845d799","impact_type":"unknown","incident_date":"2014-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4275fdc26e98","org_name":"St. Charles Health System, Inc","org_type":"unknown","ransomware":null,"records_affected":2459,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#St.%20Charles%20Health%20System%2C%20Inc-2017-03-16"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e277a29d574f56ef1db4b20614ecaaa1b774517","impact_type":"data_theft","incident_date":"2017-03-02","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NSC%20Data%20Breach_CA%20Letter_030717_0.pdf"},"notes":null,"org_country":"US","org_id":"9604226b8744","org_name":"NSC Technologies, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Payroll staff were deceived by an email posing as the CEO and sent employee W-2 forms to the requester.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66949"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NSC%20Data%20Breach_CA%20Letter_030717_0.pdf"}],"summary":"An attacker posing as NSC’s CEO emailed payroll and obtained copies of employee W-2 forms.","supporting_quote":"Believing the request to come from the CEO, the payroll department forwarded PDF copies of a number of employee IRS W -2 forms to the requestor, who was using a false email address that appeared to belong to NSC’s CEO .","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-16","discovered_date":"2017-02-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9694a73ab35bd57c1fc0d19a63c05c38dde55c32","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-11","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9687.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"59b06bf25652","org_name":"Northwest Christian Schools, Inc.","org_type":"education","ransomware":null,"records_affected":526,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9687.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9687.pdf"}],"summary":"Northwest Christian Schools learned of a data security incident that may have exposed personal information stored on its servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6856d83cc1c67b81ae6f981094f65574a76292f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6f09e488283b","org_name":"Wishbone","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Wishbone (2016)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Wishbone"}],"summary":"Wishbone suffered a data breach in August 2016 that exposed user information, including email addresses, birthdates, genders, and phone numbers.","supporting_quote":null,"technology_involved":["Wishbone mobile app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3df5c1968dd1900cab0e34a47a90659f080492","impact_type":"unknown","incident_date":"2013-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ZST%20Notification%20Letter%20CA%20Sample%202_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbee62bb7c37","org_name":"Zest Dental Solutions","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66908"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ce3ba1af726adf0d6388bb755e7913cdaac73500","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/WallTitusLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c02fd2721f54","org_name":"Wall Titus, LLC","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/WallTitusLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7229da86d5601862ec60e21fdce6e140cdb929c9","impact_type":"data_theft","imported_from":null,"incident_date":"2017-03-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"ZA","org_id":"fd0212b8bce5","org_name":"Ster-Kinekor","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An enumeration vulnerability in the API of Ster-Kinekor's old website exposed customer data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ster-Kinekor","type":"hibp","url":"https://haveibeenpwned.com/Breach/SterKinekor"}],"summary":"An enumeration vulnerability in Ster-Kinekor's old website API exposed customer data, including personal information and plain-text passwords.","supporting_quote":"In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website.","technology_involved":["website API"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1021.001"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-13","discovered_date":"2017-02-06","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"748c0c463a527ebbc5c55220a8ce5b37f4b3939e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1021.001","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ondracek%20Version%201_0.pdf"},"notes":null,"org_country":"US","org_id":"280c4dc8d84e","org_name":"Ondracek & Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66889"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ondracek%20Version%201_0.pdf"}],"summary":"Hackers accessed Ondracek & Company's system through Remote Desktop Protocol, potentially exposing clients' personal and financial information.","supporting_quote":"Through investigation we have discovered that the unauthorized access occurred through Remote Desktop Protocol between November 21, 2016 and February 6, 2017.","technology_involved":["Remote Desktop Protocol"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-13","discovered_date":"2017-03-09","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aa94671a43637d4e84e2f6aaa8a613825f41dbff","impact_type":"unknown","incident_date":"2017-03-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"39c3b096bc0e","org_name":"BBB Industries LLC","org_type":"unknown","ransomware":null,"records_affected":444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#BBB%20Industries%20LLC-2017-03-13"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"22bd9fa8c0f307b1a3e06d5462865ae07d277d6b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Arbys%20Restaurant%20Group%2C%20Inc.%2013%20Mar%2017%20-%20Consumer%20Notice.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c160ef4acce","org_name":"Arby's Restaurant Group, Inc. (ARG)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Arbys%20Restaurant%20Group%2C%20Inc.%2013%20Mar%2017%20-%20Consumer%20Notice.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38cf355c1a182627ba9930c50aab803a0464f4b4","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bambeco%20notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"502ab5c8195b","org_name":"Aptos, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bambeco%20notice%20only_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Aptos%2C%20Inc-2017-03-24"}],"summary":"An unauthorized person or persons remotely accessed Aptos's eCommerce platform and accessed consumers’ online transaction data.","supporting_quote":null,"technology_involved":["eCommerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1f7f091939de68b9d16fd00b4f7a3136355bcb3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17d704f0-8125-11e7-abf2-119fe288b6e8"},"incident_date":"2017-03-10","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12def1b86805","org_name":"Paratransit Services","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tdn.com/news/local/transportation-company-in-washington-oregon-california-falls-for-email-scam/article_5b982b97-5338-57b8-b62f-00df2bd3b11f.html"}],"summary":"W2 phishing scam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-10","discovered_date":"2016-12-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"946b2dc34e589cf5b020b902413cc67d60ba1128","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-12-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"12d2f145e730","org_name":"Hutchinson and Bloodgood LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66868"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_1.pdf"}],"summary":"A spear-phishing email was sent to an employee, and the firm’s review indicated that some company data may have been accessed.","supporting_quote":"On December 21, 2016, we learned that a targeted “spear phishing” email was sent to employees of multiple CPA firms, including a Hutchinson and Bloodgood LLP employee.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-10","discovered_date":"2017-02-08","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e640aea4090ac74ee02874b507b8ac70b13c5241","impact_type":"unknown","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4f55a3a311af","org_name":"Century, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Century%2C%20LLC-2017-03-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-10","discovered_date":"2016-11-28","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"600453602dbbc65a5a371b387a937b0fb93b0650","impact_type":"unknown","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"51882ef32986","org_name":"Bluemercury, inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bluemercury%2C%20inc.-2017-03-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-10","discovered_date":"2016-11-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2a6b7b613dfe4a9e3c08d414d9adc931ab3e293e","impact_type":"data_theft","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9686.pdf"},"notes":null,"org_country":"US","org_id":"61ea925aa5cd","org_name":"Bambeco Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9686.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bambeco%2C%20Inc-2017-03-24"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9686.pdf"}],"summary":"An intruder accessed consumer transaction data on the Aptos-hosted eCommerce platform used by Bambeco.","supporting_quote":null,"technology_involved":["Aptos eCommerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-03-09","discovered_date":"2017-01-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6283752639f049179d46e11bdbaedfb32d59ff3a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tarleton%20-%20Employee%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"15962c0cb0cc","org_name":"Tarleton Medical","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66848"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tarleton%20-%20Employee%20Notification%20Letter_0.pdf"}],"summary":"Tarleton Medical reported unauthorized access to computer systems that stored records, which may have included patients’ personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcb80ae16fe39e506d35fdaa3a5a0b554d1cb033","impact_type":"unknown","incident_date":"2016-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20AG%20notice%20attach.%20-%20prana_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01d07587ce33","org_name":"prAna","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66814"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#prAna-2017-03-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-08","discovered_date":"2017-02-06","entry_asset":"remote_desktop","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fed6c4817f4b5690022d9b4c6922269e2385a35","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Friedman%20Notification%20Letter%201_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1021.001, T1133","org_country":"US","org_id":"9b035869ba7d","org_name":"Friedman & Perry, CPA's","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66802"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Friedman%20Notification%20Letter%201_0.pdf"}],"summary":"Friedman & Perry, CPA's reported unauthorized access to client information through Remote Desktop Protocol.","supporting_quote":null,"technology_involved":["Remote Desktop Protocol"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1133"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-08","discovered_date":"2017-02-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8114a3d4dc0f679b7cf377bb7f16988d37ecaca9","impact_type":"data_theft","incident_date":"2016-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9685.pdf"},"notes":null,"org_country":"US","org_id":"77e2f600741f","org_name":"Atlantic Cigar","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9685.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Atlantic%20Cigar-2017-03-09"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9685.pdf"}],"summary":"Atlantic Cigar reported that an intrusion into Aptos systems exposed customer transaction data, including contact and payment card information.","supporting_quote":"On February 10, 2017, Aptos notified us that there had been remote access intrusion to Aptos’ systems that resulted in unauthorized access to our customers’ information.","technology_involved":["Aptos","customer ordering database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial","internal"],"disclosed_date":"2017-03-07","discovered_date":"2017-02-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"77d97c02613be2bf57acb41220eb5f4f36e1c9cf","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9683.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1567","org_country":"US","org_id":"3987c85cfdc5","org_name":"Russell Investments","org_type":"financial","ransomware":null,"records_affected":1291,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9683.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9683.pdf"}],"summary":"A Russell Investments associate sent files containing personal information to a personal Gmail account and downloaded them to a personal device.","supporting_quote":null,"technology_involved":["Gmail","personal computing device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be5fa945b858e029aadc65b001bf11073999e860","impact_type":"data_theft","imported_from":null,"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"02e4d8a0bd73","org_name":"Little Monsters","org_type":"other","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Little Monsters","type":"hibp","url":"https://haveibeenpwned.com/Breach/LittleMonsters"}],"summary":"The Little Monsters fan site suffered a breach affecting 1 million accounts, with usernames, email addresses, dates of birth, and bcrypt password hashes exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-03","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61efb1cf580be3a9fa9593cd8d288af63d02facf","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/R026_v01_CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b931213bafdd","org_name":"West Music Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Malware injected into Aptos's system may have allowed unauthorized access to customer and payment card information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/R026_v01_CA%20Notice_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#West%20Music%20Company-2017-03-03"}],"summary":"West Music reported that malware in Aptos's digital commerce platform may have exposed customer and payment card information from transactions on its websites.","supporting_quote":"The investigation determined that malware injected into the Aptos system may have allowed unauthorized access to certain customer and payment card information maintained by Aptos.","technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61a56f1d4bb59cbee18a22c4cd8d526367c28db2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47aad1c0-0175-11ea-9d67-277844cc3a60"},"incident_date":"2017-03-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c3c52dc497e","org_name":"Tucson Sunnyside Unified School District","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.kold.com/story/34679245/sunnyside-school-district-accidentally-releases-employees-personal-information/"}],"summary":"school district emails employee PII to all other employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-03-03","discovered_date":"2016-12-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b67b36f3fa1b59ce978be0a1f7d496cee420b40e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-12-22","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20Members_BND_0.pdf"},"notes":null,"org_country":"US","org_id":"aa65a8436aaf","org_name":"Brand New Day","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20Members_BND_0.pdf"}],"summary":"A contracting provider accessed Brand New Day members’ personal health information through a third-party vendor system.","supporting_quote":"A contracting provider was able to access (via a third party vendor system ) data containing your name, date of birth, Medicare ID number, ad dress, and phone number.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda03cf5f5ee7b3768a4ccb768d23d0ef1b63e25","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-02-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_3.pdf"},"notes":null,"org_country":"US","org_id":"0be1bec54a80","org_name":"Orange County Global Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_3.pdf"}],"summary":"An employee inadvertently emailed a statistical report containing patient information to an unintended recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-12","id":"43d56b4f633c69c91ad916a03cc884f374fe2c52","impact_type":"data_theft","incident_date":null,"initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Lexington2Schools.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"c010533bbdee","org_name":"Lexington County School District Two","org_type":"education","ransomware":null,"records_affected":1479,"reviewed":false,"root_cause":"A social engineering scam resulted in the disclosure of W-2 information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Lexington2Schools.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/Lexington2Schools.pdf"}],"summary":"Lexington County School District Two reported that a social engineering scam led to disclosure of employees’ W-2 information.","supporting_quote":"We recently fell victim to a social engineering scam which resulted in the disclosure of your W-2 information.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-13","veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47d4394f56c564d36bab5c4658499193cf093658","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0f9a3930-72d7-11e7-ace1-3bcdf5dc8d5d"},"incident_date":"2017-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32bdf8870d20","org_name":"U.S Secret Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/2017/03/17/laptop-containing-trump-tower-plans-stolen.html"}],"summary":"Laptop containing Trump Tower plans and Clinton email probe stolen from Secret Service agent's car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc623e04b368760a05238bf69514d97c62914635","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a25dd8a0-8432-11e7-a921-2d695ce70b69"},"incident_date":"2017-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37eac0b2cf9c","org_name":"Tyler School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs19.tv/news/local/tyler-isd-leaks-employee-data-after-phishing-attack/419743827"}],"summary":"Tyler ISD leaks employee data after phishing attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aa5361cbf0f68f64a596ad6f7e1bb8034f8897d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a0253dd0-e355-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82c8d5aed1df","org_name":"Trios Health","org_type":"healthcare","ransomware":null,"records_affected":569,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://keprtv.com/news/local/trios-health-employee-snoops-on-600-patients-hospital-takes-action-to-safeguard-records"}],"summary":"In March, Trios Health officials discovered unusual activity in their electronic health system, pointing to an employee snooping on 600 patients' private information. The records accessed may have included information pertaining to Trios Health visits (not including to outpatient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55fa0c18c30003452ff7d3c850c86cc21cf4bee1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"efe508f0-9cd2-11e8-875e-27a7b7789f98"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"954257401a4d","org_name":"TCM Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://latesthackingnews.com/2018/08/04/tcm-bank-data-breach-exposed-user-data-for-over-a-year/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2018/08/credit-card-issuer-tcm-bank-leaked-applicant-data-for-16-months/"}],"summary":"TCM Bank, a company that helps more than 750 small and community U.S. banks issue credit cards to their account holders, said a Web site misconfiguration exposed the names, addresses, dates of birth and Social Security numbers of thousands of people who applied for cards between ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e47300635997524445860914d3024f4be52e944","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3e2ceda0-c58a-11e7-8314-790c8d59abbb"},"incident_date":"2017-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3101995005c2","org_name":"Staminus Communications","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/"}],"summary":"Compromise of network using stolen credentials among other undisclosed methods","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f6b35ec6ae76b8d6d2be51177595e602bcaab95","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stallcup%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"3cef59962a46","org_name":"Stallcup & Associates CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66627"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stallcup%20Notification%20Letter_0.pdf"}],"summary":"Stallcup & Associates CPAs reported unauthorized access to an employee email account using obtained credentials, with no evidence that information was viewed or exfiltrated.","supporting_quote":"While there is no evidence of data viewing or exfiltration of information, the fraudulent person(s) did obtain the employee’s email credentials and therefore had access to her email account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da4e58c2b2f9b09eec9b1d5fc72f3a6a12e08d97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c40f94c0-d568-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7ba137f941b3","org_name":"Pembroke House Surgery","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.devonlive.com/devon-doctors-surgery-vows-to-learn-from-security-breach/story-30208436-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-devon-doctors-surgery-says-sorry-for-data-breach/"}],"summary":"A Devon doctors’ surgery that attempted to improve its service for patients has seen its efforts backfire after a newsletter was sent out with patients’ email addresses on display. The security breach affected around 1,000 patients of Pembroke House Surgery in Paignton on Tuesday","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60d2f71c76f667fc211be51e20da2437ce86c0f0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e88712c0-d56c-11e7-af4f-6b5d4514198e"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"c571e1c68b65","org_name":"New Zealand Ministry of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.odt.co.nz/news/dunedin/patient-data-disabled"}],"summary":"A new patient information system used by general practitioners had to be disabled yesterday because of a risk of data breach.  ``The ministry understands that patient demographic data has been transported from GP practices in an unencrypted form to an online Medtech hub.  ``The s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa6095f7a41f2c69d585ddbc3d27ac4d67e33b12","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13b73400-bda0-11e7-822d-6d41de439a88"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"18d66b91f3f2","org_name":"MyBroadband","org_type":"technology_saas","ransomware":null,"records_affected":30000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fin24.com/Tech/News/millions-of-south-africans-personal-information-may-have-been-leaked-online-20171017"}],"summary":"Massive South African database leak reveals private data of 30 million people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"784dff436a5a3157df50c8dc2a4af0395a3bda76","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/redacted%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"11f91bf444a6","org_name":"MetWest Terra Hospitality, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66620"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe511c74b7bb5423c3b82e0dc954b09f095cdf93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94aef4f0-6beb-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77d72cfaf4f5","org_name":"Locklear Dodge","org_type":"retail_ecommerce","ransomware":null,"records_affected":267,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.usnews.com/news/best-states/alabama/articles/2017-03-02/police-verizon-employees-used-stolen-info-to-buy-phones;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tuscaloosanews.com/news/20170301/3-women-charged-with-trafficking-stolen-identities"}],"summary":"Verizon Employees Used Stolen Info from car dealership to Buy Phones","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"badba92d3891bdacf36c18de6b65fef8109bab7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9bb29070-d56a-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"885314a6a677","org_name":"John Fawkner Private Hospital","org_type":"healthcare","ransomware":null,"records_affected":31,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/victoria/dozens-of-patients-medical-records-found-lying-in-melbourne-street-20170324-gv62op.html"}],"summary":"A hospital is being investigated for breaching the privacy of dozens of patients after medical records revealing a \"swollen penis\" and mental illnesses among other things, were found in a Coburg street.  The documents included queries about whether a patient should be resuscitate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"057baedaae4f95494b6f6188118e579f70eaf59d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1ad68bc0-8ab2-11e8-aafc-8b374e4aa1f3"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1c01c49bedd","org_name":"House of Charity","org_type":"nonprofit","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/news/woodbury-man-pleads-guilty-identity-theft-around-300-people/4992293/"}],"summary":"A Woodbury man has pleaded guilty to multiple charges after authorities say he stole the identities of approximately 300 people, many of them linked to the Twin Cities charity where he worked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4765de1b1875e93f3dc2499c80b956d52baabbb5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b947dd80-80ff-11e7-8520-b5d4bef506ca"},"incident_date":"2017-03-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8b76c98aa66","org_name":"Grayson County Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdbj7.com/content/news/Grayson-County-Public-Schools-catches-W-2-phishing-scam-e-mail-416892073.html"}],"summary":"Grayson County Public Schools catches W-2 phishing scam email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7934a5f945f82da7a78b18f3ced2838c2543aee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96e7c560-0173-11ea-9d67-277844cc3a60"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a26f4a07538c","org_name":"Fylde Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.blackpoolgazette.co.uk/news/council-blunder-leaks-personal-data-on-web-1-8452142"}],"summary":"city council publishes PII along with survey result on website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4412bde691c3f87266ed05a7686522323904c326","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"848100e0-ac78-11e8-8036-a30436c88231"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"e005b64493f5","org_name":"Dracore Data Sciences","org_type":"technology_saas","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://memeburn.com/2018/01/south-africa-data-breach-lessons/"}],"summary":"The personal data of millions of South Africans was compromised when a database backup file titled “masterdeeds.sql” was leaked publicly online. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35405daea56a5c8b8b4977161c5c1aa49bf24c1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"251a97c0-d958-11e9-baf3-31037743ca61"},"incident_date":"2017-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2423ff001908","org_name":"Denver Public Schools","org_type":"education","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kdvr.com/2017/04/05/phishing-scam-diverts-more-than-40k-from-denver-public-schools/"}],"summary":"phishing steals creds.  Used to change direct deposit of 30 people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c5e078c198dd626869d69bc8873dc4f6be564b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3f947010-e2da-11e7-a8b4-b50015373b0a"},"incident_date":"2017-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"762382414e4e","org_name":"Cook County Health and Hospitals System","org_type":"healthcare","ransomware":null,"records_affected":727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/cook-county-health-and-hospitals-system-experian-health-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/business/ct-biz-cook-county-health-data-breach-1114-story.html"}],"summary":"TThe federal government is investigating a security lapse that exposed the personal information of more than 700 patients at Cook County Health and Hospitals System this year.  The hospital system publicly acknowledged the incident in a news release in October, saying that it was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1c532b31b194c6f91f32faeb3e9e54688539feb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ed597750-7c54-11e7-8ec0-e369e9638092"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84d8c961005e","org_name":"Colorado Department of Health Care Policy and Financing","org_type":"government","ransomware":null,"records_affected":822,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/2017/07/13/colorado-medicaid-system-data-breach-exposed-private-information-822-people/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44181781465a8ef0fd2b74444ffb083ce6fa5a8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"523b9080-e2db-11e7-a8b4-b50015373b0a"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c9de9743a07","org_name":"Colonial Gardens Alzheimer’s Special Care Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wistv.com/story/36805717/west-columbia-colonial-garden-alzheimers-facility-under-investigation-by-dhec"}],"summary":" It also notes that the facility was notified that a staff member stole a resident’s credit cards and used them from March to April, even opening an account at a department store.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18f4c8d424c036b772d3a21c2397fb2be0c434cb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ed75b3b0-80fb-11e7-8520-b5d4bef506ca"},"incident_date":"2017-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2685c23e4f87","org_name":"Clearfield County Children and Youth Family Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wearecentralpa.com/news/clearfield-county-cys-notifies-residents-about-security-breach/759604244"}],"summary":"Clearfield County Children & Youth Family Services notifies residents about security breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abbe20fe3826423610a6e3042537eb8d9e35dbbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bce2bb90-6c87-11e7-8419-7d473c8dcba3"},"incident_date":"2017-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09ed8f7bbaed","org_name":"California Association of Realtors","org_type":"retail_ecommerce","ransomware":null,"records_affected":1033,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/2017/07/10/hackers-nab-credit-card-data-from-up-to-1000-california-realtors/"}],"summary":"Just over 1,000 California Association of Realtors members may have been affected by a breach of the online store they use to buy everything from blank home sales contracts and disclosure forms to books, software, magnets, lapel pins and coffee mugs.  The malware attack, which oc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20d5e80ec3df80bfe5ad4a4c82632238b2afa5be","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d90a83e0-df67-11e7-98c9-5b20d709bc39"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c09c863bb3b","org_name":"Beacon Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wsbt.com/news/local/beacon-health-systems-investigating-security-breach"}],"summary":"Beacon Health Systems investigating security breach ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efeb5001c1252349dfd8450b702a41790b5f1b90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60a4a300-c599-11e7-8053-ff1e84d2b694"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9eef137269f1","org_name":"Arkansas Department of Human Services","org_type":"government","ransomware":null,"records_affected":26044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/hospital-employee-fired-over-26000-record-arkansas-dhs-privacy-breach-8969/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.arkansasmatters.com/news/local-news/arkansas-info-breach-for-26k-on-medicaid/811920842"}],"summary":"A former employee of the Arkansas Department of Human Services (DHS) has been fired from her new position at the state hospital for emailing spreadsheets containing the protected health information of patients to a personal email account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"158fc9e0e24c78ad41db3d3e7823dccb8b779093","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41782970-0c90-11eb-ac0d-91a70ee1d655"},"incident_date":"2017-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9682e75d6ddf","org_name":"ACM Global Laboratory","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.whec.com/monroe-county-ny-news/hamlin-woman-accessing-medical-records-hundreds-of-times/5641730/?cat=565"}],"summary":"A former health care worker with ACM Global Laboratory faces hundreds of felony charges, accused of illegally rifling through confidential medical records, for more than two years, in what her alleged target said was a hunt for dirt in a child custody fight.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-28","discovered_date":"2017-02-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"db349579299936bed826b0da6d7e29314f62f2f7","impact_type":"unknown","incident_date":"2017-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"15e7458e1644","org_name":"Redmond School District","org_type":"unknown","ransomware":null,"records_affected":1120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Redmond%20School%20District-2017-02-28"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"afba682c77aa01705e656a51085ee5ff6fc1b35c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Atlantic%20Cigar).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbd085e89058","org_name":"Aptos, Inc./Atlantic Cigar","org_type":"unknown","ransomware":null,"records_affected":477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Atlantic%20Cigar).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-27","discovered_date":"2017-02-10","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d4942ad0ce1d1ea210cf9d874a31a02945219c","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JWCPA%20-%20Notice%20of%20Data%20Event%20-%20Notice%20Only%201_0_0.pdf"},"notes":null,"org_country":"US","org_id":"36783627a9e8","org_name":"John D. Williamson, Certified Public Accountant","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66571"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JWCPA%20-%20Notice%20of%20Data%20Event%20-%20Notice%20Only%201_0_0.pdf"}],"summary":"Two laptops containing client tax information were stolen from a car, with no evidence that the information was accessed or acquired.","supporting_quote":"On the morning of February 10, 2017 I discovered that my car had been stolen sometime between the night of February 9, 2017 and that morning.","technology_involved":["laptop computers","tax software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85546a2117652395d0ef87c26e19b351816e9cbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"de6e2370-8aaf-11e8-874b-dd84fb61b260"},"incident_date":"2017-02-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"76c813a8a417","org_name":"Independent Inquiry into Child Sexual Abuse (UK)","org_type":"government","ransomware":null,"records_affected":90,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/07/18/ico_hands_sexual_abuse_inquiry_200k_fine_for_security_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-44872880"}],"summary":"The UK's data watchdog today issued the Independent Inquiry into Child Sexual Abuse (IICSA) a £200,000 penalty after it sent a bulk email to participants that identified possible victims of historical crimes.  A employee of the inquiry fired a blind carbon copy (BCC) email to 90 ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbb2747e6b7369cef27ef0bb9e7fa83031b0abc4","impact_type":"both","imported_from":null,"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"317bf67f2c87","org_name":"CloudPets","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":"CloudPets left its database publicly exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CloudPets","type":"hibp","url":"https://haveibeenpwned.com/Breach/CloudPets"}],"summary":"CloudPets left its database publicly exposed, and external parties downloaded data that included email addresses, passwords, and children's names.","supporting_quote":"In January, the maker of teddy bears that record children's voices and sends them to family and friends via the internet CloudPets left their database publicly exposed and it was subsequently downloaded by external parties (the data was also subject to 3 different ransom demands).","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a1f73418466b5bc4c198296c10d455bd94561d2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e7877d70-c49f-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-02-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea4dc48aa4b7","org_name":"Association of British Travel Agents","org_type":"nonprofit","ransomware":null,"records_affected":43000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ttgmedia.com/news/news/police-investigate-hack-of-abtas-web-server-9624"}],"summary":"Unknown web vuln led to compromise of PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cd14c680943e09bba8d4d4a3c252bb85a1cd8b76","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Abbott%20Stores).pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3ecb27a11aa","org_name":"Aptos, Inc./Abbott Stores","org_type":"unknown","ransomware":null,"records_affected":1031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Abbott%20Stores).pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb385231d8e1d6798429686ab088cadb9ecd77e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mrs_Prindables_California_Courtesy_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"502ab5c8195b","org_name":"Aptos Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66569"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mrs_Prindables_California_Courtesy_Notice_0.pdf"}],"summary":"Unauthorized people accessed Aptos’ platform and placed malware on it, potentially exposing customer information for 40 online retailers, including Mrs Prindables.","supporting_quote":null,"technology_involved":["Aptos platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2017-02-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8e957cb5fcfa9af924fb2f599e6cf95b1c3bdfb6","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9678.pdf"},"notes":null,"org_country":"US","org_id":"71c1f95a7e7a","org_name":"Vapour Organic Beauty, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9678.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vapour%20Organic%20Beauty%2C%20LLC-2017-03-10"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9678.pdf"}],"summary":"Vapour Organic Beauty customer transaction information was accessed during an intrusion into Aptos systems.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fc4688a8f198a4fffd6072fc3c71b64db1a6a3f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9679.pdf"},"notes":null,"org_country":"US","org_id":"93d999a72813","org_name":"Plow and Hearth, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9679.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Plow%20and%20Hearth%2C%20LLC-2017-03-10"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9679.pdf"}],"summary":"Plow and Hearth customer transaction information was accessed during an intrusion into Aptos systems hosting retailer data.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ae156da3e1accdea4501dc52e6f75ad52082e2a0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9676.pdf"},"notes":null,"org_country":"US","org_id":"89201b9f1cbc","org_name":"Nutrex Hawaii","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9676.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Nutrex%20Hawaii%2C%20Inc-2017-03-10"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9676.pdf"}],"summary":"An intrusion into Aptos systems resulted in unauthorized access to consumer transaction data associated with retailers, including Nutrex Hawaii.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4f834b3266cd8d74d3c71f3dd3930ec5c1ddcff3","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"skipped","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9674.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a12a0aef83e2","org_name":"New England Biolabs, Inc.","org_type":"unknown","ransomware":null,"records_affected":746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9674.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ac69a47432a6a6c1d5861050e902be963a436419","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"unknown","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9681.pdf"},"notes":null,"org_country":"US","org_id":"3e5ff321d2dd","org_name":"Movie Mars, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9681.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Movie%20Mars%2C%20Inc-2017-03-10"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9681.pdf"}],"summary":"Movie Mars, Inc. customers’ online transaction information was accessed during an intrusion into Aptos’s systems.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos, Inc."},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f27874dd1692f8692c1e4daa2d3da2480023bc3f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f58294d0-a7be-11e7-9f87-7fffd7137a55"},"incident_date":"2017-02-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"409c25b677fa","org_name":"Lifespan Healthcare","org_type":"healthcare","ransomware":null,"records_affected":20431,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/phi-security-of-20k-possibly-affected-from-ri-laptop-theft"}],"summary":"individual broke into an employee’s car and stole several items, including a laptop containing a healthcare providers patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"595ab39a52454a85f3d34121ac13c1958fe12dbb","impact_type":"data_theft","imported_from":null,"incident_date":"2016-02-26","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9680.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7ce3d7d91d3b","org_name":"Century, LCC","org_type":"retail_ecommerce","ransomware":null,"records_affected":639,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9680.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9680.pdf"}],"summary":"Century, LCC customers’ personal and payment-card information was accessed in an intrusion affecting the Aptos digital commerce platform.","supporting_quote":"Aptos has determined that there has been remote access intrusion to its systems that resulted in unauthorized access to information of Individual Consumers.","technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"21fb5edf72bd0400fa668a5238b172f6e42e8f41","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9677.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"dbb928a049aa","org_name":"Blue Mercury, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9677.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9677.pdf"}],"summary":"Blue Mercury customer transaction data was accessed during an intrusion into Aptos systems.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66f794b0cf25a097843ef38ca80a5b47a0b04ff8","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Aptos%2C%20Inc%20multiple%20notices%20only_1.pdf"},"notes":null,"org_country":"US","org_id":"502ab5c8195b","org_name":"Aptos","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66556"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-67320"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Aptos%2C%20Inc%20multiple%20notices%20only_1.pdf"}],"summary":"Intruders placed malware on Aptos servers and accessed payment card and personal information for customers of retailers using its platform.","supporting_quote":"The intruder(s) placed malware on Aptos’ servers, and by doing so gained access to our customers’ payment card data, including payment card numbers.","technology_involved":["Aptos"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-25","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"cc7ff920f3e41d048d65b7f53cb1e9aab5c9646c","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9675.pdf"},"notes":null,"org_country":"US","org_id":"bf5892ead83f","org_name":"Alpha Industries","org_type":"retail_ecommerce","ransomware":null,"records_affected":1013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9675.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Alpha%20Industries-2017-03-09"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9675.pdf"}],"summary":"Unauthorized access to consumer transaction data associated with Alpha Industries occurred through an intrusion into Aptos systems.","supporting_quote":null,"technology_involved":["Aptos digital commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"hacking","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25a8c218df993de6ca97980ae39df1af2b2e2f5d","impact_type":"unknown","incident_date":"2016-10-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Rod%27s%20Western%20Palace%20-%20CA%20Notification%20%286607474-2x7AB84%29_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1953a52c1a9a","org_name":"Rod's Western Palace","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66493"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b719c5c62f95d77cd3d4e9c108685c54e887af3c","impact_type":"unknown","incident_date":"2017-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NPC_Breach_C5920_CA_Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"8d285486ea0b","org_name":"Roberts Hawaii, Inc.","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66502"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NPC_Breach_C5920_CA_Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Roberts%20Hawaii%2C%20Inc.-2017-02-24"}],"summary":"Roberts Hawaii received reports of fraudulent payment-card charges shortly after customers used their cards to make purchases on its website and investigated its website network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d42b5b344086a8ba37e1361189550ac9aa6fa42d","impact_type":"unknown","imported_from":null,"incident_date":"2017-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9672.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5b3f761c3416","org_name":"Pasco Rentals, Inc.","org_type":"unknown","ransomware":null,"records_affected":6300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9672.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9672.pdf"}],"summary":"Pasco Rentals, Inc. notified affected people about an incident dated January 12, 2017.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-24","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5835e5cf9e336f63290f7b7065e7c4ba7fb16a11","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9669.pdf"},"notes":null,"org_country":"US","org_id":"9be16188a6c3","org_name":"Mrs Prindables","org_type":"retail_ecommerce","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9669.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Mrs%20Prindables-2017-02-27"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9669.pdf"}],"summary":"Customer information for Mrs Prindables was exposed during an unauthorized access and malware incident involving the Aptos platform.","supporting_quote":"On February 6, 2017, Aptos informed us that unauthorized person(s) electronically accessed and placed malware on Aptos' platform holding Information for 40 online retailers, including Mrs Prindables, from approximately February 2016 and ended in December 2016.","technology_involved":["Aptos platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Aptos"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"502ab5c8195b","name":"Aptos"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bbe6a04d3a6aa9d4ad7c34bf943a60669547c1c9","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9670.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d3455f926548","org_name":"BENCHMARK","org_type":"unknown","ransomware":null,"records_affected":261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9670.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-24","discovered_date":"2017-02-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"185bbfecf64cffb13306c65b272a8dd8213efa8e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9673.pdf"},"notes":null,"org_country":"US","org_id":"204f8812cab2","org_name":"Affy Tapple, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9673.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Affy%20Tapple-2017-02-27"}],"summary":"Affy Tapple reported that malware on Aptos’ platform may have exposed customer personal and payment-card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1265c17b27e37460662e970ebb3772752d6b3d76","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Multistate%20Consumer%20Notice%20Redacted_%28161063433%29_%282%29_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6db687164966","org_name":"Abbott Nutrition","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66497"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9668.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other"],"disclosed_date":"2017-02-23","discovered_date":"2017-02-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed9daf55667ff4ac25c17fdcf55701c23df6a521","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-02-06","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LS%20Notice%20of%20DB%20-%20EU%202-7-17_0.pdf"},"notes":null,"org_country":"US","org_id":"ed12cf923349","org_name":"Logic Supply, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LS%20Notice%20of%20DB%20-%20EU%202-7-17_0.pdf"}],"summary":"Logic Supply, Inc. reported unauthorized access to its website that may have exposed customer usernames, passwords, company names, and order information.","supporting_quote":"Yesterday, February 6th, we discovered unauthorized access to our website, which made some customer information vulnerable.","technology_involved":["LogicSupply.com","website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b28753f78420eb1b4de4a6d5a86519ad3bb8fdd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df80bfb0-eab0-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-02-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5dbe6f71983","org_name":"Meridian Health Services","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox59.com/2017/02/22/meridian-health-services-in-muncie-latest-company-to-fall-victim-to-data-breach/"}],"summary":"A company spokeswoman said all W-2 forms at Meridian Health Services in Muncie have been compromised. The problem affects about 1,200 employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bfe53f65ed0b601723726a109d14d8e8a9b30a1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JoFit-__Adult_Notice_Form_1.PDF"},"notes":null,"org_country":"US","org_id":"c58ff311f9ea","org_name":"JoFit","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JoFit-__Adult_Notice_Form_1.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/JoFit.pdf"}],"summary":"JoFit reported that its website may have been targeted in an attack aimed at acquiring customer credit card information, with personal and payment information potentially exposed.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-22","discovered_date":"2017-02-06","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d1ecd72bb61c96a171da3933cd4ba38729f1af3e","impact_type":"data_theft","incident_date":"2017-02-03","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1566","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9666.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2238e779b103","org_name":"InterMountain Management, LLC","org_type":"unknown","ransomware":null,"records_affected":558,"reviewed":false,"root_cause":"An individual impersonating the company owner made a fraudulent email request, and the company provided the W-2 forms before discovering the request was fraudulent.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9666.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9666.pdf"}],"summary":"InterMountain Management provided 2016 W-2 forms in response to a fraudulent email request impersonating the company owner.","supporting_quote":"Unfortunately, copies of all 2016 W-2 forms prepared by InterMountain were provided before we discovered that the request was made from a fraudulent account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"external","country":"RU","motive":"ideology","name":"Fancy Bear","variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fb2b743f7d496c26f6a9d5c2239d729b40c9d6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ae11b80-6c89-11e7-8419-7d473c8dcba3"},"incident_date":"2017-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MC","org_id":"8fbc60772f5a","org_name":"International Association of Athletics Federations","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.insidethegames.biz/articles/1048848/iaaf-fear-athlete-data-theft-after-hack-by-fancy-bears;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.nytimes.com/2017/04/03/sports/computer-hackers-again-gain-access-to-athletes-private-medical-records.html"}],"summary":"Coe apologises to athletes after IAAF data theft attack by Fancy Bears'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"fancybear"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44ba3fc7cf11416b373ff5036cbe75cb559e6635","impact_type":"unknown","incident_date":"2016-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample%20letter_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84f103e761a0","org_name":"Intex Recreation Corp.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66423"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9667.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other","personal"],"disclosed_date":"2017-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d33e020d824d77b6db079d032214764b46fe23fb","impact_type":"unknown","incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"0eef19912b7a","org_name":"Funimation","org_type":"unknown","ransomware":null,"records_affected":2491103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Funimation","type":"hibp","url":"https://haveibeenpwned.com/Breach/Funimation"}],"summary":"In July 2016, the anime site Funimation suffered a data breach that impacted 2.5 million accounts. The data contained usernames, email addresses, dates of birth and salted SHA1 hashes of passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02681b055bd611a2127aab96b16cb34f880067c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9eda6e80-de98-11e7-9424-7b935f12be98"},"incident_date":"2017-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/LexingtonMedicalCenter.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdce815792fc","org_name":"Lexington Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wach.com/news/local/lexington-medical-center-hit-with-employee-data-breach"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/LexingtonMedicalCenter.pdf"}],"summary":"Officials say an employee database was hacked at Lexington Medical Center.  Thousands of records have been exposed including social security numbers and W-2 forms of current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e16ee3671661a6b6eb66ce69f2f5542c885498f6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/EvansonAssetManagement.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"83af16792cc5","org_name":"Evanson Asset Management","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/EvansonAssetManagement.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa04c7bacdfdca89160a34d3eb31bdba504df235","impact_type":"unknown","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/client%20notice%20letter%20DAVE%20EDIT_1.pdf"},"notes":null,"org_country":"US","org_id":"9f3b9a48e0d0","org_name":"DeBoer Income Tax","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66415"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/client%20notice%20letter%20DAVE%20EDIT_1.pdf"}],"summary":"DeBoer Income Tax reported attacks against its systems but could not determine whether access succeeded or what records may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7d55eaa9c216d98d0aff67b0f5c76f333168816","impact_type":"unknown","incident_date":"2017-02-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/OE3%20Notice%20of%20Data%20Breach%20Letter%20from%20RB_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1544de4a1e02","org_name":"Operating Engineers Local Union No. 3","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66363"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37475834ef4bff943b0d55569f1d3b57d92f66e2","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Honest%20Kitchen%20Ad%20r3prf_0.pdf"},"notes":null,"org_country":"US","org_id":"f71f5e3ce8d1","org_name":"The Honest Kitchen","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66352"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Honest%20Kitchen%20Ad%20r3prf_0.pdf"}],"summary":"The Honest Kitchen reported that an unauthorized network intrusion exposed customers’ personal and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4bd2be12ab499237749c9feb8575c6437113802","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e7893a70-a2da-11e7-b671-fb4cdbd76ea5"},"incident_date":"2017-02-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc427a84270b","org_name":"Southern Illinois Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.wsiu.org/post/hundreds-sih-patients-potentially-impacted-insurance-breach#stream/0"}],"summary":"Partner misdelivery of PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"796ba7171de95920e467a36b71a0c083b6baff0f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2d4f2510-7c57-11e7-8ec0-e369e9638092"},"incident_date":"2017-02-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a86e92167f7a","org_name":"Plastic Surgery Associates of South Dakota","org_type":"healthcare","ransomware":true,"records_affected":10200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/plastic-surgery-associates-of-south-dakota-notifies-10200-after-ransomware-attack/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47fbaef044755148d222537ca110c8af15d62fd0","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-27","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NEO%20Tech%20Amended%20Notice%20of%20Data%20Breach%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"d3fbb7d495d8","org_name":"NEO Tech","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email phishing incident resulted in employee W-2 data being released to an unauthorized recipient.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NEO%20Tech%20Amended%20Notice%20of%20Data%20Breach%20-%20California_0.pdf"}],"summary":"An email phishing incident resulted in NEO Tech employee W-2 data being released to an unauthorized recipient outside the company.","supporting_quote":"On Friday, January 27, 2017, NEO Tech was the victim of an email “phishing” incident that resulted in the release of employee W-2 wage and tax data to an unauthorized email recipient outside the company.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e42b870ea58b384e66918d1f20a5699faaaf45a8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"860a3b10-c55c-11e7-8460-859aaa890f03"},"incident_date":"2017-02-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74de14f94288","org_name":"GTE Financial Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/news/local/man-who-put-credit-card-skimming-device-on-atm-wanted/408588327"}],"summary":"ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d4626f52b84fe36f5d6c91bdce49e1e7af9105a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"527c2840-de83-11e7-9424-7b935f12be98"},"incident_date":"2017-02-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c4fe798e4b5","org_name":"maple's gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdam.com/story/34477520/additional-card-skimmer-found-on-highway-49"}],"summary":"gas pump skimmer found at maples gas station on hwy 49 in Hattiesburg.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-02-09","discovered_date":"2017-01-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7006376d18924b2d79489f16699c8b98f1c5d8ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66267"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20notice_0.pdf"}],"summary":"A CCHCS staff member inadvertently emailed personal and health information to a staff member at another California state department.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"165308098cbdb0a83c5ad07c8f5e124603e66fcb","impact_type":"unknown","incident_date":"2016-11-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Example%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7416444399c7","org_name":"The Boeing Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66255"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9665.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9926363c58e4d54b69320014d8e63e865c2318dc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74a80d30-c59c-11e7-8053-ff1e84d2b694"},"incident_date":"2017-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60104d3a9ceb","org_name":"Western Health Screening","org_type":"healthcare","ransomware":null,"records_affected":15326,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/western-health-screening-breach-affects-15-326-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/healthcare-information-technology/western-health-screening-notifies-patients-of-information-breach-from-vehicle-theft.html"}],"summary":"Western Health Screening, which provides onsite blood screening services at health fairs across the Colorado Western Slope region, is offering 15,326 affected individuals protective services following a data breach.  Much of the at-risk patient information is not highly sensitive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2017-02-07","discovered_date":"2017-01-06","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a58316a367ef08ea5e099358eb5beb57e5b8f5a","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Deceased%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"9ec208fc0381","org_name":"Verity Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66237"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Deceased%20Notice_0.pdf"}],"summary":"An unauthorized third party accessed a no-longer-used Verity Medical Foundation-San Jose Medical Group website, potentially exposing patient information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-07","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b80e37ffe62585aa7b1a9cbc230400f7d88dad7","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Platt%20NOB_0.pdf"},"notes":null,"org_country":"US","org_id":"dd796b59c7cc","org_name":"Platt College, Los Angeles LLC","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A technical error caused student 1098T Tuition Statements to be addressed with another student’s mailing address, resulting in inadvertent disclosure by mail.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66226"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Platt%20NOB_0.pdf"}],"summary":"Platt College, Los Angeles LLC inadvertently mailed students’ 1098T Tuition Statements to another student because of a technical error.","supporting_quote":"A technical error caused Student’s 1098T Tuition Statements to be addressed with another student’s mailing address, and the Statements were inadvertently mailed to another student on January 13, 2017.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d6318d7278d9d159738c5d88e458328ed727b3f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65dcdf40-eaba-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-02-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12af51fa73bf","org_name":"Sharp Healthcare","org_type":"healthcare","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://timesofsandiego.com/crime/2017/03/03/data-of-750-patients-breached-in-computer-theft-at-sharp-healthcare/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/OPP%20Redacted%20Letter_0.pdf"}],"summary":"Data of 750 Patients Compromised by Computer Theft at Sharp Healthcare","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ce6560b9129b7f6e8151cfe17aa52082a0c51b2","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Capital%20One%20-%20CA%20Letter%201_0.pdf"},"notes":null,"org_country":"US","org_id":"f467159d707f","org_name":"Capital One","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66214"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Capital%20One%20-%20CA%20Letter%201_0.pdf"}],"summary":"A fraudster logged in to Capital One accounts with usernames and passwords believed to have been stolen from other websites, gaining access to account information and making or attempting unauthorized transactions.","supporting_quote":"someone made or attempted to make unauthorized transactions on your Capital One account(s) by logging in with your username and password, which we believe were stolen from one of these websites.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccc70fb3e837f1738c5bce4c605f76a3471cf1d1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa8bd300-c5a6-11e7-8053-ff1e84d2b694"},"incident_date":"2017-02-06","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"81b2a087bc86","org_name":"ABCD Pediatrics","org_type":"healthcare","ransomware":true,"records_affected":55447,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthcare-informatics.com/news-item/cybersecurity/pediatric-group-reports-ransomware-attack-potentially-impacting-55000;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/pediatric-practice-reports-ransomware-attack-a-9817"}],"summary":"A pediatrics practice, ABCD Pediatrics, serving the San Antonio, Texas metropolitan area reported that it was hit with a ransomware attack, but existing antivirus software helped to slow down the attack, and the practice's IT vendor successfully removed the virus and all corrupt ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e2abf93ab038a188131c28a3746951ef1ef3591","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b734a81f3be4","org_name":"HongFire","org_type":"other","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: HongFire","type":"hibp","url":"https://haveibeenpwned.com/Breach/HongFire"}],"summary":"A breach of HongFire’s vBulletin forum exposed account information, including email and IP addresses, usernames, dates of birth and salted MD5 passwords.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6072b6cb1b3b38cfa5a8e5a4661fda79d7430384","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2017-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f53d41beb85a","org_name":"Freedom Hosting II","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Freedom Hosting II","type":"hibp","url":"https://haveibeenpwned.com/Breach/FreedomHostingII"}],"summary":"Freedom Hosting II suffered a data breach that exposed MySQL databases associated with hidden services it managed.","supporting_quote":null,"technology_involved":["MySQL databases","Tor hidden services"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-03","discovered_date":"2017-01-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94d57de478409b438fc08614b5e37c46c8fddce5","impact_type":"data_theft","incident_date":"2017-01-20","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RenovateAmerica%202_3_17_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"1bf50c8e0ac2","org_name":"Renovate America, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee provided employee W-2 forms in response to a fraudulent email impersonating the CEO.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66165"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RenovateAmerica%202_3_17_0.pdf"}],"summary":"Renovate America disclosed that an employee sent 2016 W-2 forms to an external account after a fraudulent email impersonated the CEO.","supporting_quote":"Unfortunately, copies of all 2016 employee W¬2 forms were provided before we discovered that the request was made from a fraudulent account by someone using an email address that appeared to belong to our CEO.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"728a888a9791ffad8abaee735cdfa133592149b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACL1000_L_PCIDFSSTAGE_109_20170131_001_archive_v2_IDX_001_PDF_001_8002010000_0.pdf"},"notes":null,"org_country":"US","org_id":"66587f3aa08f","org_name":"Nakawatase & Kaminsky, CPAs, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACL1000_L_PCIDFSSTAGE_109_20170131_001_archive_v2_IDX_001_PDF_001_8002010000_0.pdf"}],"summary":"An intruder compromised Nakawatase & Kaminsky’s Lacerte tax system, resulting in four fraudulently filed tax returns and possible exposure of clients’ personal and financial information.","supporting_quote":null,"technology_involved":["Lacerte tax system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad89d60183d7046d3bd6f41361ce2e23a8da0c7d","impact_type":"data_theft","incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IHG.CombinedSubNotices_0.pdf"},"notes":null,"org_country":"US","org_id":"de01d96410f1","org_name":"InterContinental Hotels Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66180"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IHG.CombinedSubNotices_0.pdf"}],"summary":"Malware on payment card processing servers at 12 IHG-managed properties searched for track data from cards used at restaurants and bars.","supporting_quote":null,"technology_involved":["payment card processing servers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"26e8c5b485f444a478822496b81a8c3056225758","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9664.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"faefea1932ab","org_name":"Conover Capital Management, LLC and Conover Securities Corporation","org_type":"unknown","ransomware":null,"records_affected":1197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9664.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"064caaa3c7a9e17ecd1e7c5560fad372d6504d16","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9dd089b0-dec6-11e7-aa62-a96e008cbc03"},"incident_date":"2017-02-03","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6345138b3aaa","org_name":"College of Southern Idaho","org_type":"education","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://magicvalley.com/news/local/education/csi-hit-with-cyber-scam/article_6a0e89b1-54e0-5d4d-b840-f546bc8cf6c3.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmvt.com/content/news/Phishing-email-compromises-personal-info-of-nearly-3000-CSI-employees-413097693.html"}],"summary":"The College of Southern Idaho announced Tuesday that up to 3,000 employees' personal information may have been compromised following a phishing scam late last week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal"],"disclosed_date":"2017-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c3bf096acb157e194bfd884fab91e1122d25c22","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Unauthorized%20RewardsRUs%20Access%20%28Final%20Versions%29_0.pdf"},"notes":null,"org_country":"US","org_id":"4c06b3549edf","org_name":"Toys \"R\" Us-Delaware, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Unauthorized%20RewardsRUs%20Access%20%28Final%20Versions%29_0.pdf"}],"summary":"Toys \"R\" Us reported unauthorized attempts to access Rewards“R”Us loyalty accounts, potentially using credentials stolen in other breaches.","supporting_quote":"We expect this activity is related to previously reported online breaches, not affiliated with Toys“R”Us, where thieves stole login names and passwords.","technology_involved":["Rewards“R”Us loyalty program"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9924adb2c295b7e8baef1296b5e3d1baaed624fa","impact_type":"data_theft","incident_date":"2017-01-20","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Q739_v01_Sunrun_CA_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"2864d98efd7b","org_name":"Sunrun Inc.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The payroll department did not recognize the impersonation email as a scam and disclosed employee W-2s.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66148"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Q739_v01_Sunrun_CA_Notice_0.pdf"}],"summary":"A scammer impersonating an employee emailed Sunrun’s payroll department, which disclosed employee W-2s for 2016.","supporting_quote":"Unfortunately, the phishing email wasn’t recognized for what it was – a scam – and employee W-2s for 2016 were disclosed externally.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-02-02","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"049db9cb9b56c4df32f9bc6874e9861d7054bd85","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DBM%20Global%20Data%20Breach%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"bbe67a0e0a79","org_name":"DBM Global, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An office burglary resulted in the theft of an employee laptop that may have contained personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66150"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DBM%20Global%20Data%20Breach%20Notice%20Letter_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DBM%20Global%2C%20Inc.-2017-02-01"}],"summary":"A burglary at DBM Global’s Phoenix office resulted in the theft of an employee laptop that may have contained personal and bank information.","supporting_quote":"On January 7, 2017, our Phoenix office was burglarized and one employee laptop was stolen.","technology_involved":["employee laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95abbdf78eff40272bb27de720c789261681d9b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d53991b0-de96-11e7-9424-7b935f12be98"},"incident_date":"2017-02-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c6594659752","org_name":"Alton Steel, Inc","org_type":"manufacturing","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegraph.com/news/96467/sources-personal-info-of-nearly-300-alton-steel-employees-compromised"}],"summary":"A security breach at Alton Steel, Inc. has left its employees open to identity theft, and more than one employee has already this year had fraudulent tax returns filed in their name,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d5a40a07b2ec6a280445ee84ee1b2c4a5b186d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ecc26c90-81e8-11e7-ace7-c5c15a923e51"},"incident_date":"2017-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a066df7a378a","org_name":"Whatta Car Wash","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wspa.com/2017/04/21/spartanburg-car-wash-warns-customers-of-data-breach/"}],"summary":"Whatta Wash Car Wash said in a notice that malware was placed on its point-of-sale system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"266adcb87c4d226e14c1b2f797f31c1005519226","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39fdff10-c58c-11e7-8314-790c8d59abbb"},"incident_date":"2017-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"d5d0c0a0bc0c","org_name":"The Victorian Institute of Teaching","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bordermail.com.au/story/4446860/teacher-watchdog-leaked-secret-yeshivah-sex-abuse-complaint/?cs=12"}],"summary":"PII of abuse complainant disclosed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3912dba301a2a5d2c1142221d5bbcd1746e6d84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d4359e90-d959-11e7-a452-77d2890a67ae"},"incident_date":"2017-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"aab5f85820f8","org_name":"Solent NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-former-solent-nhs-trust-employee-prosecuted-for-section-55-offense/"}],"summary":"A former administrative employee of Solent NHS Trust, Kayleigh Evans, has been prosecuted at West Hampshire Magistrates’ Court for accessing the sensitive medical records of a former girlfriend of her partner, without the consent of the data controller","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6f10821a928013a2c39a49816ebfc9e02749973","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6361d110-89aa-11e7-bf1d-81579668407a"},"incident_date":"2017-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"94d887e1d7ae","org_name":"Sarnia General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thesarniajournal.ca/privacy-breach-at-hospital-under-investigation/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-break-in-prompts-hospital-to-assess-possible-patient-privacy-breach/"}],"summary":"Break-in prompts hospital to assess possible patient privacy breach - Bluewater Health / Sarnia General Hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-01","discovered_date":"2017-01-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2e5caed6db500c3669991ffd6585ad9c65dc0274","impact_type":"unknown","incident_date":"2016-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"65c0aee846d6","org_name":"Pure Yoga LLC.","org_type":"unknown","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pure%20Yoga%20LLC.-2017-02-01"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Pure%20Yoga%20LLC-2017-02-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20115fea3f56e76f5fea5df801d1eba37e5aef12","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"651d6630-8438-11e7-a921-2d695ce70b69"},"incident_date":"2017-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94ae1e2f66e1","org_name":"Norwalk Transit","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://norwalk.dailyvoice.com/police-fire/police-norwalk-transit-district-employee-stole-20k-through-identity-theft/709984/"}],"summary":"Police: Norwalk Transit District Employee Stole $20K Through Identity Theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f19fc1adcc8a57e5f5aba07adec2447d720dcfa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63fb5cc0-eab4-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"570c74a28b7b","org_name":"Northern Territory Radiation Oncology","org_type":"healthcare","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/au-top-end-health-service-breach-exposes-private-details-of-cancer-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.goldcoastbulletin.com.au/news/national/top-end-health-service-breach-exposes-private-details-of-cancer-patients/news-story/3fb4915261d4747f5ac062f814569873?nk=0c481d229b89f02a4e6766156e2b427f-1514344649"}],"summary":"Confidential documents showing the diagnoses and contact details of dozens of Royal Darwin Hospital cancer patients ended up in a suburban driveway.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79d5c09919fd5020067a0f5bd15fe43f5149ac3f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0532cea0-de82-11e7-9424-7b935f12be98"},"incident_date":"2017-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df4e0130c305","org_name":"Monroe Shell Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wlwt.com/article/2-more-credit-card-skimmers-found-bringing-total-to-13-in-butler-county/8729963"}],"summary":"two payment card skimmers found at a shell station in monroe, ohio.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"712db42b792c46376ef1d542cc8a25382ef144cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c71a0de0-a92f-11e7-b732-299fe2e433d1"},"incident_date":"2017-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eafae74eee01","org_name":"Martin Memorial Health Systems","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.radiologytoday.net/archive/rt1110p24.shtml"}],"summary":"This past February, several employees and other individuals at Florida’s Martin Memorial Health Systems allegedly used their cell phone cameras in the emergency department to photograph the injuries of a shark attack victim who later died. After an investigation into possible HIP","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a39490cf137376a183a8b087fe284631516d1ae5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53e55200-842a-11e7-a921-2d695ce70b69"},"incident_date":"2017-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b8d8a659d57","org_name":"Kennebec County Sheriff’s Office","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressherald.com/2017/03/06/probe-of-security-officers-breach-ongoing/"}],"summary":"A week after a court security officer took a cellphone photo of a defense attorney’s notes and emailed it to a prosecutor in an unprecedented breach of protocol, the investigation into the matter continues and the policies followed by court officers remain unchanged.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8a7dfb36f6a7e3e557db86495970bbbe48f7a60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b82bfe10-0a37-11e8-bbae-ed39c73f1398"},"incident_date":"2017-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"167c4ba32ee7","org_name":"Elance","org_type":"technology_saas","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/elance-data-breach-hacker-leaks-1-3-million-accounts-staffing-platform-1605368;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationsecuritybuzz.com/expert-comments/hacker-leaks-1-3-million-accounts-staffing-platform/"},{"fetched_at":null,"title":"Have I Been Pwned: Elance","type":"hibp","url":"https://haveibeenpwned.com/Breach/Elance"}],"summary":"A hacker has reportedly leaked 1.3 million accounts from staffing platform Elance onto an underground hacking forum. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb54cf8d6e710b91fd97d830f9de4405b35171e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0fb512a0-c575-11e7-bdb2-99e5dbe0676c"},"incident_date":"2017-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41885fe09a49","org_name":"Corsicana ISD","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.corsicanadailysun.com/news/corsicana-isd-responds-to-data-breach-incident/article_deee240a-ee69-11e6-b5d7-db92c96a6034.html"}],"summary":"Phishing email leads to disclosure of PII ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae39061be721894052add49bb34255517410ae5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23310270-e376-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"442f4807374d","org_name":"Citizens Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ky3.com/content/news/413747713.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kspr.com/content/news/Citizens-Memorial-Hospital-investigating-breach-of-employee-information-413741283.html"}],"summary":"Personal and financial information was stolen from Citizens Memorial Hospital. Officials say W2 tax forms were mistakenly given to a scammer, and now all employees are at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b1df97f33c3d6ed7d2f361c676f87bb334a5f52","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a08d6390-e357-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"23b861244d0b","org_name":"Children’s Hospital of Eastern Ontario","org_type":"healthcare","ransomware":null,"records_affected":283,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canhealth.com/blog/cheo-employee-shared-283-patient-records-with-students/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://algonquintimes.com/news/instructor-no-longer-with-algonquin-after-cheo-privacy-breach/"}],"summary":"A part-time instructor at Algonquin College, who was also an employee of the Children’s Hospital of Eastern Ontario (CHEO), shared the private information of 283 patients with students.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7e0b423662c6e516e771d008abd4c234cc6b0cd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"289a2220-c58d-11e7-8314-790c8d59abbb"},"incident_date":"2017-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"126558043a06","org_name":"Bridgehampton National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.newsday.com/long-island/crime/police-probe-skimming-device-at-hamptons-bank-1.13056260"}],"summary":"ATM Skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7249918bfe9896aa360d4121fa420c31f881cc8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b22ff10-ec44-11e7-b683-c1703914e4a4"},"incident_date":"2017-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f78bf4372539","org_name":"Associates in Family Chiropractic and Natural Health Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehour.com/news/article/Receptionist-arrested-on-forgery-theft-charges-11193435.php"}],"summary":"A receptionist at a Norwalk chiropractic office accused in April with stealing checks and credit cards from patients there was arrested on warrants Thursday on additional charges.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"362317906e84b20fa64ec2e84f506c3ebe4e627b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10ced630-93d4-11e7-967f-a9fa27eb51b9"},"incident_date":"2017-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5eba0023a690","org_name":"Apple Yard Flowers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/3529052/appleyard-flowers-credit-card-details-hacked-mothers-day/"}],"summary":"Appleyard flowers and Blossoming Gifts warn customers their credit card details may have been hacked during orders over Mother’s Day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bdd2032938dc0049b57b45ec84aa283b4b424b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a79da0f0-d961-11e7-a452-77d2890a67ae"},"incident_date":"2017-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d91a8dab05d0","org_name":"Adventist Health Tehachapi Valley","org_type":"healthcare","ransomware":null,"records_affected":253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kerngoldenempire.com/news/san-joaquin-community-hospital-reporting-phishing-scam/653126169"}],"summary":"Phishing for W2s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2934599e282e829e268f7f60972087f77850700","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5af2b3d0-d95a-11e9-baf3-31037743ca61"},"incident_date":"2017-01-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14697b7b082d","org_name":"Akin Gump Strauss Hauer & Feld","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/akin_gump_partner_is_arrested_while_wearing_a_disguise_and_trying_to_sell_s/?utm_source=maestro&utm_medium=email&utm_campaign=weekly_email,https://bol.bna.com/akin-gump-lawyer-accused-of-trying-to-sell-lawsuit-under-seal/"}],"summary":"law firm partner tries to sell corporate secrets, but FBI gets him in a sting.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65f10ce93518e907551af98f610b95a7fb4714c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e6354520-ded2-11e9-843d-75ce6c835970"},"incident_date":"2017-01-30","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10eb4a833ae8","org_name":"Taconic Biosciences, Inc","org_type":"other","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hustlermoneyblog.com/taconic-employee-w-2-data-breach-class-action-lawsuit/,http://www.marylandattorneygeneral.gov/ID%20Theft%20Breach%20Notices/2017/itu-280527%20(1).pdf"}],"summary":"employee was phished and sent actor w-2 data of other employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03dd6250081e68792d9bd2217d9494b795ecf438","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bb8dbc20-d962-11e7-8b17-fdfed30923dd"},"incident_date":"2017-01-30","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ada65b49771","org_name":"Pointe Coupee General","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbrz.com/news/hackers-posing-as-administrator-get-200-workers-w-2-forms/"}],"summary":"More phishing for W2s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-30","discovered_date":"2017-01-19","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29034df8a2b14870a9ec88313b3d002ebf90ef28","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"7f51a03a7ca5","org_name":"Palomar Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66102"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_1.pdf"}],"summary":"Palomar Community College District reported that an unauthorized individual may have accessed employee W-2 information, including names, addresses, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85bea726044540ec2f9e850d0bb66e4833ba73ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd3ffca0-d960-11e7-a452-77d2890a67ae"},"incident_date":"2017-01-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"429d06f79ee0","org_name":"Eastern Health","org_type":"healthcare","ransomware":null,"records_affected":122,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/eastern-health-med-school-privacy-breach-1.3958376"}],"summary":"Dr. mishandled data by sending to colleagues against policy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"058fd59a3fa09235752fda759c5b43cce23b9549","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"292d2d60457f","org_name":"Xbox 360 ISO","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Xbox 360 ISO","type":"hibp","url":"https://haveibeenpwned.com/Breach/Xbox360ISO"}],"summary":"The Xbox 360 ISO forum was hacked in approximately September 2015, exposing account information and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05a4fadbe91755e304cd6fc0bbc31639de1e8e48","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-09-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c80370d1c600","org_name":"PSP ISO","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PSP ISO","type":"hibp","url":"https://haveibeenpwned.com/Breach/PSPISO"}],"summary":"The PSP ISO forum was hacked in approximately September 2015, exposing account details and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-27","discovered_date":"2017-01-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"18dbdb0166bce4d91155bbf58aeebaab6658a07e","impact_type":"exposure_no_theft_confirmed","incident_date":"2017-01-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9663.pdf"},"notes":null,"org_country":"US","org_id":"a5a4fc9f5c46","org_name":"Saturna Capital Corporation","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9663.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9663.pdf"}],"summary":"Saturna Capital Corporation mistakenly emailed a PDF containing sensitive personal information to a client.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e14f1d0aea4591b3408119c59089cd36dceceef8","impact_type":"unknown","imported_from":null,"incident_date":"2017-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/eHealthInsurance%20-Notice%20only%20-%20CA%20-%20Exhibit%201_0_0.pdf"},"notes":null,"org_country":"US","org_id":"c5d6e97aa626","org_name":"eHealthInsurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66072"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/eHealthInsurance%20-Notice%20only%20-%20CA%20-%20Exhibit%201_0_0.pdf"}],"summary":"eHealthInsurance Services reported an email spoofing attack that may affect the security of personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"260905381746913a3283cda0fd78b2c15ec7783b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24059780-d965-11e7-8b17-fdfed30923dd"},"incident_date":"2017-01-27","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"593b5fc6f3a8","org_name":"eHealthInsurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/ehealthinsurance-campbell-county-health-each-fall-w-2-phishing-scams"}],"summary":"W2 phishin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2017-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50826c641483a8108aa32740e9d7b1d298a0bac5","impact_type":"data_theft","incident_date":"2015-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Komar%20-%20Notice%20only%20-%20CA%20Exhibit%201_0_0.pdf"},"notes":null,"org_country":"US","org_id":"b848d2c5fa12","org_name":"Charles Komar & Sons, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66044"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Komar%20-%20Notice%20only%20-%20CA%20Exhibit%201_0_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Charles%20Komar%20%26%20Sons%2C%20Inc.-2017-01-26"}],"summary":"Malicious code on Cuddl Duds’s e-commerce website collected customer and payment information entered at checkout.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05780224e556c9473f8b412922c1d9ba348f8acb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a838e1c0-6c90-11e7-8419-7d473c8dcba3"},"incident_date":"2017-01-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"495cc3b54adc","org_name":"Walnut Place","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/walnut-place-notice-of-data-breach-300483653.html"}],"summary":"Walnut Place, Notice of Data Breach ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f5976b08ae1698de5ecbfc2b65054c20c0f644a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2d9860dc3afb","org_name":"Non Nude Girls","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Non Nude Girls","type":"hibp","url":"https://haveibeenpwned.com/Breach/NonNudeGirls"}],"summary":"A breach of Non Nude Girls’ vBulletin forum exposed account information, including email and IP addresses, names, and plain-text passwords.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9492e1197bf51c8381bebbee98d01377c5676f3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bd692f30-e460-11e7-977c-0b3846f56840"},"incident_date":"2017-01-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91827b35e8f4","org_name":"LCS-WP LLC d/b/a Walnut Place","org_type":"healthcare","ransomware":true,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/walnut-place-notice-of-data-breach-300457044.html"}],"summary":"Ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0d76e7cb7b3cf84a7684b6237fb95745762151eb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/DixonHughesGoodman.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fbe7a588d2b7","org_name":"Dixon Hughes Goodman LLP","org_type":"unknown","ransomware":null,"records_affected":1351,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/DixonHughesGoodman.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50960446924d512584a6690d10029f127099b0bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b8a34290-e377-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-01-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c67f27b79ee6","org_name":"Campbell County Health","org_type":"healthcare","ransomware":null,"records_affected":1456,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wyomingbusinessreport.com/newsletter_pm/two-wyo-hospitals-targeted-in-phishing-attacks/article_70bd073c-e7ff-11e6-bbd2-7f6b533f0156.html"}],"summary":"On Jan. 25, an employee of Campbell County Health was sent an email from someone posing as a high-ranking hospital official. The email requested W-2 information for all 1,456 of the hospitals’ employees who had taxable earnings in 2016.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03b9ff01e3e84fefaef22dbbd6a3e6a9815fd49c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8d948e0-decb-11e7-aa62-a96e008cbc03"},"incident_date":"2017-01-24","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"848b3a3a667c","org_name":"UGI Utilities","org_type":"energy_utilities","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcall.com/business/mc-ugi-employees-exposed-phishing-scam-watchdog-20170126-column.html"}],"summary":"UGI Utilities said Thursday that the personal information of about 1,900 employees and former employees was \"acquired\" by the perpetrators of an email phishing scheme that targeted the company ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a6be06f7de649326eb5a57eb73d82ccfddf9af8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d132e800-1628-11ec-8258-83f74c3914c9"},"incident_date":"2017-01-24","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"20cd19169ae5","org_name":"Monarch Beverage","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cbs4indy.com/news/scammer-obtains-w-2-forms-of-monarch-beverage-employees/"}],"summary":"Scammer obtains W-2 forms of Monarch Beverage employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"459b0b65fc0bea819f2e22aed528967579c5bc61","impact_type":"unknown","incident_date":"2017-01-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Pool%20Supply%20redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"235ac676731f","org_name":"Pool Supply Unlimited","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65971"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27f52efa5c5a76b518d31af4cb83b8268b8f8839","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"225dc010-971b-11e7-a11c-5542f7e3819f"},"incident_date":"2017-01-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"government","ransomware":null,"records_affected":738,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcra.com/article/why-700-people-received-letter-about-privacy-breach/9183810;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/article/Errant-email-at-CA-agency-exposes-private-11027068.php"}],"summary":"Over 700 people received a notification letter about a privacy breach of personal information, the California Correctional Health Care Services said in a statement Friday. The CCHCS sent out 738 notification letters on Feb. 9 about a privacy breach of personally identifiable info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"050dcb3e27b1c125c9024ba7f7f5db8c9d62e187","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2f46fa50-a781-11e7-ae18-bd2df8850f54"},"incident_date":"2017-01-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc-2.com/story/36437282/skimming-device-discovered-at-cape-coral-gas-station"}],"summary":"Skimming device discovered at Cape Coral gas station - 7-Eleven / Citibank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1441f95e4c844b8585b8f7c16ef7cb7f50d6d55","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3ce61f8f3f89","org_name":"The Candid Board","org_type":"other","ransomware":null,"records_affected":178201,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Candid Board","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheCandidBoard"}],"summary":"The Candid Board's vBulletin forum breach exposed account data, including email and IP addresses, dates of birth, and salted MD5-hashed passwords.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c3193dcbb6822796c28bf53eeeb5a8bba59f96d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-12-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a6f62723850c","org_name":"MrExcel","org_type":"other","ransomware":null,"records_affected":366140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MrExcel","type":"hibp","url":"https://haveibeenpwned.com/Breach/MrExcel"}],"summary":"A breach of the MrExcel vBulletin forum exposed account information, including email addresses, IP addresses, dates of birth, and hashed passwords.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4475fd006cad6983ee440c82579f4c4af62584e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad0c9450-72fb-11e7-a859-bd14321ac1c3"},"incident_date":"2017-01-22","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a9c7ddc6e55","org_name":"Austin Urology","org_type":"healthcare","ransomware":true,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mystatesman.com/business/business-digest-austin-clinic-warns-patients-data-breach/Qw2WnKy8GOayRi6In14QvO/"}],"summary":"Austin clinic warns patients of data breach - Urology Austin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"993086cd51f8dabea3f391059e80e793c272595d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e449a8f0-c58e-11e7-8314-790c8d59abbb"},"incident_date":"2017-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec042dc55f27","org_name":"Sundance Institute","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.business2community.com/cybersecurity/sundance-hack-acts-warning-small-mid-sized-businesses-01765418#ccvFelQxZRiFKAAE.97"}],"summary":"DDoS Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"118e58096224b26b5739fa078334794de1b896d9","impact_type":"unknown","incident_date":"2016-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FINAL%20BOF%20NOTICE%20%20LETTER%20DEC-2016_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4793fb07c136","org_name":"Department of Justice","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65950"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce7bca9fc8419eb63557a6add784e54922757922","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20a73120-c4a7-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4134512d694","org_name":"Palomar College","org_type":"education","ransomware":null,"records_affected":3053,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiegouniontribune.com/news/education/sd-me-palomar-databreach-20170303-story.html"}],"summary":"W2 information obtained via unknown methods","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2017-01-19","discovered_date":"2015-12-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ea3b460274fa6e98a32e206614305fe121c0854","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Enclosure%201%20-%20CoPilot%20Ad%20No%20SSN%20r4prf_0.pdf"},"notes":null,"org_country":"US","org_id":"278100855c27","org_name":"CoPilot Provider Support Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65922"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Enclosure%201%20-%20CoPilot%20Ad%20No%20SSN%20r4prf_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9662.pdf"}],"summary":"CoPilot reported that an individual accessed its database and downloaded health information submitted through its website.","supporting_quote":null,"technology_involved":["website","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd3af118bcb09fb29f185101914fc27ece72b323","impact_type":"unknown","incident_date":"2014-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_8.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65903"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65902"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66426"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0580d96676b8c40212f8edb5d171ced98e2f0fec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b0d7140-af5b-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-01-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1c4289a00a5","org_name":"U.S. Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://clarksvillenow.com/local/police-need-help-identifying-us-bank-atm-skimming-suspect/"}],"summary":"Police need help identifying US Bank ATM skimming suspect - US Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557c93f4d288c4902e8dead5e33d5896d4d30750","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"216a8c80-9d68-11e7-af90-45f1ceac3d54"},"incident_date":"2017-01-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ccc57f485d37","org_name":"University Of California, Santa Cruz","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/laptops-stolen-from-uc-santa-cruz-instructors-home-contained-students-information/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66636"}],"summary":"two unencrypted laptops were stolen from the home of a University of California, Santa Cruz (UC Santa Cruz) researcher/instructor. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-01-12","discovered_date":"2016-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b016a6e1bd65641c08528ce3411e808837a85c3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spiraledge%20CA%20Form%20Exhibits%20A%20and%20B%20NON-MASS_RI_Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"1e7ba5c20a01","org_name":"Spiraledge, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65809"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spiraledge%20CA%20Form%20Exhibits%20A%20and%20B%20NON-MASS_RI_Sample_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Spiraledge%2C%20Inc.-2017-01-12"}],"summary":"Spiraledge reported a cyberattack that may have compromised customers’ debit and credit card information used at swimoutlet.com.","supporting_quote":null,"technology_involved":["www.swimoutlet.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal","medical"],"disclosed_date":"2017-01-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3bd8b885838a5650337d11dfd082239ad55e099","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43f0f170-c493-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-12","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02053b6e995b","org_name":"Sound Community Services","org_type":"healthcare","ransomware":null,"records_affected":1279,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/sound-community-services-email-account-breach-8848/"}],"summary":"LIkely as a result of phishing web based email creds used to access email which included PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"TheDarkOverlord","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1d9d30d626815319807d1bf331ef0e8fc6482ec","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53ad2c30-e37b-11e7-8742-2bc46bd10713"},"incident_date":"2017-01-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"103bb3a00c8a","org_name":"Little Red Door","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/cancer-services-provider-confronts-52149/"}],"summary":"On January 11, 2017, TheDarkOverlord attacked Little Red Door with ransomware and demanded a payment of 50 Bitcoin (approximately $43,000) for return of the data. If the ransom wasn’t paid, the threat was that confidential information would be disclosed to the public. TheDarkOver","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55089336d2e39d8cbd29bf3704e15ddbb27400c0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b525e2c0-d56d-11e7-af4f-6b5d4514198e"},"incident_date":"2017-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb9d006244bb","org_name":"CVS Health","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsdispatch.com/news/article_40c3732a-3aec-5071-b419-980bbf63cc7a.html"}],"summary":"On or about Jan. 11, an unknown individual(s) stole hard copy prescriptions from the pharmacy drop off counter area. It was determined that limited patient information such as name, date of birth and address were taken. It is not believed that obtaining access to this patient inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","other"],"disclosed_date":"2017-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2184f07613918e62dd3e83afdb539ab1384459ee","impact_type":"data_theft","imported_from":null,"incident_date":"2015-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9d0fc2b7b523","org_name":"Eroticy","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Eroticy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Eroticy"}],"summary":"Eroticy accounts containing personal information and plain-text passwords were found circulating, but the source of the breach remains inconclusive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2017-01-09","discovered_date":"2016-11-11","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88645be1745f2c09c552bc921250f96026afb426","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter%20%28Kevin%20Harrington%29_0.pdf"},"notes":null,"org_country":"US","org_id":"66800084b912","org_name":"Kevin Harrington, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65751"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notification%20Letter%20%28Kevin%20Harrington%29_0.pdf"}],"summary":"Kevin Harrington, CPA reported unauthorized access to client files on his computer, including tax return information.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2017-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3378d181ab76e058b87ecb1f92ca803c4e8a632c","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"1776e536639b","org_name":"QIP","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: QIP","type":"hibp","url":"https://haveibeenpwned.com/Breach/QIP"}],"summary":"QIP disclosed a breach of over 26 million accounts, including email addresses and passwords, in which data later appeared publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-06","discovered_date":"2016-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7daa1becb21df349dcc9d37efe3943a0ac8f457a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Legal%20Aid%20Orange%20County%20NOTICE_0.pdf"},"notes":null,"org_country":"US","org_id":"f7b04827a3df","org_name":"Legal Aid Society of Orange County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65740"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Legal%20Aid%20Orange%20County%20NOTICE_0.pdf"}],"summary":"Legal Aid Society of Orange County reported that completed tax forms were temporarily accessible through searches on certain internet search engines, with no known attempted or actual misuse.","supporting_quote":null,"technology_involved":["I-CAN! web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2017-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba1c2dfe92a89d82e79fb388bf4f46e31eb0911b","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"ES","org_id":"d073e6aa84ad","org_name":"Pokémon Negro","org_type":"other","ransomware":null,"records_affected":830155,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pokémon Negro","type":"hibp","url":"https://haveibeenpwned.com/Breach/PokemonNegro"}],"summary":"Pokémon Negro disclosed a breach affecting 830,155 accounts, including email addresses, IP addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fe69a6e9d223255b0a05dec9ceb36decca39a5a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eafc3ad0-a47f-11e7-b5cf-fd750643ba69"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"478d44399f8f","org_name":"Yale New Haven Hospital","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.usnews.com/news/best-states/connecticut/articles/2017-08-08/woman-sentenced-to-4-years-in-fraud-identity-theft-scheme"}],"summary":"A woman and her friend stole more than 200 patients information from the hospital where they worked and committed fraud with the data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"289c7b17a4cd8d9c422274b9294c7bb10ddc8c98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d04bc550-0a9d-11e8-827c-bba53cbad290"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"8a26ffaa1bfd","org_name":"XBOX360 ISO","org_type":"technology_saas","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationsecuritybuzz.com/expert-comments/2-5-million-playstation-xbox-user-details-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/02/01/gaming_forum_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/sciencetech/article-4176436/Details-2-5-MILLION-PlayStation-Xbox-users-leaked.html"}],"summary":"Two popular gaming forums have been hacked leaking the details 2.5 million accounts globally.  The hack breached forums 'XBOX360 ISO' and 'PSP ISO' in 2015 but details of the leak are only just coming to light.  Gamers who have used the forum are being advised to change the passw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97d59d57be444e4df5ce06d265ce283a9242f796","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd86aef0-7c60-11e7-8ec0-e369e9638092"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"eeba288042cd","org_name":"Woolworths","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news.com.au/finance/business/retail/woolworths-rewards-cards-hacked-points-stolen/news-story/6e38f321c021bb5d585ec0f544e60cdc"}],"summary":"Web application compromised to steal rewards points","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b6461bff80dbf15832f509cc3c4bffe3770a100","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72488720-0b5d-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"78dfa6363fa8","org_name":"Wonga","org_type":"financial","ransomware":null,"records_affected":270000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://betanews.com/2017/04/09/wonga-security-breach-uk-poland/"}],"summary":"Payday loan website compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49c435bc6791d10bd36eed1daec08514959abaac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"887bbf60-c5a0-11e7-8053-ff1e84d2b694"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"df51d6a4fc8e","org_name":"William Osler Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/toronto/william-osler-data-breach-narcotics-1.4086124;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3192802/data-breach/need-a-fix-steal-patient-data.html"}],"summary":"A Brampton nurse has been charged after allegedly gaining access to patient information at William Osler Health System to obtain narcotics for non-hospital use.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ead4d17ef9fd787ff86b9942ff9651fa03bf040","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"258a81c0-0b55-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af115ee5f6ae","org_name":"We Heart It","org_type":"technology_saas","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2017/10/16/we-heart-it-says-a-data-breach-affected-over-8-million-accounts-included-emails-and-passwords/"}],"summary":"Database breach exposes 8M creds to pic sharing site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1077fdb31f8daa98302381c5de25e29dc0b008fc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c447b290-0b5c-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3377833c70e9","org_name":"Washington State Univerisity","org_type":"education","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/healthcare-information-technology/1m-affected-in-wsu-data-breach.html"}],"summary":"Stolen hard drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b2a823a0067a749e7fd7aeece422e00b3afcca9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f118ebe0-9cb7-11e7-bdec-d715fa410d81"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b544956e44ef","org_name":"Washington DC Department of Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":138,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wamu.org/story/17/07/26/d-c-mistakenly-disclosed-confidential-information-homeless-residents-advocacy-group/"}],"summary":"D.C. Mistakenly Disclosed Confidential Information Of Homeless Residents To Advocacy Group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60e1661cffa9b842aff72934e5a3ac0e16abcea9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17ba47f0-a481-11e7-b5cf-fd750643ba69"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e7053539c3b9","org_name":"Walsall Health","org_type":"healthcare","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.expressandstar.com/news/crime/2017/08/04/patients-records-stolen-from-walsall-health-workers-car/"}],"summary":"Patients’ personal therapy records were stolen from the car of a member of staff at Walsall Healthcare NHS Trust. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b49e1377084981aaafd06772c738fcf74656d0a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e2079850-e473-11e7-977c-0b3846f56840"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"706c715294bd","org_name":"Victoria Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/victoria/another-child-protection-privacy-breach-names-more-than-30-kids-in-care-20170128-gu0j4e.html"}],"summary":"A department caseworker sent a spreadsheet to a Melbourne foster carer showing details of multiple expenses that had been claimed for children in out-of-home care. It identified more than 30 vulnerable children.  The document names all the children, some who are siblings, and has","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"625f0170169f986ae148e4278495b958cff282f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf1186e0-0a92-11e8-827c-bba53cbad290"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fabe06b879c9","org_name":"VICI Marketing LLC","org_type":"other","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailydot.com/layer8/telemarking-breach-calls-leaked-vici-marketing-kromtech/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/thousands-credit-card-details-exposed-us-marketing-firm-leaks-400000-audio-calls-1603532"}],"summary":"Roughly 400,000 recorded customer phonecalls stored by at least one US-based telemarketing firm have been leaked online due to a misconfigured database. The company in question, called VICI Marketing LLC, has previously faced legal action over the mishandling of consumer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eedb423b9b04d387cfca0f1718d840b2948c2a65","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2412f840-e95f-11eb-9aea-07892f56ef76"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b31f46af8de","org_name":"Vermont Department of Taxes","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wcax.com/content/news/Vermont-tax-worker-charged-with-embezzlement-identity-theft-504057141.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/vermont-taxpayers-warned-of-data-leak-over-the-past-three-years/157856/"}],"summary":"Vermont tax worker charged with embezzlement, identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IS","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c494513384f1d639b2c6575ee2142f2b3b80207","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4a615ac0-8115-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/millions-verizon-customer-records-israeli-data/"}],"summary":"Misconfiguration of AWS bucket leads to customer data disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d8c62a517aec02dba3df3b161067633699569f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03e19b70-e4a3-11e9-8cfd-bf57b38104b7"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d8ed8a39ca8","org_name":"VCU Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wric.com/news/8-investigates/vcu-patient-after-personal-information-stolen-twice-you-live-in-fear-/1974269774;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.virginiafirst.com/news/local-news/vcu-patient-s-personal-information-stolen-twice/1984456740"}],"summary":"Imagine having your personal and medical information stolen not once, but twice. It happened to a VCU Health System patient. And it was an inside job.  “It’s extremely frustrating,” said that patient, who 8News is not identifying. “You live in that fear, will my money be taken, w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c3df574300ab8cb1299692f0ea4ead76eba0921","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c6c8ec20-e210-11e7-8553-197c24c367d2"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b12ae1a91183","org_name":"UPMC Susquehanna","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyitem.com/news/upmc-susquehanna-notifies-patients-of-data-breach/article_ee1b32c6-cbb6-11e7-97e6-bf68278e1b03.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wnep.com/2017/11/17/1200-people-affected-by-data-breach-at-upmc-susquehanna/"}],"summary":"UPMC Susquehanna has notified 1,200 patients treated at various UPMC Susquehanna locations that their personal information — including names, dates of birth, contact information and Social Security numbers — may have been inappropriately accessed.  The breach was discovered on Se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"850b53b582e07ff67b1bc3bb8213cfeb6702583e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eb212000-a1a2-11e7-bd2e-43ac41b832c9"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f164159dcc3","org_name":"University of Maryland Faculty Physicians Inc.","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/bs-md-security-breach-20170113-story.html"}],"summary":"doctor's practice plan affiliated with the University of Maryland School of Medicine has notified patients that somebody hacked the account of a physician assistant's email account that contained the personal information of patients.  The orthopedics practice at The University of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ace107c67d9fb5febb409d8d2e2a0648bfc030cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d8a27240-82ac-11e7-8009-bf30ec7afbca"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"85236a3632de","org_name":"University of East Anglia","org_type":"education","ransomware":null,"records_affected":320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thetab.com/uk/norwich/2017/06/16/exclusive-a-named-list-of-students-extenuating-circumstances-has-been-accidentally-sent-in-a-uea-department-email-27522"}],"summary":"An email detailing confidential extenuating circumstances has been sent to every undergraduate student in the American Studies school at UEA, The Tab can exclusively reveal.  It contained information about several private issues. It was sent to 320 AMA undergraduates enrolled in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ce492356c92c1933136ef49ca8a0157d03d8790","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"abb22370-d55e-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bdcee891526b","org_name":"University of Chicago Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.chicagomaroon.com/article/2017/11/28/university-chicago-hospital-patient-information-vulnerable/"}],"summary":"University of Chicago hospital patient information was potentially vulnerable to hackers due to weaknesses in the University’s network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e060c19edb251a42cd3c267a0a4428a6bf51e26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3965c160-b3a0-11e9-8244-abb132467e1d"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc254916b170","org_name":"university of chicago","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://edelson.com/wp-content/uploads/2016/05/Dinerstein-Google-DKT-001-Complaint.pdf,https://z6mag.com/2019/06/29/google-university-of-chicago-faces-class-action-over-electronic-health-record-breach/,"}],"summary":"Hospital shared records without getting permission and against their policies","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e59e3316dd2743c979a5a6b54a9618e492785d39","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d2f15020-8c28-11e7-944b-11adeb58a7b0"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76fda654eca3","org_name":"University Hospitals","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news5cleveland.com/news/local-news/cleveland-metro/local-nurse-charged-after-using-credit-card-stolen-from-patient"}],"summary":"Nurse stole payment card from patient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","internal","personal","secrets"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15a8d41be91bb16694088e38a5924717e195d6cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e1fcb180-ef5a-11e9-8b51-736a93581b2e"},"incident_date":"2017-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1658130b8171","org_name":"United States Senate","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bostonglobe.com/metro/2019/04/07/former-hassan-staffer-pleads-guilty-stealing-data/VYkyDl6wb24wNthDK99TMM/story.html,https://www.bostonherald.com/2018/10/05/former-staffer-for-sen-maggie-hassan-accused-of-stealing-private-info/"}],"summary":"An employee borrowed physical keys, and use them to install key loggers, to steal data and blackmail a politician.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d503c43fbe87225b2fe4383367062bfa9195dd9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e57a8e00-212a-11ec-82c4-4d3486f21395"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c558c14193ef","org_name":"United Nations","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.telegraph.co.uk/news/2020/02/16/cop26-security-plans-blown-civil-servants-accidentally-publish/"}],"summary":"COP26 security plans 'blown' after Westminster civil servants accidentally publish blueprints of venue online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1e6fd1a6a280bcdda9b9023a7d48a4c81167039","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ddca8580-c4a3-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f9083754b144","org_name":"UK Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mirror.co.uk/news/uk-news/terror-fear-prime-ministers-diary-10013743"}],"summary":"Travel notes of PM left on train","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859a02ca993a44c128c00b55d86cfcb3c046e1ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8e3c2a00-a2d9-11e7-b671-fb4cdbd76ea5"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7fa87d8849f","org_name":"Transformations Autism Treatment Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox13memphis.com/top-stories/fbi-believes-a-collierville-man-hacked-computer-to-steal-personal-information-of-autistic-children/539294774"}],"summary":"PII theft of patients by former employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b9e6d47868a7b8ec87b71899ca429911fdc1d22","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f63efef0-843b-11e7-9557-ff063714718d"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"135e27c1dfbc","org_name":"Townsend Police Department","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lowellsun.com/breakingnews/ci_31045208/townsend-employee-boyfriend-sue-town-former-police-officers"}],"summary":"Townsend employee, boyfriend sue town, former police officers over background check allegations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fe7f6964242521230b9335b13bdbc846e24ebb6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ec902e80-db78-11e7-b589-fd57f91024a3"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7d1d3c197b77","org_name":"The University Hospitals of North Midlands NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/action-weve-taken/enforcement/linda-reeves/"}],"summary":"Healthcare employee misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63d9979d99c438cf323d2f8674f65d53fada7d84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ff657cc0-ec41-11e7-b683-c1703914e4a4"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a453a6be68c4","org_name":"The Lash Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldonline.com/news/local/crime/article170254152.html"}],"summary":"A Charlotte man pleaded guilty to identity theft for stealing personal information from customers of a Fort Mill health care consulting firm, according to U.S. Attorney’s Office release.  Stanley Fard Harper, 32, had worked for the health care firm, The Lash Group, since 2010, th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a09a308fcb3554c07e707bb7ae1872d9b274164","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e128c980-c494-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910185272ab1","org_name":"The Aesthetic and Reconstructive Breast Center LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://louisianarecord.com/stories/511121065-woman-claims-that-surgeon-filmed-her-while-naked"}],"summary":"Allegation that doctor videotaped patient without consent and footage was viewed by unauthorized parties","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b91024e7a4a1e3ac4f4f0f4661e458a7ab1cede","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22ee2e90-093d-11e8-bbae-ed39c73f1398"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1a780913c9f","org_name":"Tennessee Secretary of State","org_type":"government","ransomware":null,"records_affected":654517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://sputniknews.com/politics/201708021056128837-personal-data-tennessee-voters-eBay/"}],"summary":"The personal information of 654,517 voters who voted in Shelby County, Tennessee, was found last month on a poll machine sold on popular e-commerce site eBay.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9829de59dc6ad63b02e2a9fc4fc1d4a61b7cc72f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43e7fc30-10b3-11ec-ac2c-abfc822846a5"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"741dfae7769f","org_name":"Tenafly High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.northjersey.com/story/news/2017/12/01/tenafly-high-school-student-charged-transcript-hacking/867309001/"}],"summary":"Tenafly High School student charged in transcript hacking ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1640d49f98cfcf9a007cdc5c0dcf2f0bce22819a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d7324f0-d56c-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15962c0cb0cc","org_name":"Tarleton Medical","org_type":"healthcare","ransomware":null,"records_affected":3929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/server-compromise-tarleton-medical-phi-potentially-accessed-8725/"}],"summary":"On January 6, 2017, the medical practice run by Dr. Harold Tarleton, MD, discovered a server had been inappropriately accessed.  On February 2, 2017, the forensics firm determined that the server had been inappropriately accessed by a third party and the PHI of patients was poten","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eab52c72c7688930776d35c98ab34c51a4dcce4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"523a96f0-8695-11e7-8e76-6d3ed9e599f7"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"53d10e7dfdbd","org_name":"Taipei City Government","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.taipeitimes.com/News/taiwan/archives/2017/01/12/2003662958"}],"summary":"An information security breach led to financial data concerning at least 2,000 Taipei City Government employees being leaked on Tuesday night, with city officials ascribing the incident to outdated and vulnerable data management software. The information, which was leaked to Yaho","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b5a4823896332a0d31d6b9de13eda60a57c17f7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09be78b0-af58-11e7-b9c1-d3b3b0fdcbd2"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c084a01df14","org_name":"Taco Bell","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/10278"}],"summary":"Alleged Taco Bell card skimmer arraigned","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3238909aac6bcaf452416adf1a82a4be3eed6263","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35214780-e2de-11e7-a8b4-b50015373b0a"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"af4cdeacac36","org_name":"T.J. Samson Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.glasgowdailytimes.com/news/t-j-samson-community-hospital-addresses-health-information-breach/article_e5160140-c415-11e7-b54c-17cfda891b0b.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbko.com/content/news/TJ-Samson-addresses-privacy-breach-456182043.html"}],"summary":"T.J. Samson Community Hospital determined after an investigation spurred by an audit that two individuals employed by “an independent health care provider” had accessed patients' health information they shouldn't have.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6a6e80680b5ad888dbcac8e1d1fae665b671353","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e5966a80-cdbb-11ea-add4-95da7645829e"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6f17fd70a64","org_name":"Superion (Click2Gov) Now DBA Central Square Technologies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.vcstar.com/story/news/local/communities/oxnard/2018/05/30/oxnard-officials-investigate-data-breach/658540002/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mypalmbeachpost.com/news/local/wellington-potential-data-breach-may-have-exposed-information/3A03rMfDrPnjMd90OJXgKN/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mypalmbeachpost.com/news/local/latest-wellington-sending-notices-000-potential-breach-victims/c7Ehb6Nm6WuSefDZm4ZCGI/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mypalmbeachpost.com/news/local/update-wellington-data-breach-hit-more-customers-than-first-reported/0HS8cpVZwv1GHz2YpPQTHN/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://kfor.com/2018/06/23/midwest-city-officials-more-than-2000-customers-affected-by-security-breach-of-utility-customer-service-online-payment-system/;"}],"summary":"This is a rather unique case, given the length of time the breach notices came out.  There is a second round as well, separated by enough time to make it likely a second actual incident, and will be coded as such.  This incident invovled many partner's data, and is thus coded fro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"NZ","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b391a1a16a28a38c470b7480a25f9de4fc58a32f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11dd69c0-b68c-11e8-b56a-011002460f8b"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"5fcf752fa48f","org_name":"SterKinekor","org_type":"technology_saas","ransomware":null,"records_affected":1619544,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fin24.com/Tech/News/ster-kinekor-website-flaw-puts-7-million-users-data-at-risk-20170316"}],"summary":"Manipulation of parameters sent to  poorly coded API allowed actor to enumerate all user details including email and plain text password","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d3a1a76936905ab98ce4813cfb0d355fb9bcf71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68bc3c70-c5a2-11e7-8053-ff1e84d2b694"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc1b0f21ac63","org_name":"St. Mary's Regional Wound Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wvrecord.com/stories/511096940-huntington-resident-accuses-wound-center-of-confidentiality-breach"}],"summary":"A patient is suing RestorixHealth LLC, also known as St. Mary's Regional Wound Center, citing alleged breach of fiduciary duty and confidentiality.  Jill C. Barber filed a complaint on Feb. 27 in the Cabell Circuit Court against the center, alleging that the medical provider viol","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d534de9713d67bf6132a6ef4a8d18ef31dd14701","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ae8aa450-8ccf-11e7-811e-83915e56fc98"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"2ebbd06a4d03","org_name":"St John Ambulance","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/bay-of-plenty-times/news/article.cfm?c_id=1503343&objectid=11906814"}],"summary":"Privacy breach by ambulance officer alleged in cannabis disclosure case - St John Ambulance","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"236ed6562519e04eb628a4b6ee4cc5f80fd36929","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5eca2a60-996a-11e7-a8f4-3b6b04fdb9a4"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"014090bd80b2","org_name":"St. Charles Bend","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvz.com/news/prineville-woman-charged-in-st-charles-bend-data-breach/585531930"}],"summary":"Misuse looking at patient records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb3b4acb3b8732b75bc4ec49c171453ed308f29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16694500-0b5a-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3ef54a67b61","org_name":"Spiral Toys","org_type":"manufacturing","ransomware":null,"records_affected":820000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-39115001"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techhive.com/article/3175229/security/smart-teddy-bears-involved-in-a-contentious-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://auth0.com/blog/cloudpets-data-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66615"}],"summary":"Insecure DB stored voice messages from connected toys","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9b68fd6ef3c6d05a800fb3afbccd54f2bda7f0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ad45080-9a59-11e7-bfd9-89a842dbe08d"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f72564b8c17","org_name":"Southeast Alabama Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dothaneagle.com/news/crime_court/woman-with-access-to-some-samc-patient-information-faces-identity/article_ca1e6b5a-5dba-11e7-b612-bf0a61f8add1.html"}],"summary":"Healthcare worker steals identities","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1d5f6eae3d3535d5f4482a2fc4f49195355a11","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39e10a50-e35e-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6da21b6da18","org_name":"South Fulton Mental Heath Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs46.com/story/34505007/victims-of-fulton-county-medical-record-breach-unlikely-to-be-compensated;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs46.com/story/34470411/fulton-county-clinic-dumps-sensitive-medical-records-in-plain-sight"}],"summary":"Fulton County officials are confirming the employee at the center of a data breach investigation worked at the South Fulton Mental Health Center for a number of years and had access to all the documents in question.  Officials won't identify the employee, but suggested the person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f3b02dea781637220657f1b73146211ad234892","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4cc1e380-30e2-11ec-9798-915a6ecdc137"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"4de93d7c534f","org_name":"South African Mint Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news24.com/Africa/Zimbabwe/zim-truck-driver-faces-charges-over-bond-coin-leak-20170924"}],"summary":"Zim truck driver faces charges over bond coin leak by taking picture of the invoice - South African Mint Company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bff9adee5728770eeeaa830eabf15c10f91675e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b04629c0-8439-11e7-a921-2d695ce70b69"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10a434ef4ff6","org_name":"Sky Climber LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dojmt.gov/wp-content/uploads/Sky-Climber-LLC.pdf"}],"summary":"All employee W2 information which shows everyone’s personal earnings, addresses, and social security numbers was released to a person believed to be one of the Owners (but wasn’t).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a8113e937d2443a6383458dad19fb43cb0239de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f518310-ec42-11e7-b683-c1703914e4a4"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b63f0afbe917","org_name":"Silver Cross Hospital","org_type":"healthcare","ransomware":null,"records_affected":8862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/business/ct-silver-cross-hospital-data-breach-0830-biz-20170829-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.suntimes.com/news/silver-cross-data-breach-exposed-patient-info/"}],"summary":"Silver Cross discovered in June that some patient information may have leaked onto the internet after a vendor that manages parts of its website upgraded its software, according to a letter sent earlier this month to those potentially affected. The upgrade may have reconfigured s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8666ff9f676f066ea31712d330d28fb75c99840a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18de8190-e217-11e7-a8b4-b50015373b0a"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0f5a289e1cff","org_name":"Shrewsbury and Telford NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.countytimes.co.uk/news/2017/11/17/gallery/probe-into-data-leak-as-patients-private-letters-end-up-in-newtown-100044/"}],"summary":"An envelope containing the nine letters from a consultant for patients right across Shropshire were wrongly included in a letter sent to a patient in Newtown.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"UY","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9daf2335ed04206c117175aab2fba6100cd426c2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c9ea9a40-c58f-11e7-8314-790c8d59abbb"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"289f8a8fc481","org_name":"Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.13abc.com/content/news/Another-skimming-incident-uncovered-411907255.html"}],"summary":"Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aa5c37a14050b6e984d44431e339742bd3cd7ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d083baf0-c330-11e7-8a32-4d861156a278"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"889ac610c292","org_name":"Saint Thomas Rutherford Hospital","org_type":"healthcare","ransomware":null,"records_affected":2859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/9677"}],"summary":"Lost docs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"KP","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2017-0144"],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6723d44b0acd6919afdd09c3521c8a540a2c649d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83139810-c332-11e7-8a32-4d861156a278"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"651d3df9c670","org_name":"Royal Stoke University","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.co.uk/entry/nhs-cyber-attack-hospitals_uk_5915c519e4b0fe039b3419dc"}],"summary":"Ransomware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2017-0144","kev_added":"2022-02-10","name":"Microsoft SMBv1 Remote Code Execution Vulnerability","days_listed_before_incident":-1866,"product":"Microsoft SMBv1"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb89855f3284dccd7532091b70391d621a78561c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af83d990-e20f-11e7-8553-197c24c367d2"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bcf87f5afca3","org_name":"Royal Shrewsbury Hospital","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.shropshirestar.com/news/health/2017/11/14/royal-shrewsbury-hospital-probes-leak-of-patients-data/"}],"summary":"An envelope containing highly sensitive medical information relating to nine patients from Royal Shrewsbury Hospital was sent to a member of the public by mistake.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5d60b1aef502f0f2304ee42a87ceded8a3a16d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0debf4f0-db7a-11e7-b589-fd57f91024a3"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"942e7811d674","org_name":"Rotech Healthcare","org_type":"healthcare","ransomware":null,"records_affected":957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hmenews.com/also-noted/rotech-employee-sentenced-identify-theft"}],"summary":"Healthcare employee commits ID theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72534ade565026bed3435a9305433aa960e5901e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04fe34c0-0b5e-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8dfba8d7b415","org_name":"River City Media","org_type":"technology_saas","ransomware":null,"records_affected":1370000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationsecuritybuzz.com/expert-comments/1-37bn-email-addresses-leaked-river-city-media-breach/"}],"summary":"1.37bn Email Addresses Leaked After River City Media Breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6a4e514b6f20fc92c1ccb633d78009db6506b8e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34c49240-811a-11e7-8520-b5d4bef506ca"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bc172f8428bf","org_name":"RICOH","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://iapp.org/news/a/ricoh-suffers-embarrassing-data-breach/"}],"summary":"Data breach affects Ricoh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcb6347ccb1238de066d4819af00bd19d45d5daa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f5369f80-0b5a-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"a6a7d401af71","org_name":"Reliance Jio","org_type":"technology_saas","ransomware":null,"records_affected":120000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techtimes.com/articles/211294/20170710/reliance-jio-may-have-suffered-indias-worst-data-breach-personal-information-of-over-120-million-subscribers-possibly-compromised.htm"}],"summary":"Database compromise, little details provided","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97fa3e446b1a38076a1c3737ce8a8a88876c7550","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a496b180-972a-11e8-8342-0f8f10fcd812"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"198ed6f21b1a","org_name":"Providence Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spokesman.com/stories/2018/jul/21/sue-lani-madsen-hipaa-identity-theft-sort-of/"}],"summary":"Patient detailed faxes being sent to a private residence","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a23072ef11e5b8008dd8f240c1d34acca3f254a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6da62130-98eb-11e7-a6db-535ccd646699"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05cfef1031b2","org_name":"Princeton University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/princeton-university-becomes-victim-of-mongodb-ransom-attacks/"}],"summary":"Princeton University becomes victim of MongoDB ransom attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9d1f87bfa55f5876a07b09d80fbf60c99e89af4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d072bc0-996b-11e7-a8f4-3b6b04fdb9a4"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e177fbf4349b","org_name":"Port Pirie Regional Health Service","org_type":"healthcare","ransomware":null,"records_affected":234,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.portpirierecorder.com.au/story/4778146/authorities-scramble-after-laptop-theft/"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"664eef2cdce5f56e6e4796d079ce63403bdc6db5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3139e850-98e9-11e7-a6db-535ccd646699"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a372f992ab2b","org_name":"Pioneer Manor","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mywestnipissingnow.com/16058/woman-charged-pioneer-manor-case-images-residents-shared/"}],"summary":"Sudbury police have charged one person in the Pioneer Manor controversy where images of 10 residents were taken and shared without consent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bce79e6465c87281152fbabb9e623a5102b3076f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"185d8850-c5a8-11e7-8053-ff1e84d2b694"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1493a553122a","org_name":"PharmaNet","org_type":"government","ransomware":null,"records_affected":20500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.richmond-news.com/news/richmond-man-arrested-in-pharmanet-privacy-breach-1.14202350"}],"summary":"A Richmond man has been arrested in connection to a series of PharmaNet breaches that may have compromised the personal medical information of about 20,500 British Columbians.  Vancouver police executed a search warrant at a home in Richmond on March 23 and arrested a suspect. In","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e20c999be4f6a8908703caacd65756b0ff4f4df5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"edce1120-0cbd-11ec-a2d0-f3cc343be99c"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e16e6f75be47","org_name":"Perth Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.digitaltrends.com/computing/hacker-breaks-into-perth-airport-network/"}],"summary":"VIETNAMESE HACKERS COMPROMISES PERTH AIRPORT SECURITY","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccb5d5df2bf38b45440f4612aec440e15dead111","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e1cf1da0-9d6e-11e7-af90-45f1ceac3d54"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e352b6f71f2b","org_name":"Persante Health Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dojmt.gov/wp-content/uploads/Persante.pdf"}],"summary":"that Persante Health Care (“Persante”) has been the targeted victim to an email spoofing incident. This scam resulted in the breaching of your personal information contained on your W2 Form.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e06cb3e88b06e48a79c92346bb2882bf186ced14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7bffc3c0-db77-11e7-b589-fd57f91024a3"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d6fe56f7320","org_name":"Pennsylvania Department of Human Services","org_type":"government","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pennlive.com/news/2017/09/state_data_breach_affecting_50.html"}],"summary":"Misdelivery via snail mail","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6abf6c6524f653cf74d3e0a5358626f12c2c09ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d9591be0-d55d-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a161b5d8bd5c","org_name":"Penn Medicine Dermatology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buckslocalnews.com/news/male-nurse-who-secretly-videotaped-female-patients-at-lower-makefield/article_1816a106-9569-5ea0-bc0f-3b922131a27b.html"}],"summary":"Male nurse secretly videotaped female patients as they disrobed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae145ce3fa41f7ccdf560aededdcf09d3fd8f83b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24eb6da0-8113-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a33afdc199f4","org_name":"Peachtree Neurological Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/atlanta-clinic-finds-15-month-breach-during-investigation-separate-ransomware-attack"}],"summary":"Ransomware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdac79f6812550b04c5c1758da0573991fca8d0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b8580b70-8cd5-11e7-811e-83915e56fc98"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"853e2ba8d30f","org_name":"PathWest","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.watoday.com.au/wa-news/perth-woman-wants-pathwest-employee-sacked-for-revealing-records-20170816-gxxhrw.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://thewest.com.au/news/wa/love-rival-in-pathwest-privacy-breach-ng-b88568511z"}],"summary":"A PathWest employee inappropriately divulged sensitive medical test results of a romantic rival to the man at the centre of their love triangle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5236e570a22f75b31c2db69b1e4e5452f63273f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3a8e9110-e45e-11e7-977c-0b3846f56840"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e47c2c9e68c1","org_name":"Palmetto Speech and Language Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews4.com/news/crime-news/mount-pleasant-speech-pathologist-indicted-on-medicaid-medicare-fraud-charges"}],"summary":"Speech pathologist stole the identities of other pathologists so she could continue to submit false medicare claims.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c568b78d42c20cdcc5cf1ccc3814e9874a1e7c2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ff0cfe0-8923-11e8-8760-271b3d9edf6d"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"34f19333ded8","org_name":"Pakistan National Database and Regulatory Authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.dawn.com/news/1416906/two-former-nadra-officials-booked-for-stealing-sensitive-records;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dunyanews.tv/en/Pakistan/445889-Voters-data-theft-Case-NADRA-ex-deputy-chief-lodged-"}],"summary":"ISLAMABAD: A former deputy chairman and a deputy director of the National Database and Regulatory Authority (Nadra) were on Friday booked for stealing sensitive records of the authority.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d6d78f9a6c5444659a0d23fef2853d641a44e44","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d0a2d40-e219-11e7-a8b4-b50015373b0a"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8333bff64edb","org_name":"Otolaryngology Associates of Central Jersey","org_type":"healthcare","ransomware":null,"records_affected":1551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mycentraljersey.com/story/news/health/2017/11/16/central-jersey-medical-practice-reports-records-breach/858917001/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/medical-records-stolen-new-jersey-medical-practice/"}],"summary":"Otolaryngology Associates of Central Jersey is alerting patients to a breach of their protected health information, following a burglary at an off-site storage facility in East Brunswick, NJ. The thieves took 13 boxes of paper medical records from the facility, which included inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae7c237e60e7cc7f4f03886808fce39870bddee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71de9530-c4a5-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9eb4fe20fe27","org_name":"Ohio Department of Rehabilitation and Corrections","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mansfieldnewsjournal.com/story/news/crime/2017/03/07/exclusive-inmates-ssns-mistakenly-released-identity-thief/98847916/"}],"summary":"SSN provided erroneously as part of an information request","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a54cf60dabbf58a8288a8f0ef648a94ca723abd2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59d82810-82b1-11e7-8009-bf30ec7afbca"},"incident_date":"2017-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b87dc3795f4d","org_name":"Ohio Department of Rehabilitation and Correction's (ODRC)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/04/12/prisoners_built_computer_connected_to_states_network/?utm_source=dlvr.it&utm_medium=facebook;"},{"fetched_at":null,"title":null,"type":"press","url":"https://regmedia.co.uk/2017/04/12/ohio_inspector_general_report.pdf"}],"summary":"Prisoners built two PCs from parts, hid them in ceiling, connected to the state's network and did cybershenanigans","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9292b39970876a981635a34bf666c1f4aa53011d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6992fbf0-811b-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"731fa43348bf","org_name":"Northern Territory Families","org_type":"government","ransomware":null,"records_affected":33,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2017-06-20/confidential-child-protection-files-dumped-at-alice-springs-tip/8635200"}],"summary":"Disposal error leads to PII disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2360e7073696c9c099dcb52c4023ae4e36eba10f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"becd6e20-eea8-11e7-b683-c1703914e4a4"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd0a2a12717b","org_name":"North Dakota Department of Human Services","org_type":"government","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kfgo.com/news/articles/2017/jun/04/medicaid-records-found-in-bismarck-dumpster/"}],"summary":"Medicaid records found in Bismarck dumpster","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fdb456f26e5660f3fdf79bac5fe91d838a4e27a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e2008570-995e-11e7-a069-d9175a67bd3e"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"77dc25ab69a0","org_name":"NHS Lanarkshire","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/08/30/lanarkshire_nhs_infection_named_as_bitpaymer_variant/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://stv.tv/news/west-central/1396611-cyber-attack-which-hit-nhs-board-was-ransomware/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/08/30/lanarkshire_nhs_infection_named_as_bitpaymer_variant/"}],"summary":"NHS Lanarkshire hit by cyber attack cancels operations and asks patients not to come to hospital 'unless it is essential' ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9e4502bd3bdad8cff1c992613d6ef89ef3985c0","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12a9acf0-da2e-11e7-a58f-dff506a792fb"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"7cc01415d46d","org_name":"National Institute for Health and Welfare","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://yle.fi/uutiset/osasto/news/thl_personal_data_and_lab_results_of_more_than_6000_people_leaked_online/9851191"}],"summary":"Personal data and lab results of more than 6,000 people leaked online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd8ac368f9e7eae03c09e74edd46eb560bcc6043","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2e481050-8434-11e7-a921-2d695ce70b69"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"e20a25dcff18","org_name":"Nakano Ward office","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.japantoday.com/category/crime/view/former-tokyo-ward-worker-arrested-for-stealing-personal-info-of-woman"}],"summary":"Police in Tokyo said Wednesday they have re-arrested a former part-time employee of the Nakano Ward office on suspicion of breaking and entering, as well as violating a privacy protection ordinance.  According to police, Kenichiro Takahashi, 29, who had already been arrested for ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26c2a9ec27c23c843dcfc865cf868fc1d291ee95","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9f747e00-c4a1-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d40c2d337818","org_name":"Mountain Home Water Department","org_type":"energy_utilities","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baxterbulletin.com/story/news/local/2017/03/14/city-erases-re-installs-server-after-ransomware-attack/99128740/"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1922f3d0df392caf253eddbb4a7adb2b2a62ec3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d24d7280-6b0c-11e7-9b43-bf152d61c1c6"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5bb18bd0595d","org_name":"Mobil Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtnh.com/2017/06/06/police-looking-for-person-who-installed-skimming-device-at-essex-gas-station/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.masslive.com/news/index.ssf/2017/06/skimming_device_found_on_pump.html"}],"summary":"Police looking for person who installed skimming device at Essex gas station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2253a90f2d8203fffca0f959de0efbc53d14be48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d24d7280-6b0c-11e7-9b43-bf152d61c1c6"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9ae7eb98c39","org_name":"Mobil","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtnh.com/2017/06/06/police-looking-for-person-who-installed-skimming-device-at-essex-gas-station/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.masslive.com/news/index.ssf/2017/06/skimming_device_found_on_pump.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc30.com/news/police-warning-hanford-residents-after-high-tech-skimming-device-found-at-gas-station/1703056/"}],"summary":"Police looking for person who installed skimming device at Essex gas station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cf22d8800c9a6ead6b19293f5039428b9cfbe88","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cd505a20-9953-11e7-a069-d9175a67bd3e"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f3dbc87feeb","org_name":"Minneapolis Star-Tribune","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://homelandprepnews.com/stories/22852-latvian-man-indicted-scareware-hacking-scheme-minneapolis-star-tribunes-website/"}],"summary":"Latvian man indicted for “scareware” hacking scheme on Minneapolis Star-Tribune’s website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b0c0a29c58829f21bff212740f0f0aed61d716d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af617680-c55d-11e7-8460-859aaa890f03"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"00d41e4df5f5","org_name":"Ministry of Social Development","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11798445"}],"summary":"Misdelivery of documents w PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a3e4dbb800aae6fbf15c07a06e3fabd9c382995","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"079e1b90-eab2-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3752b85a4392","org_name":"Ministry of Health","org_type":"government","ransomware":null,"records_affected":7500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/british-columbia/bc-pharmanet-breach-1.3985173"}],"summary":"The personal information of approximately 7,500 British Columbians may have been compromised through the provincial government's PharmaNet system, according to the Ministry of Health.  A letter from the ministry was sent last week to B.C residents affected by the breach. The lett","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b1fb1cbb1282beaf93e89f35fa199db35df89a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0624bad0-a19c-11e7-bd2e-43ac41b832c9"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a57d303dadd6","org_name":"Militarysleep.org","org_type":"government","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/misconfigured-mongodb-database-exposes-sleep-disorder-program-patients-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/316-militarysleep-breach"}],"summary":"More than 1,200 patient profiles exposed to the world because a sleep disorder clinic serving military personnel had a misconfigured MongoDB database that was indexed by Shodan.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98c9d7c6ccb91567a71b1ccf0319085eb79479a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25556460-8cd7-11e7-811e-83915e56fc98"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa1132b31b39","org_name":"Mid-Michigan Physicians; McLaren Medical Group","org_type":"healthcare","ransomware":null,"records_affected":106000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wilx.com/content/news/Data-breach-at-Mid-Michigan-Physicians-Practice-441746563.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lansingstatejournal.com/story/news/local/2017/08/25/lansing-data-breach-mid-michigan-physicians/602183001/"}],"summary":"McLaren Medical Group, which manages the Mid-Michigan Physicians clinic, said it was notified in March that a Radiology Center computer system was compromised. Letters were mailed to patients on Thursday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7b24ec566ac2263d1d729bdf51040e0ff36cf9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d128dc0-7615-11e7-9d88-ab89f89c69db"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0b4009e031b","org_name":"Miami Police Department","org_type":"government","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hackers-dox-miami-police-officers-with-data-stolen-from-government-database/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://motherboard.vice.com/en_us/article/bmvze8/hackers-dox-miami-police-officers-with-data-stolen-from-government-database"}],"summary":"Hackers ‘Dox’ Miami Police Officers With Data Stolen From Government Database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f5d06190110384e51e186fa6d7c3d77ca9e9945","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fb403160-8c2b-11e7-944b-11adeb58a7b0"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85300e94e485","org_name":"Mercy Health Love County","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kxii.com/content/news/Stolen-medical-records-uncovered-in-identity-theft-scheme-435737003.html"}],"summary":"Former employee breaks in, steals medical records for id theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"962c8e03888a8ab6b979cd9c8516c956fd8dd70f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6e405a10-d55f-11e7-bfad-07ede9e0bc7c"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"426eb0e9fb53","org_name":"Mann-Grandstaff VA Medical Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/lost-laptop-sees-phi-3725-veterans-exposed/"}],"summary":"A decommissioned laptop computer previously used by the Mann-Grandstaff VA Medical Center (MGVAMC) in Spokane, WA, has been discovered to be missing, potentially resulting in the exposure of sensitive patient data. The laptop was paired with a hematology analyzer and stored data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bb6286de601e8a51ec6633ca8e460bcc922b1b8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52979d10-7618-11e7-9d88-ab89f89c69db"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bddbc30c361b","org_name":"Mandiant","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://pastebin.com/6HugrWH4#LeakTheAnalyst;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3211894/security/hackers-claim-credit-for-alleged-hack-at-mandiant-publish-dox-on-analyst.html"}],"summary":"Hackers claim credit for alleged hack at Mandiant, publish dox on analyst","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c19b2c1a103222ac55060e6e6078bbb1feb58c5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bfd27100-899d-11e7-bf1d-81579668407a"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"ec8ec1dab3b0","org_name":"M.G.A.R. Ltd","org_type":"professional_services","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/waterly-app-potentially-exposed-up-to-1-million-israelis-details-researcher/"}],"summary":"Waterly app potentially exposed up to 1 million Israelis’ details- researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51cd29a2c36a00fe5d66eecf569bfd3048bf26d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d5a33ce0-bf73-11e9-8126-75153e867d2b"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"947f52c642c2","org_name":"Los Angeles Superior Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ktla.com/2019/07/26/texas-man-facing-350-years-in-prison-for-hacking-into-l-a-superior-court-sending-2-million-phishing-emails/"}],"summary":"A Texas man was found guilty Thursday of hacking into the Los Angeles Superior Court computer system and then using it to send about 2 million phishing emails, the U.S. Department of Justice said.  A jury found 33-year-old Oriyomi Sadiq Aloba guilty of 27 federal criminal charges","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fddf063581267de8014f476514115ecd3bb4b47c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e8a07ca0-15e4-11ea-ba54-075d8b11bbd2"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"797e406c7628","org_name":"London Borough of Newham","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.itpro.co.uk/privacy/33401/ico-fines-newham-council-145000-for-gang-data-gaffe,https://www.infosecurity-magazine.com/news/london-council-fined-145k-over-1-1/"}],"summary":"sensitive gang information emailed by police to multiple organizations not authorized to receive it","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f725ed7f77b86e563bb6faed6f5a7c353fe5f77","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1c8aeff0-c498-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60af5e2142f9","org_name":"LKM Medical","org_type":"retail_ecommerce","ransomware":null,"records_affected":3400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/article/5551260"}],"summary":"Stolen device contained PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f5e6dcf15527483bf365bdfb95ed2c5dfcb757e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b451da50-7c5f-11e7-8ec0-e369e9638092"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e5716446284a","org_name":"Laurentian University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/sudbury/programs/morningnorth/student-says-he-hacked-laurentian-university-to-prove-it-was-vulnerable-1.4084267"}],"summary":"Man charged with hacking into school network. No info on methods or","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f73a149a04eec1aebcfbcf79d265e441b861f0b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"347abf90-7c5a-11e7-8ec0-e369e9638092"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"059bb56ecc72","org_name":"LaunchPoint Ventures","org_type":"professional_services","ransomware":null,"records_affected":18500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthcare.com/privacy-security/anthem-business-associate-compromises-phi-for-18-500-members"}],"summary":"Employee misuse resulting in 18500 PHI record loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c968184dc203552b4d7b6ed9a08660f527e0a3df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38785480-1644-11ec-8258-83f74c3914c9"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b10c63310e24","org_name":"Larimer County Clerk and Recorder","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thedenverchannel.com/news/investigations/thousands-exposed-to-identity-theft-after-county-officials-publish-sensitive-information-online"}],"summary":"Thousands potentially exposed to identity theft after Larimer County published sensitive information online ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6da8265654987b98be78bf2fcb57ef42c065fa0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08240ba0-d0b8-11e8-bbbb-67b2993a8980"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"247764c9bd66","org_name":"Lanterman and Allen Funeral Home","org_type":"other","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://fox6now.com/2018/10/03/funeral-director-guilty-of-16-counts-of-abuse-of-corpse-after-taking-graphic-cellphone-photos/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://wnep.com/2018/10/03/former-funeral-director-sentenced-in-monroe-county/"}],"summary":"A former Pennsylvania funeral director was sentenced Wednesday after she pleaded guilty to taking photos with bodies as they were being prepared for burial.  Angeliegha “Angel” Stewart pleaded guilty in Monroe County court to 16 counts of abuse of a corpse. She will spend the nex","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fae37267207ff10bcd51b3484dc23af85117b4fe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74700250-9747-11e8-8342-0f8f10fcd812"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d6ed276c198","org_name":"Lane County Health and Human Services","org_type":"government","ransomware":null,"records_affected":715,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kezi.com/content/news/700-patients-medical-records-lost-possibly-destroyed--489095871.html"}],"summary":"Lane County Health and Human Services announced the loss of 49 boxes containing patient and client information Tuesday night.  The boxes contained 566 Community Health Centers of Lane County patient medical information files and 149 Lane County Developmental Disabilities client f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79191a495ee1bee96f1b4f88f015e9f7c4188281","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28dbfc40-e20c-11e7-8553-197c24c367d2"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e760e57733bf","org_name":"Lakes District Hospital and Health Centre","org_type":"healthcare","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.terracestandard.com/news/privacy-breach-at-burns-lake-hospital/"}],"summary":"A privacy breach has recently occurred at the Lakes District Hospital and Health Centre in Burns Lake.  Approximately 150 people were affected.  “We are notifying individuals whose health information was inappropriately accessed by an employee,” explained Eryn Collins, a spokespe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e394750c99ebdb1795c4e277c8b497025d86ecf6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48296db0-72d3-11e7-ace1-3bcdf5dc8d5d"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1e678e515df5","org_name":"Laing O'Rourke","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/3291386/laptop-with-plans-for-uks-new-18bn-nuclear-plant-stolen-from-contractors-car-in-security-blunder/"}],"summary":"NUKE PC NICKED Laptop with plans for UK’s new £18bn nuclear plant stolen from contractor’s car in security blunder","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62b7a6e583ce399115a54523081359a3a1548698","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28f613d0-e928-11e9-b01d-8d8474fb7a4b"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"117a8ecf3186","org_name":"July Systems","org_type":"professional_services","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/july-systems-data-leak-massive-trove-sensitive-information-exposed-online-via-unsecured-database-1650142"}],"summary":"Massive trove of data was left exposed online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7c313456eb09aa5635084e8b7ef393b8bf4bc9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8751dee0-aa2d-11e8-b2b4-5de6d270e153"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd75929e9712","org_name":"Jacksonville Sheriff's Office","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.news4jax.com/news/crime/jacksonville-sheriffs-office-announces-corrections-officer-arrest"}],"summary":"A former corrections officer charged with felony after leaking confidential data regarding informants arrest report.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92e96ad80e69dc934a027b153be9b970923dec76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a721b910-8cd4-11e7-811e-83915e56fc98"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d62e8f9da7c6","org_name":"Ipswich Hospital","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eadt.co.uk/news/hospital-staff-sacked-for-prying-at-patients-medical-records-in-suffolk-and-colchester-hospitals-1-5150406"}],"summary":"Hospital staff sacked for prying on patients’ medical records in Suffolk and Colchester hospitals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63eda683477493bfccd3baa5854f6b47913527f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45dcfdf0-d963-11e7-8b17-fdfed30923dd"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f62f373f2342","org_name":"Inner City Family Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox5dc.com/news/local-news/230238476-story"}],"summary":"Worker emailed PHI ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e65a12b1a7fc9911ba0de1827dbff371c307cc9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3fab8fa0-e2dc-11e7-a8b4-b50015373b0a"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a5d2a5220d70","org_name":"Independent Inquiry into Child Sexual Abuse","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breakingnews.ie/world/uk-child-sex-abuse-inquiry-breaches-anonymity-of-alleged-victim-813494.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-41932064"}],"summary":"The UK Independent Inquiry into Child Sexual Abuse (IICSA) has breached the anonymity of an alleged sexual offences victim by publishing their name on its website. The person's name appeared online in the title of a document, although it was redacted in the body of the text.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fffa7abd04363c48703c19ab536878cacfb514a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a123d630-842b-11e7-a921-2d695ce70b69"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"035b9b2aac25","org_name":"Independence School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kcur.org/post/social-security-numbers-stolen-all-independence-school-employees#stream/0"}],"summary":"The school district employees were alerted to the scam in an email sent last Thursday.  In it, the business office says “the names, social security numbers, addresses and earnings” of every employee was stolen in a phishing scam, where the crooks use fake emails or websites to st","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af157911141bfa400c6d939dd0c620a1b29a43c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ffae2fc0-9a56-11e7-bfd9-89a842dbe08d"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a420e357bc5","org_name":"iMax Medical Billing","org_type":"professional_services","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/medical-billing-firm-exposes-unencrypted-protected-health-information/"}],"summary":"Medical billing firm exposes unencrypted protected health information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c356c493581409313f5f8300c5e84b463ed87bc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31722340-8f0d-11e7-aa8f-5fa9d3670494"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c6de59982e1a","org_name":"Heart Cup Cafe","org_type":"retail_ecommerce","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.deccanchronicle.com/nation/crime/300817/telangana-man-held-for-skimming-debit-cards.html"}],"summary":"Telangana: Man held for skimming debit cards - Heart Cup Café","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"481d2c77f54c6cec1d2ed65805632df1bc8e9b5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8bbb6aa0-c49b-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c5aa9f56228","org_name":"HealthNow Networks","org_type":"other","ransomware":null,"records_affected":918000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/thousands-of-patients-data-leaks-telemarketers-bad-security/"}],"summary":"DB uploaded to publicly accessible AWS bucket owned by former employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6f431da30680682eae1e17ae3377545075eda26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"891c9e80-ac77-11e8-8036-a30436c88231"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d8582cdf2da4","org_name":"Health Sciences North","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesudburystar.com/2017/12/17/breach-of-medical-info-angers-patient"}],"summary":"The hospital confirmed on Dec. 7 in a letter to Labelle that a privacy breach involving her personal information had taken place.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b93dede6bdf3ce11e901dfc6684942a522baa43","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49d11230-35d7-11e9-99ac-992d1be32369"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"87945d2925dd","org_name":"Hardware Zone","org_type":"technology_saas","ransomware":null,"records_affected":685000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.channelnewsasia.com/news/singapore/hardwarezone-hwz-security-breach-685999-user-profiles-affected-9975156"}],"summary":"hardware zone's website was compromised by a hacker who had used stolen credentials to gain access to the site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d5e310a8b41f0384399cf96e17ec86a0a844fcb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c1f2a110-6bd1-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"9799adf118e4","org_name":"Gutu Magistrate","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zimeye.net/shocking-theft-of-secure-criminal-records-at-gutu-magistrates-court/"}],"summary":"Robbers Break Into Magistrate’s Court","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8159fea5069e659e150d649c57291553e163941a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ea428360-1d0d-11eb-a925-afd7acbe9906"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82671489d50e","org_name":"Groupize","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/meeting-and-hotel-booking-providers-data-found-in-public-amazon-s3-bucket/127542/"}],"summary":"Personal and business data belonging to Boston area meeting and hotel booking provider Groupize was discovered in a publicly accessible Amazon Web Services S3 bucket, which has since been locked down","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c7940600d1ab16855cd36724e0ce3b916b1685b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38e9cfb0-8440-11e7-9557-ff063714718d"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8b70e4783dff","org_name":"Grey Eagle Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/3208546/security-experts-call-grey-eagle-casino-security-breach-a-wake-up-call/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/3206136/grey-eagle-casino-employee-information-leaked-in-major-privacy-breach/"}],"summary":"Computer security experts say confidential employee information hacked from a computer in an office at the Calgary-area casino is the tip of a much bigger problem.  Someone gained access to a computer in the human resources department and downloaded confidential letters and files","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"024eb631f4433b1935230ad85f5b9dbcd778723c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"daa10f20-e1e8-11e7-8553-197c24c367d2"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MT","org_id":"9af2f9e277e9","org_name":"Gozo General Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.maltatoday.com.mt/news/court_and_police/82808/hospital_employee_acquitted_of_using_wifes_sensitive_patient_information"}],"summary":"An employee of Gozo General Hospital has been acquitted of offences under the Data Protection Act after allegedly pulling strings to get his estranged wife’s medical records exhibited in annulment proceedings. The male employee, whose name has been withheld by the court, was char","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ec8d48ab806ec1fdcc59678ad23ceb4e6b50f79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c506fd50-8117-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"10359276378a","org_name":"Government Digital Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-40443601"}],"summary":"Publishing error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74ba6ed74c953baf04de273657fe91394f9158b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2b68a8f0-8767-11e7-944f-971cfc93387d"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42bbb54996da","org_name":"Gannett","org_type":"technology_saas","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.welivesecurity.com/2017/05/04/gannett-co-data-breach-18000-employees-reportedly-affected/"}],"summary":"Phishing attack on HR results in account compromises of 18K employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03c687915248c49ca3b82ee062914a6e0c303ca2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"015645d0-eab9-11e7-92b6-dfe49f9d7042"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6643c4366aa","org_name":"Gallup Indian Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/nm-supreme-court-to-review-alleged-hipaa-violation-case"}],"summary":"Victim was sexually assaulted and employees shared the details with eachother.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba56a08bc33681c182711d92065b1b555df71c08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62ab1030-6bda-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"271433163472","org_name":"Flight Centre","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2017-07-13/personal-information-leaked-third-party-suppliers-flight-centre/8706422;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/07/13/flight_centre_data_breach/"}],"summary":"Flight Centre says human error behind customer information leak","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03e341f483488aaff4eb3c574cebf551e0a90004","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55577e50-1496-11ec-92c0-8d3c636e1e37"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"79eaa172f2de","org_name":"FFrees","org_type":"financial","ransomware":null,"records_affected":94574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.com/2017/08/16/ffrees_breach/"}],"summary":"FFrees had a breach discovered by a security researcher, but didn't really tell any of the impacted customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f326788a0b62a0dc82807feed98d7ae42dba3697","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"795e8790-016e-11ea-9d67-277844cc3a60"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b1622c2a0a4","org_name":"eBay Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ecommercebytes.com/C/blog/blog.pl?/comments///1512941047.html,https://www.ecommercebytes.com/C/blog/blog.pl?/pl/2017/12/1513039564.html"}],"summary":"ebay was sending PII along with customer reviews to google for indexing?","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30d085d0ca8ad9f888e26cbc1ea89b6e6430efa3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b01a9c30-81e4-11e7-ace7-c5c15a923e51"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0653518d41fc","org_name":"Dumfries and Galloway Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyrecord.co.uk/news/local-news/dumfries-galloway-council-under-investigation-10915437;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyrecord.co.uk/news/local-news/dumfries-galloway-council-under-investigation-10915437"}],"summary":"Confidential child report 'blunder' made by Dumfries and Galloway Council.  A mum jailed for abducting her children was sent confidential information disclosing where her son lives with foster carers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3998b612cf0ba734a62f86f7d7a9262e550e6c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b1fbffe0-995d-11e7-a069-d9175a67bd3e"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4e4fb4d300f1","org_name":"Dr. Michael Lai","org_type":"healthcare","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/toronto/personal-health-information-on-back-of-doctors-prescription-according-to-toronto-man-1.4248836"}],"summary":"Privacy commissioner investigating after man finds information of 60 patients on back of prescription - Dr. Michael Lai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3be154102805b588f9382bc6925dc90afecb7d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"be20e490-be4f-11e7-8a32-4d861156a278"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"244cb9fdd7be","org_name":"Dr. Davidson","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pymnts.com/safety-and-security/2017/cannabis-delivery-startup-eaze-experiences-security-breach/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6660667e35715408c7bff2273d18cbe9e146c350","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"368ca7b0-eead-11e7-b683-c1703914e4a4"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54971271bed1","org_name":"Desert Orthopedics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kbnd.com/kbnd-news/local-news-feed/292843"}],"summary":"A Bend woman is accused of stealing patients’ personal information while she worked in the billing department of a local medical clinic. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d38ad6dbfff75ed6b913942a33c35b87b23f6f5a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f7d32230-77b3-11e7-a457-a5a222e6d450"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aff9a02b6d62","org_name":"Defense Point Security, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/03/govt-cybersecurity-contractor-hit-in-w-2-phishing-scam/"}],"summary":"W2 PHishing scam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a688cf34ca53389b23688958a15a0384f120f1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63ca28f0-811c-11e7-9cfb-2f8f443557c3"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4aac47ea588","org_name":"Deep Root Analytics","org_type":"professional_services","ransomware":null,"records_affected":198000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/security-lapse-exposes-198-million-united-states-voter-records/"}],"summary":"AWS bucket misconfigured to allow access to 198 million voter records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dff4d86ca068ba6d5fae674de24cfc74a54acb8b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1bd73390-81ed-11e7-ace7-c5c15a923e51"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CY","org_id":"7fb8fe916cd3","org_name":"Cypriot Brokerage","org_type":"financial","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.financemagnates.com/forex/regulation/romanian-authorities-apprehend-three-men-trying-sell-stolen-client-data/"}],"summary":"Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT) has successfully detained three individuals who attempted to sell information stolen from a Cyprus-based brokerage. Iliescu Stefan Virgil, Roşoiu Darie Leone, and Vîlceanu Ionut succeeded in obtaining ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25e158351344d3a560b0ee2b77fae2dbc14d452f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c987f070-82aa-11e7-8009-bf30ec7afbca"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4034064021cc","org_name":"Crotched Mountain Foundation","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ledgertranscript.com/gfCrotchedMountain-ml-022117-8164753"}],"summary":"Crotched Mountain Foundation had an unauthorized release of employee W-2s, which include social security numbers, on Thursday, according to center officials.  “Our computer systems weren’t hacked, a human error led to this,” Director of Marketing and Communications Dave Johnson s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23f8093a7aa19312a85b9843d362c26ade0afe8d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8eb9960-8c17-11e8-bfaf-f7b4555dc539"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc528a23ceb2","org_name":"Coroner of Sebastian County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.todayinfortsmith.com/single-post/2018/07/17/Report-Decades-of-coroner-files-and-reports-missing-in-Crawford-Sebastian-counties"}],"summary":"The current Coroner of Sebastian County, Kenneth Hobbs stated that he has many missing files dating before January 2017 when he took office, possibly decades of missing files. Hobbs office is currently working to install a central database and join Crawford County Coroner Pam Wel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a3e54613ac8ceee479d746f42128ab0b7735914","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28e1ad70-ee38-11eb-a0c0-efc7cda0e23f"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67f550972009","org_name":"Coca-Cola","org_type":"manufacturing","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/coca-cola-suffers-breach-at-the-hands-of-former-employee/"}],"summary":"An employee of a Coca-Cola subsidary had a harddrive filed with 8k Coca-Cola employees info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6057dccd534047c606be053d6cafcd1c913b10b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f3bea20-c494-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"780be18b9873","org_name":"Cleveland Heights Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/metro/index.ssf/2017/06/cleveland_heights_no_longer_to.html"}],"summary":"Publishing Error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b8ae8254e04f5bfca377e061ecedd979c397aef","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7a2ff050-8123-11e7-abf2-119fe288b6e8"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsobserver.com/news/local/crime/article154397134.html"}],"summary":"Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9015ccf0c755337427492c59fc9bf8d7d1c17712","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"860e1870-c4a8-11e7-9a8b-47d1b690bc01"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2fbe3617f65c","org_name":"Christchurch Infant School","org_type":"healthcare","ransomware":null,"records_affected":114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiegouniontribune.com/news/education/sd-me-palomar-da"}],"summary":"BMI results of children sent to wrong recipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1462f766ca33bc58052be01f21cc8f4b36d3de30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2e64a30-093a-11e8-bbae-ed39c73f1398"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4048b924e4a2","org_name":"Chicago Election Board","org_type":"government","ransomware":null,"records_affected":1800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/us-voting-machine-supplier-leaks-1-8-million-chicago-voter-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://money.cnn.com/2017/08/17/technology/business/chicago-voter-records-exposed-upguard/index.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/news/local/politics/ct-chicago-registered-voters-identity-theft-protection-met-20170928-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://gizmodo.com/us-voting-machine-supplier-leaks-1-8-million-chicago-vo-1797947510"}],"summary":"A leading US supplier of voting machines confirmed on Thursday that it exposed the personal information of more than 1.8 million Illinois residents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5f2171c732cf56f42c21135f4ba1bb5812d61bf","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12a0e3a0-0b60-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"67c7a97a6b0b","org_name":"Candid Board","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.socpedia.com/upskirt-porn-website-accidentally-leaks-personal-information-of-180000-members/"}],"summary":"Insecure DB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c37d5671e065faf6e3afc0fdad0683feb1fb8e49","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e9c4c7e0-75fe-11e7-9d88-ab89f89c69db"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57f11f78dfea","org_name":"Campbell River High school","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.campbellrivermirror.com/news/possible-privacy-breach-at-campbell-river-high-school-prompts-warning/"}],"summary":"Possible privacy breach at Campbell River high school prompts warning","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6417bdf880c2bd5da7ee69abcb7289c42cf7b43","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48190400-1d45-11eb-866e-51f25f42af12"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0bffe4bdc908","org_name":"California Employment Development Department","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oc-breeze.com/2020/09/16/187469_former-california-edd-employee-sentenced-for-disability-benefits-fraud-identity-theft/"}],"summary":"Katherine Decker, 49, of Fresno, was sentenced today by U.S. District Judge Kimberly J. Mueller to three years and seven months in prison for a disability benefits fraud and identity theft scheme, U.S. Attorney McGregor W. Scott announced.  According to court documents, between J","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3688073ff5de6b6ed5ef34a4f84aeeedec2625ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8d8c0670-6bbb-11e7-97f1-7f40b0b1fd66"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"eaa06bcbf216","org_name":"BUPA","org_type":"healthcare","ransomware":null,"records_affected":108000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/technology/2017/07/13/bupa-loses-personal-details-108000-people-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/07/13/bupa_data_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3211408/security/an-insider-sifts-through-108000-client-files-what-can-go-wrong.html"}],"summary":"Bupa has admitted to a massive data breach after customer information was copied and deleted in a violation of rules.   The security incident occurred after an employee copied and deleted the details of 108,000 customers with international health plans. The tampered with data inc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dd6f53ce08f1f1fc957d42af501e5c6a10bb307","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8e91b5c0-82a8-11e7-8009-bf30ec7afbca"},"incident_date":"2017-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6b0826345021","org_name":"British Cycling Team Sky","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thenews.com.pk/print/189872-Crucial-Team-Sky-medical-records-stolen"}],"summary":"The UK Anti-Doping chief blasted British Cycling, Team Sky and their doctor Richard Freeman for not keeping medical records which could shed light on whether star cyclist Bradley Wiggins received a banned medical product.  Nicole Sapstead, appearing before the all-party House of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"072de2d242c12a3dd054dcb3fd46acd8d33ebeec","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"707b9fa0-a0a8-11e8-899a-23ad2f84ca7d"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c98c08d89a03","org_name":"Brinks Security","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.jsonline.com/story/communities/lake-country/crime/2018/08/08/man-charged-stealing-cash-atms-oconomowoc-and-brookfield/923400002/"}],"summary":"A former Brinks Security employee has been charged with stealing more than $22,000 from ATMs in Oconomowoc and Brookfield. All of the money was obtained through the unauthorized use of co-workers' information to get access to confidential combinations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d1e1d862e8769fba36c24e5999d54f687baeff0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4e925e80-e1f2-11e7-8553-197c24c367d2"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"532044cbd6c0","org_name":"Brampton Civic Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bramptonguardian.com/news-story/7309787-senior-files-1m-breach-of-privacy-lawsuit-against-brampton-civic-hospital/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.inbrampton.com/patients-suing-brampton-hospital-after-serious-privacy-breach"}],"summary":"A senior citizen who spent two months in intensive care at Brampton Civic Hospital (BCH) last year has filed a $1 million breach of privacy lawsuit against the William Osler Health System and a nurse.  Valerie Darragh, 77, is one of possibly hundreds of former patients who were n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0291a406bb4e9a4a8421dbf87a173c78300d5029","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"da8383d0-7234-11eb-a674-05cfd55ad89e"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5e82c53c4327","org_name":"Boots","org_type":"other","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/technology-51742079"}],"summary":"Boots advantage cards taken through through credential stuffing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad4fd9b2c0438be82d2654d9537d133c64662cfb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebf8d7f0-aa36-11e8-bee9-574e02f9ae34"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bf6b9a1fb338","org_name":"Bell Lomax Moreton","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thetimes.co.uk/article/prince-charles-files-accidentally-leaked-online-by-literary-agency-bell-lomax-moreton-bz0v7d36x"}],"summary":"The prince of wales confidential documents accidentally exposed online by a literary agency.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2113f67e652f3d92ae871be56c7527b3aef3ac5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0a676970-8122-11e7-abf2-119fe288b6e8"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8860790fa363","org_name":"BayPort Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.13newsnow.com/news/local/mycity/hampton/skimming-to-scam-police-said-pair-tried-to-target-atm-customers-at-credit-union/445038355"}],"summary":"ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b3b7a01e4e1989437ff27e4ebd2d4fe5f188445","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f0ea7580-8c27-11e7-944b-11adeb58a7b0"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"daefd3e60b13","org_name":"Bayer","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/japan-to-take-strict-action-against-bayer-over-patient-data-scandal/"}],"summary":"he Japanese government intends to take “strict action” against Bayer after the drug maker acknowledged three employees “inappropriately” accessed patient data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9417c3e6ec2e65d9de902889b9168ab0dbd1432","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0d8be610-8674-11e7-8e76-6d3ed9e599f7"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cfc18e729420","org_name":"Barts Health NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/british-nhs-trust-investigates-suspected-cyberattack-a-9634?mid=1"}],"summary":"Investigation after Barts Health Trust hit by cyber attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c49b31348cb0282c6d297abd39d083ec0996466e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"249c8a80-7c56-11e7-8ec0-e369e9638092"},"incident_date":"2017-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"af8411abf07a","org_name":"Barclays","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pymnts.com/news/security-and-risk/2017/barclays-reveals-client-names-to-german-finance-agency/"}],"summary":"Misdelivery of  banking information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"203027a6b7958346a7dc13480dbdba716a7b25bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e1ad4ea0-9959-11e7-a069-d9175a67bd3e"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4dfeea8ab008","org_name":"Ayudando Guardians Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.santafenewmexican.com/news/local_news/fraud-charges-leveled-against-new-mexico-guardianship-firm/article_120bd047-9c4e-51fb-9dc4-c2163f96f9cd.html"}],"summary":"Fraud charges leveled against New Mexico guardianship firm.  They are accused of using client funds to pay off more than $4 million in charges on a company credit card that was used by the two women and their families for personal purposes.  The indictment also accuses them of wr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a540b076abd6d1ba17babc6873d341953e360af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f2e108c0-b1f8-11e8-800d-891a5c02ea18"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b13e08d72a85","org_name":"Autoway Car Sales","org_type":"retail_ecommerce","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox2now.com/2017/12/27/police-say-car-lot-took-out-loans-on-unsuspecting-customers/"}],"summary":"owners of a used car lot use personal information of customers to purchase other vehicles in their names and resold them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e44724fe97d9a170980ba99e014d00dbae490da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8828c060-d907-11e7-be42-df02fe7390b5"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"18204b23f610","org_name":"Australian Broadcasting Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beencrypted.com/abc-validate-s3-data-leak-claimed-kromtech-security-firm/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/australian-broadcasting-corporation-confirms-s3-data-leak/"}],"summary":"According to Kromtech Security Center, the Australian Broadcasting Corporation has mistakenly leaked sensitive information from at least two unsecured Amazon web services (AWS) S3 repositories (buckets).  The corporation has ensured that their tech team has immediately responded ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e16e3eacae467b66aa05e65cd55c7b46e5db1d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e0a3af20-e4b1-11eb-8ef6-fbb8d39928b9"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb3053e1495b","org_name":"AT&T","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/tech-policy/2019/08/att-employees-took-bribes-to-unlock-phones-and-plant-malware-doj-says/#:~:text=In%20all%2C%20AT%26T%20insiders%20received,cell%20phones%2C%20the%20government%20alleged.&text=AT%26T%20generally%20locks%20phones%20to,being%20used%20with%20other%20carriers."}],"summary":"AT&T Workers took $1 million in bribes to unlock 2 million phones, DOJ says","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e799bb242a67384dc44e224038f531f0347b9ee0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"969f8680-d969-11e7-8b17-fdfed30923dd"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GH","org_id":"49b28aadb3c1","org_name":"Asesewa Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ghanaweb.com//GhanaHomePage/health/Nurses-at-Asesewa-Hospital-accused-of-revealing-information-of-HIV-AIDS-patients-586478"}],"summary":"Nurses are divulging PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2185e3f527721ab6f2df5f426b2bea4f0f2c7422","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f60263c0-843e-11e7-9557-ff063714718d"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d35641fe73d6","org_name":"Arizona Department of Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azcentral.com/story/news/politics/politicalinsider/2017/01/07/arizona-lawmakers-get-hacked-see-message-russian/96289466/?hootPostID=02e5cef95c4d41e65a1eaa54dbf21426"}],"summary":"Arizona lawmakers got hacked this week. And when they clicked the link to change their password, a screen with Russian writing popped up.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9ec0f3a0e518a585050ce1942824fed9f929560","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"034ff6d0-d50f-11eb-8806-c7cd39544f5b"},"incident_date":"2017-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0952d36de7a5","org_name":"Apollo","org_type":"professional_services","ransomware":null,"records_affected":10000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://cybernews.com/security/11-million-records-of-french-users-stolen-from-marketing-platform-and-put-for-sale-online/"}],"summary":"Apollo a marketing firm had 10million user data taken from one of their platforms and sold on criminal forums ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75f32ac1efcf12688e44ebd0e2689bcb106feb29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fce78c0-e35d-11e7-bf7a-0771e1cc9602"},"incident_date":"2017-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f07905484530","org_name":"American Senior Communities","org_type":"healthcare","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.indystar.com/story/news/crime/2017/02/20/american-senior-communities-falls-victim-w-2-scam/98161910/"}],"summary":"Nursing home chain American Senior Communities is the latest Central Indiana employer to fall victim to an email scam targeting W-2 tax forms, affecting all of the company's more than 17,000 employees, a company spokesperson confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3968f68ff8f144e764ff517261651175685fe459","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"986496d0-843d-11e7-9557-ff063714718d"},"incident_date":"2017-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf1bcde4af18","org_name":"Always Best Senior Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lehighvalleylive.com/easton/index.ssf/2017/02/cops_aid_charged_with_ringing_up_nearly_3k_on_patients_credit_card.html"}],"summary":"A home health care aide is accused of stealing two credit cards from a patient and ringing up nearly $3,000 worth of purchases in 72 transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33e2d9efafedbf5484e292910a6971fa063cb1f2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd6aa1e0-a2db-11e7-b840-f97c87f5ffb5"},"incident_date":"2017-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"financial","ransomware":null,"records_affected":1708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.statesman.com/news/local/just-personal-info-522-aetna-clients-texas-affected-data-security-incident-firm-says/PGi7zsyh7cy9ppnQd1epaK/"}],"summary":"Publishing error leads to potential disclosure of over 500 PHI records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df025c5f37c1734023e55d12fd2e7a6f69e43c6d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7136f990-996e-11e7-a069-d9175a67bd3e"},"incident_date":"2017-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"95a2fdb3d099","org_name":"Aadhaar","org_type":"financial","ransomware":null,"records_affected":88000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://timesofindia.indiatimes.com/city/bengaluru/aadhaar-e-kyc-app-had-88000-downloads-cyber-police/articleshow/59976640.cms"}],"summary":"Bengaluru techie arrested for data theft from Aadhaar website ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2017-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7319bf22f59d00fb0edac46fe6528837c4baa86a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f1f49e70-0b5b-11e8-985b-1119ad21cbad"},"incident_date":"2017-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77136d80c4ef","org_name":"8tracks","org_type":"technology_saas","ransomware":null,"records_affected":18000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hacker-steals-millions-of-accounts-from-internet-radio-service-8tracks/"}],"summary":"Unsecured github repo provided credentials to access database of users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fd3d5d07768df8868990248e2c617b8216813f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"874c0d30-8e7b-11e8-8003-e3ff5269fee2"},"incident_date":"2016-12-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6f847aa765e","org_name":"University of Pittsburgh Medical Center","org_type":"healthcare","ransomware":null,"records_affected":111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hipaajournal.com/healthcare-worker-charged-criminally-violating-hipaa/"}],"summary":"Linda Sue Kalina, 61, of Butler, Pennsylvania, has been charged in a six-count indictment that includes wrongfully obtaining and disclosing the protected health information of 111 patients.  Kalina worked at the University of Pittsburgh Medical Center and the Allegheny Health Net","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-30","discovered_date":"2016-11-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2b5a6327b962197ef14e44a8d3b32c8db77f900","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sheetworkers%20Local%20104%20Notice%20ONLY-%20CA%20original%20_0.pdf"},"notes":null,"org_country":"US","org_id":"4475b0544118","org_name":"Sheet Metal Workers’ Local Union No. 104","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65675"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sheetworkers%20Local%20104%20Notice%20ONLY-%20CA%20original%20_0.pdf"}],"summary":"A blog post claimed its author accessed sensitive member data belonging to Sheet Metal Workers’ Local Union No. 104.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-30","discovered_date":"2016-11-16","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e9c7dad9ca7b4592c4a377b1c765dea60a78bddc","impact_type":"unknown","incident_date":"2016-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"81f52c53b0ab","org_name":"International Association of Sheet Metal, Air, Rail & Transport Workers, Sheet Metal Workers’ Local","org_type":"unknown","ransomware":null,"records_affected":25156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#International%20Association%20of%20Sheet%20Metal%2C%20Air%2C%20Rail%20%26%20Transport%20Workers%2C%20Sheet%20Metal%20Workers%E2%80%99%20Local-2016-12-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15945cbb4398b5754e9d4be13ebf1569c2909e35","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ddd2cb0-e3a9-11e7-8742-2bc46bd10713"},"incident_date":"2016-12-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69e85051d15b","org_name":"Emory Healthcare","org_type":"healthcare","ransomware":true,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/emory-healthcare-hit-ransomware-data-over-200000-patients-hacked;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/emory-healthcare-patient-data-hijacked-and-held-for-ransom/"}],"summary":"Atlanta-based Emory Healthcare was hacked by the Harak1r1 the 0.2 Bitcoin Ransomware, MacKeeper security researcher Chris Vickery discovered on Jan. 3.  On Dec. 30, MacKeeper Security Research Center discovered a misconfigured MongoDB database that contained data from over 200,00","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-29","discovered_date":"2016-10-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"924be4eb14c3190148203009387c69a6b2231d60","impact_type":"unknown","incident_date":"2016-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8ebea1508430","org_name":"Providence Health & Services","org_type":"unknown","ransomware":null,"records_affected":393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Providence%20Health%20%26%20Services-2016-12-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d441da4d50b7543c9823c0996b36bd808460826a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6d7452b0-c4a4-11e7-9a8b-47d1b690bc01"},"incident_date":"2016-12-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af623ac56832","org_name":"Denton Heart Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/denton-heart-group-notifies-patients-stolen-hard-drive-held-7-years-worth-of-piiphi/"}],"summary":"Stolen hard drive results in PHI loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-29","discovered_date":"2016-11-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8d8b9b568089852cfcfba951d52ca17cc989b6f0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3258ee1591f3","org_name":"Cascade Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":3465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Cascade%20Management%2C%20Inc.-2016-12-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1f3e4157b71687b1d5c8cbbf4be0c87d519614f1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/BranndywinePediatrics%2CP.A..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b325d8017c16","org_name":"Brandywine Pediatrics","org_type":"unknown","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/BranndywinePediatrics%2CP.A..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-12-28","discovered_date":"2016-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a39e22b3ed182590a051f529cc3e97bbb6d96bac","impact_type":"data_theft","incident_date":"2016-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Graphik%20-%20CA%20Exhibit%201%20for%20Online%20Forms_0.pdf"},"notes":null,"org_country":"US","org_id":"b8b2281e990b","org_name":"Graphik Dimensions Ltd.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65625"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Graphik%20-%20CA%20Exhibit%201%20for%20Online%20Forms_0.pdf"}],"summary":"Graphik Dimensions reported that malicious code was injected into the pictureframes.com e-commerce platform and may have accessed customers’ payment information and account credentials.","supporting_quote":null,"technology_involved":["pictureframes.com e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb2356741e2cdfdcaa6e955622c2847cfd46b2eb","impact_type":"data_theft","imported_from":null,"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"18d3b5669496","org_name":"DaniWeb","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: DaniWeb","type":"hibp","url":"https://haveibeenpwned.com/Breach/DaniWeb"}],"summary":"DaniWeb suffered a data breach in late 2015 that disclosed account email addresses, IP addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b345b3088b74699b59dce99ee4ad5ea29d65317","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"5b41fb9c9756","org_name":"Cross Fire","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cross Fire","type":"hibp","url":"https://haveibeenpwned.com/Breach/CrossFire"}],"summary":"Cross Fire’s vBulletin forum was hacked, exposing usernames, email addresses, and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c254b4be459b29677d20509dfbebee752181a46c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b2589100-e35a-11e7-bf7a-0771e1cc9602"},"incident_date":"2016-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aa65a8436aaf","org_name":"Brand New Day","org_type":"healthcare","ransomware":null,"records_affected":14005,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/vendor-error-exposes-data-more-14000-health-plan-participants"}],"summary":"On Dec. 28, Brand New Day discovered that an unauthorized user had accessed the ePHI provided to one of its HIPAA business associates on Dec. 22. The access occurred through a vendor system used by a contracted provider, officials said.  The accessed ePHI included names, addresse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51f466ac4dab44e2a46106b5b03cf4cf87d37ee9","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"036a8a5a019c","org_name":"Пара Па","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Пара Па","type":"hibp","url":"https://haveibeenpwned.com/Breach/Parapa"}],"summary":"Пара Па’s vBulletin forum was hacked, exposing usernames, email addresses, and password hashes for 4,946,850 accounts.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9920f7194d28d89ff3d47a06eb058a8f193421b2","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"9d06a0869f39","org_name":"uuu9","org_type":"unknown","ransomware":null,"records_affected":7485802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: uuu9","type":"hibp","url":"https://haveibeenpwned.com/Breach/uuu9"}],"summary":"Have I Been Pwned reported that data allegedly obtained from uuu9.com in September 2016 included email addresses, usernames, and passwords for 7,485,802 accounts.","supporting_quote":null,"technology_involved":["uuu9.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45b2df183c3d93ce21a022984034a40448e10008","impact_type":"unknown","incident_date":"2016-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Breach%28CAFormNotice%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b0e16396c95f","org_name":"The Topps Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65611"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34b23994cc46b6e33a2e78ac888b0f36058428e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79427dd0-e3a1-11e7-8742-2bc46bd10713"},"incident_date":"2016-12-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b1a2a59e5aaa","org_name":"SpaSurgica","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/canadian-plastic-surgery-center-and-spa-were-leaking-patient-files/"}],"summary":"Database without security controls found by security researcher.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"093f0c65716f1bcde013081d2ab27278a352480f","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"07bd5a99e897","org_name":"OVH","org_type":"technology_saas","ransomware":null,"records_affected":452899,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OVH","type":"hibp","url":"https://haveibeenpwned.com/Breach/OVH"}],"summary":"OVH's vBulletin forum suffered a data breach involving usernames, email and IP addresses, and password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7b3c6ce9a74b323979d63930a585915fda8e239","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"58bd27e3dc34","org_name":"Kimsufi","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Kimsufi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Kimsufi"}],"summary":"A breach of Kimsufi's vBulletin forum exposed account details, including usernames, email and IP addresses, and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"844af59a2a0b395356c354ca296c6ad07ecbcd55","impact_type":"data_theft","imported_from":null,"incident_date":"2014-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"174c566716cb","org_name":"Bot of Legends","org_type":"other","ransomware":null,"records_affected":238373,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bot of Legends","type":"hibp","url":"https://haveibeenpwned.com/Breach/BotOfLegends"}],"summary":"A November 2014 breach of the Bot of Legends IP.Board forum exposed account information, including usernames, email and IP addresses, and salted-MD5 password hashes.","supporting_quote":null,"technology_involved":["IP.Board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe3af7f7e0da66232cf1122f5d52648212859bb9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bd49b260-9d69-11e7-af90-45f1ceac3d54"},"incident_date":"2016-12-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66e9992f5e74","org_name":"Alaska Public Safety Department","org_type":"government","ransomware":null,"records_affected":1020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktuu.com/content/news/State-warns-1000-people-after-social-security-numbers-taken-from-public-safety-HQ-412750303.html"}],"summary":"A woman who worked at the state Public Safety Department and trooper headquarters in Anchorage is accused of taking paperwork with the social security numbers of more than 1,000 people in an ongoing theft investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2398cf96717fe1b2aec8890dfc00d02b43f3e442","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FriendFinder%20Network%20California%20Notice%20press%20only.%20pdf_0.pdf"},"notes":null,"org_country":"US","org_id":"625313b62d9b","org_name":"FriendFinder Networks Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65608"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FriendFinder%20Network%20California%20Notice%20press%20only.%20pdf_0.pdf"}],"summary":"FriendFinder Networks reported that customer usernames, passwords, and email addresses were compromised in a security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-12-22","discovered_date":"2016-09-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b15faf83d1c8457ed475be2a677ba0a36f75d23","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-09-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DFCU%20CA%20Adult%20Letter%20Sample_1.pdf"},"notes":null,"org_country":"US","org_id":"6953ea61fadf","org_name":"Dover Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65580"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DFCU%20CA%20Adult%20Letter%20Sample_1.pdf"}],"summary":"An employee transferred files containing members’ personal information to a personal Dropbox account, and DFCU found it unlikely that an unauthorized person accessed them.","supporting_quote":null,"technology_involved":["Dropbox"],"third_party":{"archetype":null,"involved":true,"vendor":"Dropbox"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"fb5c7930c1ff","name":"Dropbox"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-12-22","discovered_date":"2016-11-15","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"778ed4289cffe5ebcf3a2271227ba5ce15c69d38","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Claremont%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"29f7b9c33463","org_name":"Claremont University Consortium","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Claremont%20Notice_0.pdf"}],"summary":"A laptop stolen from an employee’s vehicle may have contained personal and tax-form information.","supporting_quote":"On November 15, 2016, several items, including a password-protected laptop, were stolen from a Claremont University Consortium employee’s locked vehicle.","technology_involved":["password-protected laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-12-21","discovered_date":"2016-11-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fd694fd466c2dccb1653caf66ed31d05c15c8dc8","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9660.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7d777adac537","org_name":"Community Health Plan of Washington","org_type":"healthcare","ransomware":null,"records_affected":353388,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9660.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9660.pdf"}],"summary":"Community Health Plan of Washington reported that member records stored by its technology services provider were accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1c27bc6efee19733811dd0d07b6909d2bae9396","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a74bad0-e474-11e7-977c-0b3846f56840"},"incident_date":"2016-12-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8831ab64771a","org_name":"Children’s Hospital Los Angeles","org_type":"healthcare","ransomware":null,"records_affected":3600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/childrens-hospital-los-angeles-and-the-childrens-hospital-los-angeles-medical-group/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CHLA.Minor_.PHI_.011317.SAMPLE_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65827"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49e141ef21e9ab315c5ecd58deaeef673482ee5b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WU_CONSUMER_NOTICE_LETTER_NON_MA_FINAL.DOCX_AUDIT_2.pdf"},"notes":null,"org_country":"US","org_id":"c02b72fdd0f6","org_name":"Western Union Financial Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65549"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WU_CONSUMER_NOTICE_LETTER_NON_MA_FINAL.DOCX_AUDIT_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9659.pdf"}],"summary":"Western Union said personal information may have been accessed without authorization during a computer intrusion against a vendor-supplied external system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-12-20","discovered_date":"2016-11-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad55c27cf762484e9e6b81f63c62ea7b434d5bb6","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%20-%20DRAFT%2012-20-16_0.pdf"},"notes":null,"org_country":"US","org_id":"69635eabb44e","org_name":"Kaiser Foundation Hospitals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An update to the Estimates tool caused subsequent users to potentially view previous users’ information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%20-%20DRAFT%2012-20-16_0.pdf"}],"summary":"A system error following an update to Kaiser Foundation Hospitals’ kp.org Estimates tool may have exposed users’ personal and healthcare spending information to later users.","supporting_quote":"After the update, there was a small chance that a subsequent user of the tool may have viewed a previous user’s information.","technology_involved":["kp.org Estimates tool"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"230bd1c3ba697d5b4eb5dac480929bc5084b2568","impact_type":"data_theft","imported_from":null,"incident_date":"2016-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"126a751ee64e","org_name":"Ethereum","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ethereum","type":"hibp","url":"https://haveibeenpwned.com/Breach/Ethereum"}],"summary":"Ethereum’s forum database was breached, exposing email addresses, IP addresses, private messages, passwords, usernames, and website activity.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8b6a8d3b8fbc2a8236915f6445d07779fad0270","impact_type":"data_theft","imported_from":null,"incident_date":"2015-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b7d7aae55525","org_name":"QuinStreet","org_type":"technology_saas","ransomware":null,"records_affected":4907802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: QuinStreet","type":"hibp","url":"https://haveibeenpwned.com/Breach/QuinStreet"}],"summary":"QuinStreet reported a compromise affecting 28 websites that exposed personal information and password hashes for over 4.9 million people.","supporting_quote":null,"technology_involved":["websites","technology forums"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d265ae186998bfb6100b30f6c47e934a838d273","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Blearcher%20Report%20Consumer%20Notice%20Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"25129df66fd0","org_name":"Turner Broadcasting System, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65476"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ebd745ea7907eb242ec2d1b4bf5422d4359b3ac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42ef39c0-e35c-11e7-bf7a-0771e1cc9602"},"incident_date":"2016-12-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fcd63566be31","org_name":"Family Service Rochester","org_type":"healthcare","ransomware":true,"records_affected":17037,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kaaltv.com/news/data-breach-family-services-rochester/4405076/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/79k-patients-affected-by-emory-healthcare-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://familyservicerochester.org/files/2017/02/Data-Breach.pdf"}],"summary":"law enforcement was notified after ransomware was found on Family Service Rochester's computer system.  Investigators discovered that someone had illegally accessed the system between December 16, 2016 and January 25, 2017.  Potentially compromised information includes name, addr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2016-12-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"daf6d50c6f332d6ff2c58fdbda0b69ea8c4f6270","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LA%20County%20Ad%20CEO%20r16prf_0.pdf"},"notes":null,"org_country":"US","org_id":"d4b4bbd1ef48","org_name":"County of Los Angeles","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65499"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LA%20County%20Ad%20CEO%20r16prf_0.pdf"}],"summary":"The County of Los Angeles reported that a phishing email attack affected employee email accounts containing information that may have been compromised.","supporting_quote":"On May 13, 2016, the County experienced a phishing email attack that affected approximately 108 out of 120,000 County employee email accounts.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7f3089861b9d5e50e7fd702afdc71bcb9dacb48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3282B8C-0D85-4616-9AA8-93B13B6473E0"},"incident_date":"2016-12-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ae2a844d7a61","org_name":"PayAsUGym","org_type":"other","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/12/19/payasugym_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/payasugym-breach-exposes-more/"},{"fetched_at":null,"title":"Have I Been Pwned: PayAsUGym","type":"hibp","url":"https://haveibeenpwned.com/Breach/PayAsUGym"}],"summary":"Fitness website PayAsUGym has been breached in a hack that may have exposed up to 400K emails and passwords.  In a breach notice to users, the firm admitted one of its servers was hacked after \"underground researchers\" posted screenshots purporting to show PayAsUGym's hacked data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eba5dbe779e0eefc301f3e58e8ef361477a83b8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a565c9e0-ca2d-11e7-a7a2-ef5723624be0"},"incident_date":"2016-12-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2017/04/27/cvs-pharmacy-tech-charged-with-20-counts-identity-theft.html"}],"summary":"pharmacy technician faces numerous counts of identity theft after he was accused of stealing credit card information from customers at a Nashua CVS.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9bfa546bfd6f37ed79ff4ba1e8a41b5b988ee4c","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yahoo%20Notification%20Materials_0.pdf"},"notes":null,"org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo! Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yahoo%20Notification%20Materials_0.pdf"}],"summary":"Yahoo reported that an unauthorized third party stole user account data in August 2013, including information associated with the affected account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-14","discovered_date":"2016-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57271913e3deba0cda97ab523e6520dff1e6e9f2","impact_type":"unknown","incident_date":"2016-04-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/K%20Partners%20-%20Notice%20Letter%20%5BRedacted%5D%20%286490516x7AB84%29_1.pdf"},"notes":null,"org_country":"US","org_id":"198ed865b1b8","org_name":"K Partners Hotel Management","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/K%20Partners%20-%20Notice%20Letter%20%5BRedacted%5D%20%286490516x7AB84%29_1.pdf"}],"summary":"An unauthorized third party accessed a K Partners email account and file server during a network intrusion.","supporting_quote":null,"technology_involved":["email account","file server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-12-13","discovered_date":"2016-10-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50b724047e139c4944ebb605d84d6dbfb010273d","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-09-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BraceAbility%20notice%20only%20_1.pdf"},"notes":null,"org_country":"US","org_id":"302b28bfdf53","org_name":"BraceAbility","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability allowed an attack involving BraceAbility's online ordering website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65407"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BraceAbility%20notice%20only%20_1.pdf"}],"summary":"BraceAbility said a vulnerability allowed an attack involving its online ordering website and that customer names, addresses, payment card details, and purchase information may have been exposed.","supporting_quote":"Working closely with the independent IT forensic firm, we have identified and corrected the vulnerability that allowed the attack.","technology_involved":["online ordering website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab72c6d3591dbbbbdccac895e309e72e991d2433","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8167c4c0-e35b-11e7-bf7a-0771e1cc9602"},"incident_date":"2016-12-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"047cbf3bcc22","org_name":"Capital Prosthetic and Orthotic Center","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/patient-records-stolen-from-ohio-practice-s-storage-unit.html"}],"summary":"On Dec. 12, the medical records of more than 1,100 patients were stolen from a storage unit rented by Columbus, Ohio-based Capital Prosthetic and Orthotic Center, according to The Columbus Dispatch.  The files stored at Zanesville, Ohio-based Brandywine Lock-N-Stock contained inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3242f4f8d25b462fe2db1e972ea9ff520c411811","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc7a6720-eeb3-11e7-b683-c1703914e4a4"},"incident_date":"2016-12-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af9550b81c46","org_name":"Wonderful Center for Health Innovation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65961;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/TWC%20Redaction_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65961"}],"summary":"On December 12, 2016, it was discovered that a laptop containing medical information from the Wonderful Center for Health Innovation was stolen between December 9, 2016 and December 12, 2016.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-09","discovered_date":"2016-10-17","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53f32103e353c365b61a37c9647640785cc2177e","impact_type":"unknown","incident_date":"2014-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a2f88ccab71","org_name":"Asante","org_type":"unknown","ransomware":null,"records_affected":407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Asante-2016-12-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a0a9534a87919d511aea367ba820eb315cb679f","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Anchor%20Loans%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b3402043f7fb","org_name":"Anchor Loans LP","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A database was publicly exposed on the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65361"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Anchor%20Loans%20Sample%20Notice_0.pdf"}],"summary":"A security researcher accessed Anchor Loans LP’s publicly exposed database, which contained personal and financial information.","supporting_quote":"On or about November 7, 2016, a security researcher accessed one of our databases that was publicly exposed on the Internet.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"177d63b5abba022ff1eecba000cf9abe37060c06","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8173cee0-deca-11e7-aa62-a96e008cbc03"},"incident_date":"2016-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"40521d72c0a6","org_name":"Family Medicine East","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/family-medicine-east-chartered-in-wichita-notifies-patients-of-stolen-computer/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kwch.com/content/news/Wichita-medical-office-reports-data-breach-412731423.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://media.graytvinc.com/documents/Media+Release+-+2017-02-03.pdf"}],"summary":"The clinic says someone broke into the office on Dec. 8 and stole the desktop computer and a printer.  The clinic says the computer contained a significant number of images of typed office notes dictated by Family Medicine East physicians during 2002 and 2003.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6efbd5970d3a0223efb5403dd280e3382e3182e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C9E94AE-CAED-4AC9-9A8B-40599E5E3B70"},"incident_date":"2016-12-06","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6294ba568f6d","org_name":"Scottish Football Association","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/12/06/scottish_football_association_phishing_emails/"}],"summary":"Phishing emails ostensibly from the Scottish Football Association (SFA) were sent to subscribers on Monday as the result of a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-02","discovered_date":"2016-11-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a080547e26f330c6c88731754ff09bc73db0b14","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/San%20Jose%20Evergreen%20Community%20College%20District%20Security%20Incident%20Notification%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"158c02b109a8","org_name":"San Jose Evergreen Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee inadvertently uploaded a file containing personal information to a publicly accessible folder on the district website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65161"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/San%20Jose%20Evergreen%20Community%20College%20District%20Security%20Incident%20Notification%20Letter_0.PDF"}],"summary":"An employee inadvertently uploaded a file containing students’ personal information to a publicly accessible folder on the district website.","supporting_quote":"On November 7, 2016, we learned that an SJECCD employee had inadvertently uploaded a file containing the personal information of certain SJECCD students to a publicly accessible folder on the SJECCD website.","technology_involved":["SJECCD website","webserver"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad46d9d51691e30257ca355ce6e4a903f277aff8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2ddddc0-40d3-11ec-b81c-33d442e55df8"},"incident_date":"2016-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0d7f8bc00b5","org_name":"Wright County","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fox9.com/news/wright-county-alerting-residents-of-data-breach-involving-county-employee"}],"summary":"Wright County developer copied over sensitive data from a database to test something at home","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a2459f8f76b07cfb0e6d7104c1b657c5ac31345","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bce00cf0-8cc7-11e7-97c0-cfe5b6ac1588"},"incident_date":"2016-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d20949d61c1","org_name":"West Virginia Office of the Chief Medical Examiner","org_type":"government","ransomware":null,"records_affected":1019,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wvgazettemail.com/news/20170815/problems-mount-for-poca-funeral-home-owner"}],"summary":"The letter suspends Tri-State Mortuary Services LLC, Harding Family Group LLC, Gatens-Harding Funeral Home Inc., Haven of Rest Memorial Gardens LLC and Haven of Rest Memory Gardens and Crematorium from transporting deceased bodies to the Medical Examiner’s Office for autopsies. H","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dd247092904b2a153e772e6c79c90c898a047b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e0077140-e420-11e7-8742-2bc46bd10713"},"incident_date":"2016-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a9cdedcb2f8b","org_name":"Veterans Affairs Canada","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thechronicleherald.ca/novascotia/1428555-veterans-may-sue-over-marijuana-privacy-breach"}],"summary":"Veterans Affairs Canada could be facing another lawsuit after a privacy breach involving 3,000 veterans who are part of the federal medical marijuana program.  Veterans began reporting the breach Friday that effectively outed them as medical marijuana users.  A VAC mailout inform","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3bdf6121035fc71d3f9d48341abeb458bcb6536","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fde13a70-8ccd-11e7-811e-83915e56fc98"},"incident_date":"2016-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"92830f232645","org_name":"Synergy Specialists Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66062"}],"summary":"Synergy Specialists Medical Group reports their email system compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c141e7969e44d6d42cbfee1b73cbc28de5dce50","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54764420-e421-11e7-8742-2bc46bd10713"},"incident_date":"2016-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"054cc3f9cf1c","org_name":"Special Operations Command","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-38496474;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/2526400/us-military-staff-to-risk-of-being-kidnapped-or-blackmailed-for-information-after-shocking-data-leak-revealing-their-location/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/pentagon-subcontractor-inadvertently-leaks-11-gigs-of-sensitive-data/122822/"}],"summary":"Sensitive details of health workers employed by the US military's Special Operations Command (Socom) have been exposed in a data breach. The 11GB of data included social security numbers, names, addresses and salaries of some Socom staff. All the workers, including some with top ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c055d598798683a9548d57be8bf2558a93e18f6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3e5595a0-8810-11e7-9a4a-fb58f2b09996"},"incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1cad6423625","org_name":"Shelton High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ct-former-shelton-high-school-student-arrested-for-hacking-school-systems-server/"}],"summary":"Former Shelton High School student arrested for hacking school system’s server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0855d61896b710c8dabbb3c6113e2a0b1dcca265","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c14d9e0-d950-11e7-95c7-41fa40cac8a8"},"incident_date":"2016-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"dc08b4d2926e","org_name":"Sainte-Justine Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/montreal/ste-justine-hospital-leak-1.3938435"}],"summary":"Doctor sent PHI via USB drive to media","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4a5326e66375eb82838ab4ec5e9ed8074e0b904","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BE861C6-F3C7-4F62-AEDA-6BA136EBDCD7"},"incident_date":"2016-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0027c2f4029","org_name":"Houston Interventional Cardiology","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://setexasrecord.com/stories/511050985-alleged-breach-of-medical-records-prompts-woman-to-sue-houston-cardiology-center"}],"summary":"The complainant claims a HIC employee who lives in the same apartment complex as her accessed her medical records from NCMC and e-mailed her harassing messages. The employee purportedly used Putnam's information to disparage her to their neighbors, as well as threateningly approa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99b17dd3d35cc380ad5d77ae108e3597b04bf5ae","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D8BB904-841A-444A-BE48-44E61A9391F7"},"incident_date":"2016-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"f6c2d0984e2f","org_name":"Health Solutions","org_type":"healthcare","ransomware":null,"records_affected":43000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.buzzfeed.com/pranavdixit/the-medical-reports-of-43000-people-including-hiv-patients-w?utm_term=.olaNjg4wbv#.wqxX159GDE"}],"summary":"The medical records of over 43,000 people have been accidentally made public after being put online by a pathology lab in Mumbai. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43106dea324b6c6206ae038e8bcca70a6267b128","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dcc75270-a7bc-11e7-9f87-7fffd7137a55"},"incident_date":"2016-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad0821412b6a","org_name":"Coney Island Hospital, New York","org_type":"healthcare","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/coney-island-hospital-data-breach-affects-3500/article/662453/"}],"summary":"Supervisor at a NYC hospital allowed a volunteer to enter data in a log book that contained PHI data. The employee had not been properly vetted through HR at the facility and should not have had access to the data. No proof that the volunteer misused the information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d5de225c5dc6d6878386c3e90a62292bce41b8e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4bf65320-899b-11e7-bf1d-81579668407a"},"incident_date":"2016-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"479695c1f1ea","org_name":"Carroll County Sheriffs Office","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ar-carroll-county-pays-ransomware-demand/"}],"summary":"Carroll County pays ransomware demand - Carroll County Sheriff’s Office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff5ab1352ad69c6e57dc125ed648e4a78cee77ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38a1e580-8696-11e7-8e76-6d3ed9e599f7"},"incident_date":"2016-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"592a6a0e6043","org_name":"California Department of Justice","org_type":"government","ransomware":null,"records_affected":3424,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breitbart.com/california/2017/01/19/california-accidentally-releases-private-information-nearly-3500-firearms-instructors/"}],"summary":"The state of California “accidentally” released the private information of nearly 3,500 firearms instructors in October 2016. The information was released as part of the response to a Southern California Public Radio (KPCC) reporter’s Freedom of Information Act request. The repor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14a8e6ff9698c40eb7dd4e979138176900aeae48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a8dbacf0-d966-11e7-8b17-fdfed30923dd"},"incident_date":"2016-12-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ee0b485e8ee","org_name":"Brigham and Women’s Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fiercehealthcare.com/healthcare/woman-roams-brigham-and-women-s-without-permission-raising-security-questions"}],"summary":"Person shadowed doctors and observed patient care under a pretext.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50f62813b3344fc6b1488fe0cb214790f4d8b7b2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ae72d40-9193-11e8-ad4c-017f2df1a0a0"},"incident_date":"2016-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"e474243a7f4a","org_name":"ANZ Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stuff.co.nz/national/crime/105554137/bank-worker-hacks-into-computer-withdraws-89k-and-is-discharged-without-conviction"}],"summary":"A former ANZ Bank employee who had a gambling problem, hacked its computer system and withdrew nearly $90,000 but was discharged without conviction.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-30","discovered_date":"2016-10-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cd1dd38d3cb71366398a8cf5b6f5f7737064134","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"e70fedb74b46","org_name":"The LANG Companies, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65124"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notice_0.pdf"}],"summary":"The LANG Companies reported that malicious software was installed on a server processing credit card transactions, and customer order information may have been transmitted outside its system.","supporting_quote":null,"technology_involved":["payment-card processing server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-30","discovered_date":"2016-10-13","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57f674938752895ad0ad90c032b24d72c5fbdd56","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-03","initial_access":"physical_or_paper","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EMB_MB_LTR_31233EOCBreach_FINAL-110316_0.pdf"},"notes":null,"org_country":"US","org_id":"5c252cd62157","org_name":"EmblemHealth","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The intended mailing identifier was mistakenly replaced with the member’s HICN, which was printed on the external mailing label.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65120"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EMB_MB_LTR_31233EOCBreach_FINAL-110316_0.pdf"}],"summary":"EmblemHealth inadvertently disclosed members’ HICNs on external mailing labels for Medicare plan documents.","supporting_quote":"Our investigation found that, while preparing the Evidence of Coverage documents for mailing, HICNs were inadvertently included in the electronic file sent to EmblemHealth’s vendor and were then disclosed on the external mailing label that was affixed to the package.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b47090f65d27e18ad79a67c39b77ebd3b712c0cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9658.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"659c21390d7a","org_name":"CHI Franciscan Health- Hospice Tacoma","org_type":"unknown","ransomware":null,"records_affected":1223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9658.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec8c2faa963a7f540988db2d8d5fa71380d85904","impact_type":"unknown","incident_date":"2016-11-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Security%20Breach%20Notice%20Michigan%20State%20University_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"76de0ced7794","org_name":"Michigan State University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65104"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9655.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-29","discovered_date":"2016-11-04","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1959b52b062b29ae352dd4e342fdecb473ec1545","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-11-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tentler%20Letter%20Version%201_0.pdf"},"notes":null,"org_country":"US","org_id":"4cd056c1cce8","org_name":"Hillary Tentler, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65118"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tentler%20Letter%20Version%201_0.pdf"}],"summary":"A home break-in resulted in the theft of backup hard drives that may have contained clients’ personal and financial information.","supporting_quote":"On November 4, 2016, I discovered that my home was broken into earlier in that day.","technology_involved":["backup hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1162a97f9368657bc10f6e517a8515b017e14003","impact_type":"data_theft","incident_date":"2016-07-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ppt%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0b74a3c757c5","org_name":"Hewitt Associates LLC","org_type":"professional_services","ransomware":null,"records_affected":55,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65100"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ppt%20Notice_0.pdf"}],"summary":"An unauthorized individual accessed 55 records of Irvine Company employees’ personal information in the BenefitsNow portal maintained by Aon Hewitt.","supporting_quote":null,"technology_involved":["Aon Hewitt","Core Benefit Administration (CBA) web portal","BenefitsNow"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96f5d78afebc4b9753c3dd697656276a27f01e90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA773DB0-C373-4E0B-8889-A4C668ACCE79"},"incident_date":"2016-11-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a0cd885ca96","org_name":"CEFCO gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://keyetv.com/news/local/lago-vista-pd-finds-credit-card-skimming-devices-at-gas-station"}],"summary":"Lago Vista Police say they found credit cards skimmers at three pumps at the CEFCO gas station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4c7d433f4d6d1da5858e85089ca9c5115840f7f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0EE9C471-5D8F-4E20-9DFF-EF08DFAEDD44"},"incident_date":"2016-11-29","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c8804a03e1ef","org_name":"Carleton University","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.universityherald.com/articles/52781/20161201/hackers-held-university-network-system-hostage-exchange-ransom.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.campussafetymagazine.com/article/canadian_university_hit_with_ransomware/emergency;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/carleton-u-hit-by-ransomware-students-told-to-keep-windows-pcs-away/"}],"summary":"Carleton University in Ontario was the victim of a ransomware cyberattack Tuesday that limited access to its computer network and infected personal computers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-11-26","discovered_date":"2016-11-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3b8f668542f55b759ca46fc364064cb28a56b0d","impact_type":"data_theft","incident_date":"2016-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notice%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"2f8fecd6c390","org_name":"Quest Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":34000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/quest-diagnostics-notifying-34000-patients-after-hacker-acquired-phi/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice%20FINAL_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65390"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notice%20FINAL_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Quest%20Diagnostics-2016-12-12"}],"summary":"An unauthorized third party accessed Quest Diagnostics’ MyQuest by Care360 internet application and obtained protected health information of approximately 34,000 patients.","supporting_quote":null,"technology_involved":["MyQuest by Care360 internet application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e02dd36192328b74e381e912c63898f407a65ae","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4f691060-ca41-11e7-8487-35d59b80f11b"},"incident_date":"2016-11-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac1ce3914b11","org_name":"Holiday Inn Club Vacations","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kltv.com/story/36831959/tyler-man-charged-with-theft-of-copyrighted-information-in-connection-to-vacation-business"}],"summary":"man is accused of stealing copyrighted information from a vacation business in which he was employed and apparently using it for other vacation businesses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66b123a05d6394a1d40c7350a17f4129255ba1b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08D95AA4-53FA-4F64-84A3-A31E4EF98383"},"incident_date":"2016-11-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"59f3d7aa034c","org_name":"Greene King","org_type":"other","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/2290843/uks-biggest-pub-chain-greene-king-accidentally-leaks-bank-details-of-2000-staff-in-email/"}],"summary":"the e-mail, sent on Thursday, contained a list of over 2,000 bank account numbers and sort codes for some staff.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-23","discovered_date":"2016-09-12","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"919a58425975483bbbd55cb88dd462cdd08bdf05","impact_type":"unknown","incident_date":"2016-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f38f59f0efc4","org_name":"Primerica","org_type":"unknown","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Primerica-2016-11-23"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d00880b399f4e0b07c6640a3b2cfd929383a8de4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/MadisonSquareGardenCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"876be9ee0468","org_name":"Madison Square Garden Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/MadisonSquareGardenCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-23","discovered_date":"2016-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f50d6090f6eb4bb98e76119b5a2b741f7a16f30e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Atlantis%20notice%20only--%20CA%20Exhibit%201_2_0.pdf"},"notes":null,"org_country":"US","org_id":"59261edc92cb","org_name":"Island Hotel Company Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65066"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Atlantis%20notice%20only--%20CA%20Exhibit%201_2_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9656.pdf"}],"summary":"Malware may have captured payment card data from cards used at the Resort’s food, beverage, and retail locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c43ee93d4564d01f40918c69f88abd8b2b28b764","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulatory%20Packet%20%28CA%29_0.PDF"},"notes":null,"org_country":"US","org_id":"08db38bdb4ca","org_name":"The Madison Square Garden Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65042"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulatory%20Packet%20%28CA%29_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Madison%20Square%20Garden%20Company-2016-11-22"}],"summary":"The Madison Square Garden Company reported unauthorized access to its payment processing system and installation of a program designed to find payment card data.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31920ae39ee3a837492519070f78d178b58e9bfb","impact_type":"unknown","incident_date":"2016-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BREACH%20OF%20CONFIDENTIAL%20INFORMATION_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6b60c7db1006","org_name":"The California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65014"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-19","discovered_date":"2017-11-27","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12ee44e69cd6403865d0a835eefcf896668a95c6","impact_type":"data_theft","incident_date":"2016-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MJF%20--%20Notice%20for%20Harborside%20Mailing%20-%20All%20Exhibits_0.pdf"},"notes":null,"org_country":"US","org_id":"db0c3261ab4c","org_name":"MJ Freeway Business Solutions","org_type":"technology_saas","ransomware":null,"records_affected":1081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-134145"},{"fetched_at":null,"title":null,"type":"press","url":"https://mjfreeway.com/publicmessage"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MJF%20--%20Notice%20for%20Harborside%20Mailing%20-%20All%20Exhibits_0.pdf"}],"summary":"Unauthorized access to MJ Freeway’s systems resulted in the theft of Harborside customer names and driver’s license numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6513ab2f59fc79f20e9934031fbd806d1523da2","impact_type":"data_theft","imported_from":null,"incident_date":"2015-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Springfield%20Armory%20Ad%20CA%20r1prf_0.pdf"},"notes":null,"org_country":"US","org_id":"e9d1574cf92f","org_name":"Springfield Armory","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Springfield%20Armory%20Ad%20CA%20r1prf_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Springfield%20Armory-2016-11-18"}],"summary":"An unauthorized person accessed Springfield Armory’s web server and installed code designed to copy information entered during checkout.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-18","discovered_date":"2016-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1894024f0f03175045be528d166b520e57c466fc","impact_type":"disruption_or_ransomware","incident_date":"2016-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eye%20Institute%20of%20Marin%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"5b79f8cecb5e","org_name":"Eye Institute of Marin","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64977"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eye%20Institute%20of%20Marin%20Notice_1.pdf"}],"summary":"Eye Institute of Marin reported that its electronic medical record provider experienced a ransomware infection, and some consultation notes were lost during system restoration.","supporting_quote":null,"technology_involved":["electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"MMPC"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"dba5b12e72a9","name":"Marin Medical Practice Concepts, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83635020ded0da0162172d36ffe68190258ef5a5","impact_type":"unknown","incident_date":"2016-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/doc05680520161117112652_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"744b17374e30","org_name":"Watsonville Chiropractic, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64960"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"896a1125fc06d5af23b2ff6689b72936dd845f0d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20CA%20Email%20Notice%20Proof_0.pdf"},"notes":null,"org_country":"US","org_id":"327b424817c6","org_name":"QVC, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64962"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20CA%20Email%20Notice%20Proof_0.pdf"}],"summary":"QVC's website tracking technology unintentionally sent visitors' email addresses and QVC account passwords to online marketing partners.","supporting_quote":null,"technology_involved":["website tracking technology","QVC account"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1530"],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-11-17","discovered_date":"2016-09-18","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"598865d38d3d087b7716dbe1d087e5badf314764","impact_type":"data_theft","incident_date":"2016-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Luque%20--%20Press%20Release_1.pdf"},"notes":null,"org_country":"US","org_id":"842b67e061f6","org_name":"Luque Chiropractic, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The Amazon S3 storage account was accessible to persons outside the organization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64959"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Luque%20--%20Press%20Release_1.pdf"}],"summary":"A security researcher accessed and downloaded patient information from Luque Chiropractic’s exposed Amazon S3 storage account.","supporting_quote":"On September 18, 2016, Luque was notified by its billing software company that its Amazon “S3” storage account was vulnerable because it was accessible to persons outside their organization, and that a security researcher accessed and downloaded information from the storage account.","technology_involved":["Amazon S3"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a157f0dc3401829a58458543103814deee5dbb07","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/HabitatforHumanity.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4d3f6b30afc5","org_name":"Habitat for Humanity","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/HabitatforHumanity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1790cc4fc6fab5a4f4ff18339e6d257d67db5c22","impact_type":"data_theft","imported_from":null,"incident_date":"2016-08-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8bef19ce378d","org_name":"GeekedIn","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"GeekedIn left a MongoDB database exposed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GeekedIn","type":"hibp","url":"https://haveibeenpwned.com/Breach/GeekedIn"}],"summary":"GeekedIn's exposed MongoDB database was accessed by an unknown third party, who extracted records containing information from public profiles.","supporting_quote":"In August 2016, the technology recruitment site GeekedIn left a MongoDB database exposed and over 8M records were extracted by an unknown third party.","technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12e797aec8ffe6a3c59c6cded5bcde5ec7aa0dc5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e2b312f0-af5f-11e7-b9af-6daebc71dd3b"},"incident_date":"2016-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3daf01f2fd33","org_name":"Department of National Defence","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/department-of-national-defence-investigating-possible-hack-of-its-recruiting-site/"}],"summary":"Canadian Department of National Defence investigating possible hack of its recruiting site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b0261198f043ea85f51e12d48bc3efe6369b684","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17862c90-77b3-11e7-a457-a5a222e6d450"},"incident_date":"2016-11-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1c4289a00a5","org_name":"U.S. Bank","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://registerguard.com/rg/news/local/35802741-75/former-uo-football-player-arrested-accused-of-identity-theft.html.csp"}],"summary":"Bank employee identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f688ed4811bd62ae3c71a3d0faedc692040cc08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5fc76510-c94c-11e7-aa33-c3c39d564c9a"},"incident_date":"2016-11-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"846c2a596da4","org_name":"PornHub.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.manchestereveningnews.co.uk/news/greater-manchester-news/pornhub-cyber-attack-computer-warning-13878369"}],"summary":"Millions of people who used adult website Pornhub could have had computers infected in cyber attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d80277213b71f88a17a86fb4853e551d42e0b98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2eb381c0-c56e-11e7-bdb2-99e5dbe0676c"},"incident_date":"2016-11-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5cd925670a93","org_name":"TSYS Merchant Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/TSYS%20Merchant%20Data%20Breach%20Notification_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65177"}],"summary":"Misdelivery of information via email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c3c653933956c8f96402bac9589062780335cfc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"445fb140-8768-11e7-944f-971cfc93387d"},"incident_date":"2016-11-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9550bd08d945","org_name":"Central DuPage Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wlsam.com/2017/04/30/update-prosecutors-nurse-copied-sexual-images-found-on-patients-phone/"}],"summary":"Nurse copied mages found on patient’s phone","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d62a227ecf839b8f92cc1d1fa809cdc0476943db","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC673090-16AB-4542-827F-C4AA04CEC113"},"incident_date":"2016-11-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"aa964423a082","org_name":"Asda Superstore","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nwemail.co.uk/news/barrow/Two-arrested-after-skimming-device-found-at-Barrow-supermarket-77ea9a73-b8a7-42a7-a8b5-9e518b928e12-ds"}],"summary":"detection of a skimming device on an ATM at the Asda superstore in Barrow.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"398a2099cc72b0e6742b63a49380a049bfa73e6b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9653.pdf"},"notes":"records_affected not found in source; cleared; attack_techniques without supporting words dropped: T1657","org_country":"US","org_id":"1779e7a63f6c","org_name":"Charles Schwab","org_type":"financial","ransomware":null,"records_affected":975,"reviewed":false,"root_cause":"The attacker used credentials obtained from another website to access Schwab.com.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Charles%20Schwab%20%26%20Co.%2C%20Inc.-2016-11-11"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9653.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9653.pdf"}],"summary":"An unauthorized party used credentials obtained from another website to access a Schwab.com account and attempted a transfer or trade that Schwab prevented.","supporting_quote":"We believe that an unauthorized party obtained your username and password from another website and tried them successfully on Schwab.com.","technology_involved":["Schwab.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-10","discovered_date":"2016-10-24","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c3cc37f0f6b428a236ceafce63f4a891a61e2714","impact_type":"unknown","incident_date":"2016-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea5dc2b64eee","org_name":"WINDY RIDGE ACCOUNTING & TAX SERVICE","org_type":"unknown","ransomware":null,"records_affected":320,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#WINDY%20RIDGE%20ACCOUNTING%20%26%20TAX%20SERVICE-2016-11-10"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557cbf7d8b1363f27a6a6c61dc52e087ef4b938c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C82B7A6-4D31-497D-AC9E-35B155C42BBF"},"incident_date":"2016-11-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"962cbb2512f1","org_name":"Psychological & Counseling Center","org_type":"healthcare","ransomware":null,"records_affected":468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vanderbilthustler.com/news/pcc-sends-blast-email-without-hiding-recipient-email-addresses.html"}],"summary":"sent an email out to 468 of its clients on Nov. 10 without blocking the recipients from seeing each other's names","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c089b94b2147a2968d0f2fb32b57926627661a7a","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"2113f9482c26","org_name":"Dodonew.com","org_type":"unknown","ransomware":null,"records_affected":8718404,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dodonew.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dodonew"}],"summary":"Have I Been Pwned reported that data allegedly obtained from Dodonew.com in late 2011 included email addresses and usernames from 8,718,404 accounts; the breach was marked unverified.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-10","discovered_date":"2016-10-11","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9706d97859b60f4ccca67fea2694f30e96001a86","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BCU_-_SSN_Plus_Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"0e04632ee607","org_name":"Baxter Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BCU_-_SSN_Plus_Notice_0.PDF"}],"summary":"Baxter Credit Union reported that a compromised employee email account sent unsolicited email and contained some individuals’ personal information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f60f0b7d205bb88813070079e9d805ec4ce96a4b","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"52f9ae7d653a","org_name":"Army Force Online","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Army Force Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/ArmyForceOnline"}],"summary":"Army Force Online suffered a data breach in May 2016 that exposed account information, including usernames, email and IP addresses, and MD5 passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6b1f58e3fc0a38fbcbae46efc1967a61ff5e49d1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9652.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3b1209e4801","org_name":"UFCW Local 655 Food Employers Pension Plan","org_type":"unknown","ransomware":null,"records_affected":556,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9652.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-09","discovered_date":"2016-07-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ef96a1eea4dfe8bf3f491eaebdcdb9f3e67e317c","impact_type":"unknown","incident_date":"2016-07-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24e3ecba9cf4","org_name":"UFCW Local 655 Food Employers Joint Pension Plan","org_type":"unknown","ransomware":null,"records_affected":177029,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#UFCW%20Local%20655%20Food%20Employers%20Joint%20Pension%20Plan-2016-11-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62b8e9bc878389d67ef9000cadf3d5711cf4bbdc","impact_type":"unknown","incident_date":"2016-07-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/UFCW%20Local%20655%20Food%20Employers%20notice%20only%20pdf_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0ea3f9ccc6a3","org_name":"UFCW Local 655 Food Employers Joint Pension","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64824"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0190ef6e694b89f5f9b8a890eb42b032914fb380","impact_type":"data_theft","incident_date":"2016-09-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eileen%20Fisher%20notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"9da34838235b","org_name":"Eileen Fisher","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64832"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eileen%20Fisher%20notice%20only_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eileen%20Fisher%2C%20Inc.-2016-11-09"}],"summary":"Malicious code on Eileen Fisher’s website allowed unauthorized individuals to capture customer information during checkout.","supporting_quote":null,"technology_involved":["eileenfisher.com checkout website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25f61acb0914b2ace58bbd4be02100e2aff5815a","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"0abe884b6806","org_name":"Lookbook","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lookbook","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lookbook"}],"summary":"Lookbook suffered a data breach in August 2012, and data including usernames, email and IP addresses, birth dates, and plain-text passwords later appeared for sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e19b8ac28a22294ce860d85de88ca1ae964945a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F5C753D-FDE2-472D-B3D2-73022E6F50D5"},"incident_date":"2016-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53db27a4dd3a","org_name":"DemocraticUnderground.com's forums","org_type":"technology_saas","ransomware":null,"records_affected":75000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/11/10/democrat_site_blames_pro_trump_hackers/"}],"summary":"DemocraticUnderground.com's forums were hacked and rendered unavailable on Tuesday afternoon \"apparently by a supporter of Donald Trump\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12f36be973cde5eeb7095e723790812ae672e199","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1fc3105b9943","org_name":"CheapAssGamer.com","org_type":"other","ransomware":null,"records_affected":444767,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: CheapAssGamer.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/CheapAssGamer"}],"summary":"A breach of CheapAssGamer.com's IP.Board forum exposed account data, including usernames, email and IP addresses, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["IP.Board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68390ec3183e86d0df0734f207ed3b191d479c4d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2012-07-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"aae878374271","org_name":"War Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: War Inc.","type":"hibp","url":"https://haveibeenpwned.com/Breach/WarInc"}],"summary":"War Inc. exposed account data, including usernames, email addresses, and salted MD5 password hashes, in a mid-2012 breach.","supporting_quote":null,"technology_involved":["War Inc."],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2431a3545e176319af4de877080d989642fb297d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"37e1bbd7620c","org_name":"Unreal Engine","org_type":"technology_saas","ransomware":null,"records_affected":530147,"reviewed":false,"root_cause":"The breach was allegedly due to a SQL injection vulnerability in vBulletin.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Unreal Engine","type":"hibp","url":"https://haveibeenpwned.com/Breach/UnrealEngine"}],"summary":"The Unreal Engine Forum exposed account usernames, email addresses, and salted MD5 password hashes in a breach allegedly caused by a SQL injection vulnerability in vBulletin.","supporting_quote":"In August 2016, the Unreal Engine Forum suffered a data breach , allegedly due to a SQL injection vulnerability in vBulletin.","technology_involved":["vBulletin"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"vBulletin"},"updated_at":null,"veris_action":"hacking","derived":{"vendors":[{"id":"46fb5ad409d8","name":"vBulletin"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90da0be7c956a3932d0169f9959b8609949a1060","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Privacy_Incident_Oct_2016_Template_Member_Letter_Standard_Custom_0.pdf"},"notes":null,"org_country":"US","org_id":"44898f8c35fe","org_name":"Kaiser Permanente Health Plan, Inc of Northern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64764"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Privacy_Incident_Oct_2016_Template_Member_Letter_Standard_Custom_0.pdf"}],"summary":"A website upgrade caused some members’ protected health information viewed on kp.org to potentially be viewable by other visitors for approximately two hours.","supporting_quote":null,"technology_involved":["kp.org website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c16eb50b1bc6b5c4d14054523aba07bbb2205ebd","impact_type":"data_theft","imported_from":null,"incident_date":"2013-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f4acd82c6ea1","org_name":"Heroes of Gaia","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Heroes of Gaia","type":"hibp","url":"https://haveibeenpwned.com/Breach/HeroesOfGaia"}],"summary":"Heroes of Gaia suffered a data breach that exposed usernames, IP addresses, email addresses, browser user-agent details, and website activity.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8693ac2a9802d11b9fb117f5ee4f6fdbcea9956","impact_type":"data_theft","imported_from":null,"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"c204ae674f36","org_name":"Duowan.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Duowan.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Duowan"}],"summary":"Data allegedly obtained from Duowan.com in approximately 2011 included email addresses, usernames and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f13fef1dda01524cd419aa91e79353602ff9956d","impact_type":"data_theft","imported_from":null,"incident_date":"2011-07-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"3a75f05ee82d","org_name":"Civil Online","org_type":"professional_services","ransomware":null,"records_affected":7830195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Civil Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/CivilOnline"}],"summary":"Data allegedly obtained from Civil Online in 2011 included email and IP addresses, usernames, and MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-07","discovered_date":"2016-09-20","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d53b7648dd57b20b28df93bdb51826cf1e8a33bb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dccd69a8ebe4","org_name":"Ameriprise Financial, Inc.","org_type":"unknown","ransomware":null,"records_affected":942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Ameriprise%20Financial%2C%20Inc.-2016-11-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efe53f39987a4da8a45b427fa3182ec63278f6e7","impact_type":"data_theft","imported_from":null,"incident_date":"2016-09-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"9be3c9849c0c","org_name":"Aipai.com","org_type":"other","ransomware":null,"records_affected":6496778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aipai.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aipai"}],"summary":"Data allegedly obtained from Aipai.com, including email addresses and MD5 password hashes, was leaked online.","supporting_quote":null,"technology_involved":["Aipai.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-06","discovered_date":"2016-09-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddcffb161e0088d22929beda9c66aeb0af8a8780","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20i-dressup_data_breach_C_1.pdf"},"notes":null,"org_country":"US","org_id":"e9aec9642d0b","org_name":"Unixiz Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20i-dressup_data_breach_C_1.pdf"}],"summary":"Unixiz Inc reported that cyber criminals accessed its computer system and customers’ personal information, including account passwords.","supporting_quote":null,"technology_involved":["i-dressup.com account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"816a7e80f584ae9e5993530611492891852962ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F47262C8-EADB-4358-8282-A2A0AFAA7FE9"},"incident_date":"2016-11-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c360ae5eee1","org_name":"Scottland Yards Website","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hackers-hit-scotland-yards-site-after-arrests-at-million-mask-march/"}],"summary":"Hackers claim to have shut down part of Scotland Yard's website for eight hours in revenge for dozens of arrests during an anti-capitalist march that ended in violence in central London","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70b7efac7d605a2e7a864a7413bfb7373f9d9c2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D844BE1C-B8F4-494E-BD24-EDBBD33176E5"},"incident_date":"2016-11-06","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"012aeb98e1c7","org_name":"Meigs County EMS","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mydailysentinel.com/news/10668/meigs-ems-releases-statement-on-computer-hack"}],"summary":"Meigs County EMS has released a statement regarding a \"ransomware\" computer hack it say occurred earlier this fall.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bf468ad2f82714d3aed31fdaa7407df9929759b","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"3518ee360315","org_name":"uTorrent","org_type":"technology_saas","ransomware":null,"records_affected":395044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: uTorrent","type":"hibp","url":"https://haveibeenpwned.com/Breach/uTorrent"}],"summary":"The uTorrent forum database was breached, exposing account usernames, email addresses, and unsalted MD5 password hashes.","supporting_quote":null,"technology_involved":["IP.Board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"155688d3bb17a61d9e3bac48917128fe10458849","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52F1A862-A57C-4E1C-8610-83B3F40F3A2F"},"incident_date":"2016-11-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3253004bf63","org_name":"Madison County","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washtimesherald.com/news/madison-county-pays-ransom/article_7c1e4771-f347-540f-89ea-3c789bc0f6dd.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/3139975/security/ransomware-hammers-madison-county-indiana.html"}],"summary":"Madison County, Indiana was the victim of a ransomware attack last week","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-04","discovered_date":"2016-10-06","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8658d3953c1c2f2de350305e548675b308809f4f","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-10-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Welk%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b2c570ca8fde","org_name":"Welk Resort Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Welk%20CA%20Notice_0.pdf"}],"summary":"A company laptop containing information that may include personal data was stolen during a home burglary.","supporting_quote":"On October 6, 2016, we learned that, late on October 5, a Welk team member’s home was burglarized, and the team member’s company laptop was stolen.","technology_involved":["company laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2016-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1b26804e2a706633af100872ea4860ad613bc2c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37AF3885-1B44-44EE-B003-7075954EA15F"},"incident_date":"2016-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"31d35cdc6cd5","org_name":"Touchnote","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-34744132;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/touchnote-acknowledges-data-breach.html"}],"summary":"Mobile app data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f080d8220c2b47e98ee2b64c4abbce59ea836f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9670034-FFC5-4818-9558-FB09AA04C589"},"incident_date":"2016-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"c4d30ef77901","org_name":"Shiseido Co Ltd","org_type":"other","ransomware":null,"records_affected":420000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mainichi.jp/english/articles/20161203/p2g/00m/0dm/003000c"}],"summary":"TOKYO (Kyodo) -- Japanese cosmetics maker Shiseido Co. said Friday that the online store run by subsidiary IPSA Co. has suffered illegal access and that personal information on about 420,000 customers may have leaked as a result.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-04","discovered_date":"2016-10-05","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"016d09162a681dfee848bbd941a5c225d0ca0fda","impact_type":"unknown","incident_date":"2016-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c84ded8813df","org_name":"Sentinel Hotel","org_type":"unknown","ransomware":null,"records_affected":1227,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Sentinel%20Hotel-2016-11-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-04","discovered_date":"2016-10-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"dda4fa80d95adb19d3f04e77f8a3cf0cd4b24f7f","impact_type":"unknown","incident_date":"2016-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94c8d2a584f2","org_name":"Kaiser Foundation Health Plan of the Northwest","org_type":"unknown","ransomware":null,"records_affected":544,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kaiser%20Foundation%20Health%20Plan%20of%20the%20Northwest-2016-11-04"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-11-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac13c73ea3370ee59754997387f465de963a47d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4001BBBF-684D-4F00-828A-A7A4A7204301"},"incident_date":"2016-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"850fbaf65515","org_name":"Casino Rama","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/canadian-casino-says-it-was-hacked-data-was-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.680news.com/2016/11/10/customer-information-stolen-cyberattack-casino-rama/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://calvinayre.com/2016/11/12/casino/hacked-casino-rama-files-posted-online/"}],"summary":"The Casino Rama Resort in Ontario said the hacker claimed to have stolen financial reports, patron credit inquiries, collection and debt information, payroll and other data in an intrusion it first became aware of on Friday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3e7932482473298fb9d1f79a5b47ca457b8bf59","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED28D1A4-7182-4DFB-963B-7585CA13E6C7"},"incident_date":"2016-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8bbcd9578ab2","org_name":"University of Wisconsin-Madison Law School","org_type":"education","ransomware":null,"records_affected":1213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/story/news/education/2016/12/06/uw-law-school-data-breach-disclosed/95050542/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/university-of-wisconsin-madison-law-school-breach-disclosed/"}],"summary":"A database within the University of Wisconsin-Madison Law School that contained Social Security numbers and name pairs corresponding with 1,213 Law School applicants for 2005-'06 was hacked last month, the university announced Tuesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4c019933532353ed42f6a47edab527b628310f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBCE3769-1270-4B93-97F8-900CC729283D"},"incident_date":"2016-11-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"51239fb30488","org_name":"Novopay","org_type":"professional_services","ransomware":null,"records_affected":530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nz-novopay-botch-up-creates-security-breach-for-school-staff/"}],"summary":"Some schools have been sent the full payroll information of other schools this week","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-11-03","discovered_date":"2016-10-14","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"509b179be55c7cd4c33ccd8a966b71de8d080291","impact_type":"data_theft","incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"2f2b3e4b04dc","org_name":"National Wholesale Incorporated","org_type":"retail_ecommerce","ransomware":null,"records_affected":14281,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64682"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_1.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#National%20Wholesale%20Company%2C%20Inc.-2016-11-04"}],"summary":"National Wholesale reported that harmful code on its website monitored customer information entered during online orders.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70e34ad6e8dd13b28f9f38a0f04f48a8da0d7e75","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"702A585F-2E9D-4E42-A71A-09D5C426AB87"},"incident_date":"2016-11-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"22f6529d7969","org_name":"AliExpress","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/security-breach-in-shopping-app-aliexpress/"}],"summary":"n the last several days details of many users who requested to remain anonymous were exposed to anyone.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de23ca0806fbf683b254b2b1b060c4a502caaa44","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"283a3540-3b18-11ec-ba5b-a1f2db3b8242"},"incident_date":"2016-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2168fa59100f","org_name":"Zendesk","org_type":"professional_services","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/zendesk-discloses-2016-data-breach/"}],"summary":"Zendesk discovered a breach that occurred 3 years ago disclosing over 10,000 user account info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ff012cd5be2ee5e70e76dd91f55e818eb960123","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d8a84370-da34-11e7-a58f-dff506a792fb"},"incident_date":"2016-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b63f0afbe917","org_name":"Silver Cross Hospital","org_type":"healthcare","ransomware":null,"records_affected":8862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/mi-computer-system-health-data-breach-may-involve-data-of-106k"}],"summary":"Upgrade reconfigures security settings exposing data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29cc5ba2a0665813dd050c4ab244f8c7ba0739d5","impact_type":"data_theft","imported_from":null,"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"819d6fbd7aea","org_name":"Rambler","org_type":"technology_saas","ransomware":null,"records_affected":91436280,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Rambler","type":"hibp","url":"https://haveibeenpwned.com/Breach/Rambler"}],"summary":"A dump containing 91 million Rambler usernames and plain-text passwords was discovered being traded online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d7cf023ffd4753bf46329db4b80bc7f986bf1ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6a2d44e0-d967-11e7-8b17-fdfed30923dd"},"incident_date":"2016-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e70895571752","org_name":"Princeton Pain Managment","org_type":"healthcare","ransomware":null,"records_affected":4668,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/princeton-pain-management-notifies-patients-after-hacker-gains-access-to-phi/"}],"summary":"Princeton Pain Management is notifying 4,668 patients of a hack that was detected on November 28. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a7e7c97b08010574bd3e8ccb2f7c160afe7333c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e1ec950-d57b-11e7-af4f-6b5d4514198e"},"incident_date":"2016-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"1b69fac01a29","org_name":"New Zealand Nurses Organisation","org_type":"nonprofit","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/new-zealand-nurses-organisation-notifies-47000-members-of-breach/"}],"summary":"The NZNO yesterday notified our Office – as we would expect – that it had fallen victim to a spear phishing scam. An NZNO staff member received an email purportedly from its chief executive asking for names and contact details of all its members. Unfortunately, these details were","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"JM","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed2f2c665be7b2bda6e107cac4789c473300099d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3b12b950-af65-11e7-b9af-6daebc71dd3b"},"incident_date":"2016-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JM","org_id":"10848441016d","org_name":"National Works Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/jamaicas-national-works-agency-forced-to-redo-roadwork-survey-after-data-theft/"}],"summary":"Jamaica’s National Works Agency forced to redo roadwork survey after data theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7b1a893dff040da2673dca1be4fb312ee417634","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0244b30-a9db-11e7-bafd-1552bcc84b5b"},"incident_date":"2016-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b6264356f865","org_name":"Michael Page","org_type":"other","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.channelnews.com.au/huge-new-data-leak-details-of-700k-oz-jobseekers-exposed/"}],"summary":"Recruitment giant PageGroup hacked, Capgemini dev server blamed for info leak","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb2ce51bfedd421cd87aa1af61383983adc3e6e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54a76c20-c5aa-11e7-8053-ff1e84d2b694"},"incident_date":"2016-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"02e52ac525ae","org_name":"Eastside Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cjme.com/article/1216740/emerald-park-doctor-reprimanded-again-over-privacy-breach"}],"summary":"Doctor was accessing patient records without a valid reason.  He asserts it was when he was teaching his wife to use the system (also not authorized).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"339fb1302656eabb34f391b5147fd97d139c5991","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1a958de0-c56f-11e7-bdb2-99e5dbe0676c"},"incident_date":"2016-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8450dff137c3","org_name":"East Valley Community Health Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Breach%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-65226"}],"summary":"Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"285c37713cbeacac87aa3c3c8992785600c8e1c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73140210-d958-11e7-a452-77d2890a67ae"},"incident_date":"2016-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"74002f30a006","org_name":"City of Ottowa","org_type":"government","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ottawa-city-staff-scramble-after-accidentally-releasing-retirees-medical-information/"}],"summary":"Request for information results in TMI provided.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5daab52bebe01497aeb0553b8e86913de0e79521","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cc546f20-af66-11e7-b9af-6daebc71dd3b"},"incident_date":"2016-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f257fdc63a9","org_name":"Chicago Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/chicago-public-schools-worker-gave-student-names-addresses-to-charter-for-mailers/"}],"summary":"Chicago Public Schools worker gave student names, addresses to charter for mailers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23000e5b46afcf9ebda2b634dae18d85671d324c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"795ce020-af4a-11e7-906a-bb7346b48a5e"},"incident_date":"2016-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"924d1fd2e9de","org_name":"Best Health Physical Therapy, LLC (Best Health)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/physical-therapy-facility-reports-data-security-incident"}],"summary":"Best Health Physical Therapy Reports Data Security Incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b2d48168865f7e95cbe401ddf5908bf27736aae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10059290-e440-11e7-977c-0b3846f56840"},"incident_date":"2016-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9efa15a46e5","org_name":"Berkshire Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.berkshireeagle.com/stories/hundreds-of-bmc-patients-info-found-on-vendors-thumb-drives,490304;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/1745-berkshire-medical-center-patients-impacted-ambucor-health-solutions-breach-8689/"}],"summary":"Personal information on hundreds of Berkshire Medical Center cardiology patients have been found on thumb drives recovered from a former employee of an outside service vendor, the hospital reported on Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a5bfd5274465eb5819d356b1d9ffbf0e2861106","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"396470d0-d959-11e7-a452-77d2890a67ae"},"incident_date":"2016-10-31","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"151eb7d47261","org_name":"NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nhs-trust-cancels-every-operation-at-three-hospitals-after-its-electronic-system-was-hit-by-a-computer-virus-attack/"}],"summary":"Malware outbreak leads to suspension of operations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74ac4cd5b343f180f7b5fbf80d352aab6df365f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"851bbcf0-d953-11e7-a452-77d2890a67ae"},"incident_date":"2016-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b07e4dfb1c08","org_name":"Horizon Blue Cross Blue Shield of New Jersey","org_type":"financial","ransomware":null,"records_affected":170000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/healthfit/index.ssf/2016/11/horizon_alerts_170k_customers_to_possible_privacy.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/command-marketing-innovations-reports-printing-error-impacting-horizon-blue-cross-blue-shield-of-new-jersey-members/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/horizon-says-privacy-breach-could-affect-up-to-170k-n-j-customers/;"}],"summary":"Misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be102e2914527dc2cfe842ab2e7afae1d61de4cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"324D6D3A-2DB9-4952-B83B-53F371EC7F7A"},"incident_date":"2016-10-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kplr11.com/2015/11/02/atm-skimming-investigation-in-ofallon/"}],"summary":"Gas pump skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97f35ba3febc4e8c77928a71589199c7cef32002","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CACCA87D-8FC7-4722-81D7-C84BC9F45C88"},"incident_date":"2016-10-30","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"93907a1b2f25","org_name":"Lincolnshire NHS Trust","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/ransomware-blamed-for-cyber-attack-which-forced-hospitals-to-cancel-operations-and-shut-down-systems/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computing.co.uk/ctg/news/2479109/globe2-ransomware-blamed-for-lincolnshire-nhs-trust-cyber-attack"}],"summary":"An NHS hospital trust which was forced to shut down systems and cancel operations as a result of a cyberattack has revealed that a ransomware infection was the source of the problem.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e204be435a63431968ff176f50c44878bdeef1e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c267e230-e3a0-11e7-8742-2bc46bd10713"},"incident_date":"2016-10-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a12e3e8d11b9","org_name":"Goole NHS Foundation Trust","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hulldailymail.co.uk/northern-lincolnshire-and-goole-nhs-foundation-trust-cancels-more-operations-after-cyber-attack/story-29858967-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.digitalhealth.net/2017/02/ransomware-attack-blamed-on-misconfigured-firewall/"}],"summary":"The ransomware attack that shut down a northern trust for four days has been blamed on a misconfigured firewall, according to a cyber-security review.  IT systems at Northern Lincolnshire and Goole NHS Foundation Trust were hit with a ransomware virus, known as Globe2, on 30 Octo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-30","discovered_date":"2016-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c38d8ac9c8dfbc9f0d9325f31a04512f4910b921","impact_type":"disruption_or_ransomware","incident_date":"2016-07-26","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cummings%20Notice%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"7f2ebddc39a3","org_name":"Anne M. Cummings, M.D., F.A.C.P.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64633"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cummings%20Notice%20A_0.pdf"}],"summary":"Anne M. Cummings reported that her electronic medical record provider experienced a ransomware infection, and consultation notes were lost during system restoration; no evidence was found that patient information was viewed, transferred, or accessed.","supporting_quote":"On August 22, 2016, I received confirmed notice from my electronic medical record provider that their electronic system was subject to a malware attack on July 26, 2016.","technology_involved":["electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Marin Medical Practice Concepts, Inc."},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"dba5b12e72a9","name":"Marin Medical Practice Concepts, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39c5df7911788530d13cbc09da5b4672b78e87d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/password-reset-email_V3_0.pdf"},"notes":null,"org_country":"US","org_id":"33ba4f7806ed","org_name":"Beyond Yoga","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64630"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/password-reset-email_V3_0.pdf"}],"summary":"Beyond Yoga reported that an incident may have exposed customers’ personal information, including payment card information and usernames and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2016-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0ce5d52adfa17bfafa04095dd22e352e0ce5809","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E4804C2-B6AA-4BB4-814A-90C469143D11"},"incident_date":"2016-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"38f48a5b80a6","org_name":"Cellebrite","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://securityaffairs.co/wordpress/52725/mobile-2/cellebrite-data-leak.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/the-phone-hackers-at-cellebrite-have-had-their-firmware-leaked-online"}],"summary":"Source code propriatary hacker software used to access iPhones was leaked to the Internet via a thrid party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afe764d8306ae5619f19d7f89ac6ab1c4be5782e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"764E53ED-A28B-480B-877E-E01C4CA57AB7"},"incident_date":"2016-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d44db4ee6b4b","org_name":"campaign office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/assemblywomans-orange-county-campaign-office-burglarized-voter-data-stolen/"}],"summary":"Thirty tablets and a laptop computer were stolen over the weekend from the Orange County campaign office of Republican Assemblywoman Young Kim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a352a2706f2a40da068e9941943fe21c1c641769","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/%28US%29%20Data%20Incident%20-%20Notice%20to%20Consumers_0.pdf"},"notes":null,"org_country":"US","org_id":"65ae14a83d4d","org_name":"Cisco Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An incorrect security setting following system maintenance made job application information accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64548"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/%28US%29%20Data%20Incident%20-%20Notice%20to%20Consumers_0.pdf"}],"summary":"Cisco reported that an incorrect security setting made job application information on its Professional Careers mobile website accessible.","supporting_quote":"Cisco’s investigation found this to be the result of an incorrect security setting following system maintenance.","technology_involved":["Cisco Professional Careers mobile website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"629899e438b3ab2ecdb680e2e6bb00a77a407deb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"981d7da0-e422-11e7-8742-2bc46bd10713"},"incident_date":"2016-10-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2a72ea28d49","org_name":"Brandywine Pediatrics, P.A.","org_type":"healthcare","ransomware":true,"records_affected":26873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hit-by-ransomware-brandywine-pediatrics-recovers-quickly-and-notifies-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/southcentral-foundation-cyberattack-affects-14k-in-ak"}],"summary":"Ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48e39294301c663c12f34c63c817523ce83f4d26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d80f3e0-0b5f-11e8-985b-1119ad21cbad"},"incident_date":"2016-10-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8b37f8f0ad8d","org_name":"Arby's","org_type":"other","ransomware":null,"records_affected":355000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/"}],"summary":"POS breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23653b6b57bc9ffa8a1f496961bff5168c7c6b93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFB6331D-F8F8-4254-B205-6CEEFEFB7A4A"},"incident_date":"2016-10-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"dd76df9f048f","org_name":"Centrelink","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/centrelink-apologizes-for-new-privacy-breach/"}],"summary":"The latest federal government data breach is being blamed on a rookie email error, someone at the giant Department of Human Services hitting the CC button on an email instead of the BCC button.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4778bf91c647d7a8bd8d5f5c813cfa2b67b89eb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9b3784c0-e3a7-11e7-8742-2bc46bd10713"},"incident_date":"2016-10-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f0a939eb56d","org_name":"Henry County Health Department","org_type":"government","ransomware":null,"records_affected":560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Medical/2016/12/23/Officials-did-not-know-scale-of-data-exposure.html"}],"summary":"The Henry County Health Department delayed for two months its public acknowledgment that hundreds of patients’ medical records were exposed in a burglary because the department did not realize the scale of the theft, a department spokesman said Thursday.  A nurse’s laptop and pap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"948ad7cdbfabe213aabbb59831fe9e500259035a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5FB6EDEA-78A6-479E-9DC8-D8E15D21F587"},"incident_date":"2016-10-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6250c7bab77f","org_name":"Great American PAC","org_type":"nonprofit","ransomware":null,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.publicintegrity.org/2016/10/21/20370/whoops-pro-donald-trump-super-pac-publishes-donor-credit-card-numbers"}],"summary":"filing of PAC contained Payment card info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22b8fc7622b4d72806141629b776bbbfdcc05a7d","impact_type":"data_theft","incident_date":"2016-09-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Premiumbeat%20-%20Notification%20Sample%2010-04-2016_1.pdf"},"notes":null,"org_country":"CA","org_id":"3a930044fa6b","org_name":"Shutterstock Music Canada ULC d/b/a PremiumBeat","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A security bug in third-party software resulted in unauthorized access to PremiumBeat user information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64473"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Premiumbeat%20-%20Notification%20Sample%2010-04-2016_1.pdf"}],"summary":"PremiumBeat reported that a bug in third-party software led to unauthorized access to user names, contact details, and encrypted passwords.","supporting_quote":"Unfortunately, on the afternoon of September 29th, we discovered a security bug in third party software which that resulted in unauthorized access to PremiumBeat user information.","technology_involved":[],"third_party":{"archetype":"vendor_product","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f7ed9992082bd672dd1b532a4ccc16d279aa557","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-10-20","initial_access":"unknown","notes":null,"org_country":"FR","org_id":"92b2a2ab5590","org_name":"Dailymotion","org_type":"technology_saas","ransomware":null,"records_affected":85176234,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dailymotion","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dailymotion"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/blogs/dailymotion-latest-mega-breach-victim-p-2336"}],"summary":"A Dailymotion breach exposed user accounts containing email addresses, usernames, and bcrypt password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26b3628b2dae06d9c9f3e34a8533eea1dc339b5a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7385A606-EA73-4006-91FF-4133E1E94E6D"},"incident_date":"2016-10-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a99df7f82476","org_name":"Blue Moon Deli","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/new-york/manhattan/video-crooks-put-atm-skimming-device-nyc-deli-released-article-1.2873893"}],"summary":"placed a skimming device on an ATM inside the Blue Moon Deli","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-10-20","discovered_date":"2016-08-05","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"faa6ca0be029e6a1dd4e90e43cd531a8508ae83f","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Apria%20-%20Notice%20of%20Data%20Event%20-%20CA%20Exhibit%201_0.pdf"},"notes":null,"org_country":"US","org_id":"758bc92383cf","org_name":"Apria Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64474"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Apria%20-%20Notice%20of%20Data%20Event%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"Apria Healthcare discovered unauthorized access to an employee’s email account containing individuals’ personal and medical information.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c82223b027067b8d5eba77be8edfcab9ac754d67","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FAB5DC0-7986-4352-B34C-9432EE2B3654"},"incident_date":"2016-10-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c903b0bb8405","org_name":"Ohio State Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/oh-trooper-accused-of-misusing-police-database-for-womens-info/"}],"summary":"Misuse of access to police DB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78f38742fb3b0d9f821e95358a56e824ea1c2ecc","impact_type":"unknown","incident_date":"2016-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Eastwood%20CA_Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a88589867a0e","org_name":"Eastwood Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64455"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9649.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce1ca2183946331400112b845984bb98ca693f73","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04BC5440-802F-4E5F-ADA6-2A5FA5AB3E71"},"incident_date":"2016-10-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"505903173ea0","org_name":"Primark","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/pennsylvania/te/skimming-device-found-king-prussia-mall-store-police"}],"summary":"skimming device was found recently at the Primark","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-17","discovered_date":"2016-09-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bebe3b22a07be5e28bde19db4407b5a179cc897a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ff3ecf649446","org_name":"Liberty Buy Sell","org_type":"unknown","ransomware":null,"records_affected":3357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Liberty%20Buy%20Sell-2016-10-17"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cf3ea214c1b5d870017607eae3b9928efed9d32","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Broadview%20Adult_0.pdf"},"notes":null,"org_country":"US","org_id":"b867e8600fcc","org_name":"Broadview Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64437"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Broadview%20Adult_0.pdf"}],"summary":"Broadview Mortgage reported two unauthorized administrative accounts on a branch-office server that may have contained mortgage applicants’ personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15243eb31ada0b7b5e3eca4162354b201e66bf95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35c30d00-e463-11e7-977c-0b3846f56840"},"incident_date":"2016-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d12a2e8ca4c3","org_name":"Skin Cancer Specialists, P.C.","org_type":"healthcare","ransomware":null,"records_affected":3365,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/3365-patients-billing-records-potentially-stolen-by-hacker-8760/"}],"summary":"Atlanta-based Skin Cancer Specialists, P.C., has announced a data security incident has been discovered that has resulted in the exposure of the billing records of 3,365 patients. An unauthorized individual was discovered to have gained access to the healthcare provider’s system ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ef4a4f47a6fe09168e1958ee42563da24313278","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FBE1079-2038-4742-AD27-9F247E00D4D7"},"incident_date":"2016-10-14","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"229e4167d48a","org_name":"Jammu and Kashmir police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tribuneindia.com/news/jammu-kashmir/inquiry-against-cop-over-security-leak/309092.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dnaindia.com/india/report-jammu-and-kashmir-cop-in-the-dock-for-leaking-info-to-pak-2263872"}],"summary":"insider cop leaked infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-10-14","discovered_date":"2016-08-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ccba8b58a0580271dcb3a3b6372826c12bf745","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Master%20Adults_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"c0ea313a42fd","org_name":"Integrity Transitional Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64398"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Master%20Adults_Redacted_0.pdf"}],"summary":"Integrity Transitional Hospital reported that an unauthorized individual potentially could have accessed patient laboratory and identification information on systems related to its laboratory services.","supporting_quote":null,"technology_involved":["laboratory services systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-10-14","discovered_date":"2016-08-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80549603c4f43a8b852407ee3946eb97df94e764","impact_type":"disruption_or_ransomware","incident_date":"2016-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Robinson%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"86b3f35469cf","org_name":"Curtis F. Robinson, M.D. Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Robinson%20Notice_0.pdf"}],"summary":"A ransomware infection at the organization’s electronic medical record provider led to the loss of consultation notes, with no evidence that patient information was viewed, transferred, or accessed.","supporting_quote":null,"technology_involved":["electronic medical record system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Marin Medical Practice Concepts, Inc."},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"dba5b12e72a9","name":"Marin Medical Practice Concepts, Inc"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"521654410606f85df85c1151c87dc44dcebbfbe5","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-17","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CalOptima%20Security%20Incident%20Notification%20Letter%20-%20Minor%20SSN_0.pdf"},"notes":null,"org_country":"US","org_id":"9e29b2189881","org_name":"CalOptima","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CalOptima%20Security%20Incident%20Notification%20Letter%20-%20Minor%20SSN_0.pdf"}],"summary":"A departing CalOptima employee downloaded data that included protected health information to an unencrypted USB flash drive, and the organization did not believe it had been shared.","supporting_quote":"On or about August 17, 2016, a departing Ca lOptima employee downloaded data, which included protected health information, to an un encrypted USB flash drive.","technology_involved":["USB flash drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-10-12","discovered_date":"2016-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8adbe4e814080e5f4251f7121c3cffae8856c426","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulatory%20Packet%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"86d1e40caefd","org_name":"Vera Bradley, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulatory%20Packet%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Vera%20Bradley%2C%20Inc-2016-10-12"}],"summary":"Vera Bradley reported unauthorized access to its payment processing system and installation of a program that searched for payment card data used at its retail stores.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1e9132977e6388d76e163806050ab7a5b190b86d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/RainbowChildren'sClinic.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3455f5fa9673","org_name":"Rainbow Children's Clinic","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/RainbowChildren'sClinic.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc393d9c224622a833d2bfa51c6912c543aa032a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"62fcca47cca3","org_name":"Modern Business Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Modern Business Solutions","type":"hibp","url":"https://haveibeenpwned.com/Breach/ModernBusinessSolutions"}],"summary":"A MongoDB file attributed to Modern Business Solutions containing personal information was shared publicly.","supporting_quote":null,"technology_involved":["MongoDB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3029bb267785f36d2e43c064fe634d557e85afc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39d3a060-e3ac-11e7-8742-2bc46bd10713"},"incident_date":"2016-10-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":8020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/kaiser-notifies-8000-members-whose-information-was-briefly-exposed-online/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Privacy_Incident_Oct_2016_Template_Member_Letter_Standard_Custom_0.pdf"}],"summary":"Three Kaiser units – Kaiser Permanente Health Plan, Inc of Northern California, Kaiser Permanente Health Plan, Inc of Southern California, and Kaiser Foundation Health Plan of the Northwest – have been notifying members after an error exposed some members’ protected health inform","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f697bd809a8373a180d38192cd56d6d2d8d88d4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B51E2D8-359F-4447-BDC2-237009EEEA8D"},"incident_date":"2016-10-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ff40a7bffdd2","org_name":"Manitoba Finance","org_type":"professional_services","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/tax-returns-sent-to-wrong-address-1.3800650"}],"summary":"sent tax files to wrong recipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e07fc40cc226b324548079cb13fc77a7b135f1ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAE30D0B-BB9D-4144-9AEB-23BF302740D3"},"incident_date":"2016-10-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4475b0544118","org_name":"Sheet Metal Workers Local Union No. 104","org_type":"nonprofit","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailydot.com/layer8/data-breach-sheet-metal-workers-25000/"}],"summary":"vulnerable to identity theft or worse by a misconfigured database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"excessive_privilege","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df43b9f53ffdf780236c948d27644f88838a12c7","impact_type":"data_theft","incident_date":"2016-06-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Qvale%20Notification%20%2810-7-16%29_0.pdf"},"notes":null,"org_country":"US","org_id":"e9bc4bf3c00f","org_name":"Qvale Auto Group, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"During a third-party IT vendor upgrade, employee access limitations to certain employee information were removed temporarily.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64308"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Qvale%20Notification%20%2810-7-16%29_0.pdf"}],"summary":"During a third-party IT vendor upgrade, employee access limitations to certain information were removed temporarily, and unauthorized access to names and bank account information was confirmed.","supporting_quote":"The incident occurred when, during t he course of an upgrade by a third party IT vendor, employee access limitations were removed to certain information of employees for a limited time period in June 2016.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69b0792e242220d3439624ff0b54cb5c80c2282f","impact_type":"data_theft","imported_from":null,"incident_date":"2016-10-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"d1c53e506002","org_name":"GFAN","org_type":"unknown","ransomware":null,"records_affected":22526334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GFAN","type":"hibp","url":"https://haveibeenpwned.com/Breach/GFAN"}],"summary":"Data allegedly obtained from GFAN surfaced in October 2016 and included email and IP addresses, usernames, and salted and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"199efc307df4c3e8208de2b9569b2ee92ce32e58","impact_type":"data_theft","imported_from":null,"incident_date":"2015-10-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"545120950470","org_name":"NetEase","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NetEase","type":"hibp","url":"https://haveibeenpwned.com/Breach/NetEase"}],"summary":"A reported breach of NetEase's 163.com site exposed email addresses and plain-text passwords, though the breach was marked unverified.","supporting_quote":null,"technology_involved":["163.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34997cf4a9ddb90c66124c20869bd3b82ea2d0e6","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"6108a112f256","org_name":"Taobao","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Taobao","type":"hibp","url":"https://haveibeenpwned.com/Breach/Taobao"}],"summary":"An alleged Taobao breach around 2012 exposed email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b474d0f3334bde68ecfd071b924ab93f85bf74ab","impact_type":"data_theft","imported_from":null,"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CN","org_id":"a6f58def1110","org_name":"126","org_type":"technology_saas","ransomware":null,"records_affected":6414191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 126","type":"hibp","url":"https://haveibeenpwned.com/Breach/126"}],"summary":"126 reportedly suffered an unverified breach around 2012 involving subscribers’ email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":["126 email service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c3c16012a2a343c4123487bd1746a5bb82ec3f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86414951-4D02-496A-9364-CF464B3EB59B"},"incident_date":"2016-10-06","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5a4a8be39e17","org_name":"Pont3","org_type":"other","ransomware":null,"records_affected":144575,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news.com.au/technology/online/hacking/sydney-running-festival-participants-hit-in-mass-email-hack/news-story/4e6683ea9de76ccd6d20ae8d2458e8f8"}],"summary":"Sydney Running Festival participants hit in mass email hack - Pont3","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e68f213786e8a1335d4ab203459c53c3c86ead91","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C6684EB-339D-41CA-AFC9-579E9E98ECB2"},"incident_date":"2016-10-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb7d128ba859","org_name":"Texaco/Kangaroo gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wjtv.com/2016/10/05/credit-card-skimmer-found-at-madison-gas-station/"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-05","discovered_date":"2016-08-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bf025cc3fbbf1dbd2b2f9c8dfeb482df894a132","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/1887.2%20Notice%20of%20Data%20Breach%20PHI%20CEHTP%20final%20100516_0.pdf"},"notes":null,"org_country":"US","org_id":"84754ae80782","org_name":"Public Health Institute","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The database was accessible on the internet without encryption or other security features.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64216"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/1887.2%20Notice%20of%20Data%20Breach%20PHI%20CEHTP%20final%20100516_0.pdf"}],"summary":"Public Health Institute reported that a database containing users’ email addresses and passwords was accessible on the internet without security features for approximately 30 days.","supporting_quote":"an electronic database containing email addresses and corresponding passwords for individual user accounts at one or more of the sites listed below was accessible on the internet without encryption or other security features for approximately 30 days.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bb6bf694c70e3afe700e32f660b678429164fac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8875E99E-3F61-494D-B71C-233D8ECCE725"},"incident_date":"2016-10-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"92304cb3fda7","org_name":"Western Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-patient-information-shows-up-at-wrong-corner-brook-company/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/privacy-breach-patient-information-wrong-place-1.3790911"}],"summary":"10 pages of patient information were incorrectly sent to a company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7699d81441b5644cae3e58c02a86d61341e6ba5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6880F6A9-A603-4C1F-ACD8-0BD9123DA9A0"},"incident_date":"2016-10-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ae1154a9a7c","org_name":"Various","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://inforney.com/crime/item/4857-skimming-devices-located-at-two-other-area-service-stations"}],"summary":"2 instances of gas pump skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"746c14223dea05242a254ebc2879f688cedac96b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ThomasvilleEyeCenter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5061202dbdad","org_name":"Thomasville Eye Center","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ThomasvilleEyeCenter.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"db7509c6370a39804693f31a5015bc453711d8a1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e98de1801c6","org_name":"Winston Dillard School District #116","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Winston%20Dillard%20School%20District%20%23116-2016-10-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba494b17ec6785ab026c89e7eaf1c21f4a14fc06","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1ff853f0-a952-11e7-bb38-a97a354bfe15"},"incident_date":"2016-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71d9f296d454","org_name":"Winnipeg Regional Health Authority","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/personal-health-information-taken-from-locked-area-winnipeg-regional-health-authority/"}],"summary":"A paper file containing medical information for about 1000 patients has been stolen from a locked office at Health Sciences Centre.  Winnipeg Regional Health Authority Chief Operating Officer Real Cloutier says it happened in early October and police have been called in.  “We do ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2e8f0f3c3779358c1cdd4fe2e06f1ef98657890","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76A5824A-28FE-4DDB-98ED-A3698776BE88"},"incident_date":"2016-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6ddfe6e3fed8","org_name":"Vancouver Pain Management","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vancouversun.com/news/local-news/privacy-breach-on-vancouver-pot-dispensary-website-reveals-medical-data"}],"summary":"Birth certificates, medical imaging, passports, prescriptions, biopsy reports, mental health assessments and more  the personal information and medical records of an unknown number of patients were publicly available on the website of a Vancouver marijuana dispensary until recent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a4674931b7f52fabfc3880b236f948ee00593ef","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"114150a0-a9d9-11e7-bafd-1552bcc84b5b"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7c2f5a8b44b","org_name":"VA Eastern Colorado Health Care System","org_type":"government","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/personal-information-for-thousands-of-colorado-vets-may-have-been-compromised/"}],"summary":"Personal information for thousands of Colorado vets may have been compromised - VA Eastern Colorado Health Care System","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6e30fdeb035abd6fad1acdc1a4aaed3a1fbdf51","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FFB3436-0431-4DBA-B0E3-7799874C56F8"},"incident_date":"2016-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3d860aaa2ae","org_name":"United States Navy","org_type":"government","ransomware":null,"records_affected":134386,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.worldbulletin.net/world/180597/us-navy-reveals-major-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cw6sandiego.com/personal-information-130000-sailors-stolen/"}],"summary":"Personal data of 134,386 American Sailors were stolen from a contractor's laptop, the U.S. Navy disclosed Wednesday.  The Navy was notified in October by Hewlett Packard Enterprise service that sailors' \"re-enlistment approval database\" was stolen from a computer supporting a Nav","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"292bb19a8e85418851d355fe49f2c7a6b7cb5b44","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4d331ca0-0b73-11e8-827c-bba53cbad290"},"incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b896e553b1dc","org_name":"Uber","org_type":"transportation_logistics","ransomware":null,"records_affected":57000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://katu.com/news/nation-world/report-uber-covered-up-cyber-attack-that-exposed-data-from-57-million-people;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-uber-cyber-payment-exclusive/exclusive-uber-paid-20-year-old-florida-man-to-keep-data-breach-secret-sources-idUSKBN1E101C"}],"summary":"Hackers stole the personal data of 57 million customers and drivers from Uber Technologies Inc., a massive breach that the company concealed for more than a year. This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"783b81ba87a98b861a9f998cb7c5d8eae343c493","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60DF0F8C-0249-4F25-BEB5-5A1FB9808108"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32bdf8870d20","org_name":"U.S. Secret Service","org_type":"government","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/powerpost/wp/2016/11/09/secret-service-it-management-slammed-following-chaffetz-breach/"}],"summary":"A 2015 OIG investigation found that 45 employees got into Chaffetz's 2003 Secret Service job application. Only four had a legitimate need, leaving the rest in violation of the Privacy Act and agency policies. The file snooping began minutes after Chaffetz, chairman of the House O","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77401ec2e06a586dd0fd501de515777af48f89be","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02695CBB-206C-4DFC-ADF3-6D5C16643123"},"incident_date":"2016-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LT","org_id":"ebba26fa0ee1","org_name":"Tieto Lietuva","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.occrp.org/en/daily/5717-sarunas-cerniauskas?src=ilaw"}],"summary":"Technical flaws in a voter support site ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99f046b374b2beb7df9ef82d63ec9403ceaab2ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEC1902C-CF1E-4471-AF06-C21214F3D875"},"incident_date":"2016-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7a8b7f57f86b","org_name":"Three Mobile","org_type":"technology_saas","ransomware":null,"records_affected":133000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/details-133000-three-customers-stolen-hackers;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/three-mobile-data-breach-company-confirms-data-from-133827-accounts-could-have-been-accessed/"}],"summary":"Database with information on pending phone upgrades compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b762fb8c1cf7439e07e2c17af224124cede05796","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ebb820a0-880b-11e7-9a4a-fb58f2b09996"},"incident_date":"2016-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16c2924cc636","org_name":"St Mary's Goverment","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.somdnews.com/enterprise/news/local/st-mary-s-government-s-computers-attacked-on-thanksgiving/article_29f6e7fc-2a65-593e-94da-d34ea5204c65.html"}],"summary":"St. Mary’s County government’s servers and computers were attacked on the evening of Thanksgiving, leaving most services down over the weekend as repair work continued early this week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7697e2ba025286610b7d5b59f03f40b0bc9934a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A5848DF-9898-4F37-8018-D00BF02F41C3"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae7c717e76fd","org_name":"Premier Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kimt.com/2016/11/08/skimming-found-at-local-banks-customers-out-thousands-of-dollars/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d69a8cc8db4eeb5513f4a53c19dcd29d852b1b68","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94D73D7E-4713-45A6-82DD-EF83A5A9B792"},"incident_date":"2016-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"879f1ee95b0a","org_name":"Parker Jewish Institute for Health Care and Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://forward.com/news/352219/at-jewish-nursing-homes-staff-arrested-for-stealing-from-senile-residents/"}],"summary":"six crooks accused of robbing New York nursing home residents ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2016-6483"],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38e6c391a88ececbe8c5b3c086fc5de51aa6bf0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF69EFA4-DF7C-4360-992F-B6809214452E"},"incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"f27e4c9bd909","org_name":"Pakwheels.com","org_type":"technology_saas","ransomware":null,"records_affected":674775,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://en.dailypakistan.com.pk/technology/pakistans-top-automotive-portal-pakwheels-hacked-leaving-over-half-million-accounts-compromised/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.techlist.pk/pakistan-automobile-website-pakwheels-hacked/"}],"summary":"Unknown hacking method compromises outdated forum software","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2016-6483","kev_added":null,"name":null,"days_listed_before_incident":null,"product":"vbulletin vbulletin"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87bbf3887707a27923e2a5d762d5554dc017560c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62b447e0-0a9f-11e8-827c-bba53cbad290"},"incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc2574dbc201","org_name":"Michigan Unemployment Insurance Agency","org_type":"government","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.detroitnews.com/story/news/local/michigan/2017/02/03/uia-msp/97454924/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickondetroit.com/news/potential-release-of-sensitive-information-in-unemployment-computer-system-identified;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wzzm13.com/news/investigations/13-on-your-side/watchdog/2-arrested-in-florida-for-fraudulent-michigan-unemployment-claims/401194145"}],"summary":"Private information stored in a state computer system for unemployment benefits recipients was potentially exposed to unauthorized viewers after a software update inadvertently caused a system glitch that could have affected nearly 1.9 million individuals, state officials said Fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb78e3e4a58e915d9c6991810495d9178c8afcac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5342D838-4127-483B-9992-177F170F53D1"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b5a8195fe502","org_name":"Manitoba Public Insurance","org_type":"financial","ransomware":null,"records_affected":31,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/iteam/insurance-broker-fined-privacy-rules-1.3668762"}],"summary":"A privacy breach involving customers' auto insurance files ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6b69df8af1dc0f2fee31ea34c4a1ad8ee7fbc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6D6851E-F826-4575-BFFF-E6867ACD7355"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59e2c64a9b3b","org_name":"Lukoil","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/pennsylvania/te/credit-card-skimming-device-found-paoli-gas-station"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac2d1f094b0fc9c273bdac1d794483f4fad575eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ED0B543-A40D-44A4-A2F8-6AEE63DD88BB"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"ad7215945717","org_name":"Limburg Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nltimes.nl/2016/10/10/corrupt-limburg-cop-paid-300000-leak-police-info/"}],"summary":"Police officer paid 300,000 euros to release license plate information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69f307bbe68bb27beb02b2f15b03c49daaf72423","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"059a8de0-d57e-11e7-af4f-6b5d4514198e"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3a44aa527b85","org_name":"Lee Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/lee-memorial-hospital-patient-plans-lawsuit-over-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-press.com/story/news/2016/10/28/lee-memorial-hospital-patient-plans-lawsuit-over-privacy-breach/92904006/"}],"summary":"A former patient of Lee Memorial Hospital says he will sue the health center after an employee photographed him recovering from life-threatening injuries from a motorcycle crash.  The attorney for that patient, Dylan Meracle of Cape Coral, notified the hospital and its operator, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4b877d72c84ca13bf58ba13783d33c3bf448d5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36ADE060-B6B7-4327-A77A-D193EB2F863B"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"19b696bbefc1","org_name":"Knappschaft","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.apotheke-adhoc.de/nachrichten/apothekenpraxis/nachricht-detail-apothekenpraxis/krankenkassen-datenpanne-bei-der-knappschaft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.apotheke-adhoc.de%2Fnachrichten%2Fapothekenpraxis%2Fnachricht-detail-apothekenpraxis%2Fkrankenkassen-datenpanne-bei-der-knappschaft%2F&edit-text="}],"summary":"Patient data is faxed to the wrong pharmacy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"826abdebcd733f4894309cff1c16c3bb4d1af8f7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c947a200-d57e-11e7-af4f-6b5d4514198e"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07faaed5fd83","org_name":"Horizon THC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/medical-marijuana-patients-personal-information-found-in-trash-pile/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox10phoenix.com/news/arizona-news/medical-marijuana-patients-personal-information-found-in-trash-pile"}],"summary":"A medical marijuana dispensary is conducting an investigation into how sensitive patient information ended up in a pile of trash on a public sidewalk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"016fbdf12f6817274b95e2ee8546d83a86c14f71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14BEA8C0-F183-4CAE-9B65-61D06891DD10"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c0fb3716013","org_name":"Health Access Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bangordailynews.com/2016/10/19/health/lincoln-health-center-warning-patients-of-data-breach-fired-worker/?ref=latest;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wabi.tv/2016/10/20/health-access-network-in-lincoln-warns-of-data-breach-after-firing-employee/"}],"summary":"Medical employee snooping","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e447d15a2a41f371b212d8c15b88b8b029be1c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17b91da0-a19b-11e7-bd2e-43ac41b832c9"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca04bab7b4e7","org_name":"Group Health, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/EMB_MB_LTR_31233EOCBreach_FINAL-110316_0.pdf"}],"summary":"Earlier this month, GHI mailed you a copy of your Medicare Prescription Drug Plan Evidence of Coverage (a document that describes the health care benefits covered by your plan and how your plan works). On October 13, 2016, we learned of an unintentional disclosure of your Health ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6edab790457dc2fe70e0ab81a447e3702cb56e75","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9C61551-D1C4-497A-B7AA-B76F63E69A71"},"incident_date":"2016-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d3f6b30afc5","org_name":"Habitat for Humanity","org_type":"other","ransomware":null,"records_affected":5500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailydot.com/layer8/habitat-for-humanity-applicants-michigan-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/more-than-5000-people-exposed-in-habitat-for-humanity-data-breach/"}],"summary":"massive data breach ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a2d0c27d46eff38d62557c81a73f515c64673fa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA1FB6CD-5C83-4B42-B736-0883CDF82AC2"},"incident_date":"2016-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"4ada7f5859a8","org_name":"Europol","org_type":"government","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://foreignpolicy.com/2016/12/01/europol-accidentally-leaks-terrorism-investigations-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.co.uk/article/europol-terror-investigations-breach"}],"summary":"A police officer working for the European agency exposed sensitive data about security investigations on a hard drive linked to the web. Around 700 pages on terror investigations were accessible online, found by a Dutch TV programme Zembla, including analysis of terror groups, an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f27b99dd893e892410547b3f5c0ac5336d19295f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"720faac0-a9df-11e7-bafd-1552bcc84b5b"},"incident_date":"2016-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61a4a4845428","org_name":"Discovery Benefits","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wday.com/news/north-dakota/4152813-accusations-rise-fargo-company-discovery-benefits-suspicious-activity"}],"summary":"Accusations rise on Fargo Company; Discovery Benefits of suspicious activity","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96b10dd1dcccd772b84ce600d07565ad5ba67af1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"367D4172-49A3-492E-BC69-CE3F741962CC"},"incident_date":"2016-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"64bbc8414e0e","org_name":"Department of Social Protection","org_type":"government","ransomware":null,"records_affected":61,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rte.ie/news/2016/1010/822954-michael-ryan-glen-collection-investments/"}],"summary":"Clerk provides data to private investigator brother.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4021673ceac2e17f9323d38027f64233069d1e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BF42429-0CD0-433C-8DA4-99F0D50A0B24"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"83e407f2131f","org_name":"Concentrix Mums","org_type":"professional_services","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/business-37631613"}],"summary":"sent information such as bank statements, self assessment details and National Insurance numbers of other","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e2a2b0fef12b18324657551597f0fd534befc52","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B292615-E19E-4D11-9A41-42BDD861489C"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc52b91a2767","org_name":"Chevron Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/georgia/woodstock/skimming-device-found-gas-pump-woodstock"}],"summary":"gas pump skimmer, found by employees before use","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5239c5df11b057e8117b8daf2773df307f5c057","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0c198a00-8677-11e7-8e76-6d3ed9e599f7"},"incident_date":"2016-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"810d4d101f8b","org_name":"Central Platte Natural Resources District’s","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cpnrd-computers-system-hacked-by-russians/"}],"summary":"Central Platte Natural Resources District’s computers system hacked by Russians","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8cd68e07f18d2cbc7651bdcebb8edbe17ef08dd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"393fe040-a9e2-11e7-8c20-836b8b691ede"},"incident_date":"2016-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b4c646fef053","org_name":"Capitol Petro","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://host.madison.com/wsj/news/local/courts/men-plead-guilty-to-thefts-related-to-gas-pump-skimmers/article_6a6c4cca-520d-57a5-9d0f-bae59a29f969.html"}],"summary":"Men plead guilty to thefts related to gas pump skimmers - Capitol Petro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d48ef617176133a717c5ae303c47eed8d22a9c65","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fc9b1c7eb000","org_name":"Aternos","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Aternos","type":"hibp","url":"https://haveibeenpwned.com/Breach/Aternos"}],"summary":"Aternos suffered a data breach in December 2015 that affected subscribers and exposed usernames, email and IP addresses, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"73e373b4e69d2b0eae08d1868a19f715d97dec5e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-09-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9647.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"11fc9d466218","org_name":"Vaupell","org_type":"manufacturing","ransomware":null,"records_affected":1198,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9647.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9647.pdf"}],"summary":"An unauthorized person accessed Vaupell’s internal network servers, where files containing personal information were accessible; the company had no specific basis to conclude the information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dedbf2da77c6d066a2a540516390ae52f701afbf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E1B2EAE-BB01-4219-9675-506D84521DFF"},"incident_date":"2016-09-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"936fa3fdf91d","org_name":"Magna Terra Health Services","org_type":"retail_ecommerce","ransomware":null,"records_affected":470,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/illegal-pot-dispensary-customers-fume-over-email-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ottawacitizen.com/news/local-news/illegal-pot-dispensary-customers-fume-over-privacy-breach"}],"summary":"email sent not using the CC line for pot dispensary customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2bb973b02dc4aa94d1db968e16bb2eb32ab8d9f","impact_type":"data_theft","imported_from":null,"incident_date":"2016-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"47a5448a89a3","org_name":"Leet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Leet","type":"hibp","url":"https://haveibeenpwned.com/Breach/Leet"}],"summary":"A breach of Leet exposed subscriber usernames, email and IP addresses, password hashes, and website activity.","supporting_quote":null,"technology_involved":["Leet"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-29","discovered_date":"2016-08-10","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8f2b4a66d59da6413138965dbd368f0ec7116290","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9650.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b46018bc7dac","org_name":"Rebecca Minkoff","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Rebecca%20Minkoff-2016-09-29"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9650.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ad2be8854d4701ed56c88c0062de50f51e9afa7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95C67923-1A40-4EC8-9F85-9E3218AD4738"},"incident_date":"2016-09-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60fb5d176fcb","org_name":"OptumHealth","org_type":"healthcare","ransomware":null,"records_affected":2006,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/optumhealth-new-mexico-announces-2000-record-data-breach-8693/"}],"summary":"The vendor had downloaded some electronic protected health information to a flash drive, which was then sent to an undisclosed recipient by mail using the U.S. Postal Service. The flash drive did not arrive at its destination.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-29","discovered_date":"2016-07-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1f67c363812f32302edbab6064becd52e573b25f","impact_type":"unknown","incident_date":"2016-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"76cac646944f","org_name":"Jerry's Artarama NC, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Jerry%27s%20Artarama%20NC%2C%20Inc-2016-09-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05fb2de3984efd204311e761bc4827782c126f36","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vallejo%20-%20Employee%20Notification%20Letter%20-%20Proof%20-%209-29-16_0.pdf"},"notes":null,"org_country":"US","org_id":"73dc59bbd55c","org_name":"City of Vallejo","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64148"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vallejo%20-%20Employee%20Notification%20Letter%20-%20Proof%20-%209-29-16_0.pdf"}],"summary":"The City of Vallejo accidentally included employee Social Security numbers in a salary information file sent to Transparent California, which confirmed it had not disclosed them and had destroyed the file.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a67217c33611c14010d8fafb9b7f978a3343943d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2327A8A-024A-482B-A274-D4ABCB5A3981"},"incident_date":"2016-09-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9a28f6a6a60","org_name":"Kangaroo Gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wjtv.com/2016/09/28/credit-card-skimmer-found-at-pearl-gas-station-2/"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"772adbe67ad7d498841eba5379dab22ae950f82f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB73786B-6DD0-4850-8763-E8A32D09B5EA"},"incident_date":"2016-09-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"3e3627a90140","org_name":"Israeli Airforce","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/idf-colonel-suspended-for-stolen-military-laptop/"}],"summary":"IDF Colonel had laptop stolen from home","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb25c7114009dce055198a3a3a9d5bc5f2b1a22e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6188350E-60CD-49F8-888B-DA4B995DAF7D"},"incident_date":"2016-09-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5316b8ca0fa","org_name":"Gulf Oil Corp Ltd","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/virginia/mountvernon/skimming-device-found-richmond-highway-gas-station-police"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"224948869875fb237dbf89bbd81eb85ecc454d32","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39C451F0-BEBA-455B-A2F0-A66C5C185EF1"},"incident_date":"2016-09-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/news/skimming-device-found-on-convenience-store-atm/328067298"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"232cd96351e7ab0dd233a2c00e5cdb989f754482","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Novation%20Ad%20CA%20r2prf_0.pdf"},"notes":null,"org_country":"US","org_id":"c9b3acc11348","org_name":"Novation Settlement Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Novation%20Ad%20CA%20r2prf_0.pdf"}],"summary":"Novation Settlement Solutions determined that an unidentified third party was likely in possession of files containing personal and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f888930e3ba06746af6cad29813fe5e346db8ce","impact_type":"data_theft","imported_from":null,"incident_date":"2016-07-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9dc6e7faa260","org_name":"i-Dressup","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An SQL injection flaw in the i-Dressup site remained open.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: i-Dressup","type":"hibp","url":"https://haveibeenpwned.com/Breach/iDressup"}],"summary":"i-Dressup user accounts were exposed after a hack associated with an open SQL injection flaw.","supporting_quote":"At the time the hack was reported, the i-Dressup operators were not contactable and the underlying SQL injection flaw remained open, allegedly exposing a total of 5.5 million accounts.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7aa73398e6dfec32ffa83e2ae9fc36094bf1c70","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"814EBC2E-2E58-41BD-AEE6-1DA48E4374BA"},"incident_date":"2016-09-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f3cc86d31a7","org_name":"Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmur.com/news/skimming-devices-found-at-salem-gas-stations/41834694"}],"summary":"Gas pump skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2ac5d2c4fed270f5841129fb439f36ad4a6ab62","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75C3E7F0-DF8D-422E-8CF0-D6FF068D72FC"},"incident_date":"2016-09-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"05220c9c0a23","org_name":"Red Cross Blood Service","org_type":"healthcare","ransomware":null,"records_affected":1280000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2016-10-28/red-cross-data-breach-may-have-exposed-donors-to-identity-theft/7976392;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/australias-biggest-data-breach-sees-1-3m-records-leaked/"}],"summary":"PII published to a publicly-facing website,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07df2a1e7ecd762b5be7163bf8bf042662fc9a38","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2007-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c31e9ba09365","org_name":"gPotato","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: gPotato","type":"hibp","url":"https://haveibeenpwned.com/Breach/gPotato"}],"summary":"A 2007 breach of the gPotato game portal exposed more than 2 million user accounts, including personal information and credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54e367a6e3a117360a8cee776db8566404e2e5a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8cfa85b0-d583-11e7-af4f-6b5d4514198e"},"incident_date":"2016-09-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a8fb0f903f5","org_name":"Dr. Larrie Mandreck","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-hacking-attempt-made-at-vernon-doctors-office/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://infotel.ca/newsitem/attempted-computer-hacking-at-vernon-doctors-office/it35805"}],"summary":"Ransomware attack on a doctor's office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72a0ec4c79d04dec5762efdd09dd512bf9718546","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A99E741-5549-4E3B-9BC5-B8DA1F5631F3"},"incident_date":"2016-09-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b22428c05ec","org_name":"Dow Corning Corp","org_type":"professional_services","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsenterprise.com/content/dow-corning-takes-legal-action-after-data-breach;"}],"summary":"defendants \"exceeded their authorized access to Dow Corning's computers under the Master Agreement between plaintiff and defendants' employer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-23","discovered_date":"2016-08-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e036d60312511a7265157b325446d8a267a88dc","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2016-09-23%20All%20User%20Email%20Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"2deff8aafd22","org_name":"Jive Software","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64018"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2016-09-23%20All%20User%20Email%20Notice_0.PDF"}],"summary":"Jive Software said Producteev usernames and passwords were held in a file outside normal encryption procedures that may have been accessed by an unauthorized third party.","supporting_quote":null,"technology_involved":["Producteev"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-23","discovered_date":"2016-09-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0367f8f0abc9482c09e0cf49dfe3f12414ca6cf2","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9646.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"12cede7fdb13","org_name":"Group Health Cooperative","org_type":"healthcare","ransomware":null,"records_affected":651,"reviewed":false,"root_cause":"A change in the letter length was not programmed into the equipment that places letters into envelopes, causing two letters to be enclosed together.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9646.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9646.pdf"}],"summary":"Group Health Cooperative mistakenly enclosed two members’ letters in one envelope, exposing names, addresses, member numbers, and group names.","supporting_quote":"This happened because a change in the length of the letter from four pages to two pages was not programmed into the equipment which places letters into envelopes.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2016-09-23","discovered_date":"2016-07-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f54b8bcdcfc92d847eb53245b09e2ec8966db2da","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/meadows%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"1bb03372bdbe","org_name":"Hal Meadows","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64012"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/meadows%20notification_0.pdf"}],"summary":"Hal Meadows reported that a patient file containing personal, health, and billing information had been unlawfully accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"614d751573f2450f8ebf5ab2a2a9cd2764968e8e","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"98874e4f16bb","org_name":"GameTuts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GameTuts","type":"hibp","url":"https://haveibeenpwned.com/Breach/GameTuts"}],"summary":"GameTuts user account data, including usernames, email and IP addresses, and salted MD5 hashes, was exposed.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10e0b7a44ce1c9c701dcf3020bea7cd67f88d625","impact_type":"unknown","incident_date":"2015-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification-1_3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64015"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64014"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64013"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64571"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c845d3d3fe5c9df8b10f71e823b45c28f22004e2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A261D998-5FBC-4F64-BEA5-AE1E2495E53F"},"incident_date":"2016-09-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e9cccf4c8d5e","org_name":"Alberta College of Paramedics","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.metronews.ca/news/calgary/2016/09/25/privacy-breach-alberta-first-responder-information-at-risk.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/alberta-college-of-paramedics-privacy-breach-put-information-of-thousands-of-members-at-risk/"}],"summary":"privacy breach in its navigation portal. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4b4649b48d2ab070b626c2f4d3aa1d739fcf171","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yahoo%20-%20V2%20Consumer%20Notification%20Materials-c_0.pdf"},"notes":null,"org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo! Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64004"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yahoo%20-%20V2%20Consumer%20Notification%20Materials-c_0.pdf"}],"summary":"Yahoo confirmed that a state-sponsored actor stole a copy of certain user account information from its systems in late 2014.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2016-09-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddb31e5d4bd3dba423d11f20fde43979b19c42f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1819EB1-1863-4AB0-953D-C9387424C99C"},"incident_date":"2016-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2c0fd981530","org_name":"White House","org_type":"government","ransomware":null,"records_affected":12700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.upi.com/Top_News/US/2016/09/22/Sensitive-information-leaked-in-breach-of-White-House-contractors-email-reports-say/1001474584636/"}],"summary":"official emails sent to Gmail by White House employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9a3c6126ef38300108efca42ef7040d2546d11e","impact_type":"data_theft","incident_date":"2016-06-29","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FinalLetterPackage_0.pdf"},"notes":null,"org_country":"US","org_id":"cfc48e5dc6e3","org_name":"Premier America Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A departing employee emailed lists containing personal information to a non-Premier America account in violation of company policies.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64011"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FinalLetterPackage_0.pdf"}],"summary":"A departing Premier America Credit Union employee emailed lists containing personal information to a non-Premier America account.","supporting_quote":"We recently learned that a departing employee of Premier America emailed to his non-Premier America account lists that reflected some of your personal information, in violation of our company policies, during late June 2016.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-22","discovered_date":"2016-07-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8924d4d1274e99a129bdaea6e69e76a28d5c53d","impact_type":"unknown","incident_date":"2016-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b332566f1ad","org_name":"New Jersey Spine Center","org_type":"unknown","ransomware":null,"records_affected":28000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#New%20Jersey%20Spine%20Center-2016-09-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57ccd94f3901beb75a458fd94e465395e0e55a47","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA741E89-1244-4F72-B791-2A78F4A9E680"},"incident_date":"2016-09-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"602515153698","org_name":"Florida Bar Association","org_type":"professional_services","ransomware":null,"records_affected":259969,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/florida-bar-association-hacked-members-data-leaked/"}],"summary":"used JSON output to complile 259,969 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2828295f406e5462a02ac23651fdea2c8716fc75","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50709240-0aa0-11e8-827c-bba53cbad290"},"incident_date":"2016-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03abf7c61723","org_name":"Cloudflare","org_type":"other","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3173639/security/bleeding-clouds-cloudflare-server-errors-blamed-for-leaked-customer-data.html#tk.twt_cso;"},{"fetched_at":null,"title":null,"type":"press","url":"https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itechpost.com/articles/88212/20170225/cloudflare-security-breach-exposes-data-among-3-400-websites-password-change-recommended.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news10.com/2017/02/24/uber-fitbit-okcupid-info-exposed-by-massive-data-breach/"}],"summary":"Cloudflare security breach exposed data and changing the passwords are recommended among 3,400 websites. Cloudflare is an online content delivery network, which offers CDN, DNS, DDoS protection, and security.  Some usernames and passwords were leaked because of a security bug tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["credentials"],"disclosed_date":"2016-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d90365449c5252caa83728e4cd5c871d0d48311","impact_type":"unknown","incident_date":"2016-08-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/zazzle%20-%20individual%20notice%20%28california%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1e5f6914c08f","org_name":"Zazzle Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Zazzle believed the usernames and passwords used in the incident came from a data breach of another website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/zazzle%20-%20individual%20notice%20%28california%29_0.pdf"}],"summary":"Zazzle detected unauthorized login attempts to customer accounts using credentials believed to have come from a breach of another website.","supporting_quote":"Given the nature of the incident, Zazzle believes that the usernames and passwords used in the incident, including yours, were obtained from a data breach of some other website.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca15249d1edcec38277d42322aaea9bbbe50c488","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C962266-02DF-4502-85BC-5EF3CD6585D9"},"incident_date":"2016-09-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2458474868da","org_name":"University of Ottawa","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3123027/security/university-of-ottawa-gets-failing-grade-in-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/university-of-ottawa-missing-hard-drive-with-data-on-900-students/"}],"summary":"external hard drive containing the personal information of  students disappeared ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce2fd83202fb55dd65c1f84c46ee6f9e357282f6","impact_type":"disruption_or_ransomware","incident_date":"2016-07-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stallcup%20Final%20Multi%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"3cef59962a46","org_name":"Stallcup & Associates, CPAs","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63986"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stallcup%20Final%20Multi%20Letter%20Sample_0.pdf"}],"summary":"A ransomware virus encrypted some of Stallcup & Associates’ computer files, and tax information was located on the same drive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bb544d48994e06efa3d9afc84665832a45babb87","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ACTIVEOutdoors.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53243b860c1e","org_name":"Active Outdoors","org_type":"unknown","ransomware":null,"records_affected":2978,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ACTIVEOutdoors.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f876932982b5d766e27c7efd854ccab2d7f30e61","impact_type":"unknown","incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NOTICE%20%5BFINAL%5D_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5d47d8732de3","org_name":"USC Keck and Norris Hospitals","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63962"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc52fdfb0bf29be9a349cfb930abc815296a85bd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"848B43BA-D716-4E5E-BD00-29F51CC1AE7E"},"incident_date":"2016-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"031bad079e1d","org_name":"Public Health Service","org_type":"government","ransomware":null,"records_affected":6600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/powerpost/wp/2016/10/03/surgeon-general-sends-warning-to-own-staff-your-personal-information-may-have-been-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/wireStory/us-surgeon-general-investigating-computer-breach-42647917"}],"summary":"The Surgeon General on Monday issued a warning to his staff that is all too familiar to federal employees: Your personal information may have been stolen.  In an email, Surgeon General Vice Adm. Vivek H. Murthy told \"commissioned corps\" employees of the Public Health Service that","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7bc231b36cfa1f3e6cacd41ef300b03994dbd77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F82CC634-04CC-461C-BE4A-1C1A4611DB10"},"incident_date":"2016-09-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"eb287e793318","org_name":"MoDaCo dotcom / Solutions","org_type":"technology_saas","ransomware":null,"records_affected":879703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.grahamcluley.com/2016/09/android-community-modaco-suffers-data-breach-user-database-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/09/20/modaco_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/modaco-acknowledges-january-breach-impacting-879703-accounts/"}],"summary":"breach is likely to have occurred by way of a compromised Administrator account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40d4283df9ac29042d34c68e37aeb45cd0014ee1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"GB","org_id":"a26ef70454c0","org_name":"MoDaCo","org_type":"other","ransomware":null,"records_affected":879703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MoDaCo","type":"hibp","url":"https://haveibeenpwned.com/Breach/MoDaCo"}],"summary":"A breach at MoDaCo exposed subscriber identities, including email and IP addresses, usernames, and salted-MD5-hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22338b8daaf76016a129be34893e19d0829397d5","impact_type":"data_theft","imported_from":null,"incident_date":"2012-03-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6b45def6ca59","org_name":"Last.fm","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Last.fm","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lastfm"}],"summary":"Last.fm user accounts were hacked in March 2012, exposing email addresses, usernames, passwords, and website activity.","supporting_quote":null,"technology_involved":["Last.fm"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d86e56f2529aff496e066c72e8c6b506d97442e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9FC7CA3-5AD9-4D3D-8E25-D0D59DA7A3A3"},"incident_date":"2016-09-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a8d2fc159dc","org_name":"11-Jul","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bradenton.com/news/local/crime/article103285287.html"}],"summary":"ATM skimming device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-19","discovered_date":"2016-04-25","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57b19a97bf39e6693918437e638e3f49780aa366","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-21","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notification%20Proof_1.pdf"},"notes":null,"org_country":"US","org_id":"3b1723b3905f","org_name":"Ursus Holdings, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63932"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification%20Proof_1.pdf"}],"summary":"Ursus Holdings reported that an employee’s email account was compromised after the employee received a phishing email, and that personal information was present in employees’ Google Mail and Google Docs accounts.","supporting_quote":"That employee previously had received a phishing email requesting account credentials to access what appeared to be a secure PDF attachment.","technology_involved":["Google Mail","Google Docs"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Google"},"updated_at":"2026-10-10","veris_action":"social","derived":{"vendors":[{"id":"0e9f335c7c68","name":"Google"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-19","discovered_date":"2016-08-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ff637e57802cbc3cd187c7b14560cc535344b98","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/211253%20MENZIES%20AVIATION%20-%20%20PPT%20Letter%20-%20General_0.pdf"},"notes":null,"org_country":"US","org_id":"17df59aee087","org_name":"Ascensus","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A website configuration error allowed another plan administrator to access personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63931"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/211253%20MENZIES%20AVIATION%20-%20%20PPT%20Letter%20-%20General_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9645.pdf"}],"summary":"A website configuration error allowed another plan administrator to access a file containing Ascensus plan participants' personal information.","supporting_quote":"On August 23, 2016, we discovered a website configuration error that allowed the plan administrator of another Ascensus retirement plan access to your personal information.","technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fce9ab46ef6cc423f00ffca47f6639b4c26bc34","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ComboLTR_0.PDF"},"notes":null,"org_country":"US","org_id":"cb21faa75cc0","org_name":"ACTIVEOutdoors","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63929"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ComboLTR_0.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ACTIVEOutdoors-2016-09-19"}],"summary":"ACTIVEOutdoors reported unauthorized access to its online hunting and fishing licensing applications, where personal information may have been accessed.","supporting_quote":null,"technology_involved":["online hunting and fishing licensing applications"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eceed5cff5cec93a9528e3f747ff824ebb0f0d2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"911C82D3-8766-4131-B970-E1D39512D838"},"incident_date":"2016-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d9f7716b60a","org_name":"Tacoma School District","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tacoma-9-year-old-gets-explicit-report-card-through-app-used-by-teachers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox40.com/2016/09/19/tacoma-9-year-old-gets-explicit-report-card-through-app-used-by-teachers/"}],"summary":"app hacked that is used by teacher.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6234bf1be87882c1980ce4e962af6998e14a1b5f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3273C827-04DB-49F4-83DD-E22484A74400"},"incident_date":"2016-09-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4aba1728a37d","org_name":"La Joya American Federation of Teachers","org_type":"nonprofit","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/personal-information-of-la-joya-isd-teachers-accidentally-released/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krgv.com/story/33121425/personal-information-of-la-joya-isd-teachers-accidentally-released;"}],"summary":"accidentally sent email with SSN of teachers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"711fc1c4dc023b6de7976f06a7c61f11ee1323b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"583ab060-e5ea-11e9-a0ce-353e27116082"},"incident_date":"2016-09-17","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e4200a2a478b","org_name":"Best Western","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/british-columbia/best-western-hack-1.4286671"}],"summary":"phishing used to compromise front desk computers and steal credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d3ef1bad7dcaa8a5cfe149729d6977df6dbfda2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"491583AA-531A-4399-8AFD-259CD0654ADB"},"incident_date":"2016-09-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9a9c6005dfb2","org_name":"LV","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.ftadviser.com/protection/2016/09/21/ex-lv-employee-in-court-over-data-leak/"}],"summary":"London's first time that we have charged suspects with bribery offences","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-09-16","discovered_date":"2016-08-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0aa99eda23255dd27c68bbc14f47d6529d90bc1e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lulus%20Consumer%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"fa7213360e4a","org_name":"Lulu's Fashion Lounge","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63911"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lulus%20Consumer%20Notice_1.pdf"}],"summary":"Lulu's Fashion Lounge reported unauthorized access to its payment card processing system that may have exposed customer personal and payment card information.","supporting_quote":null,"technology_involved":["payment card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3119378d7afc6ebc9b527617a464fd73a2c8fd34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0BD03FF-F895-45E4-AE00-13512D2DDA35"},"incident_date":"2016-09-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d67f373962b","org_name":"Louisiana Voting","org_type":"government","ransomware":null,"records_affected":9898159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/every-voter-louisianas-details-exposed-massive-election-blunder-1583006"}],"summary":"every voter in the US state of Louisiana\" was leaked online without password protection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0bb321218ac52f8aed1c26c0327f01cb33a31cd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0b538ec0-a951-11e7-bb38-a97a354bfe15"},"incident_date":"2016-09-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e80a540ba9ad","org_name":"HP Enterprise Services LLC","org_type":"technology_saas","ransomware":null,"records_affected":1235,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/indiana-health-coverage-program-members-notified-of-breach/"}],"summary":"HP Enterprise Services LLC (HPE), a Medicaid fiscal agent for the Indiana Health Coverage Program, recently notified HHS of the theft of 1,235 members’ information. The theft was discovered on September 16 and reported to HHS by HPE on November 7.  According to a statement provid","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d606b0791655ee4d7c5bac643579ad01fd8e330","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3FA6E55-FAB3-409B-8496-0D444E505132"},"incident_date":"2016-09-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ff33ccda347","org_name":"Pontiac Nursing Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nys-a-g-schneiderman-announces-arrests-of-4-aides-who-allegedly-took-photos-and-videos-of-nursing-home-residents/"}],"summary":"4 providers allegedly taking still and video digital images of residents in undignified poses at two nursing homes in Oswego.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13fab894f20ba916a9eb1771c6b18731ca12e4b1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-09-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"ZA","org_id":"51842874b2cb","org_name":"eThekwini Municipality","org_type":"government","ransomware":null,"records_affected":81830,"reviewed":false,"root_cause":"The eThekwini eServices website allowed utility bills to be downloaded without sufficient authentication.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: eThekwini Municipality","type":"hibp","url":"https://haveibeenpwned.com/Breach/eThekwiniMunicipality"}],"summary":"A security flaw in eThekwini Municipality’s eServices website exposed residents’ personal information and utility bills because downloads lacked sufficient authentication.","supporting_quote":"Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication.","technology_involved":["eThekwini eServices website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a4f2b060747bae0658b7744ccd651492379382","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"314d6ad6a19c","org_name":"Regpack","org_type":"unknown","ransomware":null,"records_affected":324000,"reviewed":false,"root_cause":"Human error left the transactions exposed on a publicly facing server.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Regpack","type":"hibp","url":"https://haveibeenpwned.com/Breach/BlueSnapRegpack"}],"summary":"Regpack transactions containing personal and payment data were exposed on a publicly facing server due to human error.","supporting_quote":"A downstream consumer of BlueSnap services known as Regpack was subsequently identified as the source of the data after they identified human error had left the transactions exposed on a publicly facing server.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"530b8996305ac5dd5677c517f5c2423622df4ce1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/WheelerEgger.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea7ed93a443a","org_name":"Wheeler and Egger, CPAs, LLC","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/WheelerEgger.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","other"],"disclosed_date":"2016-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b22c153896931489a1b523a3043cebdc85a9003","impact_type":"data_theft","imported_from":null,"incident_date":"2016-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"273fbb6c578c","org_name":"ClixSense","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ClixSense","type":"hibp","url":"https://haveibeenpwned.com/Breach/ClixSense"}],"summary":"ClixSense suffered a data breach that exposed subscriber identities and data, including passwords stored in plain text.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f899167818945fe7ecfb5c7ba44610bb5295f85","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91AD4F00-E0E6-456D-A187-611D9A555E14"},"incident_date":"2016-09-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a868ad04e99b","org_name":"Tesco Petrol Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/deal/news/warning-as-card-machine-tampered-102726/"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73b9022e44f9f7441f72a990b3a66190c003d7cc","impact_type":"data_theft","imported_from":null,"incident_date":"2015-07-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"acbc0edd9e8a","org_name":"Pokébip","org_type":"other","ransomware":null,"records_affected":657001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pokébip","type":"hibp","url":"https://haveibeenpwned.com/Breach/Pokebip"}],"summary":"Pokébip reported a breach exposing subscriber identities, including email and IP addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5ab026362875353248665908047948e24527e995","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a2f88ccab71","org_name":"Asante","org_type":"unknown","ransomware":null,"records_affected":2282,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Asante-2016-09-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44d4d5a1fb7188b97982985f0060cc019b83dde2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A47B7D04-F74A-4FC7-8D71-D8C0B79A2360"},"incident_date":"2016-09-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0cb7b2002b48","org_name":"Pontypridd MP's","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/slackspace/owen-smith-tweets-login-data-to/"}],"summary":"tweeted log in information live","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a531088aafa89a8fac77c7cc9a9a3635694dd89","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61962535-FD64-4D8C-AF5A-71BD78FA85E3"},"incident_date":"2016-09-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc742fe994dd","org_name":"UC San Diego School of Medicine","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uc-san-diego-school-of-medicine-notifying-trainees-whose-ssns-were-exposed-on-the-internet/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63999"}],"summary":"PII exposed on the internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41030966232c3900d15ed14a4d4c2d42896e4e21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E87F2D70-5D58-4D57-A879-AD511977C9B3"},"incident_date":"2016-09-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a18689d3a44","org_name":"Saint Francis Health System","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krmg.com/news/news/local/st-francis-server-gets-hacked-6000-people-affected/nsbhd/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kjrh.com/news/local-news/saint-francis-health-system-reports-server-hacked-anonymous-demand-made-for-return-of-patient-info;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krmg.com/news/news/local/st-francis-server-gets-hacked-6000-people-affected/nsbhd/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kjrh.com/news/local-news/saint-francis-health-system-reports-server-hacked-anonymous-demand-made-for-return-of-patient-info;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/st-francis-health-system-hacked-thedarkoverlord/"}],"summary":"patient data was extracted from a server during an unauthorized external access.  Officials decided not to act on the ransom demand ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"46190ee9e70c6fc120e6d8e6bbc2e87f1e33399b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/GrayTelevision%2CInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d5b935c0ecb5","org_name":"Gray Television, Inc.","org_type":"unknown","ransomware":null,"records_affected":95,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/GrayTelevision%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cac02ed6b17e2394c9728b815bf8774b92bfebf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F0820DF-2D22-4D7F-A7F8-B38AE3C8DFEE"},"incident_date":"2016-09-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"24d13d746137","org_name":"Capita","org_type":"professional_services","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-missing-gp-records-in-essex-norfolk-and-suffolk-total-9000/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.essexlive.news/over-9-000-nhs-health-records-lost-by-private-company-in-essex-suffolk-and-norfolk/story-29873676-detail/story.html"}],"summary":"More than 9,000 patients' records in Norfolk, Suffolk and Essex have gone missing since a private firm took on transferring files, a BBC survey shows.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c2adf70674e85e8a38e66fd2145817388f976ec","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-09-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"cb48768daf7c","org_name":"WIIU ISO","org_type":"other","ransomware":null,"records_affected":458155,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WIIU ISO","type":"hibp","url":"https://haveibeenpwned.com/Breach/WIIUISO"}],"summary":"The WIIU ISO forum was hacked in September 2015, exposing 458,155 accounts and their email addresses, IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f75b9207eacd9caf502191196e42cb7f1bf043ae","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"NL","org_id":"9c511dd697c8","org_name":"ServerPact","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ServerPact","type":"hibp","url":"https://haveibeenpwned.com/Breach/ServerPact"}],"summary":"ServerPact was hacked in mid-2015, exposing account information including birth dates, email and IP addresses, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2090686dd3500df21c80bd960fab85330427909a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93AEF080-4F66-4F84-8043-28E2E2BE332C"},"incident_date":"2016-09-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"681c52b256f9","org_name":"Pilot Travel Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wyff4.com/news/atm-skimmer-found-in-the-upstate/41602198"}],"summary":"ATM Skimmer at gas station","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46ca6553fe15b64efcb923437979983dbc85eac6","impact_type":"unknown","incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"a414ae2e7f50","org_name":"Onverse","org_type":"unknown","ransomware":null,"records_affected":800157,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Onverse","type":"hibp","url":"https://haveibeenpwned.com/Breach/Onverse"}],"summary":"In January 2016, the online virtual world known as Onverse was hacked and 800k accounts were exposed. Along with email and IP addresses, the site also exposed salted MD5 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5318cb9f36b5400034a9031f4f95b34079e6e5b","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"58a3ca18c14d","org_name":"Flash Flash Revolution","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Flash Flash Revolution (2016 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/FlashFlashRevolution"}],"summary":"Flash Flash Revolution reported that its vBulletin forum was hacked in February 2016, exposing account information and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"147859f4bf45f18117d09fb2898459ac4f2ce25f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A788113-7828-49AB-9393-B947EFE0B98B"},"incident_date":"2016-09-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2680ea989fb4","org_name":"Bendigo Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theherald.com.au/story/4150618/mail-error-extends-wait-for-tumour-surgery/?cs=2452"}],"summary":"hospital results mailed to wrong address  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfd5262189b491817895549148cc47aa0b5c6dea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"045A7C93-09AA-488C-996C-9E7B12C2CEB9"},"incident_date":"2016-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"ecbee996fcc8","org_name":"Almelo municipaility","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dutchnews.nl/news/archives/2016/09/massive-data-breach-at-almelo-municipaility/"}],"summary":"hacked via partner website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5284def267297473d5d1649f2dc55d8258a1513","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c0255950-e3ad-11e7-8742-2bc46bd10713"},"incident_date":"2016-09-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"financial","ransomware":null,"records_affected":850,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mydaytondailynews.com/news/state--regional/aetna-social-security-numbers-other-data-lost-mail-for-850-ohioans/XoqSBoCK5K8IK9ExKg8qZN/"}],"summary":"Aetna warns that Social Security numbers and other personal data were potentially compromised for 850 Ohioans after a compact disc containing sensitive information got lost in the mail.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5437c47b6cb9ab0e7ca631dfc39ae14d220acf0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e1a8ae40-d3f4-11e9-ab55-b7fffb94511d"},"incident_date":"2016-09-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64297f85d8a3","org_name":"Noble House Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/noble-house-hotels-resorts-notifies-guests-of-payment-card-breaches-at-teton-mountain-lodge-spa-and-hotel-terra/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63728"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Noble%20House%20Hotels%20%26%20Resorts-2016-09-02"}],"summary":"Payment card system for Nobel House Hotels & Resorts had been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73089cf5c2880de77e180747907b8cf7c77238f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F37B91A4-4EBE-4827-92FC-385490A96260"},"incident_date":"2016-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9234ead73b40","org_name":"Brazzers","org_type":"technology_saas","ransomware":null,"records_affected":790724,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/insider/2016/09/05/hackers-ejaculate-800000-brazzers-accounts-onto-the-dark-web/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworm.net/2016/09/brazzers-goes-cleaners-hackers-leak-nearly-800000-porn-site-accounts.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://indianexpress.com/article/technology/social/porn-website-brazzers-hacked-over-800000-email-ids-and-passwords-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworm.net/2016/10/900000-hacked-brazzers-accounts-usernames-passwords-put-sale-600.html"},{"fetched_at":null,"title":"Have I Been Pwned: Brazzers","type":"hibp","url":"https://haveibeenpwned.com/Breach/Brazzers"}],"summary":"website's forum was hacked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"OurMine","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b6a7757459cd2ef9e3987e1820c1972d3aebfbf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B5F2840-5DEB-4E35-A6F8-5DABD9720D15"},"incident_date":"2016-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfd20737d22e","org_name":"Variety News","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/ourmine-hacker-group-briefly-takes-over-variety-website-spams-subscribers-dozens-emails-1579658#"}],"summary":"hackers gained access to subscriber list and sent them emails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"ourmine"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db02f2cbf85ba53bd5cc2d737437ee972608931d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03337515-E57E-4B55-B8A3-0479A6A9292E"},"incident_date":"2016-09-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"8dd6b2a29c25","org_name":"Queen Mary Hospital","org_type":"education","ransomware":null,"records_affected":3675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hk-computer-with-3600-patients-information-stolen/"}],"summary":"stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"aacbc422d8d1ae11c3e56b693a7f9704666668a3","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9643.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"659eda3a3db2","org_name":"Noble House Hotels","org_type":"unknown","ransomware":null,"records_affected":1463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9643.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"626e2f90b00b9a40d37d5ad2e59d9f93e3e29f48","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e5e24800-e1e2-11e7-8553-197c24c367d2"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8213deb21429","org_name":"Wood County Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/how-an-ohio-hospital-avoided-a-widespread-ransomware-attack"}],"summary":"Ohio-based Wood County Hospital averted a potentially widespread ransomware attack by detecting the issue with the help of its managed security services provider (MSSP) two weeks before it surfaced.  The ransomware incident took place in September 2016, which is when an employee ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30742ad09ea301eef8524774a91a3016d575dd82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ce142850-093e-11e8-bbae-ed39c73f1398"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"d756288dd820","org_name":"UniCredit SpA,","org_type":"financial","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unicredit-says-400000-accounts-were-hacked-exposing-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.massivealliance.com/2017/07/26/italys-biggest-bank-suffers-data-breach-affecting-hundreds-of-thousands-of-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2017-07-26/unicredit-says-400-000-clients-affected-by-security-breach"}],"summary":"UniCredit SpA, Italy’s No. 1 bank, said hackers took biographical and loan data from 400,000 client accounts in one of the biggest breaches of European banking security this year.  The attack occurred in September and October of 2016 and June and July of this year, according to a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f8dbb57c42536e7be23c23ee0faecf31bdd5003","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"300FB5BF-7298-4E3E-A880-39120AD4068E"},"incident_date":"2016-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a11f7a4183f0","org_name":"True Vacation Travel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krcrtv.com/news/local/shasta/redding-travel-agent-arrested-on-70-criminal-counts/70773503"}],"summary":"owner steal customers data for identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23d7e3d17f3e4b0f27af11056f62b0e9539a9021","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEA201BC-3976-46BB-B18C-1B9A444DA8E2"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"8c0840873257","org_name":"SuperCell","org_type":"technology_saas","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/clash-clans-hack-developer-supercell-admits-breach-that-hit-1-1-million-accounts-1601953"}],"summary":"Supercell, the developers of mobile game Clash of Clans, has confirmed the details of users on its official community forum that have been stolen by hackers. A breach notification website, LeakBase, claims that the leak involves roughly 1.1 million accounts.  The hacked informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77a5881f5d511d6d671f5c9471182ccf3cba05af","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03c2a6a0-c585-11e7-b1e8-038804741a6b"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9e1d63148b8c","org_name":"Sports Direct","org_type":"retail_ecommerce","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/ports-direct-data-breach-affecting-employees/"}],"summary":"Employee portal website compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80a3525e925dce75835fcf7f0774267124397c1d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"536f6730-e43c-11e7-8742-2bc46bd10713"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e8ed5365a91c","org_name":"Sequin Dermatology","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.information-management.com/news/security/dermatology-practice-struck-by-ransomware-attack-10030363-1.html"}],"summary":"Sequin Dermatology, a solo practice in Sequin, Texas, fell victim to a ransomware attack in mid-September after its server was encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d5f6aac744b1ea35cc4e95e13259453b953f8a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b02ada30-d957-11e7-a452-77d2890a67ae"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cadc672446c8","org_name":"Seguin Dermatology,","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-ransomware-attack-targets-seguin-dermatology/"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ff5f7f97049e8319eef0890248f6e405fb2689d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57cd5f30-899c-11e7-bf1d-81579668407a"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c505a4d863fc","org_name":"Oconee County","org_type":"government","ransomware":null,"records_affected":230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wspa.com/2016/09/16/some-employees-not-paid-after-data-breach-in-oconee-co/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sc-data-breach-in-oconee-co-causes-employee-pay-issues/"}],"summary":"230 Oconee County employees did not get money deposited into their bank accounts after a data breach involving the payroll service the county uses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"976dfddcc08d0bab9ffc6e803971d9640928cabb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15561EDD-EE92-4866-BDFC-6548969EC5BA"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd4bc8c00bb5","org_name":"North Dakota Department of Mineral Resources","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.inforum.com/news/4113494-nd-department-attacked-ransomware"}],"summary":"attacked by ransomware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e2291f9f51813fea170df45024975620a7faef0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2C2E56D-5D70-4CC4-9887-9B7E6BFECC4B"},"incident_date":"2016-09-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecf501e564df","org_name":"Mr. Chow","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/misfortune-cookie-mr-chow-restaurants-website-hacked-to-distribute-ransomware/article/519887/"}],"summary":"Mr. Chow restaurants has reportedly been compromised to deliver ransomware to visitors","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"725413704b213c3309d0c9c350ebf8bb5e5f8a92","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB09D174-3006-42D9-AE5D-187B797C73A2"},"incident_date":"2016-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5f5cab48552","org_name":"M. Holdings Securities","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/m-holdings-security-issues-warning-on-possible-data-breach/article/520384/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Notice_8.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63675"}],"summary":"company computer had been stolen from his parked car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"065f8f2d3ecd41cd162da32424739f818ea24e12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"189DEBB6-5086-4ED1-A59F-974BE0D4B83C"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d0a57928977f","org_name":"Lightspeed","org_type":"technology_saas","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/09/02/lightspeed_pos_vendor_breached_sensitive_database_tapped/"}],"summary":"Point of sales vendor Lightspeed has been breached with password, customer data, and API keys possibly exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34d0a09e92c4d4557ee03182eec4a9b700aba5b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2aa935c0-a390-11e7-a67b-81fbdaca3f85"},"incident_date":"2016-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b08b3b93fab1","org_name":"Kineto Rehab PHysical Therapy, PLLC","org_type":"healthcare","ransomware":null,"records_affected":665,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/physical-therapy-facility-reports-data-security-incident"}],"summary":"Stolen laptop leads to potential data security breach in NY","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"59fda50f1027d863c7a4bd724e432c7ff6df46d0","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/KimptonHotels.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"270667eb302d","org_name":"Kimpton Hotels and Restaurants","org_type":"unknown","ransomware":null,"records_affected":833,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/KimptonHotels.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed478a1aa2fd196fed8f72dd147a95280c50d706","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"543a9d30-94ad-11e7-9340-f70be1ebf87c"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf49c286d581","org_name":"Henry County Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox17.com/news/local/fox-17-investigates-cyber-attacks-block-911-calls-in-tennessee-around-the-us"}],"summary":"911 director Archer confirms ransomware hack from last year - Henry County’s Enhanced 911","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4548c17fb33db67c610b3a33058a495dcce6246","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"191f3320-75f2-11e7-9d88-ab89f89c69db"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"454e2d9853a8","org_name":"Gamestop.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/3188558/security/lengthy-gamestop-hack-may-have-compromised-customer-credit-cards-personal-info.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/04/gamestop-com-investigating-possible-breach/"}],"summary":"Lengthy GameStop hack may have compromised customer credit cards, personal info Customer credit card data may have been pilfered from GameStop.com between mid-September and early February.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":"Return","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e06144cb27ec5d14936aec7289a086817490eb5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"413692DC-F809-45AE-A421-CE286444A43F"},"incident_date":"2016-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aa2ea6f3fce0","org_name":"FraserCPA","org_type":"professional_services","ransomware":true,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nj-maplewood-tax-firm-hacked-data-held-for-ransom/"}],"summary":"hacked by a Russian hacker known as \"Return\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"return"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e037ce1a38d93724d307087ef97d89b05d172ca","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c9cdd720-eab5-11e7-92b6-dfe49f9d7042"},"incident_date":"2016-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b52dd525f57","org_name":"EMR4all, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/dozens-of-clinics-thousands-of-patients-impacted-by-third-party-data-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/more-rehab-billing-solutions-clients-notify-their-patients-of-exposed-phi/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/275-30-breaches-in-one"}],"summary":"Misconfigured AWS bucket exposes data on patients. This is a partner breach modeled from the perspective of the partner.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e64eabfb1504ef22817fae464c0a5d68118e4f5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4A0D040-00E5-4FF4-B4AA-B785BA91AF71"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3daf01f2fd33","org_name":"Department of National Defence","org_type":"government","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/privacy-breach-military-dnd-national-defence-1.3770187;"},{"fetched_at":null,"title":null,"type":"press","url":"http://technologyble.com/family-information-of-military-personnel-exposed-in-privacy-breach/"}],"summary":"service members data disclosed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"@NewWorldHackers","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b3045a4eec925d46c5ce6262f93686f06f0b1ba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f17d2ad0-c55a-11e7-8460-859aaa890f03"},"incident_date":"2016-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68248c877b43","org_name":"City of Charlotte","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/local/9-investigates-cyber-attacks-on-charlottes-city-website-during-protests/493803347"}],"summary":"DoS attack on government website ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"newworldhackers"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38ab43400fda0ddaa6beb82937e63b6de308a5d1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fc9ace90-055e-11ea-889a-bd9e961d3ab1"},"incident_date":"2016-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e81fb4b39103","org_name":"British Petroleum","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.richmondregister.com/news/credit-card-skimmer-found-at-richmond-gas-station/article_8f4ff4fc-7f77-11e6-b07b-93feae6655a3.html"}],"summary":"credit card skimmer on gas pump","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88971944fb92ebfeb8de96b95ce3ce79c5a8d115","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"136179b0-e43e-11e7-8742-2bc46bd10713"},"incident_date":"2016-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f32d3ce24123","org_name":"Alberta Supports","org_type":"government","ransomware":null,"records_affected":86,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/3076293/minister-deeply-concerned-by-possible-privacy-breach-at-alberta-supports/"}],"summary":"A USB stick with Alberta Supports client information went missing for a 24-hour period in Sept. 2016.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6b379964b022b798c4f73a2a5a4826a67b07ccb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f6f9ecc0-949d-11e7-9340-f70be1ebf87c"},"incident_date":"2016-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"26e8d429a8f5","org_name":"Advanced Info Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/th-nbtc-to-probe-alleged-privacy-breach-by-ais-employee/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationmultimedia.com/breakingnews/NBTC-to-probe-alleged-privacy-breach-by-AIS-employ-30295281.html"}],"summary":"NBTC to probe alleged privacy breach by AIS employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2aa77ca00539d5edc6919fee7561f8719d1ea5b2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/NourseFarms.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"46d8f043bae5","org_name":"Nourse Farms, Inc.","org_type":"unknown","ransomware":null,"records_affected":36,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/NourseFarms.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-31","discovered_date":"2016-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89e83f0703f52f43dea5ecb44650f50b009cac8e","impact_type":"data_theft","incident_date":"2016-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Kimpton%20resubmit%209_26_16_0.pdf"},"notes":null,"org_country":"US","org_id":"83b944ecd361","org_name":"Kimpton Hotels & Restaurants Group, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63669"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Kimpton%20resubmit%209_26_16_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9641.pdf"}],"summary":"Malware on payment card processing servers at some Kimpton hotel restaurants and front desks searched for payment card track data.","supporting_quote":null,"technology_involved":["payment card processing system","servers processing payment cards"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-31","discovered_date":"2016-07-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2634ea580059d4d46d75f5ec810ed81af2fbcab6","impact_type":"unknown","incident_date":"2016-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c42117610faa","org_name":"Kimpton Hotels & Restaurant Group, LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Kimpton%20Hotels%20%26%20Restaurant%20Group%2C%20LLC-2016-08-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-31","discovered_date":"2016-07-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b855029ed8b4f96aabc60a723ad7bab91be1b18b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9642.pdf"},"notes":null,"org_country":"US","org_id":"6fed3e987636","org_name":"Highline Medical Center","org_type":"healthcare","ransomware":null,"records_affected":12724,"reviewed":false,"root_cause":"R-C Healthcare Management left files containing patient information accessible via the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9642.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9642.pdf"}],"summary":"Highline Medical Center reported that a vendor left files containing patient information accessible via the internet.","supporting_quote":"files containing patient information had inadvertently been left accessible via the internet by RCHM from April 21, 2016 to June 13, 2016.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"R-C Healthcare Management"},"updated_at":"2026-10-12","veris_action":"error","derived":{"vendors":[{"id":"5262854c3e04","name":"R-C Healthcare Management"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a6671d48b50090b1de093e9e9dabda9e3a13b73","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A08C1229-6143-454C-8E3E-E279A31165BF"},"incident_date":"2016-08-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6af4e41f50f0","org_name":"exxon Gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/virginia/annandale/gas-pump-skimming-device-found-annandale-station-police"}],"summary":"ATM Skimmer device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"742e18d9ef4d5aa4deb9f6e8525977cbeb2eba2e","impact_type":"data_theft","imported_from":null,"incident_date":"2012-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fb5c7930c1ff","org_name":"Dropbox","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dropbox","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dropbox"}],"summary":"A 2012 breach exposed Dropbox customers’ email addresses and salted password hashes, and more than 68 million records were later traded online.","supporting_quote":null,"technology_involved":["Dropbox"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Websites-hunter","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-08-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5eca514c2c90d8e9a8d6632e8534d10214759993","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B533254C-4713-4FE7-A9F8-412ABB4EC664"},"incident_date":"2016-08-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"a9d232876173","org_name":"Al Zahra Private Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":5044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uae-al-zahra-private-medical-centre-hacked/"}],"summary":"hacked last month by the individual calling himself \"websites-hunter\" ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"websiteshunter"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-30","discovered_date":"2016-08-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"17487e5b6a78fc32cc78755b2f0004af8de55360","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-07-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9640.pdf"},"notes":null,"org_country":"US","org_id":"b990fa69fc8b","org_name":"Presnell Gage, PLLC","org_type":"professional_services","ransomware":null,"records_affected":2613,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9640.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9640.pdf"}],"summary":"Presnell Gage, PLLC determined that client tax-return files may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b531a7339a342e0c9d4643e8a73149dac12915e7","impact_type":"data_theft","imported_from":null,"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8c72af6413c6","org_name":"Nihonomaru","org_type":"other","ransomware":null,"records_affected":1697282,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nihonomaru","type":"hibp","url":"https://haveibeenpwned.com/Breach/Nihonomaru"}],"summary":"Nihonomaru’s vBulletin forum was hacked in late 2015, exposing account data.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-30","discovered_date":"2016-07-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cab16c69dc490aae29a66698b8c346bf5227bb61","impact_type":"data_theft","incident_date":"2016-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Form%20of%20Customer%20Notice%20Letter%20re%20Breach%20-%20Jerrys%20Artarama_0.pdf"},"notes":null,"org_country":"US","org_id":"cd999aafd1fe","org_name":"Jerry's Artarama N.C. Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63613"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20of%20Customer%20Notice%20Letter%20re%20Breach%20-%20Jerrys%20Artarama_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/Jerry'sArtarama.pdf"}],"summary":"Jerry's Artarama reported that malicious code may have intercepted customer information transmitted through its online sales platform between May 3 and July 10, 2016.","supporting_quote":null,"technology_involved":["online sales platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5a08b8744c3cbbe075be8ff2138f855f6f9d2ed","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"1d0c5b31195a","org_name":"InterPals","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: InterPals","type":"hibp","url":"https://haveibeenpwned.com/Breach/Interpals"}],"summary":"InterPals’ website was hacked in late 2015, exposing account data including email addresses, locations, birthdates, and salted password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-30","discovered_date":"2016-01-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"610c8d18d92409a1539a71bf0efa0dbb8c7ec67f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"526a732f7a3d","org_name":"Howard R. Jarvis, D.M.D., L.L.C.","org_type":"unknown","ransomware":null,"records_affected":1980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Howard%20R.%20Jarvis%2C%20D.M.D.%2C%20L.L.C.%20dba%20Southwest%20Portland%20Dental-2016-08-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b157540557c269a47952410a3a02a3a5b8098ec9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-01-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d6b2d738c8a9","org_name":"Minecraft World Map","org_type":"technology_saas","ransomware":null,"records_affected":71081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Minecraft World Map","type":"hibp","url":"https://haveibeenpwned.com/Breach/MinecraftWorldMap"}],"summary":"Minecraft World Map was hacked and exposed user accounts containing usernames, email and IP addresses, and salted and hashed passwords.","supporting_quote":null,"technology_involved":["Minecraft World Map website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11d385c2c407c6ef2f604aa68f2d305290b28b4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bcbfc780-dec8-11e7-aa62-a96e008cbc03"},"incident_date":"2016-08-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"407de9a60529","org_name":"Christian Louboutin","org_type":"retail_ecommerce","ransomware":null,"records_affected":666,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Louboutin%20CA%20first%20Data%20Breach%20Customer%20Notification-c_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64479"}],"summary":"On August 28, 2016, unknown individuals gained access to our U.S. online boutique, through unauthorized use of an administrative password from a third party website manager.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14db00873a9da6523e1804bcd18478aa23a74ba4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A518FC3-9FA0-4159-9FE4-32F2C1F0CD93"},"incident_date":"2016-08-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef2977124440","org_name":"National Security Agency","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2016/10/06/us/nsa-leak-booz-allen-hamilton.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/fbi-nsa-leaker-2016-10"}],"summary":"insider stole secret / TS documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-26","discovered_date":"2016-06-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"067bc49ec53924747005f792d868a19a2abc9c5e","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2008%20--%20CUSTOMER%20Letter%20for%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"c74cca973504","org_name":"Toyota Motor Credit Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63586"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2008%20--%20CUSTOMER%20Letter%20for%20AG_0.pdf"}],"summary":"A TFS associate mistakenly emailed a spreadsheet containing customer information to her personal email account.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-26","discovered_date":"2016-08-01","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfe70cbaf2a968d9d4a5618481551ee42b0e2c2b","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Updated%20Sac%20Co%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"931d07133d3e","org_name":"County of Sacramento","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An error in an online report made personal data available to Emergency Medical Service license applicants with accounts on the system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63584"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Updated%20Sac%20Co%20Notice_0.pdf"}],"summary":"An error in Sacramento County’s Accela application system may have exposed personal information through a report accessible to Emergency Medical Service license applicants with accounts.","supporting_quote":"An error was discovered in the online automated application system within the Accela software that may have made your personal data available to Emergency Medical Service license applicants that had an account on the system.","technology_involved":["Accela","online automated application system"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Accela"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"9005f7cd626a","name":"Accela"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-25","discovered_date":"2016-08-02","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"05a25a093ff1f94bc017135a451ebc3a56f676b1","impact_type":"unknown","incident_date":"2016-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8975ac2a4193","org_name":"Michelle A. Pecora CPA P.C.","org_type":"unknown","ransomware":null,"records_affected":450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Michelle%20A.%20Pecora%20CPA%20P.C.-2016-08-25"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de05dddf5e1e9849610f1a5afd47fa8524ca91e1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"397A7369-4718-4E7B-866D-30455B135D71"},"incident_date":"2016-08-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e5614e3c34e","org_name":"Dino Stop","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wiscnews.com/wisconsindellsevents/news/local/article_50be6a0f-eef1-52bb-85b8-9bdcc2e468d2.html"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-24","discovered_date":"2016-06-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a3234ad9605b69c06b35eb4df8fc241a4a73cee","impact_type":"unknown","incident_date":"2016-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"caa72d096d18","org_name":"MedAltus, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#MedAltus%2C%20LLC-2016-08-24"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84a3b4c06d0a065c5ef61b8a6d04d3bd90c4a365","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC8C0352-919F-411D-A66A-C8377142AC14"},"incident_date":"2016-08-24","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"828c83399e6d","org_name":"Man Alive Lane Treatment Center","org_type":"healthcare","ransomware":null,"records_affected":860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/baltimore-addiction-treatment-clinic-hacked-patients-info-up-for-sale-on-dark-web/"}],"summary":"website hacked and information sold on dark web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d23215fc1d9ca583ea2ac477ddc3b4857f6a10c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A34CDAD-BB6B-400D-84A4-23EFEDEF9038"},"incident_date":"2016-08-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7552173fa356","org_name":"Langston Hughes Young Explorers Academy","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nypost.com/2016/08/26/students-personal-info-left-on-street-in-careless-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc7ny.com/education/exclusive-student-records-found-discarded-in-front-of-bronx-school/1485390/"}],"summary":"student and parents documents with PII were left on the street","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8437bfe575a6a0be69698abefec9ef095e5ac2c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A395F9A-243B-424A-9A64-69FF26D22427"},"incident_date":"2016-08-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62a8b3157d55","org_name":"Hospital Auxilio Mutuo","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.qchron.com/editions/queenswide/wanted-for-hospital-atm-skimming-scam/article_6415e93f-dd20-5e6a-a7e5-2a3cedd4eb75.html"}],"summary":"ATM Skimmer on 4 New York Hospitals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75e4e0c4b5a94a491d038449f0a3a8a21ce17a2e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C1E6C8D-40FF-4E0C-8883-1CFFF38B7B2F"},"incident_date":"2016-08-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"35c293b73306","org_name":"Opera Software ASA","org_type":"technology_saas","ransomware":null,"records_affected":1700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3113040/security/opera-warns-sync-users-of-possible-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techtimes.com/articles/175356/20160829/opera-web-sync-service-breached-by-hackers-account-information-passwords-compromised.htm"}],"summary":"Opera warns Sync users of possible data breach - detected a possible security breach on the server of its cloud sync service, forcing a password reset for the 1.7 million users possibly affected by the hack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other","personal"],"disclosed_date":"2016-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"487c0611c405dacec93a87c32617d73b7e9df526","impact_type":"unknown","incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"77551bab4d58","org_name":"GTAGaming","org_type":"unknown","ransomware":null,"records_affected":197184,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: GTAGaming","type":"hibp","url":"https://haveibeenpwned.com/Breach/GTAGaming"}],"summary":"In August 2016, the Grand Theft Auto forum GTAGaming was hacked and nearly 200k user accounts were leaked . The vBulletin based forum included usernames, email addresses and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2016-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1ef6cbab2112a734560cb7dbc5b2cf2557f1b06","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"HU","org_id":"b8efbd1d9e30","org_name":"Teracod","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Teracod","type":"hibp","url":"https://haveibeenpwned.com/Breach/Teracod"}],"summary":"User records extracted from Teracod included email addresses, passwords, private messages, payment histories, and IP address peering history.","supporting_quote":null,"technology_involved":["Teracod website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8471bc35b349a823c258c42174dcaff1c4fc6f9b","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Letter%20DB%20Templ%20Fin_0.pdf"},"notes":null,"org_country":"US","org_id":"8be98d23069f","org_name":"Schwan's Home Service, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63471"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Letter%20DB%20Templ%20Fin_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Schwan%27s%20Home%20Service%2C%20Inc-2016-08-31"}],"summary":"Schwan’s reported a possible compromise of customer card data held by CARDSource, with no evidence of misuse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CARDSource"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"0b6645783bc2","name":"CARDSource"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-22","discovered_date":"2016-06-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aea5d4ae626887940dbfe94f3029bf18f6d71ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SCAN%20Exhibit%20A.CA%20Regulator%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"5ffe19fae2d8","org_name":"SCAN Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63472"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SCAN%20Exhibit%20A.CA%20Regulator%20Notice_0.pdf"}],"summary":"SCAN Health Plan reported that an unauthorized person accessed and possibly viewed a sales system contact sheet containing personal information and possibly limited health information.","supporting_quote":null,"technology_involved":["sales system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5c45de64e3917f550fb2de72ef987d444113be8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0a60720-a953-11e7-bb38-a97a354bfe15"},"incident_date":"2016-08-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70411f1fdcb8","org_name":"Baystate Health","org_type":"healthcare","ransomware":null,"records_affected":13112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/phishing-scam-creates-potential-patient-data-exposure-in-ma;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.baystatehealth.org/news/2016/10/privacy-incident"}],"summary":"Massachusetts-based Baystate Health recently announced that several of its employees had fallen victim to a phishing scam, which potentially exposed the information of approximately 13,000 patients.  Potential health data breach caused by phishing scam in Massachusetts Baystate l","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e68f439e7d64891dae2da8cb63927c3436a26a8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"512dda70-d57c-11e7-af4f-6b5d4514198e"},"incident_date":"2016-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1894c760e602","org_name":"Fred's Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fredsinc.com/wp-content/uploads/2016/10/FAQ.pdf"}],"summary":"parked at home in what normally is considered a safe, residential neighborhood. After extensive investigation, Fred's Pharmacy determined that some customers' full names and telephone numbers were stored on the laptop for administrative, work-related purposes. Some of these custo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-19","discovered_date":"2016-08-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"501a9ecd1a5929d11d0dc21c599ecf90b5a6ba72","impact_type":"unknown","incident_date":"2016-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"32d105318eb5","org_name":"Symphonix Life & Disability","org_type":"unknown","ransomware":null,"records_affected":538036,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Symphonix%20Life%20%26%20Disability-2016-08-19"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-19","discovered_date":"2016-07-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"163105d434d9d1bb531530489024247a708e07d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Newkirk_member%20notification%20template_0.pdf"},"notes":null,"org_country":"US","org_id":"cd9886bfc5e7","org_name":"Symphonix Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63451"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Newkirk_member%20notification%20template_0.pdf"}],"summary":"Member information for Symphonix Health was potentially accessed on a Newkirk server, with no evidence of misuse reported.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Newkirk"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"bf941088fd99","name":"Newkirk"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"855ac885e3bbc51968a7914b5d50361b781191e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eddie%20Bauer%20non-Massachusetts%20consumer%20notification%20final_1.PDF"},"notes":null,"org_country":"US","org_id":"2edaf56f4c16","org_name":"Eddie Bauer, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eddie%20Bauer%20non-Massachusetts%20consumer%20notification%20final_1.PDF"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Eddie%20Bauer%20LLC-2016-08-18"}],"summary":"Eddie Bauer reported that point of sale systems at its retail stores may have been accessed without authorization, potentially exposing payment card information.","supporting_quote":null,"technology_involved":["point of sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1d36a7c5fa7de48ac69bc2fe2f20775aade696","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D53A71CB-335C-4AC2-99B8-BC7A19140314"},"incident_date":"2016-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"26823f57c3dd","org_name":"Virgin Mobile","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnet.com/au/news/virgin-mobile-australia-voicemail-error-privacy/"}],"summary":"voice mail access altered","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8499bed0c2bd586fa7ffad56f1f491e795a9b4b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9AB10E3-EDFB-440F-B19B-68AB065D393E"},"incident_date":"2016-08-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news10.com/2016/10/06/police-pharmacist-accused-of-taking-drugs-for-herself-charged-with-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesunion.com/local/article/Deputies-Corinth-pharmacist-used-customer-ID-to-9884293.php"}],"summary":"Worked at a spa and stole an identity to be used at a pharmacy that we worked at to forge a prescription","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":"llJACKSPARROWll, Jack Sparrow","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3965b6d0cd2157a2cd41201b2dafc02fd83849c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9451BB9A-8350-4EE2-AD65-76984AB1F1C3"},"incident_date":"2016-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a86b6cfb019","org_name":"City of Killeen","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/turkish-hackers-launch-second-cyber-attack-on-killeens-website/"}],"summary":"City of Killeen (Texas) website was hacked for the second time in roughly three months","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"lljacksparrowlljacksparrow"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3479d2e67ce5aa886f9e2531bcc919c3caa1a71","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77A42C90-B550-4B15-BA99-D0E6BCDA3DC2"},"incident_date":"2016-08-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b8aef4872eb","org_name":"Texas Toros","org_type":"other","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news4sanantonio.com/news/local/birth-certificates-ids-stolen-from-30-seven-and-eight-year-old-kids;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-thief-steals-personal-information-belonging-to-dozens-of-children/"}],"summary":"football team players was stolen in a smash and grab of the coach's truck in a parking lot","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-08-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6e89068452117f42c3d27e78be730c962cd6b38","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F878890E-1CBD-4C09-9437-8BAE96821BB5"},"incident_date":"2016-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10d45e0916b1","org_name":"Social Blade","org_type":"professional_services","ransomware":null,"records_affected":287000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/social-media-statistics-service-social-blade-suffers-data-breach-507375.shtml"}],"summary":"Social Blade, an online service providing social media statistics and analytics, has been hacked. The data LeakedSource received contained files from Social Blade's main service and its forum.  The main website dump contains 273,086 user records while the forum dump only 13,009 u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-14","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b04479510ad939ab27e1e5ba6a9a5ed959c96ff","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GONZALEZ%20breach%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f91060e5c62e","org_name":"John E. Gonzalez DDS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63351"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GONZALEZ%20breach%20letter_0.pdf"}],"summary":"A briefcase containing an external hard drive with patient records and images was stolen from a car.","supporting_quote":"On the late afternoon of Monday July 25, 2016, my car window was broken out and my briefcase was stolen.","technology_involved":["external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f814c8b82341604a1738990a1c507ec8d533ad6b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CDF65B7-940D-4731-8A6F-9F1CDC9FE278"},"incident_date":"2016-08-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"financial","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailybreeze.com/general-news/20160926/federal-charges-await-pair-suspected-in-torrance-burbank-atm-skimming-case"}],"summary":"Felony charges against two men suspected of placing skimming devices at ATMs in Burbank and Torrance were dismissed Monday in favor of a federal case against the pair.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b074cc49c5625992c22f5a29eeb636d8f474885","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94227D7B-2051-41E5-9ADA-E9E4EA0A38A2"},"incident_date":"2016-08-13","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"a9769c1346a3","org_name":"Leoni AG","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.leoni.com/en/press/releases/details/leoni-targeted-by-criminals/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itgovernance.eu/blog/leoni-ag-victim-of-business-email-compromise-40-million-lost/"}],"summary":"spoofed email causes transfer of 40 million Euros","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d12f6471404d537330a846e5b46dd894a3e239d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB84E6C2-3FEC-4640-A274-BAB65C37AB49"},"incident_date":"2016-08-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d55671c0378","org_name":"Webster Five Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boston.cbslocal.com/2016/08/16/webster-five-bank-dudley-card-skimming-device-fraud/"}],"summary":"ATM Skimmer at bank ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-12","discovered_date":"2016-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"720f33eaddccddf3f29f826d854ea444b11cccba","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9637.pdf"},"notes":null,"org_country":"US","org_id":"bcb222dd92b1","org_name":"Valley Anesthesiology Consultants, Inc.","org_type":"healthcare","ransomware":null,"records_affected":611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Valley%20Anesthesiology%20Consultants%2C%20Inc.%2C%20d/b/a%20Valley%20Anesthesiology%20and%20Pain%20Consultants-2016-08-12"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9637.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63349"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combined_General_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9637.pdf"}],"summary":"Valley Anesthesiology Consultants reported that a third party may have gained unauthorized access to its computer systems, but investigators found no evidence that information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-12","discovered_date":"2016-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cd899b4428ea5280dc943e83b9a389e398350ec","impact_type":"data_theft","incident_date":"2016-06-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PAX%20-%20Consumer%20Data%20Breach%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"ef0042cc0e3d","org_name":"PAX Labs, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63327"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PAX%20-%20Consumer%20Data%20Breach%20Notice_1.pdf"}],"summary":"An unauthorized party accessed payment card information on a PAX cloud-based website server.","supporting_quote":null,"technology_involved":["cloud-based website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14dc5d41517764a78c1e977317cf36d363e712a2","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_7.pdf"},"notes":null,"org_country":"US","org_id":"0035d0c8b8e9","org_name":"HEI Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63346"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_7.pdf"}],"summary":"HEI Hotels & Resorts reported that malicious software was installed on payment processing systems at certain properties and could have affected customers’ payment card data.","supporting_quote":null,"technology_involved":["payment processing systems","point-of-sale terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"095ad7e26523bc74006950c16ddf11f05bd25697","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE30CCFE-1EBE-4C02-B84E-72762D126C08"},"incident_date":"2016-08-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"017068cdb9b1","org_name":"Harbin Clinic","org_type":"healthcare","ransomware":null,"records_affected":498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/harbin-clinic-notifies-patients-that-records-stored-at-iron-mountain-are-lost-missing-or-destroyed/"}],"summary":"documents lost by third party storage facility","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-12","discovered_date":"2016-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"513e613dddbb3d3377a480f659901cfe42d987ef","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Combined%20General_0.pdf"},"notes":null,"org_country":"US","org_id":"d1c7b560bb4e","org_name":"Bon Secours Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vendor inadvertently made files containing patient information accessible via the internet while adjusting computer network settings.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63348"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Combined%20General_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/BonSecoursHealthSystem%2CInc.pdf"}],"summary":"Bon Secours Health System reported that a vendor inadvertently made files containing patient information accessible via the internet.","supporting_quote":"While attempting to adjust their computer network settings from April 18, 2016 to April 21, 2016, R-C Healthcare Management inadvertently made files located within their computer network accessible via the internet.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"R-C Healthcare Management"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"5262854c3e04","name":"R-C Healthcare Management"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"726039f591b960113c0201b156759d04ae324642","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"275AE6F1-7CAD-42D4-9C24-72D6F33F9989"},"incident_date":"2016-08-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84915b31e9b3","org_name":"Napa Valley Dentistry","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/napa-valley-dentistry-notifies-patients-after-theft-of-server-from-storage-facility/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64007"}],"summary":"Server stole for storage facility ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-08-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a00a2e40eaec5e0ceaae78debabcd1645318f7c0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-08-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"US","org_id":"bae40fc23b47","org_name":"Epic Games","org_type":"technology_saas","ransomware":null,"records_affected":251661,"reviewed":false,"root_cause":"The forum breach was allegedly due to a SQL injection vulnerability in vBulletin.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Epic Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/EpicGames"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/epic-games-unreal-engine-forums-hacked-in-latest-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/epic-games-forums-hacked-again?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/epics-forums-hacked-again-with-thousands-of-logins-stolen/;"}],"summary":"The Epic Games forum exposed usernames, email addresses, and salted MD5 password hashes in a breach allegedly caused by a SQL injection vulnerability in vBulletin.","supporting_quote":"In August 2016, the Epic Games forum suffered a data breach , allegedly due to a SQL injection vulnerability in vBulletin.","technology_involved":["vBulletin","web application"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"vBulletin"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"46fb5ad409d8","name":"vBulletin"}]}},{"actor":{"category":"external","country":"NG","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-10","discovered_date":"2016-08-10","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"2a5e373dc69c7c59c8b6316cb49e15d33265bf92","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9699.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"b3e43303772f","org_name":"Seattle Indian Health Board","org_type":"healthcare","ransomware":null,"records_affected":4579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9699.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/seattle-indian-health-board-notified-almost-800-patients-after-email-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sihb.org/current/?id=135"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9699.pdf"}],"summary":"A hacker accessed an employee’s email account, sent spam messages that were blocked, and may have accessed information in the account.","supporting_quote":null,"technology_involved":["Zimbra email system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-10","discovered_date":"2016-08-10","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5042b9f69ddea22769aef19614d6ffcea7c9f1b9","impact_type":"unknown","incident_date":"2016-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pages%20from%20REV3_EXPERIAN_C2679_NOTICE_LETTER_TO_CONSUMERS_%28GENERAL%29%5B3%5D.DOCX_LIVEAUDIT_0.pdf"},"notes":null,"org_country":"US","org_id":"b46018bc7dac","org_name":"Rebecca Minkoff","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pages%20from%20REV3_EXPERIAN_C2679_NOTICE_LETTER_TO_CONSUMERS_%28GENERAL%29%5B3%5D.DOCX_LIVEAUDIT_0.pdf"}],"summary":"Rebecca Minkoff learned of possible unauthorized access to its website and investigated whether personal information was accessed.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16ad38c390b24de9520eb4c29a84f6150860147c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"801F8A1E-CD79-4408-AE0F-563FF451C3C9"},"incident_date":"2016-08-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0e9182f4b1d","org_name":"QuickChek","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/hudson/index.ssf/2016/08/skimming_device_found_in_atm_at_nj_quickchek.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theobserver.com/2016/08/kpd-atm-skimmer-at-quickchek/"}],"summary":"ATM Skimmer was placed on convenient store ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d85af9910242853646dcbdc2b7f50140f5c8b7a","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"813115e86419","org_name":"NLU Products, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63305"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20California_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9632.pdf"}],"summary":"NLU Products, LLC reported that a data security incident beginning in April 2015 may have exposed customer personal and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5f7610856a436dfcfef99e6dc35790469309998","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/breach%20%20letter%20pdf_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"b3a38aa1301b","org_name":"Brian Goldman, MD A Medical Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63286"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/breach%20%20letter%20pdf_0.pdf"}],"summary":"Two laptops containing names, birthdates, and patient chart notes were stolen from a vehicle; it is unknown whether the information was accessed.","supporting_quote":"On July 19, 2016 two laptop computers belonging to the medical offices of Dr. Brian Halevie-Goldman were stolen.","technology_involved":["laptop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db52866390518b74cd537a758e80ba0c65137ebb","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20notice%20-%20SAMPLE_0.pdf"},"notes":null,"org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":7820,"reviewed":false,"root_cause":"During the update process, records for employees of other franchisees were made available to certain franchisees.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20notice%20-%20SAMPLE_0.pdf"}],"summary":"An update process made some franchisee employees’ records potentially accessible to other franchisees.","supporting_quote":"7-Eleven discovered in June 2016 that as part of the update process, in addition to the normal set of employee records sent for ea ch Employing Franchisee, some additional records from the franchisee employee database were available to certain 7-Eleven franchisees.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"444ab3d9cbc4f0ef1110ca223cfd9a130e5a4731","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F3B2CD1-604B-4B03-AA8F-795047065B96"},"incident_date":"2016-08-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0e8c261fe89","org_name":"Nassau Educators Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc7ny.com/news/exclusive-bank-information-compromised-for-nearly-100-people-on-li/1461747/"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bec96dd061c0194912e458c0e97608b092ee553","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33E88026-F097-4FE7-949E-6E2E8C04CA2D"},"incident_date":"2016-08-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d9416fb472f5","org_name":"British Columbia Ministry of Finance","org_type":"government","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newstalk770.com/syn/112/215081/revenue-services-sends-nearly-two-dozen-msp-invoices-to-the-wrong-people"}],"summary":"nearly two dozen people had their personal information compromised after Revenue Services sent personal MSP invoices to the wrong people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"982171e3882752df176ff76eb3ab22d0a91c8da1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C989D817-D852-437D-B30B-B9ED2A05DE09"},"incident_date":"2016-08-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a17c6b7a1ec","org_name":"Bringham Young University","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldextra.com/news/local/central/orem/custodian-at-lds-missionary-training-center-arrested-for-suspected-id/article_e495f71a-0783-5c5f-ae1a-d191b9820043.html"}],"summary":" custodian at the LDS Missionary Training Center on Saturday for reportedly taking financial information from a missionary there.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bc82ed9625f33a4b89ee223405c628035fcedb5","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7abafa692ab2","org_name":"xat","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: xat","type":"hibp","url":"https://haveibeenpwned.com/Breach/xat"}],"summary":"The xat online chatroom was hacked in November 2015, exposing user account data including usernames, email and IP addresses, hashed passwords, and website activity.","supporting_quote":null,"technology_involved":["online chatroom"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-08-05","discovered_date":"2016-06-13","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"641127bc519df132b19cb586c936b24dd0c80e99","impact_type":"data_theft","incident_date":"2016-06-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9636.pdf"},"notes":null,"org_country":"US","org_id":"ca96eaad7085","org_name":"The Caroline Kline Galland Home","org_type":"healthcare","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9636.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9636.pdf"}],"summary":"Paper protected health information affecting 12 individuals was stolen from an employee’s home.","supporting_quote":"concerning the breach of protected health information in paper record form, concerning 12 individuals, occurring by theft from an employee’s home on 6/13/2016.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-08-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"156e493090a5cd847d36ba1748777cf8de277af1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B66BD651-8828-43CF-A856-F22CBB0ABB75"},"incident_date":"2016-08-05","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"eb691522a5c0","org_name":"Mail.ru Group Ltd","org_type":"technology_saas","ransomware":null,"records_affected":25000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/over-25-million-accounts-stolen-after-mail-ru-forums-raided-by-hackers/"}],"summary":"Over 25 million accounts stolen after 3 Mail.ru forums hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bee3d600c80d27404b4db73003dc4d543ffb3ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4EE8CD1D-D370-4482-9907-CCCF5B522C91"},"incident_date":"2016-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5c64aca8d63","org_name":"Khronos Group","org_type":"professional_services","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/apple-intel-google-employee-accounts-exposed-in-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/google-apple-samsung-employee-accounts-exposed-developer-forum-data-breach-1574617"}],"summary":"forum hacked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13b85aba650af69e7fd3ee6405c66b128fd50d0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E9073A7-926D-4F0D-B6D5-CA14AD8962E0"},"incident_date":"2016-08-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"83df75136b89","org_name":"Miner Norton Gold Fields","org_type":"other","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2016-08-19/significant-data-leak-at-norton-gold-fields-kalgoorlie/7766888"}],"summary":"Email misdelivery ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3059fe592a2092f4fef1bef0262e614ed992b0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16B674BB-85A2-48A5-9CA6-2BEA6D902DDA"},"incident_date":"2016-08-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16fca9b7a163","org_name":"ExxonMobile Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dfw.cbslocal.com/2016/08/04/crooks-using-bluetooth-to-steal-at-gas-pumps/"}],"summary":"4 gas station using blue tooth skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"341611cacc083cb2572c0956cca3a90b85509fc3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"035AF392-126D-405C-86D0-E0B4416FA4F3"},"incident_date":"2016-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d031bf4b031","org_name":"Children's Mercy Hospital","org_type":"healthcare","ransomware":null,"records_affected":238,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox4kc.com/2016/08/31/case-containing-information-on-more-than-200-childrens-mercy-hospital-patients-stolen-from-employees-vehicle/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mo-medical-records-for-238-childrens-mercy-hospital-patients-stolen/"}],"summary":"Medical Records stolen from an employee's locked vehicle ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9cbc2555c14b7c56be7f461275df48bafaf5ca6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"109AE399-9876-496F-A7CE-C972BF894144"},"incident_date":"2016-08-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a00ee3a54b77","org_name":"Tipperary Corporations","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-thousands-of-papers-containing-personal-information-tossed-in-city-recycling-bin/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wlox.com/story/32600992/city-of-midland-warning-about-recycling-papers-containing-personal-information"}],"summary":"document containing PII in recycling ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00d6fa03d3a72100b337a3055d0faffe0d213c29","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41980290-d584-11e7-af4f-6b5d4514198e"},"incident_date":"2016-08-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3455f5fa9673","org_name":"Rainbow Children’s Clinic","org_type":"healthcare","ransomware":true,"records_affected":33368,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/rainbow-childrens-clinic-notifies-33368-patients-of-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/patient-records-deleted-in-ransomware-attack"}],"summary":"On August 3, 2016, Rainbow Children’s Clinic was the victim of a hacker who accessed its computer system and then launched a ransom ware attack that began encrypting data stored on the Clinic’s servers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5da8febf74e47ff38a62c1be0d2f62af830ffa0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5332E492-7140-4CC3-8681-6249094C0B58"},"incident_date":"2016-08-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd4c6077ca1a","org_name":"Speedy's Mart Exxon","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtvr.com/2016/08/04/gas-pumps-skimmers/"}],"summary":"Bluetooth skimmers hidden inside gas pumps","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2016-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f53870e782f92af787a56e4833b2ac80b6393b8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99F308C2-5777-485F-9CDE-D8E64B1BD742"},"incident_date":"2016-08-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77c241e6b883","org_name":"Radio Station","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.co.uk/security/2016/04/kift-radio-station-hacked-barix-furry/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.barix.com/news/news-press-exhibition-singleview/article/radio-station-hacks-accentuate-importance-of-network-security/"}],"summary":"radio station hacked to play erotic furry animal sex","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29f04c4601d030f45bd2ffe19411c157f6a0f9d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8C05D7B-0AD6-44CF-AA35-69F0B3844B8B"},"incident_date":"2016-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5061202dbdad","org_name":"Thomasville Eye Center","org_type":"healthcare","ransomware":null,"records_affected":10891,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/georgia-eye-center-discovers-insider-breach-10891-patients-impacted-3626/"}],"summary":"A former employee of the Thomasville Eye Center in Thomasville, GA has been discovered to have accessed the protected health information of patients without authorization. PHI was stolen from the eye center and used to open credit accounts in the names of the patients.  The eye c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f61731d597ad57fe9e383d32053cd69bde32735","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0e239c90-d952-11e7-a452-77d2890a67ae"},"incident_date":"2016-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59891c651cfb","org_name":"Susan M. Hughes Center","org_type":"healthcare","ransomware":true,"records_affected":11400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cosmetic-surgery-center-discloses-ransomware-attack/"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19e2764e559c1b3e10176011016aab7583309636","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECF5780B-83BE-46CF-8BD5-919C03B5BF18"},"incident_date":"2016-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2354946febe","org_name":"Sheraton","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbrc.com/story/32750451/former-hotel-employee-accused-of-identity-theft"}],"summary":"Former hotel employee reportedly spent more than $3,000 on the debit card of a hotel guest","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6c09f80ff57554aa30ab9cfb450b348039da5ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"df8ab6d0-8f13-11e7-aa8f-5fa9d3670494"},"incident_date":"2016-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec93ee8e9e4a","org_name":"Roehl Transport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.landlinemag.com/Story.aspx?StoryID=32082"}],"summary":"Roehl Transport civil suit alleges ex-fleet manager stole company data, secrets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd1d6bd64e4f353aaeea4909bfcd8884885fb535","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"246AB809-C099-408E-AB37-CB377A119E7E"},"incident_date":"2016-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86a69207f937","org_name":"Pratap S. Kurra, M.D.","org_type":"healthcare","ransomware":null,"records_affected":2029,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-anesthesiologist-notifies-patients-after-phi-wound-up-in-a-trash-container/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63839;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63839"}],"summary":"On August 9, 2016, I was informed that papers related to my practice were found in a trash container. I immediately began an investigation into the matter and determined that on August 8, 2016, the day before, billing tickets used by my practice were accidentally thrown away duri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29a4084fb600e98174686ffe53c24633de1053be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D7B9A12-21F7-4164-BC8D-DE01D9FF7E8C"},"incident_date":"2016-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07dd5ece0d13","org_name":"New England Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/new-york/wantagh/skimming-device-found-nefcu-atm-wantagh"}],"summary":"Skimming  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99e3579ac086728350a25f0649e856caed69f225","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63573A72-1845-4227-A0C3-C9C4388502C1"},"incident_date":"2016-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccaa20a123b","org_name":"McDonald's Corp","org_type":"other","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jconline.com/story/news/crime/2016/09/08/police-mcdonalds-employee-skimmed-100-credit-cards/89996296/"}],"summary":"Credit card skimmer by McDonald's employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e885eaa82a79810d2181cbd91f4789d2b738d8b9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf5bbc20-a9e3-11e7-bafd-1552bcc84b5b"},"incident_date":"2016-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec1ab65ddf4d","org_name":"Martin’s Mini-Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.seattletimes.com/nation-world/bennington-gas-stations-warn-customers-of-card-skimming/"}],"summary":"Bennington gas stations warn customers of card skimming - Martin’s Mini-Mart, Midway’s Tenneybrook Market","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a77a7c9b79613a2a60002e7c468f964f3ee8013","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2057C4F-4ACD-49B1-B7BA-5917FBD69AEF"},"incident_date":"2016-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02b0900645fe","org_name":"KidsPeace","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/kidspeace-announces-possible-client-information-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/ransomware-attack-affects-servers-at-usc-hospitals;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcall.com/news/breaking/mc-kidspeace-records-breach-20160920-story.html"}],"summary":" box containing information about certain former KidsPeace clients went missing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2d09263f4471913c96cd41e2e21c797f4448416","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E58C212F-DA46-4BF8-9EAE-06B0FB1EE158"},"incident_date":"2016-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02ada014d1a8","org_name":"Keck Medical Center of USC","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.keckmedicine.org/wp-content/uploads/2016/09/doc11167320160920094345.pdf"}],"summary":"Ransomware infects two servers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ff6ffe66ef5a12e1a401e9866f2d6ff3b3e2c90","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5003DFA7-9D46-45BD-A6C7-73868697449A"},"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0ea313a42fd","org_name":"Integrity Transitional Hospital","org_type":"healthcare","ransomware":null,"records_affected":29514,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/integrity-transitional-hospital-learns-of-data-breach-3634/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/30k-affected-in-texas-hospital-breach/article/571585/"}],"summary":"Integrity Transitional Hospital of Denton, TX has discovered an unauthorized individual gained access to its computer system and potentially viewed lab test results and other sensitive patient data. The security breach affects patients of a number of different healthcare provider","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27fa30029c14ec6db5da4327c523105ff42ab30d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0E3E12D-6084-4F2A-A2E2-3A7D09149B99"},"incident_date":"2016-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1f3cc86d31a7","org_name":"gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/skimming-machine-gas-station-calgary-husky-1.3726860"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d48b71d959615034f1251220ddb7e6e01a8dc0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2b76a810-ec43-11e7-b683-c1703914e4a4"},"incident_date":"2016-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03549568ca85","org_name":"Equian","org_type":"financial","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theindychannel.com/news/local-news/indy-healthcare-billing-company-latest-w-2-breach-victim"}],"summary":"Phishing gains the bad guys employee W-2s.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Guccifer 2.0","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a1f407006cd44df6bf9fa1425cfc3ddcbdd5670","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEB701B2-5100-44E6-B660-C28DC8728DF9"},"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4130aae6bb63","org_name":"DNC","org_type":"government","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hacker-publishes-list-of-cell-phone-numbers-private-e-mails-for-most-house-democrats/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/guccifer-2-0-drops-democratic-party-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pelosi-bombarded-with-obscene-and-sick-calls-texts-after-cyber-attack/"}],"summary":"DNC PII posted","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"guccifer20"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e483822f1ef5f480345e170ee08a6275cf1a1e8f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2eac9c40-e420-11e7-8742-2bc46bd10713"},"incident_date":"2016-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26688fb18512","org_name":"Desert Care clinic","org_type":"healthcare","ransomware":true,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blog.knowbe4.com/health-care-records-unavailable-for-months-after-ransomware-infection;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cdn2.hubspot.net/hubfs/241394/Ransomware-letter.pdf?t=1513611952589"}],"summary":"Healthcare records of an Arizona clinic have not been available for months after a ransomware infection. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"790a4493837f7f3d83b604069d3432d7b5dec8c6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97D8C6F5-3EDA-449C-9EF4-3C13EA606DE2"},"incident_date":"2016-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc12.com/story/33348153/veterans-claims-documents-found-in-former-employees-storage-unit;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsplex.com/content/news/DVS-investigating-benefits-claims-documents-found-in-storage-unit-396328901.html"}],"summary":"Officials with the Virginia Department of Veterans Services are now working with the state Attorney General's Office and state police after a large amount of documents, including veterans' claims, were found in a storage unit.  In a statement Friday, DVS confirmed that the docume","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c42ef925138291dc3efbfe35fd9867cf6e020a75","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"865c0e10-176f-11ea-bf73-2d1a23feec7f"},"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a188579576e","org_name":"Cloudy Nights and Astronomics","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theverge.com/2018/12/10/18131024/ddos-attack-telescope-forum-cfaa-prison"}],"summary":"forum user who's account is blocked, requests it be DDoS'd which resulted in it's outage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1550901841e81a05706fdfe9a70b0c2cd0573d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81588449-3DCF-40CA-841E-E12FB369C721"},"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"df0ca7f40780","org_name":"Christians Against Poverty","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/08/15/cap_data_breach/"}],"summary":"data breach that exposed personal details ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9736a981261c8fd46214b25f9d4b7a7b7f1a534a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"958cd2f0-aa2b-11e8-b2b4-5de6d270e153"},"incident_date":"2016-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a11e44edce3e","org_name":"Avenue Living","org_type":"other","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://lethbridgenewsnow.com/article/605121/privacy-commissioner-says-avenue-living-privacy-breach-poses-risk"}],"summary":"Employee logged in remotely and downloaded PII or tenants and sold their information on the black market. The information was used to fraudulently open new credit card accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b83cf4d5db2e20a0d71afe155fb82c05504a4fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e96efd00-0849-11e8-8ccf-e3865b9fabe5"},"incident_date":"2016-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"01df543b9490","org_name":"Australian Department of Health","org_type":"government","ransomware":null,"records_affected":2900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news.com.au/technology/online/security/one-in-10-australians-health-records-exposed-in-department-data-blunder/news-story/bd78435619d694d373f52634d5afa950"}],"summary":"ONE in 10 Australians’ private health records have been exposed in a major error by the Department of Health that shows what medication patients are on and whether they are seeing a psychologist.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"AZ","motive":"grudge","name":"Anti-Armenia Team","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7c431be11389427903be1579d28b66f17c1d04d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B92EBD0F-07E6-41FE-9C2D-C07AAEBF0268"},"incident_date":"2016-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AM","org_id":"e116d80b5207","org_name":"Armenian national security ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/azerbaijani-hackers-leak-secret-armenian-data/"}],"summary":"Azerbaijani hackers going by the handle of Anti-Armenia Team who claim to have hacked Armenian government servers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"antiarmeniateam"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d99d1fe4429d248029e88ab169f8ecb6eac382b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BF82C6D-FC9C-4C48-BDAC-507560C09BF3"},"incident_date":"2016-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"a044c9e2c8fe","org_name":"DLH.Net","org_type":"technology_saas","ransomware":null,"records_affected":3300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/millions-of-steam-game-keys-stolen-after-site-hack/"},{"fetched_at":null,"title":"Have I Been Pwned: DLH.net","type":"hibp","url":"https://haveibeenpwned.com/Breach/DLH"}],"summary":"Millions of Steam game keys stolen after hacker breaches gaming site - A known vulnerability found in older vBulletin forum software, which powers the site's community, allowed the hacker to access the databases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8ac0915cde4853eb136cb4ce7a96140a1f8743f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A98ED65B-546C-4B0D-A3BA-F9C65E6DE58C"},"incident_date":"2016-07-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd3343c62b88","org_name":"Geisinger Health Plan","org_type":"financial","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/geisinger-health-plan-notifies-2800-that-processing-error-exposed-their-phi-to-others/"}],"summary":"Misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-30","discovered_date":"2016-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a039cb8343ab7222bbe100911844f735653ac609","impact_type":"data_theft","incident_date":"2016-07-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DCPI%20Notice.FINAL__1.pdf"},"notes":null,"org_country":"US","org_id":"d7eb20ada28d","org_name":"Disney Consumer Products and Interactive Media","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63132"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DCPI%20Notice.FINAL__1.pdf"}],"summary":"An unauthorized party accessed Playdom Forum servers and acquired account usernames, email addresses, passwords, and registration IP addresses.","supporting_quote":null,"technology_involved":["Playdom Forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d83823ba74d2338a5f0b939833412c93403e3656","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"418B735E-D7DF-405F-B411-68B026BAA0B4"},"incident_date":"2016-07-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b59846d7a074","org_name":"University of Wisconsin Health","org_type":"healthcare","ransomware":null,"records_affected":6923,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/university-of-wisconsin-hospitals-and-clinics-authority/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.uwhealth.org/news/notice-to-patients-regarding-mis-addressed-patient-satisfaction-surveys-w/49286"}],"summary":"UW Health announced today that it is sending letters to certain patients about a privacy incident. UW Health learned on August 3, 2016, that patient satisfaction surveys were addressed \"To the parents or guardians [patient's name]\" of some adult patients and mailed between July 2","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30d4da23da2a5d6801343917f1714c55af06532a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A4FE0C9-28CD-4AB4-A34E-F3C864E01E48"},"incident_date":"2016-07-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ff3494a5ee9b","org_name":"Saskatchewan Government Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sgi-catches-snoop-in-vonda-notifying-customers-of-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.canadianunderwriter.ca/insurance/saskatchewan-government-insurance-notifies-customers-privacy-breach-1004097547/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatoon/sgi-catches-snoop-in-vonda-notifying-customers-1.3701031"}],"summary":"ooked up customer information without a business reason","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2c394b659552709094b086bf28bda26f3b9f2d8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"976115BA-EDDF-42CE-B3FA-7266D4621738"},"incident_date":"2016-07-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abf7ef1d76da","org_name":"Altamont Internal Medicine & Pediatrics","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ny-st-peters-gave-me-other-peoples-medical-records-patient/"}],"summary":"medical records given to wrong person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"264bd5a08f943bd526483344bc5920a7c1fb4a7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C0226C3-BD54-4CC5-BED5-96D2E0CF7FD3"},"incident_date":"2016-07-28","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5bb2c77f1ad3","org_name":"UNC Charlotte University","org_type":"education","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unc-charlotte-employees-bank-accounts-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/local/potential-email-scam-at-uncc-affecting-direct-deposit-info/413523311"}],"summary":"phishing to get bank account information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f12feba8a6c49db2953740d8dc893b17d4f73596","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b01afc00-c254-11e8-bf07-99bafabab839"},"incident_date":"2016-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edea593952c8","org_name":"McAlester Regional Health Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/legal-regulatory-issues/family-sues-oklahoma-hospital-for-hipaa-violation-after-toddler-s-death.html"}],"summary":"A hospital employee broke HIPPA regulations by informing the biological parents of an adopted child that the toddler had drowned.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da982456b54598da1139a50ffb435a9ce90e2ace","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0526C438-8221-49D1-9815-6FAA088E5A63"},"incident_date":"2016-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c8e42b1c19b","org_name":"Factory RV Surplus","org_type":"retail_ecommerce","ransomware":null,"records_affected":8500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/consumer-caution-factory-rv-surplus-exposing-customer-info/"}],"summary":"exposing his information and that it had been indexed by Google","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2c5dab26aa57e18ff781dc3bb4e92db883885f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E70FC5DD-4A93-4C10-9C02-C4CEC1391031"},"incident_date":"2016-07-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"728a0b2f4c7b","org_name":"Bloomfield Township Board of Trustees","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.candgnews.com/news/campaign-opponents-blast-savoie-email-list-94909"}],"summary":"used email list for political campaign","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Ghost Squad Hackers","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae56f605526a139d4560c49e5cbc8b892ce83f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36ABDCFE-3DC9-4D40-A51A-18C7B018DFA4"},"incident_date":"2016-07-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87f7e200c251","org_name":"US Army","org_type":"government","ransomware":null,"records_affected":2437,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/ghost-squad-hackers-leak-data-of-us-military-personnel-505606.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/ghost-squad-hackers-leak-us-military-data/"}],"summary":"hacked US Army PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"ghostsquadhackers"}},{"actor":{"category":"external","country":"RU","motive":"financial","name":"Carbanak Gang","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2016-07-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f85bd35fe076336fc09fbb089c2f34523221046","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2852E9A7-BE32-49A5-89D6-7E281ACBBBCC"},"incident_date":"2016-07-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d65847107aa","org_name":"Oracle Corp","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/08/data-breach-at-oracles-micros-point-of-sale-division/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/oracle-micros-security-breach-has-ties-to-carbanak-gang-507092.shtml?utm_content=buffer7ae4e&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fortune.com/2016/08/08/oracle-data-breach-retail-hacks/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/08/visa-alert-and-update-on-the-oracle-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/thomasbrewster/2016/08/11/oracle-micros-hackers-breach-five-point-of-sale-providers/#16d7571e5eb8"}],"summary":"Oracle hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"carbanakgang"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86788195e19fa4413a3f0b0725a8840dce63e1aa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF08E6DB-4322-4D20-BCDE-E28B1EEEACD2"},"incident_date":"2016-07-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc3769b0d927","org_name":"John E Gonzalez","org_type":"healthcare","ransomware":null,"records_affected":1025,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/california-dentist-notifies-patients-of-backup-drive-stolen-from-car/"}],"summary":"laptop stolen from dentist vehicle with PII on it including names, addresses, SSN's, and some medical info.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"897204b1a6309cf216cd43ef0de848d2f01753e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB6D18B5-BDAD-46B5-A8FE-18DF94B9ADD9"},"incident_date":"2016-07-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d633b789b1a5","org_name":"Glassdoor","org_type":"technology_saas","ransomware":null,"records_affected":600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/glassdoor-email-gaffe-exposers-users-email-addresses/"}],"summary":"Glassdoor updated its terms of service, and dutifully notified its users by putting all their email addresses in the TO: field.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49c638854f7c68e27162d844ba0fd453321497f3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC9D2A4D-9D7E-40D0-BD8C-61B1CB92044F"},"incident_date":"2016-07-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9534b3a7d220","org_name":"Decatur Health Systems","org_type":"healthcare","ransomware":null,"records_affected":707,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://salina.com/news/local/binder-containing-patient-information-missing-from-oberlin-hospital/article_fc0f3206-d6eb-556b-8ccc-8ad305d6c520.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ks-breach-of-protected-health-information-discovered-at-decatur-health-systems/"}],"summary":"binder missing with PII from hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-22","discovered_date":"2016-04-22","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6fe345f24eed7e69167ebe93e9fd2b52b8a910db","impact_type":"unknown","incident_date":"2016-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3620e5bf0085","org_name":"Comnet Marketing Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Comnet%20Marketing%20Group-2016-07-22"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2af13d1f0a9963fd05d8002807218e86f5afc86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09221A82-4C8A-4206-8C2C-D1CF48B17DB4"},"incident_date":"2016-07-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87bbd882d0e7","org_name":"Nordic Consulting Partners, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nordic-consulting-partners-email-gaffe-exposes-phi/"}],"summary":"Attachment was included in email with PII of the receipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-21","discovered_date":"2016-07-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0879ae68ebd9b531566817e777d79b31d8f19334","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-02","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/inVentiv%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f70fd858e4f2","org_name":"inVentiv Health, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee believed a targeted phishing email requesting W-2 uploads was legitimate and uploaded the data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62962"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/inVentiv%20CA%20Notice_0.pdf"}],"summary":"A targeted phishing email led an inVentiv Health employee to upload U.S. employees’ W-2 data to a file-sharing site; unauthorized access to the data was uncertain.","supporting_quote":"Believing the email request to be legitimate, the W-2 data was uploaded.","technology_involved":["file sharing site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2016-07-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49df083e2307ed0fc9d82a7664e4889d6740195c","impact_type":"data_theft","imported_from":null,"incident_date":"2014-11-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"unknown","org_id":"b408b7299439","org_name":"Digital Extremes","org_type":"technology_saas","ransomware":null,"records_affected":819478,"reviewed":false,"root_cause":"A SQL injection flaw in Drupal allegedly enabled the attack.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Warframe","type":"hibp","url":"https://haveibeenpwned.com/Breach/Warframe"}],"summary":"An attack on Warframe exposed usernames, email addresses, website activity, and a data field that Digital Extremes said contained salted hashes of alias names rather than passwords.","supporting_quote":"Allegedly due to a SQL injection flaw in Drupal, the attack exposed usernames, email addresses and data in a \"pass\" column which adheres to the salted SHA12 password hashing pattern used by Drupal 7.","technology_involved":["Drupal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ca42184b4d5dcdcf00f9f7fdb418796a38af7bd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3EAA53C-76EC-4A5B-AF40-75125F2C80CD"},"incident_date":"2016-07-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c411870ce0ef","org_name":"Lees Road Post Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.manchestereveningnews.co.uk/news/greater-manchester-news/warning-after-skimming-device-camera-11681279"}],"summary":"A skimming device complete with a camera that record users putting in their pin number has been found at a cash machine in Oldham, England.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb8d0e150854e4345e0d83f5c15042f488a01f94","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CiCis%20-%20Sample%20Website%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"230f4da5b843","org_name":"CiCi Enterprises, LP","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CiCis%20-%20Sample%20Website%20Notification_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9633.pdf"}],"summary":"Malware introduced by a hacker to POS systems at some Cicis restaurant locations may have accessed payment card information.","supporting_quote":null,"technology_involved":["Point of Sale (POS) system","POS software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e874cef5b8822df0684f8ab783a6683f1efa723","impact_type":"data_theft","incident_date":"2016-04-21","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_CA_0.pdf"},"notes":null,"org_country":"US","org_id":"ea344d201866","org_name":"San Antonio Shoemakers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62930"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_CA_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9634.pdf"}],"summary":"Malware on checkout systems at certain San Antonio Shoemakers retail stores enabled unauthorized parties to access payment card data.","supporting_quote":"Based on the investigation, we discovered that the checkout systems at certain retail stores were infected with a type of malicious software, or “malware,” enabling unauthorized parties to access payment card data of some of our customers.","technology_involved":["checkout systems","checkout terminals"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"667e60441bbed6722da9e06234aa76d5d6de27a6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"859CE818-7F0A-4B14-9EB1-B0ACAC370DDA"},"incident_date":"2016-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1fa903621133","org_name":"BRIAN D. HALEVIE-GOLDMAN,","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/psychiatrists-laptop-stolen-patients-notified/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/breach%20%20letter%20pdf_0.pdf?"}],"summary":"2 laptops stolen from psychiatrist vehicle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29866ec07c37a322e053e1617cd878717ed0ee33","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFEB7A74-8959-4A5A-B45C-4043BCBFFB1E"},"incident_date":"2016-07-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64cf77f2296e","org_name":"U.S. Healthwork","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/laptop-stolen-from-u-s-healthwork-was-encrypted-but-alas-the-password-was-with-it/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/u-s-healthworks-announces-theft-encrypted-laptop-decryption-key-3591/"}],"summary":"laptop stolen with password","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"fe9d659daf03807c24197f7c348f157f906e0ce9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/KRTCPA's%2CP.C..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79d5d391b3fc","org_name":"KRT CPAs, P.C.","org_type":"unknown","ransomware":null,"records_affected":182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/KRTCPA's%2CP.C..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25a65ad9f1d8a5f575bf2f85eb818c5cd2da81c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6E3F2AF-B40A-4635-B4E2-27A0004E53D7"},"incident_date":"2016-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"976e877544c3","org_name":"Kings University College","org_type":"education","ransomware":null,"records_affected":451,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.westerngazette.ca/news/king-s-counselling-department-breaches-students-privacy/article_31959b80-527e-11e6-9856-dbba6c7af08f.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-kings-counselling-department-breaches-students-privacy/"}],"summary":"an email outed the list of students currently using King's counselling department services for academic accommodation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e020a864372b4cd3da8d82fd8ea9c579ebe30054","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-12-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"fc0504a24b31","org_name":"Trillian","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Trillian","type":"hibp","url":"https://haveibeenpwned.com/Breach/Trillian"}],"summary":"Trillian suffered a data breach that exposed personal information and passwords stored as salted MD5 hashes.","supporting_quote":null,"technology_involved":["Trillian"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a04f49bf2dd9e18c9ee36b338d3083c37396ca7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D73903FA-4E92-47C6-88D3-47B2D17B3E85"},"incident_date":"2016-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10801e532fb1","org_name":"SOAProjects Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therecorder.com/id=1202762825628/Consulting-Firm-Levels-Computer-Fraud-Trade-Secret-Claims-at-ExPartner?slreturn=20160617172651;"},{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/files/368143/Consulting.Firm.Levels.Computer.Fraud.Trade.Secret.Claims.at.Ex-Partner.The.Recorder.pdf"}],"summary":"former employee hacked in to steal secrets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-15","discovered_date":"2016-05-19","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0e404f7e237cbc12875254c4c3e3b2a30e54aaa2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0291db98fa51","org_name":"Providence Medical Group Oregon","org_type":"unknown","ransomware":null,"records_affected":5978,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Providence%20Medical%20Group%20Oregon-2016-07-15"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-15","discovered_date":"2016-05-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0268d0aec8244e67a6e3bfc05b1eb3f4b312cfbc","impact_type":"unknown","incident_date":"2015-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"25ad8a77d89b","org_name":"Matador Recordings, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_Redacted_0.pdf"}],"summary":"Matador Recordings, LLC notified customers after its third-party website developer reported finding and removing suspicious files from its website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f38350dbb769e8e6ec45f3fda0af9a15680fde4d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA887394-779D-4F57-9C78-8B3002D4C33F"},"incident_date":"2016-07-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GT","org_id":"08b124fbc7c2","org_name":"Kingo Energy","org_type":"professional_services","ransomware":null,"records_affected":18800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/off-the-grid-thousands-exposed-after-database-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/265-data-breach-at-kingo-energy;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/265-data-breach-at-kingo-energy"}],"summary":"database with PII unsecure on the internet, found by ethical hacker and alerted the company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f5a6c8681549c7571dcfbc339411a8f2ad1a31c","impact_type":"unknown","incident_date":"2015-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Website%20Posting%207-14_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c22c0ebaac46","org_name":"Eastbay Equities","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62870"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c7d2dffa30b1e2261d2a962479b2cae38b1fb78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45DFF85D-3F54-459C-BD2F-24D00DD607A8"},"incident_date":"2016-07-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0bf0e851e186","org_name":"College Hill Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wyomingbusinessreport.com/state-officials-investigate-medical-office-documents/"}],"summary":"Disposal error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"308faaca5a1994b033adce1c7ab91cf32b32e1cd","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAFD4358-4762-4027-A8C9-321592CB9D2F"},"incident_date":"2016-07-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"92bd3b674d94","org_name":"Taiwan's First Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://money.cnn.com/2016/07/14/news/bank-atm-heist-taiwan/index.html"}],"summary":"ey didn't use bank cards but rather appeared to gain control of the machines with a \"connected device,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-14","discovered_date":"2016-06-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d8f4c2f3693357dd3801ed1302647bb40af371c","impact_type":"disruption_or_ransomware","incident_date":"2016-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Standard%20Notice%20%284%29_1.pdf"},"notes":"attack_techniques without supporting words dropped: T1485","org_country":"US","org_id":"c66cbee731f9","org_name":"Project Management Institute","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62846"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Standard%20Notice%20%284%29_1.pdf"}],"summary":"An unauthorized user issued commands to delete data from PMI vendor Comnet’s systems, which may have included PMI customer credit card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Comnet Marketing Group, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"3620e5bf0085","name":"Comnet Marketing Group, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078","T1657"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-07-14","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cd56d9b2103015c81fb4227ffe68e4a3b91f6a4","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"ed652907b0e3","org_name":"Opes Advisors","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62850"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20Notice_0.pdf"}],"summary":"Compromised email login credentials gave an outside party access to one Opes Advisors account, and an attempted wire fraud was caught.","supporting_quote":"On or about May 26, 2016, email login credentials were compromised allowing an outside party to gain access to one specific account.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25b537ddebcf4b36573e49f5aa3f1beed34bf0db","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34435E06-0784-40F4-84D1-8841BF8D408C"},"incident_date":"2016-07-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"7886a3780c7b","org_name":"Elex","org_type":"technology_saas","ransomware":null,"records_affected":1597717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hacker-steals-1-6-million-accounts-from-top-mobile-games-forum/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/clash-of-kings-data-breach-exposes-1.6-million-accounts.html"}],"summary":"Hacker steals 1.6 million accounts from top mobile game's forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f091a69c2dad4abb304e4730ccffe8f28721ae8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E7535DC-22D9-405A-98C3-5FB14A9F6157"},"incident_date":"2016-07-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c934727abc90","org_name":"Canonical","org_type":"technology_saas","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ubuntu-forums-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ghacks.net/2016/07/15/ubuntu-forums-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworm.net/2016/07/ubuntu-linux-forum-hacked-data-2-million-users-leaked.html"}],"summary":"Ubuntu Linux forum hacked, data of 2 million users leaked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6e9042565db237385078fd03cfeec66e5d03f783","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/OmniHotels.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fc4ee332f24d","org_name":"Omni Hotel and Resorts","org_type":"unknown","ransomware":null,"records_affected":435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/OmniHotels.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26837c68782090489571596931f66bc0301d8e27","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5A38D48-6C36-4A12-9554-C4802DE27377"},"incident_date":"2016-07-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a2f88ccab71","org_name":"Asante","org_type":"healthcare","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://kobi5.com/news/asante-security-breach-36202/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/or-asante-notifies-patients-of-inappropriate-file-access-by-employee/"}],"summary":"employee had inappropriately accessed certain electronic patient records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69690ef46e5c2056ba7e3de6515322bcff243eb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD73F4EA-8C89-47F0-AD68-F399423C28AD"},"incident_date":"2016-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bae4e6a18821","org_name":"state board of elections","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/illinois-online-voter-registration-portal-hacked-information-compromised/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ilnews.org/8868/illinois-online-voter-registration-portal-hacked-information-compromised/"}],"summary":"hacker breached its online voter registration system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdfd84f867b1169188dee7593e07e4529e887a4c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50A5CDCD-7DEB-4CDB-A06B-2CA32404C7BD"},"incident_date":"2016-07-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23488793944a","org_name":"St. Elizabeth Physicians","org_type":"healthcare","ransomware":null,"records_affected":674,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/st-elizabeth-physicians-email-gaffe-exposed-patient-email-addresses/"}],"summary":"Email sent without BCC","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-07-12","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3395d6bf6ee50309497d853304cfdc5beffa48d8","impact_type":"exposure_no_theft_confirmed","incident_date":"2010-06-06","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notification%20letter%20for%20ClinTech%20theft%207.12.16%20-%20generic%20template%20-%20letterhead_0.pdf"},"notes":null,"org_country":"US","org_id":"cdf6f0ce6334","org_name":"Kaiser Permanente Northern California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Two Kaiser Permanente employees stole equipment, including ultrasound machines that contained protected health information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62796"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notification%20letter%20for%20ClinTech%20theft%207.12.16%20-%20generic%20template%20-%20letterhead_0.pdf"}],"summary":"Two Kaiser Permanente employees stole equipment, including ultrasound machines that contained protected health information, and the letter reported no indication that the information had been misused.","supporting_quote":"The preliminary investigation has determined that two Kaiser Permanente employees stole equipment and machines from several Kaiser Permanente sites and stored them in an offsite storage unit.","technology_involved":["ultrasound machines"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-07-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a8b5c7edd299ec4840f940fa392f7230620504c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AC1DDBF-32AE-49C6-A749-9623C88D615F"},"incident_date":"2016-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7eb20ada28d","org_name":"Disney Consumer Products and Interactive Media","org_type":"technology_saas","ransomware":null,"records_affected":391000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/playdom-forum-site-breach-affects-391000-usernames-email-addresses-and-passwords-impacted/"}],"summary":"Website/DB breach leads to disclosure of 391,000","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63287d90a3b6e18d8547ff1be253768c66c5e7e7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B5F4CB2-5654-43C9-A63E-BA4EA8EF3D3A"},"incident_date":"2016-07-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"413c3a2b5a80","org_name":"Ventura County Health Care Agency","org_type":"healthcare","ransomware":null,"records_affected":777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vcstar.com/story/news/local/2016/09/20/county-health-care-agency-reports-breach-patient-data/90750126/"}],"summary":"employee took home paperwork and apparently misplaced it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4e96b4dbe169ff92de6178367a97c625e2bf253","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/notification%20letter%20%5BFINAL%5D_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1a87bcdf650b","org_name":"University of Southern California, on behalf of KUSC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62772"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a181b07da26b94466858bff95e5ca92fcca63cf2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F7DBD42-3425-4175-813F-2A5CFAEE970A"},"incident_date":"2016-07-11","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"de9e135cc580","org_name":"Interpark Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":10300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.yonhapnews.co.kr/national/2016/07/25/47/0302000000AEN20160725011900315F.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreatimes.co.kr/www/news/biz/2016/07/123_210401.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/n-korea-behind-interparks-massive-customer-data-leak-police/;http://english.yonhapnews.co.kr/news/2016/08/31/0200000000AEN20160831008200320.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/online-mall-interpark-fined-4-5-bln-won-3-8-million-over-data-leak/"}],"summary":"The private information of an estimated 10.3 million users of online shopping mall Interpark has been stolen by a hacker group.  The information includes names, addresses, email addresses, dates of birth and phone numbers. Police launched an investigation after learning about the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"267a29acf2d09fbe106b3640bf7209f8eb24e93e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26DFD04E-7CBA-4E17-BFBA-1229E5CC0D2F"},"incident_date":"2016-07-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ec2d71ec2a59","org_name":"Valve","org_type":"technology_saas","ransomware":null,"records_affected":1923972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/dota2-forum-hacked-user-data-stolen/"}],"summary":"Dota2 forum hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"133350e50d37d20bd6f8e3a23e6de8070cdfe0f8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB636C07-4FEB-477F-9E28-AE3587789870"},"incident_date":"2016-07-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6d5a46a2409c","org_name":"Cambridgeshire and Peterborough NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-patients-warned-of-shocking-data-breach-after-nurses-bag-stolen-from-car-in-cambridge/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cambridge-news.co.uk/"}],"summary":"Patients warned of 'shocking' data breach after nurse's bag stolen from car in Cambridge  An out of hours car, used by a community nurse with Cambridgeshire and Peterborough NHS Foundation Trust (CPFT), was broken into on July 9 while parked outside a patient's home in east Chest","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02d5066d547066703b21f00826722b8b8f415310","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7F3FD08-C9A2-4B96-A8FD-253B4BE3C81F"},"incident_date":"2016-07-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e721a5300685","org_name":"The Co-operative Food","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theargus.co.uk/news/14619976.Card_skimming_device_found_on_Brighton_store_s_ATM/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da6c79b5f22e07fe679b42e77555b13722ae2a6e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D03D454-49D9-4A34-8418-5FABF8F7466D"},"incident_date":"2016-07-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d323493a8a3b","org_name":"Public Education Employees' Health Insurance Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.al.com/news/index.ssf/2016/07/personal_identity_data_for_som.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/alabama-website-breach-revealed-personal-data-of-some-state-retirees/"}],"summary":"PHI open on database for at least four days","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-08","discovered_date":"2016-05-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"497951cffc18a761e38083b519341faaaaa50ecc","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NoticeofDataBreach070816_0.pdf"},"notes":null,"org_country":"US","org_id":"cc5626e31313","org_name":"Omni Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62753"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NoticeofDataBreach070816_0.pdf"}],"summary":"Omni Hotels & Resorts reported malware affecting point-of-sale systems at some hotels that was designed to collect payment card information.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-08","discovered_date":"2016-05-30","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b377ca4835a7f06351157ca9e9ce5a1b2e177194","impact_type":"unknown","incident_date":"2015-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9631.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9558bc860692","org_name":"Omni Hotels and Resorts","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9631.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Omni%20Hotels%20and%20Resorts-2016-07-21"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b11162bf15892e443fae73026916f2d7d093c624","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1576776B-2992-41A2-A64C-DC3BA8E52619"},"incident_date":"2016-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9cce3d7073d1","org_name":"LA County+USC Medical Center","org_type":"healthcare","ransomware":null,"records_affected":743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbclosangeles.com/news/local/Over-700-LA-County-USC-Patients-Affected-in-Privacy-Breach-391712481.html"}],"summary":"Over 700 LA County-USC Patients' Personal Information Stolen in Car Break-In  Appointment lists that contained 743 patients' full names, birth dates, medical record numbers, phone numbers, genders, clinics and appointment information were stolen from an employee's vehicle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cd549e039306e61b45e502b08498d08896aada1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82F0C204-68F3-469F-B4E3-3871BD414EFE"},"incident_date":"2016-07-08","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8de310b70708","org_name":"Island Health","org_type":"healthcare","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timescolonist.com/news/local/island-health-reports-another-privacy-breach-1.2297849;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/british-columbia/island-health-second-privacy-breach-1.3670879"}],"summary":"staff member misused access privileges to view the medical records of 34 patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebfbdc0e5745991f5054f2b6ef61461f97fdfc4a","impact_type":"data_theft","imported_from":null,"incident_date":"2016-04-19","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"19ac9fd6be38","org_name":"17","org_type":"technology_saas","ransomware":null,"records_affected":4009640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 17","type":"hibp","url":"https://haveibeenpwned.com/Breach/17Media"}],"summary":"Customer data from the 17 streaming app appeared for sale, including email addresses, IP addresses, usernames and passwords stored as unsalted MD5 hashes.","supporting_quote":null,"technology_involved":["17 app"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbf50bbaeb0ebf79e8921fb66c1242fbc238a443","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_5.pdf"},"notes":null,"org_country":"US","org_id":"4e6d97784b63","org_name":"Wendy's of Fresno, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised and used to access franchisees’ POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_5.pdf"}],"summary":"Wendy’s reported that compromised service provider remote access credentials allowed access to franchisee POS systems where malware targeted payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"943801b17e6873fa5645117f3c4fb9bc1d56ced1","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_3.pdf"},"notes":null,"org_country":"US","org_id":"4216003614d4","org_name":"Wendy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to some franchisees’ POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62720"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_3.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9630.pdf"}],"summary":"Wendy’s reported malware on some franchisees’ POS systems that targeted payment card data after a service provider’s remote access credentials were compromised.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a218d054c7f2ea157a4aa0cb01c39d626adecac0","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_1.pdf"},"notes":"attack_techniques without supporting words dropped: T1133, T1199","org_country":"US","org_id":"4216003614d4","org_name":"Wendy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider's compromised remote access credentials allowed access to some franchisees' POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62718"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_1.pdf"}],"summary":"Wendy's reported malware on some franchisee POS systems that targeted payment card data after a service provider's remote access credentials were compromised.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d55a2589b8a230fc67d609a59b1dbffc9b528e27","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_6.pdf"},"notes":"attack_techniques without supporting words dropped: T1199","org_country":"US","org_id":"607c404707e8","org_name":"Wencom LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s compromised remote access credentials enabled access to franchisee point-of-sale systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62721"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_6.pdf"}],"summary":"The notice describes malware targeting payment card data on franchisee-operated POS systems after a service provider’s remote access credentials were compromised.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-07","discovered_date":"2016-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6677231a7212bdcb460eaca3e3e5d1e0f0169183","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"33359ce2820e","org_name":"Group W. Partners, LLC","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Group%20W.%20Partners%2C%20LLC-2016-07-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d164be2e55be8cd8b9118a2eb30a9b8e4d385a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFDBEA6C-7B90-4D2C-B8B7-52620FF7FDB1"},"incident_date":"2016-07-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"231f5d53bc6f","org_name":"The Center for Neurosurgical and Spinal Disorders","org_type":"healthcare","ransomware":null,"records_affected":1134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/la-center-for-neurosurgical-and-spinal-disorders-discloses-hack/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kplctv.com/story/32781361/data-security-breach-at-local-neurosurgical-center"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.americanpress.com/20160824-Hacking"}],"summary":"Hacker, probably Russian based on use of Cyrillic alphabet, gained access remotely to the computer of the office manager of a neurosurgical center, and installed key logger malware and another malware which captured screen shots at intervals. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d291b8d6ec6172744b3ea89bc51bf45a20d2bd73","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_2.pdf"},"notes":"attack_techniques without supporting words dropped: T1199","org_country":"US","org_id":"4489e85b4d2a","org_name":"RDR Foods, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to franchisees’ POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62719"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_2.pdf"}],"summary":"RDR Foods, Inc. was affected by malware deployed on franchisee POS systems after a service provider’s remote access credentials were compromised, putting payment card data at risk.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-07","discovered_date":"2016-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8b0b20c9bcfa47cb2bfda7bcd1eeb1567c908dd","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d6566f83c83","org_name":"PNV Restaurants, Inc.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#PNV%20Restaurants%2C%20Inc.-2016-07-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ba285d2b6cb6d1a1f8501bda29dbf89d06ada71","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1133","org_country":"US","org_id":"e644913480c1","org_name":"Peninsula Foods, L.P.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s compromised remote-access credentials enabled access to franchisee POS systems and malware deployment.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_0.pdf"}],"summary":"Peninsula Foods’ franchisee POS systems were accessed using compromised service provider remote-access credentials, and malware targeted payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efe16cb5e26994ed57a9a271e67ec4b30c0ff921","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBE96DCE-3C24-46C3-94AB-911B079CC6BA"},"incident_date":"2016-07-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"19a9ac2ce272","org_name":"Netia","org_type":"technology_saas","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/netia-data-leak-polish-telco-operator-hacked-14gb-customer-credentials-posted-online-1570051;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/polish-telco-confirms-massive-data-breach-430393"}],"summary":"Polish telco operator Netia suffers massive data breach, exposing 300,000 customer information including names, bank account numbers and personal IDs.  Its official website was hacked by attackers, who accessed and compromised two different online forms that customers can use to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7842c8a0192dab3ec86ceb3ba64616f85433552f","impact_type":"data_theft","imported_from":null,"incident_date":"2013-05-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"84d9f8ffd625","org_name":"Neopets","org_type":"technology_saas","ransomware":null,"records_affected":26892897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Neopets","type":"hibp","url":"https://haveibeenpwned.com/Breach/Neopets"}],"summary":"Data originating from Neopets was found being traded online, containing personal information and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-07","discovered_date":"2016-06-07","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c9dafa520c98532fcb528fe8f0f1b33103ae85f4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"94c8c2c43db3","org_name":"Joshua, Inc.","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Joshua%2C%20Inc.-2016-07-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd259b0182e9cfb52516e4e6327a348470a1ae1a","impact_type":"unknown","incident_date":"2015-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Website%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f34b62c37c1","org_name":"Gil Moore Oil Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62716"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4d0437bb8c19512d83bd4503b34f45226b051b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_10.pdf"},"notes":null,"org_country":"US","org_id":"f26579c655d2","org_name":"Desmond Foods, L.P.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to franchisees’ point-of-sale systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_10.pdf"}],"summary":"Compromised service provider remote access credentials allowed malware to be deployed on some franchisee point-of-sale systems, targeting payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aa355b9e1191dcdbb07bdd00f3503fc5d868803","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_9.pdf"},"notes":null,"org_country":"US","org_id":"c020268bffec","org_name":"Dependable Foods","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised and used to access franchisee POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62714"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_9.pdf"}],"summary":"Compromised service provider remote access credentials allowed access to some franchisees’ POS systems, where malware targeted payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ae599dfb75dbbc90bec762969e348f62390c804","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A205FABE-DA25-4360-A479-DD14A0E0F138"},"incident_date":"2016-07-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae4bc14b92e3","org_name":"Datadog","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.komando.com/happening-now/366208/top-story-the-latest-data-breach-is-the-scariest-yet-heres-why;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.datadoghq.com/blog/2016-07-08-security-notice/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/datadog-chews-on-data-breach-aws-user-credentials-in-leak/"}],"summary":"unauthorized activity on a small number of production infrastructure servers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1bac8d1d98721eb099d3b7f91e070d009e0b85d","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_8.pdf"},"notes":null,"org_country":"US","org_id":"2ef9dd594ef7","org_name":"Cotti Foods California, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to franchisees’ POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_8.pdf"}],"summary":"Cotti Foods California’s franchisee-operated POS systems were accessed using compromised service provider credentials, and malware targeted payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"215d873c4943c6d390135a1e4b69ced5b4ca3305","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"137CDC93-EB25-4AF6-BD47-94B8397DBD5D"},"incident_date":"2016-07-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"94c10fdb180c","org_name":"Care Quality Commission","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pulsetoday.co.uk/your-practice/regulation/gps-details-included-in-500-confidential-records-lost-by-cqc/20032423.fullarticle"}],"summary":"files were lost when a cabinet was accidentally tagged for removal ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f637e91d335f577b607bdc19fc390b14ef9fb6e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-13","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_7.pdf"},"notes":"attack_techniques without supporting words dropped: T1199","org_country":"US","org_id":"3116bb7d9099","org_name":"BMP/Pennant Holdings, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to franchisee POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62712"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_7.pdf"}],"summary":"BMP/Pennant Holdings’ franchisee POS systems were accessed after a service provider’s remote access credentials were compromised, putting payment card data at risk.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"542db8b9da17e1bc772efafb66a9ae07d3ced44f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20Notification_11.pdf"},"notes":null,"org_country":"US","org_id":"4ab74e4d0fa0","org_name":"Amaash Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A service provider’s remote access credentials were compromised, allowing access to franchisee POS systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62711"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20Notification_11.pdf"}],"summary":"Amaash Corporation’s franchisee POS systems were accessed using compromised remote access credentials belonging to a service provider, and malware targeted payment card data.","supporting_quote":"The Company believes this criminal cyberattack resulted from a service provider’s remote access credentials being compromised, allowing access – and the ability to deploy malware – to some franchisees’ POS systems.","technology_involved":["POS systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58905c14a372c201a45ffc2a3daeff067cd83279","impact_type":"unknown","incident_date":"2016-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CHCF%20Privacy%20Breach%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"18b138bae430","org_name":"CDCR - California Health Care Facility","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62703"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cdbb24b5bdd85b34e693261711cc80d521ee80e","impact_type":"data_theft","imported_from":null,"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b5896a89a222","org_name":"Badoo","org_type":"technology_saas","ransomware":null,"records_affected":112005531,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Badoo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Badoo"}],"summary":"Data allegedly originating from Badoo, including personal information and password hashes, circulated in 2016, but the breach’s legitimacy could not be confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"190f09ed3b7b353078a5b7f27ce8c0780fd224c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6865AE23-6B18-468A-969F-C8ACB09901C7"},"incident_date":"2016-07-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc220b8d8167","org_name":"Potters Hill Missionary Baptist Church","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nc-pink-hill-pastor-reports-ransomware-locked-up-files/"}],"summary":"randsomware on pastors computer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c8453b041989e0ecb702c1922d950347f5bb72d","impact_type":"data_theft","imported_from":null,"incident_date":"2013-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"431d6a251ae5","org_name":"iMesh","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: iMesh","type":"hibp","url":"https://haveibeenpwned.com/Breach/iMesh"}],"summary":"A breach of iMesh exposed account data, including email addresses, IP addresses, usernames, and password hashes.","supporting_quote":null,"technology_involved":["iMesh"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43e3ec6b9ed5173c582a1a40f19fdd64aa925483","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63F3092B-2D36-418C-8C46-B8C35A9505E3"},"incident_date":"2016-07-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39dd3be4ecfd","org_name":"FItBit","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/kashmirhill/2011/07/05/fitbit-moves-quickly-after-users-sex-stats-exposed/"},{"fetched_at":null,"title":null,"type":"press","url":"http://gizmodo.com/5817784/dear-fitbit-users-kudos-on-the-30-minutes-of-vigorous-sexual-activity-last-night"}],"summary":"Fitbit.com was notified that the self-trackers the company caters to were revealing their sexual activity stats online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72732fed3606f4e732ca4d013f6da4796a96a045","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A48B49F-75C6-49C2-A815-63FE64B43D74"},"incident_date":"2016-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cookcountyrecord.com/stories/510983632-walgreens-accused-of-invasion-of-privacy-with-emails"}],"summary":"a pharmacy incorrectly sent sensitive information to his father","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"588607a345afc80afe9ce5c6f6fa75de87413fb2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6442de40-d585-11e7-af4f-6b5d4514198e"},"incident_date":"2016-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f3a61474c093","org_name":"Vermont Health Connect","org_type":"financial","ransomware":null,"records_affected":660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/subcontractor-error-exposed-vermont-health-connect-customers-ssns/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vermontbiz.com/news/2017/september/29/ag-settles-data-breach-case-264000-issues-400-social-security-number-penalty;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthcare.com/privacy-security/samanage-vermont-health-connect-data-breach-security-settlement"}],"summary":"The Attorney General reached a settlement (link is external) today regarding a security breach involving the Social Security numbers of 660 Vermont Health Connect users. SAManage USA, Inc, a technology company that provides business-support services, agreed to alter its informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ca1aff2f53452d3a1135d2f9dac63f37cb618ee","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33ed20b0-89af-11e7-bf1d-81579668407a"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"aab55a8a3b5d","org_name":"University of Regina","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatchewan/university-regina-computer-hackers-1.3661882"}],"summary":"Hacked computers cause University of Regina privacy breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83a6adb99460633ae3962f3f5575500597a19fba","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BA43505-A254-4322-B1A8-52676CB03B9C"},"incident_date":"2016-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cf990ae60d7","org_name":"University Gastroenterology","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ri-university-gastroenterology-notifies-patients-of-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://turnto10.com/i-team/consumer-advocate/nbc-10-i-team-patient-information-compromised-in-local-data-breach"}],"summary":"University Gastroenterology (\"UGI\") has become aware of a data security incident that may have resulted in the inadvertent exposure of the personal and protected health information of some patients. Although at this time there is no evidence of any attempted or actual misuse of a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1de9525303dbc7f2699689e1ac7a6afbdec2548","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D6D6E4A-4F01-4F8F-BD19-9C9BD634AF4C"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"6cf05c48bda0","org_name":"The Hunting & Fishing New Zealand","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hackers-target-hunting-fishing-nz/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newshub.co.nz/business/hackers-target-hunting-and-fishing-nz-2016072507"}],"summary":"website hacked, managed by third party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"BR","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc66a90405cb6a06f06adbe7f880cfcc027fe54e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEC0387F-6BF0-4CC7-802F-A084B49EEE2B"},"incident_date":"2016-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5280695f41b","org_name":"SunTrust bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/deputies-skimming-device-suspect-targeted-affluent-celebration-neighborhood/425925963"}],"summary":" placing a skimming device at an ATM ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b87ad62919a00fe0fa505fda46a5961811e8c08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B44F3BEA-CE3B-4EBA-A88D-1BA7B87B1BF2"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27007a15cdac","org_name":"Southwest Portland Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://justice.oregon.gov/consumer/DataBreach/Home/GetBreach/1841081963;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/southwest-portland-dental-notifies-patients-of-patterson-dental-breach/"}],"summary":"one or more unauthorized individuals gained access to a network resource site used by SPD and PDSI in 2010 to exchange data between software systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6781ece1ca9b3bb7ea706e2706a2244b9879239e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFECA470-56B5-4D3C-83F6-3915ADF30ED8"},"incident_date":"2016-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"ef805137c29d","org_name":"Shri Dhanvantari Herbals","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsbtc.com/2016/08/28/indias-first-ransomware-attack/"}],"summary":" first ever recorded incident of ransomware attack in India","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"TheDarkOverlord","variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db8deded6320e22b007028f5385b3fe5129349a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32C50506-3447-44FF-9D3D-954A9B734AD3"},"incident_date":"2016-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8dfc40ce489d","org_name":"Prosthetic & Orthotic Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":23015,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/another-victim-of-thedarkoverlord-confirms-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/another-victim-of-thedarkoverlord-confirms-breach/"}],"summary":"Web application database hacked and PHI was disclosed and put up for sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fbe3702cf86950d72d294dcb75528015d72fa1f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B5D479C-E69A-4FC4-964C-F499280B6087"},"incident_date":"2016-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9733ced8027c","org_name":"New England Healthcare Exchange Network","org_type":"technology_saas","ransomware":null,"records_affected":3840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ma-codman-square-health-center-notifies-members-after-breach-at-nehen/"}],"summary":"health information exchange was accessed without authorization and against Codman's policies.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8e5055ab7abf4ec647010bdfd34a6aeefe9bd2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A3321B8-DEBC-49D9-92C4-32C75E7EBF5D"},"incident_date":"2016-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"3be86e18d6b6","org_name":"Muslim Match","org_type":"other","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/private-messages-from-dating-site-muslim-match-hacked-and-dumped/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/dating-site-muslim-match-suffers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/accounts-of-150k-users-exposed-in-muslim-match-dating-site-breach/article/506951/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/07/01/muslim_match_data_breach/"},{"fetched_at":null,"title":"Have I Been Pwned: Muslim Match","type":"hibp","url":"https://haveibeenpwned.com/Breach/MuslimMatch"}],"summary":"Private Messages From Dating Site 'Muslim Match' Hacked and Dumped  Dating site Muslim Match has been breached and 150,000 log-ins posted online alongside hundreds of thousands of private messages between users, according to reports.  Motherboard confirmed that the email addresse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9df1a48031b416f96eadcbc65a4737425c91f66c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6A92668-0EFC-4BB6-91D7-D796C58CA110"},"incident_date":"2016-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"0ce37422ade9","org_name":"MTN Irancell","org_type":"technology_saas","ransomware":null,"records_affected":20000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/internet-bot-exposes-mtn-irancell-users-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/irancell-hack-19-year-old-it-graduate-arrested-leaking-20m-customer-records-telegram-1569018"}],"summary":"Internet Bot Exposes 20 Million MTN Irancell Users' Data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cbcec1b65eddd7989c77f100407cdffc4d07238","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8769D8BE-FE44-4CD9-9322-54C69991E94C"},"incident_date":"2016-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"791f19eb0003","org_name":"Meritus Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1029,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/md-meritus-contacting-patients-after-privacy-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.your4state.com/story/d/story/meritus-health-alerts-over-one-thousand-patients-a/30610/9d4IDntCZky8zPps1Co42A;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/routine-audit-reveals-phi-data-breach-for-md.-medical-center;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldmailmedia.com/news/local/meritus-contacting-patients-after-privacy-incident/article_6ba1ccac-1c53-11e5-ac86-7f911335e173.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldmailmedia.com/news/local/meritus-contacting-patients-after-privacy-incident/article_6ba1ccac-1c53-11e5-ac86-7f911335e173.html"}],"summary":"employee at one of the company's vendors may have accessed patient information outside of normal job functions","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac7086255641cbc0de61ac659b6c704127f5f9f1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E02867DF-3FAB-44EB-AF8B-EA320289CB0F"},"incident_date":"2016-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d31a5c173bd2","org_name":"LastPass","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/lastpass-hacked-this-time-for-good/"}],"summary":"password manager website hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54c9268c5472a16f550afa0e35dbfc845e03fd8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70F4ACBC-22A9-4FEC-BCD0-78DD68063BA6"},"incident_date":"2016-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd999aafd1fe","org_name":"Jerry's Artarama N.C., Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Form%20of%20Customer%20Notice%20Letter%20re%20Breach%20-%20Jerrys%20Artarama_0.pdf"}],"summary":"RAM scraper","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":"Flog Oz","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5f5bd0f053a5d8d1127cab718d472a8799f2efa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC1B11C8-46B7-4E97-93F7-C36B64A80F52"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e18357980a7a","org_name":"H&L Australia","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.channelnews.com.au/ukranian-hackers-flog-oz-data/"}],"summary":"data for sale on darknet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"flogoz"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68c9b55e58efc4a4119935b811bb077cfd17c48f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5932928B-69E8-4DFB-B849-898A6DBC2A92"},"incident_date":"2016-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2eb26c22fc4","org_name":"Department of Veterans Affairs (VA) Northern Indiana Health Care System (NIHCS)","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sen-donnelly-presses-northern-indiana-va-on-wrongful-sharing-of-veterans-phi/"}],"summary":"veteran's PHI sent to wrong recipient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ae3eb5c38b11397bd1c97452af73477a3aa8a67","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6a594a0-bf16-11e7-94fd-31775d0f94dc"},"incident_date":"2016-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ed13c05d028","org_name":"Cumming Police Dept","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs46.com/story/36716389/former-police-officer-convicted-for-accepting-bribes-computer-fraud"}],"summary":"Jury convicts former Cumming Police sergeant of accepting bribes and computer fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"unknown","name":"Pravvy Sector","variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0adf4baefe0e94d216b64d72efaef95ebe65400a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bb455f50-eab7-11e7-92b6-dfe49f9d7042"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"40172268a6d9","org_name":"Central Ohio Urology Group","org_type":"healthcare","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/developing-central-ohio-urology-group-hacked-phi-dumped-hactivist/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://motherboard.vice.com/read/hacker-dumps-sensitive-patient-data-from-ohio-urology-clinics;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/central-ohio-urology-group-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/central-ohio-urology-20160922.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/08/04/ohio_urology_hack/;"}],"summary":"A medical group in Ohio has confirmed it was ransacked by miscreants who leaked hundreds of thousands of medical files, financial documents and patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pravvysector"}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5ad718efa28776772ac68df7216d5a9eb37ec78","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB51B3B6-A810-4C9C-B48C-FEF7D8227BC9"},"incident_date":"2016-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2754bec3f68d","org_name":"Care Quality Commission's","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-bungling-contractors-throw-out-500-confidential-documents-in-newcastle-cqc-office-refurb-blunder/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclelive.co.uk/news/north-east-news/bungling-contractors-throw-out-500-11682995"}],"summary":"records disposed during renovation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff755f45984af66612d6bffd385d66241bcd0f5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e37f39c0-c59e-11e7-8053-ff1e84d2b694"},"incident_date":"2016-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d72a7d7b21c6","org_name":"California Department of Public Health","org_type":"government","ransomware":null,"records_affected":93,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ebar.com/news/article.php?sec=news&article=72556"}],"summary":"Officials with California's public health department have said that data on dozens of people who rely on the state's AIDS Drug Assistance Program was breached.  The agency's Office of AIDS said in its monthly report for April that it's \"identified 93 ADAP clients whose informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bae37301001ee628a4c242b81d3066297fe0e60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B302AFD4-1CE0-4585-B1EF-994988BF87E7"},"incident_date":"2016-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5d85801c97e6","org_name":"Aviva Corp Ltd","org_type":"financial","ransomware":null,"records_affected":13788,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-crash-details-sold-by-aviva-manager-to-cold-callers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-3345258/Crash-details-sold-Aviva-manager-cold-callers-Insider-tens-thousands-giving-personal-information-companies-bombard-victims.html"}],"summary":"Insider used privilege to access crash victim's claim information and sold it for profit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6cb38482e032d91559abeefa5c7f3419a4d8c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FCA7535-E829-4C9A-B011-45B20039BC98"},"incident_date":"2016-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1dc4105ddbfc","org_name":"Automation Integrated","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/leaky-database-leaves-oklahoma-police-bank-vulnerable-to-intruders/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/cybersecurity/threatwatch/2016/07/software-vulnerability-accidentally-leaked/2688/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/245-oklahoma-dps-and-bank-security-exposure"}],"summary":"Misconfiguration allowed access to DB contents w/o authorization","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20dc991fc174860faa38a1755aee7b10435986ca","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"CN","org_id":"52211ed7cd71","org_name":"Tianya","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Tianya","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tianya"}],"summary":"Tianya was hacked in December 2011, and account data including names, usernames and email addresses was obtained.","supporting_quote":null,"technology_involved":["online forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae6fdbc4f7f9d73303fee3c6b2be2badf919b7d3","impact_type":"unknown","incident_date":"2016-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Security%20Breach%20Filed_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"784876acab8a","org_name":"Kool Kids Model & Talent Management","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62623"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"fcbf87770ef706f7d12b89735e96773397280687","impact_type":"unknown","incident_date":"2015-10-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9639.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"401893b6b087","org_name":"KontrolFreek","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9639.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#KontrolFreek%2C%20LLC-2016-09-16"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Individual%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized third party accessed KontrolFreek servers and acquired some customers’ payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-06-29","discovered_date":"2016-06-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10bb0fe278dcfa70537706d803dd5135b091fdd6","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VerticalScope%20-%20%20User%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"049781fda739","org_name":"VerticalScope Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62619"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VerticalScope%20-%20%20User%20Notification_1.pdf"}],"summary":"VerticalScope reported that data stolen in February 2016, including community member usernames, email addresses, and hashed passwords, was being made available online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2cfc94407efac55d1a0a6dc99361c5b3c84bab1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B04E80F9-476D-441C-A70A-E08B4C31B0D8"},"incident_date":"2016-06-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3d60dd45945","org_name":"Sun Trust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wfla.com/2016/06/29/photos-repeat-skimming-suspect-caught-on-camera-putting-device-on-polk-county-atm/"}],"summary":"ATM Skimmer at 3 banks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e2cdf01c69cec5536fe9ad391594f1e9a2bf6c2","impact_type":"data_theft","imported_from":null,"incident_date":"2012-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ec30629ceefc","org_name":"WHMCS","org_type":"technology_saas","ransomware":null,"records_affected":134047,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WHMCS","type":"hibp","url":"https://haveibeenpwned.com/Breach/WHMCS"}],"summary":"A May 2012 breach of WHMCS exposed customer information, including email addresses, payment histories, and partial credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5233ebe5b213277f8ea5834c66fe4bb47ce1cb53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D28FCB50-D5D6-46A8-AE91-F99A3739E9D5"},"incident_date":"2016-06-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f81aa2db6f2","org_name":"Planned Parenthood","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/planned-parenthood-of-greater-washington-and-north-idaho-public-notice-of-email-error/"}],"summary":"email to wrong recipients with minimal PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"34f19110a11ebed8b55f61ecf77b286eb843b030","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9629.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f2b86051c288","org_name":"Noodles & Company","org_type":"unknown","ransomware":null,"records_affected":0,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9629.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Noodles%20%26%20Company-2016-06-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1659e58eb38a6119ddeb40227fe2098fba432289","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/HardRock.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f78747625426","org_name":"Hard Rock Hotel and Casino Las Vegas","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/HardRock.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9e5558646e55dc2c414a8620a85c6956c1af5b9","impact_type":"data_theft","incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"54f468a40947","org_name":"Uiggy","org_type":"technology_saas","ransomware":null,"records_affected":4300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Uiggy","type":"hibp","url":"https://haveibeenpwned.com/Breach/Uiggy"}],"summary":"Uiggy’s Facebook application was hacked in June 2016, exposing accounts and associated personal information.","supporting_quote":null,"technology_involved":["Facebook application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-27","discovered_date":"2016-05-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d8300640ffd68da0e389d585d0051a0fa8f7b7b","impact_type":"data_theft","incident_date":"2015-10-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hard%20Rock%20-%20Regulatory%20Packet%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1efc6300a1c7","org_name":"Hard Rock Hotel & Casino Las Vegas","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62545"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hard%20Rock%20-%20Regulatory%20Packet%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hard%20Rock%20Hotel%20%26%20Casino%20Las%20Vegas-2016-06-27"}],"summary":"Hard Rock Hotel & Casino Las Vegas reported card-scraping malware in its payment card system that may have affected payment card data.","supporting_quote":null,"technology_involved":["payment card system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6281cabc1a24f172a00f86d156ecfd3f41b1bf56","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B2D97EE-5783-47C6-8428-273C2D6B0A18"},"incident_date":"2016-06-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9350e77d282f","org_name":"Santander Chile Holding SA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.peterboroughtoday.co.uk/news/crime/card-skimming-device-recovered-from-cashpoint-as-police-ask-public-to-be-on-the-lookout-for-more-1-7450094"}],"summary":"Skimmer found by member of the public on ATM at local bank.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60a390f0c3c762e11119500713b3e59551701375","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CE7F7A6-DF7C-45FC-BE58-1142D25BD9AE"},"incident_date":"2016-06-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfe5e410a816","org_name":"Village Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wytv.com/2016/06/25/up-to-5-bags-of-medical-business-records-found-at-recycling-center/"}],"summary":"patient records recycled at recycling center a matter of miscommuniction","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb2981985d0087105803e20216fec9c8193eac07","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFD33EC4-6F20-4F2A-BBDD-1DC535638984"},"incident_date":"2016-06-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9e93367217e","org_name":"Todays Dental Association","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.oag.state.md.us/idtheft/Breach%20Notices/2015/itu-262315.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"received an anonymous fax after close of business ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcac13f08549f7654bdd37c501c2ecedb1adb725","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3797C73-9FD0-4D06-8042-ECC589E508F7"},"incident_date":"2016-06-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0e16396c95f","org_name":"The Topps Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/swing-and-a-miss-topps-apps-database-leaked-fans-info/"}],"summary":"un secure database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-06-24","discovered_date":"2016-06-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"869f9c8e8a9de6dbb1113b4b07ef000ae5f2b6ce","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/patient%20letter%20-%20final_0.pdf"},"notes":null,"org_country":"US","org_id":"01a59d848823","org_name":"Mercy Medical Center Redding","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62536"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/patient%20letter%20-%20final_0.pdf"}],"summary":"A naviHealth case manager accessed Mercy Medical Center Redding patients’ medical and personal information while working under a false identity.","supporting_quote":"Unfortunately, the case manager accessed your patient information as part of his work.","technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":"naviHealth"},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"vendors":[{"id":"8fba9d30c312","name":"naviHealth"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2385d0518753b2b606130cdd2d02c49492b3a46e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50BE30E7-1617-49DF-B069-68F4FF4E4481"},"incident_date":"2016-06-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5d2a1014d576","org_name":"John Moors University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickliverpool.com/news/5472-john-moores-university-staff-details-leaked-in-data-protection-blunder/"}],"summary":"Misdelivery of PDF to former employee leads to PII loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-06-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0681339e0d8f8372d5530dc4107d3917a73d0642","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF3C7864-263F-4DE8-9C4D-BA00EE0AE185"},"incident_date":"2016-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3954c9a699ec","org_name":"University of Cambridge","org_type":"education","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hack-exposes-1500-university-of-cambridge-student-and-employee-passwords/"}],"summary":"Hackers successfully hit the University of Cambridge's Cambridge Schools Classics Project website this week, exposing the email addresses and cleartext passwords of over 1,500 students and employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6147a3478ae7447281c67dd4e0fb14157b5afcd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B4DAF2A-19D3-4306-B294-E4BE44D2BA46"},"incident_date":"2016-06-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7c7d42cdc3","org_name":"Pennsylvania Department of Revenue","org_type":"government","ransomware":null,"records_affected":865,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pennlive.com/news/2016/07/taxpayers_data_potentially_com.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtae.com/news/laptop-theft-puts-personal-information-of-hundreds-of-pennsylvania-taxpayers-at-risk/40469758;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc27.com/2016/07/12/information-of-nearly-900-pa-taxpayers-on-stolen-laptop/"}],"summary":"stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2016-06-23","discovered_date":"2016-07-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7062f8f1a00a39d0b1e86c83e0b22a0466458f2","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Banner%20Patient%20letter%20%28CA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"eeffc784273d","org_name":"Banner Health","org_type":"healthcare","ransomware":null,"records_affected":3700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/banner-health-breach-affects-37-million-a-9304;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsmax.com/Health/Health-News/medical-identity-theft-id/2016/08/09/id/742866/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.azcentral.com/story/money/business/health/2016/10/05/banner-health-summer-data-hack-triggers-10-civil-lawsuits/90758660/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63197"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Banner%20Patient%20letter%20%28CA%29_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Banner%20Health-2016-08-03"}],"summary":"Banner Health reported that attackers gained unauthorized access to information stored on some computer servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7da296912a38234677d75055686d2f81acb684ed","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E9D936E-C78D-45B7-9EA6-30A96131F930"},"incident_date":"2016-06-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"104f4206314a","org_name":"Nib","org_type":"financial","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/business/private-health-insurer-nib-leak-customers-private-details-20150622-ghub1g.html?utm_content=buffer382d1&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer"}],"summary":"accidental breach of confidential information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"384346f7f953ec9e8bdfea6256ad091d9c8f9fda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC8D059C-7339-49BC-BCF6-EB9F973F0C32"},"incident_date":"2016-06-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4e309007048","org_name":"The Outer Banks Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://outerbanksvoice.com/2016/08/19/hospital-alerts-cardio-rehab-patients-of-possible-data-loss/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.obsentinel.com/news/obx-hospital-warns-about-data-privacy-breach/article_96cb6d34-6707-11e6-8d27-23fee1531639.html"}],"summary":"two thumb drives lost","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-20","discovered_date":"2016-04-14","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"53af92d42c1f3aaad6d9d49d7fc2dfc069bdfc6b","impact_type":"unknown","incident_date":"2016-02-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3ff2a424935","org_name":"Stamford Podiatry Group, PC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Stamford%20Podiatry%20Group%2C%20PC-2016-06-20"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36dd63f766890f8afcab28be378081e986dad7f7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0DB3905-1D78-41D3-A0D0-A11ACFB7968A"},"incident_date":"2016-06-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"223348b173a7","org_name":"Crozer-Keystone Health System","org_type":"healthcare","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pa-bariatric-patients-privacy-was-compromised-crozer-keystone-says/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.philly.com/philly/health/20160730_Bariatric_patients__privacy_was_compromised__Crozer-Keystone_says.html"}],"summary":"patients' privacy was breached because of an email error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"800f23b8bc3744686b9797afd9e8217dc53b4a54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B412CEBE-CA04-433E-B210-631779A3469F"},"incident_date":"2016-06-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"703c904430fb","org_name":"Professional Dermatology Care","org_type":"healthcare","ransomware":true,"records_affected":13237,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/professional-dermatology-ransomware-attack-affects-13k"}],"summary":"Ransomeware on Dermatology  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddf38f8a895a9e1007c6a3b3e2f99370a5f14437","impact_type":"unknown","incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-notification_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62435"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62434"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62956"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"928138415707fe8588c56a54a8460f830ba21161","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9627.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e36e447f5fc8","org_name":"Uber Technologies","org_type":"transportation_logistics","ransomware":null,"records_affected":1355,"reviewed":false,"root_cause":"Information allowing access to the database was available without intended access restrictions.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9627.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9627.pdf"}],"summary":"Uber reported that a third party accessed a database containing names and driver’s license numbers after access information was available without intended restrictions.","supporting_quote":"Uber discovered in September 2014 that information allowing access to the database had been available without intended access restrictions.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-16","discovered_date":"2016-05-16","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da284e099666fffb92a9160808dc5eb8520bf927","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-05-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%207-27-16%20Supplemental%20Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"c285b4d8ce23","org_name":"Multi-Color Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63217"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62424"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%207-27-16%20Supplemental%20Notice_0.PDF"}],"summary":"A hard drive containing Multi-Color employee and applicant information was stolen during a break-in at the law firm representing the company.","supporting_quote":"On May 16, 2016, the law firm informed Multi-Color that someone broke into the law firm’s law offices on either May 14 or May 15 and stole seve ral items, including the hard drive containing Multi-Color’s data and the password.","technology_involved":["external hard drive"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b40d00b41268ed51a3e89c1142cb1e4a298217c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CF444F2-891E-44C4-8BEB-2168EE22F405"},"incident_date":"2016-06-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f6ac333923","org_name":"Orlando Health","org_type":"healthcare","ransomware":null,"records_affected":44,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/personal-information-of-pulse-victims-survivors-breached-orlando-health-says-/428060863;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/orlando-health-employee-went-through-personal-information-of-pulse-survivors-hospital-says/"}],"summary":"Pulse nightclub victims PII looked at for curiosity. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14a33dfcf0857f232e1792a724a4f980489148d9","impact_type":"unknown","incident_date":"2016-09-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notif%20Ltr%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6a666edbbe8c","org_name":"University of Connecticut","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62350"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2191fa01446deac843dc791edd722ec4208754e8","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"f9d3cec15f15","org_name":"Acer Service Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62344"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20-%20California_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/AcerServiceCorporation.pdf"}],"summary":"Acer Service Corporation reported unauthorized access to information of customers who used its ecommerce site, potentially including personal and payment card information.","supporting_quote":null,"technology_involved":["ecommerce site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d11d38bdfb4fdf7861d1aa2304980cfec392415f","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-05-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9626.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"3334564ade61","org_name":"The Tax Shack","org_type":"professional_services","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9626.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9626.pdf"}],"summary":"A burglar broke into The Tax Shack and stole a safety deposit box and petty cash; client personal information may have been accessible, but there was no evidence it was taken.","supporting_quote":"Sometime over Memorial Day weekend, someone broke through the 2`x 2` glass window at our principal place of business and stole our safety deposit box and petty cash.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-13","discovered_date":"2016-04-04","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72872989d0ca79a7177c44dec29c9c10b1c9747b","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stanford%20REDACTED%20W-2%20CA%20Notification%20Letter%20FINAL%2020160418_0.pdf"},"notes":null,"org_country":"US","org_id":"d1b2d57b4c7a","org_name":"Stanford University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stanford%20REDACTED%20W-2%20CA%20Notification%20Letter%20FINAL%2020160418_0.pdf"}],"summary":"Unauthorized individuals downloaded Stanford employees’ W-2 forms from Equifax’s W-2Express service, and fraudulent tax returns had been filed using some employees’ information.","supporting_quote":null,"technology_involved":["W-2Express","Equifax"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Equifax"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"ee776572d10e","name":"Equifax"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-13","discovered_date":"2016-06-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86c72bb5bc0442560de057db9c7da29dbc4f8b30","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Crrnt%20Emply.MMH_.Data%20Breach%20Notice%20%283%29_0.pdf"},"notes":null,"org_country":"US","org_id":"8e077cf7a8ba","org_name":"Momentum for Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62338"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Crrnt%20Emply.MMH_.Data%20Breach%20Notice%20%283%29_0.pdf"}],"summary":"Momentum for Mental Health reported that an email spoofing scam resulted in personal information from W-2 forms being made available to an unknown third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-13","discovered_date":"2015-09-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54b72e58883cd9aec71c69249b66b08d01a0c4ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MEI%20GSR%20NON_MA_NOTICE_0.pdf"},"notes":null,"org_country":"US","org_id":"c6e3e3fb8020","org_name":"Grand Sierra Resort","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62337"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MEI%20GSR%20NON_MA_NOTICE_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9625.pdf"}],"summary":"Grand Sierra Resort notified guests of a potential compromise of payment card information used at its food and retail locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b24861624b49630543ad30c49e57998d63969b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69CF9017-0831-4F42-9E09-6B1E5634F53E"},"incident_date":"2016-06-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f07bf31ec18","org_name":"American Diabetes Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/articles/2016-06-14/can-hundreds-of-doctors-keep-an-8b-secret-not-on-twitter"}],"summary":"the confidential, market-moving data displayed and then tweeted","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2016-06-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fe3d322f1657cdcc0a62b95e0a4230610eabbed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E95981D-35BE-4A17-A4F5-AA72E134BAB1"},"incident_date":"2016-06-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fab5b6ae20f4","org_name":"University of Greenwich","org_type":"education","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/student/news/greenwich-university-second-confidential-data-breach-revenge-hack-former-student-a7091366.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://metro.co.uk/2016/06/19/student-booted-out-of-uni-so-he-hacks-it-and-posts-personal-details-online-5954593/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/greenwich-university-hacked-data-leaked/"}],"summary":"student kicked out of university and then hacked website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda9b8d6ed5e10aeea8f0736c6d4b3027fbc78f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D68E6A7C-CF60-40BD-BEEB-4EB989D78191"},"incident_date":"2016-06-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8c9e578f642","org_name":"Sutter County Superior Courthouse","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.appeal-democrat.com/news/courthouse-data-breach-exposes-personal-information/article_80a08626-31fa-11e6-b227-c75f0f72438a.html"}],"summary":"Private personal information of potentially thousands of people was unintentionally available on public access computers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55bf7f6ca61819fe01d4713c8e4a9f10e0dcb740","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5219A96B-7F6F-448E-9CCF-C8881EF4DDEA"},"incident_date":"2016-06-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e29c6a7cd729","org_name":"Let's Encrypt","org_type":"technology_saas","ransomware":null,"records_affected":7618,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.pro-linux.de%2Fnews%2F1%2F23648%2Fdatenpanne-bei-lets-encrypt.html&edit-text=;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pro-linux.de/news/1/23648/datenpanne-bei-lets-encrypt.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/lets-encrypt-accidentally-spills-7600-user-emails/118625/"}],"summary":"Let's Encrypt accidentally disclosed the email addresses of several thousand of its users this weekend","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"MuhmadEmad","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"657de1d0fd050843d57c4c3753571a851df477ac","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7B470D0-4A6F-485A-B64E-FAFA2AEF4EE8"},"incident_date":"2016-06-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f7cf269f85e","org_name":"Dell Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/dell-official-website-subdomains-hacked-by-kurdish-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tapscape.com/dell-official-website-subdomains-hacked-kurdish-hackers/"}],"summary":"Dell websites defaced in other countries","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"muhmademad"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"791845dd528b96dbd7a381781d66f1322b8198b1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F072B95-4D9E-48EC-B59B-FB44FC220C11"},"incident_date":"2016-06-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e961ee2d22d9","org_name":"Kaiser Permante","org_type":"healthcare","ransomware":null,"records_affected":1136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/kaiser-permanente-notifies-patients-after-stolen-ultrasound-machines-were-recovered/"}],"summary":"ultrasound machines stolen to sell","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b04356ff971208ddc57610312028e1b6db4db0e","impact_type":"data_theft","imported_from":null,"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"76a5573fc924","org_name":"VK","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: VK","type":"hibp","url":"https://haveibeenpwned.com/Breach/VK"}],"summary":"VK accounts were hacked around 2012, and exposed data including names, phone numbers, email addresses, and plain-text passwords was later offered for sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a78ae014bd3d64319cf896a90b83cfed2569c85b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A3FEF2B-B57D-4BF7-A132-41F2E6E8573D"},"incident_date":"2016-06-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2423427754d6","org_name":"Saugus","org_type":"government","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ma-saugus-employees-personal-information-released-during-discovery-phase-of-rivers-lawsuit-against-town/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itemlive.com/news/nothing-personal-for-saugus-employees/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://saugus.wickedlocal.com/news/20160609/saugus-employees-personal-information-released-during-discovery-phase-of-rivers-lawsuit-against-town"}],"summary":"attorney sends attorney a lot of PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5df3d79eb9b2d70ae77f5412328e9b0a6fbbe272","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA08FE5F-3D48-40DE-883C-E11633E276A7"},"incident_date":"2016-06-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"acd379a0bdfe","org_name":"Oregon State Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/employee-accidentally-compromises-oregon-state-hospital-patient-data/article/514598/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.statesmanjournal.com/story/news/politics/state-workers/2016/08/07/state-hospital-patients-upset-over-medical-data-leak/88048628/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/state-hospital-patients-upset-over-medical-data-leak/"}],"summary":"a psychiatrist accidentally sent a photograph of patient records to people outside of the hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bbc5f2dbfe711fa36f0db9954bb31da79123a07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CC7827A-27F4-464A-9CC9-11B3BB8DCE29"},"incident_date":"2016-06-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1dc3301041eb","org_name":"Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailykos.com/story/2016/6/9/1536678/-Republicans-leak-names-of-Planned-Parenthood-staff-and-medical-researchers-to-anti-abortion-groups"}],"summary":"released Planned Parenthood PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-06-08","discovered_date":"2016-04-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4bbf83128789295481af492af4c5deeb33f51d9b","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9624.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"7f90d884f03e","org_name":"Mate1.com","org_type":"technology_saas","ransomware":null,"records_affected":406080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9624.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9624.pdf"}],"summary":"Mate1.com reported that an unauthorized individual may have accessed its user profile database, which may have contained names, email addresses, passwords, and other profile information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"867c87eed6ff22f1576d7d31d96612c9c92d0c9a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB104B0A-4390-47FB-BADF-A6A77C8C2ADB"},"incident_date":"2016-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3bb7e76df89c","org_name":"Eastern Health Authority","org_type":"healthcare","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegram.com/News/Local/2016-06-08/article-4553808/Doctor%26rsquo%3Bs-car-stolen-with-patient-files-in-briefcase/1"}],"summary":"Patient files stolen from doctor's car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-06-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f864efc5cbc1a4adf59b48a4474c97844f39e22","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"098a8becfa76","org_name":"BitTorrent","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BitTorrent","type":"hibp","url":"https://haveibeenpwned.com/Breach/BitTorrent"}],"summary":"BitTorrent's IP.Board forum was hacked in January 2016, exposing usernames, email addresses, IP addresses, and passwords.","supporting_quote":null,"technology_involved":["IP.Board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02f79a9875e43d893f1fee30fc1ccb372e9937ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"565153CE-D91F-4F3E-8750-C8A058BDB505"},"incident_date":"2016-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aef47d4c7a60","org_name":"Arkansas Library Association","org_type":"nonprofit","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arkansasonline.com/news/2016/jun/08/librarians-shrug-off-isis-hack-20160608/?f=latest;"},{"fetched_at":null,"title":null,"type":"press","url":"http://freebeacon.com/national-security/fbi-isis-hacked/"}],"summary":"library website defaced","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe912765a2887e752e576089171ee441fb732e6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E80319EE-9D22-4910-8439-68C16D91B5F7"},"incident_date":"2016-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"291b81dc0432","org_name":"Air India","org_type":"transportation_logistics","ransomware":null,"records_affected":44,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/in-air-india-admin-staffers-ids-also-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hackers-steal-air-india-frequent-flyer-miles-worth-24000/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://sputniknews.com/asia/201606231041811744-india-airline-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyoooz.com/delhi/515756/ai-admin-staffers-ids-also-hacked"}],"summary":"hacked sky miles","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1657"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-06-07","discovered_date":"2016-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5694035432a04e46ae949a9f614aa428edf35d69","impact_type":"unknown","incident_date":"2014-08-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20ISRR%2005116037-2016%20%20Letter%201A_0.pdf"},"notes":null,"org_country":"US","org_id":"5b716633a4f2","org_name":"State Farm Mutual Automobile Insurance Companies","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62237"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20ISRR%2005116037-2016%20%20Letter%201A_0.pdf"}],"summary":"Employees of a State Farm independent contractor agent misappropriated customer funds, misused customer financial cards, and accessed or changed some customer contact information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dc35477c58fe0d1a9fb8bc6e78ac7300d129892","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74AD2D06-6FB8-4C5F-A24A-20A37760BB60"},"incident_date":"2016-06-07","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1634dd6e40b","org_name":"Platte County Assessor Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansascity.com/news/local/article82307722.html?utm_source=fark&utm_medium=website&utm_content=link"}],"summary":"transferred money on spoofed email from CEO","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0bd6deb781665ec3fb2f4dfe33708d371d56481","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60B3C834-867E-4D7C-A181-5E2576D74127"},"incident_date":"2016-06-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ba165fec1fe0","org_name":"G4S PLC","org_type":"other","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thanetgazette.co.uk/g4s-lose-bank-statements-and-birth-certificate-copies-of-margate-staff/story-29416812-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-kent-36548788"}],"summary":"data had been lost \"whilst in our possession\" ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-06-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc6a45b99274b61f20962942d08c71b1b2394e72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"952FD03A-54B8-422E-8FD4-000EB0481C3E"},"incident_date":"2016-06-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3518ee360315","org_name":"uTorrent","org_type":"professional_services","ransomware":null,"records_affected":385000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/utorrent-forums-hacked-change-your-passwords/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/utorrent-forum-hacked-database-stolen/"}],"summary":"The BitTorrent Client uTorrent, established by Ludvig Strigeus and later acquired by BitTorrent Inc., has issued a warning to its users regarding a security breach of their forum which allowed hackers to steal user information and password hashes of the site. Naturally, uTorrent ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-06","discovered_date":"2016-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e3e304443fa8a23677537c6079c3be166afbe7b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Empathia%20-%20Notice%20of%20Data%20Event%20Notice%20Only-%20CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"686e99bc2902","org_name":"Empathia, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62197"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Empathia%20-%20Notice%20of%20Data%20Event%20Notice%20Only-%20CA_0_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9623.pdf"}],"summary":"Empathia discovered spam files on a data server containing a file with personal information that was potentially accessed, though it had no evidence the information was accessed by an unauthorized individual.","supporting_quote":null,"technology_involved":["data server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c7e9b66c97d95e141c46d6b40921a9df8d0ea892","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/WashingtonElementary.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3823d47df017","org_name":"Washington Elementary School District","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/WashingtonElementary.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"RU","motive":"unknown","name":"Peace","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e3ec6fa88c2942e523f83269cf57ed02127784d","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Myspace%20user%20notification%20email_0.pdf"},"notes":null,"org_country":"US","org_id":"caa578f2efbd","org_name":"Myspace","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62164"},{"fetched_at":null,"title":"Have I Been Pwned: MySpace","type":"hibp","url":"https://haveibeenpwned.com/Breach/MySpace"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Myspace%20user%20notification%20email_0.pdf"}],"summary":"Myspace reported that login data from some accounts on its old platform was stolen and made available online.","supporting_quote":null,"technology_involved":["Myspace platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"actor_id":"peace"}},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"165bab8f017f2e906b6bcbb014d38938f56ece54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB7833CC-EA6B-47C5-864B-62D775458F45"},"incident_date":"2016-06-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4493bd1cfb12","org_name":"London Stock Exchange Group PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsweek.com/anonymous-hackers-london-stock-exchange-icarus-tech-466790?rx=us"}],"summary":"DoS attack on Stock Exchange","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f1661d51dd2efd725a00bdc1bc8b0590da241f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94FB9DA9-CBB3-443F-B273-902C0BCF3360"},"incident_date":"2016-06-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"7b358163bd28","org_name":"Mutuelle Generale de la Police","org_type":"financial","ransomware":null,"records_affected":112000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/world-europe-36645519;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/data-breach-exposes-112000-french-police-officers-two-weeks-after-isis-inspired-murder-1567873"}],"summary":"French police hit by security breach as data put online.  A data breach has impacted 112,000 French police officers after a file containing home addresses and telephone numbers was uploaded to Google Drive without strong protection  roughly two weeks after a police official was m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal"],"disclosed_date":"2016-06-02","discovered_date":"2016-05-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4799e9239ce17f1a2e1dd2f3c0fba7fd4455e593","impact_type":"data_theft","incident_date":"2016-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2016.05.25%20Email%20Notification_Important%20information%20about%20your%20LinkedIn%20account_0.pdf"},"notes":null,"org_country":"US","org_id":"e3b8cf264cdc","org_name":"LinkedIn Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62124"},{"fetched_at":null,"title":"Have I Been Pwned: LinkedIn","type":"hibp","url":"https://haveibeenpwned.com/Breach/LinkedIn"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2016.05.25%20Email%20Notification_Important%20information%20about%20your%20LinkedIn%20account_0.pdf"}],"summary":"LinkedIn notified members that data stolen in 2012 was being made available online and that the company became aware of this on May 17, 2016.","supporting_quote":null,"technology_involved":["LinkedIn accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14932ca1b2e8254d997530a6fd9ba4cac5bfa6f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26C520CF-5204-45BE-8A93-48AC93B2B42E"},"incident_date":"2016-06-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7336d4298720","org_name":"EXOS","org_type":"manufacturing","ransomware":null,"records_affected":854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/az-laptop-stolen-from-exos-contained-protected-health-information/"}],"summary":"Recently, we learned that the laptop of an EXOS employee was stolen from our facility. We have reported the theft to law enforcement, but it is unclear whether the laptop will be recovered. While, typically, laptops are not stolen to access the data on the laptop, we would like y","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3e5634074a1111f618be26076338579f4c4f4aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"647D2BB3-6F6C-48F1-8833-209B02BE1479"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f17e0389323","org_name":"Yukon Kuskokwim Health Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ykhc-investigating-possible-credit-card-fraud-against-employees/"}],"summary":"Credit card information from Yukon Kuskokwim Health Corporation employees may have been compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"614db0b8e4f7a578a22ad6fe24e2ccf4f53b5b9d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"553641B1-6C95-4159-A002-ABAE2E9C16F9"},"incident_date":"2016-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbbe6c4374f3","org_name":"St. Mary Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thereporteronline.com/article/RO/20160629/NEWS/160629821"}],"summary":"employee stole patients credit card","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"465b882da70d93b6b2dd60c56e933889a0eb3d54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60451ca0-6bee-11e7-97f1-7f40b0b1fd66"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9901fb914eb4","org_name":"Smyrna Police Department","org_type":"government","ransomware":null,"records_affected":28,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.11alive.com/news/crime/smyrna-police-analyst-arrested-for-stealing-personal-information-/452708395"}],"summary":"Smyrna Police employee arrested for stealing personal information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ea9f8971a37b060a874084ef5b8d8f781cb90e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38129A2E-5391-4780-AF82-7C78DD5AC570"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ffe19fae2d8","org_name":"SCAN Health Plan","org_type":"healthcare","ransomware":null,"records_affected":87069,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/scan-health-plan-notifying-members-of-unauthorized-access-to-their-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/scan-health-plan-reports-phi-breach-3565/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/hackers-access-scan-health-plan-breach-data-more-100000-patients"}],"summary":"On June 27, 2016 we learned that contact sheets, which are documents kept in a system used for sales purposes, had been accessed and possibly viewed for unauthorized purposes. We immediately began an investigation and brought in outside experts. We determined the unauthorized acc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e256c7ec255a89fc9bc97df9330f3a62c8349e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9A70867-85CF-4C16-B19C-72C5787F0AE1"},"incident_date":"2016-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"942e7811d674","org_name":"Rotech Healthcare Inc.","org_type":"other","ransomware":null,"records_affected":957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/rotech-healthcare-notifies-patients-whose-details-were-found-in-possession-of-unauthorized-individual/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/possible-phi-security-breach-in-fl-respiratory-facility;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.rotech.com/pdfs/Lakeland_Data_Breach_Notification.pdf"}],"summary":"Rotech Healthcare Inc. (\"Rotech\") would like to notify you of a recent incident that may affect the security of your personal and protected health information. We are providing you with information regarding the incident, steps we have taken since discovering the incident and wha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfaf97f64957531af587d5ea014c5efa44af43a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61FED834-E733-4B6B-B840-AD5BA8112B05"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"eab661d7ce00","org_name":"RMI Bodyshop","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.am-online.com/news/aftersales/2016/06/14/confidential-driver-data-subject-to-cyber-attack-or-physical-breach-reveals-rmi-investigation"}],"summary":"access to third party ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"969b7eef375bf97e8083c1d94290a0da538f7ae2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39B1FCE8-E94B-49DD-98AF-8B8E75F52F96"},"incident_date":"2016-06-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"213718ea3a49","org_name":"Quebec Liberals","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/quebec-liberals-strategy-meetings-were-leaking/"}],"summary":"default password exploited","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdfaacddbfa6ec788c3c5975b9aea408924eae06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A971A2A-33B9-4D9C-967E-614A7CEF6808"},"incident_date":"2016-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea52bc153eeb","org_name":"Powys County Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsnorthwales.co.uk/news/163616/llanfyllin-high-school-bus-row-confidential-names-mix-up-in-bus-row-report.aspx"}],"summary":"by copying and pasting the report into another programme, the County Times was able to see the full report,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"178d80d8947a0a6ae46f71a5831b0691e7e2e411","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8E0A132-87DE-4E00-AD25-918B84D19DCA"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"80b372bb6b02","org_name":"Oakland Police Department","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/164283010-story"}],"summary":"girlfriend typed up homicide reports for him, but then posted the confidential material online after learning he was married","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d055fbd3fb2d79ca9b6abeae9531a7e24a9ca27","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4D47CB5-1771-4785-A9D8-10E14E3799E6"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0deda51c52b","org_name":"Maryland Live Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://calvinayre.com/2016/07/25/casino/maryland-live-accuse-sue-vip-hosts-stolen-client-data-mgm-resorts/"}],"summary":"an allegedly pilfered list of high-rolling gamblers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81fc4443ad5c54f965887a65f5540c46753b0fcf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08a69320-8813-11e7-9a4a-fb58f2b09996"},"incident_date":"2016-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8c6eb667daee","org_name":"Lancashire Police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southportvisiter.co.uk/news/southport-west-lancs/dad-accuses-police-leaking-information-11593222"}],"summary":"Dad accuses police of leaking information about his children to web troll - Lancashire Police","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a09fc77af6830080fe95866b7a97403ae53c13ba","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D40C05F9-AD42-43AD-AFE3-9FCAEBD9AA7F"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c29e3c852ab","org_name":"King of Prussia Dental Associates and Pediatric Dentistry of Collegeville","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pa-king-of-prussia-dental-associates-and-pediatric-dentistry-of-collegeville-notify-patients-after-finding-computer-intrusion/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pa-king-of-prussia-dental-associates-and-pediatric-dentistry-of-collegeville-notify-patients-after-finding-computer-intrusion/"}],"summary":"Server hacked for dental clinic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1873971e95024419326199fba6e0aa12c3cf65f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71DF812B-0AB6-459B-BCD9-F993C3EB5861"},"incident_date":"2016-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"4de4e08d50c3","org_name":"JTB Corp","org_type":"other","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://asia.nikkei.com/Business/Companies/Personal-info-on-7.93-million-people-feared-leaked"},{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2016/06/14/japanese-travel-agency-suffers-massive-data-breach/"}],"summary":"Major Japanese travel agency JTB Corp. said Tuesday personal information on some 7.93 million people is feared to have been leaked due to unauthorized access to its server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a336103fc2a562813bc5bc2b4be2bbc29fc229fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60E2DA37-A245-4FF4-A738-80C6004296F6"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b956dd2b1774","org_name":"Illinois Board of Elections","org_type":"government","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://foxillinois.com/news/local/200000-illinois-voters-personal-information-compromised"}],"summary":"200,000 Illinois Voters' Personal Information Compromised - Hackers accessed a Board of Elections database through the state's online voter registration system back in June. The breach was discovered and stopped a month later.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99eeaac40ce7efd7aa70eb56cf11cd4c1c9e442d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"796F6440-4F21-42E9-A15A-71E0D9F97456"},"incident_date":"2016-06-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc6e7faa260","org_name":"i-Dressup","org_type":"technology_saas","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2016/09/social-hangout-site-for-teens-leaks-millions-of-plaintext-passwords/"}],"summary":"SQLi leads to database compromise of 5.5 million credentials to teen social site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fd10f132fa38cec4883fe9b51ed31701c8e89cf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cad8b500-da2e-11e7-a58f-dff506a792fb"},"incident_date":"2016-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"291b8f260219","org_name":"Government of Nunavut","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nunatsiaqonline.ca/stories/article/65674huge_potential_privacy_breach_accents_nunavuts_lax_file_transfer_syste/"}],"summary":"Loss of paper medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4598dae4127f45460e1c61bcbee8605e0e4f4d4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA4C8648-1B93-429B-9992-0B083C8BAE24"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e188a055e0d","org_name":"Glendale Adventist Medical Center","org_type":"healthcare","ransomware":null,"records_affected":528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/socal/glendale-news-press/news/tn-gnp-me-privacy-breach-20161202-story.html"}],"summary":"Glendale Adventist officials said in a statement on Friday that the protected health information of 528 patients was accessed without authorization by a hospital employee.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2873232a1bbf8f571be592167a49d6f395d260df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48e11560-1484-11e9-9b0e-db2459a65ffe"},"incident_date":"2016-06-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cb00eb573b33","org_name":"Facepunch","org_type":"technology_saas","ransomware":null,"records_affected":396650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://news.softpedia.com/news/information-of-396k-users-exposed-in-facepunch-data-breach-523291.shtml"},{"fetched_at":null,"title":"Have I Been Pwned: Facepunch","type":"hibp","url":"https://haveibeenpwned.com/Breach/Facepunch"}],"summary":"As reported by Troy Hunt's Have I Been Pwned breach notification service, the Facepunch game studio was the victim of a data breach in June 2016 which led to sensitive information of 396,650 users being exposed. Facepunch is a game development studio based in Wallsall, UK, known ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6920f3734826e0245b474240539c5fcea8b9109","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7381A4EF-4D5B-4FBA-8854-D24BA0530FBC"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3194ffd7997d","org_name":"Evony","org_type":"technology_saas","ransomware":null,"records_affected":34345472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/evony-gaming-company-website-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.leakedsource.com/blog/evony"},{"fetched_at":null,"title":"Have I Been Pwned: Evony","type":"hibp","url":"https://haveibeenpwned.com/Breach/Evony"}],"summary":"website and forum hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89f56df987c6b06d0903d27290d42310bb807b71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A3779CB-C0D6-40BC-B869-A990B1C59FD3"},"incident_date":"2016-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6631c231eb6","org_name":"Edmonton State Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbko.com/content/news/Glasgow-Police-release-picture-of-person-of-interest-in-ATM-skimming-384546811.html"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d04b3dd836331c96f8d13bfd80a6438437f53a67","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDC7131F-3AA8-4529-99EA-B0D81929F5A9"},"incident_date":"2016-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69c8bc406a80","org_name":"City of Janesville","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tmj4.com/news/local-news/computer-virus-knocks-janesville-website-offline"}],"summary":"Malicious email attachment exposes network to worm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a3da885160c0a96e11bd737f968a46b77de97c6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD0334F6-5783-44B1-A10B-B6CD55197DA2"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d226b89f69c1","org_name":"City of Calgary","org_type":"government","ransomware":null,"records_affected":3716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/wcb-city-privacy-breach-1.3734824;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.leaderpost.com/health/city+calgary+apologizes+data+breach+3700+employees+says+malice/12148728/story.html"}],"summary":"personal email used to send PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f823b8469bcb36a236d9c130451687abfcb73f87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4F98055-45C1-48EC-AA35-DDAF2F01E12C"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecf0776ccc3b","org_name":"Cerulean Studios","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.neowin.net/news/trillian-retires-blog-and-forums-after-server-breach-user-data-exfiltrated"}],"summary":"Trillian's blog and forums were involved in a security breach ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1bdfb1e627e9da37311c2bf0845256749eacec3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4968D4D7-9E0A-4F7F-8900-EBD927778499"},"incident_date":"2016-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"af0368b08fb4","org_name":"Camden Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.camdennewjournal.com/data-breach-camden-council;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.camdennewjournal.com/elderly-woman-robbed-data-loss"}],"summary":"insided passes elderly PII to outsiders for vishing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34fe98b201c820a786a37614e108fca0769f2a69","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"639C4C76-085C-4068-A007-B0195D71C323"},"incident_date":"2016-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f52d7d791928","org_name":"Athens Orthopedic Clinic","org_type":"healthcare","ransomware":null,"records_affected":397000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/atlanta-orthopedic-group-investigating-whether-they-are-thedarkoverlords-victim/"}],"summary":"Atlanta orthopedic group investigating whether they are TheDarkOverlord's victim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4f34b7aac6e188c34a26a284d6da3d2c20871cc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"529849A6-D5EC-4170-B88C-8C9A12EEF086"},"incident_date":"2016-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"904a4db1adcb","org_name":"Albany Medical Center","org_type":"healthcare","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/au-albany-hospital-staff-avoid-censure-over-confidential-patient-document-find/;"}],"summary":"A double-sided paper document listing the personal details of 11 mental health patients was found in the courtyard  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-31","discovered_date":"2016-05-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6074255162e1d6caa79577de1e8bd4e80a1c8c35","impact_type":"data_theft","incident_date":"2016-04-27","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Verity%20Health%20System%20-%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0f3d7d7a0144","org_name":"Verity Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An external individual impersonated a Verity executive in a phishing email, leading to employee information being disclosed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62088"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Verity%20Health%20System%20-%20Sample%20Notice_0.pdf"}],"summary":"An individual impersonating a Verity executive used an email phishing scam to obtain current and former employee W-2 information.","supporting_quote":"On May 22, 2016, we learned that a Verity employee was targeted on April 27, 2016, by an isolated email phishing scam in which an individual outside of Verity impersonated a Verity executive requesting certain information for Verity employees.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"946b0f3b95fb7d9e4e6094bc232cd9c95d3a3fdc","impact_type":"data_theft","imported_from":null,"incident_date":"2013-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e841204951c8","org_name":"Tumblr","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: tumblr","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tumblr"}],"summary":"Tumblr suffered a data breach in early 2013 that exposed over 65 million accounts, including email addresses and salted SHA1 password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b432789057cf2a3f82f27a87b279633740c2ab5b","impact_type":"data_theft","imported_from":null,"incident_date":"2011-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"1d29cbb72f36","org_name":"Fling","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fling","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fling"}],"summary":"Fling was hacked in 2011, and more than 40 million accounts containing personal information and plain-text passwords were obtained.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-27","discovered_date":"2016-04-27","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0f87d8cda1fe5c128c29df28504e38b0daf3106c","impact_type":"unknown","incident_date":"2016-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c151ce2ec5f0","org_name":"The Kroger Co","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#The%20Kroger%20Co-2016-05-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2853de60b6bbb388ea8e8023de667dccc6bc870","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e238ac23293d","org_name":"Fur Affinity","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fur Affinity","type":"hibp","url":"https://haveibeenpwned.com/Breach/FurAffinity"}],"summary":"A hack of the Fur Affinity website exposed email addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c81778c549df6e456a446941354046be4806728","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EECAAAD0-CC25-450D-8504-3592E193E353"},"incident_date":"2016-05-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bde9612e1d0e","org_name":"Sarina Russo","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-3613857/Recruitment-agency-Sarina-Russo-dumped-confidential-data-Melbourne-store.html"}],"summary":"documents found in garbage bin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33bec58f3cc29c7841498b74233ee32d31210348","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00204495-81A8-4D51-B4FE-896AA0F89DA2"},"incident_date":"2016-05-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d12ab28dbfaa","org_name":"NHS England","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-data-watchdog-probe-as-patient-records-go-missing-in-transit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/wires/pa/article-3610456/Data-watchdog-probe-patient-records-missing-transit.html"}],"summary":"outsourced courier company delivers wrong PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97bb24b46aac66ff3109f1e95a4f64852b14656c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F547C484-378E-4BA5-887C-5DAE7C0FB3CB"},"incident_date":"2016-05-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8421633b8bf7","org_name":"Shell Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://journalstar.com/news/local/911/credit-card-skimmers-found-on-lincoln-gas-pumps/article_98d0a111-b1bd-5389-9471-21613c3ea473.html"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bfa885df882e0b3a0fcd955947466e07b373caf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8AA22DE-57C1-41A2-8AE5-D158EE89901A"},"incident_date":"2016-05-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c3b67baa1b9f","org_name":"Movati Athletic","org_type":"other","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ottawa.ctvnews.ca/movati-hack-compromises-13-000-emails-1.2930062"}],"summary":"gym system hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3135b46b486f810f9d45e9b46694cbd083acc6c","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F146B52-0E90-484F-909B-7613DC003099"},"incident_date":"2016-05-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"3a645a527ca7","org_name":"FACC AG","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://businessinsights.bitdefender.com/cyber-fraud-ceo-fired;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/austrian-firm-fires-ceo-after-56-million-business-email-compromise-scam/"}],"summary":" \"bogus boss\" or \"CEO fraud\" cost FACC 47 M Euros","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"981a6fb9b5ff5fa0186c027b52e3102ad58ac271","impact_type":"unknown","incident_date":"2016-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/A%26A%20Concrete%20redacted%205_24_16_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af19d54ad6f5","org_name":"A&A Ready Mixed Concrete, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61962"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01791f417bb53498ee19f77248de21cd3cf040cc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"172F6E4B-1F48-4B8A-A0AE-391608947BF7"},"incident_date":"2016-05-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9c735be6bbe","org_name":"Pinal County Attorney's Office","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.12news.com/news/local/arizona/ransomware-virus-infects-pcao-case-files/225540620;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehackersamachar.com/2016/06/ransomware-virus-infects-pcao-case-files.html"}],"summary":"CryptoLocker ransomeware on Attorney's Office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"04b034de090cd4013ebb48f6386d09beb79004de","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/O'Charley's.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cce3b5d8661","org_name":"O'Charley's","org_type":"unknown","ransomware":null,"records_affected":40590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/O'Charley's.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcdd9eea0782531900962775d79332d0db91e7d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Berkeley%20Endocrine%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"8195ed2dfb32","org_name":"Berkeley Endocrine Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61958"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Berkeley%20Endocrine%20Notice_0.pdf"}],"summary":"Berkeley Endocrine Clinic inadvertently exposed recipients' names and email addresses by sending a notification email with the recipient list visible.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-21","discovered_date":"2016-07-06","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-10","id":"4d30b593f57e4dd6539a0b46cc4ec73f721bdb9b","impact_type":"unknown","incident_date":"2016-05-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://oag.ca.gov/system/files/CAexampleletter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c05546c52088","org_name":"Newkirk Products, Inc.","org_type":"professional_services","ransomware":null,"records_affected":3466120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Newkirk%20Products%2C%20Inc.-2016-08-17"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hack-of-former-dst-business-exposes-blue-cross-blue-shield-member-info/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkbw.com/news/data-breach-connected-to-bluecross"},{"fetched_at":null,"title":null,"type":"press","url":"http://medcitynews.com/2016/08/data-breach-bcbs-business-associate/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/newkirk-products-inc-provides-notice-of-data-breach-300309995.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/newkirk-products-inc-provides-update-to-notice-of-data-breach/;"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63412"}],"summary":"They announced a cyber security incident involving unauthorized access to a server containing certain personal information.  Newkirk is a service provider that issues healthcare ID cards for health insurance plans.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdeb265d3824373b1f89074c661717cbae3abc23","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98251f10-c573-11e7-bdb2-99e5dbe0676c"},"incident_date":"2016-05-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2168cefafc7e","org_name":"Hitachi Payments Services","org_type":"financial","ransomware":null,"records_affected":3200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/malware-hit-hitachi-payments-services-3-2-million-cards-affected/"}],"summary":"Malware installed on ATM network results in possible compromise of 3.2 million cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f63eec4cd98f205246bf2ebcdccf7aa17dfbb05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6a173b70-df73-11e7-98c9-5b20d709bc39"},"incident_date":"2016-05-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d6c0fce309b","org_name":"Stephenville Medical & Surgical Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/data-incident-involving-stephenville-medical--surgical-clinic-300466664.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.yourstephenvilletx.com/news/20170531/smsc-addresses-data-breach"}],"summary":"Stephenville Medical & Surgical Clinic has disclosed that it was involved in a data breach related to inadvertently emailing an archived list of patients to a single individual.  The incident occurred May 19, when an individual requested the clinic email a blank medical record re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"118b1e46d9ca88224f85fba58e8fe05259615f9a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Paper%20Tree%20resubmit-%20adults%20only_0_0.pdf"},"notes":null,"org_country":"US","org_id":"ff38e6738b46","org_name":"The Paper Works","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61876"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Paper%20Tree%20resubmit-%20adults%20only_0_0.pdf"}],"summary":"A break-in at The Paper Works resulted in the theft of a laptop and computer tower containing customer information.","supporting_quote":"We were the victim of an office break in on March 30, 2016.","technology_involved":["laptop","computer tower"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee42a27118864842a3a2cd836b6595ddd31e67e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"670385EC-C5CB-4C8B-8B35-23B2001BEF8D"},"incident_date":"2016-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"aebad08db6fe","org_name":"Government of Turkey Health System","org_type":"healthcare","ransomware":null,"records_affected":50000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/anonymous-hacker-claims-leak-hospital-data-more-10-million-turkish-citizens-1560985"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/turkish-citizenship-database-leak/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/did-some-disgrace-besmirch-anonymous-by-hacking-turkish-hospitals-and-leaking-sensitive-patient-info/"}],"summary":"A self-proclaimed member of the hacktivist group Anonymous has posted the extremely personal health information of scores Turkish citizens. According to a purported sample of the leaked information, that includes patients' HIV status and records of past abortions. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"excessive_privilege","credential_source":"unknown","cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-05-16","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bdef525fd197b55e35ca2bb441b9a8bd1eed656","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2011-06-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20Zocdoc_0.pdf"},"notes":null,"org_country":"US","org_id":"9137e0e382cc","org_name":"Zocdoc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Programming errors in username-access management allowed practice staff members to access the Provider Dashboard after their usernames were removed, deleted, or limited.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61838"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20Zocdoc_0.pdf"}],"summary":"Programming errors allowed some past or current practice staff members to access Zocdoc’s Provider Dashboard after their usernames were removed, deleted, or limited, potentially exposing personal and medical information.","supporting_quote":"This allowed some past or current practice staff members to access the Provider Dashboard, and therefore potentially view your personal information, after their usernames were removed, deleted or otherwise limited.","technology_involved":["Zocdoc Provider Dashboard"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04d8b0d9466d1632bcb78a9292cb4b79636bf60f","impact_type":"data_theft","incident_date":"2016-04-28","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20Proof%205.12.2016_0.pdf"},"notes":null,"org_country":"US","org_id":"d16714cf9c60","org_name":"Solano Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee responded to a phishing email, believing it was a legitimate request.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61842"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20Proof%205.12.2016_0.pdf"}],"summary":"A Solano Community College employee responded to a phishing email, and an investigation found that a copy of an individual's W-2 had been inadvertently disclosed.","supporting_quote":"On April 28, 2016, we learned that a “phishing” email was sent to an employee who responded to the email, thinking that it was a legitimate request.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31bf9db9709b58afcef0420b8b3c03f2a150b0d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA5B3125-D7BF-4C83-80C9-13CA803A8534"},"incident_date":"2016-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef217bb48bde","org_name":"Memorial Hermann","org_type":"healthcare","ransomware":null,"records_affected":12061,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/memorial-hermann-notifies-employees-of-privacy-incident/"}],"summary":"incident involving the disclosure of protected health information to select primary care physicians.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"bbf40b65b9a41ff1fb61f2d1bf960d58d81092e5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/MedicalColleaguesofTexas%2CLLP.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ced429a94db1","org_name":"Medical Colleagues of Texas, LLP","org_type":"unknown","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/MedicalColleaguesofTexas%2CLLP.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-16","discovered_date":"2016-04-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-13"},"first_seen":"2026-10-10","id":"70f7a14a701558e28fb4e4a411fade6588fc1c46","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-06-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"202a79b190e8","org_name":"Flurish Inc.","org_type":"financial","ransomware":null,"records_affected":12038,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Flurish%20Inc.%20dba%20LendUp-2016-05-16"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61852"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notice_0.pdf"}],"summary":"Flurish Inc. reported that personal information for some website visitors may have been made available to third-party companies through website widgets, beacons, and analytics trackers.","supporting_quote":null,"technology_involved":["website","website widgets","analytics trackers"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-13","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45cd3a4bd6007eecd4cdeb6abcecffada168042f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ADC04AB-6B96-4FE1-BF07-2BD41CAFF250"},"incident_date":"2016-05-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54b49f6d4ced","org_name":"Allergy, Asthma & Immunology of the Rockies, P.C.","org_type":"healthcare","ransomware":true,"records_affected":6800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/co-clinic-healthcare-ransomware-case-affects-6800-patients"},{"fetched_at":null,"title":null,"type":"press","url":"http://virusguides.com/another-ransomware-attack-medical-facility/"}],"summary":"Allergy clinic in Colorado recently found evidence of healthcare ransomware on its computer systems, causing the facility to shut down its server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-05-15","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c088cff003307041ab68d14242f1a91f88d8cd72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84D3682A-F418-4F8F-9E32-18FEE24D62B4"},"incident_date":"2016-05-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5571c7d61955","org_name":"Wendy's Co/The","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/columbus/news/2016/02/09/wendys-finds-malware-at-some-restaurants-during.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/06/theres-the-beef-wendys-breach-numbers-about-to-get-much-meatier/"}],"summary":"An advanced type of POS malware attacks over 350 Wendy's location's. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e13822e6697075801b8686cd02a59627867082a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef44aec0-e1dc-11e7-8553-197c24c367d2"},"incident_date":"2016-05-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4275fdc26e98","org_name":"St. Charles Health System","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bendbulletin.com/localstate/5806757-151/lawsuit-claims-bend-nurse-shared-confidential-medical-records"}],"summary":"St. Charles Health System is being sued for $500,000 by a patient who claims a nurse illegally shared his private health information without his permission.  Jason Miller was receiving treatment at St. Charles Bend on May 15, 2016, for injuries related to an all-terrain vehicle a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"JP","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aad7ad8792109233572887e6a30b2bcedda6295a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35686FFA-7E43-43EF-AC97-3E0214C2D79F"},"incident_date":"2016-05-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"b5c2fe1f4ca3","org_name":"South African Standard Bank","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://asiancorrespondent.com/2016/05/japan-13million-atm-hacking/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mainichi.jp/english/articles/20160522/p2g/00m/0dm/044000c;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/article/3074117/security/100-thieves-stole-127-million-from-atms-in-25-hours.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://businesstech.co.za/news/banking/128602/standard-bank-computer-was-hacked-in-r300-million-atm-fraud-hit/"}],"summary":"each person on average withdrew the maximum of 100,000 yen (US$913) from the 14,000 transactions involving 1,600 credit cards. The group mainly targeted ATM cash machines in 7-11 convenience stores as they accept foreign credit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2016-05-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d67d3fa81f4a0ca5874255a7b1b99fea80122d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC1760F6-243C-4F18-B183-F847C18F0117"},"incident_date":"2016-05-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8818b3f7d44a","org_name":"City College of San Francisco","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20CA%20Notice_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61821"}],"summary":"phising email lands PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","other"],"disclosed_date":"2016-05-15","discovered_date":"2016-04-25","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9e6ca7ad304dfc1393aa55f1ce18ea302191139","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CCHCS%20Breach%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61830"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CCHCS%20Breach%20Notification_0.pdf"}],"summary":"California Correctional Health Care Services reported that a workforce member’s unencrypted laptop was stolen from a personal vehicle; it did not know whether sensitive information was on the laptop.","supporting_quote":"An unencrypted laptop was stolen from a CCHCS workforce member’s personal vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"781099058bc33a1dafff7016bfacb1341be3f0e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01162181-5C7C-44DC-82E4-65B245F4045E"},"incident_date":"2016-05-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4941eb3e8005","org_name":"Walmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":27393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wal-mart-vendor-error-exposed-limited-patient-information/"}],"summary":"PII sent out via mail error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b57b9a523775e7cc58decd1228f16a4f3a50fa56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6448FAC9-3BDB-4F65-AE21-F9748E766CF1"},"incident_date":"2016-05-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c973c9d7cb72","org_name":"Okaloosa County Emergency Medical Services","org_type":"healthcare","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wjhg.com/content/news/Two-Oklaloosa-County-paramedics-facing-charges-in-selfie-competition-using-patients-387821631.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/two-oklaloosa-county-paramedics-facing-charges-in-selfie-competition-using-patients/"}],"summary":"paramedics take selfies with patients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d8d6e49e3df6a0e523777ab1cf32dc2f90a20a2","impact_type":"unknown","incident_date":"2016-03-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cf5e1e350d5","org_name":"Imperial Valley Family Care Medical Group, APC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61822"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b869710c64e0f1bf8d9485535d67265a6aa06445","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08E65BA0-8B33-4B63-83D4-6A259AE27392"},"incident_date":"2016-05-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b321ade34221","org_name":"Wal-Mart Stores Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox19.com/story/32016321/police-skimming-device-found-in-self-checkout-at-nky-walmart"}],"summary":"Self-Checkout skimmer at Walmart","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d72bdec6af4f90c7fe09ed4f5084a580210e233d","impact_type":"data_theft","incident_date":"2016-04-12","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9622.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"63079a68f17b","org_name":"Olympia School District","org_type":"education","ransomware":null,"records_affected":2145,"reviewed":false,"root_cause":"An employee provided an electronic file after an individual impersonating a district official requested employee information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9622.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9622.pdf"}],"summary":"An individual impersonating an Olympia School District official obtained an employee information file after requesting it from a district employee.","supporting_quote":"Before it was determined that the request was fra udulent, an electronic file was provided, which contained information about the affected employees.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e0b00f6df2f3f63b68880c1faf4ad72df5d526a","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Talbott%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"aef01f51a10b","org_name":"Lynn N. Talbott, Jr., CPA, CVA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Talbott%20Notification_0.pdf"}],"summary":"Lynn N. Talbott, Jr., CPA, CVA reported suspicious activity on a work computer and said personal and financial information may have been exposed.","supporting_quote":null,"technology_involved":["work computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4937f3ac889024b5e47772283a29f7cd9b31259f","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"4829817a73e0","org_name":"Rosebutt Board","org_type":"other","ransomware":null,"records_affected":107303,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Rosebutt Board","type":"hibp","url":"https://haveibeenpwned.com/Breach/RosebuttBoard"}],"summary":"Rosebutt Board was hacked, exposing 107,303 accounts containing email and IP addresses, usernames, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["IP.Board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"c067396aebbe33ed535022797f12a24d35d1bca0","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9621.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"280f60c7251e","org_name":"LendUp Processing Center","org_type":"financial","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9621.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9621.pdf"}],"summary":"LendUp Processing Center reported that personal information from some website visitors may have been made available to third-party companies through website trackers.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-10","discovered_date":"2016-03-10","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8a0bbbb13808fb00cabf9ea9d0d6bd86eda6d4ec","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-02-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9620.pdf"},"notes":null,"org_country":"US","org_id":"a39e92cbb8de","org_name":"Ameris Bank","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9620.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9620.pdf"}],"summary":"An unauthorized individual accessed an Ameris Bank loan officer's email account, where personal and financial information may have been accessible.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-09","discovered_date":"2016-04-13","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a380036f3f0b62672b1c36d292e60fa8039a7436","impact_type":"unknown","incident_date":"2016-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53ace7b81d5d","org_name":"Puppet, Inc.","org_type":"unknown","ransomware":null,"records_affected":409,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Puppet%2C%20Inc.-2016-05-09"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d0c1a2788f3115956683d5a40e1ad74a660d50c","impact_type":"data_theft","imported_from":null,"incident_date":"2016-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"890f09d529e9","org_name":"Nulled.cr","org_type":"other","ransomware":null,"records_affected":599080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nulled.cr","type":"hibp","url":"https://haveibeenpwned.com/Breach/Nulled"}],"summary":"Nulled.cr was hacked and 599,080 user accounts, including personal information, password hashes, and private messages, were leaked publicly.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba4403f8187be2d4163a03fbe668fe926c903ed0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"836704A6-479C-47D3-8427-7B7AE941C662"},"incident_date":"2016-05-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"230d1fa00402","org_name":"GetME","org_type":"transportation_logistics","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://rideshareacademy.com/getme-disaster-austin-tx/"}],"summary":"email with GetME drivers emails exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de2f96ae88f83e8ccb78b74728dde72d8a77ae9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA3E762F-1EE2-43A5-A834-E4BE65546380"},"incident_date":"2016-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"ce60a812f2c7","org_name":"Gatecoin","org_type":"financial","ransomware":null,"records_affected":185250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thestack.com/world/2016/05/16/2-million-lost-in-bitcoin-cryptocurrency-hack/"}],"summary":"Breach at digital currency exchange leads to 2M in losses","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f10b8c26c13fca3e2d5dbeb90aee1c964b77b70f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ae1ed80-de20-11e9-b511-f75921c18742"},"incident_date":"2016-05-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"3deb9f10c957","org_name":"Singapore Red Cross","org_type":"healthcare","ransomware":null,"records_affected":4300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.france24.com/en/20190516-red-cross-website-hacked-latest-singapore-cyber-attack"}],"summary":"The Singapore Red Cross said Thursday its website had been hacked and the personal data of more than 4,000 potential blood donors compromised in the latest cyber attack on the city-state.   In the latest attack, Singapore Red Cross (SRC) said personal details, including names, bl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2863c991df01ae4e1b63e10eb72c58d0d5f81da2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D23CF02F-40D2-432E-9E2C-C551D79AACD7"},"incident_date":"2016-05-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a092b44cd019","org_name":"City of Houston","org_type":"government","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/personal-information-of-hundreds-of-city-of-houston-employees-exposed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.khou.com/news/investigations/personal-information-mistakenly-sold-at-city-auction/183295944"}],"summary":"Locked file cabinet with city employee information exposed through auction.  Documents were located in locked file cabinet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83722518df39b1c5160acfdb931532cc4fc50302","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"267B45F3-FE72-4B8F-9FE5-71406C8B050E"},"incident_date":"2016-05-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a5fea88a66a8","org_name":"Bark","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/ottawa/dog-charity-gets-files-back-after-ransomware-scam-1.3620986"}],"summary":"Dog charity pays hackers ransom ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec532d94856e7e40b86ccd513fe60dc6ccc6d028","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-08","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/49932072_6_1.pdf"},"notes":null,"org_country":"US","org_id":"486a154c7f54","org_name":"Stonebridge Realty Advisors, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61691"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/49932072_6_1.pdf"}],"summary":"Stonebridge Realty Advisors reported that malicious software on its payment processing systems may have captured payment card information.","supporting_quote":"Based upon an extensive forensic investigation, it appears that unauthorized individuals installed malicious software on our payment processing systems that was designed to capture payment card information as it is inputted into those systems.","technology_involved":["payment processing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5b9704bb6fd36c611ad55ff4ca660902ebb121d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Google%20-%20Individual%20Notification%20Letter%20%28California%29_0.pdf"},"notes":null,"org_country":"US","org_id":"0e9f335c7c68","org_name":"Google","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61707"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Google%20-%20Individual%20Notification%20Letter%20%28California%29_0.pdf"}],"summary":"A Google benefits-management vendor mistakenly sent a document containing some Googlers' names and Social Security numbers to a benefits manager at another company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-06","discovered_date":"2016-02-29","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"d6954c3e1745c7fc1f1bdbec8b042baf6b91d8a6","impact_type":"unknown","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea04e66dcb24","org_name":"EqualizeRCM Systems","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#EqualizeRCM%20Systems-2016-05-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17e9ab50440ee1960b963128353060d20607e2ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BC3802D-31CE-4A11-86DA-57091F334467"},"incident_date":"2016-05-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc10c353798a","org_name":"Popeyes","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/business/bizfeed/article/Data-breach-reported-at-Houston-area-Popeyes-10868341.php"}],"summary":"The company's credit card processor told CCC Restaurant on July 9 that it spotted \"unusual activity,\" according to a company statement. CCC Restaurant then hired a third-party forensic expert.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d133ad9c65951a83823cbfbaf9794e779e0cf30b","impact_type":"unknown","incident_date":"2016-02-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hume%20Lake%20-%20CA%20Notice%20Letter_Redacted%20%286105565x7AB84%29_1.pdf"},"notes":null,"org_country":"US","org_id":"87d0776c905e","org_name":"Hume Lake Christian Camps","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61646"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hume%20Lake%20-%20CA%20Notice%20Letter_Redacted%20%286105565x7AB84%29_1.pdf"}],"summary":"Hume Lake Christian Camps sent a consumer notification letter concerning a security incident, but the provided text does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-05","discovered_date":"2016-04-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cc84c0be90173112f05b998da3edd05344a9655","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSU_Adult_Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"db8d6d783886","org_name":"California State University Northridge","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An ID and password were mistakenly published on a staff resources webpage visible to anyone with its specific URL.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61666"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSU_Adult_Notice_0.PDF"}],"summary":"California State University Northridge found that an ID and password published on a staff resources webpage could potentially allow access to personal information of educational program applicants.","supporting_quote":"CSUN immediately began an investigation and discovered that an ID and password were mistakenly published on an internal-facing CSUN staff resources webpage that was visible to anyone with the specific website address, potentially allowing access to personal information of CSUN EOP applicants.","technology_involved":["CSUN staff resources webpage"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58c6adf2abeb02609b24f5f8b7d1197c1e706cc1","impact_type":"unknown","incident_date":"2015-01-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BACA%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fd7f6097e75e","org_name":"Bay Area Children's Association","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61688"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00af4b593cd4507a8f5c30551ad3ffd720c22524","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pro%20Sports%20Daily%20Security%20Breach%20Response%20Letter-Final_1.pdf"},"notes":null,"org_country":"US","org_id":"b7fd227e6471","org_name":"Tribune Media","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61644"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pro%20Sports%20Daily%20Security%20Breach%20Response%20Letter-Final_1.pdf"}],"summary":"Tribune Media reported that a breach involving the ProSportsDaily Forum database may have exposed user email addresses, passwords, and possibly other account information.","supporting_quote":null,"technology_involved":["ProSportsDaily Forum website","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a7bb137518b0d454c33bc5bee523059cbe43c3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12798C86-98CC-4E35-B811-187BF4E33A2C"},"incident_date":"2016-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6bbdc64f09f","org_name":"Midwest Orthopedics Group","org_type":"healthcare","ransomware":null,"records_affected":655000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dailyjournalonline.com/news/local/local-medical-group-involved-in-computer-hack-identified/article_1dfafa55-d3d5-54ba-98cf-bdccafeed7a0.html"}],"summary":"Database breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-03","discovered_date":"2016-04-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a8b77490fd1bd60f1270d11f85800f46990ba37","impact_type":"data_theft","incident_date":"2016-01-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lafler%20AllClear%20letter%20Proof_1.pdf"},"notes":null,"org_country":"US","org_id":"0faffc71faa5","org_name":"Lafler Moore Connerty & Webb, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61621"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lafler%20AllClear%20letter%20Proof_1.pdf"}],"summary":"An unauthorized individual copied information from the firm’s tax processing software.","supporting_quote":null,"technology_involved":["tax processing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-03","discovered_date":"2016-03-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e7eb1b0a0c09b4cf0c812ea0ba3db1322f99424","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ken%20Waterman%20CPA%20Notice%20Only_0.pdf"},"notes":null,"org_country":"US","org_id":"652e0021d3f8","org_name":"Ken Waterman CPA, PC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61628"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ken%20Waterman%20CPA%20Notice%20Only_0.pdf"}],"summary":"Ken Waterman CPA, PC reported that files containing tax-filing information may have been accessed by an unauthorized individual.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-05-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e68c161864573c7079cddabe6af1482e735d4dbe","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-03-25","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Charles%20Schwab%20resubmitted%20May%204_2016_0.pdf"},"notes":null,"org_country":"US","org_id":"1779e7a63f6c","org_name":"Charles Schwab & Co., Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Someone may have reused credentials obtained from a non-Schwab account or website to access Schwab.com.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61626"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Charles%20Schwab%20resubmitted%20May%204_2016_0.pdf"}],"summary":"Someone used credentials possibly obtained from a non-Schwab account or website to access Schwab.com accounts.","supporting_quote":"We believe someone may have obtained your username and password from a non-Schwab account or website that you use and tried them successfully on Schwab.com.","technology_involved":["Schwab.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcebbb98719879ab3a991e91ea5cdfeb0d825d32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DE4B5E0-9B3E-451F-8074-F99594676D38"},"incident_date":"2016-05-02","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7a1968c5d7b","org_name":"Saint Agnes Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2812,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/2800-st-agnes-medical-center-workers-compromised-in-w-2-attack/article/494770/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/kfsn-tv-employees-at-saint-agnes-medical-center-dealing-with-possibility-of-identity-theft/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/SAMC%20Data%20Breach%20Notification_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61673"}],"summary":"St. Agnes Medical Center in Fresno, Calif., reported that about 2,800 staffers had their W-2 information compromised by a spearphishing attack earlier this month.  On May 2 a hospital staffer received an email purportedly from St. Agnes CEO Nancy Hollingsworth asking that the emp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e7ae0e84119980125292215172ed932a8f38de91","impact_type":"unknown","incident_date":"2016-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71b4edfebd54","org_name":"ProSchools","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#ProSchools-2016-05-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d78b07d82770998e31d19db22e9f0b7eb103054","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F6264FE-EFAE-4BA5-9EC2-BB4867BF7BDB"},"incident_date":"2016-05-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ce68f30f939","org_name":"Palm Beach County Teachers","org_type":"education","ransomware":null,"records_affected":5800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/5800-palm-beach-county-teachers-notified-of-data-security-breach/"}],"summary":"SSN emailed to vendor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-05-02","discovered_date":"2016-04-05","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"442fdd6d82872f781b85238006d325fea9433cda","impact_type":"data_theft","incident_date":"2016-04-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9618.pdf"},"notes":null,"org_country":"US","org_id":"15e1e5013244","org_name":"Kline Galland Home Care Services","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9618.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9618.pdf"}],"summary":"Kline Galland Home Care Services reported that paper records containing protected health information for four individuals were stolen from a motor vehicle.","supporting_quote":"concerning the breach of protected health information in paper record form, concerning 4 individuals, occurring by theft from a motor vehicle and discovered 4/5/2016.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"699910b134d9a3bf7416209a1cc054e53a58043e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D66F8A88-A7CE-44D3-8FBB-948D79939099"},"incident_date":"2016-05-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99b24b21060d","org_name":"Division of Adult Institutions' California Health Care Facility","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/california-dept-of-corrections-privacy-breach-3495/"}],"summary":"Email misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d71c77a0339c4e410c40666ff1c4f59939eccc3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28B343EF-1C6B-4099-8233-3B45A9A23257"},"incident_date":"2016-05-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"710a4dcdf78f","org_name":"Cardiology Associates, P.C.","org_type":"healthcare","ransomware":null,"records_affected":907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cardiology-associates-pc-notifies-patients-of-employee-misconduct/"}],"summary":"employee emailed PII to personal email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2862006275107b8f3a63ed1a927145e1974b3a8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18C585D7-5C51-4A8C-ADFE-C990F19E6CA6"},"incident_date":"2016-05-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf6bca678de1","org_name":"California Health Care Facility","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/california-health-care-facility-email-gaffe-results-in-notifications/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CHCF%20Privacy%20Breach%20Letter_0.pdf"}],"summary":" erroneously emailed to an unauthorized recipient ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c61d2adc8be4e2e1db7d0b95b40671b81d57cf39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39352080-eeaf-11e7-b683-c1703914e4a4"},"incident_date":"2016-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fe6b822185b","org_name":"Watsonville Chiropractic Inc./David W. Christie, D.C/ Luque Chiropractice, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64960;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/doc05680520161117112652_0.pdf;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Christie%20Minor%20Notice%20%282%29_0.pdf;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Christie%20Adult%20Notice_0.pdf"}],"summary":"On September 11, 2016, we were notified by our billing software company that their Amazon “S3” storage account was vulnerable because it was accessible to persons outside their organization, and that a security researcher who works for a software company accessed and downloaded i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52a43f154e135412d3edaec8bec89bdb5223e23e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CE551BB-9242-47CE-9063-E7F1A7DCCF35"},"incident_date":"2016-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2b1fd836d01","org_name":"Washington State Liquor and Cannabis Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/washington-marijuana-applicants-personal-info-subject-to-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestranger.com/slog/2016/06/13/24182582/the-state-accidentally-released-a-boatload-of-personal-data-on-pot-license-applicants;"},{"fetched_at":null,"title":null,"type":"press","url":"http://420leaks.com/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thecannabist.co/2016/06/07/washington-marijuana-data-breach/55731/"}],"summary":"database not password protected","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc10b37841fd5cc363bc14aa90dd85f374c3a911","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9BC2909-EF6C-4B64-9A40-6F64A72CAC7C"},"incident_date":"2016-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"bfa2199e0213","org_name":"Veterans Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-veterans-affairs-admits-to-another-privacy-breach-by-canadian-legion-staff/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.nationalpost.com/news/canada/canadian-politics/veterans-affairs-admits-to-another-privacy-breach-by-canadian-legion-staff"}],"summary":"Veterans Affairs admits to another privacy breach by Canadian legion staff","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26b44d01f09ebff10921ab4ac992ffcfaffcd283","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b8068470-d952-11e7-a452-77d2890a67ae"},"incident_date":"2016-05-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59c1ffb713ef","org_name":"Vascular Surgical Associates","org_type":"healthcare","ransomware":null,"records_affected":36496,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/phi-data-breach-stems-from-computer-hacking-at-ga-entity"}],"summary":"Use of stolen vendor creds","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"840ad55372c05723288e0ced6822887e29cafb87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5B492C1-F830-4889-83CD-715E244B13D6"},"incident_date":"2016-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"853f65a00420","org_name":"Rexall","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.citynews.ca/2016/05/31/rexall-hands-out-patients-confidential-health-records-to-wrong-person/"}],"summary":"Rexall hands out patient's confidential health records to wrong person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a095a2a12c39f9c55444839b4fed03ddb73137f","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"QA","org_id":"6c645380d499","org_name":"Qatar National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attack began by exploiting a SQL injection flaw in the bank's website.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Qatar National Bank","type":"hibp","url":"https://haveibeenpwned.com/Breach/QatarNationalBank"}],"summary":"Qatar National Bank's website was reportedly exploited through SQL injection, exposing documents containing account and customer information.","supporting_quote":"Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website.","technology_involved":["bank website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":"NG","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7e87d9cd139bbbcaa026626f46e758a727b51a5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D13A77F6-A559-46D5-81A0-BEC6681E2071"},"incident_date":"2016-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac9ef238e656","org_name":"Los Angeles County","org_type":"government","ransomware":null,"records_affected":756000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3151098/security/phishing-email-scams-108-government-employees-756-000-people-affected-by-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2016/12/18/hack-la-county-emails-exposes-data-750000-people.html"}],"summary":"Phishing works.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1078","T1486"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"417ab2dac77e2c9d3c8307f1d1b2843d51a2943d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66d05780-e2d9-11e7-a8b4-b50015373b0a"},"incident_date":"2016-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"944551f515e0","org_name":"Landmark Cancer Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nwaonline.com/news/2017/nov/17/rogers-cancer-center-accused-of-fraud-c/?latest"}],"summary":"Landmark Cancer Center in Rogers claimed its competitor, Highlands Oncology Group, attempted to encrypt Landmark's computer system last year and engaged in other deceptive and illegal actions.  Landmark claims, for instance, around May of last year someone used the credentials of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07795a8ed74b5cbcbe02e06e9e71c10e6b2621a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5781ED60-D06B-4B8A-AF42-88168625A5C1"},"incident_date":"2016-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54b12378d329","org_name":"Kalamazoo College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox17online.com/2016/04/30/phishing-email-gets-copies-of-kalamazoo-college-employee-w-2s-from-2015/"}],"summary":" email that looked like it was from an administrator at the college","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e8f22832a875827db8076adbcaab49a1d3a85ba","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"176103f0-a9dd-11e7-8c20-836b8b691ede"},"incident_date":"2016-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd8f3a3ef1f3","org_name":"Georgia United Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.daltondailycitizen.com/news/local_news/bank-employee-charged-with-stealing-about/article_081040f9-73ba-5524-9592-494238d094f0.html"}],"summary":"Bank employee charged with stealing about $36,000 - Georgia United Credit Union","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4dce6d8f79e15fa049c74dda4ed08a24c6b6f18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED61FA9D-22DB-4DCE-B740-1BE716107BF2"},"incident_date":"2016-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3179ffc8922f","org_name":"First Home Plan","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatchewan/saskatchewan-government-breach-privacy-first-home-plan-1.3603595"}],"summary":"mail account sent an application form to a number of people, on Wednesday. It failed to hide those addresses, allowing anyone with access to those emails to target potential home buyers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab85183a00f36b5463a1dd982e1d61b480187784","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"181253c0-93fe-11e7-967f-a9fa27eb51b9"},"incident_date":"2016-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4cf84cf63f53","org_name":"Commercial Bank of Ceylon","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/commercial-bank-of-ceylon-website-hit-by-hack-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/commercial-bank-ceylon-website-hit-by-hack-attack-1560271"}],"summary":"Commercial Bank of Ceylon website hit by hack attack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Anonomous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34b41f15ebcb9ad7e2be0765db07b10d3ead9290","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7405B5B9-E071-4430-92F5-0094B1B6D3DC"},"incident_date":"2016-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"58c68002c7f8","org_name":"Central Bank of South Korea","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/hackers-hit-central-banks-in-indonesia-and-south-korea/"}],"summary":"DDoS Central Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonomous"}},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de64323f75da6ecfacb634eb587d58e2bf911a8a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB66053D-49CA-47A9-B801-EE2CAC68D6CB"},"incident_date":"2016-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"3762bb8dc61e","org_name":"Central Bank of Indonesia","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/hackers-hit-central-banks-in-indonesia-and-south-korea/"}],"summary":"DDoS on central bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"992dcdd86187c1b6d4010dbf62fdc786eab66c7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A531CF0-7D97-418B-97D1-98E4C3B8CF64"},"incident_date":"2016-05-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2655b89ba6c1","org_name":"Brunswick Corporation","org_type":"manufacturing","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/large-number-of-brunswick-corporation-employees-being-notified-of-w-2-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wearegreenbay.com/news/local-news/mercury-marine-hacked-employees-personal-information-stolen"}],"summary":"a sophisticated phishing incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58f3c8d178b8db71159f5c85bfc4470f60ce6220","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"246133A1-FE2A-407F-9419-A3F09E83AE3F"},"incident_date":"2016-05-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f15464564f1","org_name":"Blaine Chiropractic Center","org_type":"healthcare","ransomware":null,"records_affected":1945,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-recent-additions-to-hhss-breach-tool/"}],"summary":"On May 14, 2016, we discovered unauthorized software installed by an unknown person using a hidden administrator account. During our investigation, it was discovered that the administrator account had been created and subsequently made hidden by our third party software vendor at","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AL","motive":"unknown","name":"bRpsd","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a9c397711c46fa99d2ab850ac4806983b041add","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"829A1BCB-26F4-41B1-AC5C-C1B2BEE73268"},"incident_date":"2016-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e5f02b2657af","org_name":"Besa Mafia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/besa-mafia-hitman-for-hire-site-hacked-data-dumped/"}],"summary":"dark web hit man for hire site hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"brpsd"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ae42000d2cff0b83925e1b081e2bf650928aa24","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6903E3C6-CBC4-4711-BBB7-F78CC1D53A3A"},"incident_date":"2016-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d56bf100d86","org_name":"Bedford County School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.t-g.com/story/2350108.html"}],"summary":"breach of employees' health insurance information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"105baaa56e81bc07111e0e86d807f3f0b1c4b071","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7B55F2E-FCA8-43A9-89D8-1102EE49275F"},"incident_date":"2016-04-29","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"73389564db45","org_name":"Rhode Island Blood Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://turnto10.com/news/local/ri-blood-center-victimized-by-phishing-scam"}],"summary":"Phishing scam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75a577ba908880bca50a151fe6547383ddc6b7d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2B87A55-CA7D-464E-B58E-DFC1E2AE8DD1"},"incident_date":"2016-04-29","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f688e6de5ae0","org_name":"Areas","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Sample%20Notification_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61634"}],"summary":"email phissing schemem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2f7c5038401545f2f21fda6e913d8f01ac38a0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B36ED8D-559C-4106-978D-B6C2834F8D4A"},"incident_date":"2016-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"0aaad8efe68b","org_name":"Kenyan Ministry of Foreign Affairs and International Trade","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/anonymous-hackers-claim-steal-1tb-data-ministry-foreign-affairs-kenya-1557218;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/opafrica-sees-anonymous-leak-1tb-of-data-from-kenyan-ministry/"}],"summary":"Government fileserver compromised by hactivist group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50bf149a106fd3cb09883f53e87ea9bed38a8d71","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"464A4391-01FE-4991-8C97-DB36CA56AB09"},"incident_date":"2016-04-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94351f51d570","org_name":"Associates in Eye Care","org_type":"healthcare","ransomware":null,"records_affected":971,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/va-associates-in-eye-care-notifies-patients-of-breach/"}],"summary":"laptop theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e53ca55b5529cdd21a555bd5ce91d73671431934","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/21stCenturyOncology.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"91285d6b5e59","org_name":"21st Century Oncology","org_type":"unknown","ransomware":null,"records_affected":97842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/21stCenturyOncology.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c37bc2a6c54cc64ff2de4072bef1afedad1b9076","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80864D27-8AD1-449E-B21F-F251FA933375"},"incident_date":"2016-04-27","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7c9b924f867","org_name":"Verity Health Systems","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/employee-information-compromised-in-verity-health-systems-breach/article/500568/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Verity%20Health%20System%20-%20Sample%20Notice_0.pdf"}],"summary":"Verity Health Systems was targeted in an email phishing scam that resulted in the unauthorized release of employee W-2 information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-27","discovered_date":"2016-04-18","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f06c21ba28eaeb78891edbb89dab796d9b79ecfc","impact_type":"unknown","incident_date":"2016-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f30233f5c52","org_name":"Michels Corporation","org_type":"unknown","ransomware":null,"records_affected":8161,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Michels%20Corporation-2016-04-27"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f726715cafbecffe8b113440d9a987e97ab186c6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/AIMInc.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"32df92e0b86d","org_name":"AIM, Inc.","org_type":"unknown","ransomware":null,"records_affected":1639,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/AIMInc.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9617.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31842ad64c57eb825aa23d19222e6423ee1f2abe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE50FF1F-2AEB-4106-AFF3-73EBA1283CAD"},"incident_date":"2016-04-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84b63a5f2b40","org_name":"Noble House Hotels and Resorts","org_type":"other","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eturbonews.com/74004/us-secret-service-notified-ocean-key-resort-spa-about-credit-car;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/pos-malware-hits-two-hotel-chains-a-9364"}],"summary":"POS attack on hotel chain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9144aaf62aa29aa6a66b189bd8eb8d983acd542","impact_type":"unknown","incident_date":"2015-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/%23130774091%2C%20v1%20_LEGAL_%20-%20LuckyPet%20Multistate%20Notification%20%20%20-%20WorkSite%20Acrobat%20Integration_Redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1fba9b1eafcb","org_name":"LuckyPet, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61371"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-26","discovered_date":"2016-04-04","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f8219a52444de9fdc8d3d18d79a82b8bc31f2e0a","impact_type":"unknown","incident_date":"2016-04-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2a28482ed56a","org_name":"Advanced International Marketing, Inc.","org_type":"unknown","ransomware":null,"records_affected":63888,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Advanced%20International%20Marketing%2C%20Inc.-2016-04-26"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bab69eefb0fb4af90e2590b6b087be57fa311b39","impact_type":"unknown","incident_date":"2016-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0d771359584e","org_name":"Advance International Marketing, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61377"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc381fe5a43bb8c40fe19e37bf6656a579c31dc1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9E617D2-1391-4872-A9A1-D71CAC15742D"},"incident_date":"2016-04-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b1723b3905f","org_name":"Ursus Holdings, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notification%20Proof_1.pdf"}],"summary":"employee's email account began sending \"blast\" or \"spam\" emails.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"4e1f27a39960933c4db15ab28d43d0c5bb3c023d","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/Odyssey.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01ebc9086342","org_name":"Odyssey Logistics & Technology Corporation","org_type":"unknown","ransomware":null,"records_affected":64,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/Odyssey.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcb9e55f822836051aa876f67da1c146e0561960","impact_type":"data_theft","imported_from":null,"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"eb61f79c4f50","org_name":"Lifeboat","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lifeboat","type":"hibp","url":"https://haveibeenpwned.com/Breach/Lifeboat"}],"summary":"Lifeboat was hacked in January 2016, and usernames, email addresses, and password hashes were leaked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-04-25","discovered_date":"2016-12-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5346f3f19274884330eabc2241fc10cc64fb0041","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ICC%20Notice%20only%20California%20AG%20Notification%20Letter%20-%20ICC_0.pdf"},"notes":null,"org_country":"US","org_id":"377a56c3a33d","org_name":"International Code Council","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-66065"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ICC%20Notice%20only%20California%20AG%20Notification%20Letter%20-%20ICC_0.pdf"}],"summary":"The International Code Council reported that customer names, addresses, and payment card information may have been compromised through its online store.","supporting_quote":null,"technology_involved":["online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2016-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94c1d8464092c7541018df9aeaddba0c286d1a77","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"31f320f19e6e","org_name":"Beautiful People","org_type":"technology_saas","ransomware":null,"records_affected":1100089,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Beautiful People","type":"hibp","url":"https://haveibeenpwned.com/Breach/BeautifulPeople"}],"summary":"Beautiful People’s dating website was hacked in November 2015, and 1,100,089 accounts were leaked.","supporting_quote":null,"technology_involved":["dating website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"439b83cb19936e7f0170e9390ada35b50b01afed","impact_type":"data_theft","imported_from":null,"incident_date":"2016-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7b4721a44d6a","org_name":"TruckersMP","org_type":"technology_saas","ransomware":null,"records_affected":83957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: TruckersMP","type":"hibp","url":"https://haveibeenpwned.com/Breach/TruckersMP"}],"summary":"A February 2016 breach exposed 83,957 TruckersMP user accounts, including email addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91ce6e1a9ccc846a3a1433753ad43d35c39b24d9","impact_type":"data_theft","imported_from":null,"incident_date":"2016-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"50eba8fb12be","org_name":"Naughty America","org_type":"other","ransomware":null,"records_affected":1398630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Naughty America","type":"hibp","url":"https://haveibeenpwned.com/Breach/NaughtyAmerica"}],"summary":"Naughty America was hacked in March 2016, and data including personal information, passwords, and website activity was sold online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11b9399924a3003a3b30fcf935ff674bc0aeba21","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FB0C3B9-59FF-4760-94D3-6BA9F4ABD6AB"},"incident_date":"2016-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dda17026c377","org_name":"Social Worker","org_type":"healthcare","ransomware":null,"records_affected":27,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southwalesargus.co.uk/news/14544537.Council_could_be_fined_after_confidential_documents_stolen_from_social_worker__39_s_house/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.clydebankpost.co.uk/news/14461542.Drumchapel_social_worker_notes_found_in_street/"}],"summary":"stolen confidential documents from home","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24faa449af1b5a7ab22cbf36f97aac7b64c67ab8","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BerkeleyUSD-NotificationBANG-sample_0.pdf"},"notes":null,"org_country":"US","org_id":"dc7868b13c3d","org_name":"Berkeley Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The District inadvertently sent an electronic file containing social security numbers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61243"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BerkeleyUSD-NotificationBANG-sample_0.pdf"}],"summary":"Berkeley Unified School District inadvertently sent a reporter an electronic file containing social security numbers and asked the reporter to delete it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b09491b2734efc0a55a5d818c061e577e16221ad","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VFA%20Fraud%20Case%20Individual%20Notification%20Letter%20CA%20%284-20-16%29_0.pdf"},"notes":null,"org_country":"US","org_id":"d563e721e1a6","org_name":"Voya Financial Advisors, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VFA%20Fraud%20Case%20Individual%20Notification%20Letter%20CA%20%284-20-16%29_0.pdf"}],"summary":"A perpetrator used a financial advisor’s personal information to access Voya Financial Advisors’ systems, where client records may have been viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-04-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d52e5b5798fc2f4afde9f227d5e537ecff83914","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DCB2C83-A99A-4D5E-8CA3-9904EB1C1630"},"incident_date":"2016-04-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"280de635b6e0","org_name":"Arlington Public Schools","org_type":"education","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://edscoop.com/arlington-public-schools-data-breach-compromises-staff-info"}],"summary":"hacked school site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-04-20","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3335bf15bfd3b5549ea8cde4a25516110a94c9fb","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20California%20Form_0.pdf"},"notes":null,"org_country":"US","org_id":"925d3e396fe2","org_name":"U Gym, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61177"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Notice%20California%20Form_0.pdf"}],"summary":"U Gym reported that computers containing payroll data and personal information were stolen from its corporate office.","supporting_quote":"On April 4, 2016 we had several computers stolen from our corporate office in Santa Ana, California.","technology_involved":["computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd471698c8704c330ee9243262814c013554d3f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA766952-4DB4-4192-82AD-3C1BE248DAE0"},"incident_date":"2016-04-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31e33f3578f7","org_name":"Vancouver Public School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wa-vancouver-student-expelled-for-hacking-high-school-email-system/;"}],"summary":"Student hacked into teacher's email and sent out a mass mailing to \"Make America great\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"7a4a60d7cb9be117c736f8eabda01d2bfe85d932","impact_type":"data_theft","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9616.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2d2bb1e0a5f6","org_name":"doTERRA International LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":9737,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9616.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#DOTERRA%20INTERNATIONAL%20LLC-2016-05-02"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/doTerraInternational%2CLLC.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9616.pdf"}],"summary":"An intruder accessed systems of a third-party vendor providing doTERRA data hosting and software services, resulting in the unauthorized acquisition of customers’ and Wellness Advocates’ personal information.","supporting_quote":"We are writing to notify you today that a third-party vendor that provides dOTERRA with data hosting and software services recently informed us that an intruder had accessed some of the vendor’s systems.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2638fbb4c0045044f9fc41426a7b8615e44c347","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/doTERRA%20-%20Individual%20Notification%20Letter%20%28California%29_0.pdf"},"notes":null,"org_country":"US","org_id":"ba9d0b73cdd5","org_name":"dōTERRA International","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61140"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/doTERRA%20-%20Individual%20Notification%20Letter%20%28California%29_0.pdf"}],"summary":"An intruder accessed systems of a third-party vendor providing dōTERRA data hosting and software services, and personal information was acquired.","supporting_quote":"We are writing to notify you today that a third-party vendor that provides dōTERRA with data hosting and software services recently informed us that an intruder had accessed some of the vendor’s systems.","technology_involved":["data hosting services","software services"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15508ae96770ed8bc5f1234faa3b5c61fd1ba20f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"369B3D14-CCC7-45A4-8FA3-D11A0B4A01E6"},"incident_date":"2016-04-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ebeca1c8024","org_name":"San Mateo Foster City School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/San%20Mateo-%20%20Redacted%20Notice%20Letter%20%286114042x7AB84%29_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/san-mateo-foster-city-school-district-employee-pii-compromised-in-breach/article/496000/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61794"}],"summary":"thumb drive lost with PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e72380b0f92c45bd1f1d89d0c7db3c464f8debe0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA2D36A5-2EA3-4B0D-A998-DBE30EF3C468"},"incident_date":"2016-04-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"755de74ef62f","org_name":"Kern County Mental Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/kern-county-mental-health-dept-self-reports-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://bakersfieldnow.com/news/health/kern-county-mental-health-department-issues-notice-of-potential-breach-of-information"}],"summary":"office moved and left paperwork behind","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb7c3eccf353ac239cc0169542abda87da4f5196","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7f90d884f03e","org_name":"Mate1.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mate1.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mate1"}],"summary":"Mate1.com disclosed a breach involving subscriber information, including personal details and passwords stored in plain text.","supporting_quote":null,"technology_involved":["dating website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Anonymous Philippines","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acdeafa73eca8ee49f7c8436b95d74131a7db248","impact_type":"data_theft","imported_from":null,"incident_date":"2016-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"PH","org_id":"b3f97795ce6c","org_name":"Commission on Elections","org_type":"government","ransomware":null,"records_affected":55000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: COMELEC (Philippines Voters)","type":"hibp","url":"https://haveibeenpwned.com/Breach/COMELEC"}],"summary":"The Commission on Elections website was attacked and defaced, and data on 55 million Filipino voters was later leaked publicly.","supporting_quote":null,"technology_involved":["COMELEC website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"anonymousphilippines"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b1648b265713e26002d69b61dced08a4eec26aa","impact_type":"data_theft","imported_from":null,"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ea2fe4757d05","org_name":"The Fappening","org_type":"other","ransomware":null,"records_affected":179030,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: The Fappening","type":"hibp","url":"https://haveibeenpwned.com/Breach/TheFappening"}],"summary":"The Fappening forum was compromised in December 2015 and leaked account usernames, email addresses, and salted password hashes.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a918c2456dab96bdab0dca457fbbe73e67c8b065","impact_type":"unknown","incident_date":"2016-03-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Academy%20of%20Art%20Notice%20Letter%20%28002%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b41d6d39db73","org_name":"Academy of Art Unversity","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60936"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abc771ab1b35e443238410612af8f606cbe8f70b","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Notice%20-%20CC%2C%20Username%2C%20and%20Password_0.pdf"},"notes":null,"org_country":"US","org_id":"3101995005c2","org_name":"Staminus Communications","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60912"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Customer%20Notice%20-%20CC%2C%20Username%2C%20and%20Password_0.pdf"}],"summary":"Staminus Communications reported an unauthorized intrusion that temporarily took systems offline and exposed customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42958162739cd3fe5b2c9efb3bdb3f533a0c492a","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-22","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Schwaab%20REVISED%20Customer%20Reporting%20Letter_1_0.pdf"},"notes":null,"org_country":"US","org_id":"9ee2c97100e3","org_name":"Schwaab, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60906"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Schwaab%20REVISED%20Customer%20Reporting%20Letter_1_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Schwaab%2C%20Inc.-2016-04-11"}],"summary":"Schwaab reported unauthorized access to its computer system during a period when customer credit card information may have been compromised, though investigators found no evidence it was accessed or stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16ab3a321e46a2461ea7109600fa51ae2f1099c7","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-30","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_6.pdf"},"notes":null,"org_country":"US","org_id":"c0c309f7b716","org_name":"Bristol Farms","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60914"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_6.pdf"}],"summary":"Bristol Farms reported a data security incident affecting personal information of current and some former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-08","discovered_date":"2016-04-01","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5fe14f1124e4bb45a203a06ef5b19ff8203d98a9","impact_type":"unknown","incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7200acb9c2f8","org_name":"Wynden Stark","org_type":"unknown","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Wynden%20Stark%2C%20dba%20GQR%20Global%20Markets/City%20Internships-2016-04-08"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5f08620da6e05aedd4e9a054d7e7058a1465821","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F150B912-FCD0-40A4-BA5F-0A43A7C9B50C"},"incident_date":"2016-04-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef2138fdb026","org_name":"Premier Family Care I, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/texas-physicians-group-notifies-patients-of-unauthorized-disclosure/"}],"summary":"PHI discovered at home of doctor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-04-08","discovered_date":"2016-03-22","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fa4c92843c881d46da09a443ff780adb23f9768","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/individual%20notification%20letter%20optumrx%20vendor%20laptop%20matter%20-%20final_0.pdf"},"notes":null,"org_country":"US","org_id":"ced827a32bfb","org_name":"OptumRx","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unencrypted vendor laptop containing an electronic file with OptumRx customer health information was stolen from an employee’s vehicle.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60898"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/individual%20notification%20letter%20optumrx%20vendor%20laptop%20matter%20-%20final_0.pdf"}],"summary":"A vendor’s stolen laptop contained an electronic file with OptumRx customer health information.","supporting_quote":"On March 22, 2016, we were notified that an unencrypted laptop computer belonging to a vendor of OptumRx, which provides home delivery prescription services to you, was stolen from one of its employee’s vehicles.","technology_involved":["laptop computer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2016-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ccbeef9b5eb6dabdceb5b3fb2c16ae9cc8811b2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CC1832D-0B97-4DBB-BF8E-6B47ED3FFDEF"},"incident_date":"2016-04-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b01e58645c4","org_name":"National Network of Abortion Funds","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/national-network-of-abortion-funds-reports-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/site-of-grassroots-abortion-group-hacked/article/501375/"}],"summary":" website belonging to the National Network of Abortion Funds, a Boston-based nonprofit was hacked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"127ba5e8385923c7cbacf3ae269cb5cf4feb2004","impact_type":"data_theft","incident_date":"2016-03-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Essex%20Notice%20only%20CA%20AG%20Notice%204.07.2016_0_0.pdf"},"notes":null,"org_country":"US","org_id":"35610019b51c","org_name":"Essex Property Trust","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60880"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Essex%20Notice%20only%20CA%20AG%20Notice%204.07.2016_0_0.pdf"}],"summary":"Essex Property Trust reported that a phishing scam led to 2015 W-2 tax forms being released to people outside the company.","supporting_quote":"We are following up on the announcement we made last Friday, March 18, 2016, that we had fallen victim to a phishing scam.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fc05ee0be996c49e335b30ef5e39c284fcece42","impact_type":"unknown","incident_date":"2016-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Whiting%20Turner%20Contracting%20NOTICE%20only%20CA%20Regulator%20Notice%20Exhibits_0_1.pdf"},"notes":null,"org_country":"US","org_id":"5bacf3908fd1","org_name":"The Whiting-Turner Contracting Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60875"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Whiting%20Turner%20Contracting%20NOTICE%20only%20CA%20Regulator%20Notice%20Exhibits_0_1.pdf"}],"summary":"Whiting-Turner reported suspicious activity on an outside vendor’s systems, but had not confirmed whether employee information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07f10e8c7ef2cb0c290bf7ebe361a9062f7b15bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8F71C46-5D43-4AB4-A87B-0B2EDF0857A4"},"incident_date":"2016-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fd5e911f5f2","org_name":"Orleans Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":6890,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/server-hacking-leads-to-potential-orleans-medical-data-breach;"}],"summary":"an unsecured server was hacked after server upgrade","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a04d2dcadc46628007a0bb5e4cc3d900ffa1fd27","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9035270F-DDFB-4763-A3AC-67F56190346B"},"incident_date":"2016-04-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a809538bed1e","org_name":"Kennebunk Savings Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmtw.com/news/skimming-device-found-installed-on-kennebunk-atm/39918970"}],"summary":"ATM Skimmer found on bank ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68fa442bfa0468d2accc7b20502c2ca02b4b3df6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB092B9F-CB42-4970-8EE0-EAC1F39736EE"},"incident_date":"2016-04-06","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"8d644ddd5a9b","org_name":"CoinWallet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/coinwallet-bitcoin-trader-shuts-down-following-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/coinwallet-bitcoin-trader-shuts-down-following-data-breach-502843.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/shapeshift-bitcoin-trader-decides-to-rebuild-service-following-cyber-attack-502782.shtml"}],"summary":"CoinWallet shut down after hacking","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-04-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e723c2be218b7c338a11a8a42a318ee0d4ff676","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FF40F60-C658-4A2A-85F4-01747585ED49"},"incident_date":"2016-04-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a1d95e22509","org_name":"ProSportsDaily","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/prosportsdaily-forum-website-user-information-compromised/article/494474/"}],"summary":"Internet forum compromise leads to credential loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"543592be143af5e966d319b6310e63adeef73fda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f10ff760-0a35-11e8-bbae-ed39c73f1398"},"incident_date":"2016-04-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8917487f8f08","org_name":"Brooks Brothers","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/brooks-brothers-payment-card-system-compromised-for-almost-one-year-customers-being-alerted/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_9.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-68827"}],"summary":"Brooks Brothers recently became aware of a security incident that could affect the payment card information of some customers who made purchases at certain Brooks Brothers and Brooks Brothers Outlet retail locations in the U.S. and Puerto Rico only between April 4, 2016 and March","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e430ad39460b5715969deea238b71b7fa5ec9b47","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90DF3E87-D57F-42D2-B48F-40DCCDA1CFBD"},"incident_date":"2016-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f75eab1ebb8b","org_name":"washington Redskins","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.richmond.com/redskins-xtra/article_58532c54-1656-55b7-a1a0-be0b4e496c43.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/policy/cybersecurity/281885-nfl-data-breach-exposes-thousands-of-players"}],"summary":"laptop stolen from car with PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"011df0a033291ce453478d0369f847e66c736122","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A029E7C6-6B67-4036-A92F-3E446AFA78E1"},"incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"042a03d965b8","org_name":"UserVoice","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/uservoice-hacked-user-accounts-compromised-with-weak-encryption-at-play/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://community.uservoice.com/blog/uservoice-security-incident-notification/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://status.uservoice.com/incidents/fb7ml8b3nphf"}],"summary":"unauthorized usage of an administrative system ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b2ea3c0a7b9090ac6b4410e86a8a34b0feeb9ba","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5FE9B59-33E1-4867-9B72-82C4EAC9D9D1"},"incident_date":"2016-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"58a6350a8577","org_name":"U.S. Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":638,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox47.com/news/local/inspector-general-criticizes-va-for-ssn-data-breach-in-wisconsin"}],"summary":"Hundreds of Wisconsin veterans' Social Security Numbers were shared inappropriately ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d78a245457f2c493fbea258bc4fc5c7c5187d10d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF688855-F892-41A7-8C00-F8B86546C9D8"},"incident_date":"2016-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f84a849fc0ae","org_name":"southern Michigan Bank and Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wwmt.com/news/local/possible-security-breach-at-local-bank-has-customers-concerned"}],"summary":"Laptop stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86541489f939349840e04b9a0a6b9697ebb78e73","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EF0E448-6E3F-4229-B925-F108C5B15CA3"},"incident_date":"2016-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f257bceba06","org_name":"Shepard Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/local/atlanta/identity-theft-scam-affects-every-shepherd-center-employee/192497182"}],"summary":"identity theft scam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75c7f526128a8196138fd7425d4c7591136354e4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cb5f7460-89a1-11e7-bf1d-81579668407a"},"incident_date":"2016-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6400bec17375","org_name":"Sarasota City Goverment","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysuncoast.com/news/local/city-of-sarasota-s-system-hacked-by-ransomware-data-held/article_706019e2-6635-11e6-94cc-af3af2bb01f1.html"}],"summary":"City of Sarasota's system hacked by ransomware, data held hostage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc9479a03f0ee0834df3eb40f7bc447d4e7ee73e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84AB499B-369B-4ACF-9EA8-E19934A2DE67"},"incident_date":"2016-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e58f55c6554e","org_name":"Repair Services Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-couple-sues-plano-company-after-private-images-posted-online/"}],"summary":"cell phone repair post explicit pics to facebook","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b46bbec2dc7eea5b93c53639f69d5d36d12b2d3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53730EEC-29CC-4887-8E37-9F6792D55C38"},"incident_date":"2016-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b59716d62534","org_name":"Planned Parenthood of the Heartland","org_type":"healthcare","ransomware":null,"records_affected":2506,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcrg.com/content/news/Data-breach-for-2500-patients-at-Planned-Parenthood-in-Dubuque-385593421.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/planned-parenthood-potential-patient-records-breach-in-dubuque/"}],"summary":"potential breach of patients' personal health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02b53ca3212bd57063908bae6ed18673a8db8e34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CB2DCBA-1F42-4CEC-8E03-833C72122CD8"},"incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e52f40b62f7","org_name":"New York State Psychiatric Institute","org_type":"healthcare","ransomware":null,"records_affected":21880,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/new-york-state-psychiatric-institute-notifies-21880-research-participants-of-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2016/09/14/nyregion/a-computer-breach-that-could-have-retraumatized-research-subjects.html?_r=1"}],"summary":"For one week in late April and early May, a hacker (or hackers) got into servers that held information provided by 22,000 people for 11 mental health studies being done at the New York State Psychiatric Institute.  These were not patients being treated at the institute, but subje","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1969b221bed4c0958fd3cdebc6edd49193fd4cb1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0532aa80-c4fc-11e9-8a5a-abdcbb867af8"},"incident_date":"2016-04-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3aa1fc52cd8f","org_name":"New Jersey U.S. Attorney’s Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nj.com/essex/2019/08/gang-members-mother-worked-for-us-attorney-in-nj-outed-people-who-were-snitching-on-the-bloods-feds-say.html?utm_source=fark&utm_medium=website&utm_content=link&ICID=ref_fark"}],"summary":"A paralegal at the New Jersey U.S. Attorney’s Office used government computers to identify people who were possibly helping authorities and posted a video on YouTube of her gang member son’s co-defendant talking to investigators, according to court filings.  Tawanna Hilliard plea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7bfa839872411432d9d45ce827f365cd76dd840","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CC97067-BDCE-4D19-9650-12DF6F33F9DE"},"incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"be920eca4656","org_name":"LocalBitcoins","org_type":"financial","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bitcoinist.net/localbitcoins-database-allegedly-hacked/"}],"summary":"bitcointalk.org database hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2dbebaadb13e0f041507be4a64a770eec130ee0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41AA181B-9047-47D1-ADC6-F01572BCB952"},"incident_date":"2016-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"3bc4080438fa","org_name":"Leandra Tollgate","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.biznews.com/undictated/2016/04/28/beware-the-tollgate-card-skimming-sting-arrest-proves-i-wasnt-dreaming/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://citizen.co.za/1099675/tollgate-employee-in-court-over-card-skimming/"}],"summary":"credit card skimmer at toll gate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"IR","motive":"grudge","name":"United Cyber Caliphate","variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39683dc7808883845cc2580a6c55da3549caf655","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A333DB1-15CA-463A-B10C-FD51F85992C1"},"incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbb00e9c4390","org_name":"Lamont Christian Reformed Church","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/church-website-hacked-by-extremist-islamic-group/;"}],"summary":"church website defaced","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"unitedcybercaliphate"}},{"actor":{"category":"external","country":null,"motive":"grudge","name":"We are legion","variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b84a1bc91ed38ec1e97a51cb2e2c25078e1935","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"920FC55F-41F9-45F9-B02C-96AF71C17545"},"incident_date":"2016-04-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"25e17facc931","org_name":"InnerChef","org_type":"other","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gadgets.ndtv.com/apps/news/partial-user-data-of-food-delivery-service-innerchef-leaked-by-purported-hackers-831292"}],"summary":"hacked start up company  - grudge","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"wearelegion"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4564f7e8f1d218980c9c3f30d7a86b0d381270db","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02811E58-2E80-4DBB-B43B-8F4F077C2EFB"},"incident_date":"2016-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59a72a15a16b","org_name":"Holley Central School District","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-holley-central-school-district-investigates-possible-hacking/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.democratandchronicle.com/story/money/business/2016/06/21/holley-school-district-info-exposed-in-cyber-attack/86174856/"}],"summary":"school server hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"033624f78634d0c1a8c3635d85dead3854edb116","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82C612C8-B19F-4F40-818B-B5F58CFB92F1"},"incident_date":"2016-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c834893032d","org_name":"Good Samaritan Hospital","org_type":"healthcare","ransomware":null,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hudsonvalley.news12.com/news/rockland-hospital-suffers-data-breach-1.12187997"}],"summary":"breach by hospital vendor of PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbd54430717fd4ff107d613e78f7f50c54f124f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4609102-6ADF-42FF-8220-C88884B72CAF"},"incident_date":"2016-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac97df284fe2","org_name":"El Paso Independent School District","org_type":"education","ransomware":null,"records_affected":51,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/el-paso-independent-school-district-employee-accounts-hacked-money-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.elpasoinc.com/news/local_news/article_9c0a4f3a-20fe-11e6-b531-d7817e7eb054.html"}],"summary":"hackers had five days' access to the personal data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67ebd0df70ebc8df7813c3bea51874e5b97fd1f9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a7876a70-8f1e-11e7-aa8f-5fa9d3670494"},"incident_date":"2016-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eec45b9cac18","org_name":"Citizen’s National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://710keel.com/bossier-police-fbi-search-for-man-accused-of-atm-skimming/"}],"summary":"Bossier Police, FBI Search for Man Accused of ATM-Skimming - Citizen’s National Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0dd544f1e8914af00e64d4eced4145dcf7d2d617","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"105DBFCB-CAF0-4AD8-B497-665B7A634A7D"},"incident_date":"2016-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1c7b560bb4e","org_name":"Bon Secours Health System","org_type":"healthcare","ransomware":null,"records_affected":655550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wyff4.com/news/Bon-Secours-notifies-655-000-patients-of-potential-security-breach/41172052;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wa-highline-medical-center-notifies-18000-patients-whose-information-was-exposed-on-the-internet-by-third-party-error/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyherald.com/article/20161007/business/161008964/"}],"summary":"Error leads to PHI disclosed on public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e396e612aad39b5e68e8f30db30ddc4c03358a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA6C4CD6-DC5C-49BA-B869-2C962D704DAE"},"incident_date":"2016-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"027a173009f8","org_name":"Barrie Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/barrie-police-chief-says-investigation-ongoing-after-officer-accesses-cell-block-video/"}],"summary":"Barrie police Special Const. Ralph Hillyard was fired last week for what Greenwood calls \"misconduct and unacceptable behaviour,\" one day after Ontario court justice William Gorewich rebuked the officer for accessing restricted cell block video of a woman in custody that captured","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9774e572e0a260facb32326850de319fd05438a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73431A95-3E03-4221-81F1-F12F751288EE"},"incident_date":"2016-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1dab892bc7b3","org_name":"American College of Education","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2017/01/18/school_fires_sues_it_admin/"}],"summary":"the American College of Education (ACE) in Indiana fired IT administrator Triano Williams in April, 2016, it found that it no longer had any employees with admin access to the Google email service used by the school.  he also registered with his Google account and not his officia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7db4da5bd70ce8b0a38492d121833874b432731d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C136C1E-15CD-47F3-8151-B054C2D476F0"},"incident_date":"2016-03-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d186c96ffeec","org_name":"Washington DC Veterans Affairs Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1062,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/washington-dc-va-medical-center-breach-exposes-phi-3463/;"}],"summary":"a controlled substance monthly report had been discovered to be missing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3bb61157e28aaaf0e6635aacef8f6f3b216acdc8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4321a1e16bc3","org_name":"Armstrong Backus & Co., LLP","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Armstrong%20Backus%20%26%20Co.%2C%20LLP-2016-03-31"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18a1f55d411aa77d71c016faa70ca1f3b81a9c37","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"075EF62F-C643-4E96-BBB9-7E90A88116D4"},"incident_date":"2016-03-31","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9403afb8123d","org_name":"Alvarado Hospital Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/two-more-hospitals-struck-ransomware-california-and-indiana"}],"summary":"Ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2016-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d78838e5a7a9c3689b672d2fb0ef331f96ae748e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"224D5E0D-6CE9-4414-8E37-67E549D21530"},"incident_date":"2016-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"019fd2b96171","org_name":"Valley Anesthesiology and Pain Consultants","org_type":"healthcare","ransomware":null,"records_affected":882590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lexology.com/library/detail.aspx?g=43160994-74b7-401f-8b15-13da8bcfc33c;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/valley-anesthesiology-and-pain-consultants-notifying-882590-patients-plus-all-employees-and-providers-of-security-incident/"}],"summary":"Valley Anesthesiology and Pain Consultants Notifying 882,590 Patients PLUS all Employees and Providers of Security Incident   On June 13, 2016, VAPC learned that a third party may have gained unauthorized access to VAPC computer systems on March 30, 2016.   The computer systems m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9720c8373936f974eef5f1d2a4b4908c828d8fb4","impact_type":"data_theft","incident_date":"2016-03-22","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice%20to%20California%20residents_0.pdf"},"notes":null,"org_country":"US","org_id":"969bad426f01","org_name":"Pivotal Software","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee responded to a fraudulent email because they mistakenly believed it came from the CEO.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60798"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20of%20Notice%20to%20California%20residents_0.pdf"}],"summary":"An employee provided employee information in response to a fraudulent email impersonating Pivotal's CEO, and the information involved included a 2015 Form W-2.","supporting_quote":"On March 22, 2016, an unknown third party sent a fraudulent email message impersonating CEO Rob Mee to an employee requesting certain information about Pivotal employees.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1b17e7855cdcfb72eadf7e59c9b39bd88503a81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E2C2FAE-BE4C-4ADB-9843-EF1ABCCED1D2"},"incident_date":"2016-03-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91c748985c2e","org_name":"Empower LA","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canyon-news.com/voter-email-security-breach-in-studio-city/49448"}],"summary":"email confidential PII ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b501471239dd6833927ba11e92515b316a914e14","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42F4DC02-A043-494D-9C5D-25B3D3097348"},"incident_date":"2016-03-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"df8dc3a3f918","org_name":"Haslingden Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rossendalefreepress.co.uk/news/local-news/investigation-launched-after-confidential-medical-11133487"}],"summary":"Investigation launched after confidential medical papers fall out of a van - Haslingden Medical Group - confidential medical papers fell out of the back of a van.  The container of documents collected from Haslingden Medical Group practice - which had not been shredded - fell out","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-28","discovered_date":"2016-03-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0c670f89af805847ae89d903924b561b091a912","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Ullrich%20Delevati%20notification%20letter_0.PDF"},"notes":null,"org_country":"US","org_id":"36bc1057d1b7","org_name":"Ullrich Delevati CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60748"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Ullrich%20Delevati%20notification%20letter_0.PDF"}],"summary":"Ullrich Delevati CPAs reported that client information may have been accessed without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5ed86610e56a6cdb80ed49adbb2d4ab17e1b714","impact_type":"unknown","incident_date":"2016-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sprouts%20Farmers%20Market%20-%20Notice%20to%20Employees_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"13ec7a4f2878","org_name":"Sprouts Farmers Market","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60739"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b0215f281da964347f8855fd586db2e1e37cb910","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ADP.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1640ec91d8b","org_name":"Automatic Data Processing (ADP)","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/ADP.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-25","discovered_date":"2016-03-21","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3a3d458d593b68b507dbab57bddc6b99eecfbef","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-03-21","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/W2%20Incident%20-%20notice%20attachment_0.pdf"},"notes":null,"org_country":"US","org_id":"d868615b68ce","org_name":"Aspiranet","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60715"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/W2%20Incident%20-%20notice%20attachment_0.pdf"}],"summary":"Aspiranet said an e-mail spoofing scam led to personal information from W-2 filings being made available to a third party.","supporting_quote":"On March 21, 2016, Aspiranet was targeted by an e-mail scam called “spoofing.”","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"527fd0e00e369d126dd3954b8f61619f53400454","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E61F704F-1E75-4415-B6BF-C217AF4E678F"},"incident_date":"2016-03-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6038db0f0a23","org_name":"Christiana Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdel.com/story/74273-security-flaw-found-in-christiana-cares-online-biller-by-customer;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdel.com/story/74273-security-flaw-found-in-christiana-cares-online-biller-by-customer"}],"summary":"third party billing vulnerability ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-23","discovered_date":"2016-03-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2372b371ce2b3edfb64fb9a6c51386ef704d2a8c","impact_type":"data_theft","imported_from":null,"incident_date":"2016-02-11","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lamps%20Plus%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"e3cc001f31ac","org_name":"Lamps Plus","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee responded to a deceptive email impersonating another Lamps Plus employee, and the response was redirected to the criminal.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60670"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lamps%20Plus%20Notification_0.pdf"}],"summary":"A criminal used a deceptive email to obtain Lamps Plus employees’ W-2 data, which was used in tax-related identity theft and refund fraud.","supporting_quote":"On February 11, 2016, an unknown criminal sent an email to an individual at Lamps Plus which was intended to look as though it came from another Lamps Plus employee.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8170cc5828c515319d30292f1954ef9d86a6173b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"620A4C93-AA52-49B3-BCDF-7A7875652304"},"incident_date":"2016-03-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49b647635372","org_name":"Mountain Park Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/low-tech-break-in-results-in-breach-notification-in-phoenix/"}],"summary":"Office was burgled and filing cabinets rifled, but no evidence that anything was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e80c3b4a6e70cd2bfe4cb422b7eb985abfec7bf5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5FB6FAB-0A8A-4AAB-8FB1-D91F9EEF19A6"},"incident_date":"2016-03-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.al.com/business/index.ssf/2016/04/patient_information_at_risk_af.html"}],"summary":"A laptop that contained prescription and patient information on customers of a CVS Pharmacy in Calera has been stolen.   CVS learned on March 22 that the password-protected laptop had been stolen from a vendor. The laptop contained information about customers who have had prescri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c40f9ca2fc406aeffc3a074f345ba0a8f29fadc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66105E01-0431-438E-8CA2-D28ED471768A"},"incident_date":"2016-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"0af3545c9638","org_name":"Ministry of Transport","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://informnapalm.org/en/big-trouble-little-dpr-ministry-transport-results-data-breach/"}],"summary":"hacked data base leaked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dad5b7233accd2ddc80e7b580cd1599a8957abb6","impact_type":"data_theft","incident_date":"2016-02-17","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Regulator%20Insert%20-%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"9777ce76a01a","org_name":"Laz Karp Associates, LLC","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee believed a fraudulent email impersonating a company executive and sent the requested W-2 documents.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60586"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Regulator%20Insert%20-%20CA_0.pdf"}],"summary":"An employee sent employees’ 2015 W-2 forms to an individual impersonating a LAZ Parking executive by email.","supporting_quote":"The LAZ Parking employee complied, believing the communication to be authentic, and sent a reply correspondence that included PDF copies of certain employees’ 2015 Form W-2s.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d151018ebf1ab562515ab801bc715eb6042734bc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86D46611-6899-47D6-9249-1E95B4B23ABA"},"incident_date":"2016-03-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c561363a3797","org_name":"Imperial Valley Family Care Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/laptop-thefts-expose-phi-california-healthcare-patients-3432/"}],"summary":"LAPTOP THEFTS EXPOSE THE PHI OF CALIFORNIA HEALTHCARE PATIENTS - Imperial Valley Family Care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b752020568df7a550a40f49dbeaa835572c268b6","impact_type":"unknown","incident_date":"2014-02-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-communication_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60598"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60596"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d345c51ae63a4ed49656c4b2370eba0aee5a0a08","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E50FD0BB-EF94-4FA9-812F-9B5F4CB153E3"},"incident_date":"2016-03-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd314df0d053","org_name":"Hard Time Cafe","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wjla.com/news/local/a-maryland-hard-time-cafe-becomes-target-of-ransomware-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wusa9.com/news/local/rockville/scam-artists-hack-restaurant-computer-demand-10k/102424542"}],"summary":"restaurant shut down with ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4287cd977d11498e5a0df83abaa19fc083a32ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29B83BB3-96E2-4CCF-9382-595183898765"},"incident_date":"2016-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e55e12d63ce","org_name":"EyeCare, P.S.C","org_type":"healthcare","ransomware":null,"records_affected":971,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/washington-dc-va-medical-center-breach-exposes-phi-3463/"}],"summary":"thieves entered the premises and stole two laptop computers and a computer hard drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f51554e565ac499a3f7f7e87cde77a7bfeabde6e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6724D529-2870-4505-9633-670A4822E24C"},"incident_date":"2016-03-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aa27dddd41e4","org_name":"Union Bank and Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/newsvirginian/news/waynesboro-bank-targeted-in-skimming-operation/article_83d603e9-06e7-5b0f-a19e-bf0ad14322a8.html"}],"summary":"ATM Skimmer on bank ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d20fb9442af7d71c933fa4baeea1e82e40b52e8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF3A08C8-7F67-4914-987E-E5BEB28ABB28"},"incident_date":"2016-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d98b69ba6da1","org_name":"San Juan County","org_type":"government","ransomware":null,"records_affected":12500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nm-san-juan-county-notifying-patients-whose-phi-were-potentially-viewable-by-hacker/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/12500-drug-alcohol-abuse-program-patients-impacted-san-juan-county-hack-3465/"}],"summary":"San Juan County notifying patients whose PHI were potentially viewable by hacker  hacker had gained access to its computer systems and potentially viewed the highly confidential data of patients enrolled in its drug and alcohol abuse program.  Patients affected by the breach had ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"faa26c47c43514e55d46add4050a641295c2afd7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2276AF78-A2E8-4B38-9815-FBA285DA8A75"},"incident_date":"2016-03-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5ab157716735","org_name":"Ottawa Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/canadian-hospital-infected-with-ransomware/article/484003/"}],"summary":"hit with ransomware on several of its computers recently","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d789faec908c414dc6cb351992b4f2ffce463ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"349A6A42-9E69-4020-B8DC-9693BCE6A450"},"incident_date":"2016-03-18","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae514a3c1287","org_name":"Landstar System Inc","org_type":"transportation_logistics","ransomware":null,"records_affected":1362,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/jacksonville/news/2016/04/27/landstars-data-breach-larger-than-initially.html"}],"summary":"Phishing leads to disclosure of W-2 information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58f563d77c59759947ec58a859a9c8ad94e59ead","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"929834E0-5BA6-4B7E-A742-FCB5DD48260A"},"incident_date":"2016-03-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e5524714812","org_name":"Cumberland Farms","org_type":"retail_ecommerce","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winthroptranscript.com/2016/03/17/residents-skimmed-for-more-than-60k/"}],"summary":"gas pump and ATM skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f3646c2dbabff2400a082dcf7d9e97958f3f07a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBD162E4-D64A-435C-91ED-87771ADBB1D8"},"incident_date":"2016-03-17","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66c60ebc8b80","org_name":"Cloquet School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.duluthnewstribune.com/news/crime/3989320-cloquet-schools-suffer-ransomware-attack"}],"summary":"Ransomware infects school computer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43d5d7f253c35d3110921cfd62ecbb26988cc6e3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62E7CE14-7FD0-4F48-8175-210354A916E3"},"incident_date":"2016-03-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"445a0c662bf6","org_name":"Blue Ridge Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nc-stolen-blue-ridge-surgery-center-laptop-was-encrypted-but-password-was-with-it/"}],"summary":"Stolen Blue Ridge Surgery Center laptop was encrypted, but password was with it.  employee's encrypted work laptop had been stolen during a break-in at the employee's residence that same day. The employee reported the theft to law enforcement and we immediately began our own inve","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e1e26a0db9b7d38cef70c98dac527616d8193b8","impact_type":"unknown","incident_date":"2016-02-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PerkinElmer%2003152016%20California%20notice%20redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"82c97f9c85c4","org_name":"PerkinElmer, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60521"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"096235a2b4a72b949ba11a7ece37e4be6a4129dc","impact_type":"data_theft","incident_date":"2016-03-07","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS.NOTICE%20LETTER_0.pdf"},"notes":null,"org_country":"US","org_id":"82eafcb177b3","org_name":"Advance Auto Parts","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An outside party impersonated an Advance employee and convinced an employee to provide a file.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS.NOTICE%20LETTER_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9614.pdf"}],"summary":"An outside party used a phishing-type attack to persuade an Advance Auto Parts employee to provide a file containing employee information.","supporting_quote":"This access was through a phishing-type attack in which an outside party posing as an Advance employee convinced an employee to provide a file containing information about certain individuals who worked for Advance during 2015.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-03-15","discovered_date":"2016-02-17","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"847fa821d7cb425cdefe4aba090b6b4385d20504","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Laborers%20Notice%20of%20Data%20Breach%20-%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"e836400b4593","org_name":"Laborers Funds Administrative Office of Northern California, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A computer error caused a portion of the Form 1095-B documents to be defective.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Laborers%20Notice%20of%20Data%20Breach%20-%20Sample_0.pdf"}],"summary":"The Fund mailed Form 1095-B documents containing participants’ and dependents’ personal and health plan information to another participant after a computer error.","supporting_quote":"According to the Fund’s internal investigation, some of your personal information and the personal information of your dependents were included on the Form 1095-B mailed to another Fund participant.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-14","discovered_date":"2016-03-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15789b6d179d2eb4f5855b16244141bfadd13e5d","impact_type":"data_theft","incident_date":"2016-02-24","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NoticeCA_0.pdf"},"notes":null,"org_country":"US","org_id":"52b02421dc48","org_name":"Mitchell International, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee was deceived by an impersonation phishing scam and disclosed employee information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60473"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NoticeCA_0.pdf"}],"summary":"Mitchell International disclosed that an employee provided current and former employee information to an external person through an impersonation phishing scam.","supporting_quote":"Please know that this information was stolen through a sophisticated phishing scam for employee information and did not involve any customer information or an intrusion into our computer systems or network.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-03-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d17caf92984f6369104569e5d4ce1804289344d","impact_type":"data_theft","incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bailey%27s%20Notice%203%207%2016%20v%20%202%20FINAL%20%284%29_0.pdf"},"notes":null,"org_country":"US","org_id":"7e603b262c80","org_name":"Bailey's Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60483"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bailey%27s%20Notice%203%207%2016%20v%20%202%20FINAL%20%284%29_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/Bailey'sInc.pdf"}],"summary":"Bailey's Inc reported that an unauthorized person or persons accessed its BaileysOnline.com website and may have stolen customers' personal and credit card information.","supporting_quote":null,"technology_involved":["BaileysOnline.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"106720bfb090b600f73fb0a6123abf3c090e8a64","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34716320-a930-11e7-b732-299fe2e433d1"},"incident_date":"2016-03-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43fb1aa7bc1a","org_name":"Summit Reinsurance Services","org_type":"financial","ransomware":true,"records_affected":51809,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.delawareonline.com/story/money/business/delawareinc/2017/01/13/19000-delaware-blue-cross-blue-shield-members-data-breached/96551000/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/wellcare-health-reports-security-breach-affecting-24800-patients-8680/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theadvocate.com/baton_rouge/news/business/article_ea98fa62-f889-11e6-9b6a-d3ce2aa327f7.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/summit-reinsurance-on-behalf-of-certain-affected-health-plans-and-self-funded-employer-groups-notice-of-data-breach-300422963.html"}],"summary":"Two subcontractors of Highmark Blue Cross Blue Shield of Delaware were breached in an incident that has compromised 16 of the insurer's self-insured customers and about 19,000 of their members.  The Delaware Department of Insurance disclosed the security breach Friday. Summit Rei","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a719068ab4bc38ec52e767e237fe16193e4453a2","impact_type":"data_theft","incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"43e76596aa5d","org_name":"Lord of the Rings Online","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lord of the Rings Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/LOTR"}],"summary":"A breach of Lord of the Rings Online exposed player account data, including email addresses, birth dates and password hashes.","supporting_quote":null,"technology_involved":["Lord of the Rings Online"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"209a588fd78b25a49e3178d49d29f9e39955fdf0","impact_type":"data_theft","imported_from":null,"incident_date":"2013-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"9d64b4ab7d2e","org_name":"Dungeons & Dragons Online","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Dungeons & Dragons Online","type":"hibp","url":"https://haveibeenpwned.com/Breach/DDO"}],"summary":"A breach of Dungeons & Dragons Online exposed player account data, including email addresses, birth dates and password hashes.","supporting_quote":null,"technology_involved":["Dungeons & Dragons Online"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67452a259a788da568316fd43142c11d478fdc75","impact_type":"unknown","incident_date":"2014-05-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"b0dada6e2bfe","org_name":"Avast","org_type":"unknown","ransomware":null,"records_affected":422959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Avast","type":"hibp","url":"https://haveibeenpwned.com/Breach/Avast"}],"summary":"In May 2014, the Avast anti-virus forum was hacked and 423k member records were exposed. The Simple Machines Based forum included usernames, emails and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864c007582b92f028718c7889dbc9dffc188b996","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B74B009-CF60-4D45-BA82-2430096143EC"},"incident_date":"2016-03-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eagletribune.com/news/skimming-device-found-at-methuen-atm/article_8c615116-4203-59c7-9ca9-c7d43f2a6b4c.html"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-11","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0821446430b703005fdee5a3cc929b84437c13cd","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sequoia%20-%20CA%20Notice%20%286003570x7AB84%29_1.pdf"},"notes":null,"org_country":"US","org_id":"e0d352809125","org_name":"Sequoia Union High School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60445"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sequoia%20-%20CA%20Notice%20%286003570x7AB84%29_1.pdf"}],"summary":"A phishing incident led to unauthorized access to a Sequoia Union High School District office computer and possible access to files containing employee and retiree names and Social Security numbers.","supporting_quote":"On February 3, 2016, as a result of a phishing incident, an unauthorized third party accessed a SUHSD office computer and may have accessed files containing certain information on all of our employees and retirees, including myself.","technology_involved":["office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f030893f14e1cc8a071b31b601743f4bb5761202","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B1EFB10-1D53-471A-82EB-40DEA7147259"},"incident_date":"2016-03-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19fd17101eae","org_name":"Sunbury Plaza Dental","org_type":"healthcare","ransomware":null,"records_affected":7784,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sunbury-plaza-dental-notifies-patients-after-stored-records-were-burglarized/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/stolen-patient-records-in-oh-lead-to-potential-phi-breach"}],"summary":"records stolen from dental office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc324e3c09bf08f358e4d8e19b0a4896a7e2081a","impact_type":"data_theft","imported_from":null,"incident_date":"2014-12-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"1245a712e9cd","org_name":"Team SoloMid","org_type":"other","ransomware":null,"records_affected":442166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Team SoloMid","type":"hibp","url":"https://haveibeenpwned.com/Breach/Solomid"}],"summary":"Team SoloMid member accounts, including email and IP addresses, usernames, and salted password hashes, were leaked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other","personal"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"348349d2c60beafcc739b7653caaaacf0e71a02a","impact_type":"unknown","incident_date":"2014-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"18e44c5d9e52","org_name":"Sumo Torrent","org_type":"unknown","ransomware":null,"records_affected":285191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sumo Torrent","type":"hibp","url":"https://haveibeenpwned.com/Breach/SumoTorrent"}],"summary":"In June 2014, the torrent site Sumo Torrent was hacked and 285k member records were exposed. The data included IP addresses, email addresses and passwords stored as weak MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09c4f16e49466820c9519abf84278626a5d0e2c5","impact_type":"unknown","incident_date":"2015-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"c2159ac88b77","org_name":"Seedpeer","org_type":"unknown","ransomware":null,"records_affected":281924,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Seedpeer","type":"hibp","url":"https://haveibeenpwned.com/Breach/Seedpeer"}],"summary":"In July 2015, the torrent site Seedpeer was hacked and 282k member records were exposed. The data included usernames, email addresses and passwords stored as weak MD5 hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a1a64c37c513d9127476a697d643653864de2c2","impact_type":"data_theft","incident_date":"2016-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Seagate%20CA%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"ebd5865761d7","org_name":"Seagate US, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Employees did not recognize the phishing email as a scam and disclosed W-2 information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60402"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Seagate%20CA%20Notice_0.pdf"}],"summary":"A phishing email led Seagate employees to disclose W-2 information, including names, addresses, Social Security numbers, and earnings.","supporting_quote":"In this case, the phishing email targeted Seagate employees in HR and Payroll, requesting copies of all 2015 Forms W-2, and unfortunately the email was not recognized as a scam.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f19d47e739bfb1456e0527dedc1a74c9fa370c4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"FR","org_id":"30d5185c1778","org_name":"Minefield","org_type":"other","ransomware":null,"records_affected":188343,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Minefield","type":"hibp","url":"https://haveibeenpwned.com/Breach/Minefield"}],"summary":"Minefield’s IP.Board forum was hacked in June 2015, exposing member records that included personal information, website activity, and passwords stored as salted hashes.","supporting_quote":null,"technology_involved":["IP.Board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f143025bb3435d80672c7dc73ad0582938e40f9f","impact_type":"data_theft","imported_from":null,"incident_date":"2014-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5e944d8371c9","org_name":"Malwarebytes","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Malwarebytes","type":"hibp","url":"https://haveibeenpwned.com/Breach/Malwarebytes"}],"summary":"The Malwarebytes forum was hacked in November 2014, exposing member records that included personal information and passwords.","supporting_quote":null,"technology_involved":["IP.Board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3902128b44cec0e0b264e715cdbfa382c6edcf93","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/B7655_ADULT_NOTIFICATION_PROOF_0.PDF"},"notes":null,"org_country":"US","org_id":"f9de14cfbc6f","org_name":"Billy Casper Golf","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60368"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/B7655_ADULT_NOTIFICATION_PROOF_0.PDF"}],"summary":"Billy Casper Golf notified affected people that personal information on an IRS Form W-2 may have been at risk in an email spoofing attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76079522beb982bf480855d34f1f09eaca576133","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D88E4B8-81FA-4662-9BB3-43E48D73C152"},"incident_date":"2016-03-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/skimming-device-found-at-oviedo-gas-station-raises-more-concerns/153685775;"},{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/new-jersey/belleville/nutley-atm-skimming-cases-still-being-reported-police"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afd3ec939fd8555ce2d7c2d673bd3d8d79cd4cd1","impact_type":"unknown","incident_date":"2016-02-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notification_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1d519628bc9","org_name":"1-800-Flowers.com","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60377"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c506d20e9d333bdb71847000eb043ed3a1f27fc","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2016-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Turner%20Construction%20Ad%20r4prf_1.pdf"},"notes":null,"org_country":"US","org_id":"48b43f59c24d","org_name":"Turner Construction Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60340"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Turner%20Construction%20Ad%20r4prf_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9612.pdf"}],"summary":"Turner Construction Company reported that personal information was disclosed in an email to an unauthorized recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36567a8e9c7c961bfbd0fc0947be2f22a086f0a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21B54A8F-7A1C-4EDC-B760-305823797581"},"incident_date":"2016-03-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"289f8a8fc481","org_name":"Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/skimming-device-found-at-brevard-county-gas-station/149900323"}],"summary":"skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e07307e2fc011d2c81a0c7375b0bb4ed51d039b7","impact_type":"data_theft","imported_from":null,"incident_date":"2015-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e53bb5a2ef89","org_name":"WildStar","org_type":"other","ransomware":null,"records_affected":738556,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WildStar","type":"hibp","url":"https://haveibeenpwned.com/Breach/WildStar"}],"summary":"A breach of WildStar’s IP.Board forum exposed forum members’ account data, including email addresses, birth dates, and passwords.","supporting_quote":null,"technology_involved":["IP.Board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fe5ceb722ad7f18e7cffdcb40f88e3cf49db2bf","impact_type":"data_theft","imported_from":null,"incident_date":"2014-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"558f348188f3","org_name":"Acne.org","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Acne.org","type":"hibp","url":"https://haveibeenpwned.com/Breach/AcneOrg"}],"summary":"A November 2014 breach exposed Acne.org forum members’ account data, including email addresses, birth dates, and passwords.","supporting_quote":null,"technology_involved":["forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-04","discovered_date":"2016-02-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"861c8771b2b68680124a70fc60829fe14e25e0ec","impact_type":"data_theft","incident_date":"2016-02-26","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Snapchat%20Inc%20updated%20Sample%20of%20Employee%20Notice%20of%20Data%20Breach_Redacted_0.pdf"},"notes":null,"org_country":"US","org_id":"67b6ba1ebfc4","org_name":"Snapchat, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee sent payroll information after a scammer impersonated the CEO in an email.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60310"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Snapchat%20Inc%20updated%20Sample%20of%20Employee%20Notice%20of%20Data%20Breach_Redacted_0.pdf"}],"summary":"A scammer impersonating Snapchat’s CEO used an email phishing scam to obtain payroll information about current and former employees.","supporting_quote":"Snapchat’s payroll department was targeted by an isolated email phishing scam in which a scammer impersonated our Chief Executive Officer and requested that employee information be sent via email.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-04","discovered_date":"2016-02-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0319b504fe5f58d316d360e4c537489330cb02c6","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20-%20Rosen%20AG%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"a394ba1c0d50","org_name":"Rosen Hotels & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60301"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20-%20Rosen%20AG%20Notification_1.pdf"}],"summary":"Rosen Hotels & Resorts reported that malware was installed in its payment card processing system and searched data read from guests’ payment cards.","supporting_quote":null,"technology_involved":["payment card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30f440b6f474bc41c25723d8faccd4e9d79cf8db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6500a5d0-2bf3-11ea-b50d-3fd6f00cf940"},"incident_date":"2016-03-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d747a6a5189","org_name":"Marathon Gas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/court-justice/index.ssf/2017/06/five_charged_with_installing_s.html"}],"summary":"Five Florida residents were indicted Wednesday and charged with placing skimmers on gas station pump credit card machines in Northeast Ohio and Wisconsin and using the stolen data to make thousands of dollars in purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2016-03-04","discovered_date":"2015-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc301b3c821f9b11a1d7911506226a1d16b52018","impact_type":"data_theft","incident_date":"2015-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/21st.Adult_.Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"91285d6b5e59","org_name":"21st Century Oncology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60307"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/21st.Adult_.Notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9611.pdf"}],"summary":"21st Century Oncology reported that an intruder may have accessed a database containing patients’ personal, medical, and insurance information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eee89bb29abfb7c2a71deab1c72fcf6ce82b10e8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"623304C8-ABE7-4289-BCA9-B7C03796F90A"},"incident_date":"2016-03-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"1860fb7d4df1","org_name":"Utrecht Municipality","org_type":"government","ransomware":null,"records_affected":316,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nltimes.nl/2016/09/01/data-leak-put-thousands-utrecht-residents-info-streets/"}],"summary":"unprotected data on the intranet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45490296c1af4c5d45e04f1b493bf3f4673de2ba","impact_type":"data_theft","imported_from":null,"incident_date":"2016-02-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"b7c2c6a184d8","org_name":"Nival","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nival","type":"hibp","url":"https://haveibeenpwned.com/Breach/Nival"}],"summary":"Nival was targeted in an attack that affected more than 1.5 million accounts and exposed personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9b6c310b4e8d0cfb63664f84c7bf309f6b5659","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2f32c5639559","org_name":"MajorGeeks","org_type":"technology_saas","ransomware":null,"records_affected":269548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MajorGeeks","type":"hibp","url":"https://haveibeenpwned.com/Breach/MajorGeeks"}],"summary":"A breach of MajorGeeks’ support forum exposed account information, including email addresses, salted password hashes and IP addresses.","supporting_quote":null,"technology_involved":["support forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85307e5a2bd1da1c394041eb178b4118f0ee38d9","impact_type":"data_theft","incident_date":"2016-02-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"897b13629ac0","org_name":"KM.RU","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: KM.RU","type":"hibp","url":"https://haveibeenpwned.com/Breach/KMRU"}],"summary":"An attack on KM.RU affected user accounts and exposed personal information, including security questions and answers.","supporting_quote":null,"technology_involved":["email service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6604e11b47cb358316bb00c1957c688475271971","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6E37FEA-3276-4226-8E5D-2E0D2E735C35"},"incident_date":"2016-03-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb02104561ae","org_name":"PruittHealth","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pruitthealth-home-health-low-county-notifies-patients-after-office-burglary/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/pruitt-health-alerts-patients-to-potential-privacy-breaches-after-two-break-ins-3488/"}],"summary":"PruittHealth Home Health  Low County notifies patients after office burglary.  Thieves smashed the glass in the front door and entered the PruittHealth Home Health  Low Country office. No electronic devices were stolen by the thieves and only petty cash was believed to have been ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fd51d68ade5a0839be0466f8e81767b6db99087","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2812DF8-060F-41F6-BAC5-5A7AC6F38FBB"},"incident_date":"2016-03-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb526aaaf9b7","org_name":"Luzerne County Community College","org_type":"education","ransomware":null,"records_affected":264,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pahomepage.com/news/lccc-data-mistake-impacts-faculty-and-staff;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pa-luzerne-county-community-college-email-gaffe-exposed-faculty-ssns-w-2-info/"}],"summary":"email sent with PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-02","discovered_date":"2016-01-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"58aa950601f32a7a6a27ba2c49a4a98c87322add","impact_type":"unknown","incident_date":"2015-09-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"79bc09b65923","org_name":"Baileys","org_type":"unknown","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Baileys-2016-03-02"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6dc1091dc34a8b44c542ba8dad54047c7a1d7e5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b7e4efe0-8425-11e7-a921-2d695ce70b69"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"16aedb42792b","org_name":"Zhaopin.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chinaplus.cri.cn/news/china/9/20170603/5729.html"}],"summary":"Three stand trial for job seeker private data breach - Zhaopin.com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e9065df4611f27a52983cdc0c2241c4ac4e93ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1c0cdc80-eeac-11e7-b683-c1703914e4a4"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bca79979787c","org_name":"WVU Medicine University Healthcare","org_type":"healthcare","ransomware":null,"records_affected":7445,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.journal-news.net/news/local-news/2017/02/7445-patients-notified-of-university-healthcare-information-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/virginia-woman-admits-stealing-wvu-medicine-university-healthcare-patient-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldmailmedia.com/news/tri_state/west_virginia/va-woman-pleads-guilty-in-w-va-hospital-id-theft/article_5030c018-c22a-562b-86da-39a6b6d6cbc4.html"}],"summary":"University Healthcare officials became aware Jan. 17, of an FBI and local law enforcement investigation into the unauthorized access, use and disclosure of personal information contained on the electronic systems of University Healthcare by an employee of Berkeley Medical Center ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6a797ad6412cc3261a35fee9501b3d190e3348e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0670ff90-ad39-11e8-9e5a-c1f99505e93a"},"incident_date":"2016-03-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd730678dbc7","org_name":"Timco Aviation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.classactionrebates.com/settlements/timco-aviation/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kathrynsreport.com/2018/04/timco-aviation-data-breach-class-action.html"}],"summary":"The plaintiffs alleged in their class action lawsuit that TIMCO, an aircraft maintenance company, was hooked by a phishing scam and disclosed employees’ W-2 information to unauthorized third parties","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"9c8ab8195876ff5443afc4324aac58a83f80d24a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/EyeInstitute%2CInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"440808bc9e4d","org_name":"The Eye Institute of Corpus Christi","org_type":"unknown","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/EyeInstitute%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e7937aea3126e4d716a55205a8b01675fa6438d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36ab7d90-9b44-11e8-8c28-77aa5b8d940e"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4bd066aab869","org_name":"St John's School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.getsurrey.co.uk/news/surrey-news/manager-hacked-st-johns-school-14803360"}],"summary":"An IT manager has been found guilty of hacking a school's computer systems to hide traces of fraudulent invoices.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fee291702f9a13d4080b4aa5b520fcccb9867a46","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F21801C6-AD72-4E05-997C-DF8C3D5AD05B"},"incident_date":"2016-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c843cc24eda9","org_name":"SS&C Technologies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/china-hackers-swipe-millions-in-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/2016/09/16/china-hackers-swipe-millions-in-data-breach.html"}],"summary":"duped by China-based hackers who sent sloppy emails to company staffers in order to trick them into releasing client money","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa2a7c3bcfd13fb33a9ffc0d6fab68fb99466867","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEE23AEC-0181-49DF-A694-B8A839C00011"},"incident_date":"2016-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"6caee849ffef","org_name":"Silverstream Health Centre","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nz-silverstream-health-centre-patients-reassured-after-email-gaffe-involving-online-patient-portal/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/dominion-post/77710658/silverstream-health-centre-patients-reassured-over-online-patient-portal"}],"summary":"Email misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61a63121f6e5b3478dd52143e0b1ae1b324f22f5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BB03FF8-5647-4046-BABA-1A5B1A394EE0"},"incident_date":"2016-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e18c09332158","org_name":"Shell Fuels","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cbs4indy.com/2016/03/12/fishers-police-investigate-credit-card-skimmed-device/"}],"summary":"Credit card skimmer found on gas pump.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95eac9d612e80cd90e802058dcddc5f6051d798f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3432CF4-2D07-4092-A1A7-F178587172C8"},"incident_date":"2016-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e43729679601","org_name":"Royal Bank of Scotland Group PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlothianadvertiser.co.uk/news/local-news/bank-card-skimming-incident-in-dalkeith-1-4040993"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90326519a1a719835640e28e3578bfc5bb1e539f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E332BA9E-D36B-4757-AF31-0121FEFA1F56"},"incident_date":"2016-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8104299074b1","org_name":"Prime Healthcare Services Inc.","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://khn.org/news/hackers-take-aim-at-two-more-california-hospitals/"}],"summary":"Hackers demanded a ransom from two more Southern California hospitals last week and federal authorities are investigating the case.  Prime Healthcare Services Inc., a fast-growing national hospital chain, said the attackers infiltrated computer servers on Friday at two of its Cal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91e2aef1a857e69d44008c895d77c0495e9888ee","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03CAED4A-09A9-41D6-B5BD-E19992E6FDA6"},"incident_date":"2016-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"5e1475161c7e","org_name":"Our Lady of Lourdes Hospital","org_type":"healthcare","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/regionals/argus/news/patients-data-found-lying-on-the-footpath-34562410.html"}],"summary":"Document found by jogger featured PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"390a7124d63302ae897cda8b29e8349fb1ce59d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DBCB138-599E-4DD4-B80E-71B169E811AC"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d591f84959c","org_name":"Northgate Medical P.C.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ma-patient-information-taken-from-northgate-medical-primary-care/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.masslive.com/news/index.ssf/2016/04/after_overbilling_issue_spring.html"}],"summary":"Employee stole patient information before leaving company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07100cf38f000faa1759de36d907979620adbdac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"008639D4-0040-4CD2-B8D0-B36A70CFA271"},"incident_date":"2016-03-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"95b449b9686a","org_name":"Ministry of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3048784/internet/thailands-immigration-system-suffers-data-breach.html"}],"summary":"Poorly configured application allows medical records to be viewed without authentication.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a3d06aa3f9ae10ab4094fa370c44abe1e005965","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C11AC99-D06D-4A56-9946-645AF6B6782E"},"incident_date":"2016-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f3011e020d5e","org_name":"Millennium Hotels & Resorts North America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/denver/news/2016/08/25/greenwood-village-based-hotel-chain-warns-of.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hotelnewsresource.com/article90836.html"}],"summary":"14 US hotels reported POS malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6462ff177ad762783c3a16560ff515807d4c3e1d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01E592CE-97CB-4345-97CF-2A278B67624B"},"incident_date":"2016-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d29c8fc540c","org_name":"Methodist Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thegleaner.com/news/methodist-hospital-hit-by-electronic-virus-no-patient-information-compromised-2e588bab-c37b-3673-e05-372601151.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ky-ransomware-incident-at-methodist-hospital-in-henderson/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/03/hospital-declares-internet-state-of-emergency-after-ransomware-infection/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2016/03/kentucky-hospital-hit-by-ransomware-attack/"}],"summary":"Methodist Hospital officials say patient information is secure after discovering the hospital's network had been infected with a virus.  According to a news release, a ransomware virus got into the system. Ransomware restricts access to the infected computer system and demands th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"430ca9573624505c8f82db62c046363bd0f3e06f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D5B93FA-8D91-4311-A4DF-F6871220D155"},"incident_date":"2016-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ced429a94db1","org_name":"Medical Colleagues of Texas","org_type":"healthcare","ransomware":null,"records_affected":68631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/data-breach-affecting-more-than-50000-reported-by-medical-colleagues-of-texas/"}],"summary":"External actors leverage remote access and compromise internal LAN","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3bb5dc9544ddd29575917c426e6e78fcda99550","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90C9F428-63B4-4799-8094-460D52AE81FA"},"incident_date":"2016-03-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19d844913753","org_name":"Maine School District","org_type":"education","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressherald.com/2016/03/29/hackers-target-school-systems-for-employee-tax-form-data/"}],"summary":"A computer hacker or hackers posing as a district's school superintendent have tried to trick at least three Maine school departments into handing over sensitive personal information contained on employees' W-2 forms  and succeeded at least partially with one of them.  The breadt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab15c64f2b2375c0cd4e51e7ce6cab0660090587","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52a7afe0-94a7-11e7-9340-f70be1ebf87c"},"incident_date":"2016-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fca16d6f9d3","org_name":"Lewis, Kisch & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ago.vermont.gov/assets/files/Consumer/Security_Breach/Lewis%20Kisch%20and%20Associates%20Ltd%20SBN%20to%20Consumers.pdf"}],"summary":"Hacker accesses law firm's files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ecabaddddac0cc15bf1665e059d57cc37e9f916","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A723D98F-2913-4D32-A3A5-E4FD1BD0BB22"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbb43619ee5","org_name":"LBI Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courant.com/breaking-news/hc-defense-contractor-arrests-1115-20161114-story.html"}],"summary":" defense contractor have been indicted by a federal grand jury on charges that they stole trade secrets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1335a470d1841f47cf6685c1fbcff11c68150931","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95DBE9A7-C65D-4B23-878C-63A19DBFBE00"},"incident_date":"2016-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9f322150353","org_name":"Laser & Dermatologic Surgery Center","org_type":"healthcare","ransomware":true,"records_affected":31000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/laser-dermatologic-surgery-center-notifies-31000-of-possible-phi-compromise/"}],"summary":"fell victim to unauthorized access of its computer systems that may have led to the disclosure of certain patient information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1b78505a104f3eb2458734bbf4bca3404add08f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E51388AE-9FB4-49F4-8497-7CAF2E3AE57F"},"incident_date":"2016-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pe.com/articles/permanente-800852-kaiser-members.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mail-delivery-truck-stolen-2400-inland-empire-health-plan-members-phi-exposed-3405/"}],"summary":"A mail delivery truck carrying the personal information of 2,400 Kaiser Permanente members on the Inland Empire Health Plan was stolen last month from a parking lot in Santa Clarita, officials announced Friday. Michelle Simms, a Kaiser Permanente spokeswoman, said the health care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f17663575e3a3c839521ae2e446aea447e0d25d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"565c5150-aa26-11e8-9604-77188de09ef1"},"incident_date":"2016-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd8e0d23a197","org_name":"Hilton","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wsbtv.com/news/local/north-fulton-county/hotel-worker-accused-of-stealing-customers-credit-card-information/163184195"}],"summary":"A Riverdale man is facing felony fraud charges after Alpharetta police say he stole credit card information from a customer at the hotel where he worked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f74d73a18af2d560e60e78f2f3d7344716b1cdc8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26a837d0-94a6-11e7-9340-f70be1ebf87c"},"incident_date":"2016-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"c3d7a99da053","org_name":"code.org","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/code-org-volunteer-emails-exposed-in-information-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/non-profit-code-org-notifies-volunteers-whose-email-addresses-were-exposed/"}],"summary":"On Friday night we discovered and fixed an error in the Code.org site that allowed access to our volunteer email addresses. This wasn’t a case of hackers breaching our security systems, rather it was our mistake of leaving volunteer email addresses accessible via the web browser.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-03-01","discovered_date":"2016-02-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98b338ac1da62158580ef9f8995c4fdc518d19c8","impact_type":"data_theft","incident_date":"2016-02-23","initial_access":"vishing_or_social_engineering","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Central%20Concrete%20Ad%20r1fin_0.pdf"},"notes":null,"org_country":"US","org_id":"e30e208118e8","org_name":"Central Concrete Supply Co. Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An outside party impersonated another person and convinced an employee to send copies of W-2 documents by email.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60270"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Central%20Concrete%20Ad%20r1fin_0.pdf"}],"summary":"An outside party impersonated another person and persuaded a Central Concrete Supply employee to email copies of 2015 W-2 statements.","supporting_quote":"This information was stolen through a sophisticated social engineering scheme in which an outside party posing as another person convinced an employee of Central Concrete Supply to provide copies of the documents by email on February 23, 2016.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88a7717aa807c3e3c771a1f5ef9f6154ecb25020","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8f8a0da0-0a9e-11e8-827c-bba53cbad290"},"incident_date":"2016-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"7205500b4465","org_name":"CD Projekt RED","org_type":"technology_saas","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/witcher-3-old-dev-forum-hacked-1-9-million-credentials-dumped-512597.shtml;"},{"fetched_at":null,"title":"Have I Been Pwned: CD Projekt RED","type":"hibp","url":"https://haveibeenpwned.com/Breach/CDProjektRed"}],"summary":"Game developer studio CD Projekt RED was the victim of a data breach in March 2016 when hackers got hold of 1.9 million user credentials from its online forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ce81bc5d9e43d1534588716fed82fd0600112a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B9291B9-20D8-4432-937F-E187F66B3A5A"},"incident_date":"2016-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e15eef264119","org_name":"Boston University","org_type":"education","ransomware":null,"records_affected":828,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/boston-university-notifies-medical-research-participants-after-server-compromise/"}],"summary":"Server compromise","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42258f881610050ea6eadb21404527fbf052296f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2c9a4a0-a9e1-11e7-bafd-1552bcc84b5b"},"incident_date":"2016-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BS","org_id":"8a2d905579c7","org_name":"Atlantis, Paradise Island","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Atlantis%20notice%20only--%20CA%20Exhibit%201_2_0.pdf?"}],"summary":"Atlantis Provides Notice of Data Security Incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d049c55766fbea9a7dada1a3b2e52d2ef5e621ee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1f7ba790-3276-11ec-a962-0f8a4d8d5131"},"incident_date":"2016-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba415820a14c","org_name":"Alto City","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.jacksonvilleprogress.com/news/alto-city-office-battles-ransomware-issue/article_0f9ac6ee-f2e4-11e5-bea2-ebc9266adf96.html"}],"summary":"An Alto city employee unknowingly opened an email attachment to download the alleged invoice, when a virus “grabbed files inside the computer and encrypted them, saying we had to pay a ransom of $500 to get our files back","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-29","discovered_date":"2016-01-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f088a438e76504597f8cb4ada42315e117b6d43","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TN%20Marketing%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"52dede87eee0","org_name":"TN Marketing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60252"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TN%20Marketing%20Letter_0.pdf"}],"summary":"TN Marketing reported that information entered on its e-commerce checkout pages could have been at risk due to a potential vulnerability.","supporting_quote":null,"technology_involved":["e-commerce checkout pages"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4c5c848a5de9f132f73c8378ce068d25b2a7d8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8414DA23-6CF6-4E49-99EA-78C4842FF42B"},"incident_date":"2016-02-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a030ec0f1732","org_name":"Atique Orthodontics","org_type":"healthcare","ransomware":null,"records_affected":1506,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/atique-orthodontics-p-a-notifies-patients-of-security-incident/"}],"summary":"External actor used remote access to compromise computer ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1716762bd00d233963dc35150c7600089fcef703","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7203C776-84F8-43EE-9C99-F8670214755F"},"incident_date":"2016-02-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"461efe7bf4f5","org_name":"Veterans Administration","org_type":"government","ransomware":null,"records_affected":211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/va-physician-leaves-patient-files-in-his-car-and/"}],"summary":"VA physician leaves patient files in his car - a briefcase containing two lists of patient names was stolen from a physician's locked vehicle. The vehicle was parked in front of the employee's home where the car windows were shattered and the contents of the vehicle were stolen. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unpatched_known_vuln","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3b33a47758dc7d051049ce33ee78a7ecea64ad0","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCB-2016-02-26-CA-SampleNotice-SSN-Bank-AG_0.pdf"},"notes":null,"org_country":"US","org_id":"1f16e2ea9241","org_name":"University of California, Berkeley","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Criminals gained entry through a security flaw in the UC Berkeley financial system that the University was in the process of patching.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60237"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCB-2016-02-26-CA-SampleNotice-SSN-Bank-AG_0.pdf"}],"summary":"An unauthorized person or persons accessed portions of UC Berkeley’s financial system containing names, Social Security numbers, and bank account numbers.","supporting_quote":"The criminals gained entry through a security flaw that the University was in the process of patching.","technology_involved":["financial system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66020367602e6795502924f75f14b18647e47ab8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"573B230E-CB64-4292-B4E0-20091DCC29BB"},"incident_date":"2016-02-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c5dd7aee1a4","org_name":"EqualizeRCM Services","org_type":"professional_services","ransomware":null,"records_affected":19898,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/stolen-billing-vendors-laptop-held-patient-info-from-8-medical-facilities/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/hipaa-business-associate-notifies-patients-data-breach-3414/"}],"summary":"EqualizeRCM Services  is a vendor providing billing and collection services to healthcare providers.  In compliance with HIPAA, it has Business Associate contracts with its clients, who provide it with the information needed to fulfill its functions. The firm has headquarters in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41bc7bdb94ffb789623ba18cc857ff3742e751ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00760E12-352A-4515-9063-726A80DF8988"},"incident_date":"2016-02-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77be14f89430","org_name":"Commanche County Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":2199,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/comanche-county-memorial-hospital-notifies-2199-patients-after-contractors-email-gaffe/"}],"summary":"On February 26, 2016, the company contracted to provide patient satisfaction surveys for the MMG determined that an e-mail survey sent to numerous patients included incorrect information. The surveys were sent to the e-mail addresses of patients who visited MMG physicians from De","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5bf6407bb0035491d44ebe76980164c49adc379","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NAS_Superior_Label_US_letter_to_residents_1.PDF"},"notes":null,"org_country":"US","org_id":"58d67c44c01d","org_name":"Superior Labels","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Hackers used a security vulnerability in the WordPress blogging software to gain access to the order management system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60210"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NAS_Superior_Label_US_letter_to_residents_1.PDF"}],"summary":"Hackers used a vulnerability in WordPress to access Superior Labels' order management system, where customer order and personal information may have been accessed.","supporting_quote":"Based on our investigation, it appears that hackers used a security vulnerability in the WordPress blogging software to gain access to our order management system from November 3, 2015 to December 11, 2015.","technology_involved":["WordPress","order management system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e59e8ca6ed7e0b0d5d010d3d540c13d310e699bf","impact_type":"data_theft","incident_date":"2016-02-19","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Letter%202015%2002%2022_0.pdf"},"notes":null,"org_country":"US","org_id":"d87f2b1df2be","org_name":"Mercy Housing","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An email scam led to the unauthorized release of employee W-2s.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60215"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Letter%202015%2002%2022_0.pdf"}],"summary":"Mercy Housing reported that an email scam led to the unauthorized release of an electronic copy of its 2015 employee W-2s.","supporting_quote":"there was an unauthorized release of an electronic copy of all 2015 W2s issued by Mercy Housing’s payroll department due to an email scam.","technology_involved":[],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac50d99e31255f649c11cc64b345893973341270","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBE32B58-C73A-44F1-A2F5-CFC2440B96D3"},"incident_date":"2016-02-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"94c92532e1ef","org_name":"Katherman Kitts & Co. LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/katherman-kitts-notifies-clients-whose-identity-and-financial-information-was-stolen-from-unattended-vehicle/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60867"}],"summary":"Laptop stolen from accounting firm partner's vehicle ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d315ccea7163d7db40bda202b7891ed02d58054","impact_type":"unknown","incident_date":"2016-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"00731c12eb43","org_name":"SkTorrent","org_type":"unknown","ransomware":null,"records_affected":117070,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: SkTorrent","type":"hibp","url":"https://haveibeenpwned.com/Breach/SkTorrent"}],"summary":"In February 2016, the Slovak torrent tracking site SkTorrent was hacked and over 117k records leaked online . The data dump included usernames, email addresses and passwords stored in plain text.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34e6af600cc75a50b5d66039d1ab319087ffffe4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DACBD41-2FE3-44E9-8FFF-37FB65859A9E"},"incident_date":"2016-02-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82a362a15f6b","org_name":"Pulaski County Special School District","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arkansasonline.com/news/2016/mar/19/school-district-reports-breach-20160319/?f=news-arkansas;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ar-pulaski-county-special-school-district-notifies-past-and-current-employees-of-data-breach/"}],"summary":"emailed documents inadvertently","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"860f602069eae38f09958d3904e292b359b39b66","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79209AF7-0831-496D-8BE3-5AA4AADF353E"},"incident_date":"2016-02-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad54d2d31728","org_name":"Mayfield Brain & Spine","org_type":"healthcare","ransomware":null,"records_affected":23341,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/breach-at-vendors-results-in-mayfield-brain-spine-patients-receiving-emails-containing-malware/"}],"summary":"On February 23, 2016, many people began receiving a fraudulent email titled \"Important Information: invoice 11471\" from an unauthorized person who had accessed Mayfield Brain & Spine's account at an outside vendor. This email was not sent by Mayfield. Mayfield notified recipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a96105e6354b9c75a263c1f6f380097af1217d1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"74d1e052ef66","org_name":"iPmart","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: iPmart","type":"hibp","url":"https://haveibeenpwned.com/Breach/iPmart"}],"summary":"The iPmart vBulletin forum was hacked in 2015, exposing members’ details, including birth dates and passwords stored as salted hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f73ac68dcc185b6d0aae5c11657458fb45fcbd48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F032707-4BFB-4228-AAF0-9055B5D0ACFF"},"incident_date":"2016-02-22","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"875fd18fc9d2","org_name":"Wyoming Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3184,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://trib.com/news/local/casper/wyoming-medical-center-informs-patients-of-email-breach/article_b88e758c-28fa-5470-9dd8-ad962f978b0d.html"}],"summary":"Wyoming Medical Center informs 3,200 patients of email breach - Two Wyoming Medical Center employees fell for phishing schemes in February, potentially exposing the information of 3,184 patients.  They had access to the employees' emails for 15 minutes, he said. The hospital coul","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20fc49edf9960396cda9696fa2146fa796f1f9dd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C7E4271-2718-4897-B364-D0812F06615E"},"incident_date":"2016-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3ff2a424935","org_name":"Stamford Podiatry Group","org_type":"healthcare","ransomware":null,"records_affected":40491,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ehremr-hacks-impact-connecticut-and-pennsylvania-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/data-of-40000-stamford-podiatry-group-patients-compromised/article/500698/"}],"summary":"network was comprised and electronic health records (EHR) may have been accessed and copied","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3478dc7f3a3bb18b7fa926c7c0597ed1f302e04","impact_type":"data_theft","imported_from":null,"incident_date":"2016-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"162ea85b4762","org_name":"Linux Mint","org_type":"technology_saas","ransomware":null,"records_affected":144989,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Linux Mint","type":"hibp","url":"https://haveibeenpwned.com/Breach/LinuxMint"}],"summary":"Linux Mint’s website was hacked, an ISO was infected with a backdoor, and subscriber information from its phpBB forum was put up for sale.","supporting_quote":null,"technology_involved":["phpBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-22","discovered_date":"2016-02-04","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19da42f712c86855d6e65606225ecbdd9986d2d7","impact_type":"data_theft","incident_date":"2015-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Incipio%20Ad%20r2prf_0.PDF"},"notes":null,"org_country":"US","org_id":"e52834823583","org_name":"Incipio, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Incipio%20Ad%20r2prf_0.PDF"}],"summary":"Incipio reported that an unauthorized party accessed a cloud-based website server and customer personal and payment card information.","supporting_quote":null,"technology_involved":["cloud-based website server","e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous Anon Verdict","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa7689c0e338c512cc797f78a3bec2a39df53dd8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8374605-A940-49A2-8B8D-90155D07FCBA"},"incident_date":"2016-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0216f610c682","org_name":"Cincinnati Police Department","org_type":"government","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mirror.co.uk/tech/anonymous-releases-details-52-police-7415832"}],"summary":"hacktivist group called Anonymous Anon Verdict has revealed a data dump of the personal details of 52 police officers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymousanonverdict"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdfec24984ee6dd4e1cab6f2f2378614baebfd8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1C15EE2-0DBA-43E3-B1D0-5C829554CD02"},"incident_date":"2016-02-19","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d87f2b1df2be","org_name":"Mercy Housing","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Letter%202015%2002%2022_0.pdf"}],"summary":"unauthorized release of an electronic copy of all 2015 W2s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63e14d4917f5b900946ca4d78a7716461f9e70d4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7DC26E8-6DC1-4B71-9B35-5017F2BDFEC7"},"incident_date":"2016-02-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05e69697c4c3","org_name":"Children's National Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/childrens-national-medical-center-blames-former-transcription-vendor-for-privacy-breach/"}],"summary":"third party disclosed PHI by FTP server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d77d4d78ecafb924e70ca3691ca47ab9b813317","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B88F561F-5448-49C7-92FC-3D182B6B7AFD"},"incident_date":"2016-02-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50aa629277f9","org_name":"Bozeman Health","org_type":"healthcare","ransomware":null,"records_affected":1124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.belgrade-news.com/news/briefs/article_9d62ad6c-efa0-11e5-a58b-37dc64003dc5.html"}],"summary":"Misdelivery led to retiring doctors patients' receiving letters addressed to other patients. Only names were disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"320f7d17ebeeb71924f65a53c37f52b613aef7cc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31FD40DF-7E16-4CCB-8D55-D8AD5E47E19C"},"incident_date":"2016-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecdb25b9f240","org_name":"Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chronicle.augusta.com/news/government/2016-02-19/sc-medicaid-computer-breach-exposes-data-1-million"}],"summary":"40 year old server compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae6eb7ffa08805c5f23875f1060125f11557170","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37A8FDF0-7D05-4A05-846A-A4FAD558E2F0"},"incident_date":"2016-02-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15ed1a0c4ea4","org_name":"Laborers' Health & Welfare Trust Fund for Northern California","org_type":"financial","ransomware":null,"records_affected":2373,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/laborers-health-welfare-trust-fund-for-northern-california-members-notified-of-hipaa-breach/"}],"summary":"MIsdelivery of mailed docs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeeb8ca07fb25b680204a3ec17678d5a69de51ff","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E9FB21A-0C84-4A2D-9FE5-0EDEDA647086"},"incident_date":"2016-02-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d5035fe9b9d","org_name":"Carle Foundation Hospital","org_type":"healthcare","ransomware":null,"records_affected":1185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/server-hacking-leads-to-potential-orleans-medical-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-gazette.com/news/local/2016-08-05/updated-carle-warns-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/carle-health-system-warns-of-data-breach-due-to-vendor-error/"}],"summary":" files were placed on a Carle server Feb. 17 by one of Carle's vendors, making them potentially viewable for months by other Carle vendors who didn't have a business reason to view them, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2016-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2329257ad4184df25c948e3a1d4dd419ec09f9ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1EE8F8C-DE42-487A-B277-E4A5E011D477"},"incident_date":"2016-02-16","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"270667eb302d","org_name":"Kimpton Hotels and Restaurants","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.kimptonhotels.com/promos/payment-card-notification;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationsecuritybuzz.com/hacker-news/kimpton-hotels-disclose-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/07/kimpton-hotels-probes-card-breach-claims/"}],"summary":"POS malware on hotel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-16","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f66bfa3b8785dc23f60d5d6e8df788cad5814de","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-02-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CPN%20Employee%20Notification%20-%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"7dc515ec9581","org_name":"Calpine Corporation","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60083"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CPN%20Employee%20Notification%20-%20Template_0.pdf"}],"summary":"A Calpine employee’s stolen laptop may have contained confidential employee information, including personal and financial data.","supporting_quote":"A Calpine employee’s laptop, which contained confidential employee information, was stolen from a car.","technology_involved":["employee laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c13cc3c74e490d224a5ec88212f77c741fbf6b2c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FF3EBC0-E321-49FD-85BD-BC3814154F33"},"incident_date":"2016-02-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b321ade34221","org_name":"Wal-Mart Stores Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":4800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/almost-13000-affected-by-recent-pharmacy-data-breaches-3350/"}],"summary":"Programming error potentially disclosed 4800 prescription histories via web application","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0b12db3ccc33aec9ada71a3161d0a1d2b596b36","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C09DEFC0-F792-4ACD-A7A0-6A0960FC27EE"},"incident_date":"2016-02-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32983921e3a4","org_name":"Loyola University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/loyola-university-medical-center-notice-of-privacy-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.loyolamedicine.org/notice-privacy-breach"}],"summary":"On April 5, 2016, Loyola University Medical Center learned that a project that occurred in February, 2016 undertaken to acquire accurate addresses may have resulted in the release of billing statements to certain unverified addresses. The billing statements included name, account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2016-02-15","discovered_date":"2015-12-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9e9ec0d6d815c154b63adfdbe7f659f2ace59be","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/B7126_MINOR_PRF_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"044ebeec1e6c","org_name":"Alliance Health Networks, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A test database containing patient information had inadvertently been left accessible via the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60071"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/B7126_MINOR_PRF_0.PDF"}],"summary":"Alliance Health Networks, LLC reported that a test database containing patient information had been left accessible via the internet.","supporting_quote":"On December 17, 2015, we became aware that a test database containing patient information had inadvertently been left accessible via the internet.","technology_involved":["test database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-02-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89297fef1b4abed0f16d208774e7804f22ea5ae9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"647D70D0-65D2-42DB-A553-E6B776DF768F"},"incident_date":"2016-02-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8daa5cb792f","org_name":"1-800-FLOWERS'","org_type":"retail_ecommerce","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hacker-picks-1-800-flowers-customers-credit-card-info/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Notification_1.pdf?"}],"summary":"1800flowers hacked the day after valentines day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e4b6fb2c9e46f2a2af98e29e69ecbd5c2069e6e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4729DDEB-9BD1-483A-AAE7-2C2EE5AB4F43"},"incident_date":"2016-02-12","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"a61c2d9ccfda","org_name":"Eastern Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedailystar.net/business/atm-frauds-rattle-banks-customers-510868"}],"summary":"ATM card data stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fbec16394de8d40c976f7ff55e651fc912fdadc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B825342A-E522-431A-85D3-C855C593AB91"},"incident_date":"2016-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99be816f73b1","org_name":"Elliot J. Martin Chiropractic","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/elliot-j-martin-chiropractic-notification-to-patients-of-hipaa-breach/"}],"summary":"Breach on internal system via unknown method leads to medical record loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a01f507d6d9047e1dc48428eab820efb5a92556","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33265AA8-8F1E-4B29-999D-B411B529BD2D"},"incident_date":"2016-02-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e988332d4a1","org_name":"D.C. Public Schools","org_type":"education","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/local/education/dc-accidentally-uploads-private-information-of-12000-students/2016/02/11/7618c698-d0ff-11e5-abc9-ea152f0b9561_story.html"}],"summary":",000 D.C. public school students was accidently uploaded to a publicly accessible website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de84790626bc075dc5907130767c03375113b1a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F55D03B-DE00-494B-98E1-24E1EBFFA273"},"incident_date":"2016-02-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf6bad29a4a7","org_name":"Commonwealth Primary Care","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtvr.com/2016/06/22/former-nurse-charged-with-stealing-patients-personal-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wtvr.com/2016/06/24/capri-williams-guilty/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/va-former-nurse-charged-with-stealing-patients-personal-information/"}],"summary":"identity theft from nurse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1636beb0ea2796aee3a46e86eb2773e113618887","impact_type":"data_theft","incident_date":"2016-02-03","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Incident%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"111740fcb081","org_name":"The Brickman Group, Ltd. LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60028"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Incident%20Notice_0.pdf"}],"summary":"The Brickman Group disclosed that a phishing email led to payroll information for active team members being sent to an unauthorized person.","supporting_quote":"On February 3, 2016, an unknown, unauthorized person sent a phishing email requesting that they be provided with specific personal information of our team members (e.g., Social Security number and date of birth).","technology_involved":["legacy Brickman payroll system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"305fd19d3ffe24a0b34f208e3d59ab4d3fe530b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"223726D5-6505-4D24-887E-3190E83089A6"},"incident_date":"2016-02-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"88f0b4e8f608","org_name":"Japan's National Tax Agency","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://preciouscrownworld.blogspot.com/2016/02/tax-agencys-website-hit-by-possible.html"}],"summary":"DoS attack on Tax agency","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6c265b7de81a18836154eda9aac3b64e61e8d06","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f0b39478d126","org_name":"R2Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: R2Games","type":"hibp","url":"https://haveibeenpwned.com/Breach/R2Games"}],"summary":"R2Games’ vBulletin forum was hacked in late 2015, and records containing email addresses, IP addresses, passwords, and usernames were disclosed.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"059fb7008ea81985c220527dbd2ef55f7fb9b240","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-11-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9610.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d70d1eed1f3","org_name":"Health Care Authority","org_type":"unknown","ransomware":null,"records_affected":91187,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9610.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ceb54ae8ceae1f57ffd10e52e21a0117150c0fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5063787-10D5-417C-9F24-F1B4262548E6"},"incident_date":"2016-02-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"afa7ee695ab8","org_name":"Genghis Grill","org_type":"other","ransomware":null,"records_affected":55000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nrn.com/technology/genghis-grill-reports-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dallasnews.com/business/headlines/20160919-north-texas-genghis-grill-locations-hit-by-hackers-up-to-55000-transactions-impacted.ece"}],"summary":"had their payment card information stolen by hackers in the last several months","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64def95630ae82714c7aac7e1ad31704c0b09786","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"5431a27f17d6","org_name":"Plex","org_type":"technology_saas","ransomware":null,"records_affected":327314,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Plex","type":"hibp","url":"https://haveibeenpwned.com/Breach/Plex"}],"summary":"Plex’s discussion forum was hacked in July 2015, exposing account details including email addresses, IP addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":["IP.Board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9772fdc4d388e55a59100f1060e3c7beae1f72ae","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"2553bf373783","org_name":"Comcast","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Comcast","type":"hibp","url":"https://haveibeenpwned.com/Breach/Comcast"}],"summary":"A breach exposed Comcast customer email addresses, plain-text passwords, and some home addresses, and the dataset was sold on underground forums.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-02-08","discovered_date":"2015-12-16","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d4ffbbb105b3e2bacaa0684f434ea0f7cdf5ad2","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-16","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BajaBound_notice%20only%20_0.pdf"},"notes":null,"org_country":"US","org_id":"75cdc77e2cf6","org_name":"Baja Bound Insurance Services, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60000"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BajaBound_notice%20only%20_0.pdf"}],"summary":"Baja Bound Insurance Services reported that an agent’s email account may have been compromised through phishing, and documents in the account contained personal and credit card information; it had no evidence the information was viewed or compromised.","supporting_quote":"On December 16, 2015, we discovered that an agent’s Baja Bound Insurance Service’s email account may have been compromised through a phishing attack.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"913f0e73305bd7e71e78ac781d24a9e96ffa508b","impact_type":"data_theft","imported_from":null,"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"d9e49cd62323","org_name":"Xbox-Scene","org_type":"other","ransomware":null,"records_affected":432552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Xbox-Scene","type":"hibp","url":"https://haveibeenpwned.com/Breach/Xbox-Scene"}],"summary":"Xbox-Scene’s IP.Board forum was hacked in approximately February 2015, exposing account data including email addresses, IP addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":["IP.Board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23488c912a5fa8f0615da8e2ef72d159623a0298","impact_type":"data_theft","imported_from":null,"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"8c622867f509","org_name":"PSX-Scene","org_type":"other","ransomware":null,"records_affected":341118,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PSX-Scene","type":"hibp","url":"https://haveibeenpwned.com/Breach/PSX-Scene"}],"summary":"PSX-Scene reported that its vBulletin forum was hacked and more than 340,000 accounts were exposed.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72a7acd3652ee2f7df05cb5e3f6b5c2272ba1ad8","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"6d49614dbce7","org_name":"PS3Hax","org_type":"other","ransomware":null,"records_affected":447410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PS3Hax","type":"hibp","url":"https://haveibeenpwned.com/Breach/PS3Hax"}],"summary":"PS3Hax reported that its vBulletin forum was hacked and more than 447,000 accounts were exposed, including email addresses, IP addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"765a5bec370f8fecc76d68eeaa6bc176d0111b23","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e654693f090b","org_name":"OwnedCore","org_type":"other","ransomware":null,"records_affected":880331,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: OwnedCore","type":"hibp","url":"https://haveibeenpwned.com/Breach/OwnedCore"}],"summary":"OwnedCore’s vBulletin forum was hacked in approximately August 2013, exposing account information including email addresses, IP addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3493276a9b286326ae6fd845d8174af40e4e5ea","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a11a631b07f6","org_name":"Gamerzplanet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gamerzplanet","type":"hibp","url":"https://haveibeenpwned.com/Breach/GamerzPlanet"}],"summary":"Gamerzplanet was hacked in approximately October 2015, exposing account data including email addresses, IP addresses, usernames, and salted password hashes.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44e84292f15a4279a0f54016b3bc9b724424607c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DA10EEA-60B9-48F0-B473-8AE7481DDE66"},"incident_date":"2016-02-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4b00568fdd23","org_name":"Brizlincote Valley for East Staffordshire Borough Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.burtonmail.co.uk/councillor-broke-confidentiality-rules-in-conversation-with-son-over-dinner/story-29453283-detail/story.html"}],"summary":"breach of passing confident information to a third party and releasing information that could reasonably be regarded as bringing the council into disrepute.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"968e53314d931f450230daba1ed840b9bf592038","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/StarwoodHotels.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c66e94323bc","org_name":"Starwood Hotels & Resorts Worldwide, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/StarwoodHotels.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c4de1706e3460fe1d17f5106e3c11b696555bef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C635767-CAF8-46AB-A67F-8904B06D84A7"},"incident_date":"2016-02-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"7bc1102cbe21","org_name":"Waikato District Health Board","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/77843180/privacy-breaches-involve-former-waikato-dhb-staff-member"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/78040062/Breach-of-doctors-privacy-alleged-at-Waikato-District-Health-Board;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.headlines-news.com/2016/03/18/1003341/breach-of-doctors-privacy-alleged-at-waikato-district-health-board"}],"summary":"Privacy breaches involve former Waikato DHB staff member - Private and confidential documents outlining a hospital worker's breach of privacy and confidentiality against an inmate were found strewn across a Raglan lawn.  Intact letters outlining the alleged misconduct of a Waikat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92471dd94c373ffc053782f1e431f2929c5f1be7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE63C1BC-E0F1-4B14-8307-F9FED37060E2"},"incident_date":"2016-02-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"89bf86adb1ee","org_name":"United States Soccer Federation","org_type":"other","ransomware":null,"records_affected":28,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/players-personal-information-exposed-in-u-s-soccers-lawsuit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.espn.com/espnw/news-commentary/article/14715944/us-women-personal-information-exposed-us-soccer-lawsuit"}],"summary":"PII of US woman's soccer team exposed during a lawsuit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79210b0171db671141b84075c18d7933d7702230","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2E324BB-CC4B-4B3E-9720-7443000DB3A8"},"incident_date":"2016-02-03","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"485c7b2462e6","org_name":"Magnolia Health Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/magnolia-health-corp-notifies-its-employees-after-their-data-acquired-by-someone-impersonating-ceo/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Sample%20Letter_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/healthcare-data-breach-in-ca-caused-by-impersonation-scam"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60061"}],"summary":"Pretexting using compromised email account leads to disclosure of PII for entire employee base","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47a182076d7b28abdf0f73998aa6c4d508e96b58","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E157D01A-AFCF-456D-B40C-35865F5F8094"},"incident_date":"2016-02-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"181d352f2ae4","org_name":"Canada Revenue Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-tax-agency-staffer-gone-after-taxpayer-data-leaks-to-csis/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/taxslayer-data-breach-leaves-thousands-us-financial-accounts-tax-filings-risk-1541539;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/politics/csis-cra-taxpayer-information-1.3428855"}],"summary":"taxpayer information obtained without a warrant ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3765594fade148b4cfefad4709e8c88401913c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD46C10E-290F-4656-BDBF-BEFECA9567FA"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13ec40735a45","org_name":"York Hospital","org_type":"healthcare","ransomware":null,"records_affected":1483,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/me-data-breach-hits-york-hospital-employees/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.seacoastonline.com/news/20160224/data-breach-hits-york-hospital-employees;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/york-hospital-breach-compromises-pii-of-1400-employees/article/479549/"}],"summary":"York Hospital has been hit by cyber criminals who stole identifying information from employees, but the hospital says patient information was not targeted. A press release sent out Wednesday afternoon said there is no indication at this time that patient health information, which","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8642df38921711c2508389fae86b36820e7825e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A9C05FA-10CB-4D95-BC8D-9F4C6B8421D7"},"incident_date":"2016-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ba8001343486","org_name":"Whanganui District Health Board","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nz-health-board-hit-with-ransomware/"}],"summary":"Ransomeware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"758b52d4cd706f6178a7883a4cfe181677b24461","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BE6A542-2075-4356-AAD7-FD91449EB55F"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39b29e03c728","org_name":"Weebly","org_type":"technology_saas","ransomware":null,"records_affected":43430316,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3133031/security/weebly-data-breach-affects-43-million-customers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2016/10/weebly-foursquare-data-breach.html?m=1;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.leakedsource.com/blog/weebly/"}],"summary":"Weebly, a San Francisco-based company that has allowed more than 40 million people create websites with since 2007; will start sending notification letters to all of their customers on Thursday, informing them of a data breach that occurred eight months ago.  The breach, affectin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad1fe5e7e8e42160d0c0d282fa0a3f9215b2c58d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE91447C-FEEB-4261-902A-B1D5831117E7"},"incident_date":"2016-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ce1afa8f24e9","org_name":"Victim Services","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/2495386/manitoba-victim-services-discloses-confidential-information-to-wrong-person/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/manitoba-victim-services-discloses-confidential-information-to-wrong-person/"}],"summary":" voicemail left by a victim services worker revealed confidential information about an incident concerning the welfare of a child to a person with no connection to the people involved","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73bf223ce98c72b023aa9fccc5f685d008c84d05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85b67710-084a-11e8-8ccf-e3865b9fabe5"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5beb6d4f9cf3","org_name":"Verticalscope.com","org_type":"technology_saas","ransomware":null,"records_affected":25000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2017/11/2nd-breach-at-verticalscope-impacts-25m/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/leakedsourcecom-finds-45m-leaked-verticalscope-user-records/article/529437/"}],"summary":"For the second time in as many years, hackers have compromised Verticalscope.com, a Canadian company that manages hundreds of popular Web discussion forums totaling more than 45 million user accounts. Evidence of the breach was discovered just before someone began using that illi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"608696a93d689f0c207a26feb2d6394d0288f66b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D1D41C4-5A45-4F84-9A7D-1032030ABF21"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"049781fda739","org_name":"VerticalScope","org_type":"professional_services","ransomware":null,"records_affected":45000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/hacker-steals-45-million-accounts-from-hundreds-of-verticalscope-car-tech-sports-forums/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/hackers-make-off-with-over-40-million-passwords-from-1000-sites;"},{"fetched_at":null,"title":null,"type":"press","url":"http://business.financialpost.com/fp-tech-desk/0616-biz-sc-hack?__lsa=b6e4-6441;"},{"fetched_at":null,"title":null,"type":"press","url":"http://securityaffairs.co/wordpress/48404/deep-web/verticalscope-data-breach.html"}],"summary":"Hacker steals 45 million accounts from hundreds of car, tech, sports forums - VerticalScope","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e2831cf7501fe5f75ef057bc078d0a54c8b8a10","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F06767CD-BD54-44A6-BB12-34312ACCA86C"},"incident_date":"2016-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"db91f8c8f49e","org_name":"Vancouver Division of Family Practice","org_type":"healthcare","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-medical-files-of-4000-vancouver-patients-stolen-raising-alarms/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vancouversun.com/news/metro/medical+files+vancouver+patients+stolen+disturbing+privacy/11768758/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/theft+medical+records+people+raises+alarms/11768713/story.html"}],"summary":"Thieves who burgled a West Broadway office last month stole the personal medical files of 4,000 Vancouver patients, likely by far the largest privacy breach of medical records in B.C. in 10 years or longer.  And the ease with which the thieves were able to walk off with the sensi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PT","motive":"financial","name":"@ECHOison","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6af17943af9c8de755fcec758cecc149d8cf9cf9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E182B737-F747-4500-A857-AD95E0FABBEB"},"incident_date":"2016-02-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7ba5a620acb3","org_name":"University of Liverpool","org_type":"education","ransomware":null,"records_affected":6500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworlduk.com/news/security/university-of-liverpool-database-of-6500-staff-posted-on-dark-web-forum-3637726/"}],"summary":"PII on dark net","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"echoison"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f9e6865e0bb9ea1cd0a10c9cf004c8fcd883c36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB81AC88-6885-4B74-A176-228222E995B8"},"incident_date":"2016-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a108403711fd","org_name":"U.S. Forest Service","org_type":"other","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/news/crime/ex-forest-service-worker-accused-of-hacking-co-workers-identities-b99740780z1-382372991.html"}],"summary":"identity theft from co worker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"TeaMp0sioN","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cedc72f0c22202c486ff044b89e80dd53dab3a1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"311E3515-2F33-4116-A2B7-5DD1E4EBA4C1"},"incident_date":"2016-02-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c89647a447c","org_name":"Time Warner Cable Inc","org_type":"technology_saas","ransomware":null,"records_affected":4191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/some-time-warner-business-class-customer-data-hacked-and-dumped-by-teamp0ison/"}],"summary":"website defaced, sql attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"teamp0sion"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ea5a9a06739f7147e0e0790f999e736e61bce48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e7293050-d965-11e7-8b17-fdfed30923dd"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"69c0bc9e7bb0","org_name":"Singh & Arora Oncology Hematology PC","org_type":"healthcare","ransomware":null,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/six-months-after-learning-of-problem-michigan-cancer-treatment-provider-notifies-22000-patients/"}],"summary":"Breach of server - little details provided","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e951037e8b9973e73b37230ee8667a233e8fdb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36FC11FE-1C08-4552-BB69-BD0620DA3CFF"},"incident_date":"2016-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a80381e61be","org_name":"Ohio Department of Mental Health and Addiction Services","org_type":"government","ransomware":null,"records_affected":59000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ohio-department-of-mental-health-and-addiction-services-ohiomhas-notifies-patients-of-phi-exposure/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/potential-healthcare-data-breach-in-oh-affects-59k-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.10tv.com/content/stories/2016/05/11/columbus-ohio-data-breach-impacts-59000-ohio-children-seeking-mental-health-treatment.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mha.ohio.gov/Portals/0/assets/News/pressReleases/20160422-Media-Notice-Privacy-Breach.pdf"}],"summary":"The Ohio Department of Mental Health and Addiction Services (OhioMHAS) today notified the public of a privacy incident involving protected health information (PHI). The issue involves a February 2016 postcard sent to consumers of mental health services inviting participation in a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"392960634cd8e6a40442a9783b1704269b5eee73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0382DD1-6DE9-4B46-9F2A-0F096FA79485"},"incident_date":"2016-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9815b36ddd70","org_name":"Northeast Independent School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-ransomware-attacks-20-northeast-isd-schools/;"}],"summary":"Ransomware on school not successful","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"baf645a97c7020905d523793bab6761e99bd0ee5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DAE0CDD-F985-4A67-8704-4FDA964EC927"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67b28bf0dbd8","org_name":"Massachusetts General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://whdh.com/news/local/mass-general-hospital-announces-data-breach/"}],"summary":"breach of medical data fro 3rd party software tool","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"654620d95dade544848d72b45f8db9564704547a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2847d830-da2d-11e7-a58f-dff506a792fb"},"incident_date":"2016-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d4ada7bf058f","org_name":"Leicester City Council","org_type":"government","ransomware":null,"records_affected":349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.publicsectorexecutive.com/Public-Sector-News/ex-leicester-council-employee-prosecuted-for-illegally-taking-sensitive-data"}],"summary":"Ex-Leicester council employee prosecuted for illegally taking sensitive data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"654b07c4917b1909f187fd63ff2304ba799990c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53E207D7-BCD5-4A40-A890-A8496E76354D"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"983a6ae14c5b","org_name":"Leet.cc","org_type":"technology_saas","ransomware":null,"records_affected":6084276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/data-for-6-million-minecraft-gamers-stolen-from-leet-cc-servers-507445.shtml"}],"summary":"Unknown methods used to breach gamer site DB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46dbb0c5a936e30f2d908881a584b92afe3347c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a7861d20-d968-11e7-8b17-fdfed30923dd"},"incident_date":"2016-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a514b7679fb1","org_name":"Jackson Health","org_type":"healthcare","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.campussafetymagazine.com/hospital/hospital_secretary_patient_data_privacy_id_theft_case/"}],"summary":"Healthcare worker misuse leads to DI theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1451b9997dd8fe5d0192fa21c3837dd9c547d8b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B7F1CB2-7F5F-4539-883C-581361B89921"},"incident_date":"2016-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b296f0e6e55","org_name":"Iowa Republican Party","org_type":"nonprofit","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2016/2/4/10917236/iowa-republican-voter-records-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fastcompany.com/3056359/fast-feed/iowa-republican-party-website-exposed-2-million-voter-records"}],"summary":"Misconfiguration allowed PII to be exposed in source info on web application/DB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6ffed24102758bd69b52f3db873c17e89e91ede","impact_type":"data_theft","incident_date":"2016-01-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IA%20134%20info%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"7111ef08ed5f","org_name":"IATSE Local 134","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59899"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IA%20134%20info%20notification_0.pdf"}],"summary":"IATSE Local 134 reported that a laptop connected to the Levi’s Stadium network was breached via the internet and information was taken.","supporting_quote":null,"technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5bb03b2931741ec996dbe6ad961aa2bceb13d70","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBE90679-5E5A-43FD-B19C-0CEA3D7D0F37"},"incident_date":"2016-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f46d5836020b","org_name":"Hollywood Presbyterian Medical Center","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hollywood-presbyterian-medical-center-victim-of-cyber-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxla.com/news/local-news/89941411-story;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/hackers-demand-3-6-million-from-hollywood-hospital-following-cyber-attack-500408.shtml?utm_content=buffer5dfa6&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Nation/2016/02/17/Hospital-paid-17K-ransom-to-hackers-of-its-computer-network.html"}],"summary":"A Los Angeles hospital paid a ransom in bitcoins equivalent to about $17,000 to hackers who infiltrated and disabled its computer network, the medical center's chief executive said Wednesday.  It was in its best interest of Hollywood Presbyterian Medical Center to pay the ransom ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5878edc5bb15fd9dd589cb05adf810df7c0fdb1b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC59DB49-F46D-4739-945A-F04F8062A780"},"incident_date":"2016-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c0c2e95c9a1","org_name":"Hillcrest Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lifenews.com/2016/05/04/abortion-facility-caught-operating-without-a-license-violating-patient-privacy-laws/"}],"summary":" documents blow down the street after abortion clinic temp closed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a508aa6e074ef72f3c78df8aba244c679c675a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"535F3361-455D-4365-8B2A-933EF665A24C"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"1dc3301041eb","org_name":"Government","org_type":"government","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/security/155030-anonymous-hacks-sa-government-database.html;"}],"summary":"Anonymous hack South Africa Government database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a09a40c3f0b914ebe2fcbb8f50f5cbb65fa15479","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A604000-90FC-4563-9E59-F6EE7EDC41A5"},"incident_date":"2016-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bb3f144a7193","org_name":"Gold Coast City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.goldcoastbulletin.com.au/news/council/mayor-tom-tates-office-leaked-confidential-information-to-election-candidate-staffer-stood-down/news-story/97f9bcf5b45468095e2fbf160dabc657?nk=1d7886cdc97f12926f722c4034196e59-1461391085"}],"summary":"Documents mailed to incorrect recipients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4503e80f3a6beaaf05a4204db9588b4b99df81e5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27615c00-0561-11ea-889a-bd9e961d3ab1"},"incident_date":"2016-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d31adf788896","org_name":"Eternal Word Television Network","org_type":"technology_saas","ransomware":null,"records_affected":425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ewtn-reports-security-breach-of-425-employees-data/,https://www.al.com/living/2016/02/ewtn_reports_security_breach_o.html"}],"summary":"W2 details stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"488f3f2487c7a2c04dca235d4b26e9b87f2dd10b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF5DAC91-F937-4CB5-87F3-35228422DE29"},"incident_date":"2016-02-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4793fb07c136","org_name":"Department of Justice","org_type":"government","ransomware":null,"records_affected":31530,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3030702/security/hackers-leak-dhs-staff-directory-claim-doj-is-next.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://marketbusinessnews.com/hackers-leak-personal-information-of/124090;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/hacker-plans-to-dump-alleged-details-of-20000-fbi-9000-dhs-employees"}],"summary":"hacked and downloaded 200GB of data from the US Department of Justice's internal network","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd202f9cea039cc5a16749e71b55558b53b8fab0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A73F6074-FD44-40BB-81B5-77B0482A2708"},"incident_date":"2016-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"d0310017eff4","org_name":"Danske Bank A/S","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://yle.fi/uutiset/danske_bank_employee_suspected_of_skimming_funds_from_customers_account/9123350"}],"summary":"bank employee siphoned funds directly from a users account ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"10975b6859b38c5f33d867f40f37d8b7fa97a916","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/CenteneCorporation.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f4d651336b2a","org_name":"Centene Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/CenteneCorporation.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"593516412057b9cfaf665e864ed029ce1c27c40d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39CDD35C-E003-44F6-BC71-83C604D448A7"},"incident_date":"2016-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc10.com/news/local/stolen-state-laptop-puts-patient-information-at-risk/191106955"}],"summary":"Stolen state laptop puts patient information at risk.  A laptop was stolen that may contain the personal information of patients. The theft happened from the employee's personal vehicle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2739639c8523ef0a57cf018e35281e0030b1cce7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"798AFB14-F0B7-42FB-B878-550590561FCD"},"incident_date":"2016-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d375e590a1a0","org_name":"Bundle Stars","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shacknews.com/article/93341/bundle-stars-prompts-user-password-reset-due-to-irregular-account-activity;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theinquirer.net/inquirer/news/2447605/bundle-stars-hack-steam-deal-site-sets-fire-to-user-passwords"}],"summary":"accounts stolen from bundle stars","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69c87189ecafd30edaec57bccb397aec195953e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"641ccab0-af5c-11e7-b9af-6daebc71dd3b"},"incident_date":"2016-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f50da9d747a","org_name":"Briar Hill Management","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/briar-hill-management-notifies-2000-nursing-facilities-residents-of-lost-laptop/"}],"summary":"Briar Hill Management notifies 2,000 nursing facilities residents of lost laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"699b79d130cdd65274cd992953eb5eba1c6c7f9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f67e49b0-bf06-11e7-a9c6-17df034f6c5e"},"incident_date":"2016-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"902ef0604c86","org_name":"Boeing","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://losangeles.cbslocal.com/2017/09/18/russian-spy-engineer/"}],"summary":"Engineer Sentenced To Prison For Selling Data To FBI Agent Posing As Russian Spy - Boeing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-31","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"494c1bbd5e87566c52a9c7c823209af0fd282698","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C5B8ABE-3FD2-4031-96C3-ED632D77447E"},"incident_date":"2016-01-31","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2b86051c288","org_name":"Noodles & Co","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bna.com/noodles-co-data-b57982073608/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/noodle-and-company-confirms-payment-card-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcci.com/news/list-of-iowa-restaurants-affected-by-new-creditdebit-data-breach/40279332;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/05/noodles-company-probes-breach-claims/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-62596"}],"summary":"POS Intrusion at numerous restaurant locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c30da12c2af5f376af02f51204a6c541d5b5957","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99D4638E-F70F-43A2-9CAD-CAC159A349E9"},"incident_date":"2016-01-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"686e99bc2902","org_name":"Empathia","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/hr-vendor-empathia-hit-by-potential-breach/article/501544/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Empathia%20-%20Notice%20of%20Data%20Event%20Notice%20Only-%20CA_0_0.pdf"}],"summary":"third-party vendor Empathia announced a potential data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"weak_or_reused_password","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-29","discovered_date":"2016-01-13","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"971e99354f5894ce36b9ab29d0bf8caf16715436","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TaxSlayer%20CA_0.pdf"},"notes":null,"org_country":"US","org_id":"fed5986fe59e","org_name":"TaxSlayer","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker reportedly obtained the TaxSlayer username and password from another online service.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59859"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TaxSlayer%20CA_0.pdf"}],"summary":"TaxSlayer reported that an unauthorized third party may have accessed customer accounts using usernames and passwords obtained from another online service.","supporting_quote":"As a result of ongoing security reviews, TaxSlayer identified on January 13, 2016 that an unauthorized third party, whom we believe obtained your username and password from another online service, may have accessed your TaxSlayer account between 10/10/2015 and 12/21/2015.","technology_involved":["TaxSlayer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-29","discovered_date":"2015-12-03","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3dc452e6703a5b1c720698b610b80f260bb361e3","impact_type":"unknown","incident_date":"2014-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfa225bf249c","org_name":"Landry’s, Inc., Golden Nugget Atlantic City, LLC, Golden Nugget Lake Charles, LLC, GNL Corp., GNLV C","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Landry%E2%80%99s%2C%20Inc.%2C%20Golden%20Nugget%20Atlantic%20City%2C%20LLC%2C%20Golden%20Nugget%20Lake%20Charles%2C%20LLC%2C%20GNL%20Corp.%2C%20GNLV%20C-2016-01-29"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d3fc749cd5d72ddf0d714ab45b019f2ea958ab7","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Landry%27s%20CA%20substitute%20notice%20and%20press%20release_0_0.pdf"},"notes":null,"org_country":"US","org_id":"6f55df3b49ba","org_name":"Landry’s, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59857"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Landry%27s%20CA%20substitute%20notice%20and%20press%20release_0_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9608.pdf"}],"summary":"Criminal attackers installed a program on payment card processing devices at certain Landry’s locations to search magnetic-stripe payment card data.","supporting_quote":null,"technology_involved":["payment card processing devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd437994868767353737b19de6f434312e294a2c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AB8C71D-D9A9-49C1-BEE9-492B08F31DC6"},"incident_date":"2016-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"818647b93ea5","org_name":"JASACare","org_type":"healthcare","ransomware":null,"records_affected":1154,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/jasacare-email-system-breach-impacts-1154-patients-3370/"}],"summary":"Healthcare employee email account breach via undisclosed method. Email with over 1000 patient and employee PII potentially viewed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14c08621b705a3987c6b580ffd5a324f430e7453","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1058B7C-244A-4392-861C-994A749C0C6C"},"incident_date":"2016-01-28","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"f20b40dc6cda","org_name":"YJFX","org_type":"financial","ransomware":null,"records_affected":185626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ex-employee-of-yahoos-forex-broker-yjfx-stole-clients-data/;"}],"summary":"former employee stole data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2016-01-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ab8d15ad1eb52fdde915e23c7372036c524b7d9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"261FEF4F-E2E8-48B6-B84F-34816A67D138"},"incident_date":"2016-01-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe1dbd535ef6","org_name":"Fraternal Order of Police","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/hacktivist-dumps-controversial-data-belonging-to-america-s-biggest-police-union-499615.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fraternal-order-of-police-hacked-members-data-dumped/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/us-news/2016/feb/07/leaked-police-files-contain-guarantees-disciplinary-records-will-be-kept-secret"}],"summary":"FOP hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26cb65edb68f3ac2a98f29112de9850db8afef40","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ABB52ABF-0B66-444F-B062-335A53FA6034"},"incident_date":"2016-01-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a372e293de44","org_name":"Saban Community Clinic","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://norcalrecord.com/stories/511011527-man-alleges-saban-community-clinic-tested-him-for-hiv-without-permission"}],"summary":"allegedly hostile to plaintiff and ordered an HIV test, which plaintiff refused to undergo ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"524d1c9487cc15c134c72935abdb8134f505c411","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26BAD79D-0A84-4254-BB20-C34BF605E15A"},"incident_date":"2016-01-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0faffc71faa5","org_name":"Lafler, Moore, Connerty & Webb","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/californian-accounting-breached-tax-and-pii-info-exposed/article/494373/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Lafler%20AllClear%20letter%20Proof_1.pdf?"}],"summary":"User noticed irregular mouse activity and it was confirmded that the device was compromised and W-2 information was leaked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a8b95f900a8eda15be6ccfd942328094fcaf7ea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C21F889-70B1-4B2B-9B6A-D9B0029F77AE"},"incident_date":"2016-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"709c9fdb6086","org_name":"W. Christopher Bryant DDS P.C.","org_type":"healthcare","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://d1li5256ypm7oi.cloudfront.net/yourgrandblancdentist/2016/03/Security-Risk-Letter.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/michigan-dentist-notifies-patients-of-missing-backup-drive/"}],"summary":"back up HD missing after security upgrades","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Blink Hacker Group","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad34c70676d211800955193510391a7b21fb3065","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3128D19-B718-4C53-A640-67828904EB77"},"incident_date":"2016-01-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"ffa3f634d975","org_name":"Thai Prison Websites","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-takes-down-20-thai-prison-websites-499543.shtml"}],"summary":"Prison Websites hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"blinkhackergroup"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6be27625cd91eda96469318855b7742ac61a2240","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"857A9015-007D-433D-8CF7-5C89E3D179DB"},"incident_date":"2016-01-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bdc9459cc842","org_name":"Mercy Hospital","org_type":"healthcare","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcci.com/news/iowa-city-hospital-reports-patient-information-breach/38702378;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/data-capturing-virus-discovered-by-mercy-hospital-in-iowa-city-3373/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mercy-iowa-city-and-mercy-clinic-notify-patients-after-alerted-to-malware-by-law-enforcement/"}],"summary":"About 15,000 patients have been notified that a computer virus designed to capture personal data infected some of the hospital's computers in January, an official with Mercy Iowa City and Mercy Clinics in Iowa City said Monday.  \"That's a small percentage\" compared with the total","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ee71a1bd68f5c62e9093740491e24d95b1f3a11","impact_type":"unknown","incident_date":"2015-12-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ag_hsa_1_26_16_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b14f2c628d37","org_name":"County of San Diego","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59801"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48b837d0fdcfc7923131d17386ecf17515157cc7","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C2015030179%20%20-%20Customer%20Letter%20-%20CA%20AG%20Online%20Submission_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59799"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59798"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59818"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59836"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60159"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60171"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-60413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C2015030179%20%20-%20Customer%20Letter%20-%20CA%20AG%20Online%20Submission_0.pdf"}],"summary":"American Express said a third-party service provider experienced unauthorized access, and some card account information may have been involved.","supporting_quote":"We became aware that a third party service provider engaged by numerous merchants experienced unauthorized access to its system.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"6f4aa93d05eb5d4fc80447d31ad01fa9ce3a9005","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/YapStone%2CInc..pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6960c532a72d","org_name":"YapStone, Inc.","org_type":"unknown","ransomware":null,"records_affected":2896,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/YapStone%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4213456dfa98f3bf852fd2f4b962c9379d2260a9","impact_type":"unknown","incident_date":"2015-12-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RealSelf%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5c542fdae738","org_name":"RealSelf, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59793"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4bf21e3263a24cbf30ea8859a3de4f3512fa13e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9242C268-4AB8-4B18-B3B6-316FEED63778"},"incident_date":"2016-01-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"227b692c354a","org_name":"Medfield city government","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/blogs/town-faces-ransomware-infection-blinks-p-2055;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/metro/2016/02/02/town-medfield-pays-ransom-free-computer-system/oHZB3bYC20lW39kSJJsrKI/story.html"}],"summary":"city pays ransom ware to unencrypt servers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-25","discovered_date":"2015-12-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83baff85067bacc2d67028e14d788f3e7dcce28c","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HealthEquity%20CA%20Notification%20inc1142_0.pdf"},"notes":null,"org_country":"US","org_id":"51e4ea4a3323","org_name":"HealthEquity","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HealthEquity%20CA%20Notification%20inc1142_0.pdf"}],"summary":"A HealthEquity employee inadvertently emailed a recipient at another employer the affected person’s name and Social Security number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-25","discovered_date":"2016-03-25","entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"298ecfec7a2020e77d9e86573670a10963f321f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"551F7BB4-5DE8-4A9B-B23E-DBA464E69064"},"incident_date":"2016-01-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed02850ede61","org_name":"CertifiKid","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CertifiKid%20Sample%20Consumer%20Notice_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61677"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9619.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Certifikid-2016-05-27"}],"summary":"Malware installed via web application compromised stored payment card data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22e097e04416afbab55288ff3c6cc184b8f7d72","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CAVA%20Notice%20of%20Data%20Breach_Teacher%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0377dd8a3c5c","org_name":"California Virtual Academies","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59786"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CAVA%20Notice%20of%20Data%20Breach_Teacher%20Notice_0.pdf"}],"summary":"California Virtual Academies reported that a researcher accessed information through a vulnerability in a data storage system.","supporting_quote":null,"technology_involved":["data storage system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"146ec8ec74afcebd15c68d01d76c4187515c66a0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8887D25D-DAF9-477D-BE3F-CB86ACF2243D"},"incident_date":"2016-01-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/5-laptops-stolen-from-alberta-health-services-office-in-edmonton-1.3434749;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/5-laptops-stolen-from-alberta-health-services-office-in-edmonton/"}],"summary":"Five password-protected laptops were stolen from the Edmonton offices of Alberta Health Services last week, police confirmed Thursday.  The theft occurred during a break and enter at the Coronation Plaza offices near 111th Avenue and 142nd Street in Edmonton on the evening of Jan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2fdf06a07116bf12077584e6a47ef41bb75584d","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-03","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"46fb5ad409d8","org_name":"vBulletin","org_type":"technology_saas","ransomware":null,"records_affected":518966,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: vBulletin","type":"hibp","url":"https://haveibeenpwned.com/Breach/VBulletin"}],"summary":"A breach of vBulletin exposed forum user and customer account data, including email addresses, birth dates, security questions and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50cde7835022365a4dca3a19667389bc1e4e6104","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F155F2D7-F75F-4FB2-967D-C2235659110D"},"incident_date":"2016-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b896e553b1dc","org_name":"Uber","org_type":"transportation_logistics","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2016/1/25/10827996/uber-driver-personal-data-mistake-glitch"}],"summary":"PII mistakenly sent to other drivers as the result of a software glitch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77544aa4f79dc8e3c02bb21b786e80366b492fbd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9323E054-319E-4EF2-8CAE-1748D41E72E6"},"incident_date":"2016-01-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4b0163e6e64","org_name":"Oakmont High School","org_type":"education","ransomware":null,"records_affected":365,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thepresstribune.com/article/2/10/16/oakmont-high-student-transcripts-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcra.com/news/356-oakmont-high-school-students-transcripts-stolen/37831706"}],"summary":"transcripts stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-24","discovered_date":"2016-03-11","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90b731714dc4540b365b139aebdf8d048c467b15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ba05f70-dae7-11e9-aa50-b778a2874faa"},"incident_date":"2016-01-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30748c32b292","org_name":"Hi-Tec Sports USA, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":17635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/HT_CA_Notice_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-61796"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Hi-Tec%20Sports%20USA%2C%20Inc.-2016-05-11"}],"summary":"malware installed on an online payment site stealing cc numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"563814847ee101bcadd43df454d224ffb7f656b1","impact_type":"data_theft","imported_from":null,"incident_date":"2012-12-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"4ced44a58b7d","org_name":"Heroes of Newerth","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Heroes of Newerth","type":"hibp","url":"https://haveibeenpwned.com/Breach/HeroesOfNewerth"}],"summary":"Heroes of Newerth was hacked in December 2012, and usernames, email addresses, and passwords were extracted.","supporting_quote":null,"technology_involved":["Heroes of Newerth"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":"SA","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"158e1905a25edb9318a5efd2cd1e0594882f3a48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFDFE7D9-A14E-4513-9687-E9E6DDE3DB38"},"incident_date":"2016-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"26b441d6ac42","org_name":"BOHEMIA INTERACTIVE a.s.","org_type":"professional_services","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/dayz-forums-hacked-over-200-000-user-details-compromised-499988.shtml;http://www.pcgamer.com/dayz-forums-hacked-user-info-and-encrypted-passwords-stolen/"}],"summary":"The online forums of the DayZ gaming community were compromised around January 23 by a group of Saudi Arabian hackers known as OurMine.  DayZ is an open-world survival video game and the stand-alone version of the award-winning ARMA II mod of the same name. The game, developed by","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5163c9c4bacf4fe864ad114bfc30f3df0fdf1dff","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0870145B-9AE7-4657-9A4A-3AEEF4B48C69"},"incident_date":"2016-01-22","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96cf6df33df1","org_name":"Village of Oak Park","org_type":"government","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/village-of-oak-park-incident-reported-to-hhs-six-months-later/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chronicleillinois.com/news/cook-county-news/oak-park-officials-investigating-release-of-private-employee-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chronicleillinois.com/news/cook-county-news/fired-oak-park-employee-files-whistleblower-lawsuit/"}],"summary":"emailed spreadsheet files to her personal computer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25b09efba822ab9ca7ed2d11cc5fb98ab5f2adaa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90276F9C-EC9B-4859-9A4C-B9C315C2A7A1"},"incident_date":"2016-01-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6a4550882cf7","org_name":"Telstra","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-telstra-privacy-breach-leaves-customers-voicemail-exposed/"}],"summary":"was receiving his personal Telstra voicemail messages to two phones","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5601a7dd2a864a4e85da584304eb030f1ebe3344","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9607.pdf"},"notes":null,"org_country":"US","org_id":"4b8d16692e0a","org_name":"Starwood Hotels and Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9607.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9607.pdf"}],"summary":"Starwood reported that malware on point-of-sale systems at some North American hotels allowed unauthorized parties to access customers’ payment card data.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb00c62752ab6fdb8aedeff778076fdef357441e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8F76242-C068-45E7-ADC6-EE7238776687"},"incident_date":"2016-01-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/misconfigured-mongodb-installation-left-microsoft-careers-site-vulnerable-to-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/microsoft-careers-data-exposed-by-mongodb-flaw/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/microsoft-secure-boot-key-debacle-causes-security-panic/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techtimes.com/articles/173282/20160811/microsoft-accidentally-leaks-golden-keys-that-unlock-secure-boot-protected-windows-devices-oops.htmhttps://www.grc.com/sn/sn-573-notes.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techtimes.com/articles/173282/20160811/microsoft-accidentally-leaks-golden-keys-that-unlock-secure-boot-protected-windows-devices-oops.htm"}],"summary":"database was vulnerable to compromise and may have been serving arbitrary HTML through the mobile version","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0449326ce6a5fd0860136b39944ae7cd86512f32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"727C3DC1-4B43-4E8A-B8AE-7E6938D954F8"},"incident_date":"2016-01-21","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b8bbd3030f6","org_name":"NCH Healthcare Systems","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nch-healthcare-employee-data-compromised-by-business-associate-breach/"}],"summary":"Employee misuse ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78a89278bab9f98b475d1fbf4b7d3501fc1455b5","impact_type":"unknown","incident_date":"2015-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KickyPants%20General%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"18c5f3033628","org_name":"Kicky Pants, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KickyPants%20General%20Notice_0.pdf"}],"summary":"Kicky Pants, Inc. reported that compromised information included names, credit card details, billing addresses, telephone numbers, and email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63f6a1a136eb64e9ba34dfc83d9ac88ee907473d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE067CB9-B108-4066-851D-2927244135ED"},"incident_date":"2016-01-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"927db14df5f9","org_name":"Wiener Linien","org_type":"transportation_logistics","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fderstandard.at%2F2000029438860%2FDatenpanne-Wiener-Linien-geben-hunderte-E-Mail-Adressen-weiter&edit-text=;"},{"fetched_at":null,"title":null,"type":"press","url":"http://derstandard.at/2000029438860/Datenpanne-Wiener-Linien-geben-hunderte-E-Mail-Adressen-weiter"}],"summary":"Email sent exposing email address of 100's","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9b69c5cfa67c2c8438f6ad79a8e327dbb04efab","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5B9F704-3A92-4538-839C-C424439A49E9"},"incident_date":"2016-01-20","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56cc09b22c3e","org_name":"St. Mary's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.freep.com/story/news/nation/2016/09/10/fake-teen-doctor-malachi-love-robinson-arrested-news-charges/90200870/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.freep.com/story/news/2016/02/17/cops-fake-teen-doctor-opened-own-office-newser/80506962/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newser.com/story/201557/cops-teen-posed-as-obgyn-for-a-month.html"}],"summary":"may have noticed that Dr. Malachi Love-Robinson looked a little young to be a doctor. That's because he's only 18 years old  and he isn't a doctor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1a79632209e3f41df2fb57d563e51d2791f7c17","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8E9958F-1964-43C2-9FFD-18626E762388"},"incident_date":"2016-01-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"361153e507a2","org_name":"Royal Melbourne Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-hack-attack-on-a-hospital-it-system-highlights-the-risk-of-still-running-windows-xp/"}],"summary":"A report this week in The Age said a \"computer virus\" has affected Windows XP systems across the hospital, interfering with the delivery of meals and pathology results. Staff have resorted to \"manual workarounds\", telephones, and fax machines to ensure continued delivery of these","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"985724c572c8a790471657b1e6c015b99253df9c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C898316E-4711-45EF-83A1-45DD742C2AC3"},"incident_date":"2016-01-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"973f7532ddf9","org_name":"Life Time Fitness Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://clubindustry.com/profits/life-time-fitness-files-lawsuit-against-former-regional-vice-president"}],"summary":"elected to pilfer\" proprietary business information, duplicate Life Time's business model","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08a751b0de9141b39d26ab8352911466d670cc32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5EC74643-0F36-4F2A-BEBD-98A0110162C2"},"incident_date":"2016-01-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"4b3789d2a23e","org_name":"Irish National Lottery","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/irish-national-lottery-shut-down-via-ddos-attack-right-before-big-draw-499381.shtml"}],"summary":"DDoS attack launched by an unknown attacker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5bd9d10e9bcd0a63a2ce63312b8891319163ea3","impact_type":"data_theft","imported_from":null,"incident_date":"2012-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"DE","org_id":"c1d348f051c1","org_name":"Gamigo","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gamigo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gamigo"}],"summary":"Gamigo was hacked in March 2012, and email addresses and passwords from more than 8 million accounts were publicly leaked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2016-01-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"802b981cd01c5038cefb0f7b6683cc4fb6a05a6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36FB010D-2EE8-462F-B4F2-71088E3BC8CD"},"incident_date":"2016-01-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d2b237a483a","org_name":"City of Hope Hospital","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/email-accounts-compromised-city-of-hope-hospital-phishing-attack-3344/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/city-of-hope-employees-fall-victim-to-phishing-attack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-phishing-scam-nets-patient-info-from-city-of-hope-employees-email-accounts/"}],"summary":"Phishing campaign leads to disclosure of 4 credentials to mail accounts and use of creds discloses PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2016-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c89d92e055031a234d5766cafd5656296366ff1d","impact_type":"data_theft","imported_from":null,"incident_date":"2013-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5c35f1bdae30","org_name":"Nexus Mods","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Nexus Mods","type":"hibp","url":"https://haveibeenpwned.com/Breach/NexusMods"}],"summary":"Nexus Mods reported a breach dated July 2013 that exposed usernames, email addresses, and salted-hash passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44b2e8ec7728c2269f557e98ddb9fb586361ed0e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92b6b920-70a6-11e7-955a-c3e87cda4766"},"incident_date":"2016-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"2828c25aacec","org_name":"Tsinghua University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/isis-hackers-deface-university-website-in-its-first-ever-cyberattack-on-china-499075.shtml"}],"summary":"ISIS Hackers Deface University Website in Their First Ever Cyberattack on China","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71bc3f5b35b5f63a8175a2c400597a38e7ce8ad1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68C984C9-3535-4B5F-BC55-076BB6D5287F"},"incident_date":"2016-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c80618524481","org_name":"Australian federal police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/au-police-accidentally-gave-victims-details-to-alleged-attacker/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/australia-news/2016/jan/19/police-accidentally-gave-victims-details-to-alleged-attacker-documents-show"}],"summary":"accidentally revealed the personal details of an assault victim to the alleged perpetrator, risking the safety of the complainant and his family, according to an AFP risk assessment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2016-01-15","discovered_date":"2015-11-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee36ad266433c284f8539f18e85d834fd75251c2","impact_type":"data_theft","incident_date":"2015-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9606.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9d03f33c97f0","org_name":"MaineGeneral Medical Center","org_type":"healthcare","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9606.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/MaineGeneralMedicalCenter.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9606.pdf"}],"summary":"MaineGeneral data containing personal and medical information was found on an external website after unauthorized access on or about September 11 and 12, 2015.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"grudge","name":"Anonymous","variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31d485592af8cf173313518b1254a70971013246","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1F355C1-7FB0-47AB-83D4-767F7DC698B7"},"incident_date":"2016-01-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61cb1827dc39","org_name":"Hurley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hack-by-anonymous-created-hassles-for-hospital-patients-during-flint-water-crisis/"}],"summary":"Blended attack (DDoS, phishing, malware) launched in protest of Flint water debacle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2016-01-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fcb0c427596c75cc9f1fa099e335321915822e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d3a45c30-c4f0-11e9-bbcb-6517d645041f"},"incident_date":"2016-01-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"796448685279","org_name":"Availity","org_type":"professional_services","ransomware":null,"records_affected":522,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/humana-notifies-500-texas-members-about-security-breach.html"}],"summary":"actors  posing as drs downloaded healthcare information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd8c9bca76e236439f96a39a2b7eb6d11cc55319","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03F31826-3C08-445D-8645-F7B94DAD0439"},"incident_date":"2016-01-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71d9f296d454","org_name":"Winnipeg Regional Health Authority","org_type":"government","ransomware":null,"records_affected":67,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegsun.com/2016/01/27/more-patient-records-stolen-from-wrha;"},{"fetched_at":null,"title":null,"type":"press","url":"http://winnipeg.ctvnews.ca/wrha-apologizes-after-theft-of-nurse-s-bag-compromises-clients-privacy-1.2752560"}],"summary":"Health officials are apologizing after a nurse's bag was stolen containing some personal health information, potentially impacting dozens of people. \"On behalf of the health region, (I) want to apologize to the 67 people whose client information has been stolen,\" said Real Clouti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9dcaa175292597885fd8719f3674263d9b024255","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"549B19B2-F5EF-4A10-8037-F4F8E746E9A5"},"incident_date":"2016-01-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"645bb3275e8f","org_name":"Vilas County Jail","org_type":"government","ransomware":null,"records_affected":85,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lakelandtimes.com/main.asp?SectionID=9&SubSectionID=9&ArticleID=28207;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wi-vilas-county-jail-inmates-had-personal-info-disclosed-online/"}],"summary":"inmates PII posted on web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b37c6c2f266a2e45c956c30768129f4a024cbc42","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70360291-9A97-4F9E-99AF-D500C14B5F1C"},"incident_date":"2016-01-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b039cbdaa037","org_name":"Vidant Health","org_type":"healthcare","ransomware":null,"records_affected":897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/healthcare-data-breach-in-ca-caused-by-impersonation-scam;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nc-vidant-health-notified-employees-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;jsessionid=E1686250BFB260412DB1FEDDA9A2A53D.ajp13w"}],"summary":"Healthcare data breach affects employees at Duplin Hospital  A healthcare data breach has affected an undisclosed number of employees at Duplin Hospital, an affiliate of Vidant Health, says an article from Reflector.com.  According to a statement from Vidant Health, employee info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a09d59be76899f710ec256b5e5c3a8a10539eb1","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-09-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Adult_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Log-in credentials for certain Blue Shield customer service representatives were misused to access the vendor’s data systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59626"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Adult_0.pdf"}],"summary":"Blue Shield of California reported that misused customer service representative credentials were used to access personal information held in a vendor’s data systems.","supporting_quote":"We believe that the unauthorized access happened between September and December of 2015 and was the result of log-in credentials for certain Blue Shield customer service representatives being misused.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"471fb15fb9dd5bcf94d3f590cba24f76db5fba32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61B6CC94-6EDB-4A78-A70B-69115B2B96CE"},"incident_date":"2016-01-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9d32717e5f2","org_name":"Roark's Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/almost-13000-affected-by-recent-pharmacy-data-breaches-3350/"}],"summary":"A burglary at Roark's Pharmacy in Oneida, TN., in January has impacted 3,000 of the store's customers. A hard drive containing customer prescription information and personal data was stolen by thieves who broke in to the pharmacy in the early hours of January 13. The break-in and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19ceac6d534c6e5dd344aef8970fae801177e7ac","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-12-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IdGrd_1_Version6%20Public_0.pdf"},"notes":null,"org_country":"US","org_id":"9cafa450d027","org_name":"HSBC Bank USA, National Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The mortgage servicing provider inadvertently included personal information on disks sent to an unauthorized commercial third party.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59603"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IdGrd_1_Version6%20Public_0.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#HSBC%20Bank%20USA%2C%20National%20Association-2016-01-14"}],"summary":"HSBC’s mortgage servicing provider inadvertently sent disks containing customer information to an unauthorized commercial third party, which HSBC said did not access or view the customer data.","supporting_quote":"We recently became aware of an incident in which HSBC’s mortgage servicing provider sent encrypted and password protected disks, which inadvertently included some of your personal information, to an unauthorized commercial third party (a firm that performs financial analytics).","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"8ffadec92f82cd7fd43ae6ea936489e815b70ea4","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9604.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9ceea47112fc","org_name":"HSBC Bank USA","org_type":"unknown","ransomware":null,"records_affected":2271,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9604.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/HSBCBankUSA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"030a586e7fd3d57aac4f18867f19f908228b579c","impact_type":"unknown","incident_date":"2015-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/RateMyProfessors%20User%20Notification%2020160106%20-%20Attach%20to%20California%20AG%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53c23d74b62f","org_name":"RateMyProfessors.com LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59576"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2016-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f30b8d74ea0b2e6524ded2ec3b40becbc1bf3418","impact_type":"data_theft","incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/00631462_0.PDF"},"notes":null,"org_country":"US","org_id":"baa7cc17e754","org_name":"JB Autosports, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/00631462_0.PDF"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/JBAutosports%2CInc..pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#JB%20AUTOSPORTS%20INC-2016-03-02"}],"summary":"JB Autosports reported that attackers intercepted customer personal and payment information entered on its websites’ checkout page while it was being transmitted to PayPal.","supporting_quote":null,"technology_involved":["website checkout page"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2016-01-12","discovered_date":null,"entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e7de788f98a799b356111d3d0a4d56f035dee57","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/20160111%20Account%20accessed%20CA_clean%20version_0.PDF"},"notes":null,"org_country":"US","org_id":"7ab7857a80e4","org_name":"Blucora, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59569"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/20160111%20Account%20accessed%20CA_clean%20version_0.PDF"}],"summary":"An unauthorized third party accessed a TaxAct account using username and password combinations obtained from outside TaxAct, and tax returns in the account may have been opened or printed.","supporting_quote":"We have no evidence that any TaxAct system has been compromised and believe the third party used username and password combinations obtained from sources outside of our own system.","technology_involved":["TaxAct"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc6fdf17e45aa586782122a34bba9db3456d247a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6097C59B-E325-42CB-9C9C-D217DF68E677"},"incident_date":"2016-01-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08b29eb26a42","org_name":"The Islamic Center of Wheaton (ICW)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://america.aljazeera.com/articles/2016/1/12/islamophobia-wheaton-illinois-college.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/illinois/wheaton/police-probe-fake-website-targets-wheaton-mosque-0"}],"summary":"website set up with same web address except domain name","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f8bfa53f7533c1a657bb01970743d829bf6dbbf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FD76913-EABE-41BD-A053-74D7CF5E9AED"},"incident_date":"2016-01-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93f0d17fb73a","org_name":"Pinnacle Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.joplinglobe.com/news/police-skimming-device-found-on-bank-s-atm/article_56c20f68-b960-11e5-b860-4723ede95f50.html"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afee55aacbb4c9dae59341c3da023a9ec90e20d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1055F1B-11F0-4854-9237-6CBBB1D47A96"},"incident_date":"2016-01-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/portland/index.ssf/2015/03/customer_claims_drug_addict_tr.html"}],"summary":"Prescription information for man was accidentally placed in bag of another customer whose mom really really likes oxycodone and harassed the customer for drugs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab4f097ce123fb53fc3a7d2a6a61d4008558d466","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5944DF1-6C4E-4A51-82D1-E4860E29DC96"},"incident_date":"2016-01-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9479ae6011d","org_name":"Virginia Dept of Human Resource Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/improper-redaction-exposed-virginia-employees-personal-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://vulnerabledisclosures.blogspot.com/2016/01/state-of-virginia-dhrm-fails-to-respond.html"}],"summary":"A PDF posted by this organization contained information that was obfuscated by blocks but was a layered image so if you edit the document the blocks can be removed and the original content is then visible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff6445af2e2bce39c45e2af9f9be4d6d7248f90c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B523CF6-51BF-408E-B4A3-D729F6177ECC"},"incident_date":"2016-01-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"b81ebdbb31d8","org_name":"Construction Forestry Mining Energy Union","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-return-to-sender-unions-royal-commission-apologises-over-privacy-blunder/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/australia-news/2016/apr/06/return-to-sender-unions-royal-commission-apologises-over-privacy-blunder"}],"summary":"giving its confidential documents to another party. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7270c7ea0ee0a86d74b142978aa4de7c5475ea7b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B06151A-1315-4120-B000-81449690CC95"},"incident_date":"2016-01-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9166e231ce67","org_name":"Premier Healthcare","org_type":"healthcare","ransomware":null,"records_affected":205748,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/premier-healthcare-notifying-200000-patients-after-laptop-with-phi-stolen-from-office/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://medcitynews.com/2016/03/indiana-data-breach/"}],"summary":"Instead of a malicious hack from overseas or a ransomware attack, Premier Healthcare, a multispecialty physician group in Bloomington, Indiana, has reported a stolen laptop. (It's like 2014 all over again!) It's put the personal data of more than 205,000 people at risk.  However,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fe872914450f42361f3659931c86b0cbef15348","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6AFB317A-8218-4F53-A482-8157CB27FB87"},"incident_date":"2016-01-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e29da0e2ecb","org_name":"Cuesta College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksby.com/story/31113099/former-cuesta-college-employee-sentenced-for-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2016/feb/2/former-college-employee-gets-jail-in-identity-thef/"}],"summary":"HR employee steel PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08fab9bd3dd7bf2520916442421935903176a970","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D8C1EB9-674E-4C91-8EDD-5580E3C9916B"},"incident_date":"2016-01-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TT","org_id":"5274c53c4b6a","org_name":"Republic Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationnews.com/nationnews/news/76342/rbc-accounts-compromised;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.trinidadexpress.com/20160104/news/once-you-used-affected-machines-you-are-at-risk"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18196d62389d99a705b6371a87788b83f693cbdb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEA842E3-0E12-4522-B6EE-82A98A41D835"},"incident_date":"2016-01-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07d99d104897","org_name":"FISH AND WILDLIFE SERVICE, UNITED STATES","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.opb.org/news/series/burns-oregon-standoff-bundy-militia-news-updates/militants-have-accessed-government-computers-at-refuge/;"}],"summary":"Militants May Have Accessed Government Computers At Refuge  by John Sepulvado OPB | Jan. 8, 2016 6:30 p.m. | Updated: Jan. 9, 2016 11:32 a.m. Ryan Bundy, one of the leaders of the armed militants who have taken over the Malheur National Wildlife Refuge, says his group has not acc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f96295da1d73b7f9b951a285e47e97af8befbbd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6390A0A5-5990-4F69-B5A4-712D253E7743"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo! Inc","org_type":"technology_saas","ransomware":null,"records_affected":500000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gizmodo.com/yahoo-confirms-hackers-swiped-yahoo-mail-users-passwor-1512742999?utm_campaign=socialflow_gizmodo_twitter&utm_source=gizmodo_twitter&utm_medium=socialflow;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/id/101378748;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/wireStory/yahoo-email-account-passwords-stolen-22305108#.Uurimsh1WcY.twitter;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.engadget.com/2014/01/30/yahoo-mail-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/yahoo-confirms-data-breach-affecting-500-million-accounts-claims-state-actor-behind-attack/#ftag=RSSbaffb68;"}],"summary":"ahoo has confirmed a data breach dating back to 2014 that may have affected at least 500 million user accounts.The confirmation wasn't unexpected as reports in Recode noted that Yahoo would confirm a massive data breach. In addition, Motherboard reported in August on stolen Yahoo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e82baead15669bc1088ddcf6207f054b39e605b8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"851F33E3-9AEE-4556-A1C5-496BFFED09F1"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CY","org_id":"133817c04844","org_name":"xHamster","org_type":"technology_saas","ransomware":null,"records_affected":380000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/hackers-are-trading-hundreds-of-thousands-of-xhamster-porn-account-details;"},{"fetched_at":null,"title":null,"type":"press","url":"http://gadgets.ndtv.com/internet/news/xhamster-reportedly-saw-380-000-accounts-compromised-in-security-breach-1632680"}],"summary":"Hundreds of thousands of user account details for porn site xHamster are being traded on the digital underground.  The database of nearly 380,000 users, provided to Motherboard by for-profit breach notification site LeakBase, includes usernames, email addresses, and what appears ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"ideology","name":"Fancy Bear, APT 28","variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal","secrets"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ec2a8fe7ca175fb7d74cfe7b61cf976c39ee9d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"370F9037-921F-4357-94B5-8C484AA76B2D"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"92043b60145d","org_name":"World Anti-Doping Agency","org_type":"nonprofit","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fancy-bear-release-more-confidential-athlete-data-wada-confirms/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/breaking-wada-hack-troves-confidential-medical-data-leaked-by-suspected-russian-espionage-group-1581180;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wada-hacked-simone-biles-and-serena-williams-medical-files-leaked/"}],"summary":"WADA hacked by Fancy Bear","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"fancybearapt28"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f622a0323fbc5b2906a1647182b43bc782b1dc2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d5e22000-c9fc-11eb-8af5-ed6b4a3c0fb5"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31337b2ff213","org_name":"Wood Specialties Company","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs58.com/story/33707380/menomonee-falls-business-was-attacked-by-ransomware"}],"summary":"Wood Specialties Company a small business in Wisconsin fell victim to ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e81aa896105be6e8458d6183dc26fa5c26afad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D7F9155-829A-419B-A95F-3FEEDF158A1C"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea1381a2a5ab","org_name":"Wolverhampton NHS Primary Care Trust","org_type":"healthcare","ransomware":null,"records_affected":36,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-confidential-records-of-mentally-ill-patients-found-in-cabinet-bought-on-eba/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.expressandstar.com/news/health/2016/06/23/confidential-records-of-mentally-ill-patients-found-in-cabinet-bought-on-ebay/"}],"summary":"Personal documents containing confidential details of mentally ill patients of the former Wolverhampton NHS Primary Care Trust were found in a filing cabinet bought on eBay.  The cabinet contained 60 pages of documents including details of patients' history of sexual abuse and su","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87e402139ec12648bbfaa80b6e1a34e064000c0e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8946096-C011-4444-BF89-CF9A6502C6AF"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24ffc09c0cb3","org_name":"WeWork","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/wework-is-suing-an-ex-employee-for-talking-to-reporters-2016-7"}],"summary":"unlawful access to its computers and of stealing confidential and proprietary information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32f3355a2103872a2a58be59d011563f0463dad9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"446475C9-B440-4B29-86B9-87F188A3B934"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"226f0f61e4d5","org_name":"Welwyn Hatfield Council","org_type":"government","ransomware":null,"records_affected":510,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whtimes.co.uk/news/anger_and_resignations_after_welwyn_hatfield_council_security_breach_1_4516253"}],"summary":"Email to 510 members included list of email addresses in cc: field.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2628b67f6757647a5c949201744f55c4bafadc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"455474d0-8102-11e7-8520-b5d4bef506ca"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a36996a8e97a","org_name":"Wells Fargo","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wsav.com/2017/07/26/savannah-resident-convicted-for-bank-fraud-aggravated-identity-theft/"}],"summary":"Savannah resident convicted for bank fraud, aggravated identity theft - Wells Fargo Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f552e3a0b67e108bf18263af6cc2a8c40de89e07","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E86C8294-6940-4FD3-83F1-F799890D263A"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eead95f4f693","org_name":"Washington State Health Care Authority","org_type":"government","ransomware":null,"records_affected":91000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://q13fox.com/2016/02/09/state-notifies-91000-apple-health-medicaid-clients-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/employees-mishandle-data-violate-hipaa-in-washington-state-medicaid-breach/article/473185/"}],"summary":"XLS with PHI was transferred w/o encryption, was disocvered during another investigation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e833e5e681551abed4c5ef3d6d4d032633280ea9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B93F7BFF-4E44-4E92-B769-CA3FB34894F1"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b77400a2e643","org_name":"Walsall Healthcare NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.expressandstar.com/news/health/2016/09/05/walsall-patient-has-personal-records-stolen-from-physiotherapists-car/"}],"summary":"The 51-year-old woman, who does not wish to be named, received a letter from the trust revealing that her file had been stolen from the boot of a physiotherapist's car.  The file contained information such as her name, age, address, telephone number, NHS number and treatment info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2d9ec33fb564dcad3658247184b36a78290a1d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23415D47-D19C-4844-AE9F-7322243A480A"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c13a7035d30","org_name":"Virtua Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1654,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/virtua-medical-group-vendor-error-puts-patient-data-in-search-engines-3364/"}],"summary":"Publishing error led to patient data getting indexed by search engines","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9ecf33e5ccbf38be077aa3e5997b1face15ca3a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF973386-9AB5-4BE2-B597-C29C517C9ABD"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1df67585e394","org_name":"Verizon Enterprise Services","org_type":"professional_services","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/03/crooks-steal-sell-verizon-enterprise-customer-data/"}],"summary":"DB Compromise leads to disclosure of 1.5 M records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18f2c1a4a69c67f4bd6d576e46737db89aa01571","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"825001C1-DC4D-4A3C-813B-7BB0F9332909"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87f7e200c251","org_name":"US Army","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krdo.com/news/colorado-springs/investigation-underway-into-army-documents-found-in-fountain-field/90323513"}],"summary":"Army document found in the field","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd6ee6c01d76804a2fa4cc1b754b9140a1bb2d53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8099D2B1-0B88-4BA3-86CD-5BDC9199CA16"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac838cd987bc","org_name":"University of the Southwest","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/another-greenshades-client-discloses-breach-of-employee-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/university-southwest-20160422.pdf"}],"summary":"W2 info leaked by 3rd party vendor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c96cec22ff6128abda8d585b0424bbdcf1aca5bd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"457888C2-F1CA-4687-9CCF-BD3A74D21766"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"65c5a034759d","org_name":"University of Prince Edward Island","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/prince-edward-island/personal-information-data-leak-university-prince-edward-island-upei-1.3540711;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-upei-privacy-breach-leaks-personal-data-of-700-people/"}],"summary":"Publishing error posts sensitive information on public site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b47903a11645c42a415ba85780c097d1c230ef29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"209A8A35-2B88-4C48-B278-88D78518200D"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69d264481a81","org_name":"University of Oklahoma Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/officials-report-ou-nursing-web-server-compromised/article/5374078;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/officials-report-university-of-oklahoma-nursing-web-server-compromised/"}],"summary":"web server had been compromised exposing PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21aa76551c2aee3888043c77fb85292c14f12d1f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f11052a0-de9d-11e7-aa62-a96e008cbc03"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e1434c0cf23","org_name":"University of Nebraska Lincoln","org_type":"education","ransomware":null,"records_affected":83000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ketv.com/article/unl-security-breach-puts-thousands-of-current-former-students-information-at-risk/8522433"}],"summary":"The names, ID numbers and grades of 30,000 current and former students may have been comprised over the last two years, the email read.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8aad81a9d0015c35633701ccc05e446668dec8f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D322242-B6B4-446F-90A6-24B902778341"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0508d8e4ed40","org_name":"University of Mary Washington","org_type":"education","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fredericksburg.com/news/education/umw-warns-about-possible-data-breach/article_a09feef8-d68d-11e5-bbaf-af36f7edefa9.html"}],"summary":"stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":"2016-01-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c8c6219d6463b667b8ee95c967a32cb0e3b04c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Student%20Adult%20CA%20Notice_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"5c088bfa4ce1","org_name":"University of Central Florida","org_type":"education","ransomware":null,"records_affected":63000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/student-ssns-exposed-in-university-of-central-florida-breach/article/471439/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/u-central-florida-facing-second-lawsuit-over-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/university-of-central-florida-hack-compromisesq-63000-social-security-numbers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.orlandosentinel.com/features/education/os-ucf-verizon-hack-contract-post.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.orlandosentinel.com/features/education/school-zone/os-ucf-lawsuit-dismissed-hack-story.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Student%20Adult%20CA%20Notice_0.pdf"}],"summary":"The University of Central Florida reported unauthorized access to a database containing personal information about affected individuals.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b61081189145e5e21679299885697b0253163865","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D2B353F-904B-4315-86DA-9C8FD194557A"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e2dde2bd55f4","org_name":"University of British Columbia","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-ubc-release-of-uncensored-personal-information-an-honest-mistake-report/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theglobeandmail.com/news/british-columbia/ubc-release-of-uncensored-personal-information-an-honest-mistake-report/article29398977/"}],"summary":"uncensored details about the departure of a former University of British Columbia president was an honest mistake","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f6e53670909cb0b9e9af741cba65df3b5d7dfab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D428669-1ABC-4840-B5E4-DDE63B8694B2"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"95954d41fda8","org_name":"University Hospital","org_type":"healthcare","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.coventrytelegraph.net/news/coventry-news/coventry-hospital-apologises-after-24-11307882"}],"summary":"Medical records of 24 hospital patients have been found dumped in a bin in Coventry.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdf46cf3118cc8a001ab117e8913c68b22a8fc43","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99B72313-0199-449B-9569-46019739184B"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3d860aaa2ae","org_name":"United States Navy","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pilotonline.com/news/local/crime/bronze-star-recipient-based-in-virginia-beach-pleads-guilty-to/article_c72f6568-62ac-59d1-8a45-88ab86901870.html"}],"summary":"Identity theft by a Navy Chief","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72839c8647bde95a5439b1febc038355e92f6f2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07F85073-9942-40EF-97E2-D3769D581353"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36bc1057d1b7","org_name":"Ullrich Delevati CPAs","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Ullrich%20Delevati%20notification%20letter_0.PDF"}],"summary":"CPA firm discloses breach of customer data, no information provided on how data was compromised, nor who was responsible.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8ecf63a727d6f57f7e53421d2ad10eca45c78b2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C96AC97B-3E82-4C98-B5DD-A8116D841F1A"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"50ddd01ddcd5","org_name":"UC Baby","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/nova-scotia/uc-baby-3d-ultrasound-security-video-privacy-1.3494301?cmp=rss"}],"summary":"Website designed to allow customers to view 3D ultrasounds made all files available via forced browsing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce79ad5c0982980f9580762378e585cb59cb5189","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"705D7A8D-26A8-47B7-8938-CD4125015A3A"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"d4572d213faf","org_name":"Turkish Government","org_type":"government","ransomware":null,"records_affected":49611709,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/turkish-citizenship-database-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/wireStory/data-50-million-turks-allegedly-leaked-online-38142865;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/turkey-leaked-personal-data-not-from-election-board/"}],"summary":"Turkish citizenship database hacked and posted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"247bc4c579068432ed62e1003ffd2772efb9be2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ca9ba70-0237-11ea-ad43-7952870528d4"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"f2d05d50b852","org_name":"Tu Ora Compass Health","org_type":"healthcare","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/tu-ora-data-breach-exposes-medical-data-of-one-million-new-zealand-residents/;"}],"summary":"Tu Ora Compass Health was breached when one of their websites was defaced ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1cdb734200cf5b1bef9ad9c3b974cced599b36d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e4de3a00-8e7f-11e8-8003-e3ff5269fee2"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UM","org_id":"1388c517a0b7","org_name":"Trinity Elms Assisted Living Facility","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.journalnow.com/news/crime/former-assisted-living-worker-pleads-guilty-to-identity-theft/article_c36762c0-80b0-58c5-a1e8-56c5f639fad9.html"}],"summary":"Smith, a former employee of the Trinity Elms Assisted Living Facility in Clemmons, was accused of stealing money in 2016 from Martha Umberger, 83, a resident at the assisted-living facility, prosecutor Sara Loebner said. At that time, Smith worked at the facility for about a year","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ea7582748456abd80e3005cbdea9c96bdf25dbd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EADBF68D-9157-4CB9-A87C-FE708CA6BAAB"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"830a74a258b0","org_name":"Treasure Coast Lexus","org_type":"retail_ecommerce","ransomware":null,"records_affected":68,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://protectingyourpocket.blog.palmbeachpost.com/2016/06/08/lexus-dealer-worker-convicted-of-id-theft-for-80-of-oxy-pillls/"},{"fetched_at":null,"title":null,"type":"press","url":"http://protectingyourpocket.blog.palmbeachpost.com/2016/06/08/lexus-dealer-worker-convicted-of-id-theft-for-80-of-oxy-pillls/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/former-car-dealership-employee-sentenced-for-her-participation-in-a-stolen-identity-tax-fraud-scheme/"}],"summary":"identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3124f2b6ffd9e5dad9dd06b1d63c936b8c74391e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e4d7cfc0-761c-11e7-9d88-ab89f89c69db"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"0e587d125d93","org_name":"TorrentFreak","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/ddos-attack-hits-kickass-torrents-dns-servers-crippled-499019.shtml"}],"summary":"DDoS Attack Hits Kickass Torrents, DNS Servers Crippled","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a54848737fda6811c9829c17b40c7c0478d7a30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78804BD3-3826-4FB9-83E2-41DAB60DC95D"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"112b14fac5c1","org_name":"Toh-Shi Printing Singapore","org_type":"manufacturing","ransomware":null,"records_affected":8022,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.straitstimes.com/singapore/fined-for-leaking-8000-peoples-personal-data;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/sg-fined-for-leaking-8000-peoples-personal-data/"}],"summary":"sent erroneous account statements to policyholders that resulted in more than 8,000 people having their personal data leaked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed070b410f36a4c40af5ebb4d27f4d23139adfde","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5083E7C0-ABDA-42EE-9709-13D980DC694B"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cdbfff40189","org_name":"Thomson Reuters Corp","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/world-check-financial-crime-and-terrorism-database-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/world-check-terrorism-database-leaks-online-security-researcher-chris-vickery-claims-thomson-reuters-2016-6?r=UK&IR=T"}],"summary":"Flaw in DB allowed access to sensitive information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"824d82172a33999dc5d51836514dfaca044ab1d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12d608e0-ca2f-11e7-a7a2-ef5723624be0"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9df263f3b9af","org_name":"The Personal Agent","org_type":"other","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.getsurrey.co.uk/news/surrey-news/estate-agent-jailed-two-years-12950560"}],"summary":"Estate agent took personal information from homes of his clients and used it to commit fraud. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Anonymous","variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb20fcafe3a4cdf4b30d3d51c72978d83e1980eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19E2501E-1D3F-4B6E-A049-7441356410CA"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"156da3832ad4","org_name":"The Ministry of Foreign Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://allafrica.com/stories/201605030697.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/anonymous-hacks-kenya-ministry-foreign-affairs/"}],"summary":"'social-engineering' attack on The Ministry of Foreign Affairs and then hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6d4450ca5e47909ae5f7c04a1d4c8f61ef1cc67","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE5F5142-A7B3-446E-8A95-350F6BA51837"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4aada9e4049f","org_name":"The Information Commissioner's Office","org_type":"government","ransomware":null,"records_affected":957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lexology.com/library/detail.aspx?g=68aff625-753c-4246-b7b1-f1bc8faaf643"}],"summary":"employee who illegally transferred information about company clients to his email account before starting to work for a competitor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1dd97783878a874cf14faa1c47f257733a878100","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2869B8B6-7C10-4610-913C-DE94EC3F4E8C"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9bb6336ebb40","org_name":"Tesco Superstore","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lisburntoday.co.uk/news/lisburn-news/police-issue-warning-after-discovery-of-suspected-skimming-device-at-atm-1-7546595"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18278a04c39fa68c6d3615602a4bfa6bf1e2ae65","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B6DB332-B0F5-43A2-A0BD-F3BD99ED5CCC"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"32dbb1569c25","org_name":"Tesco Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-scotland-tayside-central-35945066;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-scotland-tayside-central-36110378"}],"summary":"copied the details into an email and sent it to himself","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c86aafa73cd64c5e9291bf57e76b0c483dea7b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6E2664A-4AA2-447F-A74B-774450571D11"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f96f459713d6","org_name":"Tennessee Valley Authority","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/business/2016/aug/11/nuclear-consultant-accused-espionage-china-us-szuhsiung-allen-ho"}],"summary":"nuclear espionage to China","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4ad94fe7af5a55f62c642e5e24194819cf00269","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23BD7808-BFE8-413A-B2AC-68DA4FC794BD"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ee774b66acc","org_name":"Target Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2015/12/wish-list-app-from-target-springs-a-major-personal-data-leak/"}],"summary":"target app has open API","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acd420dce05e8ab0fcf4f11e941d433520ec2858","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74A41577-4A9E-4D55-A2CE-7B17A23FFFF8"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"9a846a5bf95d","org_name":"Tallaght Hospital","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/health/hospital-admits-it-lost-patients-test-results-data-34666948.html"}],"summary":"Lost test results","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"499f13266bc2be3ccc6d16f080a175244286153f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"711B88B1-0E32-40B7-B469-0D951E3439CA"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8fffdebdb6fa","org_name":"Talkspace","org_type":"technology_saas","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/toddessig/2016/08/18/talkspace-reveals-clients-email-violating-clinical-confidentiality/#1237ef1533cf"}],"summary":"email sent identifying their email address","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bb000a5c3c4ba6e13a81b12f494b4e690e24a48","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0125ACA2-17F2-4BBC-AF88-1D21F296457C"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"a1f73cc9bb77","org_name":"T-Mobile","org_type":"technology_saas","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cz-t-mobile-employee-arrested-for-trying-to-sell-customer-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/06/20/tmobile_czech_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cz-t-mobile-employee-arrested-for-trying-to-sell-customer-data/"}],"summary":"T-Mobile Employee Arrested for Trying to Sell Customer Data  T-Mobile Czech Republic says there was \"no actual data leak\" adding that \"data are (sic) safe\". It is unclear if the company is claiming the records were for sale but remained not purchased. Attempt was detected before ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13c5fb47830fe3cfdd3ddc9a587f31e80040de3b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"526de640-761e-11e7-9d88-ab89f89c69db"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"ec81f9e6a482","org_name":"Supreme Court of Thailand","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-releases-1gb-of-data-from-supreme-court-of-thailand-498941.shtml"}],"summary":"Anonymous Releases 1GB of Data From Supreme Court of Thailand","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"306b4d41f83266e4628945e10129af3978b2d6b7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a5ab9860-1469-11eb-ac54-3bea5c26f172"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1bb7a0c78cd7","org_name":"State of Alaska","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govtech.com/security/No-Damage-Reported-from-Partial-Breach-of-Alaskas-Election-System.html"}],"summary":"Alaska election reporting system was hacked due to an outdated server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a52a9aa7125975aeb733b7b9ee7a66ba2380c9b8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC8E8BB5-C9D6-42D7-BEE8-3DB366FA710B"},"incident_date":"2016-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17b9be1df0b1","org_name":"State of Alabama","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.al.com/news/index.ssf/2016/06/bentley_fires_high-ranking_fin.html"}],"summary":"Internal actors improperly granted access to fingerprint database to contractors","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4795293b50e521b74a8cae15276780b69d00023","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19D355E5-F624-41E7-9797-4CA4590FFD5A"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6279ef63218a","org_name":"StarCare","org_type":"healthcare","ransomware":null,"records_affected":2844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newswest9.com/story/32522894/5-laptops-stolen-from-starcare-in-east-lubbock-suspect-at-large;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/starcare-specialty-health-system-reports-potential-phi-breach-3526/"}],"summary":"StarCare discovered that one or more people broke into a StarCare/StarQuest office in the 3300 block of East Broadway.  Officials say five laptops were stolen. One of the laptops had confidential information on it that the burglar could access. That laptop was disabled to reduce ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0af8ef082bf66075d407c16fa96b7b723e1af9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"746f7ae0-89ad-11e7-bf1d-81579668407a"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59e5ef0a856c","org_name":"Southern New Hampshire University","org_type":"education","ransomware":null,"records_affected":140000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/southern-new-hampshire-u-still-investigating-database-leak-exposing-over-140000-records/"}],"summary":"Southern New Hampshire U. still investigating database leak exposing over 140,000 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be85b95544fc80ab1a00e092eab319fbcbb772c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7843499B-006A-4D8F-8241-8FE6EA07463D"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"157e08a99fc0","org_name":"South Carolina Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.postandcourier.com/20160516/160519730/sc-medicaid-agency-apologizes-for-patient-privacy-breach;http://www.postandcourier.com/article/20160123/PC16/160129774/obamacare-x2018-coverage-gap-x2019-excludes-123000-south-carolinians-from-health-insurance-including-jim-connor"}],"summary":"Medicaid application (SSN, address, employment history) sent to a different applicant.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb92dccb94b89847a3d4d2d9e629fd5143c12d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1bd46500-0c76-11ea-bb2f-edf349509116"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9eac11f07fa","org_name":"Social Security Administration","org_type":"government","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.davisenterprise.com/local-news/social-security-employee-pleads-guilty-to-theft-conspiracy/"}],"summary":"social security employee accessed PII and then provided to external actor to open bank accounts and redirect SSA direct deposits.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb68f5e6593026328175f7f0828638e931b82361","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eaef4a20-9a72-11e8-b855-9f03b7750df7"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b944d266fbc6","org_name":"Sobeys","org_type":"retail_ecommerce","ransomware":null,"records_affected":74,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.baytoday.ca/national-news/pharmacist-snooped-on-dozens-of-patients-ns-privacy-commissioner-says-1003025;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/nova-scotia/privacy-breach-foipop-drugs-health-1.4769546"}],"summary":"Nova Scotia's privacy commissioner says she's shocked by how a grocery-store pharmacist was able to snoop into the electronic personal health information of dozens of people she knew.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1b734bde66dd2cd965776635a4e5dbeaeb7a54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c241a930-d581-11e7-af4f-6b5d4514198e"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1909cb4d3a6","org_name":"Silver Creek Fitness & Physical Therapy","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/silver-creek-fitness--physical-therapy-provides-notice-of-data-security-incident-300350009.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64521"}],"summary":"On September 11, 2016, Silver Creek was notified by its billing and software companies that its Amazon \"S3\" storage account was vulnerable because it was accessible to persons outside their organization, and that a security researcher who works for a software company accessed and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"679f43aea02f033568f1c02fa0bbbca6f2f07e49","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF47070A-6496-4C4C-B32E-C46A7B9A248F"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98d3c3639a7d","org_name":"Sharp Grossmont Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpbs.org/news/2016/may/19/sharp-hospital-apologizes-privacy-breach-video-sti/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacydatabreach.com/2016/05/investigation-underway-after-sharp-grossmont-hospital-shared-private-patient-videos-with-third-party/"}],"summary":"Sharp Grossmont Hospital has apologized for releasing 14 video clips that included women undergoing obstetric surgery, an error it said constituted a breach of their medical privacy and has led to state and federal agency notification.  \"We are very sorry that this error occurred","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f614a976e9c5a7b32d41c7b104237a94b3de895","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bc76ffb0-e39f-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2866ac366865","org_name":"Sentara Healthcare Martha Jefferson Hospital","org_type":"healthcare","ransomware":null,"records_affected":5454,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsplex.com/content/news/Data-breach-at-Sentara-Healthcare-410960015.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wavy.com/2017/01/16/sentara-healthcare-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://lintvwavy.files.wordpress.com/2017/01/snews-scann17011713470.pdf"}],"summary":"Thousands of Sentara patients may have been impacted by a data breach at a third-party vendor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f10c5be35bbc5e2607f5a0da9fe7cbf05fb6dbf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F90ECB84-2E19-4577-8005-B4BB444E6CE2"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BS","org_id":"764e9377c695","org_name":"Save the Bay","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/bs-activists-to-send-leak-complaint-to-data-watchdog/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tribune242.com/news/2016/mar/31/activists-send-leak-complaint-data-watchdog/"}],"summary":"emails leaked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94953b8b998e98c361be2cc49952835dbbbe0f59","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C511A6B4-6002-4030-BB90-61B0B0FF0C91"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SA","org_id":"58e647eb2f89","org_name":"Saudi Arabian Govt","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-shuts-down-several-saudi-government-websites-after-recent-executions-498400.shtml"}],"summary":"DDoS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6919f4c9dca6370ac18fe411d03555f0c510190","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53259f20-81f3-11e7-ace7-c5c15a923e51"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2bfeb2bb9bc","org_name":"Santa Fe Fire Department","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abqjournal.com/755997/santa-fe-paramedic-accused-of-stealing-using-dead-mans-debit-card.html?utm_source=abqjournal.com&utm_medium=related+posts+-+crime&utm_campaign=related+posts;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.abqjournal.com/1031083/paramedic-who-stole-debit-card-from-dead-man-wants-lighter-sentence.html"}],"summary":"A Santa Fe city government paramedic is accused of stealing the debit card of a deceased man his emergency crew was called to help and then making dozens of purchases on the card, including once when he went to Walmart in an ambulance.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d4bd94337a8f737d0d2c526822aacacc4090e94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF64D7B8-D079-446E-AB4E-BCDDE782F1F0"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a01875151693","org_name":"San Francisco Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gfarma.news/headline-news/nearly-two-dozen-arrested-in-wide-ranging-drug-raids-including-in-sf-the-san-francisco-examiner/"}],"summary":"Misuse of access to DMV records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"JP","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e05f8be9b8318a9041759f785f82a3d91d8a1f3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7D2ABD6-A225-4819-8094-01268E6D1233"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"f46c6ac6efcf","org_name":"Saga Prefecture Schools","org_type":"education","ransomware":null,"records_affected":210000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2016/06/27/national/crime-legal/teen-faces-charges-over-breach-of-online-school-grades-management-system/"}],"summary":"Kid accesses school system and steals data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06a051e2040eb448b0eb13e7f8db4395e321eb5c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EE349BD-C5B1-470E-9D0A-7A73BC4AFBE0"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f4a6900d8f49","org_name":"Royal Victoria Infirmary","org_type":"healthcare","ransomware":null,"records_affected":143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclelive.co.uk/news/north-east-news/dozens-newcastle-patients-medical-records-11098893"}],"summary":"Patients from the RVI and Freeman Hospital are among those at risk of having had their private data stolen after a van was left unsecured.Confidential medical records belonging to dozens of North East patients have gone missing from Tyneside hospitals.  The documents were taken a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bc8b15ccd76e0e0a0a1fbc050fc225b27c0b296","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C589C710-DEFD-444E-BED3-6310967F44B5"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"257a75acbfa0","org_name":"Royal Cornwall Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.westbriton.co.uk/hackers-attack-royal-cornwall-hospital-at-treliske-and-hold-bosses-to-ransom-over-stolen-information/story-29754378-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hackers-attack-royal-cornwall-hospital-at-treliske-and-hold-bosses-to-ransom-over-stolen-information/"}],"summary":"experienced \"multiple attacks\" through cyberspace in the past 12 months. Read more at http://www.westbriton.co.uk/hackers-attack-royal-cornwall-hospital-at-treliske-and-hold-bosses-to-ransom-over-stolen-information/story-29754378-detail/story.html#9QmcdVishB6JlJpk.99","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d0e6f02a50076f2dceaeccd73c40014c17b9fbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDF78BB5-EC9F-4253-A95C-09892CABE651"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8d25002d796b","org_name":"Royal Berkshire Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.getreading.co.uk/news/reading-berkshire-news/royal-berkshire-hospital-sends-confidential-11661819"}],"summary":"Medical details of another patient mailed to the wrong recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fd0506e8717b4c97730f6ae74dc0f51eb61fd7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5C64658-D8C6-4A55-AA8F-E81B24D72013"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4829817a73e0","org_name":"Rosebutt Board","org_type":"technology_saas","ransomware":null,"records_affected":107000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/rosebuttboard-ip-board"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/hardcore-fetish-forum-hacked-sql-injection/"}],"summary":"Site hit with SQLi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2f85cb08557985d1ca8431ccb113c9841c4dc47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0E69DB4-6B39-4FE2-86F0-3704984E2F55"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8a4d3883582","org_name":"Rehab Billing Solutions","org_type":"financial","ransomware":null,"records_affected":260000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/dozens-of-clinics-thousands-of-patients-impacted-by-third-party-data-leak/;"}],"summary":" leaky bucket on Amazon S3 that contained thousands of patient records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddf0d2c23688c9a9616146a805916bbb437b39e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06C51486-9B7F-4BD8-B3CB-FC9116FD1B84"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"8c5e6b408189","org_name":"Registry of Births, Deaths and Marriages Victoria","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/victoria/birth-certificate-mix-up-sparks-identity-fraud-fears-20151222-gltrap.html"}],"summary":"Birth certificates were being sent to incorrect recipients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6276a3737bf546044092baa7908a03e40dc4a29c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7062830-e424-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"d93173cb8c7a","org_name":"Quattro Global Services Private Limited","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyoooz.com/gurgaon/690292/exstaffers-of-private-firm-booked-for-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hindustantimes.com/gurgaon/two-ex-employees-booked-for-theft-of-gurgaon-bpo-s-customer-database/story-Zj8YElzVaoXMcBaTmceM9N.html"}],"summary":"Customer database of a BPO firm in Gurgaon was stolen and used to float a new company in Dehradun. Two former employees of the BPO, Quattro Global Services Private Limited, have been booked for fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26e09fcff3a34bd70e62054c3c910ff4a90c5568","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F16207DF-DE91-4812-A7BA-AE7F2656B70E"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"cd20344667bb","org_name":"QIP.ru","org_type":"technology_saas","ransomware":null,"records_affected":33380559,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/33-million-plaintext-passwords-stolen-from-qip-ru-instant-messaging-service-508103.shtml"}],"summary":"Hackers have stolen over 33 million user records from QIP.ru, an instant messaging service used predominantly in Russia.  Softpedia has received a sample of the data from HEROIC, a cybersecurity startup that protects users from hackers and cyber threats.  The company claims to ha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"544a9c7d47a275be52c77fe2ff72f0f8660da566","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A7E69A1-FEDA-49C9-A810-651A55983750"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"f28b48763525","org_name":"Qihoo 360 Technology Co Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/bribery-helped-criminals-whitelist-malware-in-chinese-antivirus-product/article/489101/"}],"summary":"sophisticated scheme involving bribery to get malware whitelisted on a Chinese antivirus product","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d946c251e93e8317325112e58b6c3003fef82bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F47816CC-8414-4D8C-AEA4-DD9FF18812DD"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d04e90b4228","org_name":"PwnedList","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/pwnedlist-shuts-down-because-of-security-bug-that-exposed-details-for-866m-users-503617.shtml"}],"summary":"Security researcher uses forced browsing to access information of another user. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1733abc452c59daab3bf867e714ddb3497fd5b57","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"192033d0-89ef-11e8-bc39-6bf805ebd808"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6794fd1ee4ae","org_name":"Pueblo District Attorney's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.chieftain.com/news/crime/ex-pueblo-da-investigator-allegedly-aided-bookmaking-operation/article_6c8df55a-7ab9-5150-a13b-7955f12765fa.html"}],"summary":"The Colorado Attorney General's Office is prosecuting Widup on numerous charges in an indictment filed in January. They include official misconduct, professional gambling and misuse of official information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a41b9db9bfee261a819e220fbfcb4335ef6cd91","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f6a7b530-fe8d-11e8-aee0-f7420d4f3238"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68347f4646eb","org_name":"Pueblo County District Attorney’s Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.chieftain.com/news/crime/indictment-reveals-more-about-charges-against-widup/article_4b9d2a7c-abf3-11e8-a0f8-87a7181abb98.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.chieftain.com/news/ex-pueblo-da-investigator-pleads-guilty-to-felonies/article_20fa3e20-d413-11e8-a473-8ba3e009fd6a.html"}],"summary":"New information about the criminal charges against a former investigator in the Pueblo District Attorney’s office shows he allegedly was part of a nationwide bookmaking ring and using the office to help run the illegal gambling.The information is in the indictment against Charles","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"485d202db82e05e2843b5a6b4d333a1b0bf9313e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F57F603B-1A8C-4CDA-8D70-E9792E4A5BE1"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02d226181927","org_name":"Premier Physicians Group","org_type":"healthcare","ransomware":null,"records_affected":1326,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/midland-healthcare-providers-inform-patients-privacy-breach-3520/"}],"summary":"MIDLAND MEMORIAL HOSPITAL ANNOUNCES POTENTIAL PHI BREACH  Midland-based Premier Physicians Group  formerly Premier Family Care  has also alerted some of its patients that their PHI was exposed as a result of the actions of Dr. Gross. Premier was alerted to the privacy breach on A","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0285e41474f4c4108828e391cce96b7995083d53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D9C4361-F3A2-4508-A3FD-3C201DFB7048"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"e504fc7d85dc","org_name":"Polish Defense Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/suspected-right-sector-hackers-breach-polish-ministry-demand-50000/"}],"summary":"Compromise of database leads to extortion attempt. Minimal info provided in article.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de89a93c2f3358a3ef1e6323d815d53215490159","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02FD07DC-72FC-4953-B68B-55E21D500705"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"848fea4adfe9","org_name":"PhotoBucket","org_type":"technology_saas","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://denver.cbslocal.com/2016/11/02/coloradan-apologizes-after-1-9-million-photobucket-accounts-hacked/"}],"summary":"A 29 month prison sentence was handed down on Tuesday to a Colorado man who pleaded guilty to charges involving a massive photo hacking scheme.  Brandon Bourret, of Colorado Springs, pleaded guilty to conspiracy to commit computer fraud.  The FBI tracked Bourret and a colleague d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"072c2d4cf0e7049e2fdcdc8af6224c8351482db5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AD91346-E95D-41AC-81AA-97291D22114A"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82c97f9c85c4","org_name":"PerkinElmer Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/PerkinElmer%2003152016%20California%20notice%20redacted_0.pdf"}],"summary":"email phishing ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"556061104aaaaf179b0c9b30f7290012c0a1f9e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24eb6da0-8113-11e7-9cfb-2f8f443557ce"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a33afdc199f4","org_name":"Peachtree Neurological Clinic","org_type":"healthcare","ransomware":null,"records_affected":176295,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/atlanta-clinic-finds-15-month-breach-during-investigation-separate-ransomware-attack"}],"summary":"breach discovered in response to ransomware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"TheDarkOverlord","variety":"unaffiliated"},"attack_techniques":["T1078","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76ba80c2e803a884a7d9dab37f2ece25dd30ec3b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D567A618-E17A-4921-97C0-DC48DA7017C6"},"incident_date":"2016-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23b31c260bc8","org_name":"P&O Care","org_type":"healthcare","ransomware":true,"records_affected":23565,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/another-healthcare-database-hacked-and-put-up-for-sale/"}],"summary":"database  hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"939c8acf95eb785bdf61e48d248c578847f6eb88","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5FC4CFCD-5110-4178-BE2F-42C9332EC529"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"5e1475161c7e","org_name":"Our Lady of Lourdes Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ie-patient-documents-must-have-blown-out-of-doctors-hand/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dundalkdemocrat.ie/news/home/204741/Patient-documents-must-have--blown.html"}],"summary":"Councillor Toms Sharkey has hit out at the latest breach of patient privacy in Our Lady of Lourdes Hospital.  \"Last week patients and their families received calls from management of Our Lady of Lourdes Hospital. The call was to apologise for the fact that personal files, found i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc2e405697a14c41119718a184fbf158dd01fc34","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C569168-C347-414F-8558-74D692FE57DE"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5ab157716735","org_name":"Ottawa Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ottawa-hospital-hit-with-ransomware-information-on-four-computers-locked-down/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.nationalpost.com/news/canada/ottawa-hospital-hit-with-ransomware-information-on-four-computers-locked-down"}],"summary":"The Ottawa Hospital has confirmed that four computers in its network of 9,800 were hit with ransomware last week which encrypted the information on those machines making it unaccessible to hospital administrators.  \"No patient information was affected. The malware locked down the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bf3fca431dfbfecb2f094f9453f40bb844912fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3A1A652-9A6D-4F25-B9CE-184716D7A2E8"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b7ed589b590","org_name":"Office of U.S. Attorneys for the Eastern District of Kentucky","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://mic.com/articles/156607/tech-challenged-federal-prosecutors-leak-steubenville-hacker-s-personal-information#.hegic5I1O"}],"summary":"Information improperly redacted in a PDF","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a0f4480f224fbd2d6dbf9ff61d0fd606725ab63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"136C0D26-D3B7-46F8-97EE-D7893B655EC2"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"18aa03c23705","org_name":"NU.nl","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nl-personal-data-of-3700-ede-residents-leaked-through-municipal-site/"}],"summary":"LIkely SQLi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6a982441d3c600dd32058e5199e4a78de5b9859","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75e7f5c0-d63b-11e7-af4f-6b5d4514198e"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"84d175acfb65","org_name":"NSW Ambulance","org_type":"healthcare","ransomware":null,"records_affected":130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.skynews.com.au/news/national/nsw/2017/11/19/nsw-ambulance-faces-class-action-lawsuit.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theherald.com.au/story/5065094/ambulance-staff-sue-over-their-medical-files-being-sold-to-lawyers/"}],"summary":"More than 100 paramedics will launch a class action against NSW Ambulance after their health records were leaked to personal injury law firms.  A NSW Ambulance contractor was convicted last year after accessing and selling the worker's compensation files of 130 current and former","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60e067dc034a7c31b75560e69eb7749b0ce5f9ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82F194C2-FF65-4E2A-9232-F266A48004AA"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"551140a7e8c9","org_name":"Northwest Territories Power Corporation","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-nwt-power-corporation-apologizes-for-customer-data-breach/"}],"summary":"Misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb4f6402a305b315053c53691d69dd0041549eae","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d5e196a0-d584-11e7-af4f-6b5d4514198e"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c92a238b0b15","org_name":"Northumberland County Council","org_type":"government","ransomware":null,"records_affected":82,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclelive.co.uk/news/north-east-news/northumberland-social-worker-suspended-putting-12023360"}],"summary":"Marie Devlin was reprimanded for keeping 82 confidential documents containing service users’ details in an unsecured locker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b9425edfb266f5b90f206859e1fe231edd862b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87F17A1F-ED44-49CC-AC92-7CD4D8CA9437"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6341e24afa97","org_name":"Northern Territory's Country Liberals","org_type":"government","ransomware":null,"records_affected":76,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/victorian-teen-stokes-international-hacktivist-fears-after-hacking-clps-website/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2016-05-12/clp-hacked-by-bendigo-18yo/7410284"}],"summary":"young hacker learns on youtube","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"095c2220a74e2dce6876984502adb91ae28ab835","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"491f91d0-89ae-11e7-bf1d-81579668407a"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"3d3e525b16c1","org_name":"Nissan","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/life-style/gadgets-and-tech/news/anonymous-cyberattacker-hack-nissan-japan-whaling-opwhales-a6810741.html"}],"summary":"Anonymous launches cyberattack against Nissan in protest at Japanese whale hunting","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0696db8e03e3bef248512f3871117d66bb5e38c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09ef25c0-9cb9-11e7-bdec-d715fa410d81"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ede94a1d26e1","org_name":"New Zealand Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rnews.co.za/article/15615/former-hawks-lt-col-jailed-for-tipping-off-port-elizabeth-card-skimming-syndicate"}],"summary":"Military official arrested for informing skimming group of police activity.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f51aa77f35868ecc058d9692c3c7f019305214a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ccbae10-e423-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d5cf551f44a","org_name":"Nevada Division of Public and Behavioral Health","org_type":"government","ransomware":null,"records_affected":11771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/more-than-10000-medical-marijuana-establishment-agent-applicants-in-nevada-had-their-personal-info-exposed-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3153664/security/agent-applications-for-nevadas-medical-marijuana-program-exposed.html"}],"summary":"Agent applications for establishments looking to operate within Nevada’s medical marijuana program have been exposed to the public, enabling anyone to view an applicant’s personal details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b36e73a40506b6520a9a0e7c30649ae4a6cbb485","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFBB9D89-E686-43AB-8FFC-005AEAAC6C52"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"caa578f2efbd","org_name":"Myspace","org_type":"technology_saas","ransomware":null,"records_affected":360000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.usatoday.com/story/tech/2016/05/31/360-million-myspace-accounts-breached/85183200/"}],"summary":"Unknown hack of myspace leads to user creds being disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e745b8141517b13ba38cd6bc6dafd87e4a15af6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d635d350-e439-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"52c7f71091a3","org_name":"Musgrove Park Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.somersetcountygazette.co.uk/news/14952082.Woman_s_fury_as_photo_of_her_foot_after_op_to_remove_toe_used_in_NHS_training_without_her_permission/"}],"summary":"A WOMAN has hit out at Musgrove Park Hospital after photos of her recovering foot were used in a training seminar without her consent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27b4a2f624d2758841be23666dc8e4cd4adc74b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FC4070B-89FB-44E4-BAF9-F064E44546F4"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"927aefce8dbc","org_name":"Multiple Listing Service","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/article/5526216"}],"summary":"MLS staff investigated and discovered an unlicensed assistant who was registered to have access and regularly running searches for closed transactions. The assistant also was an employee of the ADT reseller.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6b1fa0e79d83d42eb0317ce7829fcd156ddd9c4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2945D3A-3747-4A5C-AF05-2E781EEAA407"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee0534a3f6a5","org_name":"Mountaintop Area Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wearecentralpa.com/news/patient-info-taken-from-medical-center"}],"summary":"Patient info taken from medical center","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"457a0af09e71f8fc75202d85296127b56413620b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8a6aa5c0-e3aa-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"595181b891c7","org_name":"Mount Carmel Medical Group","org_type":"healthcare","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc6onyourside.com/news/local/4000-files-stolen-from-medical-other-offices-in-organized-crime-ring"}],"summary":"Investigators say an organized crime ring in central Ohio compromised thousands of people who sought medical or legal services. Police arrested roommates Johnathan Knapp and Justin Goins in the spring of 2016 when they say the two used a stolen credit card to stay one night at th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7887522b5c458a29630b855af7aa61e52c422d99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF57BE30-AA4F-450B-8C84-3DE32B220613"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"dbde384088c7","org_name":"Motor Vehicle Registry","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nwsgo.com/2-intentional-privacy-breaches-in-government-says-office-of-privacy-commissioner/"}],"summary":"Misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e3c695bf7b6a622fa77f63b4e81066d4542313e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36ee1e50-0b59-11e8-985b-1119ad21cbad"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"d0c32c62181e","org_name":"MoneyBack","org_type":"financial","ransomware":null,"records_affected":88623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/mexican-tax-refund-company-exposes-passport-data/"}],"summary":"Misconfigured DB exposed Passport numbers, credit card data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05e281be44103c9c744368499637f21032409894","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C72F6A57-47A2-4C01-972F-0BC9F31D96DE"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8836deefed48","org_name":"Modern Home Health Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10news.com/news/medical-records-found-dumped-on-paradise-hills-sidewalk"}],"summary":"Medical documents containing names and Social Security numbers for hundreds of patients were found dumped on a Paradise Hills sidewalk Monday morning.    The records were discovered by a man on a sidewalk with some other trash in the area of Paradise Valley Road and Jester Street","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5009b1e7eb0dea3a9c6f56ab2f4e0af93b18a12","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21108ad0-d57d-11e7-af4f-6b5d4514198e"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"be690e5f6806","org_name":"MJS and Associates, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/texas-court-holds-compliance-auditor-18465/"}],"summary":"A Texas appellate court recently affirmed a judgment against a healthcare consulting firm that claimed that its former employee had misappropriated its confidential information to use in a False Claims Act (“FCA”) lawsuit against the consulting firm’s largest client.  The consult","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91e6cc35da856b898806bd9ac9a2ef45649c4f2a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2BADC20F-9DE6-4FFA-9C35-B251D0087D9F"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"15e8a7bd6910","org_name":"Milnerton restaurant","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/security/170031-cape-town-barman-and-waiter-arrested-for-card-skimming.html"}],"summary":"restaurant skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6b03cc27c02a383338fb7cb6d43cc7e5edd4f46","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FF3EB17-D9EB-440C-925B-529FDE50D829"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6957d92d5640","org_name":"Midland Women's Clinic","org_type":"healthcare","ransomware":null,"records_affected":717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/midland-healthcare-providers-inform-patients-privacy-breach-3520/"}],"summary":"Midland Women's Clinic Notifies 717 Patients of PHI Exposure  On April 26, 2016., Midland Women's Clinic discovered that Gross had left information relating to 717 patients at his former residence according to a press release issued by the clinic.  Patients affected by the breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb11227a341059e64ae6aa9d40eb7d8dcc03571b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D244EEC1-81A2-4325-AAED-2DDCAC802B97"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e25eff721b5","org_name":"Midland Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/midland-memorial-hospital-announces-potential-phi-breach-3496/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/midland-healthcare-providers-inform-patients-privacy-breach-3520/"}],"summary":"MIDLAND MEMORIAL HOSPITAL ANNOUNCES POTENTIAL PHI BREACH  Midland Memorial Hospital has announced that some of its patients' protected health information has potentially been viewed by unauthorized individuals.  On April 8, 2016, the Midland, Texas-based hospital was alerted to a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"TW","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c66fef69379b1c3d9fc50f4341609a8d0c9c3cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52ab63f0-2aa0-11eb-9486-e305299943be"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bab2635c72f1","org_name":"Micron Technology","org_type":"manufacturing","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://financialpost.com/pmn/business-pmn/taiwans-umc-pleads-guilty-fined-60-mln-in-trade-secret-theft-case"}],"summary":"Micron Technology had trade secrets stolen by a chinese-government owned competitor by recruiting internal engineers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9907afc258b07d3e267150268fc2b8c3763642b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DE8ACA0-7CE3-42B0-AB37-FCCB487E4CD0"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e85d9d5a9bea","org_name":"Mercy Hospital & Medical Center","org_type":"healthcare","ransomware":null,"records_affected":547,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/il-mercy-hospital-medical-center-notifies-patients-after-billing-service-loses-547-patients-documents/"}],"summary":"Lost records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00249c37f5dc0772392afd7e42c6f68c249e4f88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C297D0D-4B10-4BED-B21E-0E839F247925"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5bd4aab17325","org_name":"Medical Council of New South Wales","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/01/17/pdf_redaction_is_hard_nsw_medical_council_finds_out_the_hard_way/"}],"summary":"Improper redaction of PII on PDF","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d72bd31df54eb08bd87a9468f00754091f6cdf13","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23326E0D-5BBB-47A8-97C3-F3CBA76C9756"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"327a0ceaecb6","org_name":"Mcdonalds","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://citizen.co.za/news/1339904/mcdonalds-worker-arrested-card-skimming/"}],"summary":"McDonald's employee is being investigated for fraud after it was found he was allegedly card skimming.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b89332439429da90f801da45b98b54394dff2d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92BE6D35-2CCE-4C85-9189-C3ABFBF3AD08"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccaa20a123b","org_name":"McDonald's Corp","org_type":"other","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/crime/index.ssf/2016/09/metairie_mcdonalds_employee_ca.html"}],"summary":"employee took pictures of credit cards used for payment","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccefe13303d4936ad110b1082072529dfce815c6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD2EFB35-664B-4298-9C73-AF5EB9851118"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7f90d884f03e","org_name":"Mate1.com","org_type":"other","ransomware":null,"records_affected":27000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hacker-claims-to-have-sold-27m-mate1-com-passwords/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/hacker-claims-to-have-sold-27m-dating-site-passwords-mate1-com-hell-forum"}],"summary":"databased hacked for PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c00eabf099a6219bc525b9896a21b0840ddfa893","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B040BD1B-8129-4926-8EF1-B4CD957E7C25"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"89fc36c6abe6","org_name":"Manitoba Health","org_type":"healthcare","ransomware":null,"records_affected":197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-197-patient-health-records-inappropriately-accessed-by-provincial-employee-for-birthday-cards/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/manitoba-health-information-breach-1.3849925"}],"summary":"A former government employee wasn't up to anything nefarious when she peeked at the private health records and home addresses of Manitoba patients  she just wanted to know where to send her love and birthday wishes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adedb13807d97a7c99de5eabbdf32667d3e6a3c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8c5d88f0-8f3c-11e8-a74f-e5450456a5bf"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"337e61ef20ec","org_name":"Main Line Health  Inc.","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cincinnati.com/story/money/2018/07/03/hiphipaa-laws-cracking-down-co-worker-snooping/755522002/"}],"summary":"On two occasions, Terrell had accessed a co-worker’s personal data through the internal records system. Her conduct not only constituted a breach of company policy, it also violated federal health care privacy laws, specifically the Health Information Portability and Accountabili","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83bf4524a0ffccf38a0e499856de2b82b2a4fa39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F98BC21D-A10F-4440-952A-A2A3098B4C2B"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71538e2d34e5","org_name":"Magnolia Ridge Care and Rehabilitation Center","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.al.com/news/birmingham/index.ssf/2016/04/gardendale_nursing_home_worker.html"}],"summary":"Gardendale nursing home worker charged with identity theft - Magnolia Ridge Care and Rehabilitation Center - A Gardendale nursing home employee is under arrest after police say she stole the identities of hundreds of people, including eight at the facility where she worked; inves","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e28e52f64b61686d67b74e04a0a4d288e7f23efb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AF7EEE9-BCD4-43C7-81DB-E1EE48CB82ED"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"43ad941a5c4a","org_name":"Lukas Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dw.com/en/hackers-hold-german-hospital-data-hostage/a-19076030;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/02/26/german_hospitals_ransomware/"}],"summary":"Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"496c92ef4c73de10e1a763f7a6572f72ebbbecf2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cde3a660-811e-11e7-8520-b5d4bef506ca"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8bb085a6e65","org_name":"Louisiana Citizens National Bank's","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shreveporttimes.com/story/news/crime/2016/04/20/atm-skimmers-discovered-two-north-louisiana-banks/83279394/"}],"summary":"Skimming device found at Minden ATM - Citizen's National Bank","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01a4224cdd9b4a3e7243005b17a61912bc464121","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B17BF12-C68A-4873-A17A-2ACFDE441EB4"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77a091dd5b0f","org_name":"Los Angeles County Department of Health Services","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/los-angeles-county-health-department-targeted-in-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/los-angeles-county-health-department-suffers-ransomware-attack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-county-health-services-ransomware-20160226-story.html"}],"summary":"Los Angeles County Department of Health Services computers have been targeted in a \"ransomware\" cyberattack, officials said Friday.  Ransomware is a type of malware that takes control of computers and cuts off users' access to files or threatens to destroy them unless a ransom is","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e26ecb52a2e1aafd9f982ea3ad14f527951b372","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BB603E7-D025-4F3B-9241-4C72BEC52A1E"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e2b7c7be9b6f","org_name":"Leicestershire County Council","org_type":"government","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.leicestermercury.co.uk/String-data-protection-breaches-Leicester-City/story-28561363-detail/story.html"}],"summary":"poor security practices","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff38f9ce940dd7f648fab5821f65757f958512be","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"085A4B6B-8143-43F9-A0F7-5A899BA5624B"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"384e42205d4b","org_name":"KFC","org_type":"other","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thesun.co.uk/news/2381886/kfc-website-hacked-as-over-1-2m-loyalty-scheme-members-warned-to-change-password/"}],"summary":"Website breach targeted 30 KFC loyalty club credentials in the UK","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3df6d17ec45bc14968a03747d00e0bef9ea320d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D234A10E-7874-4E1E-ADEA-98969208FB00"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3438fe73f19b","org_name":"Kent police force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-kent-police-force-fined-for-passing-on-personal-details-in-domestic-abuse-case/"}],"summary":"Kent Police had inappropriate security measures, and that it had committed a serious breach of the law, likely to have caused substantial distress.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6b541b78c1771f371a734b191ea8f7a7ad82a5d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BF4229D-F7F5-4DA7-9164-7D90B53BAE3F"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfbafe8989a6","org_name":"Karmanos Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":2808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/karmanos-cancer-center-discloses-lost-flash-drive-contained-patient-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.detroitnews.com/story/business/2016/03/11/data-breach-reported-karmanos-cancer-center/81652590/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/karmanos-cancer-center-patient-info-at-risk-from-lost-flash-drive/article/483093/"}],"summary":"More than 2,000 Karmanos patients and family members have been affected by a data breach involving an unencrypted flash drive lost in the mail, said medical center officials.  The Barbara Ann Karmanos Cancer Center is in the process of contacting 2,808 patients and family members","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ba240513bce09acc6898aa2c2d5bbbe4ef427d4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"029ACFBC-720D-41DB-92D4-F719E149A920"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"880b8684a2c5","org_name":"Kansas Heart Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/kansas-heart-hospital-hit-by-ransomware/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2016/05/25/ransomware-hit-hospital-faces-second-demand-despite-paying-up/"}],"summary":"Ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da97fbcb02931f49c3da4fb5096e4fd9dd727c00","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22493EDF-5778-4683-AEBC-66FB7830B1A4"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"59b01e69effa","org_name":"Justice Ministry and Edmonton Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cknw.com/syn/98/117374/117374;"}],"summary":" potential privacy breach of client data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a51c5d6973f03f410cb990bda1f94beacf3f7a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98DA25E3-41F6-4E24-A238-40C489F258F7"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c13d5675e024","org_name":"Jefferson Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":10401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ms-jefferson-medical-associates-notifies-patients-of-new-and-old-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdam.com/story/32574292/laurel-clinic-warns-patients-of-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/more-details-emerge-on-jefferson-medical-associates-incidents/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jeffersonmedical.net/breach/index.php"}],"summary":"A cyber security researcher said a flaw in an online security system may be responsible for a data breach of patient information at Jefferson Medical Associates in Laurel.  \"I find things that are publicly available on the internet that should probably not be public available,\" s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7c319c6a0133a5f9f63268626dffbe0944cfaea","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"226D1AE9-0B48-40BE-AD23-14DD4D56D555"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6a38b073d3c6","org_name":"Janeway Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/accidental-eastern-health-privacy-breach-1.3801646;"},{"fetched_at":null,"title":null,"type":"press","url":"http://vocm.com/news/eastern-health-contacting-19-patients-affected-by-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/eastern-health-privacy-breach-orthotics-clinic-1.3802943;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-19-patients-affected-in-accidental-eastern-health-privacy-breach/"}],"summary":"Eastern Health is calling a privacy breach involving 19 patients at a travelling clinic in Happy Valley-Goose Bay \"accidental.\"  The health authority said the personal information of some patients went missing during an orthopedic travelling clinic from June 6 to 10. All those af","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fd473df6b4ea9d07263454cb5f3a4d1cc71e81d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F94648F-6777-4FCA-9D3A-DA3BBD653590"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8de310b70708","org_name":"Island Health","org_type":"healthcare","ransomware":null,"records_affected":197,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vancouverisland.ctvnews.ca/island-health-investigating-privacy-breach-of-198-patient-records-1.2944408"}],"summary":"Employee access of medical records of patients not in their care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66b7b09223fecf235b356505aa5a72e6bde216dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9851c980-c24c-11e8-bf07-99bafabab839"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d02b0a2b0467","org_name":"Innovative Services NW","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.columbian.com/news/2018/sep/14/vancouver-woman-gets-a-year-in-prison-for-stealing-22000-from-elderly-client/"}],"summary":"A Vancouver certified nursing assistant who stole tens of thousands of dollars from an elderly woman and hundreds more from a quadriplegic woman was sentenced Thursday to more than a year in prison.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0675f9c32483a498b33be0f20083d9ce874f57c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2BD5D56-74D0-40F0-9594-73A3ED1ABC03"},"incident_date":"2016-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"99a206c5cd95","org_name":"Incorpore","org_type":"other","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.walesonline.co.uk/news/wales-news/thousands-email-addresses-leaked-online-12132241"}],"summary":"Thousands of email addresses belonging to businesses and councils in Wales have been dumped online after a health club firm was targeted by a \"classic hack\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa8446ecfa855e02d059696945983e208ef71ac1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8265990C-BBC0-417C-9573-E94A3BF0F887"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4ecebca7ec41","org_name":"Hitachi Payment Services","org_type":"other","ransomware":null,"records_affected":3200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/india-experiences-catastrophic-cyberattack-with-theft-of-3-2-million-debit-cards-account-details/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://economictimes.indiatimes.com/industry/banking/finance/banking/3-2-million-debit-cards-compromised-sbi-hdfc-bank-icici-yes-bank-and-axis-worst-hit/articleshow/54945561.cms"}],"summary":"India is dealing with one of the worst data breaches ever to hit the country with as many as 3.2 million debit card details stolen from multiple banks and financial platforms.  On Thursday, the Economic Times reported that malware was used to compromise the Hitachi Payment Servic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36183fc679d426a19d9d6a76696f18a65a128b2c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDA98B08-12A7-448D-A04A-A88D285D2FD8"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"7313b23d4166","org_name":"Health Service Executive","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/john-mcguinness-says-hse-in-serious-breach-of-data-protection-as-patient-files-stored-in-unlocked-outhouses/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kclr96fm.com/john-mcguinness-says-hse-serious-breach-data-protection-patient-files-stored-unlocked-outhouses/"}],"summary":"A Kilkenny Dil Deputy says the HSE locally has seriously breached Data Protection.  John McGuinness says it was brought to his attention that there are boxes of patient and HSE workers' files stored in unlocked outhouses at the site of their auxiliary hospital on Wolfe Tone Stree","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a14499b5d780bd870104308d7c14777a8c44543f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BBEE166-123E-4B7C-B3E6-35CDC29A4F2A"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"227fffe7d5c1","org_name":"Guidance Residential","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/university-bank-of-ann-arbor-liable-for-willful-and-malicious-trade-secret-misappropriation-300288118.html"}],"summary":"theft of trade secrets ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65b42db1f2910dbfa82262be8b1e313a03505320","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB7AA5C3-3B2D-462F-8EE5-C55C726F7623"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74c44585c26b","org_name":"Grand Street Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":14772,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-treasure-trove-of-grand-street-medical-associates-patient-data-exposed-and-indexed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2016/03/22/medical-data-breach-exposes-patient-records/"}],"summary":"PHI was stored on an unsecured, internet-facing FTP server. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fabc4d29651a428082cecff92571e9560d7efe9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF35341A-AA79-47D0-A3E3-47629657AA1D"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"fa85c238945e","org_name":"Gold Coast Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-gold-coast-health-apologizes-and-retrains-staff-after-patient-notes-found-lying-in-street/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.goldcoastbulletin.com.au/news/gold-coast/gold-coast-health-apologises-and-retrains-staff-after-patient-notes-found-lying-in-street/news-story/9aaa771aab1e883ea6714e77cabae7df"}],"summary":"Gold Coast Health is retraining staff on how to handle patient records after a local truckie's surgical report and personal information was found in the street.  The blunder, which prompted truck driver Martin James to lodge a complaint with Gold Coast Health's privacy officer, h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e0c346ece0cab57c7fd6979500d298bf1f4adcb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AFEFAA6-242D-4674-87C4-6C5C81B0CD80"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4acbcfee4e28","org_name":"General Optical Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.opticianonline.net/personal-registrant-data-leaked-general-optical-council/"}],"summary":"Personal data of General Optical Council registrants has been mistakenly shared by the regulator with three optical organisations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4260bad14cde1af2f4c78193f0a6b574b5dc0788","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E3E33F3-E846-4226-BEB6-D8AD8639747C"},"incident_date":"2016-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"625313b62d9b","org_name":"FriendFinder Networks Inc","org_type":"technology_saas","ransomware":null,"records_affected":412000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3132933/security/penthouse-adult-friendfinder-databases-leak-at-least-100-million-accounts-impacted.html"}],"summary":"LFI leads to compromise of numerous sites under same corp umbrella","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c7f9d66d9c2d5e928002b09b04c74d6b2d04974","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E9F0D91-32BC-4509-8083-1D10C38395E4"},"incident_date":"2016-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b860d13c567","org_name":"Friend Finder Network","org_type":"technology_saas","ransomware":null,"records_affected":412000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/secrets-for-hundreds-of-millions-exposed-in-largest-hack-of-2016-friend-finder-network/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2016/11/13/13615750/412-million-adultfriendfinder-accounts-exposed-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/adultfriendfinder-network-hack-exposes-secrets-of-412-million-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/technology/2016/nov/14/adult-friend-finder-and-penthouse-hacked-in-largest-personal-data-breach-on-record"}],"summary":"Adult dating service company Friend Finder Network has reportedly been hacked, with over 412 million accounts, email addresses, and passwords from their websites made available on criminal marketplaces. Notably, the database does not include more detailed personal information, bu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1159b7d8937c4faeb4944aa08f15c94335d404","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32462D59-D5F8-4868-AD56-B47BE3CC8B42"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f22bdcb9d01f","org_name":"Florida Hospital","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/boxes-of-patient-information-missing-from-florida-hospital-in-orlando/459486261"}],"summary":"Boxes of patient files lost during a move.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab6c8be96d034a9e38db499daf1252c2c520d185","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F96FF75C-5000-4EE9-8B4C-81FCF6AF25C4"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aeab7b909582","org_name":"First Citizen bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wbtw.com/2016/06/28/darlington-police-continue-to-investigate-atm-skimming/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa8316c4ca7e750462c581ff6bc9d8ac433292b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4423F3D6-F03E-4C7B-8C0E-AEE930F38172"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"19e33debde01","org_name":"Family and Child Services of Lanark, Leeds and Grenville","org_type":"healthcare","ransomware":null,"records_affected":285,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/ottawa/family-children-services-facebook-personal-information-1.3546788;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.recorder.ca/2016/04/22/fcs-agency-facing-class-action-lawsuit;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard-freeholder.com/2016/08/10/two-smiths-falls-residents-charged-in-child-services-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ottawa.ctvnews.ca/names-of-285-people-referred-to-children-s-aid-in-lanark-leeds-and-grenville-posted-online-1.2865944"}],"summary":"website hack leads to PII compromise","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b500fcd9e08524b7afefc5f880e37b7a7574533","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE27A740-BA14-4A0C-8B58-0C90B4A9DE57"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"ca5acf16fc52","org_name":"Ericsson-LG","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreaherald.com/view.php?ud=20160919000710"}],"summary":"Former employee took sensitive data upon leaving company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70d21e52c57e876f2199b24ae39ec80573b60268","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93FFFE30-8C44-4ACD-8C6F-2DAA9F6C21D4"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"3e09e4005f1c","org_name":"Erasmus University","org_type":"education","ransomware":null,"records_affected":27000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://themerkle.com/erasmus-university-data-breach-exposes-students-medical-and-financial-information/"}],"summary":"Not too long ago, the Erasmus University was a victim of a data breach. Although initial results indicated not too much sensitive information was obtained by hackers in the process, it looks as if those findings need to be revised. New data reveals that medical and financial deta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"358ba678b06e4940abdb8431d19599574c9045b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01757980-d565-11e9-8558-6543aabf247e"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee776572d10e","org_name":"Equifax Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2016/05/crooks-grab-w-2s-from-credit-bureau-equifax/,https://www.databreaches.net/kroger-notifies-employees-of-w-2-breach-involving-equifax-service/,https://www.itpro.co.uk/data-leakage/26498/equifax-suffers-data-breach-losing-431000-workers-details"}],"summary":"default login to asset  website was personal info of individual.  Attackers used already known info to scrap w-2 information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9c79bb2328bea757b26a6d3492a938e33c76593","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E963429-EAE2-4C96-8E8A-967EAC6B46AD"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"675ff0301d69","org_name":"Emergency Medicine Associates","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tucson-er-info-with-1000-names-is-stolen-from-doctors-car/"}],"summary":"Logbook stolen from Dr's car.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0a6984d7584cf2b900b983ef627113f8db22914","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E394D93-C60C-4F81-A3FB-25171B782EAC"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36e9ce04d2d4","org_name":"EC-Council","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2016/03/certified-ethical-hacker-website-caught-spreading-crypto-ransomware/"}],"summary":"site spreading malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61c30e8158ffa61d00b30d47aab18a416669a214","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD00AA2A-6578-4E61-A3E3-2BF62E9FD3A8"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"429d06f79ee0","org_name":"Eastern Health","org_type":"healthcare","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsjs.com/url.php?p=http://www.ottawacitizen.com/health/health+authority+fires+clerical+worker+over+privacy+breach/11893805/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/eastern-health-employee-fired-for-deliberate-privacy-breach/"}],"summary":"Newfoundland and Labrador's largest health authority says it has fired an employee over a privacy breach involving the records of 11 patients.  Eastern Health says it launched an audit to investigate when two of the patients in question raised concerns.  The audit revealed severa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"410908d49e167c584f5c3d04f9124639e9f54d27","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E40CFD4C-62D2-438F-A22B-2987083618C3"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c39f747fb45","org_name":"East Riding Clinical Commissioning Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hulldailymail.co.uk/serious-incident-east-riding-patients-medical-records-lost-by-company-paid-to-keep-them-safe/story-29479945-detail/story.html"}],"summary":"'Serious Incident': East Riding patients medical records lost by company paid to keep them safe  MEDICAL records for patients in the East Riding have been lost by a firm paid by health bosses to keep them safe in storage.  East Riding Clinical Commissioning Group (CCG) has launch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be16ec471600955dd50594c5bc8b6aa46482c60c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10428610-7617-11e7-9d88-ab89f89c69db"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"396a554b8880","org_name":"Earbits","org_type":"technology_saas","ransomware":null,"records_affected":325000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/earbits-com-leaks-325000-user-credentials-misconfigured-database/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/183-earbitscom-leaks-325000-user-credentials;"},{"fetched_at":null,"title":null,"type":"press","url":"https://betanews.com/2016/01/20/earbits-music-service-had-a-data-breach-but-there-should-be-no-need-for-concern/"}],"summary":"Earbits.com Leaks 325,000 User Credentials: Misconfigured Database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7eb40c99eae26b3ac30a0d6f08b86ed2a5a03cb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDDACB68-06E7-43FA-B872-000875EC3AF3"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71f8c0b7adc6","org_name":"E-Sports Entertainment Association","org_type":"other","ransomware":true,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3155397/security/esea-hacked-1-5-million-records-leaked-after-alleged-failed-extortion-attempt.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fortune.com/2017/01/10/hackers-havoc-ransomware-esea/"}],"summary":"E-Sports Entertainment Association, a company that hosts competitive video game tournaments, is among the latest to be hit. The gaming company said this week that hackers had released stolen data about its users, including emails, private messages, and phone numbers after it refu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd1d5299b69fe67abb81588e3f06d1b0f5c7957c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD8BDF0D-C37E-4742-B29D-CB0BF061ABF8"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5c5155af5d3","org_name":"Dr. Ronald Schultz","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/the-mystery-of-the-reappearing-ftp-server-part-2/"}],"summary":"Database that was spun up as part of a trail run of software was turned back on after 10 years this time without a password","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1e5e0cf5b894fb1d372d79eee4cb6ae8b175133","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34A476C1-3CC9-408B-8244-17D678C123DA"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10af3c05e2dd","org_name":"Dillard's Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/plaintiffs-use-privacy-pledge-against-insurer-in-data-breach-claim/"}],"summary":"employee data unsecure on internet by 3rd party insurance company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"412062b2b41f14150c5ae91c4d566cc7ba6f4d3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A234568C-0FE3-4434-A5B5-B0F90CA4D643"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8f21d9a21008","org_name":"Derriford Hospital","org_type":"healthcare","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-confidential-records-of-37-derriford-hospital-patients-discarded-in-truro-charity-clothing-bank/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.westbriton.co.uk/37-confidential-patient-records-derriford/story-28838849-detail/story.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.plymouthherald.co.uk/computer-hackers-targeted-derriford-hospital-and-demanded-ransom-payment/story-29680007-detail/story.html"}],"summary":"Former employee who still had PHI paper documentation dumped the documents in a charity clothing bin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6caa0559194a8fffc097406d1a0e60d59e4fcfc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05839C79-6565-457D-97D6-AE982388E99E"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"685db895c7f4","org_name":"Department of Youth Rehabilitation Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcwashington.com/news/local/Former-DC--Employee-Sentenced-4-Years-Identity-Theft-Tax-Fraud-Scheme-377989101.html"}],"summary":"A former employee of D.C.'s Department of Youth Rehabilitation Services was sentenced to four years in prison for stealing the identities of young people in order to file false income tax returns.  Marc A. Bell, 49, of Bowie, Maryland, worked as a program manager, program officer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af03ee7c216b1887a035586bcd0d12edda0de171","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83bdb720-eab8-11e7-92b6-dfe49f9d7042"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-veterans-affairs-admits-to-another-privacy-breach-by-canadian-legion-staff/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.nationalpost.com/news/canada/canadian-politics/veterans-affairs-admits-to-another-privacy-breach-by-canadian-legion-staff"}],"summary":"Veterans Affairs is acknowledging another case where the confidential files of a Canadian veteran were accessed, without consent, by an employee of the Royal Canadian Legion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa161ae64d5f58eb9ddbaf99cfab2e56230b362c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"650F2B0F-30F4-46DD-8731-27D7CE58ECD5"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9ce032cfdbc","org_name":"Department of Housing and Urban Development","org_type":"government","ransomware":null,"records_affected":425000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.housingwire.com/articles/38573-hud-inadvertently-exposed-personal-information-of-nearly-500000-individuals"}],"summary":"Publishing error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4251cdc5458b135d3f76b0ddd9b156ef0c4145cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F638D14-8C4F-4F56-8721-EACBB1D6589A"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0230f4b1d437","org_name":"DeKalb County VA Medical Center","org_type":"government","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ga-veteran-given-10-other-patients-records-by-atlanta-v-a-medical-center/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ga-veteran-given-10-other-patients-records-by-atlanta-v-a-medical-center/"}],"summary":"Request for medical records by veteran resulted in his receipt of 10 others as well.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e07adfe2a27a531f19d367200c3371c485c496f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"755AA965-0905-4C98-884B-726D7A23FB64"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e33b9ddc2110","org_name":"DeKalb County Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.11alive.com/news/crime/dekalb-county-police-employee-charged-with-selling-information/244328953;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/local/dekalb-police-department-employee-arrested-selling/nrgPX/"}],"summary":"An civilian employee with DeKalb County Police Department is no longer working for the force, authorities said.   DeKalb County Police arrested Shirley Waters Monday and charged her with Computer Invasion of Privacy.   Waters was an aide with the Auto Theft Unit with the police d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"IN","motive":"ideology","name":"bohrilieaks","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc78d9169b41e383e169c0e7d5aee43de1b5f5fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"663700d0-ce5a-11e9-a07e-2170fe2d70c6"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"a7f82d0d5648","org_name":"Dawoodi Bohra Trust","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.mid-day.com/articles/bohrileaks-massive-data-leak-hits-bohri-muslims-ahead-of-moharram-mumbai-news/17669199"}],"summary":"hacktivists hack database of religious attendance to show data improperly secured.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"bohrilieaks"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e25cd5ddd7d3adfb23c46a949d8a8bf08b3f0d14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DD9CF48-4CA6-4879-B132-1740E6A13CB9"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2a823bf97a62","org_name":"Cyberoam","org_type":"professional_services","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehindubusinessline.com/info-tech/security-firm-cyberoam-turns-victim-in-cyber-attack/article8054964.ece?utm_source=RSS_Feed&utm_medium=RSS&utm_campaign=RSS_Syndication"}],"summary":"cybersecurity firm hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":"~hades","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dcae3c4717fa6ba635c9d18ff34f9394dee9c8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A6B230C-CD76-45D8-89E6-1874CC8DF71B"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"f55f300397b6","org_name":"Crystal Web's","org_type":"technology_saas","ransomware":null,"records_affected":5400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/security/169341-south-african-isp-suffers-massive-password-leak-online.html"}],"summary":"ISP leaks customers data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"hades"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6792c31380ac44aa5e519f8bd4300f8f5427ad91","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d8cc6d40-761b-11e7-9d88-ab89f89c69db"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6ff2dd9c3a2","org_name":"Crest Foods","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news9.com/story/30995309/personal-information-found-on-discarded-crest-foods-job-applications"}],"summary":"Personal Information Found On Discarded Crest Foods Job Applications","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94e383f1e6f210b1af3f8b8e5d20ac487936b3c1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4c168230-d964-11e7-8b17-fdfed30923dd"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d777adac537","org_name":"Community Health Plan of Washington","org_type":"financial","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://komonews.com/news/local/data-breach-at-community-health-plan-of-wash-exposes-380000-members"}],"summary":"Data breach no details provided.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e04beaeb099c8ca0b58119b0537622bd094e9d34","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC5275C0-CBF9-46E5-BB83-5ACD3A3BDD58"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"273fbb6c578c","org_name":"ClixSense","org_type":"technology_saas","ransomware":null,"records_affected":6600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/6-6-million-plaintext-passwords-exposed-as-site-gets-hacked-to-the-bone/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cybercashworldwide.com/clixsense-has-been-hacked;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.yahoo.com/tech/clixsense-suffers-massive-data-breach-200212574.html"}],"summary":"ClixSense, a site which pays users to view ads and take surveys, was the victim of a massive data breach compromising around 6.6 million user accounts.  Usually when there's a data breach of this size, the information stolen contains usernames, passwords, and some other personal ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0d5e17714f9e3d59f818f7ce0a9dfa896625c8e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"823D144C-89F1-4164-9F3E-8DA9957FFA2E"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d2da53abc7","org_name":"Clark County Water Reclamation District","org_type":"energy_utilities","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reviewjournal.com/news/las-vegas/clark-county-water-reclamation-district-computer-system-hacked"}],"summary":"ransomeware on Water reclamation computer system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"017d6987bac5aadc9f74a2730c6780eded746cd8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4649AE7-6B57-46DE-A37D-6E02AC0FED3B"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2cb169c0b8e","org_name":"City of Austin","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.twcnews.com/tx/austin/news/2016/07/1/city-of-austin-responds-after-hundreds-of-residents--social-security-numbers-released.html"}],"summary":"City of Austin sent documents to Time Warner without obfuscating sensitive information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd7a360ecab411a2e3e4f95e345383112d3c78ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F007626E-B60E-4E08-B905-7E6DC0B199D1"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d0f4dd13509e","org_name":"Child, Youth and Family Services","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nwsgo.com/2-intentional-privacy-breaches-in-government-says-office-of-privacy-commissioner/"}],"summary":"Misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"003cf6366edbbab94867d63ce9d419fa16c46fc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72F64D33-1541-4EDD-A7BE-58F833E7539A"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77e31ae6c5a8","org_name":"CHI Good Samaritan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nebraska.tv/story/31551065/personal-info-stolen-from-chi-employees"}],"summary":"Employee information lost due to third party attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3147b0af40642895a408733420c1d2d9e1ebfa7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d20d3720-eaae-11e7-92b6-dfe49f9d7042"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"390f55210e94","org_name":"Charleston Area Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://wvrecord.com/stories/511274429-patient-accuses-charleston-area-medical-center-ex-wife-of-invasion-of-privacy"},{"fetched_at":null,"title":null,"type":"press","url":"http://wvrecord.com/stories/511092664-woman-accuses-camc-associated-radiologists-of-breach-of-privacy"}],"summary":"Patient accuses Charleston Area Medical Center, ex-wife of invasion of privacy.  A Logan County man alleges his medical records were accessed by his ex-wife without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df71ae061e1b114c494a96042fda83daad86e2a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"085e73b0-9713-11e7-a11c-5542f7e3819f"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"663b503468e0","org_name":"Carolina Neurosurgery & Spine Associates","org_type":"healthcare","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/news/local/crime/article153689514.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbtv.com/story/35557029/charlotte-medical-employee-pleads-guilty-to-patient-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/local/federal-prosecutor-charlotte-medical-practice-worker-sold-patients-private-info-for-10/523221440"}],"summary":"Federal prosecutors have charged a Charlotte medical practice employee over accusations she sold patient's private information to an identity thief.  Keniona Laneen Thomas, a former employee at Carolina Neurosurgery & Spine Associates, was charged in a bill of information filed M","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80b0c1f635175fec2f169f8c10830224013798db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94837F77-6F0E-44F5-9C42-F92B5E47F5C9"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b6645783bc2","org_name":"CARDSource","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Customer%20Letter%20DB%20Templ%20Fin_0.pdf"}],"summary":"third party compromised puts their data exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"259c6821049ca98ec18ee0f060ef7c10a0996306","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"420B1182-EE25-4442-9F50-A559E33A7768"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"313a72dbc41c","org_name":"Cambridge leisure park ATM","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cambridge-news.co.uk/suspected-skimming-device-found-at-cambridge-leisure-park/story-29524119-detail/story.html"}],"summary":"ATM skimmer found in park setting","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41de9596bd4c0d8014f5e658e36a5ffdf59f9ae0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9745352C-247F-4487-89BC-3F26EBDA2753"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e29b2189881","org_name":"CalOptima","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/caloptima-discloses-second-hipaa-breach-in-as-many-months/"}],"summary":"employee downloaded info to USB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d1ee6ef3134b42923d18b656c3566239e83856d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37A6B76C-CFE3-4FBF-B109-C627508EB364"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c36b6ebc34f2","org_name":"California Correctional Health Care Services (CCHCS)","org_type":"healthcare","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/laptop-breach-may-affect-400000-prisoners-a-9173"}],"summary":"The recent theft of an unencrypted laptop that may contain information on up to 400,000 inmates who served time in California prisons has been added to the federal tally of health data breaches. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04bf848a484d4ec238e2051b22095c8acd663be3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6340F148-2463-4F0F-8083-C1177CC7A464"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d74724d12692","org_name":"Bureau of Workers' Compensation","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsnet5.com/news/local-news/oh-cuyahoga/confidential-ohio-medical-records-exposed"}],"summary":"A Cuyahoga County man said he stumbled upon a data breach involving medical records filed by the Ohio Bureau of Workers' Compensation.   The man, who did not want to be identified, said he filed a claim with the department. When he logged onto the state BWC website and entered hi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcde1fbf0f506e78d1b698738abacb0604924748","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43C61A71-5002-47C5-8B77-3F3FE0AA07E3"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"856abaeb9f1e","org_name":"Bureau of General Communicable Diseases","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://asiancorrespondent.com/2016/03/thailand-sensitive-info-about-tourists-revealed-in-2nd-online-data-leak/"}],"summary":"Publishing error leads to data leak","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d27d8fc8742f86599459608bad9d5444d4dc4cf8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"765ce730-b6a1-11e8-b56a-011002460f8b"},"incident_date":"2016-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e3fd86d99f9e","org_name":"British and Foreign Bible Society","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2018/06/08/ico_fines_bible_society/"}],"summary":"Ransomware attempt led to disclosure of payment card data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0d74950f9465865b05fa5c088cb510ca82f03c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EE24C94-6C7E-432A-8FC3-DA44A782B98F"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e01857231362","org_name":"Brant County Health Unit","org_type":"healthcare","ransomware":null,"records_affected":498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.brantfordexpositor.ca/2016/08/09/health-unit-apologizes-for-security-breach"}],"summary":"PHI available on website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be3f1cfb11e7f34a33ba00b7c93b68e2dbc609e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"005E7AB2-7DB5-4041-BD7D-7AB4583EAAB6"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc7868b13c3d","org_name":"Berkeley Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/BerkeleyUSD-NotificationBANG-sample_0.pdf?"}],"summary":"In response to a California Public Records Act request, Berkeley Public Schools responded with extraneous PII. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e559854eb5651111317c60316d8e51707fa3aec1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d942ffe0-2398-11eb-a2fc-cdee479fbead"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f09c120ce89a","org_name":"Beneficial Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/philadelphia/news/2018/10/12/former-bank-employee-charged-in-424k-id-theft.html"}],"summary":"city policy data found on criminal forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec65fed5075201dae514aaea2ee73431eb59a7d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE40DFB8-5CDD-4220-A1D3-6D3C2120D9A5"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0851e0c80ed2","org_name":"Beaufort Delta Health Authority","org_type":"healthcare","ransomware":null,"records_affected":67,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/patient-records-possible-breach-1.3435311;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/inuvik-hospital-employee-patient-record-breach-1.3573992"}],"summary":"67 patients had their medical records accessed inappropriately","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b7a39c7bc0031edff94e008309edf4f4ad9e837","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E57A8456-68FE-4B8B-8703-B08D4EBDC086"},"incident_date":"2016-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70411f1fdcb8","org_name":"Baystate Health","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ma-information-of-13000-baystate-patients-possibly-compromised-due-to-phishing/"}],"summary":"Information of 13,000 Baystate patients possibly compromised due to \"phishing\"  Baystate learned that a \"phishing\" email had been sent to several Baystate employees allowing hackers to access some employees' email accounts. The hacker designed the phishing email to look like an i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5c6ca812a0379917d3c5092f3a72db47e2955de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE3115F7-1AF7-4304-928C-19088015179E"},"incident_date":"2016-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd7f6097e75e","org_name":"Bay Area Children's Association","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/notice-of-data-breach-from-bay-area-childrens-association-300264238.html"}],"summary":"cyber intruders may have installed malware ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54940786c94a7aea0dcd15914e2e61dc1eafeb2b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ABD64505-EC1B-4BE1-829C-84A63E2941B2"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a9d34509def","org_name":"Barbieri Restaurant","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.syracuse.com/crime/index.ssf/2016/08/north_syracuse_restaurant_owner_charged_with_grand_larceny_forgery_police_say.html"}],"summary":"Restaurant stole checks from the customer's home while delivering food ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e493fe77c7e328bfe831dff7b6a4b2bfbc49a664","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b748bd90-e425-11e7-8742-2bc46bd10713"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fe014a292ee","org_name":"Banner Boswell Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/az-hospital-employee-accused-of-stealing-patients-credit-cards-bought-parts-to-build-ar-15/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc15.com/news/region-west-valley/sun-city/mcso-hospital-employee-accused-of-stealing-patients-credit-cards-buying-items-online"}],"summary":"A hospital employee is behind bars for allegedly buying multiple items from a store online with credit cards that he stole from patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38337b4230a8dfe52a6420f8c2c03d987bf64431","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F9E0EAE-9BBD-41DD-B0A5-A7D0DCB925DC"},"incident_date":"2016-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America Corp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://braintree.wickedlocal.com/article/20160202/NEWS/160208805"},{"fetched_at":null,"title":null,"type":"press","url":"http://6abc.com/news/2-arrested-after-skimmer-found-on-atm-in-radnor/1270983/"}],"summary":"ATM Skimmer ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f2a57fc302d36b2a205f13976ae942d40306335","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E19F5F6-A976-40FA-947C-2703BFB4C810"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ccd7fe4cddc0","org_name":"Bank New Zealand","org_type":"financial","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tvnz.co.nz/one-news/new-zealand/more-than-1500-bnz-customers-confidential-information-compromised-in-data-glitch"}],"summary":" system error a small number of customers yesterday morning received routine text and email alerts for accounts that did not belong to them,\" the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25b40887ca668d97bac3363d481e1f14b8c1bcd0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6F83D88-C44C-441E-B868-164ABBAB579E"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BS","org_id":"388fa7e2a640","org_name":"Bank","org_type":"financial","ransomware":null,"records_affected":175000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/world/bahamas-offshore-data-leak-tax-haven-1.3771867"}],"summary":"Canada sending money to Bahama's","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f7a299a4979f2d447a90c91c326c1da95d0a28b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"976C8221-E0D3-4EAC-B91D-C5FDCDA9F20D"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"d6da91d3575c","org_name":"Australian Health Practitioner Regulation Agency","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/technology/2016/feb/09/nurse-allegedly-assaulted-after-watchdog-employee-used-database-to-find-her"}],"summary":"Nurse allegedly assaulted after watchdog employee used database to find her","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"694ff2f0b1282f091015033f9876eae09e19c36d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB6ABEAC-335B-4237-A0E8-B14A81CE1F1C"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"01df543b9490","org_name":"Australian Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/national/public-service/privacy-watchdog-called-after-health-department-data-breach-20160929-grr2m1.html;"}],"summary":"Australian Health Department published information that tied prescriptions to doctors. Shoud not have been made public, but did not identify patient information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b71d71f1a08f4b0a0f262eb0c472956b91f70589","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FEC0069-C50E-4F6C-B37C-70FDE1097F72"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cd4d1306ae9d","org_name":"Australian Bureau of Statistics","org_type":"government","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/big-w-shutters-online-shopping-after-data-leak-441236"}],"summary":"The Australian Bureau of Statistics inadvertently released contact names linked to more than 5,000 Queensland businesses in what was described as a \"human error\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9112dbc4ca2753770d0cc8cefff736f82086d7cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BA25696-4729-467F-8789-10635D6DAAE7"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8edc16f08d8b","org_name":"Ascension Parish Health Unit","org_type":"healthcare","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/crime/baton-rouge/index.ssf/2015/06/social_security_stolen_ascensi.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theadvocate.com/new_orleans/news/communities/article_44eca381-3b35-5c84-861c-82dc397a9b12.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/crime/baton-rouge/index.ssf/2015/06/social_security_stolen_ascensi.html"}],"summary":"access device fraud and aggravated identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf377b7e8ed6956ccae989ebcf0af5e6383e9c32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6AA12732-978F-4E97-932B-0ED149B54E1E"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b26edb9e356","org_name":"Arkansas State Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2016/oct/6/ex-arkansas-hospital-orderly-sentenced-for-identit/"}],"summary":"Identity Theft at Hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6a3970803e4e33f1fa690171e728b92de6a2765","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1a4da380-eeb0-11e7-b683-c1703914e4a4"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"758bc92383cf","org_name":"Apria Healthcare","org_type":"healthcare","ransomware":null,"records_affected":912,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64474;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Apria%20-%20Notice%20of%20Data%20Event%20-%20CA%20Exhibit%201_0.pdf"}],"summary":"On August 5, 2016, Apria Healthcare discovered that the email account of an Apria Healthcare employee was subject to unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87bf485b04d0f226d14d223b2fd85ed07d431427","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9145D97-AD50-42D5-BAAD-930A025FAF36"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c683b7df3469","org_name":"Apple Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/apple-store-workers-found-raiding-photos-from-female-customers-phones/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2016-10-13/apple-sacks-several-carindale-staff-over-alleged-privacy-breach/7929612;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.straitstimes.com/asia/australianz/apple-staff-fired-over-sharing-of-customers-intimate-photos"}],"summary":"Employees misusing access to customer photos on mobile devices","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed5072ca51c30d5c7bf3f887e8e9260723ff5515","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B86313FC-BB19-4BCA-8227-A0F7E76ED767"},"incident_date":"2016-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"e291884a72b3","org_name":"Anhui Women and Children Health Hospital","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sixthtone.com/news/hospital-hackers-steal-thousands-newborn-baby-videos"}],"summary":"Hackers have got their hands on nearly 6,000 private videos of newborn babies and uploaded them to a video-sharing website, according to a Tuesday report by online news outlet Phoenix New Media.  The videos were recorded by the Anhui Women and Children Health Hospital in Hefei, t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cda1b6fe0528d1650fc1c637dcac97922f682aa7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"848F849B-322C-4DCB-BC89-B8963C6C6A8A"},"incident_date":"2016-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f453c5f59832","org_name":"Allstate Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kerngoldenempire.com/news/local-insurance-agent-arrested-on-counts-of-identity-theft-and-insurance-fraud;"},{"fetched_at":null,"title":null,"type":"press","url":"http://bakersfieldnow.com/news/local/bakersfield-insurance-agent-arrested-on-14-counts-of-id-theft-and-fraud"}],"summary":"misrepresented information on over 100 auto and homeowner policies by \"manipulating the company database and falsifying insurance applications","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38efa5c1182942f99b99326d66763faa554425bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e72c67a0-0d94-11eb-8a4c-a57973eceafd"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e5adeef647dc","org_name":"Alexander Maconochie Centre","org_type":"government","ransomware":null,"records_affected":679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af705507cf91a2f5e6a7c1ae516c4ee3a64f2caf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F9E762F-C17B-4F8D-833F-79956202DE60"},"incident_date":"2016-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"244112ef90a3","org_name":"Ailsa Hospital and University Hospital Ayr","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-eight-patients-records-are-accidentally-leaked-from-ayr-hospital/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyrecord.co.uk/news/local-news/eight-patients-records-accidentally-leaked-7493169"}],"summary":"hospital staff discharge patient with other patients data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e2ec8e5480a44083239918f0e7a9726cac617b6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53AF1F7D-F8DB-4371-B63E-B8F8A9FDEB78"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f7face34dbe","org_name":"Access Health Care Physicians","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-recent-additions-to-hhss-breach-tool/"}],"summary":"Access Health Care Physicians has notified approximately 2,000 patients of a breach of unsecured personal patient protected health information following a break-in at the medical office of Dr. Imad Tarabishy, 11339 Cortez Blvd., Brooksville.  Records that were accessed may have c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1f2d239ae9d8e836054f6eb14077cd44ea45ed7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e186aee0-111f-11ea-bd5f-71a8176be0a0"},"incident_date":"2016-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0dde4e445947","org_name":"Aberdeen City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.eveningexpress.co.uk/fp/news/local/laptop-and-files-with-confidential-information-about-children-stolen/"}],"summary":"Paper documents and a laptop holding personal details about youngsters in the Granite City were taken when a car was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2016-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3af1db0cfe593b5e5db810596c288e34ed83042","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d072da10-dae3-11e9-aa50-b778a2874faa"},"incident_date":"2016-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"c40c06ee00dd","org_name":"2degrees NZ Ltd","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.newshub.co.nz/home/new-zealand/2016/07/2degrees-loan-iphone-privacy-breach.html"}],"summary":"phone repair doesn't clear phone before giving it to next person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be14eebec2e3bba292d91cfc48949a6b5c9eb158","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95D29905-BE56-49C7-8461-6F44BF113DAA"},"incident_date":"2016-02-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8421633b8bf7","org_name":"Shell Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boston.cbslocal.com/2016/02/12/credit-card-skimmer-quincy-gas-pump/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.petrolplaza.com/news/industry/MiZlbiYxOTUyMCYmMSYzMCYx"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"636851f7b583160a0995ef2824c48eaa11386f20","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9603.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e2ef4b6293b7","org_name":"Regional Income Tax Agency","org_type":"unknown","ransomware":null,"records_affected":38,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9603.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-12-31","discovered_date":"2015-12-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"165e48f6b55ac286cc6c8df7dc1c05623c46f0e4","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-10","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hillsides%20Employee%20Breach%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"136c1594e2ac","org_name":"Hillsides","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59475"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hillsides%20Employee%20Breach%20Notice_1.pdf"}],"summary":"A Hillsides employee sent files containing personal and health information to a personal email account.","supporting_quote":"On December 8, 2015, Hillsides became aware that an employee had sent internal files containing personally identifiable information (PII) and/or protected health information (PHI) to a personal (non-Hillsides) email address.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83326398d4ffaa0317352917e20e3766f33a5a99","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DDCCADB-F828-4AF4-9C1E-A1A2B2433536"},"incident_date":"2016-02-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.21alive.com/news/local/Marion-Police-are-investigating-skimming-devices-at-two-gas-stations-367541441.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/medina/index.ssf/2016/06/skimming_device_found_on_medin.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.petrolplaza.com/news/industry/MiZlbiYxOTUyMCYmMSYzMCYx"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"New World Hackers","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42605a7b2e1922f95be5828f4f7e9dcfe64cf81d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3135038-657B-4B51-860F-12510498A811"},"incident_date":"2015-12-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"93465b3085a3","org_name":"British Broadcasting Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anti-isis-hackers-claim-bbc-ddos-attack-say-it-was-only-a-test-498333.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2016/01/03/world/europe/group-claiming-to-oppose-isis-says-it-committed-cyberattack-on-bbc.html?_r=0"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-35204915"}],"summary":"BBC DDoS attack, the main BBC website, the iPlayer platform, and the iPlayer Radio app experienced a complete failure  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"newworldhackers"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61f0c405cdbef91060526d36698d459da0a18c1d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"979158C3-5E65-43B6-B5DF-C729845D5DEB"},"incident_date":"2015-12-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5403a211d112","org_name":"Vancouver Radiologists","org_type":"healthcare","ransomware":null,"records_affected":603,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/radiology-office-mistakenly-reveals-603-mammogram-patients-names/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.columbian.com/news/2016/feb/26/medical-office-mistakenly-reveals-patient-names/"}],"summary":"A Vancouver medical imaging center inadvertently disclosed the names of more than 600 patients when mailing appointment reminders.  On Dec. 30, Vancouver Radiologists mailed 603 mammogram appointment reminder postcards to its patients. On Jan. 4, the company discovered an error w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c5e8ed7422011ff331f143c691bbbc13242f6cb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5357D585-642B-4A6C-89F7-BF8C6C39CE95"},"incident_date":"2015-12-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"411f1eed792f","org_name":"Valley Hope Association","org_type":"healthcare","ransomware":null,"records_affected":52076,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ks-laptop-with-sensitive-personal-and-medical-info-stolen-from-valley-hope-association-employees-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://valleyhope.org/data-security-event/"}],"summary":"Valley Hope Association is notifying affected individuals of a data security event that may have affected the security of some of their information. We are unaware of any attempted or actual misuse of information relating to this data security event.  We are providing notificatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"037430239820733e64611bb14b38f1400b2944f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CD364CA-58C7-4FAF-B56A-6E96581DD472"},"incident_date":"2015-12-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"204d4b555c3a","org_name":"Shire Human Genetic Therapies, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/stolen-shire-laptop-contained-patients-personal-and-medical-info/;http://ago.vermont.gov/assets/files/Consumer/Security_Breach/Shire%20Human%20Genetic%20Therapies%20SBN%20to%20Consumers.pdf"}],"summary":"Pharmaceutical company Shire is notifying an unspecified number of individuals that their personal and medical information was on a laptop stolen from an employee's car in Washington D.C.  The laptop, which was issued by Shire Human Genetic Therapies, Inc. was stolen on December ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce7d3343c98a832fd2dce4f34e8fd69fd20ec8ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D05BD4D-30D8-4A74-BEE1-A5F557E62BE3"},"incident_date":"2015-12-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9eb0edad0e8","org_name":"Tri-City Medical Center,","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/san-diego-medical-center-did-not-report-a-data-breach-to-state/"}],"summary":"A clerical employee was terminated for allegedly accessing part of a patient record that she should not have had access to. She was told to look at the record for admitting or billing purposes, but the company said she looked at other parts she should not have. She claims they fi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-28","discovered_date":"2015-10-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0deab8df43cac272d265d5161a1a0c83782e36b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WH.Adult_.Final_.12.28.15_0.pdf"},"notes":null,"org_country":"US","org_id":"c7e9948a19ad","org_name":"Washington Township Health Care District","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WH.Adult_.Final_.12.28.15_0.pdf"}],"summary":"Washington Township Health Care District reported that an unauthorized individual may have accessed a computer containing a database with names, addresses, and driver’s license numbers, although access to the database file itself was not confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d74cfb65ac38ad5825e27756131415960a2f9c1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1E9B550-021B-4E09-84DA-390FFC5F10EA"},"incident_date":"2015-12-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04bf25d08f2f","org_name":"UC Berkley","org_type":"education","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/university-of-california-berkeley-alerting-80000-to-december-hack-involving-ssn-or-bank-account-info/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/UCB-2016-02-26-CA-SampleNotice-SSN-Bank-AG_0.pdf?"}],"summary":"criminal cyberattack on a system storing their Social Security or bank account numbers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"883b9d4b06d1c579d58ec14c5f323f1263968752","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F2667EE-F637-4267-B426-1D079F6D5797"},"incident_date":"2015-12-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"868e339a4142","org_name":"Morgan Stanley","org_type":"financial","ransomware":null,"records_affected":350000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/id/102292464#;http://money.cnn.com/2015/01/05/technology/security/morgan-stanley-data-breach/index.html;http://www.bloomberg.com/news/print/2015-01-05/morgan-stanley-fires-employee-accused-of-stealing-client-data.html;http://www.marketwatch.com/story/morgan-stanley-shares-down-3-after-employee-theft-of-client-data-2015-01-05"}],"summary":"Morgan Stanley said Monday that it terminated an employee for stealing wealth management data from up to 10 percent of its clients, or about 350,000 people.  The bank said there is thus far \"no evidence of any economic loss\" for its clients. Still, data for about 900 clients_incl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2015-12-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e4c5ffe52c671656b9de992298eea61570245e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DD11501-E1B2-467E-BA26-DBBBBA0769D9"},"incident_date":"2015-12-26","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53dd66944572","org_name":"Neiman Marcus Group","org_type":"other","ransomware":null,"records_affected":5200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/luxury-retailer-neiman-marcus-says-hackers-breached-user-accounts-499780.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/attacker-accesses-5200-neiman-marcus-group-customer-accounts/article/470237/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59847"}],"summary":"a series of automated login attempts that were trying to guess valid username & password combos  Read more: http://news.softpedia.com/news/luxury-retailer-neiman-marcus-says-hackers-breached-user-accounts-499780.shtml#ixzz4MPDe1Nps ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-12-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"199b15f0455171da1ea57fb93e9bcb45060cfa41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2101B3BF-E819-4E96-8D48-E2C0AA185F6C"},"incident_date":"2015-12-25","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/verizon-devs-leave-api-password-inside-website-source-code-498309.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/verizon-devs-leave-api-password-inside-website-source-code-498309.shtml"}],"summary":"Verizon Hum website and discovered that the source code of the \"shopping\" page included a username and the password \"Weblogic12.\" ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"169fdcb681d6409f2cca3951d5b486e6b7400511","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B81E60C1-5020-4DEA-9CF4-BABF44C3D1DF"},"incident_date":"2015-12-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec2d71ec2a59","org_name":"Valve Corporation","org_type":"technology_saas","ransomware":null,"records_affected":34000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/steam-users-hit-by-christmas-day-breach-finally-notified/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.inquisitr.com/2660279/steam-store-returns-to-full-operation-with-no-glitches-in-sight-blames-valve-cache-update-for-christmas-shutdown/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/12/25/steam_snafu/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theinquirer.net/inquirer/news/2440432/steam-says-a-config-error-and-dos-attack-caused-sensitive-data-leak;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/in-the-spirit-of-christmas-giving-steam-gives-your-account-details-to-others/;"}],"summary":"database cache issue on Christmas Day caused by a DoS attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a95da7c3a864ce750ea03da40075d12a3ad24193","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4A155A1-D70B-4BAF-B872-173D44922467"},"incident_date":"2015-12-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a41524dc49eb","org_name":"Kwik Check Convenience Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mrt.com/news/public_safety/article_8a148fe0-cf8a-11e5-ad83-2fb84af96c05.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.everythinglubbock.com/news/state-regional/midland-police-warns-community-of-new-fuel-pump-skimmer-found-at-local-gas-station"}],"summary":"Bluetooth gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7417b2f5288307522c010a7dea48a3e0b0afb4e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2CFF8F0-7478-497A-B0FE-07D97E8BBA9E"},"incident_date":"2015-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9d4410e2a1c","org_name":"Rutgers University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/rutgers-university-suffers-sixth-ddos-attack-this-year-498229.shtml"}],"summary":"Rutgers U suffers a DDoS attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e4a732a520c5ee1e3fec6306ef9c8261ad6a3bd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E2D074B-B7DF-4D02-94DB-69599F1AE42C"},"incident_date":"2015-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"314ea2ef408b","org_name":"Electronic Arts Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/phantom-squad-starts-christmas-ddos-attacks-by-taking-down-ea-servers-498078.shtml"}],"summary":"DDoS against gaming servers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5f2925d4eb9679162b517e4d05e38d0c5f5791a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13C4CEA0-91A3-44AF-A842-2695FF89CD51"},"incident_date":"2015-12-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef3729a7a1bd","org_name":"Circle K Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reporter-times.com/free_access/credit-card-skimmer-discovered-on-martinsville-gas-pump/article_02335481-5039-5f3d-9e37-f0d126ebd9c9.html"}],"summary":"credit card skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"762026bccbf777cf0a5c2c63114b37b813b652c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"848CDD4F-C65B-4FB9-942B-7AD57E01BC6C"},"incident_date":"2015-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f55dd3ef5f8","org_name":"BeautifulPeople.com","org_type":"other","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/beautiful-people-data-dump-exposes-users-elite-dating/story?id=38674598;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsweek.com/11-million-dating-profiles-beautifulpeoplecom-leaked-and-sale-dark-web-452362"}],"summary":"hacked mongoDB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2015-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"88372323d716ef44a054a2e2efe918faf04437de","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9602.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8a32af0b3d8b","org_name":"Matson Navigation Company, Inc. and Horizon Lines","org_type":"unknown","ransomware":null,"records_affected":2185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9602.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","medical"],"disclosed_date":"2015-12-23","discovered_date":"2015-12-07","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a7b34b3046048aa41d116477b9c68ac5b208957","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20151222_matson501_2_0.pdf"},"notes":null,"org_country":"US","org_id":"559524af542b","org_name":"Matson Navigation Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59399"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ACID_PRINTERPROOFS_20151222_matson501_2_0.pdf"}],"summary":"Matson Navigation Company notified mariners that a missing device may have contained their personal information.","supporting_quote":"a device containing information regarding mariners who have served aboard vessels operated by Horizon Lines has been identified as missing.","technology_involved":["electronic device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88a3e5360eda6cdefbf5bad321d9a9575ff150e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"208CA34D-561F-4B5F-8080-0179A274AF2F"},"incident_date":"2015-12-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83e43a21662b","org_name":"Catoosa County","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ga-911-dispatcher-fired-for-sharing-callers-personal-information-on-facebook/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wrcbtv.com/story/31208630/first-on-3-911-dispatcher-fired-for-sharing-callers-personal-information-on-facebook"}],"summary":"911 dispatcher posted a screenshot of call details incl. PII and medical emergency details to Facebook group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef5fbbe88f4c4c920ad14ca409b6241c8c1ec656","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"248BE843-1169-402F-9C32-698BFAB6CACD"},"incident_date":"2015-12-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1921b3129f8","org_name":"Annapolis Parking Garages","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalgazette.com/news/annapolis/ph-ac-cn-data-breach-parking-0622-20160621-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalgazette.com/news/annapolis/ph-ac-cn-annapolis-data-breach-0623-20160622-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/data-breach-at-annapolis-parking-garages-possible-city/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalgazette.com/news/annapolis/ph-ac-cn-data-breach-update-0625-20160624-story.html"}],"summary":"malware on vendors system for parking garages","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"116796969fd2661fb8aa8ca5ccf6c056ac4295ef","impact_type":"unknown","incident_date":"2015-08-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ATS%20Sample%20Letter%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1e2a3785b5f0","org_name":"Acclaim Technical Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59396"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-12-22","discovered_date":"2015-11-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"014f1a2fd8412bd9f59799b8c0e988814427c479","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20letter_US_final_0.pdf"},"notes":null,"org_country":"US","org_id":"e99fbcc0b6d3","org_name":"VTech Electronics North America, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59366"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20letter_US_final_0.pdf"}],"summary":"An unauthorized party accessed customer data in VTech’s Learning Lodge app store database; the letter does not state how access occurred.","supporting_quote":null,"technology_involved":["Learning Lodge app store customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-12-22","discovered_date":"2015-11-20","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"038bab3177b75744270d0583c19f669b4773d8ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%201-1_0.pdf"},"notes":null,"org_country":"US","org_id":"b673633555f9","org_name":"Dungarees, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59371"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%201-1_0.pdf"}],"summary":"Dungarees reported that hackers manipulated its website, potentially affecting customer personal and payment card information associated with orders.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b148e1023caf43a048f3fb040dc17dac20474549","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28A09F22-BE65-4265-B52D-7F4609DC4C56"},"incident_date":"2015-12-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b126786d7401","org_name":"Design Spike, Inc","org_type":"professional_services","ransomware":null,"records_affected":258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wa-behavior-intervention-specialists-client-records-exposed-in-misconfigured-database/"}],"summary":"Database exposed PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85279b4693749971313a80da38544fae6db2cfc4","impact_type":"data_theft","imported_from":null,"incident_date":"2011-10-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"ccf09e21b2b0","org_name":"Android Forums","org_type":"other","ransomware":null,"records_affected":745355,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Android Forums","type":"hibp","url":"https://haveibeenpwned.com/Breach/AndroidForums"}],"summary":"Android Forums was hacked in October 2011, and 745,355 user accounts were leaked publicly, including email addresses, birth dates, and salted MD5 password hashes.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-12-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1256243adb5e34e91ad4e9c3f897b386e8f22e0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66C4F97C-4661-4AA3-A4D7-D72A0E2BC03E"},"incident_date":"2015-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"dc57f19e1a93","org_name":"Sanrio Digital","org_type":"retail_ecommerce","ransomware":null,"records_affected":3300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/data-breach-on-hello-kitty-servers-over-3-3-million-accounts-exposed-497872.shtml;http://www.continuityinsights.com/news/2016/01/hello-kitty-owner-sanrio-says-fan-site-security-leak-fixed;http://www.csoonline.com/article/3017171/security/database-leak-exposes-3-3-million-hello-kitty-fans.html;http://sanriodigital.com/story/security-advisory"}],"summary":"Sanrio Digital notifies that personal information belonging to members of the consumer website SanrioTown.com was publicly accessible owing to a security vulnerability. The vulnerability has been corrected and investigations are underway. To our knowledge at this time, no persona","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-18","discovered_date":"2015-11-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67e0d8a8a6a66ec32a32219b2e42c7077ce3f694","impact_type":"unknown","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CBC_-_Sample_Notification_Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"b5d87cbc5962","org_name":"CBC Restaurant Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59339"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CBC_-_Sample_Notification_Letter_0.PDF"}],"summary":"CBC Restaurant Corporation reported an unconfirmed allegation that a former employee possessed a file containing employee personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"438ff0b9602af71f711475213b4efee612d4d8fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Vendor%20Partner%20Email%20Incident%20-%20Toyota%20States%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"c74cca973504","org_name":"Toyota Motor Credit Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unencrypted email containing customer information was sent to an authorized vendor partner.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59287"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Vendor%20Partner%20Email%20Incident%20-%20Toyota%20States%20AG_0.pdf"}],"summary":"Toyota Motor Credit Corporation sent an unencrypted email containing customer information to an authorized vendor partner, which confirmed the email was deleted.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0a49c0a30d0099e27715b2348d8575a36dee85f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91A96A06-599D-4F10-8A43-909D1EC7D0F0"},"incident_date":"2015-12-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83294c3dba85","org_name":"City of Boston","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/short-ddos-attack-puts-boston-authorities-on-alert-497793.shtml"}],"summary":"DDoS against Boston city servers (City Hall, Fire Dept)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-14","discovered_date":"2015-11-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2f22b3db4cb64ca9d0f11500ab9efcdedc6e98f","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sorrento%20Pacific%20Financial%20LLC%20Notice%20Letter%20Templates_0.pdf"},"notes":null,"org_country":"US","org_id":"cddb624371b1","org_name":"Sorrento Pacific Financial, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former investment representative may have stolen a beneficiary's personal information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59275"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sorrento%20Pacific%20Financial%20LLC%20Notice%20Letter%20Templates_0.pdf"}],"summary":"Sorrento Pacific Financial reported that a former investment representative may have stolen a beneficiary child's personal information.","supporting_quote":"we learned that your child’s personal information may have been stolen from a former Sorrento Pacific Financial, LLC investment representative.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-12-14","discovered_date":"2015-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"617b159ff227486ef45582e30e5b0bd2b9a31c11","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-15","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9600.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"e4b50bb6ea41","org_name":"PeaceHealth","org_type":"healthcare","ransomware":null,"records_affected":1405,"reviewed":false,"root_cause":"A former employee retained access to patient information through third-party websites after leaving PeaceHealth.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9600.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9600.pdf"}],"summary":"A former PeaceHealth employee accessed patient information through third-party websites after leaving the organization.","supporting_quote":"On October 9, 2015, we first learned that an employee who no longer works at PeaceHealth accessed patient information from a home computer using third-party websites, including insurance verification websites and prior authorization portals from June 15, 2015 to October 12, 2015.","technology_involved":["insurance verification websites","prior authorization portals"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71aefab9baec070f538f9d00eb11c2f626282bae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"927A02AA-0F6F-4CC9-8DAF-D38D2414A104"},"incident_date":"2015-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"81ec64659e26","org_name":"NIC.tr","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-takes-credit-for-ddos-attacks-on-turkey-s-dns-servers-accuses-turkey-of-aiding-isis-497863.shtml"}],"summary":"Anonymous DDoS'ed Turkish DNS servers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efbede1a807332f190fef56c0b01aa192bd678d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DFBAD24-12AD-4256-85FC-D8EC2D8C71FB"},"incident_date":"2015-12-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f7203edc2d97","org_name":"Moonfruit","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-35091534"}],"summary":"Threat of attack caused hosting company to go offline for 12 hours to make changes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da437a10a6beb114a3a7e51103075f2a484d626f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4218EC1F-B6E4-409D-AF83-5EADEFD8536D"},"incident_date":"2015-12-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"458843621ca5","org_name":"Bargain Booze","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/6827"}],"summary":"Skimming device found in Middlesbrough cash machine","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4795ee59c144e76ac2063a89b0d773a92235c5f2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E23188F4-998D-4BEE-8E26-4A36F636240F"},"incident_date":"2015-12-13","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9146906c5613","org_name":"Rivers Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/pa-rivers-casino-hit-with-computer-virus/;http://pittsburgh.cbslocal.com/2015/12/15/rivers-casino-hit-with-computer-virus-personal-info-not-compromised/"}],"summary":"Rivers Casino Hit With Computer Virus","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"778982916278c716b13a4abbea320c338beab592","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6B959A8-3757-4ADB-A820-1ED67D494528"},"incident_date":"2015-12-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3d60dd45945","org_name":"Sun Trust Bank","org_type":"financial","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-journalonline.com/article/20151230/NEWS/151239971/101040?Title=Police-Man-with-skimmer-device-stole-at-least-100-customers-information"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70a861d03b80b61e0ae7fc0c6b1ab0943f8629ac","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C8BA12E-DEFB-44D4-90F2-78270D495A08"},"incident_date":"2015-12-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82c832bfd135","org_name":"Northwest Community Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ktvl.com/news/local/skimming-device-found-in-medford"}],"summary":"Skimmer device discovered on ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8019ac32b1897fa69cea2b9312cea0f70622aa5a","impact_type":"data_theft","incident_date":"2015-11-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TuneCore_Customer_Letter_Template_SSN_0.pdf"},"notes":null,"org_country":"US","org_id":"636b3073c0a0","org_name":"TuneCore","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59260"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TuneCore_Customer_Letter_Template_SSN_0.pdf"}],"summary":"TuneCore reported that an intruder exported personal, account, and financial information from three servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffc1322e116a12b46b0ee4ea488df92c897f1d1d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1264DC7-EF3A-4C9F-BDE7-575149E21345"},"incident_date":"2015-12-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d92ac5994a36","org_name":"North Atlanta Motors","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forsythnews.com/section/6/article/28980/"}],"summary":"suspicious paperwork in an open-air Dumpster ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SE","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94040dbbb8e3a8e4476c9aabcd09a73376bf007d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"113C8BA8-EB38-4B95-B03C-EC98B95F07C7"},"incident_date":"2015-12-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82f814a449a5","org_name":"Disqus","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com/article/744481/Disqus_Scrambles_After_Leak_Fuels_Swedish_Tabloid_Expos_195_169_?taxonomyId=3234;http://arstechnica.com/security/2013/12/crypto-weakness-in-web-comment-system-exposes-hate-mongering-politicians/;http://www.infosecurity-magazine.com/view/36125/disqus-may-not-have-been-hacked-but-it-was-certainly-exploited/"}],"summary":"Disqus is updating its widely-used comments platform after a Swedish tabloid exposed politicians and other public figures for allegedly making highly offensive comments on right-wing websites.  The Swedish daily Expressen, working with an investigative journalism group, said it u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76571b9bb522c83c3d9fb017a64610cebc2e8a4c","impact_type":"unknown","incident_date":"2015-08-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice_4.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3f5989c685c5","org_name":"CM Ebar LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59245"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"507dbc8a44bbe54682e18f247bd34d40d890b74c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9C68B33-01E6-445F-97EC-E1778489AE61"},"incident_date":"2015-12-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78396ade3a60","org_name":"Borgess Rheumatology","org_type":"healthcare","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/borgess-rheumatology-informs-700-patients-of-mailing-error-8301/"}],"summary":"Misdelivery of medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f9b7435ff7c0ec6c6e1ab4c99c1629a290ba8cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"019490BF-0B7D-4AE6-A76F-9CBFC552C035"},"incident_date":"2015-12-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7555429ef602","org_name":"Town of LaSalle","org_type":"government","ransomware":null,"records_affected":140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/windsor/lasalle-privacy-breach-1.3372304?cmp=rss"}],"summary":"Town of LaSalle exposed PII of residents with poorly constructed web site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"298637f0cf4d0ca5f6167c1ac5805f24e71c87e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A67CD94-13D4-4BB9-A4C7-A54B47DD08D9"},"incident_date":"2015-12-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63d9b861ff9e","org_name":"Physicians Health Plan of Northern Indiana","org_type":"financial","ransomware":null,"records_affected":1708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/physicians-health-plan-of-northern-indiana-notifies-indigo-members-whose-billing-statements-were-erroneously-sent-to-others/"}],"summary":"Physicians Health Plan of Northern Indiana notifies Indigo members whose billing statements were erroneously sent to others.  An error occurred in the assembly of a premium billing statement mailing on December 8, 2015, which resulted in a portion of the recipients receiving mult","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-08","discovered_date":"2015-09-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc07bf2ac4f7d41a82b38656ca351e2e845d20ec","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-09-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Breach%20Form%20Letters%20-%20GHC_0.pdf"},"notes":null,"org_country":"US","org_id":"af7f2f4599f9","org_name":"George Hills Company, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A website application configuration allowed a security researcher to access a temporary backup of claims databases.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Breach%20Form%20Letters%20-%20GHC_0.pdf"}],"summary":"A configuration in Systema Software’s claims-management website application allowed a security researcher to access a temporary backup of George Hills Company claims databases.","supporting_quote":"Systema Software notified GHC on September 9, 2015, that a security researcher contacted Systema Software because he had identified a configuration in the website application that allowed him to gain access to a temporary data backup of claims databases.","technology_involved":["Systema Software","website application","claims databases"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Systema Software"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"fab1d4056514","name":"Systema Software"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6501f54cdef60bf4cbab608625838d31063726e3","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Muji%20USA%20notice%20only_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3e84337ce72a","org_name":"MUJI U.S.A. LIMITED","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59200"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d403d1170bbda04496f880db5d4e17ecf287049a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22361A4F-5AB7-4C92-A0AC-FB740515A416"},"incident_date":"2015-12-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ab3ac00f296","org_name":"Oregon Health & Science University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/stolen-oregon-health-science-university-hard-drive-contained-babies-protected-health-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/ohsu-hard-drive-stolen-phi-of-neonatal-patients-exposed-8310/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/babies-have-data-too-and-it-can-be-compromised-ohsu-neonatal-icu-announces-breach.html"}],"summary":"Oregon Health & Science University (OHSU) has reported the theft of a computer hard drive containing the protected health information of neonatal intensive care unit patients. The hard drive was stolen from the vehicle of a research student on December 6, 2015.  Contact informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c999b265121d3147f133894de2015d3973610fd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5479BAE-17C5-40CC-B29B-4CA3EF5B6EBD"},"incident_date":"2015-12-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83fabee9e40a","org_name":"Quincy Credit Union","org_type":"financial","ransomware":null,"records_affected":670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bostonglobe.com/metro/2015/12/27/hundreds-quincy-credit-union-accounts-compromised/3xCbyNhoiKCGDbh8Jw4Z0J/story.html"}],"summary":"ATM Skimming ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07b94aeb02d7830a27b1c5ac211bfb88f5bb8cfb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CA132C5-CA27-4D20-ACD9-F8EAFE1E3067"},"incident_date":"2015-12-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2067250b96a","org_name":"Hellgate High School","org_type":"education","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mt-hellgate-high-data-breach-reveals-confidential-student-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hellgate-high-data-breach-included-records-of-former-deceased-students/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://newstalkkgvo.com/hellgate-high-data-breach-reveals-confidential-student-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmontana.com/news/mcps-holds-press-conference-for-data-breach/36860132;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krtv.com/story/30700099/missoula-schools-data-breach-included-info-on-family-abuse-developmental-disabilities-disciplinary-actions;"}],"summary":"Employee accidentally included attachment to email with sensitive information about current/former/deceased students and one teacher.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a63a04ffcba2ae04501069237ace50502c886269","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PDF%20Attorney%20Gen_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0de46a6e8632","org_name":"Holly A Nordhues CPA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59137"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a0c13cecd468eea82c353eca9ac13590cb01531","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A1A5DE1-7456-4042-9506-918E66C24A6E"},"incident_date":"2015-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"f09a20e3337e","org_name":"Yellow New Zealand","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11563168"}],"summary":"private numbers in phone book","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ba5baffd4a26e67261ce5a92c65a325443525d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E77392D-6A16-4EC1-848F-98F1BCEAB667"},"incident_date":"2015-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a02ba4e877e9","org_name":"Vixlet","org_type":"technology_saas","ransomware":null,"records_affected":377000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/despite-warnings-earlier-this-year-tens-of-thousands-of-databases-continue-to-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fan-networks-including-mlb-leaked-fans-personal-details-researcher/"}],"summary":"Vixlet leak affecting more than 377,000 MLB, ATP and Slipknot fans","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e18a4c8410672ac6cac7c27c272a7aad9e194a69","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5EE459B7-B545-4FAF-8396-EFA5A43C186D"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"73f24bb7691d","org_name":"Vail Valley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3118,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/vail-valley-medical-center-notifies-3118-patients-unauthorized-phi-disclosure-3406/"}],"summary":"Vail Valley Medical Center (VVMC) is in the process of notifying 3,118 patients of the inappropriate disclosure of some of their protected health information (PHI).  A physical therapist formerly employed at Howard Head Sports Medicine was discovered to have copied the PHI of pat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b3b10fda8fa1384382275d6da7dfd09d5959b05","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88409FC9-A75B-4F77-959F-04CDB4EE179B"},"incident_date":"2015-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ff8d5e17f57","org_name":"Tonitown","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ar-tontitown-website-hacked-computers-filled-with-viruses/"}],"summary":"city computer system attacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efbacd5213eb75131eb48d3ebd1c56c45c3a515a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73F27C43-05E0-402A-8E8A-2D0C69F5A956"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee4b161b5443","org_name":"The Cheesecake Factory","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-the-cheesecake-company-personnel-files-found-in-disposal-bin/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://calgaryherald.com/news/local-news/restaurant-personnel-files-thrown-in-dumpster-passerby-retrieves-them-in-fear-of-identity-theft"}],"summary":"documents found in dumpster","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16eba4eff76de8a05519ad83f38605ddbf99ca67","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0ACE621-B0E8-4D4F-B76B-ACE2FF5505F1"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f57c97b8f6c","org_name":"Tapco Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/news/local/crime/article94019792.html"}],"summary":"identity theft by bank teller","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40310cec4b810b143f32694a0283cf7ec4adc3bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DE11EF4-61C7-4193-8E12-856252C6ADC6"},"incident_date":"2015-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11f84b74c58a","org_name":"St. Vincent health system","org_type":"healthcare","ransomware":null,"records_affected":760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/health-system-sees-7th-hipaa-data-breach"}],"summary":"How many breaches, how many compromises of patients' confidential medical information does it take before there are some questions asked of an organization and its security policies? One health system, for instance, recently announced its seventh large HIPAA breach.   The 20-hosp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2317ece59b6f07c9bbc22f8a518ee3fddb5d2c1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8232E6D9-2571-4DCB-94F3-A8CE1D91E51E"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"89a1796db9f2","org_name":"SaskPower","org_type":"energy_utilities","ransomware":null,"records_affected":5537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://leaderpost.com/news/saskatchewan/saskpower-employee-snooped-on-personal-data-for-thousands-of-past-and-present-staff"}],"summary":"Employee snooping","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b744cb9040bec10081bd021bc2a87e1b70b5a35b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E839C791-A436-42D0-8A4C-CE781F2F2025"},"incident_date":"2015-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b5f01575425","org_name":"Radiology Regional Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winknews.com/2015/12/21/medical-records-found-on-fowler-street/"}],"summary":"County disposal service didn't lock up paper documents en route for disposal instead they flew out of the back of the truck","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2edb538048111d61d100241972fa6e741bf9b456","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF2FFB2E-6AB8-4418-BC1A-694848C85912"},"incident_date":"2015-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06119c37888d","org_name":"PST Services","org_type":"professional_services","ransomware":null,"records_affected":10104,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/employee-error-exposes-over-10000-patients-personal-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mckesson-subsidiary-exposed-over-10000-patients-information-via-google-search-data-exposed-for-more-than-4-months/"}],"summary":"The personal information of more than 10,000 patients was recently exposed online due to an error by medical billing services provider PST Services, a subsidiary of McKesson.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19dc5d700e3b3c568ada9bdbf69bf37b9e3190b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9500d060-6be9-11e7-97f1-7f40b0b1fd66"},"incident_date":"2015-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d856f829b67c","org_name":"Orchard Turn Developments","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.marketing-interactive.com/ion-embroiled-hacking-incident/"}],"summary":"Shopping mall ION Orchard (ION) has been mired in a recent hacking incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc2bb43d356b46e9f0ea1e05ec0170ab7433fb4f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"371E7E46-A9D9-4447-8153-BC26FCA4CDA6"},"incident_date":"2015-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8adefc71d7b5","org_name":"New West Health Services","org_type":"healthcare","ransomware":null,"records_affected":28209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.newwestmedicare.com/securityupdate;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mtpr.org/post/data-breach-affects-25000-new-west-health-services-customers;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvq.com/story/30987985/health-service-company-warns-of-data-breach"}],"summary":"New West Health Services d/b/a New West Medicare has unfortunately learned of an incident involving a company laptop computer that was stolen from an off-site location. The computer contained electronic files with personal information from past and present New West customers. The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12eb97b3e611a5310b642b07f97a974d22ec0777","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0F3C8E8-AF91-44BA-B2A7-38C5A6C0C0D4"},"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1439159665da","org_name":"Maidstone Borough Council","org_type":"government","ransomware":null,"records_affected":870,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-maidstone-borough-council-refers-parking-permit-data-breach-to-information-commissioners-office/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/maidstone/news/council-admits-parking-permit-data-47991/"}],"summary":"error reported when a new car parking permit application site went live on their website earlier this month","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"614a1486122ed50064b14ca03dd7dee8c1006184","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BE4C9E1-9B50-4A65-8039-F5CBBA5ED58E"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27344d8c5606","org_name":"Lenox Hill Hospital","org_type":"healthcare","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-husband-wife-steal-info-from-lenox-hill-hospital-emergency-room-patients-spend-hundreds-of-thousands-of-dollars-at-saks-prosecutors/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox5ny.com/news/56792014-story;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/news/local/Husband-Wife-Thieves-Prey-Hospital-Patients-Lenox-Hill-Steal-Account-Saks-Fifth-Avenue-Luxury-Arrest-361301351.html"}],"summary":"A husband-and-wife pair have been arrested for allegedly stealing the personal information of dozens of Manhattan hospital patients to take control of their bank accounts and buy hundreds of thousands of dollars worth of merchandise at luxury retailers like Saks Fifth Avenue, aut","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18bacddc98ec96c2332fa2414e6ecb117a780aa4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED790568-51B0-48F0-8473-FE71E2528E1F"},"incident_date":"2015-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1756d70cfe95","org_name":"Keenan & Associates","org_type":"financial","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/californian-health-plan-administrator-35k-record-data-breach-8201/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59125"}],"summary":"Californian health plan administrator, Keenan & Associates, has announced a breach of Protected Health Information that has impacted 35,000 health plan subscribers.  An error was made by a vendor with the configuration of a web portal. The server security settings had been miscon","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f209df7e584f45f90b58a406b91f9b213429f267","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2AEC4E6-25FC-49FC-B955-95FA441AEAAB"},"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"065b140c4e68","org_name":"JD Wetherspoon","org_type":"other","ransomware":null,"records_affected":650100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-jd-wetherspoons-discloses-breach-impacting-656723-customers/;http://www.independent.co.uk/life-style/gadgets-and-tech/news/wetherspoon-s-hack-pub-chain-s-website-hit-by-huge-cyber-attack-personal-information-and-credit-card-a6760121.html;http://www.cisltd.com/news/2015/december/jd-wethersoon-hacked"}],"summary":"British pub chain JD Wetherspoon (JDW.L) has been hit by a cyber attack which leaked the names, email addresses and birthdates of 650,000 customers as well as some of the credit and debit card details for 100 buyers of its gift vouchers, it said on Friday. Wetherspoon, which oper","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ebb41a37575fe94ebe11460e9296d91a83dd5d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE616C41-3DA5-4640-BD0E-BEA0796381A1"},"incident_date":"2015-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dff9a0ad6821","org_name":"Hyatt Hotels Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/12/malware-driven-card-breach-at-hyatt-hotels/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://newsroom.hyatt.com/news-releases?item=123450"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59630"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9605.pdf"}],"summary":"Hyatt Hotels Corporation (NYSE: H) today announced that it recently identified malware on computers that operate the payment processing systems for Hyatt-managed locations. As soon as Hyatt discovered the activity, the company launched an investigation and engaged leading third-p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e47346be110acddfe327be93880945907164f137","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98ED15ED-563E-42A2-8CE4-6746C0E5C7FE"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d8582cdf2da4","org_name":"Health Sciences North","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesudburystar.com/2016/01/21/privacy-breached-sudbury-patient-alleges"}],"summary":"Patient's medical record was viewed by acquaintance with whom he had an ongoing disagreement. Patient knew the threat actor worked at the hospital and made it known to the privacy officer that they needed to look out for the misuse of access. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19374e4a1c90edd940c9f40f379b52b48ee07d9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC6D7F48-DF4F-4673-AAF9-98995207589B"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70f720ca92d1","org_name":"Green Gourmet Deli","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/new-york/nyc-crime/cops-hunt-2-atm-skimming-gangs-stolen-16-6g-article-1.2501304;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.metro.us/new-york/photos-police-seek-two-separate-atm-skimming-duos/zsJpas---rHuaD73W5lrg/"}],"summary":"ATM Skimmer ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2946a8312ea84ac6c0bbb5e2e4ff619af9e6a21b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C722891F-B0C1-46C2-A8B6-EC9413B4E443"},"incident_date":"2015-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67a43bffa1dd","org_name":"FHN Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/il-fhn-memorial-hospital-reveals-hard-drive-with-patient-info-was-stolen-in-december/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalstandard.com/news/20160226/fhn-patient-information-compromised-in-hard-drive-theft"}],"summary":"A computer hard drive containing patient information was stolen from FHN Memorial Hospital in December. The hard drive did not contain medical records, but did have internal reports and spreadsheets with patient data, according to a FHN news release. The files may have included a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95ba500ecece75f5cf3b5abd766ac49263051b96","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6E316FD-3391-4D4B-BCE6-07FD8B1119D1"},"incident_date":"2015-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RS","org_id":"a91fa5215d74","org_name":"Dr Laza Lazarevic","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/disclosure-of-patients-mental-health-status-and-treatment-results-in-strong-response-by-serbias-commissioner-of-information-of-public-importance-and-personal-data-protection/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bdklegal.com/blogs/data-protection-and-privacy/health-data/803-serbia-mental-health-data-leakage"}],"summary":"In December 2015, a journalist disclosed one patient's health data in a TV show. The data were related to the patient's mental health and his treatment in the mental health clinic \"Dr Laza Lazarevic\", in Belgrade. The Serbian Commissioner for Information of Public Importance and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29422da62196b1796aa0b7e8774598a07cbdb627","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"484959FB-9E89-41EB-86D5-D6238DC6698B"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dd95f4b59d5","org_name":"Department of Human Services","org_type":"government","ransomware":null,"records_affected":425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/iowa-dept-of-human-services-mistakenly-shared-personal-info-on-nursing-home-residents/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/nursing-home-residents-phi-disclosed-iowa-dhs-3345/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/medicare-claims-data-sent-to-the-wrong-health-records-441292"}],"summary":"Protected health information of 425 nursing home patients has been accidentally mailed to 12 nursing home facilities by the Iowa Department of Human Services.  The HIPAA breach occurred in December 2015, although it was not discovered by Iowa DHS until January 22, 2016. Last mont","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"690c74ab70fbb0a04182457ff740c53226eec29b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DF252C7-A7F8-435F-9CBE-9EA5007A1848"},"incident_date":"2015-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"017d2a9aac80","org_name":"Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":4200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ketv.com/news/stolen-laptop-contained-patient-records-hospital-say/37940348"}],"summary":"Community Hospital in McCook has told nearly 4,200 former patients that their identity information was contained on a laptop computer that was stolen in December.  Hospital officials say the laptop belonged to an employee of the hospital's auditing company, Seim Johnson, of Omaha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08aa98fd39ffb86f3109b3252eed0ce13b5e102d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D95EE935-950B-4732-A5CD-C1F7327F3D4C"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"713ad79fe9ad","org_name":"Comfort Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/new-mexican-dental-patients-records-found-dumped-along-west-mesa/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krqe.com/2015/12/18/new-mexicans-medical-records-dumped-along-west-mesa/"}],"summary":"New Mexican dental patients' records found dumped along West Mesa - Cottonwood Comfort Dental.  An Albuquerque man said he found hundreds of medical records dumped on the West Mesa. The medical records include people's addresses, insurance information and social security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10c601fb1eabbb39399f2b3908c757c7edde4eb5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D99040B0-9B7B-4491-A751-BD6EA2EEBB52"},"incident_date":"2015-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0377dd8a3c5c","org_name":"California Virtual Academies","org_type":"education","ransomware":null,"records_affected":58694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/personal-and-sensitive-data-of-59000-charter-school-students-in-california-leaked-researcher/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/cava-offers-employees-credit-monitoring-in-wake-of-misconfigured-database/"}],"summary":"Back in December, this site broke the story of a misconfigured database affecting students and faculty at California Virtual Academies.  The leaky database had been uncovered by independent researcher Chris Vickery, who estimated the number affected at 59,500.  CAVA would subsequ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6bfbb8d3708d4586309d111ede4e6aa54689ec7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83477C77-2183-41E6-AB5D-DA11E3DF0C6E"},"incident_date":"2015-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bac3f597933b","org_name":"BJC HealthCare Accountable Care Organization","org_type":"healthcare","ransomware":null,"records_affected":2393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/bjc-healthcare-accountable-care-organization-notifies-patients-of-unencrypted-email/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/stolen-laptop-leads-to-possible-healthcare-data-breach-in-ks;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bjcaco.org/About-Us/BJC-HealthCare-Accountable-Care-Organization-Notifies-Patients-of-Unencrypted-Email"}],"summary":"BJC HealthCare Accountable Care Organization (BJC ACO) has notified 2,393 patients that identifying information was sent to a participating medical practice through an unencrypted email. All affected patients have been offered identity theft protection free of charge.   BJC ACO d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e5f58311bdd34b15cd73eef7831c75280b3f78f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74C74A51-D98A-4C74-ADCD-45B6A59D78AB"},"incident_date":"2015-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"1b2cbe94b2e7","org_name":"Antoni van Leeuwenhoek hospital","org_type":"healthcare","ransomware":null,"records_affected":781,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nl-records-of-781-cancer-patients-stolen-from-hospital-car-park/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dutchnews.nl/news/archives/2016/03/patient-records-for-781-cancer-patients-stolen-from-hospital-car-park/"}],"summary":"A hard drive containing the medical records of 781 cancer patients has been stolen from a researcher at Amsterdam's Antoni van Leeuwenhoek hospital. The drive, which was not secured with a password, was taken from the boot of a hospital worker's car in December. The specialist ca","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac38a1efcc9e99b2d3ccfc6eb7821fa5d14a29ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46955F9E-E971-43C2-8B88-93923F781572"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bc05caca742","org_name":"Alpine Vending","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://denver.cbslocal.com/2015/12/23/vail-police-warn-about-skimmer-found-on-atm-inside-transportation-center/"}],"summary":"VAIL, Colo. (CBS4)__ Police in Vail have issued a warning to consumers after a credit card skimmer was found on an ATM inside the Vail Transportation Center.  The skimmer was found in the transportation center located at 241 S. Frontage Road in Vail. The device was attached direc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b346af41c05c9e0f05cdee9c56d95d02bc603970","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2D58155-C990-48A2-A8A3-BB6F125D3ED4"},"incident_date":"2015-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"caa0601f1b9f","org_name":"AllMed","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtvm.com/story/30804533/exposed-medical-records-found-in-dumpster-in-east-montgomery"}],"summary":"Medical records were found Monday in an open air dumpster behind a former medical clinic called AllMed on Eastchase Parkway near Minnie Brown Road in east Montgomery.  The records included prescriptions, lab results, names of patients and their birthdays -- all considered Private","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"062fff81ead9701116eb1d37aa1b8b2a8f099717","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"310718DD-65D1-4E00-B23D-78364F4972D2"},"incident_date":"2015-12-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wavy.com/2015/12/29/police-warn-of-skimming-devices-found-in-7-eleven-atms/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pilotonline.com/news/local/crime/police-warn-customers-after-skimming-devices-found-on-several-store/article_f3f0dc4d-e6f0-5305-9b39-7f3043d04d82.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mycentraljersey.com/story/news/crime/jersey-mayhem/2016/01/04/police-blotter-atm-skimming-device-found/78265004/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1f7fec19449994f0876b141d1405a600d70d229","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2010-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ee59ef00a37e","org_name":"Neteller","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Neteller","type":"hibp","url":"https://haveibeenpwned.com/Breach/Neteller"}],"summary":"A 2010 data breach at Neteller exposed customer personal information, account balances, and security question answers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"34f8aa949c1dfa1ce87694958966ca4c7c65d441","impact_type":"data_theft","incident_date":"2015-01-22","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9599.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"aee125918046","org_name":"Muji","org_type":"retail_ecommerce","ransomware":null,"records_affected":664,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9599.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9599.pdf"}],"summary":"Muji reported that malware infiltrated its online server and customer order information, including payment card details, may have been acquired.","supporting_quote":"Based on the outcome of our recently completed investigation, we have determined that an unauthorized third party used malicious software (malware) to infiltrate our on-line server, which is hosted by a reputable service provider.","technology_involved":["online server","online shopping site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dbb8523704003047dbfde3574deed06f59f1a4c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2009-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"b898d1d5d4d7","org_name":"Money Bookers","org_type":"financial","ransomware":null,"records_affected":4483605,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Money Bookers","type":"hibp","url":"https://haveibeenpwned.com/Breach/MoneyBookers"}],"summary":"Money Bookers suffered a data breach in 2009 that exposed customer information, including names, email addresses, home addresses, and IP addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc9bff8e5fac63e94c8973bdcb087de21a0924a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F1E737F-DCDA-4841-A8D9-035A27743959"},"incident_date":"2015-11-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91d7d71b2b76","org_name":"Dermatology Center of Lewisville","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/1500-patients-impacted-by-laptop-theft/"}],"summary":"stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-11-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57b54345120ece47055f189d582c4644ca65e419","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC0ACFE0-3159-4EE8-B317-4A76F48B3A83"},"incident_date":"2015-11-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"7774c5930d17","org_name":"UN Climate Change","org_type":"government","ransomware":null,"records_affected":1410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-hacks-un-climate-change-summit-website-to-protest-french-police-brutality-496924.shtml"}],"summary":"After doing the world a whole lot of good by going after ISIS members, Anonymous activists have now turned their hacking skills towards two websites connected with the UN Climate Change Summit that's going on in Paris this week.  The reason behind the group's actions is a protest","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e861e3f68925171911abdbc2d07e17fa3da71d3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D24F6DD6-36A0-4688-A67C-9A208AE78B65"},"incident_date":"2015-11-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"866acb43619f","org_name":"Mission Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs8.com/story/30821444/man-wanted-in-attempted-identity-theft-involving-atm-in-santee"}],"summary":"atm skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab6227c683970b998e5f51f467e09789fd2cc186","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83658A53-37B7-4586-A8DB-DEE5B31AA0C2"},"incident_date":"2015-11-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec2ecd101922","org_name":"Dueling Pianos Roadshow","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/2016/08/19/entertainment-business-founder-sentenced-in-denver-to-20-years-in-prison/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kdvr.com/2015/11/25/dueling-pianos-roadshow-founder-indicted-for-fraud/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.westword.com/news/dueling-pianos-caz-bzdek-accused-of-ripping-off-clients-for-200k-7384601"}],"summary":"credit card fraud on his own customers and employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"610d0c32063f795443f68d762fd797421dcc8579","impact_type":"data_theft","imported_from":null,"incident_date":"2015-11-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"HK","org_id":"385cb74bf0b6","org_name":"VTech","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: VTech","type":"hibp","url":"https://haveibeenpwned.com/Breach/VTech"}],"summary":"Hackers extracted parents’ and children’s accounts and personal information from VTech’s Learning Lodge website.","supporting_quote":null,"technology_involved":["Learning Lodge website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":"TC","motive":"grudge","name":"Turk Hack Team","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85d6afe49257d486385b5e41efe3cad017173eb3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE327DA0-FFE9-4577-A894-F7C972E401A0"},"incident_date":"2015-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"8b930068ff40","org_name":"Russian Central Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/turkish-hackers-target-russian-central-bank-site/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/turkish-attackers-shut-down-russian-central-bank-website/"}],"summary":"Turkish hackers just took down the official website of Russian Central Bank ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"turkhackteam"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77502d9579bb30c51a0978090c991152f98a0046","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A54E52F-A0E1-4B52-A4CD-3E77C7DBE85E"},"incident_date":"2015-11-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"7784ee75486c","org_name":"V-Tech","org_type":"other","ransomware":null,"records_affected":4833678,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hacks-exposes-data-on-more-than-200000-kids-and-almost-5m-parents/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.idigitaltimes.com/vtech-hack-update-company-suspends-apps-store-after-5-million-parents-and-childrens-494272;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/vtech-flaw-exposes-millions-of-accounts-412402;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/hacker-obtained-childrens-headshots-and-chatlogs-from-toymaker-vtech;"},{"fetched_at":null,"title":null,"type":"press","url":"https://boingboing.net/2015/11/27/vtech-breach-dumps-4-8m-famili.html;"}],"summary":"Lorenzo Franceschi-Bicchierai reports: The personal information of almost 5 million parents and more than 200,000 kids was exposed earlier this month after a hacker broke into the servers of a Chinese company that sells kids toys and gadgets, Motherboard has learned. The hacked d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2164ff849f0188149d330b632d78aad6f5572cb3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93C959C3-32F2-42FF-A974-23C64ABDA7AF"},"incident_date":"2015-11-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"7782811d0a70","org_name":"The Bitcoin Forum","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com/article/2380571/security0/bitcointalk-org-warns-passwords-in-danger-after-dns-attack.html;https://bitcointalk.org"}],"summary":"IDG News Service _ A popular Bitcoin discussion forum warned on Monday some user passwords may have been intercepted after the site's DNS (Domain Name System) registrar was breached.  An attacker found a flaw in Bitcointalk.org's domain name registrar, a company based in Japan ca","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc062e861bb079ee34657c668e558a3d52f9d2e7","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hilton%20Worldwide%20Inc%20%20Consumer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"a82389c48dcf","org_name":"Hilton Worldwide","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59022"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hilton%20Worldwide%20Inc%20%20Consumer%20Notification_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9598.pdf"}],"summary":"Hilton Worldwide identified and eradicated malware targeting payment card information in some hotel point-of-sale systems.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2015-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"242dd3aa8a1a81131e11da209cd32c8676a5140e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"84b0fccef964","org_name":"Foxy Bingo","org_type":"other","ransomware":null,"records_affected":252000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Foxy Bingo","type":"hibp","url":"https://haveibeenpwned.com/Breach/FoxyBingo"}],"summary":"Hackers obtained 252,000 Foxy Bingo accounts containing personal information, including plain-text passwords, birth dates and home addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96d61ccad7b27cee904f23387e3f11ede65504c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E0559E4-A74F-4ED4-8FF0-C2A57FE2E082"},"incident_date":"2015-11-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dca46df38a8","org_name":"Storage Units","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/austin-dumpster-diver-finds-a-list-actors-private-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kvue.com/story/news/local/2015/11/20/austin-dumpster-diver-finds-a-list-actors-private-info/76144154/"}],"summary":"dumpster diver finds celeb PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"447ba7ee096acc180b0d2a2f46214f23ee79f05d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45C6E921-8E2D-460E-98CA-88FC1E046F46"},"incident_date":"2015-11-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d9101c549cb7","org_name":"Clyde bank City Council","org_type":"government","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/syrian-refugees-data-stolen-from-council-worker-day-before-clydebank-arrival/"}],"summary":"laptop and doc stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55335463b0f308be04289ec67a0ce1616cdd071a","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/starwood-notice-materials_0.pdf"},"notes":null,"org_country":"US","org_id":"2c66e94323bc","org_name":"Starwood Hotels & Resorts Worldwide, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58971"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/starwood-notice-materials_0.pdf"}],"summary":"Malware infected point of sale systems at some Starwood hotels and enabled unauthorized parties to access customers’ payment card data.","supporting_quote":null,"technology_involved":["point of sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2015-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62332b3b9aac2715b82ca9881630e1a7e2c9c967","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4058286E-8FF0-4733-B48F-292557A25F08"},"incident_date":"2015-11-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8757af7e3e5c","org_name":"Complete Chiropractic & Bodywork Therapies","org_type":"healthcare","ransomware":null,"records_affected":4082,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mi-complete-chiropractic-bodywork-therapies-notified-4082-patients-after-discovering-malware/"}],"summary":"Complete Chiropractic & Bodywork Therapies notified 4,082 patients after discovering malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ca3ec522b0f57d7fe260cb24965d235b174b222","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a8cc10935770","org_name":"W.W. Grainger, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58923"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"577395580b5eca00080a94e9078d41766bec0ede","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71b813da9532","org_name":"Intuit Inc.","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Intuit%20Inc.-2015-11-18"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Intuit%20Inc.-2015-11-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e268d8f98b1f6b753bf406aaabca3ebce7cdea4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CA6D74A-3873-41C5-8262-64A969708DDA"},"incident_date":"2015-11-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49a991df0b40","org_name":"Florida Medical Clinic, PA","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/florida-medical-clinic-pa-notifies-1000-patients-after-greenway-health-error-exposed-phi/"}],"summary":"Misconfiguration by partner who manages portal exposed medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":"Kurdistan Workers' Party","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d66955272c1f0b80d8fd182094257e1663f525a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C143D8E-397A-4D78-A043-8E7189F39719"},"incident_date":"2015-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"e9b210afa51e","org_name":"Turkish Social Security Administration","org_type":"government","ransomware":null,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://web.archive.org/web/20150115085409/http://national.bgnnews.com/weak-state-servers-breach-causes-mass-identity-theft-in-turkey-haberi/2771"}],"summary":" inspector's report reveals huge medical security fraud concerning the Social Security Administrations. 14 million Turkish citizens' ID information shared with a third party.        Weak state servers breach causes mass identity theft in Turkey      The Presidency's State Audit I","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"kurdistanworkersparty"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ae00a9682e0e8e4f8bf63ab39d3358b460a48bd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FB4F810-23B6-49AD-8951-6F574EF88954"},"incident_date":"2015-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42e5cb7810b1","org_name":"Clark County school District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nv-ccsd-magnet-school-website-experiences-data-loss/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktnv.com/news/education/ccsd-magnet-school-site-experiences-data-loss"}],"summary":"lost data on two days on the website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6168b4fa8ba2fdb25ba70d66512c0e17ae3fb0c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9C5CDB4-6E80-4ACB-8101-95017D7279C4"},"incident_date":"2015-11-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d4a0c1351f7","org_name":"Durant Landmark Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kxii.com/home/headlines/Durant-PD-issues-warrants-for-Romanian-duo-in-credit-card-fraud-case-368686771.html"}],"summary":"ATM skimmer suspect caught","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efc209c339adb849a6eab02dc26e281804bde6b5","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"84b63a5f2b40","org_name":"Noble House Hotels and Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58832"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9597.pdf"}],"summary":"Noble House Hotels and Resorts reported that malware may have been installed on payment processing systems at several properties, potentially compromising payment card information.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45401153802a6c0995dbdceaf959c8eae59125da","impact_type":"unknown","incident_date":"2015-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FTF%20-%20Sample%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d30be392e944","org_name":"B. Lane, Inc., a Delaware corporation d/b/a Fashion to Figure","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58851"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c72839770f933eba8f5ba437eb6594af76540b28","impact_type":"exposure_no_theft_confirmed","incident_date":"2008-05-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C2015080328%20-%20Customer%20Letter%20-%20CA%20AG%20Online%20Submission_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58781"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58780"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59367"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C2015080328%20-%20Customer%20Letter%20-%20CA%20AG%20Online%20Submission_0.pdf"}],"summary":"American Express notified cardmembers that a merchant detected unauthorized access to data files containing American Express card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c008bccd057ab00a7c1801003811e87083258c58","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"035070A2-4C45-462A-8ACD-98B49BB10A25"},"incident_date":"2015-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"65eac291a848","org_name":"Victoria's Metro Trains","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/11/12/oz_railway_lets_newspaper_photograph_train_keys/"}],"summary":"Train keys were photographed and posted online. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2015-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b52438e95250432cee5bcea34ce83cc440f4d4e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A28913FB-5206-45DB-A163-D3CA495EABF0"},"incident_date":"2015-11-10","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f48b7c30757","org_name":"TaxAct","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/taxact-acknowledges-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/taxact-breached-customer-banking-and-social-security-information-compromised/article/464952/"}],"summary":"hacked tax software maker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TN","motive":"ideology","name":"The Tunisian Fallaga Team","variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c6b095845a5f1c3f508e6441fa0a4eb3bf67c3e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1b28bf80-aa24-11e8-9604-77188de09ef1"},"incident_date":"2015-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"69f9b1425555","org_name":"JFS","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/uk/321597-islamist-hackers-jewish-school/"}],"summary":"A Tunisian Islamist hacktivist group has claimed responsibility for hacking the website of Europe’s largest Jewish school, JFS in North London","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thetunisianfallagateam"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0c233afbd08346c489472fe5fd6d954d2f6e67c","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/33242%20Blank%20Atmtd%20Chng%20Smpl%20nogrid%20IBCD%20011156%20rev4_0.pdf"},"notes":null,"org_country":"US","org_id":"7eba9c14958a","org_name":"CSAC-Excess Insurance Authority","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58732"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/33242%20Blank%20Atmtd%20Chng%20Smpl%20nogrid%20IBCD%20011156%20rev4_0.pdf"}],"summary":"CSAC-Excess Insurance Authority notified individuals of an incident involving information associated with their claims and said it did not believe the information had been used for an unauthorized purpose.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89c8bbbb3a7b837e45d93a6addd73194abae0870","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DCAC08F-4602-4273-897F-ACF1592F4A2A"},"incident_date":"2015-11-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e0644ee8407","org_name":"Corner Bakery","org_type":"other","ransomware":null,"records_affected":2955,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/corner-bakery-cafe-to-notify-employees-of-possible-breach/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CBC_-_Sample_Notification_Letter_0.PDF?"}],"summary":"Potential misuse of employee PII. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94c02401c1368acbbf5b961cc6c0cfd4f769dac4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C52C3ED-93A0-4872-BBAF-9381A8A37967"},"incident_date":"2015-11-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3612f3b4a0ea","org_name":"Rush University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1529,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access to paper/films results in the expose of 1529 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"0dc2933e60068f63cfe19e83ad43cf72dc7f9aa5","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/OsteoMed.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c29063ef9b5","org_name":"OsteoMed","org_type":"unknown","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/OsteoMed.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-06","discovered_date":"2015-10-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c2a08d4dbef69b6aaaacaa76db9787bda42555a","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-09-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%201_0.pdf"},"notes":null,"org_country":"US","org_id":"e33f3b32e782","org_name":"California Department of Motor Vehicles","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A DMV employee mistakenly sent the file to an unintended government entity.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58698"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%201_0.pdf"}],"summary":"The California Department of Motor Vehicles mistakenly sent a file containing names and driver license numbers to the Riverside Probation Department.","supporting_quote":"The primary cause of the incident was due to human error by a DMV employee.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0f5aea63d0ab1f940954ab64f2f5ffbefe2df8a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9EDF8A8-35D0-4D22-8538-0E044A55DABA"},"incident_date":"2015-11-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9daae57427b1","org_name":"Medicap Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.desmoinesregister.com/story/tech/2016/02/04/medicap-pharmacy-warns-possible-data-breach/79820534/"}],"summary":"Disposal error of hard drive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db0f31f0beda94ee57533429f32b1612c67a78e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74CD93D6-C06F-479C-B33E-80465E472382"},"incident_date":"2015-11-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edcf6adf61ce","org_name":"Central Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksdk.com/story/news/crime/2015/11/06/money-swiped-teen-card-skimmed/75272356/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8347e21ad4f3086a9a398b58d2fd2b5fc97ea7bc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4E5CA5D-82F2-4DA5-BD49-868823E01648"},"incident_date":"2015-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9a8eaa8d90e6","org_name":"Niteworks","org_type":"professional_services","ransomware":null,"records_affected":831,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/04/22/mod_contractor_hacked_831_members_of_defence_community_exposed/"}],"summary":"Britain ministry of Def PII gone in hacking","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"860ff5bf20500f15101df579c7834e2d0e716ded","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFDAD5DD-26FA-4304-89BC-67AED85C9408"},"incident_date":"2015-11-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"90bcb331f1d7","org_name":"Hucks Food & Fuel","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox2now.com/2015/11/04/more-skimming-devices-found-in-st-charles-county/"}],"summary":"gas station skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca0c66461c8b3030fce21a83dce0295343ecb159","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Notification%20Letter%20-%20Final%20%282%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1b8f7e77b155","org_name":"Avis Budget Group","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Notification%20Letter%20-%20Final%20%282%29_0.pdf"}],"summary":"A benefits provider inadvertently sent a file containing Avis Budget Group employee personal information to another client, where two individuals briefly viewed it before it was deleted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00fbd07e0cac6b763656cbaf4b988cbdd8a47eb8","impact_type":"data_theft","imported_from":null,"incident_date":"2014-06-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8641f35a9a63","org_name":"Black Hat World","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Black Hat World","type":"hibp","url":"https://haveibeenpwned.com/Breach/BlackHatWorld"}],"summary":"Black Hat World accounts were breached in June 2014, and personally identifiable information was publicly released in a MySQL database script.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-03","discovered_date":"2015-09-21","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"67a2f155bdf7204ff30a9a0f0d74e9f6f94ec0b9","impact_type":"unknown","incident_date":"2015-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"938f28e5625c","org_name":"Accuform Manufacturing Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Accuform%20Manufacturing%20Inc-2015-11-03"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e2a6f71e6f3b93fa547774ad1e5bb1dc0f6061a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0C25255-A449-4070-8655-489477ED4ED6"},"incident_date":"2015-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e530ef25b045","org_name":"University of Queensland","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-law-student-charged-with-hacking-uq-to-get-better-marks/"}],"summary":"hacked his way to better grades","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa2c069304ff979175f9c4ed0d4fdb79194c31bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B64BA4B7-71CB-477E-AA34-2D48582F12DF"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b3e7b37e9ca","org_name":"UC Health","org_type":"healthcare","ransomware":null,"records_affected":1064,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcpo.com/news/local-news/hamilton-county/cincinnati/uc-health-privacy-breach-affects-1064-patients;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Email address mixup leads to misdelivery of medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12406e04a2c370f2f046c33a846d66ccb240df56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"919fde00-e37d-11e7-8742-2bc46bd10713"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d02e4b332a54","org_name":"TriHealth","org_type":"healthcare","ransomware":null,"records_affected":1126,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/trihealth-notifies-1126-patients-after-software-glitch-sends-statements-to-old-addresses/"}],"summary":"In late November of 2016, TriHealth discovered a software glitch inadvertently replaced the current mailing addresses of 1,126 TriHealth patients with a previous address we had on file for them. This caused TriHealth billing statements and other correspondence to be sent to the f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72c638f76a0e54b2950b534b5bfdd677cb4220e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE146B43-34F4-49E4-9596-1A18A855504F"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"317d75edfe6f","org_name":"Town & Country Bank and Trust Co.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/louisville/blog/morning_call/2015/11/skimming-devices-are-found-on-several-atms.html"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57c8652a74200cf73ca52f3ad6447f7c9fc9a023","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C84DE7E-6C81-41A8-A0DD-7CB94B7C1F38"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"f2c8bd30a74b","org_name":"Swedbank AB","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbronline.com/news/cybersecurity/data/swedbank-hit-by-second-hack-attack-4713586"}],"summary":"DDOS on bank website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dad74022fea4093f7d846b6ba0f25c8c736de36d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AC872D0-5F48-45DE-938E-6F649737855B"},"incident_date":"2015-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.poughkeepsiejournal.com/story/news/crime/2016/02/03/rite-aid-associate-stole-customer-addresses-credit-card-numbers/79762090/?from=global&sessionKey=&autologin="},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57939"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9589.pdf"}],"summary":"A Rite Aid associate at the Poughkeepsie location \"may have obtained limited customer information\" including customer names, addresses and payment card information in order to make \"unauthorized payment card transactions,\" according to a press release from the corporation. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff7a1f485845fb1ba2c632427975aa703c05dba1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51CCF2BE-FBB1-4B24-B4AE-D60C4E2BBDD1"},"incident_date":"2015-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2ef4b6293b7","org_name":"Regional Income Tax Agency","org_type":"government","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox8.com/2016/01/04/rita-reports-personal-data-of-50000-taxpayers-may-be-at-risk/"}],"summary":"Unencrypted DVD with 50000 records of PII was lost.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"972784400fa2a5da55ed4d7fe9956b27a4c02af0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87CB1C77-9AF7-4A05-8865-C526C2BB5CB3"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f8fecd6c390","org_name":"Quest Diagnostics Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businesswire.com/news/home/20151120006010/en/Newman-Ferrara-Announces-Class-Action-Quest-Diagnostics;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/investigations/Medical-Records-Mix-up-Investigation-Doctor-Privacy-351060331.html"}],"summary":"A Brooklyn marketing office was inundated for months by hundreds of private medical documents meant for Quest Diagnostics, but couldn't get anyone at the clinical laboratory services company to take action until she called NBC 4 New York's I-Team. Gabby Klotzman started working f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8b15ef25dfe5d49c3cc9042a174c6272b453543","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8EFB9AD-19BA-4B93-887A-F95399733518"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"341e3e66d4ec","org_name":"Nova Southeastern University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"PII breach  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bea11edfdacc44fb78bd4f0f720a950cbc2698de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94A87D26-5677-40C0-8FC1-C172F1268658"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4f527a2b397e","org_name":"Natwest Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.warringtonguardian.co.uk/news/14033610.UPDATED__Police_warning_after_card_skimming_devices_discovered_on_Warrington_cash_points/"}],"summary":"ATM skimming ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bd623250e8c8b209e03488fc516c876f0cf63fd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B81BD6B-A784-4FDB-8A1F-80D6EB150F7F"},"incident_date":"2015-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2359e2577053","org_name":"Michael S. Benjamin, M.D.","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/california-hematologist-notifies-patients-after-thief-stole-paper-records-with-protected-health-information/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Michael S. Benjamin, M.D. wants to alert his patients that in November 2015 thieves stole a small number of patient paper charts. The police were called immediately upon discovery of the theft. A suspect was identified and taken into custody, and the police recovered many stolen ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8913546bd10a51f66819febf8a5c3b774260a5b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CD2DF27-E15B-4971-AFD7-201A12E37836"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3b8cf264cdc","org_name":"LinkedIn","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconbeat.com/2016/08/11/linkedin-bot-attack-thats-stealing-member-data/"}],"summary":"Data thieves used a massive \"botnet\" against professional networking site ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec5b0da600df047c37ff59ac0b5d1317bba3710c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E520D79B-0043-4678-9857-064C1633ACCC"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"f23d6b20c8a1","org_name":"Kromtech Alliance Corp.","org_type":"technology_saas","ransomware":null,"records_affected":13000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/12/13-million-mackeeper-users-exposed/"}],"summary":"13 Million MacKeeper Users Exposed due to server misconfiguration","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bc11da71e48134b93b9ad33f85659f80cc73524","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45E96920-F078-4997-AB0C-91549896D95E"},"incident_date":"2015-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"441045d88670","org_name":"Indiana University Health Arnett","org_type":"education","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/iu-health-arnett-hospital-notified-30000-of-missing-or-stolen-portable-storage-device/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://iuhealth.org/newsroom/detail/notice-to-patients-of-lost-portable-storage-device/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wbaa.org/post/purdue-it-security-expert-dont-panic-about-30000-compromised-health-records"}],"summary":"For a second time in two-and-a-half years, IU Health Arnett Hospital has had to notify thousands of patients that some of their personal information may be compromised because a computer device was either lost or stolen.  The latest incident was discovered in November, the hospit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d3b0cd9a8ee5305bb185baee1053fea1461d6ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E69CA0CA-2384-4D38-B8F0-E97161A80160"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a8bb0ded332","org_name":"Dr. Mary Ruth Buchness","org_type":"healthcare","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nyc-dermatologist-emails-spreadsheet-containing-personal-info-for-15k-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/news/local/New-York-City-Doctor-Emails-Personal-Information-Spreadsheet-Patients-353112481.html"}],"summary":"When Missy Brown opened her email Monday morning, she was stunned to find a document from her doctor's office containing personal information for 15,000 names.  \"I think the subject line said 'coupon attached,' and I saw that there was a spreadsheet attachment,\" she said. \"As soo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67ca1d6786d0dfd2f21757aef6bc89e752a6990f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2BDE8132-512A-4D8A-856F-D550AC0935AC"},"incident_date":"2015-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb85c496cecd","org_name":"Department of Transportation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.qgazette.com/news/2016-06-29/Front_Page/DOT_Parking_Permit_Holder_Info_Stolen.html"}],"summary":"parking passes stolen  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1de0e28f6dfe8899ea010043f93a24bf508cd584","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C092C7FC-E677-4EF1-810C-63D9B4A333F3"},"incident_date":"2015-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BG","org_id":"5787454675f9","org_name":"DANS","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.novinite.com/articles/171607/Hack+Attack+Targets+Websites+of+Bulgaria+Security+Body,+Parliament,+Vote+Counting+Company"}],"summary":"DDoS against Bulgarian govt sites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf4b106a376af31e5020a7ae76022b21d0fb1153","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25952206-66CC-4AE2-95C7-283F20984FE0"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0714c47977f","org_name":"Centegra Health System","org_type":"healthcare","ransomware":null,"records_affected":2929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/patient-privacy-violated-following-employee-theft-in-oregon;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/il-mailing-error-by-contractor-discloses-limited-personal-info-of-3000-centegra-patients/"}],"summary":"Centegra Health System recently notified 2,929 patients that a mailing error may have exposed some of their personal information.  On November 2, at the vendor MedAssets, a setting on automatic mail filing equipment accidentally was changed, spokesperson Michelle Green told the N","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32b66379ffe987ca37b79c7f4508b9cec0b00689","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0c2c5a50-d63a-11e7-af4f-6b5d4514198e"},"incident_date":"2015-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://calgaryherald.com/news/politics/privacy-commissioner-finds-ahs-responsible-for-high-profile-privacy-breach"}],"summary":"On Wednesday, the Office of the Information and Privacy Commissioner released its report on a 2015 case that saw 49 AHS employees improperly access the records of a patient and the patient’s daughter at Calgary’s South Health Campus.  The privacy breach revolved around a Calgary ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4c577c0104e04d61d345d79ab8f88f1052fbb36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2038B30F-A9D2-43BD-965A-C4C67828721D"},"incident_date":"2015-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"472ab3772963","org_name":"Agency for Health Care Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.wjct.org/post/ne-florida-patient-information-compromised-records-sent-landfill;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ahca.myflorida.com/MCHQ/Field_Ops/151221_HIPAA_Notice_PHI.pdf"}],"summary":"A mistake by Florida healthcare regulators may have exposed the personal information of thousands of Northeast Florida patients.  The Agency for Health Care Administration accidentally sent inspection records to a landfill, instead of a shredder, last month.  In a notice posted o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee976e88968a0376057d5df09f859ed6154fd2a7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60F9393B-7A44-4082-AF6D-2ACAA429BCCF"},"incident_date":"2015-10-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5850cd289655","org_name":"St. Luke's Cornwall Hospital","org_type":"healthcare","ransomware":null,"records_affected":29156,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-st-lukes-cornwall-hospital-notifies-patients-after-thumb-drive-with-limited-phi-is-stolen/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"On October 31, 2015, an individual entered a restricted area of St. Luke's Cornwall Hospital (\"SLCH\") and stole a USB thumb drive that may have contained  limited protected health information for some patients.  SLCH takes the privacy and security of its patients' information ver","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b384a48838684292853a32e447a21be529a6b472","impact_type":"unknown","incident_date":"2015-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"8db01d17dbda","org_name":"Mac-Torrents","org_type":"unknown","ransomware":null,"records_affected":93992,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Mac-Torrents","type":"hibp","url":"https://haveibeenpwned.com/Breach/Mac-Torrents"}],"summary":"In October 2015, the torrent site Mac-Torrents was hacked and almost 94k usernames, email addresses and passwords were leaked. The passwords were hashed with MD5 and no salt.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2015-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1705a9a80ce57f885d671d31f643ce5c70a8102c","impact_type":"data_theft","imported_from":null,"incident_date":"2015-09-18","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"09936e1e9aef","org_name":"Final Fantasy Shrine","org_type":"other","ransomware":null,"records_affected":620677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Final Fantasy Shrine","type":"hibp","url":"https://haveibeenpwned.com/Breach/FFShrine"}],"summary":"Final Fantasy Shrine was breached in September 2015, and data including email addresses, IP addresses, and salted password hashes was released publicly.","supporting_quote":null,"technology_involved":["discussion forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-30","discovered_date":"2015-09-15","entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"362191fc2048a6a8ebfa09a9cfa1d819e3c81b66","impact_type":"unknown","incident_date":"2015-09-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b4311c4972ae","org_name":"T-Mobile / Experian","org_type":"unknown","ransomware":null,"records_affected":108000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#T-Mobile%20/%20Experian-2015-10-30"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2015-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a289b131f778c8e194f999b3f66a4b97523f1dc1","impact_type":"data_theft","imported_from":null,"incident_date":"2015-10-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"1aa17b9cf5d2","org_name":"PHP Freaks","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: PHP Freaks","type":"hibp","url":"https://haveibeenpwned.com/Breach/PHPFreaks"}],"summary":"PHP Freaks' discussion board was hacked and 173,891 user accounts were publicly leaked.","supporting_quote":null,"technology_involved":["discussion board"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3e4b808a4a5f2f244cb0b4587467c161fd390c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49063294-8218-420D-A42B-48EC8B9472DE"},"incident_date":"2015-10-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"411cab0a4c10","org_name":"American Bank of Texas","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heralddemocrat.com/article/20151130/NEWS/311309939"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4864a112ebb6532b94dc3ffe2751905a2026091","impact_type":"data_theft","incident_date":"2015-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/STILETTO%20-%20Notice%20Letter_Final%20%285772563x7AB84%29_0.pdf"},"notes":null,"org_country":"US","org_id":"59014ec8865c","org_name":"STILETTO Solutions","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58547"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/STILETTO%20-%20Notice%20Letter_Final%20%285772563x7AB84%29_0.pdf"}],"summary":"STILETTO Solutions reported unauthorized access to its e-commerce server and said customer payment data and possibly account credentials may have been acquired.","supporting_quote":null,"technology_involved":["e-Commerce server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f8759082e335395d49195bd6cf6697bc772e2e4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C21B1E6A-342B-4717-B395-C1CBD253700E"},"incident_date":"2015-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44013842b51f","org_name":"LTC Dental, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1680,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Laptop theft results in exposure of 1680 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2d72e4e85e72538cec334e0ad326a1eaa1035f11","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9596.pdf"},"notes":null,"org_country":"US","org_id":"066208ddc9eb","org_name":"Excellus Blue Cross","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9596.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9596.pdf"}],"summary":"Excellus Blue Cross experienced a cyberattack in which personal, medical, and financial information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abb395dd8dbcea08ebd523caa35ad6bedc346237","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"f95c7fc7fc47","org_name":"Digital Theatre, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58535"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_2.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9595.pdf"}],"summary":"Digital Theatre reported that unauthorized individuals installed malware on a website-hosting server, potentially compromising customer personal and payment card information.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b522e60f57a1536a0647f266818cff9561cfcf72","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C929ED7D-A009-46D0-9A97-4811AD887620"},"incident_date":"2015-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4627840c2df1","org_name":"Rotherham Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.co.uk/news/local/emails-reveal-how-rotherham-council-bosses-covered-up-laptop-theft-details-1-7473181;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.co.uk/news/exclusive-theft-of-council-laptop-with-names-and-addresses-of-abused-girls-kept-secret-from-rotherham-victims-1-7473174"}],"summary":"Rotherham Council bosses decided to keep secret details of laptop thefts from their offices - despite being aware that 'significant amounts of confidential information' relating to a child abuse investigation and young people in care had been lost.    New information has now been","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b80555a574482b996f2638e8c1efe7ca3ab8e51","impact_type":"data_theft","imported_from":null,"incident_date":"2015-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c073d3898c0b","org_name":"MPGH","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MPGH","type":"hibp","url":"https://haveibeenpwned.com/Breach/MPGH"}],"summary":"MPGH’s vBulletin forum was breached, exposing usernames, email addresses, IP addresses, and salted password hashes.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-10-26","discovered_date":"2015-11-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01b8d782a522d7cd8bc1aa2f3759355d0c114fdf","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-10-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cottage%20Health%20Patient%20Notification_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"7f4c6c0d80c7","org_name":"Cottage Health","org_type":"healthcare","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":"Patient health information on a server was inadvertently exposed to the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/cottage-health-notifying-11000-patients-whose-records-were-exposed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/exposed-server-causes-cottage-health-healthcare-data-breach"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59101"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cottage%20Health%20Patient%20Notification_0.pdf"}],"summary":"Cottage Health reported that patient information on a server was inadvertently exposed to the internet, with no indication that it had been misused.","supporting_quote":"We currently understand that the PHI of approximately 11,000 patients residing on a server may have been inadvertently exposed to the internet during the period of October 26 to November 8, 2015.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8a7a4c2a02f8f2a7d3ddfe6fe284a7349b9582d","impact_type":"data_theft","imported_from":null,"incident_date":"2015-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"69a204b9011c","org_name":"000webhost","org_type":"technology_saas","ransomware":null,"records_affected":14936670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: 000webhost","type":"hibp","url":"https://haveibeenpwned.com/Breach/000webhost"}],"summary":"A breach at 000webhost exposed customer names, email addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69c994fbaf4fcee5f4bd7804c90fcfaac4cfa636","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B76124E-EF8D-4D77-AF64-521D00BB1605"},"incident_date":"2015-10-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3237d21df02","org_name":"ST Psychotherapy, LLC","org_type":"healthcare","ransomware":null,"records_affected":509,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wi-mental-health-patients-and-disability-benefits-applicants-info-on-stolen-laptop/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wbay.com/2015/12/22/psychotherapy-office-warns-of-data-breach-after-laptop-stolen/"}],"summary":"An Oshkosh psychotherapy office is advising about 500 patients of a potential breach of personal information.  ST Psychotherapy, LLC, says there was a burglary at the office at 627 Bay Shore Drive on Oct. 23.  Among the stolen items was a laptop computer with records of outpatien","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fae0ac3a3affb02626a7f92f64338c02998426f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24551BF0-DCD6-48DC-B806-C945D21A9B51"},"incident_date":"2015-10-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"287c6af3f5a2","org_name":"Fox River Counseling Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/mental-health-record-data-breach-for-wis.-clinic;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenorthwestern.com/story/news/2015/12/21/counseling-clinic-warns-clients-data-breach/77693548/"}],"summary":"A Wisconsin counseling center recently reported a data breach that may have exposed mental health records for approximately 500 individuals.  Fox River Counseling Center had an \"unsecured laptop\" stolen on October 23, according to The Northwestern. Outpatient mental health record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-10-22","discovered_date":"2015-09-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbbf7e4004d10447bb168df8395f31820ee67395","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/General%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"84b63a5f2b40","org_name":"Noble House Hotels and Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58429"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/General%20Notice_0.pdf"}],"summary":"Noble House Hotels and Resorts reported malware on The Commons’ payment card system that may have compromised payment card information.","supporting_quote":null,"technology_involved":["payment card system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-10-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45cc69fa900c231a8ea13c80317a1bc4aaaafeb3","impact_type":"data_theft","incident_date":"2015-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Alert%20Regarding%20ABA_0.pdf"},"notes":null,"org_country":"US","org_id":"5c962c2ad7c1","org_name":"American Bankers Association","org_type":"nonprofit","ransomware":null,"records_affected":6400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58430"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Alert%20Regarding%20ABA_0.pdf"}],"summary":"The American Bankers Association reported that at least 6,400 ABA Shopping Cart usernames and passwords were posted online.","supporting_quote":null,"technology_involved":["ABA Shopping Cart"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2015-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9a18fac5f3c20b884455190b44b84d876ba3abb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBB30244-C1E0-41DE-AA91-467D1598BC48"},"incident_date":"2015-10-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee17f2413de6","org_name":"Osceola County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fl-osceola-county-childrens-personal-information-posted-online/"}],"summary":"Children's information posted online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a251ca0aa7a3990ce629cc9a2e5047cefcb11acf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"854E102C-ED08-442E-9F37-43F561739F3D"},"incident_date":"2015-10-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09e18cb6747a","org_name":"Belgrade Regional Health Center","org_type":"healthcare","ransomware":null,"records_affected":854,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mailing-error-results-in-phi-exposure-of-belgrade-regional-health-center-patients-8238/"}],"summary":"When a physician's assistant left the Belgrade Regional Health Center, a letter was sent to patients to tell them about the impending change in personnel; however, that letter also resulted in a breach of 854 patients' Protected Health Information (PHI). The mailing took place on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64bc7a883dd1cf61bfcaf61f1285eecf9b7a73ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7d276370-e441-11e7-977c-0b3846f56840"},"incident_date":"2015-10-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13a42ed5892a","org_name":"Hennepin County Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hcmc-employee-sentenced-for-fraudulently-using-patients-credit-cards/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/article/stories/s4320873.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://minnesota.cbslocal.com/2016/09/20/former-hcmc-employee-pleads-guilty-to-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/news/hcmc-employee-identity-theft-plea-patients-credit-cards/4268671/"}],"summary":"A Hennepin County Medical Center employee who pleaded guilty to fraudulently using patients’ credit cards was sentenced Monday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d351b3ae122ddb3b14b4737d3b73b187c9ea57ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F129C970-3B04-4581-A42D-5F1432284386"},"incident_date":"2015-10-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01120b28032d","org_name":"TrustCo Bank Corp NY","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news10.com/2015/11/18/romanian-man-arrested-for-skimming-delmar-bank-atm/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3ff51d58792f520ad9cba79123eac738ebc8059","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C8DF4D1-AD22-4959-BBF2-B5F297BCC620"},"incident_date":"2015-10-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e29b2189881","org_name":"CalOptima","org_type":"nonprofit","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/caloptima-notifies-members-of-breach-8-months-later/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.caloptima.org/~/media/Files/CalOptimaOrg/508/Members/2016-06_NoticeofDataBreach_508.ashx"}],"summary":"On October 7, 2015, an internal printing error resulted in approximately 100 CalOptima Medi- Cal members with diabetes receiving a health incentive survey that may have included an extra survey meant for another member. We became aware of the error on October 8, 2015, and immedia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5102bd7a70351ab46b176d08fe812a274523313b","impact_type":"data_theft","imported_from":null,"incident_date":"2015-08-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice_2.pdf"},"notes":null,"org_country":"US","org_id":"7d80a3be9773","org_name":"Scripps Networks","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58311"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice_2.pdf"}],"summary":"Scripps Networks reported unauthorized access to Food.com user credentials and possible acquisition of some users’ dates of birth.","supporting_quote":null,"technology_involved":["Food.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-10-16","discovered_date":"2015-09-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"524ef6116dc49f096bb7126ae4ee58f408c9a767","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NextBus_ONLY%20Notification_Letter_CA_AG_0%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"852384b339f1","org_name":"NextBus, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58315"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NextBus_ONLY%20Notification_Letter_CA_AG_0%20%281%29_0.pdf"}],"summary":"NextBus reported that stolen login credentials compromised an agency account and may have exposed account information in a database.","supporting_quote":"While our investigation is ongoing, our experts have determined that an agency account was compromised through stolen login credentials.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-10-16","discovered_date":"2015-09-08","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"924ac8164284cafe90856bd589bd332f2b396755","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Comm%20Catlysts%20NOTICE%20ONLY_2_0.pdf"},"notes":null,"org_country":"US","org_id":"8dd5de8f4fb8","org_name":"Community Catalysts of California","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58324"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Comm%20Catlysts%20NOTICE%20ONLY_2_0.pdf"}],"summary":"A thumb drive containing personal and medical information was stolen from an employee’s car.","supporting_quote":"On September 8, 2015, Community Catalysts of California was notified by an employee that a thumb drive was stolen from the employee’s car, which was parked in a locked garage.","technology_involved":["thumb drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2015-10-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82c7f1991067e8dad98455f4ee610749c957db41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFD6BC27-EFC7-4FAF-B9D3-27A2C4C282CB"},"incident_date":"2015-10-14","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"1da83b8c0e21","org_name":"Alibaba","org_type":"retail_ecommerce","ransomware":null,"records_affected":20590000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/cn-hackers-steal-account-details-of-20-6-mln-taobao-users/;https://thestack.com/security/2016/02/03/taobao-hack-20-59-million/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/hackers-attack-20m-accounts-of-alibaba-e-commerce-unit/article/471412/"}],"summary":"Attackers stole 99 million accounts, 20 million of which were active accounts and correct passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2c9dba3bdc9f3ce50248a0ce724d0c01c1495a2","impact_type":"unknown","incident_date":"2015-03-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Exhibit%20A_1.pdf"},"notes":null,"org_country":"US","org_id":"8223a0ab2e23","org_name":"Service Systems Associates, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58264"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Exhibit%20A_1.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9594.pdf"}],"summary":"Service Systems Associates reported malware in point-of-sale systems used by gift shops at several zoos between March 24 and May 20, 2015.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5daa01453b487fc444abd8f058316f061af9829c","impact_type":"unknown","incident_date":"2014-10-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Breach%20Letter_3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd63af3cc748","org_name":"Peppermill Casinos, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58266"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e21277e7ad7f5879fb1b99861b690a11cd46a3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08718D74-C8FA-4BA3-BFBA-D7A0D24FD412"},"incident_date":"2015-10-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"486bdec03bb7","org_name":"Georgia","org_type":"government","ransomware":null,"records_affected":6200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hosted.ap.org/dynamic/stories/G/GA_VOTER_DATA_BREACH_LAWSUIT_GAOL-?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT;http://www.databreaches.net/ga-it-staffer-fired-in-data-breach-affecting-6-million-georgia-voters/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myajc.com/news/news/state-regional-govt-politics/data-breach-in-georgia-could-affect-6-million-vote/npQj8/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/state-regional-govt-politics/it-staffer-fired-in-data-breach-involving-6-millio/npQ9C/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/state-regional-govt-politics/suit-accuses-georgia-of-massive-data-breach-involv/npQLz/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.natlawreview.com/article/data-breach-georgia-affecting-six-million-voters-adds-to-2015-national-tally"}],"summary":"Kristina Torres_reports: Georgia Secretary of State Brian Kemp will issue an alert this afternoon formally notifying more than 6 million Georgia voters that their personal information, including Social Security numbers and birth dates, were illegally released last month by his of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PS","motive":"ideology","name":"KDMS Team","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dcfead4a8d7a0ba83b3e4985af59ecd0d8cdf1e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98C5C1E1-1C09-47DB-9C42-21C771A93670"},"incident_date":"2015-10-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c1cf3df4ca8","org_name":"Rapid7","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Metasploit-com-Hacked-by-Palestinian-Hackers-of-KDMS-Team-390444.shtml;https://community.rapid7.com/community/infosec/blog/2013/10/15/putting-the-fax-straight-rapid7com-and-metasploitcom-website-defacement"}],"summary":"Palestinian hackers of KDMS Team, the ones that have defaced numerous high-profile domains over the past days through DNS poisoning, have hijacked metasploit.com, the website dedicated to the popular penetration testing software Metasploit. They've also defaced Rapid7's website, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social","derived":{"actor_id":"kdmsteam"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0eef990e42070e583ebacafae728cfd52c05336","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2010-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"IE","org_id":"9eb292dbaca0","org_name":"Paddy Power","org_type":"retail_ecommerce","ransomware":null,"records_affected":750000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Paddy Power","type":"hibp","url":"https://haveibeenpwned.com/Breach/PaddyPower"}],"summary":"A 2010 breach exposed 750,000 Paddy Power customer records containing personal information and security question answers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a36e3269ef5fd0c8c134128b883f782d33dd19b1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B392686-FDCA-4519-9389-D76096039401"},"incident_date":"2015-10-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d141cdb94322","org_name":"Niall O'Kane Optometrists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/medway/news/patients-records-left-on-train-45367/"}],"summary":"A copy of patients' records, which include names, addresses, national insurance numbers and bank account details, has been lost by an optometrist in Strood.  The protected back-up copy of Niall O'Kane Optometrists' patient database was left on a train on Saturday, October 10.  Mr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fde501000c2c575e63d4358ead0378e7d87019d2","impact_type":"unknown","incident_date":"2015-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"942c49a14ac7","org_name":"MyVidster (2015)","org_type":"unknown","ransomware":null,"records_affected":19863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: MyVidster (2015)","type":"hibp","url":"https://haveibeenpwned.com/Breach/MyVidster"}],"summary":"In August 2015, the social video sharing and bookmarking site MyVidster was hacked and nearly 20,000 accounts were dumped online. The dump included usernames, email addresses and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4afd4325bc80138ccbc85453591961606a91636c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E61A5232-EB0C-49DE-8783-7C7705FDC762"},"incident_date":"2015-10-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"136c1594e2ac","org_name":"Hillsides","org_type":"healthcare","ransomware":null,"records_affected":502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hillsides-a-pasadena-child-welfare-agency-warns-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pasadenastarnews.com/general-news/20151230/hillsides-a-pasadena-child-welfare-agency-warns-of-data-breach"}],"summary":"Employee sent unencrypted PII and medical record data to personal email account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"381674faf81fda8110f52a8de8f09763399a232d","impact_type":"unknown","incident_date":"2015-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Vacaville%20Housing%20Authority%20-%20Notice%20of%20Data%20Event_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b3a4b68fa353","org_name":"Vacaville Housing Authority","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58203"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"002f11e67e6158d7f9cf4c6f17a7df1d1c01ea7d","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-09-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9593.pdf"},"notes":null,"org_country":"US","org_id":"d9c0bfd3101f","org_name":"Peggy Olson","org_type":"professional_services","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9593.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9593.pdf"}],"summary":"Peggy Olson reported that a virus infected her computer and an unauthorized individual may have accessed it, potentially putting clients’ personal information at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e19b58c169b19d4bb2c370271c9f51df343a7ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0902A32-1807-4970-A3BD-561BD3B77A11"},"incident_date":"2015-10-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1756d70cfe95","org_name":"Keenan & Associates","org_type":"financial","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Keenan%20Associates%20Ad%20r3fin_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/healthcare-firm-keenan-assoc-exposes-data/article/457495/"}],"summary":"On October 9, 2015, we learned that documents containing information relating to some < < ClientDef1(Client Name)>> employees and some of their dependents could potentially be found through searches on the Internet. We immediately began an investigation and discovered that the do","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2f923f2bcbd1b5e4c764aa6e6963a7e6e624dc0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBC7677A-6801-4704-9861-0E2DCEC7C98C"},"incident_date":"2015-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b669a7d39c1e","org_name":"Washington Hospital Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/washington-hospital-healthcare-system-notifies-individuals-of-breach/"}],"summary":"A computer within the hospital used to track library cards was accessed without authorization. There was no indication that the information was used for any purpose. The info did not include PII or any other sensitive information apart from name and addresses of users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-10-08","discovered_date":"2015-08-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"127ca0ef28b4b840f960c61412a4134a87234098","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Samela%20dba%20NorthShore%20Supply%20notice%20only_0.pdf"},"notes":null,"org_country":"US","org_id":"19b034778fa2","org_name":"NorthShore Care Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58183"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Samela%20dba%20NorthShore%20Supply%20notice%20only_0.pdf"}],"summary":"NorthShore Care Supply reported that customer information, including payment card data, may have been exposed through its online ordering website.","supporting_quote":null,"technology_involved":["online ordering website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07ce33809f021e0885db1cd46d80958632926fc0","impact_type":"data_theft","incident_date":"2014-05-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mail%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"725f42907c10","org_name":"GlamGlow LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58194"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mail%20Notification%20Letter_0.pdf"}],"summary":"An unauthorized party accessed the GlamGlow website and acquired some customers’ personal information.","supporting_quote":null,"technology_involved":["glamglowmud.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc9efa6df4e4c5c9334b6d75251d03d2e57a6bdf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"816E347F-861A-4E1F-A77C-14076F2C13EE"},"incident_date":"2015-10-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-oct-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-nov-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-dec-2015.pdf"}],"summary":"Patient A received a prescription intended for Patient B. Patient Bs name and type of medication was compromised. Patient A reported the incident to the medical center and a replacement has been requested for Patient B. Murfreesboro Consolidated Mail Outpatient Pharmacy (CMOP) in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d9a50c2866fb6ddbf963ed994570126b6e743ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4698686-86B4-446E-A9F9-27798D533F7A"},"incident_date":"2015-10-06","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"d0310017eff4","org_name":"Danske Bank A/S","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/danish-bank-leaves-server-in-debug-mode-exposes-sensitive-information-in-javascript-comments-493838.shtml"}],"summary":"Server left in Debug mode..","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b71756cf824258b155c1be4e3942a38e378c4476","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A59D92AF-2F56-4AEC-9F38-EB7BD8094E97"},"incident_date":"2015-10-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4710bedac792","org_name":"The Navajo Area Indian Health Service","org_type":"healthcare","ransomware":null,"records_affected":7500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nm-northern-navajo-medical-center-patient-information-turns-up-in-nm-storage-units/"}],"summary":"employee walked out with 7500 medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50fbc8330776d725b2c422410b3667ffc9a0941f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"422104D4-4D4A-4A85-A5CA-D70855EE28E3"},"incident_date":"2015-10-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd65cd0ecb03","org_name":"New Mexico Department of Health","org_type":"government","ransomware":null,"records_affected":561,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nmhealth.org/about/asd/itsd/cso/dbi/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/new-mexico-department-of-health-data-breach-561-8233/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"On October 4, 2015 a Department of Health employee's laptop was stolen from the employee's personal vehicle during an auto burglary at St. Joseph on the Rio Grande Church, 5901 St. Joseph's Dr. NW, Albuquerque, NM, 87120. It was one of several auto burglaries in the church parkin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2015-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3339f55513ef284a9c5a8af82641ca4406f1c54b","impact_type":"data_theft","incident_date":"2015-10-03","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multistate%20Notice_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1530","org_country":"US","org_id":"c072b3916a8a","org_name":"Gyft, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":392773,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-59990"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/12/password-thieves-target-e-giftcard-firm-gyft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/gyft-notifies-affected-users-of-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://themerkle.com/news/gyft-reveals-more-details-regarding-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/gyft-resets-some-customer-passwords-following-breach/article/460904/"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multistate%20Notice_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9609.pdf"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Gyft%2C%20Inc.-2016-02-05"}],"summary":"An unauthorized party accessed two cloud providers used by Gyft and viewed or downloaded user information stored with them.","supporting_quote":"Beginning on October 3 and continuing through December 18, 2015, an unknown party accessed without authorization two cloud providers used by Gyft.","technology_involved":["cloud providers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fa3bfe56ceb551d6f447f15831a1252730e6d8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88a93e10-a26c-11e7-bd2e-43ac41b832c9"},"incident_date":"2015-10-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb25c75bd131","org_name":"Atmore Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atmoreadvance.com/2016/12/28/ach-fires-employee/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/al-atmore-community-hospital-fires-employee-who-snooped-on-1000-patients-records-for-more-than-one-year/;"}],"summary":"An Atmore Community Hospital employee was terminated for accessing the electronic record of approximately 1,000 patients without an appropriate work-related reason, according to a press release from Infirmary Health.  The breach of the patients’ privacy was discovered during a ro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c4822f3f844ba04b6fb37b084a43c321be99810","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CB75F1A-30BD-40E8-865B-628863F5AF67"},"incident_date":"2015-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91285d6b5e59","org_name":"21st Century Oncology","org_type":"healthcare","ransomware":null,"records_affected":2200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/21st-century-oncology-notifies-patients-of-data-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/21st-century-oncology-notifies-patients-of-data-security-incident-offers-protection-300230892.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-press.com/story/news/2016/03/09/data-breach-affects-22m-21st-century-onoclogy-patients/81525656/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/21st-century-oncology-sued-for-57m-over-data-breach/"}],"summary":"A 21st Century Oncology spokesperson confirmed today to DataBreaches.net that 2.2 million patients were impacted by this breach.   Today, 21st Century Oncology Holdings, Inc. announced that it is investigating an unauthorized third party intrusion into its network. The company is","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial","other"],"disclosed_date":"2015-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d21577342938f748a197a9887aa3682a4ffd2b66","impact_type":"data_theft","imported_from":null,"incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bfd5152fd7fb","org_name":"Patreon","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Patreon","type":"hibp","url":"https://haveibeenpwned.com/Breach/Patreon"}],"summary":"Patreon was hacked in October 2015, and a public dump included database records, email addresses, personal messages and bcrypt password hashes.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31d9384aa62f43a50460a867b63c52d7360efe45","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE7DB355-BAC8-4844-85C6-66625F479F4C"},"incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0fc9afdd4d7e","org_name":"The Archdiocese of Denver","org_type":"nonprofit","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/18000-possibly-affected-by-archdiocese-of-denver-data-breach/article/491295/"}],"summary":"The names, social security numbers and addresses of those in the database may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5922f86318eb905c08d5361796461babab379bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8D2917D-11EB-4A6B-9D4E-EC5B258E793F"},"incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"293ee27453dd","org_name":"TalkTalk","org_type":"retail_ecommerce","ransomware":null,"records_affected":156959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-34611857;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/talktalk-call-centre-staff-manacled-over-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitalspy.com/tech/news/a782119/the-talktalk-data-breach-cost-company-100000-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitalspy.com/tech/news/a772876/mps-launch-investigation-into-talktalk-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.co.uk/tech-policy/2016/01/talktalk-call-centre-staff-manacled-over-security-breach/;"}],"summary":"alkTalk has revealed the impact of last year's data breach on its user base, confirming that it has lost 100,000 customers since its systems were hit.  Some 95,000 of those users were a direct result of the hack, which is estimated to have cost the operator around 60 million.  Br","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":"2015-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"2c198cc37cfa68766d33b6aab03a460c2b270241","impact_type":"data_theft","incident_date":"2015-09-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9591.pdf"},"notes":null,"org_country":"US","org_id":"fd7db84b9052","org_name":"T-Mobile USA","org_type":"telecom","ransomware":null,"records_affected":328889,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9591.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9591.pdf"}],"summary":"T-Mobile USA reported that information it provided to Experian for credit checks was downloaded by an unauthorized party who accessed Experian systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Experian"},"updated_at":"2026-10-12","veris_action":"unknown","derived":{"vendors":[{"id":"b1720a6ef76f","name":"Experian"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":"2015-09-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3415981c33b3157dac3a155c2c7a040e6f799b19","impact_type":"data_theft","incident_date":"2015-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TMobile-Experian%20corrected%20copy%20v_2%202015-10-02%20Multi-state%20notification%20letter%20_0_0.pdf"},"notes":null,"org_country":"US","org_id":"fd7db84b9052","org_name":"T-Mobile USA, Inc.","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58079"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TMobile-Experian%20corrected%20copy%20v_2%202015-10-02%20Multi-state%20notification%20letter%20_0_0.pdf"}],"summary":"An unauthorized party accessed Experian servers and downloaded personal information maintained for T-Mobile USA.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Experian"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"b1720a6ef76f","name":"Experian"}]}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba93d08db8092d335c2d2efcd1a71bf80c9b639b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60425CB5-68AB-40E4-B90D-B862C750F434"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca57af4adcdb","org_name":"Sheridan Chapter of Trout Unlimited","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thesheridanpress.com/?p=46743"}],"summary":"woman has been sentenced to 51 months in prison for bank fraud and aggravated identity theft involving forging checks to herself and misdirecting funds electronically. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de190236dc9b117f095980e6b4e31fbc735a1210","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Scottrade%20California%20notice%20only%20_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"22fb53e33b4e","org_name":"Scottrade","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58084"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Scottrade%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d214916efd56dde2510590793b901e826bdee53","impact_type":"unknown","incident_date":"2015-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Participant%20Incident%20Notification%20Template%2010_1_15_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9e17a4c3b928","org_name":"Schwab Retirement Plan Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58080"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Schwab%20Retirement%20Plan%20Services%2C%20Inc.-2015-10-07"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67e34eeaf13d03a810724e3ec530f4ae320e322d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAA7B824-DE1B-4407-9ECE-896C575B4D14"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"53beb8f9fecf","org_name":"Regina General Hospital","org_type":"healthcare","ransomware":null,"records_affected":97,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/regina-hospital-employee-caught-snooping-medical-records-including-ex-spouses/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/2901116/regina-hospital-employee-caught-snooping-medical-records-including-ex-spouses/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.canlii.org/en/sk/skipc/doc/2016/2016canlii54143/2016canlii54143.pdf"}],"summary":"According to the Aug. 17 report, the Regina Qu'Appelle Regional Health Authority (RQRHA) received a complaint from a female patient on Oct. 15, 2015.  A total of 97 electronic medical records of 35 people were accessed by the employee. The report said the worker is a medical lab ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9506aebc2fffb79faf728e0298025ccbb9df6c74","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D986B4C0-B3E4-4516-B6AF-65A95EDE3F45"},"incident_date":"2015-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2a1900f85aa","org_name":"Peppermill Casinos INce","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/payment-card-breach-at-peppermill-resort-spa-casino-in-reno/article/447433/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Breach%20Letter_3.pdf?"}],"summary":"Data breach of client information at the Peppermill Casino in Reno, NV compromise of credit cards and debit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddb0cb96ed1dd874a062a86aa2ea51d401b80de7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5c248d80-2fbb-11e9-a1a1-c18441714bf8"},"incident_date":"2015-10-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"228c02319fce","org_name":"Peebles Media Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cso.com.au/article/657653/ex-employee-sued-by-firm-after-falling-bec-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bbc.com/news/uk-scotland-glasgow-west-47161340"}],"summary":"Scottish custom publishing house Peebles Media Group is suing a former employee, Patricia Reilly, for losses stemming from nearly £200,000 of the company’s money she transferred to a business email compromise (BEC) fraudster.   BEC fraud is a huge business that the FBI has attrib","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca551024d2c5cbdc8570d89ee05121fa88e28dda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83D7E3A6-DADB-4097-8982-74CADD41F45F"},"incident_date":"2015-10-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3a919958ea6","org_name":"Panther Creek High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/hacker-changes-high-school-grades-just-before-college-application-period-495830.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/student-charged-with-hacking-n-c-high-schools-computer-system-changing-grades/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.welivesecurity.com/2016/02/08/student-arrested-school-data-breach/"}],"summary":"hacking by student to change grades","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IL","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d207bdd447fe73a861e6a0b6e4b2ca705a6b67ef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"525666BA-35CE-4B28-A9A2-2E2336CBCD02"},"incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae83aaa92f37","org_name":"Overstock.com Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sltrib.com/home/2872084-155/israeli-arrested-for-alleged-cyber-attack"}],"summary":"DDoS on online retailer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20b5eeb5666bb3076686fa126747b93d3ee12d08","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66904561-7076-4819-93AC-BD5812201D93"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6d7ff507597","org_name":"Northwest Primary Care","org_type":"healthcare","ransomware":null,"records_affected":5372,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/or-northwest-primary-care-notifies-5372-of-insider-data-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-medical.net/news/20151213/NWPC-notifies-certain-patients-about-insider-data-theft.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/patient-privacy-violated-following-employee-theft-in-oregon;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.satprnews.com/2015/12/12/northwest-primary-care-notifies-patients-of-security-incident/"}],"summary":"Northwest Primary Care (NWPC) is notifying certain patients about a security incident involving information that was stolen by a former employee. On October 13, 2015, NWPC was informed by law enforcement that the employee stole patient names, dates of birth, Social Security numbe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25ce2b4490387fdd424cb90df0441260ea9b2870","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ef930ef0-e423-11e7-8742-2bc46bd10713"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9003596613cb","org_name":"New Hampshire Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nh1.com/news/personal-info-of-about-15-000-nh-dhhs-clients-accessed-by-patient-some-posted-on-social-media/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/new-hampshire-psychiatric-patient-accused-of-data-breach/article_8b048ffe-abd5-5d6e-8854-d874962d9125.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://manchesterinklink.com/nh-dhhs-data-breach-involves-15000-clients-personal-info-posted-nh-hospital-patient-social-media/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newhampshire.com/state-government/Detective-Suspect-in-DHHS-data-breach-said-he-was-bored-12292016"}],"summary":"The NH Department of Health and Human Services reports a data breach involving 15,000 DHHS clients who received services prior to November 2015. An investigation indicates that a patient at New Hampshire Hospital accessed information on the DHHS website in 2015, including names a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d7ca5ce45c156904ed03dc0862407065a85fd61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6aff0110-8697-11e7-8e76-6d3ed9e599f7"},"incident_date":"2015-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"3458a697c6f8","org_name":"Manly Warringah Sea Eagles","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/nsw/martin-taupau-email-mixup-highlights-legal-risks-of-forwarding-misdirected-message-20151030-gkn7vk.html"}],"summary":"It was an incredible email mix-up that gave a Canadian theatre critic a rugby league scoop. But when James Kelly Nestruck posted on social media about an email sent to him instead of Manly Sea Eagles chief executive Joe Kelly, eagles of the legal variety swooped.  The unlikely tu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39e3654f73464734e4adeb54597def53750d65b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"608F63BE-D2C5-4253-ADED-11C7C48438DD"},"incident_date":"2015-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e2ab74d33f3","org_name":"HealthSouth Round Rock","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.komando.com/happening-now/340852/top-story-another-hospital-data-breach-affects-1300-patients-in-texas;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/healthsouth-round-rock-laptop-stolen-1900-affected/article/461459/"}],"summary":"HealthSouth Rehabilitation Hospital of Round Rock (Texas) is notifying individuals that some medical and personal information may have been lost when an employee's laptop was stolen.  How many victims? 1,359  What type of information? The information may vary from person to perso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96c3e9242969ef98ade32fae3c07912e78bd4dc0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD30F8B3-4738-48DF-B8F8-CC8BF37F5C3D"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"2a048336fdad","org_name":"Eidenhoven Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nl-eindhoven-cop-fired-for-misusing-police-database-leaking-info/"}],"summary":"Misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ba1e13e93c3ae155f1de4aa4ae38fc52609b5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33C10037-8261-4519-9F32-D32D00C6AF41"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"356003007cd0","org_name":"Daffodil Software Ltd","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/in-it-firm-ex-employee-booked-for-data-theft/"}],"summary":"former employee of an IT firm has been booked for allegedly stealing data from that company and selling it to industry competitors","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"572a323bbcaffbc4774cbe0aa24be34b8dbfad84","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40F43FE2-011D-459B-AE40-BF24B3E167D0"},"incident_date":"2015-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f07d8c30d86d","org_name":"CoPilot Provider Support Systems","org_type":"other","ransomware":null,"records_affected":220000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/copilot-provider-support-services-data-breach-affects-220k.html"}],"summary":"Database compromise leads to potential disclosure of 220000 PII records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25edd6b88ea59529e27c409a48a1acb04be4eb84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87775c50-6c8b-11e7-8419-7d473c8dcba3"},"incident_date":"2015-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ff730cf6d53","org_name":"Citrix","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/citrix-says-sensitive-data-not-accessed-breach?utm_source=twitter.com&utm_medium=social&utm_campaign=buffer&utm_content=buffer40639;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/i-hacked-citrix-says-russian-hacker-w0rm/article/464362/"}],"summary":"Citrix, a US software company specialising in virtualisation and cloud computing, has reportedly been compromised by a Russian hacker called w0rm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"3712b440957c504c02c007e535ba074a5db3400f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9592.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1779e7a63f6c","org_name":"Charles Schwab","org_type":"unknown","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9592.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa8b4522c88d9d3eb1833ae0d47246d45d2bd9cc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9314DF98-DCDA-490F-A915-66F23BD47024"},"incident_date":"2015-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c72a49cd7174","org_name":"Brandeis University","org_type":"education","ransomware":null,"records_affected":193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thejustice.org/article/2015/11/registrar-data-stolen-in-laptop-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.oag.state.md.us/idtheft/Breach%20Notices/2015/itu-261689.pdf"}],"summary":"two computers were stolen from the Registrar's office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f95d7051fd9fd4069a4d6d478c859a36ba368c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EDF4CBB-E73E-45A8-B291-151D032554FA"},"incident_date":"2015-10-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"financial","ransomware":null,"records_affected":20764,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nearly-21000-customer-records-hit-by-blue-shield-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/shield-699874-blue-security.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/telephone-phishing-scam-blue-shield-california-8262/"}],"summary":"Blue Shield of California has reported a breach of PHI caused by an employee of a business associate who fell for a telephone phishing scam. Almost 21,000 individuals have been affected by the security breach.  Healthcare providers and insurers should conduct staff training to en","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a514e3bd09723bff43c9cf34a76b585facdbfcdb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72D3796D-E135-4895-ACE2-5E0AFD85DABC"},"incident_date":"2015-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"762be260389a","org_name":"Angels in Your Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/center-for-disability-rights-offers-help-to-people-in-alleged-data-breach/"}],"summary":"Former CEO used PHI of customers to help spin up his own company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e967d5cbf69abec1774e73294026ae4b45adea90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9a41f790-aa20-11e8-9604-77188de09ef1"},"incident_date":"2015-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"50245a0fa90e","org_name":"ADAC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.autobild.de/artikel/adac-mitgliederdaten-im-internet-7106293.html"}],"summary":"The ADAC has displayed data of members openly readable on the Internet for weeks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-09-30","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"829578c3d9aae52c9249f54e2412bb1ae6a45529","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9590.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"9841c1e3b622","org_name":"Scottrade Financial Services, Inc.","org_type":"financial","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":"Corrected 1099 forms were mailed to an older address rather than the current address on file.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9590.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9590.pdf"}],"summary":"Scottrade reported that corrected 1099 forms containing personal and financial information were mailed to an older address.","supporting_quote":"Your information inadvertently went to your older address rather than to the current mailing address we have on file.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-12","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d941fcf5431baefb7b431b3e9602b4986d38a7c3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35534913-8CBB-4D41-B5DF-56A543FF7B4F"},"incident_date":"2015-09-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"financial","ransomware":null,"records_affected":2815,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wbay.com/2015/10/11/laptop-documents-with-some-wisconsin-humana-members-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/business/computer-documents-containing-data-on-some-wisconsin-humana-medicare-subscribers-stolen-b99593880z1-331844871.html"}],"summary":"Documents containing the member identification numbers for about 250 people enrolled in Humana Medicare Advantage plans in Wisconsin were stolen when an employee's vehicle was broken into, Humana said Friday.  The health insurer has been notifying the people this week and will is","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c243ce7e8dc7fd8191795f49b016512cf96af010","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDDDBE43-3D93-4D66-9EAE-5351DBDC86AA"},"incident_date":"2015-09-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"343d90fbba56","org_name":"First Niagrara Bank, Trustco Bank, Berkshire Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyfreeman.com/general-news/20160909/columbia-county-bank-customers-targeted-by-atm-skimmers-indictment-says"}],"summary":"skimming devices and pinhole cameras to secretly capture the account numbers and PINs of customers who used ATMs at First Niagara Bank, Trustco Bank and Berkshire Bank branches in Chatham and Delmar, and Great Barrington, Mass., respectively","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"116473e772bec5684900e164777dbaea2fbb6255","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D94F7846-0369-4817-92C4-B8A68D0203FC"},"incident_date":"2015-10-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e33f3b32e782","org_name":"California Department of Motor Vehicles","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bakersfieldnow.com/news/local/California-DMV-worker-indicted-in-ID-theft-probe-335320841.html"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notice%201_0.pdf"}],"summary":"creation of new identities with Puerto Rican documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b5e58fecd3afd94b03edbbbc415e338f35395fa7","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9588.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"559fd3d04863","org_name":"Sterbick & Associates, P.S.","org_type":"unknown","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9588.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98e6b06246160aaf70e9e27bd32223dc4eb0db9a","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"ee81676af9ba","org_name":"Trump Hotel Collection","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57993"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_1.pdf"}],"summary":"Trump Hotel Collection notified customers that malware may have accessed payment card information entered into the payment card systems at its Las Vegas hotel.","supporting_quote":null,"technology_involved":["payment card systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-09-25","discovered_date":"2015-08-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3f68c7e77b64b28a60e33cd6901ac12553b439a","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-09-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notfication%20Letter%20Template%20-%20Silverberg%20Medical%20Adult%20r1prf_0.pdf"},"notes":null,"org_country":"US","org_id":"e2cac823352d","org_name":"Silverberg Surgical and Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A document scanning device inadvertently exposed patient health records to the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57984"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notfication%20Letter%20Template%20-%20Silverberg%20Medical%20Adult%20r1prf_0.pdf"}],"summary":"Silverberg Surgical and Medical Group reported that a document scanning device exposed patient health records to the Internet.","supporting_quote":"Based on our investigation, on September 10, 2013 a document scanning device inadvertently exposed some patient health records to the Internet.","technology_involved":["document scanning device"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a99423dc92b2b3f6a7cbd77098f494de241bd353","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5884C116-0D86-4D08-B289-CD6D9F0236DE"},"incident_date":"2015-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"439094cf6560","org_name":"Pathways Professional Counseling","org_type":"healthcare","ransomware":null,"records_affected":986,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/patient-privacy-violated-following-employee-theft-in-oregon;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/pathways-professional-counseling-notifies-patients-ssn-financial-insurance-diagnosis-and-treatment-info-all-on-stolen-laptop/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/pathways-professional-counseling-reports-theft-of-laptop-containing-ssns-8193/"}],"summary":"A Pathways Professional Counseling employee's laptop was stolen on September 24, 2015, potentially exposing 986 individuals' information. The theft was discovered the very next day, and Pathways immediately notified local law enforcement.  The device was password protected, accor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3740b75704fc886771599673e05da7b3592b8f8d","impact_type":"unknown","incident_date":"2014-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Costco%20General%20Notice%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"919b6c05ec04","org_name":"Costco Photo Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Costco%20General%20Notice%20Sample_0.pdf"}],"summary":"Costco Photo Center offered identity theft recovery and credit monitoring services in connection with an incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc62c982c6f3943ea9b55ffd58ab3508d1a8b415","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22BB329D-3A38-4E51-8829-B811F111E91C"},"incident_date":"2015-09-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"631dfd891fe2","org_name":"Bayside bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://qns.com/story/2016/01/21/this-guy-may-have-stolen-your-personal-info-from-bayside-atm/"}],"summary":"ATM placed inside bank on ATM","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-09-22","discovered_date":"2015-08-31","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c39d21136ef5b252c9cd390142cb5b4ffdcad72","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lawton%20notice%20-%20deidentified_0.pdf"},"notes":null,"org_country":"US","org_id":"b8b33ea86a50","org_name":"Kindred Transitional Care and Rehabilitation – Lawton","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lawton%20notice%20-%20deidentified_0.pdf"}],"summary":"An office computer containing personal and accounting-related information was stolen from a locked office, and unauthorized access to its files could not be ruled out.","supporting_quote":"On August 31, 2015, we learned that an office computer had been stolen from a locked office within the facility.","technology_involved":["office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"27fb0278d1669ce713e5a7428a3d1b61022e25ae","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9587.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"770ca0c6b460","org_name":"Costco","org_type":"unknown","ransomware":null,"records_affected":1498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9587.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Costco.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":["T1041"],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-09-18","discovered_date":"2015-07-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"b6f18c822cb9bfb11333dced102fb94b717327b5","impact_type":"data_theft","incident_date":"2015-03-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"extracted","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9586.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"ccc1c6a14cfd","org_name":"Molina Healthcare of Washington, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7767,"reviewed":false,"root_cause":"A former CVS employee removed Molina members’ personal information from CVS systems in violation of CVS policies.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9586.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9586.pdf"}],"summary":"A former CVS employee transferred Molina members’ protected health information from CVS systems to a personal computer.","supporting_quote":"The PHI was removed from CVS’ systems by its former employee in violation of CVS’ policies.","technology_involved":["CVS computer systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CVS"},"updated_at":"2026-10-12","veris_action":"misuse","derived":{"vendors":[{"id":"910947b07615","name":"CVS"}]}},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-09-18","discovered_date":"2015-07-20","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb5c7ec3f184e525c726b26130a3995faf635814","impact_type":"data_theft","incident_date":"2015-03-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAMPLE%20Final%20Member%20Breach%20Notification%20DSNP%20CA%20WA%20091815_0.pdf"},"notes":null,"org_country":"US","org_id":"ba878d181ed5","org_name":"Molina Healthcare of California, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former CVS employee took PHI from CVS computers and sent it to a personal computer.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20Final%20Member%20Breach%20Notification%20DSNP%20CA%20WA%20091815_0.pdf"}],"summary":"A former CVS employee took Molina members’ protected health information from CVS computers and sent it to a personal computer.","supporting_quote":"On or about 3/26/15, a former CVS employee took PHI from CVS’ computers and sent it to his personal computer.","technology_involved":["CVS computers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"CVS"},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"vendors":[{"id":"910947b07615","name":"CVS"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-17","discovered_date":"2015-08-07","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bce150457d5cf2a614fad6c46af75d74f836ee1","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-08-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Outback%20Notice_final_0.pdf"},"notes":null,"org_country":"US","org_id":"e1b2d2ef2b98","org_name":"T-Bird Restaurant Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57861"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Outback%20Notice_final_0.pdf"}],"summary":"A thief stole computer equipment from a T-Bird-managed Outback Steakhouse, including a point of sale computer containing employee names and Social Security numbers.","supporting_quote":"Computer equipment, including the restaurant’s point of sale computer terminal and back office computer, was stolen and the thief or thieves attempted to steal the restaurant’s safe.","technology_involved":["point of sale computer terminal","back office computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-09-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29dd1bf9481886db824d39575c099ea3a809ba5a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EBBCA4B-52B2-4568-A28B-D9C6F630A7C0"},"incident_date":"2015-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co","org_type":"financial","ransomware":null,"records_affected":265359,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.katc.com/news/data-breach-may-have-exposed-jp-morgan-chase-cardholders/;http://www.bayoubuzz.com/louisiana-news/baton-rouge-news/item/561503-hackers-may-have-exposed-personal-info-of-la-residents;http://www.huffingtonpost.com/2013/12/05/jpmorgan-cyber-attack_n_4388779.html;http://arstechnica.com/security/2013/12/hack-on-jpmorgan-website-exposes-data-for-465000-card-holders/;http://www.databreaches.net/louisiana-agencies-notified-of-breach-across-certain-jpmorgan-chase-systems-breach-not-confined-to-louisiana/;http://www.databreaches.net/jpmorgan-chase-breach-update-pile-on/;http://www.nbcphiladelphia.com/news/business/Data-Breach-to-Affect-Pa-Cardholders-234676751.html;http://www.sltrib.com/sltrib/news/57229169-78/breach-jpmorgan-customers-data.html.csp;http://www.hispanicbusiness.com/2013/12/6/data_breach_exposes_account_information_for.htm;http://www.bostonglobe.com/metro/2013/12/10/data-breach-could-expose-benefit-recipients-info/jf98QJfRsjwlHypHty3XyM/story.html;http://ivebeenmugged.typepad.com/my_weblog/2013/12/jpmorgan-chase-prepaid.html;http://www.bizjournals.com/boston/news/2013/12/11/jpmorgan-chase-data-breach-affects.html;http://www.kansascity.com/2013/12/12/4688533/jpmorgan-chase-job-aid-recipients.html"}],"summary":"NEW YORK/BOSTON, Dec 5 (Reuters) - JPMorgan Chase & Co is warning some 465,000 holders of prepaid cash cards issued by the bank that their personal information may have been accessed by hackers who attacked its network in July.  The cards were issued for corporations to pay emplo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd577d61397344696b13e287ba7873026748fb26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C30BC3E-1FA4-499B-972D-6DB398E3FDC4"},"incident_date":"2015-09-16","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f209ed71cb7b","org_name":"OH Muhlenberg, LLC","org_type":"healthcare","ransomware":null,"records_affected":84681,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fbi-alerts-owensboro-health-to-breach-at-muhlenberg-hospital-breach-began-in-january-2012/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.14news.com/story/30527902/owensboro-health-says-greenville-hospital-experienced-security-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://44news.wevv.com/owensboro-health-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/update-over-84000-affected-by-oh-muhlenberg-breach/"}],"summary":"OH Muhlenberg, LLC announced that its hospital located in Greenville, KY, has experienced a security incident affecting some of the hospital's computers. The hospital is providing notice to individuals that may have been affected by the incident and offering one year of complimen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a49b9ec55afdc924b1177d463553a28078b0beb0","impact_type":"data_theft","imported_from":null,"incident_date":"2015-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"financial","ransomware":null,"records_affected":15000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Experian (2015)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Experian"},{"fetched_at":null,"title":null,"type":"press","url":"http://hosted.ap.org/dynamic/stories/U/US_EXPERIAN_T_MOBILE_DATA_BREACH?SITE=SCAND&SECTION=HOME&TEMPLATE=DEFAULT;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2015/10/01/us-tmobile-dataprotection-idUSKCN0RV5PL20151001?feedType=RSS&feedName=technologyNews;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2015/10/hack-brief-hackers-steal-15m-t-mobile-customers-data-experian/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wirelessweek.com/news/2015/11/experian-posts-20m-charge-related-t-mobile-data-breach;http://www.wirelessweek.com/news/2015/10/t-mobile-hit-lawsuits-wake-experian-hack"}],"summary":"A circulated dataset allegedly exposed personal and financial information belonging to 15 million people who applied for financing from T-Mobile, but its source was inconclusive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57da4df1ab4281bb9a459a75ca95f1b57a426cf0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D1719EF-61C1-46A8-9A52-3E01F25E8FA9"},"incident_date":"2015-09-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04af6478a3b4","org_name":"Claystone Clinical Associates","org_type":"healthcare","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mlive.com/business/west-michigan/index.ssf/2015/09/kentwood_company_warning_clien.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/car-theft-results-in-exposure-of-phi-of-2900-individuals-8117/"}],"summary":"A Wyoming medical billing firm is trying to contact patients of one of its clients that a vehicle theft could result in a data breach of customer information.  Insurance Data Services, at 1161 58th St. in Wyoming, says a West Michigan Delivery Service courier car delivering accou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7261b53a3bdbb5b95e9c5f77df308db328645516","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BACFC23F-4749-4051-955F-FE22D99AE09A"},"incident_date":"2015-09-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ecf37f04a22","org_name":"United States Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":524,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/dhhs-discloses-second-medicaid-data-breach/15106827/"}],"summary":"The state Department of Health and Human Services revealed Friday that a staffer potentially compromised the confidential health information of hundreds of Medicaid patients, marking the second time in recent months this has happened.  Officials said they have installed software ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","internal"],"disclosed_date":"2015-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e5660aa4ecf507ba40b55b04c0d06bb45189b81","impact_type":"data_theft","incident_date":"2015-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Glidewell_Proof%20Copy_0.pdf"},"notes":null,"org_country":"US","org_id":"64f29ac1d19c","org_name":"James R. Glidewell, Dental Ceramics, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57775"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Glidewell_Proof%20Copy_0.pdf"}],"summary":"Glidewell reported that an unauthorized individual may have taken employee personal information and proprietary company information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"42cc4c6754bd8e90734b03bdf647805a805b8081","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CVS.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"61d7b2178573","org_name":"CVS Pharmacy, Inc/PNI Digital Media","org_type":"unknown","ransomware":null,"records_affected":5840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CVS.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d4a0f76afb5b30d9d45cf7b97812bfed9707e48","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51B0603E-FE1A-4581-BAA6-6FAF5A496C64"},"incident_date":"2015-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"4411d5bb07f4","org_name":"Moscow Kremlin","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/california-hackers-said-to-hit/;https://www.rt.com/politics/315338-hacker-attack-kremlin-website/"}],"summary":"The Kremlin's official website fell under a massive cyber-attack on Monday, although it was repelled, the presidential press-secretary, Dmitry Peskov has revealed. \"On Sunday, a very powerful hacking attack was made on the Russian president's website. The defense system worked, e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2015-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47acbd52cf0164397fd69062a3d780ef80506792","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F9747D5-0AB0-4082-9D5B-2332ECB1F50B"},"incident_date":"2015-09-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dcfc1afdea62","org_name":"Mascoma Savings Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mychamplainvalley.com/news/local-bank-finds-skimming-device-camera-on-atm"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eb110057ce056b6e50722cedb2a09d07ef8a2f0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5CD91B8-20F6-4340-ACEA-BC2BA01EF95F"},"incident_date":"2015-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7800ba106efd","org_name":"Bremerton Housing Authority","org_type":"nonprofit","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wa-hacker-tries-to-ransom-housing-authority-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kitsapsun.com/news/local/hacker-tries-to-ransom-housing-authority-data-3c7e38bd-2c7a-654d-e053-0100007f4ae1-393487771.html"}],"summary":"ransomware for data  not paid","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-09-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67f4142d91f057bf619e36d37ca0aa389cd3e51e","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/YAPSTONE-single%20letter%20sample_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"6960c532a72d","org_name":"YapStone, Inc.","org_type":"financial","ransomware":null,"records_affected":5264,"reviewed":false,"root_cause":"Personal information stored in the application may have been accessible to unauthorized persons through a YapStone URL.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57770"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/YAPSTONE-single%20letter%20sample_0.pdf"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9601.pdf"}],"summary":"YapStone reported that personal information stored in its VacationRent Payments application may have been accessible to unauthorized persons through a YapStone URL.","supporting_quote":"certain personal information you provided on your VacationRent Payments application that was stored by YapStone may have been accessible by unauthorized persons via a YapStone URL between approximately July 15, 2014 and August 5, 2015.","technology_involved":["VacationRentPayment application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c8e102fd12e456f9eb6d099c7f761ac7132df38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BD88C4C-55CA-4322-803A-A2D1AF5C0F80"},"incident_date":"2015-09-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"313704874685","org_name":"Tulare County Sheriff's Office","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fresnobee.com/news/local/crime/article74607507.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc30.com/news/tulare-county-sheriffs-office-clerk-arrested-for-data-fraud/1316152/"}],"summary":"employee was arrested in Visalia on Thursday on suspicion of fraudulently accessing computer data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-09-11","discovered_date":"2015-08-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d3f0fe47c1192c9d0491b8855cf808e05ec8dec","impact_type":"data_theft","incident_date":"2013-04-26","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/B3245_V3_PMID_SMF_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"2acdf07aa74a","org_name":"Sutter Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee emailed electronic documents to a personal email address without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57764"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/B3245_V3_PMID_SMF_0.PDF"}],"summary":"A former Sutter Medical Foundation employee emailed electronic documents containing personal, medical, and financial information to a personal email address without authorization.","supporting_quote":"On August 27, 2015, we determined that the former employee emailed certain electronic documents to a personal email address without authorization on April 26, 2013.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb448da30d26e8626b49f9c28d949c90e4c54a88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B477519E-4F12-4B42-A3A8-4EF15911EE10"},"incident_date":"2015-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2788cc52cfd","org_name":"MaineGeneral Health","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mainegeneral-health-notifying-employees-and-patients-after-fbi-alerts-them-to-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mainegeneral.org/news/statement-regarding-mainegenerals-recent-cyber-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mainegeneral-breach-update-investigation-revealed-additional-phi-compromise/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcsh6.com/story/news/local/2015/12/08/cyber-attack-hits-mainegeneral-health-patient-information-possiblly-compromised/76973146/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":" cyber attack on a hospital computer network","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cf8c0406e84f8c93521e64493a659e717c55d77","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6A6339C-233D-4D8D-907F-17AD93EF8915"},"incident_date":"2015-09-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"341959542f95","org_name":"CoastHills Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.noozhawk.com/article/data-skimming_devices_found_in_lompoc_santa_maria_atm_machines_20150913"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2bc2e2288a172ef927e07225bd7da4e9d3d1e4b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B246336F-5DE4-4C83-9F63-55A0D3A33303"},"incident_date":"2015-09-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4df256837e58","org_name":"CarePlus Health Plans","org_type":"financial","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/florida-health-plan-data-breach-after-mailing-error"}],"summary":"Misdelivery of paper documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"babdef390aa85578d09691ace6713cd9d4b8687b","impact_type":"unknown","incident_date":"2013-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/LifeTime%20Healthcare%20sample%20notices%209_9_15_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3e4bf425861","org_name":"The Lifetime Healthcare Companies","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57740"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9585.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef2b0cc36e791c6b01ef036d2a2494a1a2436b73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAF6581E-08D3-4AAB-9757-0C1CA854F4EF"},"incident_date":"2015-09-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"b988005351ed","org_name":"Carmelton","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.apnews.com/ap/db_289563/contentdetail.htm?contentguid=OYbniEK7;http://www.washingtonpost.com/world/middle_east/ap-exclusive-experts-say-hackers-hit-major-israeli-roadway-a-sign-cyber-warfare-now-reality/2013/10/27/54a65a3a-3f2e-11e3-b028-de922d7a3f47_story.html;http://www.usatoday.com/story/tech/2013/10/27/ap-exclusive-israeli-tunnel-hit-by-cyber-attack/3281133/;http://www.nextgov.com/cybersecurity/threatwatch/2013/10/breach/509/;http://thehackernews.com/2013/10/israeli-road-control-system-hacked.html"}],"summary":"Israel is considered one of the most advanced country in cyber security, but at the same time is a privileged target for hostile governments intent in sabotage and cyber espionage on his technology. Yesterday, Cybersecurity experts revealed that a major artery in Israel's nationa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-09-04","discovered_date":"2015-08-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"697a3386966757ddd3435425970e96a559831c4b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WEV%20-%20Email%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"7cef177a6864","org_name":"We End Violence LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57701"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WEV%20-%20Email%20Notice_0.pdf"}],"summary":"We End Violence LLC discovered unauthorized access to its website server involving personal information associated with Agent of Change users.","supporting_quote":null,"technology_involved":["website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483362d33e5cd9ea976ca29871fce5353787cf39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCBEFD24-C0EF-427A-A54D-BC7018C6F165"},"incident_date":"2015-09-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"533a7203c638","org_name":"Banks","org_type":"financial","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krcrtv.com/news/local/shasta/20-bank-accounts-hacked-in-anderson-alone/104845106"}],"summary":"skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22d22b602f241a3a9c40e9e8a6ce060e14dbdb80","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-31","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ReverbNation%20Sample%20Email%20Notice%20to%20Consumers%20-%20Password%20Reset%20and%20Additional%20Information_0.pdf"},"notes":null,"org_country":"US","org_id":"dafd008bf837","org_name":"ReverbNation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57665"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ReverbNation%20Sample%20Email%20Notice%20to%20Consumers%20-%20Password%20Reset%20and%20Additional%20Information_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/ReverbNation.pdf"}],"summary":"An individual accessed a ReverbNation vendor’s computer systems and user information in a backup of ReverbNation’s database.","supporting_quote":"In January 2014, an individual, who has since been identified and charged, illegally accessed a R everbNation vendor’s computer systems and ultimatel y gained unauthorized access to user information contained in a backup of our database.","technology_involved":["database backup"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea71b0cdb2a22e489ab9823f79f224eae034839f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8CA65E1-8A90-474A-9795-B8DAE091AAFA"},"incident_date":"2015-09-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08734f34cf33","org_name":"Whalerock Industries","org_type":"technology_saas","ransomware":null,"records_affected":600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2015/09/16/kardashian-website-security-issue-exposes-names-emails-of-over-half-a-million-subscribers-payment-info-safe/"}],"summary":"Celebrity website exposed 600000 PII records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2302e2ebc27fc6ad7b57c8b209f67754bc32131c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DC99F44-26E7-460C-BC13-E9198F99D72E"},"incident_date":"2015-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-sep-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-oct-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-nov-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-dec-2015.pdf"}],"summary":"Veteran A received Veteran B's appointment letter and his lab results. Both letters have been returned.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b78af819e71b9232753f26d62f52be46e916c785","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20IDExperts%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"a737fbc60b3c","org_name":"UCLA Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57650"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20IDExperts%20letter_0.pdf"}],"summary":"A laptop containing limited UCLA Health patient information was stolen from a faculty member's locked car, with no evidence that the information was accessed or used.","supporting_quote":"On July 3, 2015, a laptop computer belonging to a UCLA Health faculty member was stolen from his locked car while he was traveling.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"172364251f81969ba6680fb68d19874cc27137be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cbe5edd0-30da-11ec-9798-915a6ecdc137"},"incident_date":"2015-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55eb59d81e36","org_name":"The Peninsula Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.canyon-news.com/peninsula-hotel-files-complaint-against-ex-employee-for-corporate-espionage/105613"}],"summary":"Peninsula Hotel Files Complaint Against Ex-Employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54e403bb04dd88b79e08d83d477e5502e364316d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"444497b0-89a3-11e7-bf1d-81579668407a"},"incident_date":"2015-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"8c0796ba0c5b","org_name":"Swedish Transport Authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/government/biggest-data-leak-in-swedens-history-punished-with-half-a-months-paycheck/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.itnews.com.au/news/sweden-exposed-sensitive-data-on-citizens-military-personnel-469046;"},{"fetched_at":null,"title":null,"type":"press","url":"https://edgylabs.com/swedish-data-breach-ibm/"}],"summary":"Swedish authorities are battling to contain a major privacy breach that has seen sensitive information on its citizens and the country's military leaked to companies and individuals outside the Nordic nation.  In 2015 the Swedish Transport Authority hired IBM to move the country'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"269b5a9ba05ff676b0b672b1f215e36b31eaaf35","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C078E1FE-3ED8-472F-BD39-A7D1F3D347A4"},"incident_date":"2015-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"26e36305cd59","org_name":"Prince Albert Parkland Health Region","org_type":"healthcare","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-prince-albert-parkland-health-region-employee-fired-for-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/2293463/patient-privacy-breach-in-the-prince-albert-health-region/"}],"summary":"An employee is no longer working for the Prince Albert Parkland Health Region after a privacy breach of patient health records. Officials with the region said an employee, who was not involved in their care, accessed the records of 22 patients.  The breach came to light in Septem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"514297f7dfa054193acf0c9073df7b836f1a512f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1A9700A-C2DB-4B95-985A-57B3F592F964"},"incident_date":"2015-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"705aac269bb2","org_name":"Preferred Care Pharmaceutical Services","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.postandcourier.com/article/20150911/PC16/150919818/1177/drug-tester-pharmacist-deny-wrongdoing-in-alleged-prescription-records-breach"}],"summary":"Pharmacist accesses state prescription database and provides information to another party. The two were going to provide the info to lawyers for use in family court cases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c1670fdb4c65d1d3ff997a5a836e262b2cdfcb9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8116a50-8f11-11e7-aa8f-5fa9d3670494"},"incident_date":"2015-09-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c11e45db5b1","org_name":"Palm Beach County Police Department","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/sensitive-details-of-police-operations-posted-on-city-of-west-palm-beachs-site-in-redaction-fail/"}],"summary":"For three long hours Friday morning, thousands of pages detailing secret law enforcement plans to take down local drug and gambling gangs — including the names of confidential informants and undercover agents — were published on the city of West Palm Beach’s official website, Gos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05f5e571ffadae4003d35bada7000cd3cb63e7af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"085F342B-04EE-48C3-A4A4-B82B05420A70"},"incident_date":"2015-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45a08d4dcf48","org_name":"North Shore-Long Island Jewish Health System","org_type":"healthcare","ransomware":null,"records_affected":18213,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/follow-up-company-involved-in-nsuh-lij-breach-folded/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-18000-north-shore-university-hospital-lij-patients-notified-8-months-after-data-theft-at-business-associates-offices/"}],"summary":"Five password-protected, but unencrypted laptop computers were stolen from Global Care Delivery, a business associate (BA) of the covered entity (CE), North Shore LIJ Health System in September 2014.  The laptops contained the protected health information (PHI) of 18,213 individu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25cc3ff981712a45f4d54f20e074298ee3825b2f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16c3a1f0-a7ad-11e7-9f87-7fffd7137a55"},"incident_date":"2015-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2176c26a3a09","org_name":"Memorial Hermann Health System","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.natlawreview.com/article/disclosure-single-patient-s-phi-leads-to-hefty-24-million-settlement"}],"summary":"A patient presented herself at a hospital with a fake health member card. The hospital called police and she was arrested. In the process, the hospital released protected health insurance information to the police and the media. The hospital was sued and had to pay a settlement o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02aa36bc5e1759e439f78a2eca747807c812d93c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6EB1BF0A-C6A2-4D1C-BB9E-3B3013D8B27A"},"incident_date":"2015-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ccecbc87ae6","org_name":"Lewis-Palmer School District 38","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/probable-security-breach-may-have-compromised-thousands-of-lewis-palmer-students-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/rostering-provisioning-owning-your-stack-and-transparency-a-look-at-lewis-palmer/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/rostering-provisioning-owning-your-stack-and-transparency-a-look-at-lewis-palmer/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://completecolorado.com/pagetwo/2016/05/24/probable-security-breach-may-have-compromised-thousands-of-lewis-palmer-students-data/"}],"summary":"probability that a security breach related to its Infinite Campus platform may have compromised more than 2,000 students' personal information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14aa682cd4abd265ed0253f081d7aebc209fdda5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"013EB45A-58BF-4B03-B4C0-992BB5C18E57"},"incident_date":"2015-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33f54bba93d3","org_name":"Harbeson Deli","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://capegazette.villagesoup.com/p/credit-card-information-stolen-from-harbeson-gas-station/1443449"}],"summary":"gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f111be657ea4dd4ab1a2f390d5f755b56f10e7b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1866145A-1814-4A66-89F0-1ADD79D969A0"},"incident_date":"2015-09-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f2e6ef98cba4","org_name":"Faithless","org_type":"technology_saas","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/faithless-fans-suffer-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mixmag.net/read/18-000-faithless-fans-have-their-details-stolen-in-website-hack-news"}],"summary":"British electro band Faithless have had their personal details stolen,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f70bcc782814202b15e642ca4f39fe86448e0bc7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FEC21E7-F3EA-4FB8-B1E1-CBCC7C6929FF"},"incident_date":"2015-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e90b1c9cc099","org_name":"CVS pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/new-york/nyc-crime/cops-hunt-2-atm-skimming-gangs-stolen-16-6g-article-1.2501304;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.metro.us/new-york/photos-police-seek-two-separate-atm-skimming-duos/zsJpas---rHuaD73W5lrg/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57763"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8b2040e79e8d118c79b98c0d21230208d14989e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A3CAF15-13A2-4A8D-81CA-94A81EFA9382"},"incident_date":"2015-08-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66556f2291b9","org_name":"Walpole Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ma-ssns-addresses-inadvertently-posted-on-walpole-police-dept-s-website/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox25boston.com/news/ssns-addresses-inadvertently-posted-on-walpole-pds-website/434128779"}],"summary":"PII was accidently placed on Police Website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"546bec3f07b067f95b49b8954b13a866cbdea017","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D76A375E-6B3A-441F-95FC-5254EFD987E0"},"incident_date":"2015-08-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c0de6ec04732","org_name":"Joseph Brant Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thespec.com/news-story/6554398-privacy-breach-at-joseph-brant-hospital-leaves-more-questions-than-answers/"}],"summary":"Privacy breach at Joseph Brant Hospital leaves more questions than answers.  nurse at Joseph Brant Hospital snooped in his electronic patient record.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a145a72f2efeadd9bab889933138b741a1fd0dd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7282B5EE-0535-454B-AAC1-1357E55CF379"},"incident_date":"2015-08-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a19968c321ba","org_name":"Kindred Transitional Care and Rehabilitation","org_type":"other","ransomware":null,"records_affected":1125,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Lawton%20notice%20-%20deidentified_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/kindred-transitional-care-and-rehabilitation-patients-notified-after-computer-theft/"}],"summary":"Patients at Kindred Transitional Care and Rehabilitation __ Lawton are being notified that a computer containing limited health information was stolen from a locked office. Kindred learned of the theft on August 31, although it may have occurred as early as August 28.  In a lette","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95f33f53fc6fe61d24a9e03d95d15eb340ce673f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B124687D-155B-4EED-BACF-E90D902E8F93"},"incident_date":"2015-08-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19b875ef578a","org_name":"Valley Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":164,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fresnobee.com/news/local/article38038617.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.documentcloud.org/documents/2451168-15cecg02967-1.html"}],"summary":"Doctors accessed medical records in attempts to solicit patients to new practice.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7532022f8f023e565997a62afcd22491cc88c6d2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEEF5903-24F4-42D3-91B6-5D2091CC5D7D"},"incident_date":"2015-08-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"348bdaaa1703","org_name":"strawberrynet","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2016/08/22/strawberry_net_security_fail/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://forums.whirlpool.net.au/forum-replies.cfm?t=578654"}],"summary":"Company site allows users to put in their email address, and it returns their customer data in plain text.  They consider this a usability feature of their site.  Security personnel consider it irresponsible and insecure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-08-26","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d707fd334192b3b1074148c87ba5356f8ddc1c0","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-06-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SOPER%20NOTIFICATION%20LETTER_0.pdf"},"notes":null,"org_country":"US","org_id":"f5ec409e0a12","org_name":"Robert Soper","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57565"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SOPER%20NOTIFICATION%20LETTER_0.pdf"}],"summary":"A computer containing patient information was stolen from Robert Soper’s car, with no indication that the information was accessed or used.","supporting_quote":"During a visit to San Francisco On June 27 my car was broken into and my computer stolen, along with camera, suitcases, and other equipment.","technology_involved":["office desktop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe8aff5619ca87d30f494adc7ecb4367fb5778aa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA87D038-14FE-4404-A114-87C1278E0862"},"incident_date":"2015-08-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"846b9a0a6f12","org_name":"Marin Healthcare District","org_type":"healthcare","ransomware":true,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/two-more-ransomware-attacks-both-organizations-pay"}],"summary":"ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63ea9cfa1a040c61a014ee88249eced7091d1524","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73C12AF5-D2CF-4964-8162-176E9B627AA3"},"incident_date":"2015-08-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"213aa5142412","org_name":"American Family Care","org_type":"healthcare","ransomware":null,"records_affected":7200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/american-family-care-notifies-7200-patients-of-breach-involving-phi/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/american-family-care-announces-7200-patient-phi-breach-3529/"}],"summary":"American Family Care notifies 7,200 patients of breach involving PHI   An unauthorized individual gained access to systems used to store ePHI on multiple occasions over a period of 10 months. Affected individuals had a limited amount of PHI exposed on CDs containing X-ray images ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2015-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e68cb8074c75940a5887d99105ef8eaa56d03d30","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"272B6C40-A466-4AE3-B176-5C322E4F9C18"},"incident_date":"2015-08-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"564ae1e780fd","org_name":"Northeast Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fosters.com/article/20150830/NEWS/150839952"}],"summary":"ATM skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"269a2ebb33bf1b026cb61e5db238a69b633b3608","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9584.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"89426dfe38fd","org_name":"Olympia Hotel Management, LLC","org_type":"unknown","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9584.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/OlympiaHotelManagement%2CLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-08-21","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57e882f47eb47398fac6559ba95e9ec992b24d1f","impact_type":"data_theft","incident_date":"2015-07-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice_1.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"4458b078d35b","org_name":"M&M Automotive Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57502"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice_1.pdf"}],"summary":"M&M Automotive Group reported that a break-in at its dealership led to the theft of archived files containing personal and financial information.","supporting_quote":"The vandalism involved the theft of a vehicle and boxes of archived files from the secured storage room located on the third floor.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f3ac6e8a1ad6b748c957135a060505c556e11ac","impact_type":"unknown","incident_date":"2015-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BPG%20incident_Customer%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fa5fdf4e5c28","org_name":"Buyers Protection Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57473"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16ea7fea420214093532c95c11fbcab4ebcd10b3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79322318-A449-4FA1-A723-4CB5AF10AAA7"},"incident_date":"2015-08-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"111156320110","org_name":"North Carolina Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":1615,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/nc-dhhs-reveals-potential-medicaid-data-breach/14975745/"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/dhhs-has-second-email-health-data-breach-in-two-months;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/north-carolina-dhhs-reveals-524-patient-record-data-breach-8182/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/dhhs-discloses-second-medicaid-data-breach/15106827/"}],"summary":"Spreadsheet with PII sent unencrypted via email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","other"],"disclosed_date":"2015-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"531c50a53caa602c84a4bd7963a3692b474af81e","impact_type":"both","imported_from":null,"incident_date":"2015-07-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2186d2882116","org_name":"Ashley Madison","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Ashley Madison","type":"hibp","url":"https://haveibeenpwned.com/Breach/AshleyMadison"}],"summary":"Attackers threatened to disclose Ashley Madison's breached database, which was later dumped with more than 30 million unique email addresses.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9019b16f0dd09a587ab699ff5af1d077fee8eb8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EC0C032-046D-4B83-BE4C-A251903D7450"},"incident_date":"2015-08-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-aug-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-sep-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-oct-2015.pdf"}],"summary":"Patient A received a Medline Industries medical supply intended for Patient B. Patient B's name and type of medical supply was compromised. Patient A reported the incident to the medical center and a replacement has been requested for Patient B. Great Lakes Consolidated Mail Outp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"691314929da13931e81490fa21d10f6a0753e9c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D722108-9104-4836-AA53-0732BADDB08A"},"incident_date":"2015-08-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b2a2a5ab037","org_name":"University Hospitals Geauga Medical Center","org_type":"healthcare","ransomware":null,"records_affected":677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-information-on-some-geauga-medical-center-patients-improperly-accessed/"}],"summary":"nformation on some Geauga Medical Center patients improperly accessed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0caeaa1dd50d68c352a5b74172a68a2caf780c87","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-03","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/48478108_3_0.pdf"},"notes":null,"org_country":"US","org_id":"655d5a8e209f","org_name":"Lee's Deli","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57419"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/48478108_3_0.pdf"}],"summary":"Lee's Deli reported that malicious software designed to capture payment card information was installed on point-of-sale systems at two locations.","supporting_quote":"We recently learned that unauthorized individuals installed malicious software on computer systems used to process credit card transactions at our Lee’s Deli location s at 75 Battery Street in San Francisco , CA and 4200 Bohannon Dr ive in Menlo Park, CA.","technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff73e02de614518216895a8c8bff3b7a0b884b86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D373EC7E-3DCD-441F-AD02-B43225266961"},"incident_date":"2015-08-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5766dbd98486","org_name":"Investors Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/burlington/index.ssf/2016/08/atm_skimming_device_found_at_mansfield_bank.html"}],"summary":"ATM Skimmer in place for two days","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3959a608d10525c7b20f6e8754c460655a61ff37","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"041EDDA8-680A-42CF-AED0-15723AB5CCBC"},"incident_date":"2015-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9583.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc96fd0a0967","org_name":"Web.com","org_type":"technology_saas","ransomware":null,"records_affected":93000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.marketwatch.com/story/webcom-reports-cyber-breach-2015-08-18"},{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9583.pdf"}],"summary":"Web.com, WWWW reported that it discovered an unauthorized breach of one of its computer systems on August 13, 2015. As the result of this attack, the credit card information of approximately 93,000 customers (of the company's over 3.3 million customers) may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b8e27fca33b37dad32ec7fbdb755b0412ba2815","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"401A786C-1C53-43BD-BA3E-EBB4A1C4264C"},"incident_date":"2015-08-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"244ef3bf9cb2","org_name":"Landmark Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kten.com/story/29791919/thieves-hack-local-atm-machine-stealing-customers-data"}],"summary":"MARSHALL COUNTY, OK -- Local police are urging you to check your bank statements after an ATM in Madill may have been breached.  Police say the ATM at Landmark Bank at Walmart was tampered with Thursday morning.  They say someone put a device on the card reader that collected peo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c701cdd942fe27123ef873708ad9714f5278d06b","impact_type":"unknown","incident_date":"2015-07-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Greenlight%20Incident_CA_%20Notification081015_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"84a3b1176919","org_name":"Nationstar Mortgage LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57381"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"992c590cea53df862ad93a2df75576f7078a5cc6","impact_type":"data_theft","incident_date":"2015-07-31","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ICANN.org%20Email%20Notification%20Sample%20to%20CA%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"0e5f7a6b6984","org_name":"Internet Corporation for Assigned Names and Numbers","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Unauthorized access to an external service provider resulted in encrypted passwords being obtained.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ICANN.org%20Email%20Notification%20Sample%20to%20CA%20AG_0.pdf"}],"summary":"ICANN reported that usernames, email addresses, and encrypted passwords for ICANN.org profile accounts were obtained through unauthorized access to an external service provider.","supporting_quote":"While investigations are ongoing, the encrypted passwords appear to have been obtained as a result of unauthorized access to an external service provider.","technology_involved":["ICANN.org public website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d7d123c75d0a976a26be7393386441952f27645","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D109048-9610-49A5-BE1C-BC6F1865C614"},"incident_date":"2015-08-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79e932bea729","org_name":"Common Market","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/permalink.php?story_fbid=906091222806635&id=126951340720631;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/common-market-in-maine-notifies-customers-of-payment-card-breach/"}],"summary":"Common Market in Maine notifies customers of payment card breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b6e1a032127ae089d831f3d789c9ebfea2b20e6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B29C8B0C-CE40-4C37-8F7F-126B777063CB"},"incident_date":"2015-08-11","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da56df3de8f7","org_name":"Yellowfront Grocery","org_type":"retail_ecommerce","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/yellowfront-grocery-notified-customers-via-facebook-of-pos-breach/article/450345/"}],"summary":"POS Intrusion","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee82a7794ebbe470873350feec17fea689be685f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-12","outcome":"no_text","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9582.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"358ea063f70c","org_name":"Sterling BackCheck","org_type":"unknown","ransomware":null,"records_affected":1419,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Washington AG data breach notification","type":"state_ag","url":"https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9582.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3275a011adaa79c499e5a1428f73eb6c1f59640","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B027FEC2-A8EA-4F59-81F3-F0747619449E"},"incident_date":"2015-08-09","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c89647a447c","org_name":"Time Warner Cable Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nm-fired-by-roadrunner-former-employee-allegedly-took-revenge-by-hacking-them-and-re-routing-customer-service-calls/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abqjournal.com/686455/news/long-list-of-charges-await-alleged-hacker.html"}],"summary":"former employee hacked and rerouted calls","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ed4e0cb1b634b47cbdd1ff761434f1ef31eae07","impact_type":"data_theft","imported_from":null,"incident_date":"2013-11-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"97ff744dfa90","org_name":"XSplit","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: XSplit","type":"hibp","url":"https://haveibeenpwned.com/Breach/XSplit"}],"summary":"A November 2013 breach of XSplit exposed names, email addresses, usernames, and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1bd6afaa9e53750982123e73626cde88419bbb0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC466FF8-B065-4140-BD37-8CD89D1B5860"},"incident_date":"2015-08-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ab2ef422b63","org_name":"Sacramento County","org_type":"government","ransomware":null,"records_affected":843,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/sacramento-county-data-exposed-for-nearly-a-year/article/519085/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Updated%20Sac%20Co%20Notice_0.pdf?"}],"summary":" error in the county's automated application system within the Accela software","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d537db89431f0e7cb6bed9b9a1ef48f47f8cce1d","impact_type":"unknown","incident_date":"2015-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Exhibit%20A_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"331bf9895c2c","org_name":"SterlingBackcheck","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57330"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Sterling_Backcheck.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ab8e5a0e82cf80ddaa230d6f3714ae2d319de97","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wattpad%20-%20Consumer%20Notice_1.pdf"},"notes":null,"org_country":"US","org_id":"d3d66600bca1","org_name":"Wattpad","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57318"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wattpad%20-%20Consumer%20Notice_1.pdf"}],"summary":"Wattpad reported that an attack against its system may have accessed account information, including email addresses, passwords, IP addresses, and profile information.","supporting_quote":null,"technology_involved":["Wattpad"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f168883170505051062710cb13b5670544d73aa0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D034884-E735-4207-B6AF-6628D818A208"},"incident_date":"2015-08-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ab1ce9d431f","org_name":"Max M Bayard MD, PC","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.maxbayardmd.com/PatientPortal/MyPractice.aspx?UAID=%7b0EFA4E79-AE25-42B2-95BE-D1ACA63D35E1%7d&TabID=%7b103%7d"}],"summary":"On August 5, 2015, the offices of Max M. Bayard, MD PC were broken into and computer devices were stolen.  As soon as the theft was discovered, we notified law enforcement and are cooperating with their investigation.  Immediately after the break-in, we began an investigation to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"028ea30276d916945b46ffc8c203588f770663d9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95FBF0F8-537A-4B2B-9614-377CC02FE3FF"},"incident_date":"2015-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c4b52245e2f","org_name":"Excellus Bluecross BlueShield","org_type":"financial","ransomware":null,"records_affected":10500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.scmagazine.com/excellus-bluecross-blueshield-announces-breach-105m-records-at-risk/article/437651/;http://www.democratandchronicle.com/story/news/2015/09/09/excellus-announces-august-breach-system/71949658/;http://oag.ca.gov/ecrime/databreach/reports/sb24-57740;http://www.excellusfacts.com/index.html;http://www.excellusfacts.com/faq.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.democratandchronicle.com/story/news/2016/03/02/breach-cost-excellus-17-million-2015/81233256/"}],"summary":"Rochester, NY-based Excellus Bluecross BlueShield (BCBS) and affiliate Lifetime Healthcare Companies (LTHC) have been breached.  The health insurance organizations learned in early August that unauthorized access was gained to IT systems in late 2013, and personal information on ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"247d223c16354cbd539fb076eb35bb2ae5143a5e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D375844-DBF3-4441-AEE3-886C6187D4FB"},"incident_date":"2015-08-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1c61427fbff","org_name":"Columbia Eye Care","org_type":"healthcare","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"safe was stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-08-04","discovered_date":"2015-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff3744fecbbd06598f389d962701794af689791b","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MM%20US%20letter%20to%20customers%20-%20data%20breach_0.pdf"},"notes":null,"org_country":"US","org_id":"01a4a2a46a9c","org_name":"Mama Mio US, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57280"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MM%20US%20letter%20to%20customers%20-%20data%20breach_0.pdf"}],"summary":"Mama Mio US, Inc. reported a cyberattack on its website that may have compromised customers’ personal and payment-card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c69ed495f73b61fbf039dd05bcdfe2c610d03d1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F37143C-32BC-4705-9C9B-22CCEA810A2A"},"incident_date":"2015-08-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ade7fc6c6c0","org_name":"Yuba-Sutter Medical Clinic","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-yuba-sutter-medical-clinic-discloses-august-ransomware-attack/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63841"}],"summary":"Ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c3bc58ce3f7a11674697196e24d0222a14ffaf1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70BA9914-BA7B-4737-AA12-F12A1AC17A8E"},"incident_date":"2015-08-03","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8d89e02f94b","org_name":"Wheeler & Egger CPA's","org_type":"professional_services","ransomware":null,"records_affected":45,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63840"}],"summary":"firm has malware to steal data form IRS filings","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-08-03","discovered_date":"2015-06-02","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2319446684dc0f9df7d9dfd5cc59e8a66c3259b3","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/dyoco%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"adfef9598480","org_name":"Olartino Dyoco","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57245"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/dyoco%20notification_0.pdf"}],"summary":"A burglary at Olartino Dyoco's office resulted in the theft of computers containing patient billing and personal information.","supporting_quote":"On June 2, 2015, Dr. Dyoco opened his office and found the office had been burglarized.","technology_involved":["computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61369a0bf86d290a8f67bfec5d81f7c9de1ae0f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CB79FD2-124E-4B68-A73D-4F58913EE1EB"},"incident_date":"2015-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-so-thats-what-happened-to-160000-walgreens-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/"}],"summary":"Walgreen Co. reported that 160,000 patients had PHI involved in an August 1st __ November 6th breach involving paper records.  I was unable to find any coverage of this, but this could be big, as Walgreen has had problems before with paper records, and was even fined in the past.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0555c9b2faf85202430d2f95473d651f68d75154","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4DE22AE-C849-4A06-9854-989CB2993D91"},"incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"467f7ad4b6f8","org_name":"Transportation Security Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-luggage-keys-leaked-photos/"}],"summary":"Lockpickers 3-D Print TSA Master Luggage Keys From Leaked Photo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fb319ab109f466a7742ce05964944be989333d4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E55579F9-169E-475F-B799-9BBF48FC234F"},"incident_date":"2015-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31f3924fccb4","org_name":"Sentara Heart Hospital","org_type":"healthcare","ransomware":null,"records_affected":1040,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.13newsnow.com/story/news/local/mycity/norfolk/2015/10/02/hard-drives-patient-information-stolen-sentara-heart-hospital/73225506/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/stolen-computer-hard-drives-lead-to-health-data-breach-in-va;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2015/10/1040-patients-notified-security-breach-sentara-heart-hospital"}],"summary":"The August theft of two portable hard drives from Sentara Heart Hospital's electrophysiology labs led hospital officials to send letters about a security breach this week to 1,040 patients.  The theft occurred during the weekend of Aug. 14. The patients who were informed had test","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2247551ce8187cf3109608ed0697cb051e5e60e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9CD0944-50E8-4C90-953A-39B116A2CB7A"},"incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"22fb53e33b4e","org_name":"Scottrade","org_type":"financial","ransomware":null,"records_affected":4600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/scottrade-brokerage-firm-hacked-data-for-4-6-million-customers-stolen-493516.shtml;http://www.pcworld.com/article/2988993/security/scottrade-had-no-idea-about-data-breach-until-the-feds-showed-up.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://about.scottrade.com/updates/cybersecurity.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miltonstart.com/blog/2015/11/16/scottrade-fined-for-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://about.scottrade.com/updates/cybersecurity.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2015/10/gigabytes-of-user-data-from-hack-of-patreon-donations-site-dumped-online/"}],"summary":"Law enforcement officials contacted Scottrade, a US brokerage firm, and informed them of a data breach in one of their servers, which led to the disclosure of personal details for 4.6 million of their clients. According to a company press release, the incident seems to have taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f74688c5515ac8651ec4e972638a27f3a37b53ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED3B1A28-071C-41A9-9293-CB9B92495B04"},"incident_date":"2015-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"19e17e569125","org_name":"Sanrio Co Ltd","org_type":"manufacturing","ransomware":null,"records_affected":6249,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hello-kitty-shareholders-personal-information-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2015/12/hello-kitty-hack"}],"summary":"Hello Kitty leaked PII of shareholders","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2668f00416d6951686873106d5cd4534a14e26d4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0b29cb40-a189-11e8-a73d-8bf9996ed0ad"},"incident_date":"2015-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f5c7b9abb67","org_name":"Okanogan County Police Department","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inlander.com/spokane/blame-the-russians/Content?oid=11333979"}],"summary":"Judge Culp determined that he had no choice but to scrap the entire case after law enforcement withheld the fact that crucial evidence — cell phone data from one of the victims — had been corrupted by ransomware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"997a438115e56dcb3b7693baaf737958e7f536d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D65463C9-8427-4492-B064-68F030E203F8"},"incident_date":"2015-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9660697ba031","org_name":"Moyer's Car Care Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pahomepage.com/news/skimming-device-found-on-schyulkill-haven-gas-pump;"},{"fetched_at":null,"title":null,"type":"press","url":"http://republicanherald.com/news/police-urge-moyer-s-car-care-customers-to-check-credit-card-statements-1.2082247;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pahomepage.com/news/skimming-device-found-on-schyulkill-haven-gas-pump;"},{"fetched_at":null,"title":null,"type":"press","url":"http://republicanherald.com/news/police-urge-moyer-s-car-care-customers-to-check-credit-card-statements-1.2082247"}],"summary":"skimmer on gas pump","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"015ddb998b8d290ab92765cedd1767b9477f546c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55C892B6-5289-4689-A6FF-1886DBA0CBDF"},"incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"019e3528dcdd","org_name":"Kettering General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/exclusive-kettering-general-hospital-investigating-email-data-breach/article/439350/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northantstelegraph.co.uk/news/top-stories/experts-investigating-alleged-breach-of-it-security-at-kettering-general-hospital-1-6969074"}],"summary":"Kettering General Hospital's IT security has been breached by a well-known Russian hacking group, which has started using the hospital's email server to send spam emails advertising illegal goods on the dark web according to penetration tester and social engineering expert Richar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb159c427bae415d61866b8109fafc2e88a9b69b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC50DD6B-D44D-4B65-92FE-67C4A1AFF698"},"incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff9104bf84e5","org_name":"Global Financial Services Company","org_type":"financial","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/former-employee-of-global-financial-services-company-charged-with-unauthorized-access-of-supervisors-email-account-on-approximately-100-occasions/"}],"summary":"Former Employee, KRISTOPHER ROCCHIO, Of Global Financial Services Company (speculated to be Western Asset Management) Charged With Unauthorized Access Of Supervisor's Email Account On Approximately 100 Occasions","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a490f1704cf57b27d78e303257441dc207d5557","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0EA47BA-AC2C-4FF7-877A-09F577779F02"},"incident_date":"2015-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5dc81414ba74","org_name":"Elephant Bar","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/elephant-bar-alerts-customers-to-possible-payment-card-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcsandiego.com/news/local/Security-Breach-at-Restaurant-Chain-Elephant-Bar-May-Affect-Customers-Cards-Across-7-States-361080981.html"}],"summary":" malware on the point-of-sale and payment card processing systems caused the loss of customer data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c584a7e089b0a29f9e9f0974b8efb6351e2751bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CDADB0E-AB25-4024-AF22-212130488387"},"incident_date":"2015-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc1820796440","org_name":"Dakota County","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/former-dakota-county-employee-pleaded-guilty-in-data-breach/368513991/"}],"summary":"sent report to home email and then leaked it to media","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a8d544b82190daf0c66a48f8526be92b8c101db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5175490C-8BE0-4F78-BEAF-89B772EC2A62"},"incident_date":"2015-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"910947b07615","org_name":"CVS","org_type":"retail_ecommerce","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/news/local/Skimming-Device-ATM-Thefts-Manhattan-Queens-372610252.html"}],"summary":"ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d841f4c07f45bcb111a25ef26ebbf6adee61d29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EA88F5A-F26B-4BE3-95BC-18D593860FB4"},"incident_date":"2015-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b16f3f295b85","org_name":"Cooper Standard","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lex18.com/story/32694849/hr-employee-investigated-in-identity-theft-allegations"}],"summary":"of identity theft by an employee in the company's human resources department","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9aa36f76245fb9f796d9634f2b6de227ed5e4de","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74FF797A-1C82-4F04-859E-99CCCBE8429C"},"incident_date":"2015-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a3cf2de977f","org_name":"Cisco","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cisco-jobs-portal-exposed-personal-data/"}],"summary":"Wrongly configured security settings in a Cisco portal used for job applications has resulted in the leak of personal data online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fdb46c162d05d2f3c1bbdb44c1ca37f65718486","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"530FFCA7-123E-47E7-800E-93254296994A"},"incident_date":"2015-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff5b3e633273","org_name":"Carilion Clinic","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.propublica.org/article/clooney-to-kardashian-celebrities-medical-records-hospital-workers-snoop;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.roanoke.com/business/news/carilion-employees-disciplined-for-violating-patient-privacy-in-high-profile/article_4b0a0109-a84d-55cb-a41e-dd32316a6370.html"}],"summary":"Carilion Clinic in Roanoke, Virginia, fired or disciplined 14 workers for peeking at a patient's medical records in a high-profile case. The patient was reportedly the mother of a five-year-old boy who was found dead in a septic tank near his home.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"NG","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d9394fa41b8168af2396dff4a3d1ab0c47bd2d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C40D9A65-15CA-4F96-8AD7-16580C90A4E1"},"incident_date":"2015-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e15eef264119","org_name":"Boston University","org_type":"education","ransomware":null,"records_affected":174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"phishing email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"651b4c15653ec1fc177659170f999183a8d36b3e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99840D17-37D0-4089-886F-91B69BFE8163"},"incident_date":"2015-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb84c704ea2b","org_name":"Barrington Orthopedic Specialists","org_type":"healthcare","ransomware":null,"records_affected":1009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/equipment-containing-patient-data-stolen-from-illinois-orthopedic-provider/article/442044/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.barringtonortho.com"}],"summary":"Illinois-based Barrington Orthopedic Specialists is notifying more than a thousand patients that a laptop and EMG machine containing their personal information were stolen.  How many victims? 1,009.  What type of personal information? Names, dates of birth, and EMG results and re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06794aeb56a8abf182be286b649fe09369fc9caf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFAEFB6F-999E-4565-B532-EAD47273B100"},"incident_date":"2015-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/massachusetts/falmouth/bank-america-customers-beware-atm-skimmer-found-north-falmouth-0"}],"summary":"ATM Skimmer discovered","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb009a2a6d1ff4c60b5c6dc377b224c4f70c6543","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5332700C-3A03-4DCF-BE93-C4010B2583ED"},"incident_date":"2015-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"232ef0be538b","org_name":"AutoZone Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":162000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/50000-autozone-customers-data-hacked-exposed/"}],"summary":"AutoZone, a leading American retailer of auto parts, has reportedly been hacked by @JM511.  This afternoon, JM511 announced the hack of the AutoZonePro.com site on Twitter. The linked paste included 49,967 customers' details: billing addresses (street and city), email addresses, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12f097de52df7f5507db7848708b53f7702b2d5f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"195860d0-bf0a-11e7-a9c6-17df034f6c5e"},"incident_date":"2015-08-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03ab359a9a2b","org_name":"American Pacific Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.scmagazine.com/american-pacific-mortgage-files-lawsuit-against-insurer-to-reclaim-losses-due-to-bec-attack/article/684875/"}],"summary":"American Pacific Mortgage files lawsuit against insurer to reclaim losses due to BEC attack ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccf46f9600a8f27516afe2a9b3cb9a8d635cf556","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92F3793E-C5E9-4A8A-8477-9A2C329DECE3"},"incident_date":"2015-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03774c15f048","org_name":"All Rehab & Repair","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/stlouis/news/2016/08/04/all-rehab-repair-owner-indicted-for-fraud.html"}],"summary":"indicted on fraudulent use of access devices, mail fraud and aggravated identity theft charges after allegedly using the personal information of several business customers to obtain credit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f68a13dba3f7a08cb3ce0f733714c407d56d711e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"861B4F09-125C-4730-945F-FFB1599F3267"},"incident_date":"2015-07-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BW","org_id":"c60590c77f48","org_name":"Rural Administrations Centre","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mmegi.bw/index.php?aid=53044&dir=2015/august/03"}],"summary":"Confidential govt files stolen - Rural Administrations Centre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08d3345b0a1fd44bd2f441534009e11ae6d4a2de","impact_type":"unknown","incident_date":"2015-06-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/AG%20Sample%20Notice%20073115_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"036e14b5c0dd","org_name":"Orange County Employees Association","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57215"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5424c381ee4bc294206e185e99a90ddaf85f3d03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16C98F9A-7BE8-4D09-908B-38CA0D15520A"},"incident_date":"2015-07-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ee4d916ec68","org_name":"Huntington Medical Research Institutes","org_type":"professional_services","ransomware":null,"records_affected":4300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/huntington-medical-research-institutes-discovers-two-hipaa-breaches-8174/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/calif.-facility-reports-two-healthcare-data-breaches"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/calif.-facility-reports-two-healthcare-data-breaches;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/huntington-medical-research-institutes-discovers-two-hipaa-breaches-8174/"}],"summary":"The second healthcare data breach was reported on October 20, 2015 and happened when a former HMRI employee potentially took some ePHI when the employee left HMRI on July 31, 2015. The research institute said that it learned about the incident on August 20, 2015.  The HMRI statem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ead5733940cccbfd39e22a49817b6f0249ee8e12","impact_type":"unknown","incident_date":"2012-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"6bfb90fa764c","org_name":"YouPorn","org_type":"unknown","ransomware":null,"records_affected":1327567,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: YouPorn","type":"hibp","url":"https://haveibeenpwned.com/Breach/YouPorn"}],"summary":"In February 2012, the adult website YouPorn had over 1.3M user accounts exposed in a data breach . The publicly released data included both email addresses and plain text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"229f9c844189a4d522e4c57584485a18687ce481","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA2AE973-3617-45E1-AB99-3D19643652B3"},"incident_date":"2015-07-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"97267d497aea","org_name":"Cowboy Casino","org_type":"other","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cowboys-casino-warns-personal-information-may-have-been-leaked-in-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.660news.com/2016/06/03/cowboys-casino-warns-personal-information-may-have-been-leaked-in-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/cyber-attack-cowboys-casino-1.3616389"}],"summary":"Cowboys Casino is investigating a possible data breach after its computer system was the target of a cyber-attack.  The establishment says its IT experts took immediate actions and they are confident they have secured the system.  It's believed some client, employee and corporate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-29","discovered_date":"2015-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8adfd7bec9393d137e0810d1242a3fcf1f2a8692","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/East%20Bay%20Perinatal%20Medical%20Associates%20Ad%20r6fin_0.pdf"},"notes":null,"org_country":"US","org_id":"bf30f495eb34","org_name":"East Bay Perinatal Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/East%20Bay%20Perinatal%20Medical%20Associates%20Ad%20r6fin_0.pdf"}],"summary":"A patient list containing names and dates of birth was found on an employee’s personal laptop and permanently deleted.","supporting_quote":null,"technology_involved":["personal laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d96a162106ea89d5e7710a3e65cc4accc06edf93","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-07","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20template%207.24.15_0.pdf"},"notes":null,"org_country":"US","org_id":"6cded446ef84","org_name":"Golden 1 Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee engaged in unauthorized activity involving member accounts.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57170"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20template%207.24.15_0.pdf"}],"summary":"A Golden 1 Credit Union employee engaged in unauthorized activity involving member accounts, making personal and financial information available for viewing.","supporting_quote":"We have discovered that a person employed by us from early April to mid-June of this year appears to have engaged in unauthorized activity involving a small number of member accounts.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c0eb259a83e9ca45f0361397c01ec3b91489d0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4766EBBD-54B5-4F79-9421-2D9C7D3ADCA1"},"incident_date":"2015-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b4559e7c2906","org_name":"PLS Financial Services","org_type":"other","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Master%20Notification_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/pls-financial-acknowledges-security-breach.html;http://www.oag.state.md.us/idtheft/breachNotices2013.htm"}],"summary":"Poan and check cashing company PLS Financial Services recently began notifying an undisclosed number of customers that their names, addresses, e-mail addresses and Social Security numbers may have been exposed as a result of a programming error (h/t DataBreaches.net).  \"We learne","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"795fdd5cc1d4fbea47e25852d3190dc500b7c5a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B68FE23A-B006-4358-A88F-427D7A0E17C2"},"incident_date":"2015-07-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"439f203e6252","org_name":"Natrona County Sheriff's Office","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://trib.com/news/local/crime-and-courts/detention-officer-pleads-not-guilty-to-releasing-confidential-information-about/article_5e2c6a23-7586-5495-b682-bd7043c450fc.html"}],"summary":"Detention officer release confidential information to his family about a rape case","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e01ec0a7bf9de460ccfb6e100b4dea03de11476f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C2C2351-AC07-4EFD-9964-2EB451C8654D"},"incident_date":"2015-07-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5add929c2d4e","org_name":"Marin Medical Practices Concepts","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/curtis-f-robinson-m-d-notifies-patients-after-ransomware-attack-on-emr-provider/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.marinij.com/health/20160929/marin-patients-medical-data-lost-after-cyber-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northbaybusinessjournal.com/industrynews/6143426-181/marin-health-care-district-ransomware-virus?artslide=0;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/marin-medical-practice-concepts-remains-silent-about-ransomware-attack-on-patient-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mercurynews.com/2016/08/05/marin-electronic-medical-record-system-hacked-ransom-paid/;"}],"summary":"Marin Medical Practices Concepts electronic medical record system hacked, ransom paid  The computer records of Marin Medical Practice Concepts, a Novato company that provides medical billing and electronic medical records services to many Marin physicians, were hacked on July 26.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb196e544b00d2fc0353c4ab651495e0db0725ee","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD918C60-167E-48C6-8075-CB90CFBAE761"},"incident_date":"2015-07-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d903f97b7d2a","org_name":"Urology Associates","org_type":"healthcare","ransomware":null,"records_affected":6500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/potential-health-data-breach-for-montana-urology-clinic;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyinterlake.com/members/vandal-gains-access-to-medical-files/article_c0e991ec-3984-11e5-a151-777a42ceb9bb.html;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"A Montana urology clinic reported a potential health data breach after it discovered in May that its storage unit that housed patient records was broken into and patient data was possibly accessed.  Urology Associates sent data breach notification letters to patients, practice ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb0c5097c55a86f4a604410106288e28681ccd79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB3095ED-717B-4068-ACDC-C70B85B835CB"},"incident_date":"2015-07-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7416cc23796","org_name":"Orthopedic & Sports Therapy","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/crime/index.ssf/2015/10/trio_stole_more_than_200000_fr.html"}],"summary":"Trio stole more than $200,000 from Metairie couple in identity theft case - Orthopedic & Sports Therapy.  Actors arrested and booked with identity theft and hundreds of counts of computer fraud and credit card fraud. In just over two months, the trio used reissued debit cards on ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1335323ea9dce2b98e54b77f8107a2a9a689952f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cust%20Notif%20Template%20for%20Regs%20IDGrd_1%20Revised%207-23-2015_0.pdf"},"notes":null,"org_country":"US","org_id":"9cafa450d027","org_name":"HSBC Bank USA, National Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57157"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cust%20Notif%20Template%20for%20Regs%20IDGrd_1%20Revised%207-23-2015_0.pdf"}],"summary":"HSBC reported that account documentation containing personal and financial details was sent in error to an unrelated commercial entity, which did not view it and deleted it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2015-07-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc8a6a2b629f75a70e42200e2f7afca106f63998","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"126A061A-B511-4260-BCC4-31B159FA289D"},"incident_date":"2015-07-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"696a6a4354d5","org_name":"European Central Bank","org_type":"financial","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2955278/data-breach/european-central-bank-hacked.html"}],"summary":"European Central Bank Web site was victim to Cyber Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0974c5c71f627069fa6ad4e957ad201863c53e30","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Online%20-%20Customer%20Letter%20-%20C2015040121_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57108"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57120"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57154"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57169"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57567"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Online%20-%20Customer%20Letter%20-%20C2015040121_0.pdf"}],"summary":"American Express notified cardmembers that a merchant had detected unauthorized access to website files containing their card information.","supporting_quote":null,"technology_involved":["merchant website files"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"ee7be84ce628673434ce761c7835d05449bd911b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/LatexConstructionCompany.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3306f715ace2","org_name":"Latex Construction Company","org_type":"unknown","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/LatexConstructionCompany.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5b1669a1aeb7225b59c811098656a6cefac8056","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50CFA3A4-E6F3-4125-B18C-F4818A8A4278"},"incident_date":"2015-07-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb14165d2337","org_name":"Oklahoma University","org_type":"education","ransomware":null,"records_affected":9300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/laptop-theft-affects-thousands-of-ou-medicine-patients/article/447709/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oumedicine.com/urology/media-release-regarding-theft-of-laptop"}],"summary":"Roughly 9,300 individuals are being notified that a laptop containing personal information was stolen from a physician who formerly worked for the University of Oklahoma Department of Urology.  How many victims? About 9,300.  What type of personal information? Names, diagnoses an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaefeacbce217ed06725f17c11143b2d668f8b7c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1812C678-88E1-4F16-BFDD-F5FEC5DF21FF"},"incident_date":"2015-07-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"709cdbf27987","org_name":"LSU Health New Orleans School of Medicine","org_type":"education","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksla.com/story/30037676/stolen-laptop-potentially-exposes-health-information-of-5000-minor-patients-in-la-ms;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2015/sep/16/laptop-stolen-from-lsu-docs-car-had-patient-info/"}],"summary":"A laptop stolen from a member of the faculty of LSU Health New Orleans School of Medicine has potentially exposed the protected health information of approximately 5,000 minor patients primarily living in Louisiana and Mississippi.  Dr. Christopher Roth, Assistant Professor of Ur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bad137b806d9cb0645d39aef406261c98b2d6190","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67D4D237-C11E-46BB-B978-4B7DC2EF6917"},"incident_date":"2015-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09cc45d63df0","org_name":"Dominican Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notifications%20-%20Scanned_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/dominican-hospital-notifies-patients-whose-phi-was-sent-to-wrong-health-plan/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-63491"}],"summary":"protected health information was securely, but erroneously, transmitted to an incorrect health plan ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8057f3b320dea7fa904778f206251096cd718de9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2314def0-9d59-11e7-88fd-d58755d0feda"},"incident_date":"2015-07-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8e5f9c6dc136","org_name":"Basildon Borough Housing Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/05/essex-local-authority-fined-for-publishing-sensitive-personal-data-in-online-planning-documents/"}],"summary":"council has been fined £150,000 by the Information Commissioner’s Office (ICO) for publishing sensitive personal information about a family on their website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"418c9cadc899beb8f583cea32ccca8d91dd53518","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A82924ED-C887-49C2-932E-806AAC5DEB19"},"incident_date":"2015-07-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6960c532a72d","org_name":"Yapstone","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vrmintel.com/vacationrentpayments-customer-info-potentially-exposed/"}],"summary":"Publishing error by vacation home payment application led to disclosure of PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e80a125e9eba35850a8708b0bf227fb2e539a69","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6A8FC27-D3BA-467E-8BA0-A0DA44272075"},"incident_date":"2015-07-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"4c8b08c42abd","org_name":"VFS Global","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/technology/2015/jul/17/users-data-compromised-after-technical-glitch-at-home-office-contractor"}],"summary":"Users' data compromised after technical glitch at Home Office contractor - VFS Global","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6a580bc309768c2afc3c54504139809933e8a84","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EA0AE40-1809-49C3-838A-CC421B1C69DD"},"incident_date":"2015-07-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bae40fc23b47","org_name":"Epic Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/triangle/blog/techflash/2015/07/epic-games-cary-nc-investigates-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/epic-games-forum-hit-by-hack-registration-data-stolen/#ftag=RSSbaffb68"}],"summary":"Epic Game Forum hit by hacker attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"721209c1db4d5696611b9f77cd45927dcc21b190","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2feb8a20-936b-11e9-96b8-11c597846497"},"incident_date":"2015-07-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bb02f9b3cf58","org_name":"Axa Insurance","org_type":"financial","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insuranceage.co.uk/insurer/3868206/axa-staff-sentenced-for-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.decisionmarketing.co.uk/news/gang-of-four-sentenced-over-axa-insurance-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.manchestereveningnews.co.uk/news/greater-manchester-news/wolf-manchester-who-made-thousands-15883558"}],"summary":"Four people have been sentenced for their part in a scam which saw 100 pieces of data a week stolen from Axa Insurance between July and December in 2015.  The City of London Police’s Insurance Fraud Enforcement Department (IFED), which worked closely with Axa during the investiga","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44a6e648f83a1806e7e97ddfb496633466f2bc89","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C37979BC-4175-482E-A0A1-3BDEAA3B31AC"},"incident_date":"2015-07-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2ef9d39d716b","org_name":"Avid Life Media","org_type":"other","ransomware":null,"records_affected":42600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/;http://hosted.ap.org/dynamic/stories/U/US_ASHLEY_MADISON_HACKED?SITE=SCAND&SECTION=HOME&TEMPLATE=DEFAULT;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/statement-from-avid-life-media-inc-300115394.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/thomasbrewster/2015/07/20/ashley-madison-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://gizmodo.com/the-ashley-madison-hackers-just-released-all-of-their-s-1724920693?utm_campaign=socialflow_gizmodo_facebook&utm_source=gizmodo_facebook&utm_medium=socialflow;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2015/08/happened-hackers-posted-stolen-ashley-madison-data/;"}],"summary":"Hackers who stole sensitive customer information from the cheating site AshleyMadison.com appear to have made good on their threat to post the data online.  A data dump, 9.7 gigabytes in size, was posted on Tuesday to the dark web using an Onion address accessible only through th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"054f053f2baf4390824dede2218d27271feb193f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7515E710-157A-498D-BBF2-39A742F72F9B"},"incident_date":"2015-07-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"970ef7472deb","org_name":"Oakland Family Services","org_type":"healthcare","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/oakland-family-services-phishing-attack-claims-16k-victims-8099/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.komando.com/happening-now/327720/private-health-info-leaked-in-serious-data-breach"}],"summary":"16,000 people are being notified of a major risk to their private health information following an email attack on a health services company. I'm talking birth dates, Social Security numbers, insurance info, diagnoses, addresses and more.  The Oakland Family Services, a nonprofit ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"774c92f4c1e810bd8de8bba7e66f888050f7f083","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1037D65E-63BC-4415-9DC6-24DFBB128C73"},"incident_date":"2015-07-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61e9b9d4ff39","org_name":"North East Medical Services","org_type":"healthcare","ransomware":null,"records_affected":69246,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/north-east-medical-services-hipaa-breach-69246-8055/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57240"}],"summary":"A HIPAA breach has been reported by North East Medical Services. The Protected Health Information of almost 70,000 patients has potentially been exposed after an unencrypted laptop was stolen from the car of a NEMS employee's car.  According to a breach notice sent to the Califor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfd98e26c1cb148647852a20d5246598399f670f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISO%20Template%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"a53aa83f64a1","org_name":"Insurance Services Office, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57032"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISO%20Template%20Notification_0.pdf"}],"summary":"Insurance Services Office notified individuals that their personal information may have been viewed by unauthorized people during an investigation into suspected unauthorized use of insurance data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b24567c551e6a90b5a3175e3061f45777a7e7e8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4713D9B6-BAFD-4E83-BEB1-E3E23E9E57CB"},"incident_date":"2015-07-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4ae335ee0247","org_name":"Fitch Ratings Lanka Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/fitch-digitalrealty-idUSL4N0ZT58D20150713"}],"summary":"Fitch Ratings accidentally published info on acquisition ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0383f1daabdc8032121328c5613d144d455f61ab","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CDCR%20MCSP%20-%20Privacy%20Breach_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57023"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f53fb8fa44153cf8100bdcb7f6b85c0f0d678117","impact_type":"unknown","incident_date":"2015-04-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/New%20Horizons%20notice%20only%207_10_15_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a3a920bd7da3","org_name":"New Horizons Computer Learning Centers, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57002"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"402a5347b2fc16197e299c8ccb1b578673c62e38","impact_type":"data_theft","incident_date":"2014-06-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CHI-%232933532-v1-Mandarin_State_Regulator_Breach_Notification_CA_x_0.pdf"},"notes":null,"org_country":"US","org_id":"8d985f89d071","org_name":"Mandarin Oriental","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56994"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CHI-%232933532-v1-Mandarin_State_Regulator_Breach_Notification_CA_x_0.pdf"}],"summary":"Mandarin Oriental confirmed that malware at several hotels resulted in unauthorized acquisition of some guests’ names and credit card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f70ee178de559049512977b8683e1072f9fb15bd","impact_type":"data_theft","imported_from":null,"incident_date":"2015-07-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SE","org_id":"cd8144539a60","org_name":"Hemmakväll","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Hemmakväll","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hemmakvall"}],"summary":"Hemmakväll customer records, including personal details and passwords, were dumped publicly; the entry method was not stated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5961dd1c1e0fe493dbf00e88fc27ee617e2b945d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85AE1FBF-2965-426D-B936-0ADEC65ED531"},"incident_date":"2015-07-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"990bd2f436e9","org_name":"Wigan - Dept of Works and Pensions","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wigantoday.net/news/local/address-mistake-causes-data-breach-1-7347127"}],"summary":"Wigan resident was sent confidential tax documents due to a civil service mix-up.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60595665badfe14c4099d8ae926b4a0010864e1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5D5419C-457C-4F02-BE09-07C3F8629849"},"incident_date":"2015-07-08","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"475e13015ed8","org_name":"SAG Health Plan","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/shannen-doherty-my-ex-manager-tricked-sag-into-revealing-medical-information-exclusive-audio/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hollywoodreporter.com/thr-esq/shannen-doherty-my-manager-tricked-848525"}],"summary":"Shannen Doherty: My Ex-Manager Tricked SAG Into Revealing Medical Information (Exclusive Audio)  When Tanner Mainstain employee Kimberly Gabay was asked her name, she responded, \"Shannen Doherty.\" The firm also was able to provide the actress' social security number.  Shannen Doh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"@its_not_herpes and 0x8badfl00d","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0846ba67e3c025dce257c790910a05ca90570d8","impact_type":"data_theft","imported_from":null,"incident_date":"2015-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"6c5244418ce1","org_name":"myRepoSpace","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: myRepoSpace","type":"hibp","url":"https://haveibeenpwned.com/Breach/myRepoSpace"}],"summary":"myRepoSpace user data was hacked and leaked publicly in July 2015.","supporting_quote":null,"technology_involved":["myRepoSpace","Cydia"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"itsnotherpesand0x8badfl00d"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5024581bd4c443fae9972e16afea3705d65953c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"909CD2CC-A501-4C30-901D-3D56DA0ABE54"},"incident_date":"2015-07-08","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c811336c51c0","org_name":"Jackson Health System","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/giants/index.ssf/2016/02/jason_pierre-paul_jackson_memorial_hospital_statem.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://nypost.com/2015/07/09/hospital-on-warpath-over-espn-leaking-jpps-finger-file/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/news/health-care/article88913872.html"}],"summary":"Photo leaked to media of athlete's injured hand.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b92f8139771c74db3f87c8e8d17407a91c22f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C19D7044-63AA-4629-8994-58039B39AEB0"},"incident_date":"2015-07-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"328214f04db2","org_name":"Evans Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Evans%20Hotels%20Substitute%20Notification%20for%20Web%20Posting_0.pdf?;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox5sandiego.com/2015/07/08/security-breach-at-local-hotels-led-to-unauthorized-charges-on-guests-cards/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56969"}],"summary":"Hotel guest credit cards compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2015-07-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f168f47ab087a83d0b01b9b26f309251a789f98b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F6B3AD6-B1D7-4C60-9E9F-9DCB8543356A"},"incident_date":"2015-07-07","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bd7607706f1","org_name":"Burrell Center Inc","org_type":"healthcare","ransomware":null,"records_affected":7748,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/burrell-behavioral-health-provides-notice-of-data-security-incident-300322082.html;"}],"summary":" it discovered that an individual or individuals gained access to the email account of an employee ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f86d1599e50c9565c2a83cab68bf2450bba91ebd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FED457C3-F6DF-4D0B-888D-D4E11725BA19"},"incident_date":"2015-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c404f9f15977","org_name":"housing.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://indianexpress.com/article/technology/tech-news-technology/housingdown-yes-housing-com-is-down-or-has-it-been-hacked/"}],"summary":"There is much more to the post, but it won't make a lot of sense for those who have not walked under the gate of an engineering college.  It reads like gibberish, but we are sure it will make sense for someone. Housing.com, Rahul Yadav, Housing.com hacked, Housingdown, housing, h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"853746aea52652ebcf8707c3221e9ecea0195a23","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/KAR_Sample%20Consumer%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"b70750ffb02f","org_name":"Automotive Recovery Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56920"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/KAR_Sample%20Consumer%20Breach%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/AutomotiveRecoveryServices%2CInc.pdf"}],"summary":"Automotive Recovery Services reported unauthorized access to VDPC legacy systems that may have exposed personal information.","supporting_quote":null,"technology_involved":["VDPC legacy systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee2d5a6a466a41af0f0bd13cd4dd341f815f0565","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F19B95D-2C90-4AE2-A87F-D295D4A6AC2A"},"incident_date":"2015-07-05","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"2f3c07528a00","org_name":"Hacking Team","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2943968/data-breach/hacking-team-hacked-attackers-claim-400gb-in-dumped-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/hacking-team-source-code-leaked-on-github-486267.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.biztekmojo.com/00977/six-former-employees-under-investigation-allegedly-leaking-hacking-teams-code;"},{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/security/2016/04/how-hacking-team-got-hacked-phineas-phisher/"},{"fetched_at":null,"title":"Have I Been Pwned: Hacking Team","type":"hibp","url":"https://haveibeenpwned.com/Breach/HackingTeam"}],"summary":"unknown party took control of the company's Twitter account and used it to publish a link to a torrent with over 400GB of private files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74a71915eedfb929a1f22df480f9f6df63503dfd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E762062-B7D8-429D-BD50-C041AF461C37"},"incident_date":"2015-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a737fbc60b3c","org_name":"UCLA Health","org_type":"healthcare","ransomware":null,"records_affected":1242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailynews.com/general-news/20150901/ucla-health-notifying-1242-patients-about-stolen-laptop-containing-personal-health-info;"},{"fetched_at":null,"title":null,"type":"press","url":"http://losangeles.cbslocal.com/2015/09/01/laptop-stolen-containing-private-medical-data-for-over-1200-ucla-health-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/third-breach-in-rapid-succession-at-ucla-health"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57068"}],"summary":"UCLA Health announced Tuesday that 1,242 patients are being notified about the theft of a faculty member's laptop computer containing names, medical record numbers and health information used to prepare patient treatment plans.  According to UCLA, no Social Security numbers, heal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dde7f528f36fef2ac7d55b34bcf2ff145c45a6ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB678ADF-19D9-415B-8B75-74C363D86603"},"incident_date":"2015-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ddc09041fbda","org_name":"London and Middlesex Health Unit","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lfpress.com/2015/07/14/moms-health-info-stolen"}],"summary":"Personal health information about young mothers and their babies was stolen from the parking lot of the local health unit after an employee left files and a laptop in a vehicle, health officials say.  The thief made off with health information of about a dozen families that had b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03bc550a69a7499c71b60b41fce17d2e6995b725","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A2425A9-8362-4ADF-9297-DFE6ADE1ED3E"},"incident_date":"2015-07-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08f8feec388e","org_name":"OneLogin","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/onelogin-reports-security-breach-that-exposed-customers-secure-notes-data-clear-text-1578846;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.onelogin.com/blog/august-2016-incident"}],"summary":"server security breach that allowed a hacker to access customer Secure Notes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2015-07-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ead3242e0dd797cfcebf374f4bb1652b0b7196","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93A5AEF3-3CF5-4750-AE05-5683AE9BD38D"},"incident_date":"2015-07-02","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf84c9989cad","org_name":"Medical College of Wisconsin","org_type":"education","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/wisconsin/wauwatosa/data-breach-medical-college-wisconsin-exposes-patient-data-3-200-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/story/news/crime/2016/09/03/medical-college-finds-security-breach/89828866/"}],"summary":"some of their patient data was subject to a security breach over a three-day period from July 2-4","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe1a6d3a2c6038b57c86418a6fc184a39b56b05f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"955A158C-9539-4516-9E8D-E0B14B0AA6D7"},"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cb3403a1ab9","org_name":"WXXR","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wivb.com/2015/07/13/indiana-radio-station-hacked-by-anonymous/"}],"summary":"Anonymous intercepted FM signal for their own broadcast","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6989841df0987c46d337629b37c5df79f410b180","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BABBCB22-BF69-4682-8FA2-48B86687F6DB"},"incident_date":"2015-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"88b811c17dd9","org_name":"WorkSafeNB","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/worksafe-privacy-breach-new-brunswick-1.3311691"}],"summary":"WorkSafeNB has sent out more than three thousand letters of apology over a serious privacy breach.  The agency provided a USB drive containing the names and health information of injured workers to a polling firm.  The drive was not password protected.  It happened when WorkSafeN","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df3bd86197af11a0b10781eccece7e9dd79b2d27","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"851F5479-8AC4-4D2E-BA99-27B059BDCACE"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"795ff3940a5f","org_name":"U.S. Navy","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wavy.com/2016/05/02/decorated-navy-sailor-indicted-in-identity-theft-case/"}],"summary":"identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c5db4b58c013e1b31ea45d8f84a1d55c87bacea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4C53D40-0A69-456E-921A-5EDC8832DA28"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/philadelphia/morning_roundup/2016/05/td-bank-tuffour-charge-identify-theft-fraud.html"}],"summary":"A former TD Bank employee was indicted Monday for allegedly stealing customer information and selling it to co-conspirators, who in turn used the data to run an identity theft scheme.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02702c99bbc293e6aa9a93981513efa9c581c734","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"873E5E1A-2ED6-4716-BF6F-A3B09EA2AA64"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46570f9c40ac","org_name":"Serenity Care","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ny-health-care-agency-owner-accused-of-stealing-clients-personal-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wnyt.com/news/allison-delong-serenity-care-accused-of-stealing-personal-information-from-clients/4102922/"}],"summary":"Health care agency owner accused of stealing clients' personal information - Serenity Care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a372a51b599f8b85beb57681dc23f81c70e35ff3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"677463f0-e20e-11e7-8553-197c24c367d2"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0221cc01ea71","org_name":"Royal Gwent Hospital","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-nursing-auxiliary-fined-for-unlawfully-accessing-patient-records/"}],"summary":"A nursing auxiliary has been fined for accessing a patient’s medical records without a valid legal reason.  Marian Waddell, 61, was working at the Royal Gwent Hospital in Newport when she unlawfully accessed the records of the patient, who was known to her, on six occasions betwe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fd440a4fee808070486537fdc841b73f4e0365a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BE519E7-EB8E-4DE9-BE6C-DB425CFDB836"},"incident_date":"2015-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"306f54b71673","org_name":"Richmond Radiology","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dotmed.com/news/story/25859"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lex18.com/story/29208324/medical-records-found-in-richmond-storage-dumpster;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkyt.com/home/headlines/Dozens-of-boxes-filled-with-personal-medical-records-found-in-dumpster-305775771.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ky-medical-records-from-defunct-practice-found-in-richmond-dumpster;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.richmondregister.com/news/local_news/medical-records-found-in-dumpster/article_fc9a1aea-08c4-11e5-9ac2-3719e02bd1fb.html"}],"summary":"Medical records from abandoned storage unit are placed in the dumpster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"activist"},"attack_techniques":["T1078","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d72fc6c1dc221a0dd4f4a95331451f891779afd0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CF7500C-2B1E-47F2-9CC5-D2DB4E3A2CA6"},"incident_date":"2015-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b332566f1ad","org_name":"New Jersey Spine Center","org_type":"healthcare","ransomware":true,"records_affected":28000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/two-more-ransomware-attacks-both-organizations-pay"}],"summary":"Ransomware attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c42aefba1d665fc3e1a6077228d3aee25e103fe3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DD7FE37-6860-4ED3-BCC0-F9A5DB6859E5"},"incident_date":"2015-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ae2e0e2bd783","org_name":"Mental Health Advocacy and Peer Support","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/individuals-with-anxiety-disorder-get-their-emails-leaked-486157.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/the-press/news/69943678/swift-apology-after-mental-health-privacy-breach"}],"summary":"mass email was sent out without BCC 200 individual","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3ce2580aeffa7ff2004f6ea87d76be143092271","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54C2F0B2-A4D5-42AD-BC68-17DB06066A59"},"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41a07d2e00e1","org_name":"First Niagara Financial Group Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buffalonews.com/business/first-niagara-reissuing-cards-after-security-breach-at-merchant-20140715"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wgrz.com/story/money/2014/07/14/first-niagara-keybank-fraud-breach/12649859/"}],"summary":"First Niagara Financial Group is replacing debit cards for a \"small number\" of its customers following a security breach at an unidentified merchant.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"830db6d557dd34e9b411a0e0e058958178b02377","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96F6F4B4-F2B1-4821-9891-4945C6C67270"},"incident_date":"2015-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"429d06f79ee0","org_name":"Eastern Health","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/eastern-health-tore-offices-apart-looking-for-missing-flash-drive-1.3128813;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/privacy-breach-no-more-eastern-health-finds-missing-usb-in-file-folder-1.3181849"}],"summary":"Newfoundland and Labrador's largest health authority is reporting a privacy breach affecting thousands of its employees, including the loss of sensitive data like social insurance numbers, names and employee numbers.  Eastern Health said a USB flash drive containing a spreadsheet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"804866a678e88a8000ff3f59a0f250d61f69ab41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC86A206-CA47-49B4-A7F1-8AB886BD6F12"},"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3a02845445e","org_name":"Dr. Gerardo A. Gamez","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-press.com/story/news/local/2015/08/19/ex-anchor-files-suit-station-story/32015719/"}],"summary":"Medical records were found in an auctioned off storage unit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba40b25ead4360cf9ec7f082d30d5ab72311fd96","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA307DE8-0D9C-4141-9627-53CD94D9F67C"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"64bbc8414e0e","org_name":"Department of Social Protection","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/news/crime-and-law/courts/district-court/private-investigator-convicted-of-obtaining-details-from-welfare-official-1.2682884"}],"summary":"private investigator who illegally obtained personal information from an official ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae0ef27aa93a2db048bdbe7f666ec591a5574cee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"688bbab0-e3ab-11e7-8742-2bc46bd10713"},"incident_date":"2015-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"be96a2849163","org_name":"Department of Defence","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/federal-politics/political-news/defence-medical-records-sent-to-china-in-security-breach-20150707-gi6xb7.html"}],"summary":"Eye test records and personal contact details of hundreds of military personnel including soldiers posted overseas were sent to China in a significant data security breach.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"094c1847d5fb7ba18fd796a2da2a6bba9c9380ca","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BONITAUSD_B1194_BONITA_USD_%20NOTIFICATION_LETTER_STUDENT_ADULT.DOCX_AUDIT_0.pdf"},"notes":null,"org_country":"US","org_id":"adefa431df7d","org_name":"Bonita Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BONITAUSD_B1194_BONITA_USD_%20NOTIFICATION_LETTER_STUDENT_ADULT.DOCX_AUDIT_0.pdf"}],"summary":"Bonita Unified School District reported unauthorized access to its student information system at San Dimas High School, which may have involved students’ personal information.","supporting_quote":null,"technology_involved":["student information system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab51e7abd2c6120cf4e1d664132344ff786ccfd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ef61b00-ad5a-11e8-9e5a-c1f99505e93a"},"incident_date":"2015-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab64cba7a826","org_name":"Arc Erie County New York’s","org_type":"healthcare","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arceriecounty.org/about/compliance/information-regarding-data-security-incident-updated-392018-447/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/samba-mailing-error-creates-data-security-concern-for-13.9k"}],"summary":"The Arc Erie County New York (The Arc) was recently made aware that certain information contained on two spreadsheets stored on its database was publicly available on the internet between approximately July 2015 and February 15, 2018 due to a problem with a link on The Arc’s webs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22474d711df73bca15e583c085753a7e98fed71","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47741ECA-EBCD-4E2A-B7A3-CD4EF37B2B81"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26356db97505","org_name":"AnMed Health Medical Center","org_type":"healthcare","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unauthorized-employee-accessed-anmed-health-patient-records-release-says/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independentmail.com/news/audit-revealsanmed-patient-records-viewed-improperly-388f44a2-f6a8-0b52-e053-0100007feae6-388459481.html"}],"summary":"partner organization employee looks at PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"273b92b14e797968d973cda27f5f6d1ce0808e18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC5EF980-29A8-4367-8BAA-CA718D0CE956"},"incident_date":"2015-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"government","ransomware":null,"records_affected":12848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/ahs-privacy-breach-troubling-says-digital-security-expert-1.3780531;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/alberta-health-services-notifies-almost-13-000-patients-of-privacy-breach-1.3779296"}],"summary":"Alberta Health Services has issued a warning after thousands of patients had their confidential health information \"inappropriately accessed\" by a former AHS employee.  An AHS investigation has determined that the former employee accessed the health information of 1,309 Albertans","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"@rmsg0d","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3366d743e1c489654afa0078bd7df5e9dca25f9e","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2d1de76bd1b2","org_name":"Minecraft Pocket Edition Forum","org_type":"other","ransomware":null,"records_affected":16034,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Minecraft Pocket Edition Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/MinecraftPocketEditionForum"}],"summary":"The Minecraft Pocket Edition Forum was hacked in May 2015, and data from 16,034 accounts was dumped publicly.","supporting_quote":null,"technology_involved":["web forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"rmsg0d"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1041"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-06-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44cae7a1125de085348a22e3f7bce78af1baf199","impact_type":"data_theft","imported_from":null,"incident_date":"2015-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Accuform-SampleNotification%20-%20Standard_0.pdf"},"notes":null,"org_country":"US","org_id":"ea9ba90aec87","org_name":"Accuform Signs","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-58598"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Accuform-SampleNotification%20-%20Standard_0.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Accuform-SampleNotification%20-%20Standard_0.pdf"}],"summary":"Accuform Signs reported that outside intruders accessed and exfiltrated copies of order information from its website and/or a distributor’s website.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acd5c82c904bd7de249accd7eeb52cf88331afd8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eed16b70-9378-11e7-a11c-5542f7e3819f"},"incident_date":"2015-06-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a923c9bda33e","org_name":"Daniel Drake Center for Post-Acute Care","org_type":"healthcare","ransomware":null,"records_affected":4721,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bizjournals.com/cincinnati/news/2017/08/02/uc-health-hospitalnotifies-patients-of-medical.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/4271-uc-health-patients-notified-of-insider-data-breach-8913/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://healthitsecurity.com/news/phi-of-4.7k-ohio-patients-affected-by-unauthorized-ehr-access"}],"summary":"The Daniel Drake Center for Post-Acute Care, a hospital affiliated with UC Health, has begun notifying thousands of patients that some of their medical records might have been compromised  Drake hospital began mailing letters to 4,721 affected patients on Aug. 1 and has establish","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5425d7aaad2fa0616af89ccb04d3a8c92e14628","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8882B9D0-D6C7-4CEE-B3C6-821C02B41DEA"},"incident_date":"2015-06-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75d114522797","org_name":"Robert E. Soper, M.D.","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/psychiatrist-leaves-desktop-with-phi-in-trunk-of-his-car-and-yes/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57565;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/frisco-psychiatrists-computer-stolen-from-vehicle-trunk-phi-exposed-8082/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.times-standard.com/general-news/20150902/psychiatrists-computer-with-patient-information-stolen;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"During a visit to San Francisco On June 27 my car was broken into and my computer stolen, along with camera, suitcases, and other equipment. The computer was an older office desktop I planned to give to my brother. It was hidden in the trunk. The computer contained patient names,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-06-26","discovered_date":"2015-05-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7aeaa1fb416191078de1a3386035c4e00283746","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Medical%20Informatics%20notice%20only6_26_15_0_0.pdf"},"notes":null,"org_country":"US","org_id":"2ff6263befed","org_name":"Medical Informatics Engineering","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56609"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Medical%20Informatics%20notice%20only6_26_15_0_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/MedicalinformaticsEngineering.pdf"}],"summary":"Medical Informatics Engineering reported unauthorized access to its network that exposed patient personal and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f66fb8644d4fc0c49d637c35f7110134f2f43dd","impact_type":"unknown","incident_date":"2014-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample-CA_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56611"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a05f90588787a6df2f8c338bf6b109114d3c524","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1E23781-8B72-4D9E-85CF-A31068564059"},"incident_date":"2015-06-26","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fff89969fc42","org_name":"Appalachian Regional Healthcare System","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/appalachian-regional-hospitals-on-emergency-operations-plan-computers-shut-down-after-malware-injection/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.register-herald.com/news/arh-computers-breached/article_5159665b-7786-523b-b233-c3524259b538.html"}],"summary":"2 hospitals:  after hackers planted a computer virus in its electronic web-based services and electronic communications.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e969ab2816be513c7f33669ae445840ec5ddc3e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57B329DC-381D-4460-AE0F-BAA0DF743746"},"incident_date":"2015-06-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7edd047af888","org_name":"Washington County EMS","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://poststar.com/news/blotter/records-jail-guard-tipped-daughter-to-drug-case/article_e67bf00d-e0f9-541e-85f7-2f54ed8d5379.html"}],"summary":"Jail guard tipped daughter to drug case, provided information on identity of CI.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9843e45ac58c433a185bd0ae52b50a6e408d163a","impact_type":"unknown","incident_date":"2015-06-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Bank%20of%20Manhattan%20Customer%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9a7af1c61eda","org_name":"Bank of Manhattan—Mortgage Lending","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56587"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33edb3cd4e90e65fc066d33246855f5c03c5e4dc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FE6EC4E-928F-44C3-BEE6-05780E718F5F"},"incident_date":"2015-06-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccc91c5e474","org_name":"Today's Dental Associates","org_type":"healthcare","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"Dharani Jasthi DMD PC dba Today's Dental Associates reported that they:  received an anonymous fax after close of business on June 24, 2015. The anonymous source stated that it found a document containing names, ages, social security numbers and dates of birth of 6 of Today's Den","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afaea6ff3dc5811f70808d9aa2a1a56c1f02a4b9","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Event_0.pdf"},"notes":null,"org_country":"US","org_id":"491512239800","org_name":"Trustmark Mutual Holding Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56493"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Event_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Trustmark.pdf"}],"summary":"Trustmark reported that its automated billing e-mail system sent encrypted emails to certain insurance carrier clients on May 13, 2015.","supporting_quote":null,"technology_involved":["automated billing e-mail system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"776e3803b163aac23dcb8cf8087d008ffa05843a","impact_type":"unknown","incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e6b680a765a8","org_name":"Summit Financial Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56501"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc83ec2f9ca6729d93e8ba1f69aa023f690bc301","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2E51216-F1A6-46BB-8EC5-266965622F30"},"incident_date":"2015-06-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a500583c5879","org_name":"PNC Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/business/shopping/atm-skimming-discovered-at-nutley-bank-1.1619939"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"a565f9d2fbf99caed15579086eb105d01a962892","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/MontefioreHealthSystem.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7918aa2cd265","org_name":"Montefiore Health System/University Hospital for Albert Einstein College of Medicine","org_type":"unknown","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/MontefioreHealthSystem.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6c897ad734493c9ff8dd89197b14ad1dc8bfc67","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90D69409-04EA-464D-8B87-1F98B62DF484"},"incident_date":"2015-06-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JM","org_id":"08f384caaf0a","org_name":"Jamaica Information Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://jamaica-gleaner.com/article/news/20150622/update-jis-website-hacked-sensitive-data-not-lost-management"}],"summary":"The website of the Jamaica Information Service (JIS) has been hacked, but the management is seeking to assure that critical information has not been compromised.  A visit to the website revealed the following message: \"hacked by Holako\".  However, the perpetrator of the attack wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-06-19","discovered_date":"2015-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc1b8a7b494119cc50d5a7176660398e08210058","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DOCS-%231545590-v3-Generic_Consumer_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b673633555f9","org_name":"Dungarees, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56488"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DOCS-%231545590-v3-Generic_Consumer_Notice_0.pdf"}],"summary":"Dungarees reported that hackers manipulated its website and customer information associated with orders placed between March 26 and June 5, 2015 may have been affected.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dfb47a65f6ba02ecb044f166605c83d0bf89b3d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FEB4103-8DE7-4BFC-BFEC-5E7A7C442AF2"},"incident_date":"2015-06-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df59e316261b","org_name":"Cancer Care Northwest (CCNW)","org_type":"healthcare","ransomware":null,"records_affected":1426,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/possible-health-data-breaches-for-ohio-wash.-providers"}],"summary":"The PHI of 1,426 Cancer Care Northwest (CCNW) is potentially at risk after the healthcare provider realized that a notebook containing the information was missing. Information in the notebook included patient names, dates of birth, patient ID numbers, diagnoses, and some treatmen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f132801bc44e0d7b7e323514baf21ddac3945f50","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/The%20Good%20Life%20Wine%20Collective%20Credit%20Card%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"d530f501ee53","org_name":"The Good Life Wine Collective","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56447"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/The%20Good%20Life%20Wine%20Collective%20Credit%20Card%20Breach%20Notification%20Letter_0.pdf"}],"summary":"The Good Life Wine Collective notified customers that its consumer direct sales systems provider reported possible access to customer information, including payment card data and passwords.","supporting_quote":null,"technology_involved":["Missing Link Networks, Inc.","consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10689527042e870a9b69e67fa41d5a12c58a2226","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Summers%20Breach%20Notify%20Ltr20150611_14590190%20pdf_0.pdf"},"notes":null,"org_country":"US","org_id":"327573ef0773","org_name":"Summers Estate Wines","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56461"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Summers%20Breach%20Notify%20Ltr20150611_14590190%20pdf_0.pdf"}],"summary":"A third party might have accessed customers’ personal, payment, and password information through the consumer direct sales systems provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["Missing Link Networks, Inc.","consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"797cb9d5f85714da406d0b351ebecf3ea379a229","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Spring%20Mountain%20Customer%20Breach%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"2bcd3a19d507","org_name":"Spring Mountain Vineyard","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56460"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Spring%20Mountain%20Customer%20Breach%20Notification_0.pdf"}],"summary":"Spring Mountain Vineyard reported that customer personal, payment card, and password information in its provider Missing Link Networks Inc.’s platform may have been compromised.","supporting_quote":"We are writing to inform you that our consumer direct sales system provider, Missing Link Networks Inc. (Missing Link) notified us on May 27, 2015 that their platform had a security incident during the window of April 1, 2015 to April 30, 2015.","technology_involved":["Missing Link Networks Inc. platform","consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"009f391b91e7b1979cbcb1eac76e25fec05884bb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Silverado%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"90f879cce368","org_name":"Silverado Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56459"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Silverado%20Breach%20Notification%20Letter_0.pdf"}],"summary":"Silverado Vineyards said customer information held by its third-party ecommerce provider, Missing Link Networks, Inc., may have been compromised.","supporting_quote":"We are writing to inform you that our third-party ecommerce provider, Missing Link Networks, Inc. (MLN), was the subject of a recent data security incident.","technology_involved":["Missing Link Networks, Inc.","ecommerce provider"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03b495cbedd1b9589ee49b79411da13f361c6133","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Signorello_Security%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"a8d9058c4792","org_name":"Signorello Estate","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56458"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Signorello_Security%20Notice_0.pdf"}],"summary":"Signorello Estate reported that its consumer direct sales systems provider notified it of possible access to customer information, including payment-card details and passwords.","supporting_quote":null,"technology_involved":["consumer direct sales system","Missing Link Networks, Inc."],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c6125a8d98c1e0e6e8f5998fcfd990630053f5e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Round%20Pond%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"ed86676f4cfa","org_name":"Round Pond Estates","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56457"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Round%20Pond%20Breach%20Notification%20Letter_0.pdf"}],"summary":"Round Pond Estate notified customers that its consumer direct sales systems provider reported possible access to customer personal and payment information.","supporting_quote":null,"technology_involved":["consumer direct sales systems","Missing Link Networks, Inc."],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2af4b6c2549b0265553561f6fd9199abaf640e40","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rhys%20ecellar%20breach%20notification_0.pdf"},"notes":null,"org_country":"US","org_id":"7e4f778c80b2","org_name":"Rhys Vineyards","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56455"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rhys%20ecellar%20breach%20notification_0.pdf"}],"summary":"Rhys Vineyards reported that a third party might have accessed customer information through its ecommerce provider, Missing Link Networks.","supporting_quote":null,"technology_involved":["Missing Link Networks, Inc.","ecommerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce696f5ed77d54dffd22c634c38803c3148b7c14","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Repris%20Missing%20Link%20Breach%20Notification%20Letter%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"bcb2747cc8b7","org_name":"Repris Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56454"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Repris%20Missing%20Link%20Breach%20Notification%20Letter%20Final_0.pdf"}],"summary":"Repris Vineyards notified customers that its sales systems provider reported possible unauthorized access to customer names, payment-card information, addresses, passwords, and dates of birth.","supporting_quote":null,"technology_involved":["sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31a3099d0ea95d5111791f868d87998d9d8610f9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Pride%20Mountain%20Vineyards%20Customer%20Breach%20Notification%205.11.12_0.pdf"},"notes":null,"org_country":"US","org_id":"953a9e9ab098","org_name":"Pride Mountain Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56453"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Pride%20Mountain%20Vineyards%20Customer%20Breach%20Notification%205.11.12_0.pdf"}],"summary":"A third party might have accessed customer information through Pride Mountain Vineyards’ consumer direct sales systems provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cd03644b802d78f74e6f15cad58c0840c57ba1f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Palmaz_eCellars%20Breach%20Notification%20Letter%206_10_2015_0.pdf"},"notes":null,"org_country":"US","org_id":"c8512b7e6f1a","org_name":"Palmaz Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56452"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Palmaz_eCellars%20Breach%20Notification%20Letter%206_10_2015_0.pdf"}],"summary":"Palmaz Vineyards reported that a third party might have accessed customer information through its consumer direct sales provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab346b5f17f8ecaa49b6e9a00f6be7660c27154a","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Outpost%20Breach_Draft%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"6d8e56da1a3d","org_name":"Outpost Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56451"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Outpost%20Breach_Draft%20Notification%20Letter_0.pdf"}],"summary":"Outpost Vineyards reported that a security incident involving its consumer direct sales systems provider may have exposed customer information.","supporting_quote":"It should be noted that Outpost Estate Wines is only one of many Missing Link clients that have been affected, so it’s possible that you may receive similar notifications from other wineries.","technology_involved":["Missing Link Networks, Inc.","consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4731b1fc255a242a1f429216289374bf60b65477","impact_type":"data_theft","incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"d2e9a2ee20fa","org_name":"Montefiore Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee abused access to steal patient account information from the electronic medical record system.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56456"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_0.pdf"}],"summary":"A Montefiore employee stole patient account information from its electronic medical record system between January and June 2013.","supporting_quote":"On May 15, 2015, Montefiore was informed by law enforcement that an employee stole patient account information from Montefiore’s electronic medical record system.","technology_involved":["electronic medical record system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32cbbecd7f32f654c3928f0bad002d7551fe0699","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Martinelli_eCellars%20Breach%20Notification%20Letter%206_10_2015%20_0.pdf"},"notes":null,"org_country":"US","org_id":"76a6a64349f3","org_name":"Martinelli Winery","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56450"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Martinelli_eCellars%20Breach%20Notification%20Letter%206_10_2015%20_0.pdf"}],"summary":"A third party might have accessed personal, payment, and password information through Martinelli Winery’s consumer direct sales systems provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8887ea2b84abd688ce26ab4e1a93342c0e1c478","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Larkmead_eCellars%20Breach%20Notification%20Letter%20LMV_0.pdf"},"notes":null,"org_country":"US","org_id":"bdf320fa7a33","org_name":"Larkmead Vineyards","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Larkmead_eCellars%20Breach%20Notification%20Letter%20LMV_0.pdf"}],"summary":"Larkmead Vineyards reported that a third party might have accessed customer information on its consumer direct sales provider Missing Link Networks' systems.","supporting_quote":null,"technology_involved":["Missing Link Networks systems","consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c4bee83eb8395ca98e65d102c2dad9ece405399","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Heitz%20Customer%20Notification_Security%20Breach_ALL%20%28except%20MA%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a7930946580a","org_name":"Heitz Wine Cellars","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56446"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Heitz%20Customer%20Notification_Security%20Breach_ALL%20%28except%20MA%29_0.pdf"}],"summary":"Heitz Wine Cellars notified customers that its consumer direct sales systems provider, Missing Link Networks, reported possible unauthorized access to customer information.","supporting_quote":null,"technology_involved":["consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b8f68c00f8580a72a2401104cc129bc501e555d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gemstone%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"4bdce1721943","org_name":"Gemstone Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56445"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gemstone%20Breach%20Notification%20Letter_0.pdf"}],"summary":"A third party might have accessed customer information in Gemstone Vineyards’ consumer direct sales systems provider’s systems.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["Missing Link Networks, Inc.","consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"185e05664d634f73f3582210db8c24c727b970c9","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Flora%20Springs_eCellars%20Breach%20Notification%20Letter%20FINAL_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"4d62e5b3e600","org_name":"Flora Springs Winery & Vineyards","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56444"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Flora%20Springs_eCellars%20Breach%20Notification%20Letter%20FINAL_0.pdf"}],"summary":"Flora Springs reported that a third party might have accessed customer information through its consumer direct sales systems provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer name, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["Missing Link Networks, Inc.","consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0095819f6020d6974f9d700c2f7d88951b76a3b6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Corison%20Breach%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c3d2033fea8f","org_name":"Corison Winery","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56442"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d42a298a51a0d90559f1ee32ee7c464208d5c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Charles%20Krug%20Winery_notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"fced3f20934c","org_name":"Charles Krug Winery","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56443"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Charles%20Krug%20Winery_notification%20letter_0.pdf"}],"summary":"A third party might have accessed customer information in Charles Krug Winery’s consumer direct sales system provided by Missing Link Networks.","supporting_quote":null,"technology_involved":["consumer direct sales system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-18","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dd35f9f4dd5ae8678c818967da5cd092bc4e988","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cain%20Breach%20Notification%20Letter_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"4d877efd150d","org_name":"Cain Vineyard and Winery","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cain%20Breach%20Notification%20Letter_0.pdf"}],"summary":"Cain Vineyard and Winery reported that a third party might have accessed customer information through its eCommerce provider, Missing Link Networks.","supporting_quote":"Missing Link advised us that during the period of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, passwords, card numbers, related payment addresses and dates of birth.","technology_involved":["Missing Link Networks, Inc.","eCommerce provider"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-06-17","discovered_date":"2015-03-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58e70708f0af498784deda8b05356b47ca28f5f6","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-06-22","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20CA%20Notice%2006172015_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"f44d8cd7904e","org_name":"University of California Irvine Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee accessed patient records without a job-related purpose.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56428"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20CA%20Notice%2006172015_0.pdf"}],"summary":"An employee accessed UC Irvine Medical Center patient records without a job-related purpose; the investigation found no evidence that the information was removed.","supporting_quote":"On March 13, 2015, the UC Irvine Medical Center discovered that an employee, whose job required access to some patient records, had looked at additional patients’ records without a job-related purpose.","technology_involved":["medical records"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58131c5dc631ec6b755eb691d2e50b4c15783216","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1465360-EDF2-4F79-86F9-D669CC749D90"},"incident_date":"2015-06-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82be7623630d","org_name":"Law offices of Higgins, Harrell and Clarke","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/news/local/article/Law-firm-case-runner-pleads-guilty-to-8529618.php"}],"summary":"Law firm \"runner\" used access to information about clients to defraud people in excess of 1.8 million dollars.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1314c5e5fc9d8f46147751ab5135ff4755982289","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA762C64-E7E2-4F31-A477-5ED4BAEB0705"},"incident_date":"2015-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547b3c078691","org_name":"Endocrinology Associates","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/possible-health-data-breaches-for-ohio-wash.-providers"}],"summary":"Ohio-based Endocrinology Associates reported a potential data security incident after it realized that a POD containing patient information was missing its padlock. They stated that no charts were missing but they are not certain that no one opened the charts and looked through t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"434d9cc71ae1e0d832927461085aa0f9607eff5b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8DD505C-9A65-4EA7-9178-B9E8E5FB666B"},"incident_date":"2015-06-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"563e9a438fc3","org_name":"East Sussex Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eastbourneherald.co.uk/news/local/confusion-over-patient-data-on-lost-hospital-stick-1-6875173"}],"summary":"The husband of a woman whose confidential patient details were found on a memory stick which had been left outside a hospital, says he has been given conflicting information from the NHS Trust.  James Foster says his wife Patricia had received a letter from the East Sussex Health","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f122136acf5faa1e9054d486a5f30e3f581fe6a5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80629175-98C7-40E5-8A83-A89A5A9376A0"},"incident_date":"2015-06-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5bd67c201cc","org_name":"University of Oklahoma College of Medicine","org_type":"healthcare","ransomware":null,"records_affected":7693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/university-of-oklahoma-department-of-obstetrics-and-gynecology-announces-data-breach-8078/"}],"summary":"Laptop with medical records stolen from car.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3734d135c46effc7fa8a511090bcd9769d3bb14","impact_type":"data_theft","incident_date":"2015-05-31","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20for%20Mailing%20on%20LH_0.pdf"},"notes":null,"org_country":"US","org_id":"50586d78fb62","org_name":"San Luis Obispo County Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A District employee accessed the employee database without authorization and transmitted its information to a private email account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56341"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20for%20Mailing%20on%20LH_0.pdf"}],"summary":"A District employee accessed the employee database without authorization and sent employee personal information to a private email account.","supporting_quote":"a District employee gained unauthorized access to the District’s employee database containing the personally identifiable information","technology_involved":["employee database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-06-12","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e18582f17df6d969f747eb0dd5810c41ce42b87","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PMW%2C%20Notification%20Letter%2C%20%28US%20%2B%20PR%20-%20MA%29%20FINAL%20DRAFT%206-11-2015_1.pdf"},"notes":null,"org_country":"US","org_id":"ed7d22987480","org_name":"Peter Michael Winery","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PMW%2C%20Notification%20Letter%2C%20%28US%20%2B%20PR%20-%20MA%29%20FINAL%20DRAFT%206-11-2015_1.pdf"}],"summary":"An intruder breached a third-party e-commerce vendor’s data systems, potentially accessing Peter Michael Winery customers’ personal and payment information.","supporting_quote":null,"technology_involved":["e-commerce vendor database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-06-11","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afd4e75ce16f8838bb50f807c0461a121079797e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/eCellars%20Customer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"bacc00d4305f","org_name":"Rombauer Vineyards, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56321"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/eCellars%20Customer%20Letter_0.pdf"}],"summary":"Rombauer Vineyards reported that a third party might have accessed customer information through its consumer direct sales systems provider, Missing Link Networks.","supporting_quote":"Missing Link has advised us that during the window of April 1, 2015 to April 30, 2015, a third party might have gained access to certain personal information, including customer names, card numbers, related payment addresses, passwords, and dates of birth.","technology_involved":["consumer direct sales systems"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ee0ed3a765d63399c11ecff626757df2633a088","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3118871B-9F23-4500-8E69-3998492E31AE"},"incident_date":"2015-06-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8554eeea5660","org_name":"Dr. Everett Chalmers Hospital","org_type":"healthcare","ransomware":null,"records_affected":158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/horizon-notifying-patients-after-laptop-stolen-in-fredericton-1.3162877"}],"summary":"The Horizon Health network is notifying patients of a privacy breach after a laptop was stolen from the Dr. Everett Chalmers Hospital in Fredericton.  Kathy Kowalski, a director for the respiratory clinic, said the laptop went missing on the evening of June 11.  She said there wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c75828e427faa9555c31989ab81787fb3287525","impact_type":"unknown","incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Turley%20Wine%20Cellars%20AG%20notification_NOTICE%20ONLY_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"979f0d3c9059","org_name":"Turley Wine Cellars","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56311"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-06-10","discovered_date":"2015-05-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a2845c376fc9346c75c7ddafab3ea1f36054394","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Clif%20Family%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"d315908f1adc","org_name":"Clif Bar Family Winery & Farm, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56310"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Clif%20Family%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"Clif Family Winery notified customers that an intruder potentially accessed payment card transaction information held by its ecommerce provider, Missing Link Networks, Inc.","supporting_quote":null,"technology_involved":["ecommerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Missing Link Networks, Inc."},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"08310531e383","name":"Missing Link Networks, Inc"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0e0689b464b6156ccf9fa9b8e7cf7beb20e4369","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A4A805A-FD82-4486-9F0C-D388626CD02B"},"incident_date":"2015-06-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea1381a2a5ab","org_name":"Wolverhampton NHS Primary Care Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.briefreport.co.uk/news/telford-woman-s-horror-as-patient-records-found-in-old-filing-cabinets-4227939.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/nhs-psychiatric-patients-records-found-filing-cabinet-sold-ebay-1567324"}],"summary":"A woman purchased filing cabinets on eBay and found a total of 16 case files detailing the sexual abuse of patients and their suicide attempts and a further 20 files with the names of other patients. In total there were more than 60 pages of documents containing confidential deta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d00e1927be2980ba16cd7bcb04e287a3bcdf4997","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21D403B5-6CD7-4FBA-8255-AFACFA71D695"},"incident_date":"2015-06-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jun-2015.pdf"}],"summary":"Veteran A received information pertaining to Veteran B in the mail. The information included Veteran Bs name, SSN, Power of Attorney (POA), branch of service and service dates. Veteran A returned the information he received in error via mail. The improperly disclosed information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc9fd05fd7516bff86ad437143e32c6cf1f5e753","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7659496F-F7FC-483B-A50A-AA34987DB1C4"},"incident_date":"2015-06-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de9ac9361a94","org_name":"Akron Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":7600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/phi-health-data-breach-at-childrens-hospital-affects-7600"}],"summary":"PHI data breach notification letters were sent to over 7,600 Akron Children's Hospital patients and families, according to a hospital press release. The health data breach involved a misplaced device containing information about medical transports between September 2014 and June ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c9f622a1dce2282828078e01e66974faec4f863","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6171AB4-884A-4D28-AB5B-BB9E10BEF1BC"},"incident_date":"2015-06-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12935822314c","org_name":"Division of Aging Services","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/breach-affects-3000-clients-enrolled-in-georgia-state-program/article/428766/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/atlanta/morning_call/2015/07/patient-information-released-in-state-agency-data.html"}],"summary":"Georgia Division of Aging Services Accidental disclosure.  The personal data of approximately 3,000 clients of the Community Care Services Program in Georgia was potentially compromised June 8 after the Division of Aging Services accidentally emailed the information to a contract","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ba732e2d1d17344062e1b657630483bfb90bb2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98C6344E-7D1A-42B8-9F06-76D5643B15A6"},"incident_date":"2015-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"39a37b616292","org_name":"Assyrian International News Agency","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.aina.org/news/20150617135759.htm"}],"summary":"AINA Brought Down By Massive Denial of Service Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6075c02eb331e71deffc8c05e3eed043c880bc16","impact_type":"unknown","incident_date":"2015-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification%20letter.6%208%202015_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1996f17e4011","org_name":"ADP, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56273"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-06-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"071b9570ec7ea6bb524f5978e73d869ecd4428b5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC5F1D9B-88C0-4402-9031-FDF044FE98C8"},"incident_date":"2015-06-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19b034778fa2","org_name":"NorthShore Care Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Samela%20dba%20NorthShore%20Supply%20notice%20only_0.pdf"}],"summary":"eCommerce server was compromised leading to payment card loss","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e5f5f5b1cceb12c40ae0cc93d3c349f32853e3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBBD5C27-6BF1-4C70-883B-27D66E589F72"},"incident_date":"2015-06-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab4788af5707","org_name":"Greene County office of Department of Human Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kait8.com/story/32849655/exclusive-documents-detail-firing-of-greene-co-dhs-supervisor"}],"summary":"employee sent former employee a group text with confidential customer data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fb9e6cfdbca2e4e8ad3f015444c95e48685d887","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51A4A9B5-D39C-496B-A2E5-04BCC621C7A1"},"incident_date":"2015-06-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5e7425f1185","org_name":"GunMag Warehouse","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/possible-breach-at-gunmag-warehouse/article/511780/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SCMagazineHome+%28SC+Magazine%29;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.batblue.com/potential-breach-affects-gunmag-warehouse-customers/"}],"summary":"third party module updated","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ff9c5afec3ab496cba2787b0e9eee3f6def004f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D687722-21C5-4A7B-9E69-D5DA62423BFF"},"incident_date":"2015-06-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"483b6885cb9a","org_name":"UPMC Health Plan","org_type":"financial","ransomware":null,"records_affected":722,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtae.com/news/upmc-health-plan-reports-data-breach/34176994"}],"summary":"Email misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13c1366763c236137e095a44f79865028da3fc4a","impact_type":"data_theft","imported_from":null,"incident_date":"2014-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"79d884c0df6e","org_name":"NextGenUpdate","org_type":"other","ransomware":null,"records_affected":1194597,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: NextGenUpdate","type":"hibp","url":"https://haveibeenpwned.com/Breach/NextGenUpdate"}],"summary":"NextGenUpdate reportedly suffered a data breach that exposed account usernames, email addresses, IP addresses, and salted and hashed passwords.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-06-05","discovered_date":"2015-05-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ef2a174bbfbdd0c9ef645459d8eb771a57d5beb","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-05-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A computer code update caused users logged into their own accounts simultaneously to view member information from another user's account.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56265"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notification%20Letter_0.pdf"}],"summary":"A code update to Blue Shield of California’s secure website allowed some users to view other members’ protected health information, which the users said they did not retain, use, or disclose further.","supporting_quote":"As the (unintended) result of a computer code update Blue Shield made to the Website on May 9, three users who logged into their own Website accounts simultaneously with (at the exact same time as) another user were able to view member information associated with the other user’s Website account .","technology_involved":["secure website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-03","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6416b1650873dd3a073bc47e7230a75cb70950ef","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Gallant%20notice%20only%20_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"5b8d38544222","org_name":"Gallant Risk & Insurance Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56236"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Gallant%20notice%20only%20_0.pdf"}],"summary":"Gallant Risk & Insurance Services reported that laptops containing personal information were stolen.","supporting_quote":"É » ¾ »· • »“» ‹ ‚ ¿‹ ‹ ' – • † … • “• … « ¿· › ' ‚ – ‹ – – µ ‹ ‚ » · ¿° ‹ – ° › ' »fi » ‡ – › ‹ · • µ»· § • † ‹ »fi »› ‹ »… • † ‹ ‚ » »· »‰‹ fi – † • ‰› ¿† … † – ‹‹ ‚ » • † ” –fi ‡ ¿‹ • – † – † ‹ ‚ » · ¿° ‹ – ° ›","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-06-03","discovered_date":"2015-05-05","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c75c769ab2eeb868d8a0ac077d9b714d46dc938f","impact_type":"data_theft","incident_date":"2014-10-15","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Current%20Notice%20-%20Final%20B%20Letter%20Only_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"8165fb82b1c7","org_name":"AeroGrow International","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56231"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Current%20Notice%20-%20Final%20B%20Letter%20Only_0.pdf"}],"summary":"AeroGrow International reported that malware infiltrated its online servers and may have captured customer order and payment-card information.","supporting_quote":"As a result of this investigation, we learned on May 5, 2015, that a hacker likely used malicious software (malware) to infiltrate our on-line servers, which are hosted by a leading service provider.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-06-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f34f3afd4c8d2100fed197b0d4a549f79d7a198d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70E9D97F-4812-43C4-9DAA-4F8C2460ED7D"},"incident_date":"2015-06-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3725b1cc2d20","org_name":"San Dimas High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/BONITAUSD_B1194_BONITA_USD_%20NOTIFICATION_LETTER_STUDENT_ADULT.DOCX_AUDIT_0.pdf"}],"summary":"Grades changed in school database; PII and medical information also disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b66b324bff5e3e3fbce1e13b71d43e6de6738c75","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3F76200-3A77-4A27-8E9B-B7AD8FC35811"},"incident_date":"2015-06-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13aeaeb309f9","org_name":"Dr. Olartino Dyoco","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/health-data-breaches-from-theft-improper-disposal;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/dyoco%20notification_0.pdf;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"As often discussed on this site, health data breaches can stem from numerous areas. Covered entities and their business associates need to ensure they have a comprehensive data security plan, and are able to implement the necessary physical, administrative, and technical safeguar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36295609823c5355ac0ce5e599699cfa61aec2d8","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Anthem%20Breach%20Employee%20Notifications_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"72bdcee5f34e","org_name":"YP Holdings","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56189"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7a56b11d4dba360a73b5df51f2bbef4cad44393","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"622525CC-9C78-4316-8708-CC69F9E41DE1"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecb3fca7a151","org_name":"XPO Logistics Inc","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ttnews.com/articles/basetemplate.aspx?storyid=40807&t=XPO-Logistics-Suit-Claims-YRC-Poached-Execs-Stole-Trade-Secrets"},{"fetched_at":null,"title":null,"type":"press","url":"http://aircargoworld.com/xpo-suing-competitor-yrc-over-theft-of-trade-secrets/"}],"summary":"XPO logistics claim that a competitor lured away employees in order to obtain IP about a company that XPO was purchasing. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84938b4de229aff6eb0414e161acffde39e78f6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B69EE252-E06A-4776-8B3F-22E3BA3B9736"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"384e9b93c9f7","org_name":"Virginia's State Corporation Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://augustafreepress.com/scc-advises-former-licensed-insurance-agents-possible-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://pilotonline.com/business/insurance-agents-in-virginia-may-have-had-personal-data-stolen/article_c8052cf4-513f-561d-8407-9deb69210bc8.html"}],"summary":"State Corporation Commission is advising former licensed insurance agents of the potential improper access to their personal data by a former contractor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be3a3c70bac24f86a091f0bcd637440746b2cada","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83CF2465-BBEA-4F73-B640-DC027CEEE5A1"},"incident_date":"2015-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"530ee1f32ac3","org_name":"University of New Mexico","org_type":"education","ransomware":null,"records_affected":1360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koat.com/news/unm-students-employees-could-be-victims-of-id-theft/41256378;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/after-a-month-of-silence-university-of-new-mexico-assists-identity-theft-victims/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unm-students-employees-could-be-victims-of-id-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailylobo.com/article/2016/08/unm-identity-theft"}],"summary":"Over 1,000 former students and employees of UNM recently had their identity stolen from a University database","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-06-01","discovered_date":"2015-03-12","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0963d1d3ed8b24a3898dd236f95c9a136bb6460b","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/4708_HUB%20Data%20Breach_Notice_v2%20%283%29_0.pdf"},"notes":null,"org_country":"US","org_id":"160f94cd7c57","org_name":"The Wonderful Company LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56201"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/4708_HUB%20Data%20Breach_Notice_v2%20%283%29_0.pdf"}],"summary":"A HUB employee's stolen laptop contained The Wonderful Company workers' compensation claim information, including Social Security numbers.","supporting_quote":"On February 27, 2015, a HUB employee supporting these services had his password-protected laptop stolen from his locked car.","technology_involved":["laptop"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"HUB"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"92ec6217c432","name":"HUB"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54f73cca372440b1bf81de1a27272c17318901d1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8188F81-0CCF-4E2A-860A-15D236D3D1D5"},"incident_date":"2015-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5327f190a72","org_name":"St. Mary Medical Center","org_type":"healthcare","ransomware":true,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buckscountycouriertimes.com/news/local/ransomware-attack-on-info-of-k-patients-at-ambulatory-surgery/article_17c97124-479b-11e6-87da-e76488b7128f.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckersasc.com/asc-turnarounds-ideas-to-improve-performance/ambulatory-surgery-center-at-st-mary-suffers-data-breach-affecting-13k-patients-5-key-points.html"}],"summary":"Ransomware attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8d04a27fcc051eebea7f6c27bb471a4203bad9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67D76339-98B9-4BE1-A7E2-D4CA0107A7C0"},"incident_date":"2015-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d601b87a4f1","org_name":"St. Lucie Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wptv.com/money/consumer/st-lucie-medical-center-gave-patient-records-to-wrong-patient-exposing-social-security-numbers"}],"summary":"medical records given to the wrong patient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40a256bffa275f175b172ecbe0d7367fb49ca343","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07D10456-689C-497F-BEE3-387A999C6A2B"},"incident_date":"2015-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"289f8a8fc481","org_name":"Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc11news.com/home/headlines/GJPD-investigating-another-skimming-device-306276031.html"}],"summary":"GRAND JUNCITON, Colo. For the second time in a week, Grand Junction Police have found and removed a credit card skimming device. The latest skimmer was found at a local gas station.  The skimming device, about the size of a pen, was found at the Shell gas station at 745 Horizon D","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64f259f4263cb7bd8837dce0dcd3baaefbfaabbe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80E4D6CC-2451-45DB-B301-8D38370DA4EB"},"incident_date":"2015-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"afc1f19aca8f","org_name":"Salt Lake County","org_type":"government","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/data-accessible-on-internet-salt-lake-county-sends-out-14k-notification-letters/article/448843/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/salt-lake-city-20151009.pdf"}],"summary":"The Salt Lake County, Utah mayor's office has sent out approximately 14,000 notification letters to those whose data was exposed in an incident involving workers' compensation and other damage claims submitted to the County.  How many victims? Approximately 14,000 notification le","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e2edb9f0675b89447412a6c94f15712b6139a75","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA7029D2-34BF-459B-905C-0A1E42FCD172"},"incident_date":"2015-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/baltimore-riots/bs-md-rite-aid-statement-20150603-story.html"}],"summary":"As looted prescription drugs flood Baltimore streets, fueling a surge in violence, pharmacy chain Rite Aid warned customers Wednesday that their personal medical information could be on the streets, too.  Store officials said the labels on prescriptions stolen during the late Apr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f374dc14fdb62495fe7fe15515cdba4a3605369","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"236c8830-e933-11e9-b01d-8d8474fb7a4b"},"incident_date":"2015-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4be569c69de2","org_name":"National Credit Federation","org_type":"financial","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberscoop.com/national-credit-federation-aws-s3-leak-upguard-chris-vickery/"}],"summary":"Florida-based credit firm leaves 113GB of customer data on an open s3 bucket","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35190de62b15955e863245453ba4e559a8f936b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CA35432-61AB-4FDB-8ECD-84297C231C2C"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2e9a2ee20fa","org_name":"Montefiore Health System","org_type":"healthcare","ransomware":null,"records_affected":12517,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.crainsnewyork.com/article/20150619/HEALTH_CARE/150619832/montefiore-data-breach-exposes-information-for-more-than-10k-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.crainsnewyork.com/article/20150619/HEALTH_CARE/150619832/montefiore-data-breach-exposes-information-for-more-than-10k-patients"}],"summary":"An employee theft has exposed 12,517 patients of the Montefiore Health System to a data breach. Montefiore announced Friday that it is notifying those patients that their information was stolen by a former employee between January 2013 and June 2013. The hospital wasn't aware of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d58889869e70da4da39b3ad980d169e55b74a692","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D700E75F-BDBF-4315-BE07-9F4BC8C96A2A"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01a59d848823","org_name":"Mercy Medical Center Redding","org_type":"healthcare","ransomware":null,"records_affected":520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mercy-medical-center-redding-notifies-patients-after-discovering-navihealth-case-manager-was-working-under-a-stolen-identity/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.actionnewsnow.com/news/massive-data-breach-at-local-health-care-group/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/case-manager-duped-navihealth-dignity-health-alerts-patients-to-privacy-breach-3484/"}],"summary":"unknowingly employed a person as a case manager who was working under a false name and nursing license","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5145981d400b69c294cf911bc3de3b03e9563e89","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67ADA44C-5C15-4447-8991-63C34E2980F8"},"incident_date":"2015-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ad3182e3f20","org_name":"Lawrence General Hospital","org_type":"healthcare","ransomware":null,"records_affected":2071,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/lawrence-general-health-data-breach-due-to-lost-flash-drive;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/massachusetts-hospital-reports-missing-unencrypted-thumb-drive-8067/"}],"summary":"Health data breaches due to misplaced flash drives seem to be a rising trend recently, as Lawrence General Hospital is yet another healthcare organization to report an incident. On August 7, the hospital put out a press release outlining the details of the data breach.  The flash","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db9d393a0dcd416769870ff516f03e3cbdd150f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F1A62F8-CC00-4304-80F3-2E46849E7D0F"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d123d7c42a87","org_name":"Hamilton General Hospital","org_type":"healthcare","ransomware":null,"records_affected":397,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-397-medical-records-snooped-at-hamilton-general-hospital/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thespec.com/news-story/6729448-397-medical-records-snooped-at-hamilton-general-hospital/"}],"summary":"Employee misused access to view medical data of patients not in his/her care.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46bad2b1da954ada9730c00250676669124ea66b","impact_type":"unknown","incident_date":"2013-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Green%20Tree%20Sample%20Consumer%20Notification%20Letter%20%28general%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a6520f7edd0b","org_name":"Green Tree Servicing, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56200"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e0fdbc4056013ea25d297b1c2def15a19af7136","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A869CFD0-8FE3-4E99-B7F6-7B57C607BC82"},"incident_date":"2015-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cdfb894c9742","org_name":"East Sussex Healthcare Trust","org_type":"healthcare","ransomware":null,"records_affected":3634,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eastbourneherald.co.uk/news/local/thousands-hit-by-east-sussex-healthcare-trust-data-breach-1-6990252"}],"summary":"Hospital papers have revealed the confidential details of more than 3,500 patients were discovered on an unencrypted data stick.  The incident was discussed at an East Sussex Healthcare Trust board meeting on September 30, which oversees Conquest Hospital in Hastings and the East","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8a970a14f4c31ac8d1ab58af31d02688fa6d8ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F6C3EEE-6E9F-4084-89B7-0E542D75B4DF"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea1a2259b14a","org_name":"Cefalu Eye-Tech of Green, Inc.","org_type":"healthcare","ransomware":null,"records_affected":850,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/details-emerge-on-cefalu-eye-tech-of-green-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/62395"}],"summary":"An employee of Cefalu Eye-Tech of Green, Inc. (Cefalu) photographed computer screens containing the protected health information (PHI) of approximately 850 individuals, including names, addresses, email addresses, and codes for diagnosis and conditions. Following the breach, Cefa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e55b56ff0db76b464a413aa15d134b5bb223152a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74d3d9d0-6c94-11e7-8419-7d473c8dcba3"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d6775b9188a","org_name":"Brand Services LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://louisianarecord.com/stories/510654428-brand-services-seeks-restraining-order-against-former-employee"}],"summary":"A Georgia company is seeking a temporary restraining order and an ex parte seizure order in connection with a lawsuit against a former employee the company claims illegally took confidential company files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2015-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fea87005b243e3ba4a1d8823157ddc54f8dd4bd0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5EF1FD3-1BFC-43E8-A77A-8D6E80B6D46C"},"incident_date":"2015-06-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6b8e89b0358f","org_name":"BlueScope Steel Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/business/bluescope-steel-stung-by-alleged-corporate-espionage-20160107-gm1f0j.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/business/world/75745793/vengeful-retrenched-employee-allegedly-took-top-trade-secrets-with-her"}],"summary":"internal actor downloaded a trove of company documents  about 40 gigabytes  over a four-year period, including code","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-06-01","discovered_date":"2015-12-10","entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b33bc150192ce05a4c89822c040ccad033f499d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C2A653D-B295-4E12-8433-6C1BFB6B6D64"},"incident_date":"2015-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc38cc4e3365","org_name":"Bay Area Chiropractic Center LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/bay-area-chiropractic-center-patient-info-allegedly-stolen-by-doctor-to-open-his-own-practice/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://justice.oregon.gov/consumer/DataBreach/Home/GetBreach/846048661"},{"fetched_at":null,"title":"Oregon DOJ data breach report","type":"state_ag","url":"https://justice.oregon.gov/consumer/DataBreach/#Bay%20Area%20Chiropractic%20Center%20LLC-2016-02-23"}],"summary":"It seems that Bay Area Chiropractic Center LLC had a breach in 2015 that they first reported to Oregon this month.  The breach occurred between June 1, 2015 and August 31, 2015, and was discovered on December 10, 2015. Affected patients were notified on December 22, 2015.  Why th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-12","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13d7bc4ca9c0ddbd279d5b9d86101575540b6e3e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DAC72A3-3820-4FA7-A171-A4120E13CCC9"},"incident_date":"2015-05-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"1dd27d23145b","org_name":"People's Freedom Party (PARNAS)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/politics/344827-voters-personal-data-leaked-online/"}],"summary":"Opposition PARNAS party cancels primaries over massive leak of voters' personal data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"706ad3370a67c86666770d1f50b11c11af8b28a0","impact_type":"unknown","incident_date":"2013-11-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Standard%20Letter%20Template%20with%20Notation%20%283%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c09c863bb3b","org_name":"Beacon Health System","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56184"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/BeaconHealthSystem.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcc7d2f49e13df094df59565ee497d9b4b7095f8","impact_type":"unknown","incident_date":"2015-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SBH%20Website%20Posting_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"98c00237078d","org_name":"Sally Beauty Holdings, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56178"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/SallyBeautyHoldings%2CInc..pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","other"],"disclosed_date":"2015-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8425291c94bc02ba63f8f9950bdaca2d9ce8b49","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"7174f52aa341","org_name":"mSpy","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: mSpy","type":"hibp","url":"https://haveibeenpwned.com/Breach/mSpy"}],"summary":"mSpy’s online service was breached in May 2015, and personal information was made freely available on the internet.","supporting_quote":null,"technology_involved":["mSpy online service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-05-28","discovered_date":"2015-05-08","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d2a602a1a4b936357e00470a0c4a3f254174320","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Heartland%20Payment%20Systems%20Ad%20r1fin_0.pdf"},"notes":null,"org_country":"US","org_id":"99cb4d153f00","org_name":"Heartland Payroll Solutions, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56169"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Heartland%20Payment%20Systems%20Ad%20r1fin_0.pdf"}],"summary":"Computers containing information that may have included Social Security numbers or bank account information were stolen from a Heartland office; the company reported no evidence that the data was accessed or used.","supporting_quote":"Many items, including password protected computers belonging to Heartland were stolen.","technology_involved":["password-protected computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b59591fc784b28829b7221c141fc7f81b99b5f12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6FEC3E1-1D9C-486A-AD25-97B85D6177A0"},"incident_date":"2015-05-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cec586e31cc","org_name":"Department of Homeland Security","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/7844"}],"summary":"Secret Service agents involved in prying into and leaking information from an old personnel file of a top GOP congressman ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"335b7b066587d8394307e23733842d184c3be85f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Copart%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"959832566334","org_name":"Copart Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56154"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Copart%20Notice_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CopartInc..pdf"}],"summary":"Copart reported that an unauthorized person accessed its computer network and may have accessed customers’ personal information and Copart.com account credentials.","supporting_quote":null,"technology_involved":["Copart.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-05-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"664422a7b222a046d7c0ebb33bb3dcef4ecf3fbf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3F40AD0-BC3C-434B-99B0-DD789BA1C35B"},"incident_date":"2015-05-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5e4e6fbb5d8","org_name":"Cloud Imperium Games","org_type":"technology_saas","ransomware":null,"records_affected":48,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com.au/star-citizen-disco-lando-file-leak-2015-5"}],"summary":"Developer inadvertently leaks game info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"294509f18dfcb31aff480b6e14e82e7c9edac755","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A38F703-5856-4EB6-825A-609DA383094E"},"incident_date":"2015-05-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5124559e222c","org_name":"Prima CARE, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/health-data-breaches-stem-from-cyber-attack-exposed-binders"}],"summary":"Prima CARE, P.C. sent data breach notification letters to 1,651 patients after it recovered a binder containing personal information. The documents were found in the pushes in a parking lot on May 25, 2015. Prima said in an announcement on its website that it became aware of the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7046586db78c56f6940d954318c53744d7df19d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCAA8777-1ED5-4197-AA79-9F379ADEB56D"},"incident_date":"2015-05-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84d8c961005e","org_name":"Colorado Department of Health Care Policy and Financing","org_type":"government","ransomware":null,"records_affected":1622,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.9news.com/story/news/local/2015/08/17/personal-medicaid-information-sent--wrong-addresses/31862221/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.colorado.gov/hcpf/client-correspondence-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ihealthbeat.org/articles/2015/8/19/health-care-organizations-respond-to-sued-over-data-breaches"}],"summary":"Mail error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2015-05-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"568aae0b5116721a4df2c486ae5b883fb38d32e7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26EF258E-D5C4-4C84-B822-D5CD66B2278C"},"incident_date":"2015-05-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"9f9fb78e2910","org_name":"Thailand Senate and Public Health Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/anonymous-breaches-thailand-senate-website/"}],"summary":"Anonymous breached into the official website of Thailand Senate and Public Health Ministry","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e875e517599f89281d01c11b32a632245690d95","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B069AB2-9346-4CDA-8C5E-C6CD9D3CCA22"},"incident_date":"2015-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf9a25d81cbc","org_name":"VYC Tires, INC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ago.vermont.gov/assets/files/Consumer/Security_Breach/VYC%20Tires%20Inc%20Security%20Breach%20Notice%20Ltr%20to%20consumer1.pdf"}],"summary":"On May 22, 2013, late in the day, we received notification from CORESense, Ltd. (the company which helps us manage and process our customer orders) that they had just discovered there had been unauthorized access by an outside source to the personal information (including credit ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c32960793c78e768d570b49c768cdb3902a0e2dc","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"bd8d8afdd70c","org_name":"Adult FriendFinder","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adult FriendFinder (2015)","type":"hibp","url":"https://haveibeenpwned.com/Breach/AdultFriendFinder"}],"summary":"Adult FriendFinder was hacked in May 2015, and nearly 4 million records containing personal information were dumped publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2015-05-21","discovered_date":"2015-04-30","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04f7b05f557398539c850f4194a1ec084b269c47","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-04-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Blue%20Spring%20Partners%20Ad%20r1prf_0.pdf"},"notes":null,"org_country":"US","org_id":"a215dad9b2c3","org_name":"Blue Spring Partners, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56084"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Blue%20Spring%20Partners%20Ad%20r1prf_0.pdf"}],"summary":"Blue Spring Partners reported that malware was installed on its website checkout page, potentially exposing customer personal information and payment card details.","supporting_quote":null,"technology_involved":["finfunmermaid.com checkout page","shopping cart system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"890e3e119fc6ea3bbd346937f308d5dc5a826916","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61C6DBDF-A649-4636-8347-4F6759688CEF"},"incident_date":"2015-05-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b10af925c83","org_name":"Alabama State Legislature","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsfa.com/story/29125585/breach-of-al-legislatures-email-system-completely-contained"}],"summary":"Email borne malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"44f59378419647329fc63ed1854fbec636542175","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Associateddentists.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ed0f4b98c6e1","org_name":"Associated Dentists","org_type":"unknown","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Associateddentists.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-05-19","discovered_date":"2015-03-21","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec150760374f100ee4814069c6917bc5f7a10921","impact_type":"data_theft","incident_date":"2015-03-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20release%20Jones%202_0.pdf"},"notes":null,"org_country":"US","org_id":"32615c584bb4","org_name":"Sharon J. Jones, M.D.","org_type":"healthcare","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55986"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20release%20Jones%202_0.pdf"}],"summary":"A break-in at Sharon J. Jones, M.D.'s office resulted in the theft of patient charts, computers, and a server.","supporting_quote":"On the evening of March 20, 2015, our office was broken into and approximately 17 patient charts were stolen along with one desktop computer, two laptops and our server.","technology_involved":["desktop computer","laptop","server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1a154041bf809e4703480d35fe0365b58544264","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4056580C-3F12-4879-922C-AE9362367D4C"},"incident_date":"2015-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc9d736359ef","org_name":"MySchoolFees","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard.net/Education/2015/05/20/School-fee-website-hacked.html"}],"summary":"Online payment processing site is defaced, no evidence of payment card theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88290b345809a1a56b0bfdce34ea0557cfb622bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDAE38DB-D747-4F52-B46E-0E56B48FC2A6"},"incident_date":"2015-05-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"0ab320735da7","org_name":"Japan Pension Service","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/us-japan-pensions-attacks-idUSKBN0OH1OP20150601?feedType=RSS&feedName=technologyNews;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2015/06/01/national/crime-legal/japan-pension-system-hacked-1-25-million-cases-personal-data-leaked/#.VrOehjYrJBw"}],"summary":"Japan pension system hacked, 1.25 million cases of personal data leaked.  The data were leaked when agency employees opened an attached file in their email containing a virus.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9f08ee189e8493b5cdff31f7f9486e4815ebecb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59CD581F-F358-4FDA-9CDF-E7CEE3F99FA5"},"incident_date":"2015-05-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"943ad91f4f68","org_name":"B. Lane, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fashion-to-figure-notifying-customers-of-payment-card-compromise/;"}],"summary":"Ecommerce site for clothing retailer suffered malware infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"189de0451abb4511b4b15b8e8ab9b5da00e45820","impact_type":"unknown","incident_date":"2012-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Penn%20State%20NOTICE%20only%202015.05.18%20_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"887cb2317e3f","org_name":"The Pennsylvania State University, College of Engineering","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55957"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":"The Dark Overlord","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical","personal"],"disclosed_date":"2015-05-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f11f329a7530c0796b2ca22c36036cf25914ed97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B621D22-DB4C-44E9-861E-16DA23E3F338"},"incident_date":"2015-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5165383179d2","org_name":"Peachtree Orthopedic Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/peachtree-orthopedic-clinic-notifies-patients-of-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/local/atlanta/fbi-investigating-hacking-of-local-clinic-database/456571280"}],"summary":"The FBI is working to learn who hacked the patient database of a local clinic.  In the letter, the clinic said a thief hacked into its patient database on September 22, gaining access to names, Social Security numbers, addresses, dates of birth, and patient records.  We regret to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1fb12aef5ef48a3d635ca3bed80ccec8b4f2d21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46AB95DA-9B34-4162-9163-933BC18D0E73"},"incident_date":"2015-05-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0812b7fc44f","org_name":"Daniel A. Sheldon, M.D., P.A.","org_type":"healthcare","ransomware":null,"records_affected":2075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-so-thats-what-happened-sunday-edition/"}],"summary":"On May 18, 2013, OCR received an anonymous complaint alleging that the protected health information (PHI) of the patients of the covered entity (CE), Dr. Daniel Sheldon, M.D., P.A., was accessible on the internet via Google.  OCR confirmed the allegations when it identified web s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"1617425970f20bf0bb6f06c4e3b376961b91bdac","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/BlairandAssociates%2CLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"64ba39f27072","org_name":"Blair & Associates, LLC","org_type":"unknown","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/BlairandAssociates%2CLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a05aed8667064f25be29c9370a42201b4dfc58ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2EC57B8-6D41-4D85-A88E-D10F5EFD7D3C"},"incident_date":"2015-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51eddc6e1c0d","org_name":"Stripes","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kristv.com/story/32012089/skimming-device-found-at-gas-station-under-investigation"}],"summary":"Gas station skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0d1c29ef70e2212e2f0a299ad5ee4f9f0822511","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF14223C-BF57-4E71-94B6-8538ADBDE2B0"},"incident_date":"2015-05-15","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"de9e135cc580","org_name":"Interpark Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":10000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/10-million-customers-data-leaked-from-online-shopping-site/"}],"summary":"An unidentified suspect allegedly hacked into the server of Interpark Corp. and stole customer information, including names, addresses and phone numbers, in May. A total of 10 million records were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb5f2fe22a7f3027d47aaaed293a451d2990d4c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2800B785-C1CB-4640-9C12-E819EB340984"},"incident_date":"2015-05-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ea636401917","org_name":"ProMedica hospitals","org_type":"healthcare","ransomware":null,"records_affected":3472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mi-patient-info-at-2-promedica-hospitals-breached/"}],"summary":"Private medical records of 3,472 patients at two ProMedica hospitals in Michigan were inappropriately breached by seven employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d03c9b107e35ee784e48c28e06f1d60b234f252","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DC8277A-F1C2-4743-A196-C0B3105057B6"},"incident_date":"2015-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"b2f84f106dda","org_name":"Acer Inc","org_type":"manufacturing","ransomware":null,"records_affected":34000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hothardware.com/news/acer-confirms-online-store-breach-nearly-a-years-worth-of-credit-card-data-exposed;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/hackers-harvest-card-details-from/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworm.net/2016/06/acers-u-s-webstore-hacked-names-mailing-addresses-credit-cards-leaked.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/3085649/security/acer-online-store-breached-34-000-customer-credit-cards-stolen-over-the-last-year.html"}],"summary":"Acer hacked via third party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"w0rm","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"890e9244b462ba24bb93ee74072a47257c167aa3","impact_type":"data_theft","imported_from":null,"incident_date":"2015-05-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"036a8a5a019c","org_name":"Спрашивай.ру","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Спрашивай.ру","type":"hibp","url":"https://haveibeenpwned.com/Breach/SprashivaiRu"}],"summary":"Спрашивай.ру user details, including personal information and passwords, were exposed in a 2015 breach attributed to hacker w0rm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"w0rm"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-11","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1c91cf60c63bb97c21c5114b691a17ffef4c69f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Longwood%20Notice%20Template_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"f79b62e866a7","org_name":"Longwood Management Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55875"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Longwood%20Notice%20Template_0.PDF"}],"summary":"A burglar stole a password-protected laptop issued to a Longwood employee from the employee’s vehicle.","supporting_quote":"During the burglary, a password-protected laptop we issued to this employee was stolen.","technology_involved":["password-protected laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"981aa19f94f37f876d1a76460792c14db440a6be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4EE690D8-3FE0-40E5-81A7-D9C3EE80A215"},"incident_date":"2015-05-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a2619a944e7","org_name":"Lasair Aesthetic Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/co-lasair-aesthetic-health-notifying-patients-after-manager-took-information-after-resigning/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/lasair-aesthetic-health-notifies-patients-of-privacy-breach-3511/"}],"summary":"Employee sends internal doc to personal email account before resignation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-05-11","discovered_date":"2015-04-09","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6243e4146d79977d7f1f46da6511bf5937d4bca1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Honig%27s%20Consumer%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"909d124fb181","org_name":"Honig's Whistlestop Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55876"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Honig%27s%20Consumer%20Notification%20Letter_0.pdf"}],"summary":"Honig's Whistlestop Inc. confirmed that its website was breached and customer information was accessed.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53f2e29570564279068ac6b34177b57918bd7809","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DEDC3F7-992A-4D3B-B71C-577CD848FA0F"},"incident_date":"2015-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef86325458ce","org_name":"Blue Cross & Blue Shield of California","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/blue-shield-of-california-notifies-some-members-of-exposure-breach-following-software-update/,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notification%20Letter_0.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/software-update-causes-phi-exposure-for-blue-shield-of-calif"}],"summary":"Due to a glitch in code during an upgrade of their website three customers who logged in simultaneously could see information about each others policies. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92e73c023a4009e01583fcb99ad86a36134ca63f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6588FA69-2800-452E-AB9A-A2012DFA0F2E"},"incident_date":"2015-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ff6263befed","org_name":"Medical Informatics Engineering","org_type":"professional_services","ransomware":null,"records_affected":3900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalgazette.net/business/Local-medical-software-company-hacked-7127894;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wlky.com/news/Metro-employees-personal-information-at-risk-after-Concentra-data-breach/34290346;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businesswire.com/news/home/20150724005450/en/Medical-Informatics-Engineering-Updates-Notice-Individuals-Data;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.landlinemag.com/Story.aspx?StoryID=29554;"},{"fetched_at":null,"title":null,"type":"press","url":"http://t.co/XNf5rLMUor;"}],"summary":"Indiana Attorney General Greg Zoeller has started an investigation in the hacking of Medical Informatics Engineering (MIE) and its subsidiary NoMoreClipboard, both Indiana-based companies that provide data administration services for hospitals and clinics across the US.  The data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5acd87ea1aa7a7965c12290e10161da3447f452e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B08FFCCF-B838-495B-81CE-A4A984B16EC9"},"incident_date":"2015-05-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California, San Francisco","org_type":"education","ransomware":null,"records_affected":435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ucsf.edu/news/2015/07/130926/ucsf-reports-laptop-burglary-faculty-office"}],"summary":"UC San Francisco is alerting individuals about a burglary involving an unencrypted laptop belonging to a faculty member in the Cardiac Electrophysiology & Arrhythmia Service that contained some personal, research and health information.  While there is no evidence of attempted ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"5663da57006e14826f3905c8c05250595db9698b","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Hough%2CGelfand%26Associates%2CCPA.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"149f9b43eee4","org_name":"Hough, Gelfand & Associates, CPA","org_type":"unknown","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Hough%2CGelfand%26Associates%2CCPA.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"f6371b3150a6d0b295fa452de1eb97c3101e09fe","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/HardRockHotel%26CasinoLasVegas.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1efc6300a1c7","org_name":"Hard Rock Hotel & Casino Las Vegas","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/HardRockHotel%26CasinoLasVegas.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Assange Shuffle Collective","variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d33650469682a162cd64d03ba2709c638c41fc1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3070845-807B-4EEE-A2E9-371DE5F0C6F2"},"incident_date":"2015-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"710cb681c07c","org_name":"Yesco","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dailydot.herokuapp.com/lol/goatse-billboard-atlanta/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-32826351"}],"summary":"Hackers changed an electronic billboard to display the famous Goatse image for hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"assangeshufflecollective"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d502a86f26f2a90d8e662ce30395ddda318b9d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7a22dc0-e07b-11e9-9ff0-a5a30eaf0927"},"incident_date":"2015-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24ffc09c0cb3","org_name":"WeWork","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cnet.com/news/weworks-weak-wi-fi-security-leaves-sensitive-documents-exposed/"}],"summary":"Wifi is open and unencrypted shared between all customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0176e5c7490677a2ad2cb89b481c071229b2e2c7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"240131BF-CA65-4FAC-99AF-6B5C5A4E10EB"},"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec9a876e33f8","org_name":"West Ada School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://legacy.ktvb.com/story/news/crime/2015/05/15/student-accused-of-cyber-attack-on-west-ada-district/27403905/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kotaku.com/kid-arrested-for-doxxing-entire-school-district-1705666374"}],"summary":"Kid Arrested For DDOSing West Ada School District.  The teenager paid someone to overwhelm the system with traffic from multiple sources; internet went down multiple times. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36373a6e12c87b726923e9ef3cc7c4823c772404","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4346a110-eeab-11e7-b683-c1703914e4a4"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb5ecd31ceb","org_name":"Vanderbilt University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/vanderbilt-umc-hit-with-data-breach-during-epic-ehr-implementation.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wkms.org/post/vanderbilt-university-medical-center-security-breach-affects-3000-patients-officials-say;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/79k-patients-affected-by-emory-healthcare-data-breach;"}],"summary":"Between May 2015 and December 2016, two VUMC patient transporters accessed information from VUMC patients' electronic medical records, including names, birthdates, medical record identification numbers and some Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e6d8e87d5415b1b544d087125ebbae2ca4a79ba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"939A51CF-A852-4C18-B624-A96BCFA926EC"},"incident_date":"2015-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"143862758ea2","org_name":"Times Internet","org_type":"technology_saas","ransomware":null,"records_affected":12500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hacker-accesses-gaana-com-user-data-after-site-fails-to-respond-to-security-alerts/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thetechportal.in/2015/05/28/gaana-com-suffers-massive-data-breach-details-of-over-10-million-users-exposed/"}],"summary":"Gwyn D'Mello reports that an online music site was hacked to make a point after they failed to secure their site despite multiple warnings: A white hat hacker used an exploit to gain access to Gaana.com user credentials, because they neglected to fix a security bug he reported. I","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864e5ee24968db8284d09b412080de7e04b80116","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B687C34-0A8B-40FB-8C2E-54986E43D73F"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ac947435cc4","org_name":"SUNY Upstate University Hospital","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ny-nurse-who-took-pics-of-patients-private-parts-at-syracuse-hospital-turns-in-license/"}],"summary":"A nurse who took photos of an unconscious [SUNY] Upstate University Hospital patient's penis with her smart phone has turned in her nursing license.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59b626206c07713aca64b170141f061d91abe541","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"861139AA-B8E4-4317-BB92-D6B0E5D98F73"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a8c7319bdc35","org_name":"Saskatchewan Cancer Agency","org_type":"government","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatchewan/sask-cancer-agency-employees-may-have-snooped-on-48-patients-1.3160563;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatchewan/info-breach-at-sask-cancer-agency-not-acceptable-privacy-commissioner-1.3161588;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/saskatchewan-cancer-agency-patient-privacy-breach/"}],"summary":"The Saskatchewan Cancer Agency says it has disciplined two employees after the health records of 48 people were apparently snooped on.  The agency said Monday that it began investigating after learning of the breaches May 13.   The information viewed included an individual's name","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f65f1baab85f650538aea863f720d4559f67573b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5A41A56-6035-4429-B817-B1953764CAC5"},"incident_date":"2015-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"704a7586aed8","org_name":"OhioHealth Riverside Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":1006,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/patient-data-included-on-missing-thumb-drive-ohiohealth-says/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/ohiohealth-reports-loss-of-flash-drive-containing-1006-protected-health-records-8045/"}],"summary":"Patient data included on missing thumb drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"784a20d244795b559ab5b7865a0c2c9e50a57401","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C8E0DC6-5E12-43E2-9327-19A9C4E8AB4A"},"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ea2326ed32f","org_name":"Northshore School District","org_type":"education","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wa-northshore-school-district-students-receive-emails-with-inappropriate-messages/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://q13fox.com/2016/05/29/northshore-school-district-students-receive-emails-with-inappropriate-messages/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://komonews.com/news/local/thousands-of-northshore-sd-student-gmail-accounts-hacked"}],"summary":"The Northshore School District is updating parents that student's emails were not hacked, instead were spammed after first warning parents that an outsider gained access to student emails. Now students are locked out of their emails with just weeks left in the school year, as the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"687064b0217879f409735bd1be6472337feaf4a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10C45B97-0D3E-4320-A5F0-543BD3AD3C28"},"incident_date":"2015-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fda03d3bca75","org_name":"McLean Hospital","org_type":"healthcare","ransomware":null,"records_affected":12600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mclean-hospital-brain-donators-have-phi-exposed-8047/"}],"summary":"Lost back up tapes resulted in loss of PHI data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3e25dda737c179503ee45b02166cd07c4e8b0f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23C4FD85-519A-4ED7-9E93-45D88E385E3E"},"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"1333987933c5","org_name":"Irish Bank Resolution Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/business/irish/ibrc-identifies-source-of-leaked-bank-data-31300734.html;;http://www.irishtimes.com/business/financial-services/rt%C3%A9-story-on-o-brien-and-ibrc-based-on-leaked-letter-to-bank-liquidator-1.2210012"}],"summary":"The special liquidators to the Irish Bank Resolution Corporation are understood to have identified the source of the leak of confidential client data from the bank.           Share  _   _   _   _             The individual is understood to be an employee of the bank who provided ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61bff8619f5b704f43743877ea1113326f5f257a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C52741D-C46F-45A0-AB41-C1F29303843A"},"incident_date":"2015-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc90b1a5802c","org_name":"Internal Reveune Serivce","org_type":"professional_services","ransomware":null,"records_affected":101000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2016/02/irs-website-attack-nets-e-filing-credentials-for-101000-taxpayers/"}],"summary":"IRS hit by a malware attack that stole the PII of 101k citizens.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da9efd24e4e2f307eef413d7aa67f31812c3967a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FFDA8A4-E656-4D30-8270-E6AB498431B6"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c4a14ae529f","org_name":"Harvey Pain Institute","org_type":"healthcare","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wzzm13.com/story/news/2016/01/20/identity-theft/79087070/"}],"summary":"billing clerk who worked in two doctor's offices is accused of using patient information to write checks and apply for credit cards using stolen identities.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"TH","motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebac1930ba235e2c4c7469e6ec5e31dcd6a8ccae","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E7BEC1D-0008-4CB8-B4AF-E43E261546B4"},"incident_date":"2015-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"625313b62d9b","org_name":"FriendFinder Networks Inc","org_type":"technology_saas","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2925833/data-breach/adult-friend-finder-confirms-data-breach-3-5-million-records-exposed.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bustle.com/articles/85232-hack-of-adultfriendfinder-one-of-the-largest-hookup-sites-exposes-4-million-members-personal-information-from"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Full-Adult-Friend-Finder-Database-Up-for-Sale-for-70-Bitcoins-482157.shtml"}],"summary":"Online \"dating\" site database compromised 3.5 M usernames, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c5d82b4d353210bb48e06b4bdadc3904f9a375d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93CD5B40-DF17-41F8-BD09-269EDE8384E1"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d73f740e801e","org_name":"Federal Reserve Bank of Chicago","org_type":"financial","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2016/03/18/business/dealbook/former-chicago-fed-employee-guilty-of-theft-of-secret-documents.html"}],"summary":"Insider took sensitive documents with him to new job.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c1454b98c65796dca8c67f35418357e6770e789","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00514A10-BEA4-440B-8B18-EAE02531A475"},"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a200d79a6515","org_name":"Depatment of Agriculture","org_type":"government","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oops-ohio-agency-failed-to-redact-personal-info-in-public-records-request/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.13abc.com/home/headlines/Major-personal-information-release-by-state-of-Ohio-322449662.html"}],"summary":"gov't releases private data instead of tiger data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b02d9e6934f9bc810d5d616f86baf133d40f289","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B618C84-56AE-4703-91A8-D74A205F9706"},"incident_date":"2015-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/hipaa-breach-1111-veteran-records-improperly-dumped-8058/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2015/08/02/sd-va-waits-more-than-two-months-to-notify-1100-veterans-data-breach/"}],"summary":"health records were improperly disposed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af35152e4cdd1212b3e04a5734c507de207abd79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61175D39-06FC-4B92-A11B-48AA3EDF4D58"},"incident_date":"2015-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5755f239306a","org_name":"CVS Caremark Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiegouniontribune.com/news/2015/jul/17/pharmacy-patient-data/"}],"summary":"ID theft by pharmacy worker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe222be4e957da7405cea0c3a84645552e1d909a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07296FDE-43C0-4772-AAD5-244B1D4C5549"},"incident_date":"2015-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e15eef264119","org_name":"Boston University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/health-data-breaches-stem-from-hacking-employee-theft"}],"summary":"Boston University server was compromised and used to launch other attacks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aff33efc89079f8a7e107a074ccb4d079b369e13","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F959A5F-3C6B-45D5-A5A6-9B943AF18A9D"},"incident_date":"2015-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a89d45a76ef4","org_name":"Blue Shield","org_type":"financial","ransomware":null,"records_affected":843,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.desertsun.com/story/money/business/2015/06/11/843-blue-shield-members-affected-by-data-breach/71091786/"}],"summary":"A total of 843 Blue Shield of California members had their personal information compromised during a data breach in May, officials said Thursday.  The personal information that was accessible during the breach included first and last name, Blue Shield identification number, date ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cba6eaa7abb5a3b471343aed87dcd0e2beca0e02","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB2B9AE2-BB40-454B-9461-6894059F9E4E"},"incident_date":"2015-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5832db422153","org_name":"Access Adult Family Care Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abcactionnews.com/news/local-news/i-team-investigates/police-fear-assisted-living-home-operator-may-stolen-multiple-patients-identities"}],"summary":"Police fear assisted living home operator may stolen multiple patients' identities - Access Adult Family Care Home  Police said at least one former patient was a victim of identity theft.   The woman's daughter discovered her credit card had been used several times after she died","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-30","discovered_date":"2015-03-14","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"160a2cabfe47253b57b4b3aaab921a9984eda75b","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-12-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCB%2004-30-15%20Breach%20Notice%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"1f16e2ea9241","org_name":"University of California, Berkeley","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55760"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCB%2004-30-15%20Breach%20Notice%20Sample_0.pdf"}],"summary":"The University of California, Berkeley reported unauthorized access to a web server that stored student information, including personal and financial information.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b74c6ab9c48242a3b9f14d794c47403a718019ce","impact_type":"unknown","incident_date":"2014-09-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Individual%20Notice%20TEMPLATE_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af0a7fe61b88","org_name":"Hard Rock Hotel & Casino","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55764"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdce494cb768f73dc8ec85226954b31f261b7555","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/cms1_227482_0.pdf"},"notes":null,"org_country":"US","org_id":"d4b4bbd1ef48","org_name":"County of Los Angeles","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55750"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/cms1_227482_0.pdf"}],"summary":"The County of Los Angeles notified patients that information involved in an incident may have included medical records and personal identifiers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d104d0e1df3787e1491fdde32c3b6955a5702290","impact_type":"unknown","incident_date":"2015-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CTHP%20Exhibits_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"044bc9f7e18c","org_name":"Consolidated Tribal Health Project, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55669"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34b53b1e58e2b53c03542b7db3b61220e0638880","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2015-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"IN","org_id":"35920106cdcb","org_name":"Telecom Regulatory Authority of India","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Telecom Regulatory Authority of India","type":"hibp","url":"https://haveibeenpwned.com/Breach/TRAI"}],"summary":"The Telecom Regulatory Authority of India published emails from citizens supporting net neutrality, including names, email addresses, message contents, and other personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23e692a602c60c8c0f86b8500f38797ab981aa80","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BD1CDC9-F16F-44D2-86C9-807DC4D3031C"},"incident_date":"2015-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9d4410e2a1c","org_name":"Rutgers University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/middlesex/index.ssf/2015/04/cyber_attack_against_rutgers_causes_internet_servi.html"}],"summary":"Denial of service cyber attack was behind the outage of the internet for the Rutgers University. even though, that the IT department of the university said on their Facebook page, they are working to restore the service and investigating what cause the outage. On the other hand t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-27","discovered_date":"2015-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"675b30c4a090f55356730643c609962838c2ec1d","impact_type":"data_theft","incident_date":"2015-01-27","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Anthem%20Breach%20Filings%20Letter%202%202015%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"42176c896062","org_name":"International Coffee & Tea, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55652"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Anthem%20Breach%20Filings%20Letter%202%202015%20FINAL_0.pdf"}],"summary":"Anthem reported that attackers accessed its information technology system and obtained personal information relating to consumers covered by International Coffee & Tea, LLC.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anthem"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c9dc15af44b2","name":"Anthem"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-27","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e081a09eeeb6e41695d85d19d8942c0e1cbfc50f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-02","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Compass_Proof%20Copy%20Media%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"428a0e7e99dc","org_name":"Compass Group USA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55656"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Compass_Proof%20Copy%20Media%20Notice_0.pdf"}],"summary":"Compass Group USA reported that malicious software designed to capture payment card information was installed on certain NEXTEP self-serve kiosks.","supporting_quote":"Based upon an extensive forensic investigation, it appears that unauthorized individuals installed malicious software designed to capture payment card information on certain NEXTEP self-serve kiosks, including those in use at the locations identified above.","technology_involved":["NEXTEP self-serve kiosks"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"NEXTEP"},"updated_at":"2026-10-10","veris_action":"malware","derived":{"vendors":[{"id":"0f1057a42be5","name":"NEXTEP"}]}},{"actor":{"category":"external","country":"ID","motive":"ideology","name":"Gantengers Crew","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74a06dcb61cbf32341a28e7a9a182b744c81aa70","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C79B101-1C40-4CC7-BEA1-597A4A0A6391"},"incident_date":"2015-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14b6aa069e8a","org_name":"Mastercard Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/indonesian-hackers-hack-mastercard-website/"}],"summary":"Indonesian hackers from the group Gantengers Crew hacked and defaced MasterCard's website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"gantengerscrew"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9db8fc9e7e5c3f4e838be2abb01356c17b60134d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FDF054B-52CF-422D-BD63-35C8B8F72C44"},"incident_date":"2015-04-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e59e5e60f9c","org_name":"Lansing Board of Water & Light","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lansingstatejournal.com/story/news/local/2016/10/12/bwl-employee-severances/91862614/"}],"summary":"employee unknowingly opened an email with an infected attachment ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","credentials"],"disclosed_date":"2015-04-24","discovered_date":"2015-04-08","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fc4723aa04f0992455aaba9cd5ec8ea243f6462","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Staters%20Bros%20-%20Pin%20Pad%20Incident%20Website%20Notice%20v2_0.pdf"},"notes":null,"org_country":"US","org_id":"10bc13d78f59","org_name":"Stater Bros. Markets","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55627"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Staters%20Bros%20-%20Pin%20Pad%20Incident%20Website%20Notice%20v2_0.pdf"}],"summary":"Suspects physically installed a skimming device on a Stater Bros. Markets deli point-of-sale terminal that may have captured payment card information.","supporting_quote":"Regrettably, on April 8, 2015, we discovered that three suspects connected a small data capture device to the pin pad of a point-of-sale terminal in the deli area of our West Covina, California store.","technology_involved":["point-of-sale terminal","pin pad"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e753327eeed3770a96206ca4c3d7252cfe526267","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8910D586-6812-481B-8CF5-808B4C7660BE"},"incident_date":"2015-04-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c72a57caaca","org_name":"Atkinson, Andelson, Loya, Ruud & Romo","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/personal-data-on-laptop-stolen-from-attorney-with-california-law-firm/article/428222/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-57094"}],"summary":"Stolen laptop w/ PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e16f2847825802c932749bd4745410438126512","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CS_California_0.pdf"},"notes":null,"org_country":"US","org_id":"bb3053e1495b","org_name":"AT&T","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55594"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CS_California_0.pdf"}],"summary":"AT&T reported that customer accounts were accessed without authorization between February and July 2014 in an effort to request codes for using AT&T-programmed phones on other networks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e97ef6670b20953893502326289ee3c1f5beb11a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D7B8F2B-F990-40AA-9358-2C8EA4A6DCB5"},"incident_date":"2015-04-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c1cf2f880c7","org_name":"U.S. HealthWorks","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/USHW%20Letter_0.PDF;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pymnts.com/news/2015/unencrypted-laptop-exposes-us-healthworks-to-data-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56185"}],"summary":"U.S. HealthWorks, a California-based health care service provider specializing in urgent care and occupational medicine, recently alerted employees to a data breach after a password protected (but unencrypted) laptop was stolen in April.  According to its website, the company ope","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-22","discovered_date":"2015-03-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63454cc71c4ef6e16ddac7d7e9fffd53e88c3d83","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20CA%20Consumers_0.pdf"},"notes":null,"org_country":"US","org_id":"7c938d853670","org_name":"Freedom Smokes, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55579"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20CA%20Consumers_0.pdf"}],"summary":"Freedom Smokes discovered unauthorized code on its website that may have been used to obtain customer information entered during purchases.","supporting_quote":null,"technology_involved":["website shopping cart"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8fb8f563cc11924492b544d70ba08785e901ae6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADA9CE28-42D7-4AA3-90AA-8AECA9AF66A1"},"incident_date":"2015-04-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8195ed2dfb32","org_name":"Berkeley Endocrine Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-email-gaffe-at-clinic-exposes-patients-names-and-email-addresses/"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Berkeley%20Endocrine%20Notice_0.pdf"}],"summary":"On April 22, 2016, my office was subject to a spam email which we believe went to many patients. Though no patient information was affected by that correspondence, we sent a notification email to all individuals on our email list, informing them of the spam. Inadvertently, the re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9219d591130819a5690baae2b9a79355a92591e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4860DE40-FB71-4E39-88DA-F0490664F2EE"},"incident_date":"2015-04-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6f6a84082e9","org_name":"Applebee","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wavy.com/2015/11/23/applebees-employee-fired-for-having-credit-card-skimming-device/"}],"summary":"waitress with skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31c962662f5e3ac1539325edfc3e859e759ae15f","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Epic%20Foods%20Media%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f7eb0cde739c","org_name":"Epic Foods dba Bistro Burger","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-52559"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Epic%20Foods%20Media%20Notice_0.pdf"}],"summary":"Epic Foods reported that malicious software was installed on payment card processing systems at its Market Street Bistro Burger location, potentially exposing customers’ card data.","supporting_quote":null,"technology_involved":["payment card processing systems","computer server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cbfce905ff16c23e4d244cce7f6e3d51cca1272","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bf687b90-904c-11e8-8b32-9bc4732308c2"},"incident_date":"2015-04-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9497d7e051f","org_name":"Strategic Analysis","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/strategic-analysis-inc-provides-notice-of-data-event-300680820.html"}],"summary":"On November 23, 2017, Strategic Analysis (\"SA\") received indications of suspicious activity involving certain systems in their IT infrastructure. SA became aware of unauthorized access to a number of SA accounts, systems, and data beginning April 20, 2015 and continuing through J","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-17","discovered_date":"2015-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bc4b7b8505974f0be40ee349d64491de14cf2bd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Abbott%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"ec04c5c3d6bf","org_name":"Abbott Laboratories","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49420"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Abbott%20Notification%20Letter_0.pdf"}],"summary":"Personal information about some Abbott health care plan participants was exposed in the Anthem cyberattack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anthem"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c9dc15af44b2","name":"Anthem"}]}},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b61eaa214cf6e1e7160f305c330450ca6b0cf105","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA9FD4C0-4054-4E3F-9EA9-2FA05DD202DD"},"incident_date":"2015-04-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"be463d27b8d9","org_name":"Office of Personnel Management","org_type":"government","ransomware":null,"records_affected":21500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/world/national-security/chinese-hackers-breach-federal-governments-personnel-office/2015/06/04/889c0e52-0af7-11e5-95fd-d580f1c5d44e_story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2015/06/06/us-cybersecurity-usa-idUSKBN0OL1V320150606;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.slate.com/blogs/future_tense/2015/06/05/office_of_personnel_management_discovered_hack_while_trying_to_upgrade_security.html?wpsrc=sh_all_dt_tw_top;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlestondailymail.com/article/20150611/ARTICLE/150619767/1276;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hosted.ap.org/dynamic/stories/U/US_GOVERNMENT_HACKED?SITE=SCAND&SECTION=HOME&TEMPLATE=DEFAULT;"}],"summary":"Hackers working for the Chinese state breached the computer system of the Office of Personnel Management in December, U.S. officials said Thursday, and the agency will notify about 4__million current and former federal employees that their personal data may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9744fc731b8b8ed54927b12441a2b53624d41c2d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C34C4215-0A81-42E8-A9A8-7B257DFFE57B"},"incident_date":"2015-04-15","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5a6adb844aa","org_name":"DeCicco Grocery Chain","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2015/04/29/deciccios-market-data-breach-ardsley/;"}],"summary":"DeCicco;s grocery chain attacked for customers credit card information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb585ccc3f53573a8eb0fd8e3e7c1ee43906fd82","impact_type":"unknown","incident_date":"2015-04-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Stanilslaus%20Surgical%20Hospital_041415_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c0042a3d820","org_name":"Stanislaus Surgical Hospital","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49325"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ae4ae4fe4995ef946868fe82bcae3e8181cb059","impact_type":"unknown","incident_date":"2015-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Homebridge%20Data%20Security%20EE%20Notification%20Letter%2013%20April%202015_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"07d8e4c1b0a3","org_name":"Homebridge, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49328"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd1fca263b278ca0ff1a7396c3c582e4b46620e9","impact_type":"data_theft","imported_from":null,"incident_date":"2015-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"MD","org_id":"e156de8ce053","org_name":"StarNet","org_type":"telecom","ransomware":null,"records_affected":139395,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: StarNet","type":"hibp","url":"https://haveibeenpwned.com/Breach/StarNet"}],"summary":"StarNet's database was published online in February 2015, exposing customer email addresses and personal details.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-10","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4034efb159688ce526da64c06f98575b06add347","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCR%20Graduate%20Division%20Computer%20Theft%20Notification%20Draft%20Memo%20March%202015%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"13c59b0f3eaa","org_name":"University of California, Riverside","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49300"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCR%20Graduate%20Division%20Computer%20Theft%20Notification%20Draft%20Memo%20March%202015%20FINAL_0.pdf"}],"summary":"A computer containing graduate student applicants’ names and Social Security numbers was stolen from University of California, Riverside’s Graduate Division offices.","supporting_quote":"On Friday, March 13, 2015 University of California, Riverside (UCR) officials were notified of a computer theft from UCR’s Graduate Division offices.","technology_involved":["computer system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bee855cafd21f6e675c3dc302af0c3d81ec0c0ca","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/K-A%20Notification%20Letter%20K-A%20Version_0.pdf"},"notes":null,"org_country":"US","org_id":"e80522e12041","org_name":"Kellogg & Andelson Global Management","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49323"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/K-A%20Notification%20Letter%20K-A%20Version_0.pdf"}],"summary":"Kellogg & Andelson Global Management reported suspicious activity involving client accounts and said some personal information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"799f5eed84f8203232b4abc0304c21e692274988","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IdGrd_1%20-%2047%20State%20B_AG_0.pdf"},"notes":null,"org_country":"US","org_id":"58be27bcb6f2","org_name":"HSBC Finance Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Personal information about certain customer mortgage accounts was inadvertently made accessible via the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49318"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IdGrd_1%20-%2047%20State%20B_AG_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/HSBC.pdf"}],"summary":"HSBC reported that personal information about certain customer mortgage accounts had been inadvertently accessible via the Internet.","supporting_quote":"personal information about certain customer mortgage accounts was inadvertently made accessible via the Internet which we believe was towards the end of last year.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bc958d0232bd74133a7b33f046490642d3fda40","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA246080-8D52-4EE0-ACA1-36FCBC1B4E09"},"incident_date":"2015-04-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc70b1c4c5e1","org_name":"Oceans Acquisitions, Inc.","org_type":"healthcare","ransomware":null,"records_affected":659,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/eight-months-after-laptop-theft-oceans-acquisitions-notifies-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.txheadlines.com/index.php/public_notices/article/Notification-of-Potential-Data-Breach-In-December-2015-Oceans-Acquisitions-/"}],"summary":"Notification of Potential Data Breach In December 2015, Oceans Acquisitions, Inc. began notifying patients in the Abilene area about a possible data security breach that may have resulted in exposure of a limited amount of protected health information (PHI). The potential exposur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"929412f863925f1eef2087e4e0a9cebe087ef0e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E53D63D-DFE5-42DF-AC71-5A089C156A44"},"incident_date":"2015-04-08","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0807e06316c","org_name":"SendGrid","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to-steal-customer-credentials/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://sendgrid.com/blog/update-on-security-incident-and-additional-security-measures/"}],"summary":"Attackers compromised a Sendgrid employee_s account, which was then used to steal the usernames, email addresses and (hashed) passwords of customer and employee accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49967a4e241a159f032589a4bf7c618c8b75b0d3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DDFC40C-5612-4160-B4E5-5DCEA02AEED2"},"incident_date":"2015-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70d25a0d8fee","org_name":"Florida Hospital Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/florida-hospital-medical-group-notifies-patients-after-transcription-service-error/"}],"summary":"A transcription service sent some emails of medical reports back to a doctor's office and they were unencrypted. It is not clear why the hospital believes this may have lead to a breach. No other article info could be found. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee5b1b95ab12ea566e02f0eb64f3036a0887d4e2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/March%2018%2C%202015%20Data%20Breach%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb427737e5f1","org_name":"Cement Masons Southern California Health and Welfare Trust Fund","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49280"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6141051ee319992191ac4aa83f16498981df59ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9825E74-D4FA-4EB2-AD62-A146DA49E09D"},"incident_date":"2015-04-07","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca0f55e064aa","org_name":"Vermont Attorney General's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcax.com/story/31788527/vt-ag-office-calls-essex-data-breach-email-spoofing;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcax.com/story/31756059/essex-police-investigate-data-breach"}],"summary":"The attorney general's office calls this email spoofing, where someone who appears to be a CEO or higher up at a business requests personnel info and someone responds quickly","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3848d764004cccbbfbdfa9fce4b0f3dcd1be6fac","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Signed%20Notification%20Ltrs_Eng-Sp_4-1-15.pdf%20-%20Adobe%20Acrobat%20Pro_0.pdf"},"notes":null,"org_country":"US","org_id":"495fddc73eb4","org_name":"Tulare County Health & Human Services Agency","org_type":"healthcare","ransomware":null,"records_affected":845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49239"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Signed%20Notification%20Ltrs_Eng-Sp_4-1-15.pdf%20-%20Adobe%20Acrobat%20Pro_0.pdf"}],"summary":"An HHSA employee emailed approximately 845 clinic patients without blind-copying recipients, exposing their email addresses.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68e91612fa91b566a0b84e08fc9ebfe78e503fa9","impact_type":"unknown","incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Consumer%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"71b813da9532","org_name":"Intuit","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49249"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"783ebed238e3634f7f1b0d453accd534b788328a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ee776572d10e","org_name":"Equifax","org_type":"unknown","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/identity-theft-unit/security-breach-notices#Equifax-2015-04-06"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0a19edf692a06a39e044940f4c06945b82a237f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1CC9E84-8866-456D-8932-EBB56C9BFC2B"},"incident_date":"2015-04-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"435a68a56b4b","org_name":"Tewksbury Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pogowasright.org/horrific-privacy-breach-by-tewksbury-public-schools/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pogowasright.org/massachusetts-dese-finds-tewksbury-breach-violated-state-law/"}],"summary":"Tewksbury Public Schools face angry parental backlash following the release of private student information online last week. A document included in a 222-page School Committee packet remained online for the better part of a week, before being taken down Monday.  Awareness of the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal","other"],"disclosed_date":"2015-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6bd728378b218665ba2b5a7fc8bbe679ac2661c","impact_type":"data_theft","incident_date":"2014-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"33e228fc5d27","org_name":"Quantum Booter","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Quantum Booter","type":"hibp","url":"https://haveibeenpwned.com/Breach/QuantumBooter"}],"summary":"A breach of Quantum Booter disclosed its internal database, including user information and private discussions.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d7fb5d698756e32e1e66b97cb2bf2c0dc7cb4f7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C377D21F-DD71-42EA-B49E-787EE671AB9C"},"incident_date":"2015-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"20fbfd923eef","org_name":"National Seating and Mobility","org_type":"other","ransomware":null,"records_affected":9627,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/laptops-stolen-from-national-seating-and-mobility-contained-some-patient-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/national-seating-and-mobility-20150612.pdf;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen laptop contained patient PHI.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bb0c58541d1052608171faa11fc088eb42e04a6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"085EE9A1-CE03-4F04-AF7D-27CDA24E8567"},"incident_date":"2015-04-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df1eac872b1a","org_name":"Oregon Health Co-op","org_type":"healthcare","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://portlandtribune.com/pt/9-news/258508-129948-health-co-op-says-laptop-with-sensitive-information-was-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/portland/blog/health-care-inc/2015/04/oregons-health-co-op-stolen-laptop-leads-to.html;"}],"summary":"Oregon Health Co-op of Portland warned its members on Tuesday that a company laptop with member and dependent information was stolen early this month.  Co-op officials said the laptop was taken April 3. The laptop was password-protected, but it contained sensitive information abo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7759a8fecfe071143ffed610e451a691348d15bb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B41E0B3A-E596-480F-88DB-36F152F76D49"},"incident_date":"2015-04-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"311f32d6a58d","org_name":"Augustus F. Hawkins Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-county-usc-data-breach-20150429-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.utsandiego.com/news/2015/apr/29/personal-data-on-900-los-angeles-county-patients/"}],"summary":"OOfficials are investigating a security and privacy breach affecting 900 patients who were treated at the Los Angeles County-USC Medical Center's mental health facility.  The breach was discovered April 3 during a search of the home of a nurse who was employed at the Augustus F. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18e3841678c10af2b0a1696699157bf446bcd447","impact_type":"unknown","incident_date":"2014-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Template_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"067b8fd936d1","org_name":"SRI, INC.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49214"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3098be718279d0a99e06e1a4a089085debb10bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B307927-EDB6-4CC7-ADC0-F90941119A93"},"incident_date":"2015-04-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75438f8f4f64","org_name":"hard rock hotel and casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2917674/data-breach/hard-rock-hotel-and-casino-suffers-data-breach.html;http://news.softpedia.com/news/Card-Breach-at-Hard-Rock-Hotel-Casino-Lasts-for-7-Months-480019.shtml;http://www.theregister.co.uk/2015/05/04/hard_rock_breach/"}],"summary":"It seems that this was nothing in comparison to a criminal issue that the Hard Rock Hotel & Casino was dealing with just down the road. News came out on Thursday that they had suffered a data breach courtesy of a criminal element. The casino made it known that their payment syste","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"285a7c3a7b3f80a29c897d6696edf02838574745","impact_type":"unknown","incident_date":"2015-01-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SDD%20Breach%20Notification%20Letter%20for%20DOJ_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"54aabca368a5","org_name":"California Department of Business Oversight","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49208"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32934324fc95f91d5e493e4274f17c3b8122916a","impact_type":"unknown","incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Auburn%20-%20notice%20sample_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"751e5dd440fe","org_name":"Auburn University","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49210"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/AuburnUniversity.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50a2000f95d438801b8f901e0caa9f20da02e2b8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D771DDED-B975-49F5-AFDE-6B9BC1FF6A0E"},"incident_date":"2015-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"553f0b8b97ba","org_name":"Wellington Hospital","org_type":"healthcare","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wellington-health-boards-smear-email-breached-privacy-of-grieving-mother/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/dominion-post/news/82530463/wellington-health-boards-smear-email-breached-privacy-of-grieving-mother"}],"summary":"inappropriate email sent to board members","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48a61d26f15bfcade7ae99e6cddbf2df1fcb1358","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A055FF36-B5F0-4D3F-B824-CF2DFBD7E4FA"},"incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea6e77452fe0","org_name":"Vermont Department of Fish and Wildlife","org_type":"government","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2016/jun/14/vermont-fish-and-wildlife-reporting-license-data-b/"}],"summary":"website hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0101cad9783aa95f3d1ea6d4b82ccb2d65e42b0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6FA323C-BE32-412A-85F8-B79D6D24B9EB"},"incident_date":"2015-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42d0ae1c0974","org_name":"Various Gas Stations","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/florida/sfl-ap-gas-station-skimmers-20150423-story.html;http://media.trb.com/media/acrobat/2015-04/83370368-23114941.pdf"}],"summary":"During a review of over 6000 gas stations in Florida, 81 locations were found to be compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2bec135dad6ee1168686f740407e8969300b76df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80741BBD-AC31-48DB-BA51-3104C2DF596C"},"incident_date":"2015-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04cd84255ce3","org_name":"University of Rochester Medical Center Affiliates","org_type":"healthcare","ransomware":null,"records_affected":3403,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wxxinews.org/post/settlement-between-nys-urmc-over-patient-privacy-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/blog-university-of-rochester-medical-53663/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.democratandchronicle.com/story/news/2015/05/22/urmc-patient-information-breached/27799845/"}],"summary":"the nurse shared a list of names, addresses, dates of birth and diagnoses with her new employer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a17cbdd4e12e6eb4ea41bb71c89010270d6f0274","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D4C2A45-1DA1-4909-8616-1B4363797D1F"},"incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b62fc143213a","org_name":"Unity Recovery Group","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Unity-Rehab-Centers-Leak-Highly-Sensitive-Patient-Info-482746.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/united-recovery-group-notifying-patients-of-hipaa-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/unity-recovery-group-20150526.pdf"}],"summary":"Multiple rehab units under the umbrella of Unity Recovery Group disclosed to partners personally identifiable details and health-related information belonging to their patients.  In April, it was discovered that Starting Point Detox, LLC, Lakeside Treatment Center, LLC, Changing ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ce7ea25f324c64be21044c15dfc5e3ca183cc01","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49509A7F-5588-4786-A29B-C4097480B48A"},"incident_date":"2015-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84108d7606a1","org_name":"The Texas Department of Aging and Disability Services","org_type":"government","ransomware":null,"records_affected":6600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/phi-data-breaches-for-ny-texas-organizations;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthit.com/story/data-breach-texas-agency-makes-phi-available-online/2015-06-15;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dads.state.tx.us/news_info/releases/class-dbmd-databreach-6-11-15.pdf"}],"summary":"Publishing error leads to 6600 records being available to the Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6c27c4b90d2b3a62533448332838254d15df19c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7A06C41-5F09-4BEB-907C-D3CBDC3146E1"},"incident_date":"2015-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8081781054","org_name":"Sunoco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtae.com/news/new-jersey-man-charged-with-using-credit-card-numbers-stolen-from-murrysville-gas-station/36209428"}],"summary":"crooks stole the card numbers remains a mystery ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca1d23752b0eae80d5c40db926f7a0f6fb9891d8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54CA33C9-DF8A-43A3-ACBC-D37E2B17EAE4"},"incident_date":"2015-04-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"573774333d93","org_name":"Pomeroy Investment Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/spearphishing-attack-nets-hundreds-of-thousands-from-investment-firm/article/494753/"}],"summary":"Financial pretexting/spearphishing influences employee to initiate a money transfer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83498583c01b23966d9ef47a1556242eb0df5882","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BDE5E7A-A4A7-4FA7-9F55-0E76B7E7D9AE"},"incident_date":"2015-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bac284ea6eb","org_name":"Oregon's Health CO-OP","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/today/index.ssf/2015/04/oregon_health_insurers_data_br.html"}],"summary":"On Wednesday Sherwood residents Lester and Nora Brock were surprised to learn that personal data entrusted with their health insurer, Oregon's Health CO-OP, might be compromised.  Even more surprising? They learned this not from a letter addressed to them, but from five different","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cde22b2b669a759a76b69382f473e045ea2d05e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8ED7F09-D4BD-4FAC-8BB5-156C57BED69B"},"incident_date":"2015-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SZ","org_id":"177fac12276b","org_name":"MTN Swaiziland","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.observer.org.sz/news/81000-scandal-mtn-employee-leaks-customer-data.html"}],"summary":"Ponzi scheme insider says they do have money in the accounts he checked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce73e7d0dad34a17465b81291eef38d561901192","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46F0E733-3167-421E-953C-D18EA1BC22CB"},"incident_date":"2015-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13af1eb7f4f5","org_name":"Mount Sinai Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.law360.com/privacy/articles/823957?nl_pk=166726d9-3804-4cfe-afaa-565c1e8c03bc"}],"summary":"Allegations that a nurse at a major Chicago hospital tweeted about a shooting victim's death and blood-soaked hospital room are a stunning cautionary tale that health care providers can use to hammer home how workers may be held liable for privacy lapses, attorneys say.  The alle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b71ee21eaf8de8af4e72d224b41c5d5f3eadd8cc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"540D0C6C-DE8F-410B-BC92-90BED088E77B"},"incident_date":"2015-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cdf4235bf0d7","org_name":"Jenifer Peeples","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/bergen/index.ssf/2016/07/plastic_surgeon_used_womans_photos_without_permiss.html"}],"summary":"Cosmetic surgeon used before and after photos of woman's cosmetic surgery in spite of her refusing to allow him to do so. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c3eee1fa684c190ce72b3f7377032a18606b166","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C177949D-3785-45C0-841D-F60C4F0E8C41"},"incident_date":"2015-04-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"256d37f95049","org_name":"harbortouch","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/harbortouch-reveals-pos-malware-attack-a-8128;http://consumerist.com/2015/05/05/big-credit-card-data-breach-hits-bars-and-restaurants-using-harbortouch-point-of-sale-systems/;http://krebsonsecurity.com/2015/05/harbortouch-is-latest-pos-vendor-breach/"}],"summary":"Last week, Allentown, Pa. based point-of-sale (POS) maker Harbortouch disclosed that a breach involving \"a small number\" of its restaurant and bar customers were impacted by malicious software that allowed thieves to siphon customer card data from affected merchants. KrebsOnSecur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9cf561e8b7b8e84a7d0d6ec285f0eab98a6ebf0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4b74c9b0-a19a-11e7-9764-c7e1aa1637e1"},"incident_date":"2015-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"984b2f46b9d2","org_name":"Dublin North Mental Health Services","org_type":"healthcare","ransomware":null,"records_affected":102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.midlands103.com/news-centre/x-ray-file-local-penneys-among-hse-data-breaches/"}],"summary":"Healthcare records relating to 102 children were lost from the Public Health Nursing section of Cherry Orchard Hospital last year, which required all affected individuals to be re-screened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"916fdf1162d365ccff32805a868ba7c18a1a69be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA4B7138-720C-4084-B848-52D9F0DB9404"},"incident_date":"2015-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08f0cef4103c","org_name":"Champs Sports","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/business/fl-champs-clerk-credit-card-skimming-arrest-20151103-story.html"}],"summary":"Portable Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f633219cc382a64c9c0e746e93a89a5a3cd58ecf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCE24BF8-DFAF-4ECA-972C-F277597BB348"},"incident_date":"2015-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"af8dc0726e26","org_name":"Cafe de Coral Holdings Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shanghaidaily.com/article/article_xinhua.aspx?id=281009"}],"summary":"HONG KONG, May 8 (Xinhua) -- Hong Kong's local fast food chain Cafe de Coral has accidentally leaked the personal details of members of its bonus-point program, it said on Friday.       The company said the mistake was made last month in an email to a third party, which it did no","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d047ff69d6f8c93f1975925e5b8f4222de09529","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57F57373-DE98-45FD-9B54-FB50F2B88D53"},"incident_date":"2015-04-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b54238e2a0c5","org_name":"American Type Culture Collection","org_type":"manufacturing","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3075479/security/the-frustrating-aftermath-of-a-data-breach-at-american-type-culture-collection.html"}],"summary":"In April, American Type Culture Collection (ATCC) was targeted by a Phishing attack seeking W-2 records. The attempt was successful, leaving employees stressed about their finances and the long-term impact this breach could have on them.  But it's the actions by the company after","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a5e0036cde1957ed63075c536173a909494f5e1","impact_type":"data_theft","imported_from":null,"incident_date":"2014-11-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20Online%20Submission_%20C2015020316_Customer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49205"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55655"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55754"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55783"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-55813"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20Online%20Submission_%20C2015020316_Customer%20Letter_0.pdf"}],"summary":"American Express said card information, including account numbers, names, expiration dates, and Social Security numbers, was recovered during an investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc119b6ac72eacdba295235e1c31d04e23740c4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82FE900F-2A1C-4042-8876-4C9C31D6F48B"},"incident_date":"2015-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eba270bc2872","org_name":"Allina Health Isles Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/allina-health-isles-clinic-notifies-more-than-6000-patients-of-improper-disposal-of-their-records/"}],"summary":"Allina Health Isles Clinic notifies more than 6,000 patients of improper disposal of their records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-03-31","discovered_date":"2015-03-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c64cba55039bdb07c03186284689f740edede45","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/WY%20follow-up%20letter%20regarding%20Premera%20security%20breach_0.pdf"},"notes":null,"org_country":"US","org_id":"367909b703c3","org_name":"Weyerhaeuser Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/WY%20follow-up%20letter%20regarding%20Premera%20security%20breach_0.pdf"}],"summary":"Premera notified Weyerhaeuser that attackers had accessed its systems and may have accessed information about Weyerhaeuser health-plan enrollees; Premera reported no evidence that data was removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Premera"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"ae2e88b3f83a","name":"Premera"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa517a82e2b0d44d69bc1202dab6aaaf1d2a71c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F50784B-D125-4719-ADFA-9D45489A5428"},"incident_date":"2015-03-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"593f7155a690","org_name":"Heartland Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/unauthorized-access-gained-to-heartland-dental-databases/article/421161/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/unauthorized-access-gained-to-heartland-dental-databases/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/heartland-dental-20150603.pdf"}],"summary":"Unauthorized access was gained to three databases containing data from old employment, discount plan, and patient financing applications","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1123cbbf9615f6d659dcc457c46394227f12698b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75553A5C-A547-4EDD-AA97-78C4BF54C1B6"},"incident_date":"2015-03-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cac2f26513db","org_name":"Florida Department of Health","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mynews13.com/content/news/cfnews13/news/article.html/content/news/articles/cfn/2015/5/7/fl_dept_of_health_do.html"}],"summary":"A security breach at the Florida Department of Health could have compromised the confidential medical records of five patients.  One victim said he learned about the incident Thursday, over a month after the documents were reported stolen to the Orlando Police Department.  An emp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"ideology","name":"Human Rights Campaign","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9cc22fdea3de95a73554d9974e2e7410ca7e55d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"016F24DF-547E-43B0-BBC7-2F44885F8537"},"incident_date":"2015-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f14e223c010c","org_name":"National Organization for Marriage","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theglobaldispatch.com/national-organization-for-marriage-sues-irs-for-leaking-tax-documents-to-human-rights-campaign-58294/;http://www.usatoday.com/story/opinion/2013/05/15/irs-commits-political-sabotage-column/2163089/;http://www.hrc.org/press/mitt-romney-fuels-noms-divisive-racial-tactics;http://arc-sos.state.al.us/PEL/SOSELPDF.001/E0090860.PDF;http://nonprofitquarterly.org/2014/06/25/irs-pays-nonprofit-group-50-000-settlement-for-leaking-documents/"}],"summary":"The National Organization for Marriage announced Thursday a lawsuit in federal court against the Internal Revenue Service for illegally releasing confidential tax documents to the Human Rights Campaign.  After the leak of the documents in 2012, the Human Rights Campaign (HRC), po","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"humanrightscampaign"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b96a0864160d5925162b89086e3187aafc9a6c2","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"55c654331140","org_name":"ThisHabbo Forum","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: ThisHabbo Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/ThisHabboForum"}],"summary":"ThisHabbo Forum was compromised in 2014, exposing usernames, email addresses, IP addresses and salted password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-03-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4789097222d432283c0606437633eb751ccd61a4","impact_type":"data_theft","imported_from":null,"incident_date":"2015-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Credit%20Cards%20and%20Database%20%28US%20incl%20PR%20Territories%20%29%20_0.pdf"},"notes":null,"org_country":"US","org_id":"9b1e062a2778","org_name":"Nite Ize, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49119"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Credit%20Cards%20and%20Database%20%28US%20incl%20PR%20Territories%20%29%20_0.pdf"}],"summary":"Nite Ize reported that an attack on its online store may have allowed unauthorized parties to access approximately 309 credit card numbers and other customer information.","supporting_quote":null,"technology_involved":["Nite Ize website","online store"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"329658d3bfb689fc3c640528b382c66e8df66c43","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f1dfe4a0-9047-11e8-8b32-9bc4732308c2"},"incident_date":"2015-03-27","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cb6895724a3","org_name":"American Tooling Center","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insurancejournal.com/news/national/2018/07/17/495389.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.insurancejournal.com/app/uploads/2018/07/American-Tooling-v-Travelers.pdf"}],"summary":"a federal appeals court has sided with a commercial policyholder where the insurer denied coverage under a computer fraud provision of a crime insurance policy for a money transfer involving fraudulent emails.  The Sixth Circuit appeals court found that Travelers was wrong to den","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ecced120373047e85dd5eaf24130ba3e0380f52","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87C118F0-A51E-4714-82B3-56062C0FE636"},"incident_date":"2015-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1525a0892a6","org_name":"Siouxland Pain Clinic","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siouxlandnews.com/story/29699657/data-breach-at-siouxland-pain-clinic;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/foreign-hacker-responsible-siouxland-pain-clinic-data-breach-8056/"}],"summary":"Remote attacker accesses network. Very little details provided.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa416c548e080daf1ea320f0044de7b7c9e2d502","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F331E5A-16C9-4EA5-9A3A-72E7BF55BD92"},"incident_date":"2015-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d8d6e9aa11d","org_name":"Southeast Eye Institute, P.A.","org_type":"healthcare","ransomware":null,"records_affected":87000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/the-southeast-eye-institute-patient-information-compromised/article/499440/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthit.com/story/breach-eye-care-facility-vendor-may-have-put-phi-87k-risk/2016-05-27"}],"summary":"The Southeast Eye Institute, P.A., in Florida: 87,314 names, addresses, telephone numbers, Social Security numbers, dates of birth, and insurance information may have all been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ca71af003a3d7520b9a63ca55fbd8ba2ea36234","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"430B633B-71C5-445B-91F2-A1324395EA04"},"incident_date":"2015-03-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3e4839f6d24","org_name":"Thomas H. Boyd Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":8300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://greeneprairiepress.com/breach-of-hospital-privacy-p13011-127.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/follow-up-to-boyd-hospital-breach/"}],"summary":"The hospital had leased a facility in Illinois to store records. The owner of the facility sold the building and did not inform the hospital. 7500 current and/or former patients of the Hospital were located in the building. The records contained personal information of the patien","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"64ce0471c0ba576aed9234829ee005b36c7983b6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/SVC-West%2CLLC.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b6289fd4886b","org_name":"Shell Vacations Club (SVC-West)","org_type":"unknown","ransomware":null,"records_affected":51,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/SVC-West%2CLLC.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef4a0af3f9597e502839b4e2be837970e8afdcfe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BB36EB4-F8A2-4E23-9F25-81F9C5273AD2"},"incident_date":"2015-03-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8952d1aa3461","org_name":"Rose House Care Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://stv.tv/news/tayside/1363311-nurse-let-non-employee-dispense-drugs-at-care-home/"}],"summary":"allowing an inappropriate person to participate in administering medication","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f0e99f5d31be5a4c3921b52f766a40ea44bfaf5","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Basic%20Letter%20to%20Patients%20Advantage_0.pdf"},"notes":null,"org_country":"US","org_id":"1e2717649102","org_name":"Advantage Consolidated LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48988"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Basic%20Letter%20to%20Patients%20Advantage_0.pdf"}],"summary":"An unauthorized person accessed a database containing patient personal information, which may have included names, addresses, phone numbers, dates of birth, and Social Security numbers.","supporting_quote":null,"technology_involved":["dental database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee611517db3cc65393af1cd00654978ef3a66160","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB2618D1-3B68-4218-904A-8E36CEAAD26E"},"incident_date":"2015-03-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cbb354caeb4f","org_name":"Linux Australia","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/linux-australia-suffers-another-data-leak/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itwire.com/business-it-news/open-source/70431-linux-australia-suffers-another-data-leak"}],"summary":"hacked server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba3e0c405ceace9a94bcfe8ff550b9d351ae76b5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F933C9A8-0116-4514-8655-CE5290F7C9A8"},"incident_date":"2015-03-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"568561485a31","org_name":"Department of Motor Vehicles of California","org_type":"government","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://losangeles.cbslocal.com/2015/04/24/mail-sent-to-dmv-offices-in-riverside-stolen/"}],"summary":"30 pieces of mail were stolen from the DMV Riverside Call Center and DMV East Riverside Field Offices of California.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"95738e61ba2bd4779268c1159ee31ddfd3f44ca1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/PremeraBlueCross.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"62080ff1ed97","org_name":"Premera Blue Cross/Academe, Inc. f/k/a Life Wise Health Plan of Arizona, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/PremeraBlueCross.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc30a34a3bafaaaecab90367442c967583dcff6e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BFE451A-C5EF-443A-A215-562E75692FB6"},"incident_date":"2015-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed0f4b98c6e1","org_name":"Associated Dentists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/minnesota-dentists-notify-patients-of-computer-theft-potentially-compromising-the-security-of-personal-information-300085113.html"}],"summary":"Associated Dentists is notifying affected patients of a data security incident that may affect the security of their protected health information.  Associated Dentists and investigating authorities are unaware of any attempted or actual misuse of patients' protected health inform","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc0305ca270cd6d2f3b01706cea406db4825dd3b","impact_type":"unknown","incident_date":"2015-01-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SVC_West_NON-MA%20US%20CONSUMER%20LTR_SAMPLE_031715_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6c76c6885d7d","org_name":"SVC-West, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48872"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19c3d4d1db04f0ce92e17dce30a27659689377cc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20-%20Premera%20-%20Adult_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48870"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-03-17","discovered_date":"2014-12-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a429399df49b4c0aa8adf27e3c198c4d9c5c5393","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OSP%20Notice%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"164dbb4de7be","org_name":"OneStopParking","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OSP%20Notice%20Letter_1.pdf"}],"summary":"OneStopParking reported that customer information may have been exposed in an incident affecting people who used its website between August 1 and December 31, 2014.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8e71f32f4af61b2ff9ef29aef8c12b1f84ad805","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"126A7F5A-F784-483B-AE2F-601B32BBE8AF"},"incident_date":"2015-03-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ced827a32bfb","org_name":"OptumRx","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/unencrypted-laptops-expose-over-400000-patients-medical-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/optumrx-notifying-patients-after-laptop-with-phi-stolen-from-vendors-unattended-vehicle/"}],"summary":"Unencrypted laptop stolen from vendor vehicle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"189ba03f97f350a464f122363d1814589d885c13","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Riley%2048865%20notice%20only%20_0_0.pdf"},"notes":null,"org_country":"US","org_id":"07d858cc2090","org_name":"Mark Riley, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48865"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Riley%2048865%20notice%20only%20_0_0.pdf"}],"summary":"Mark Riley, Inc. notified people that an incident involving a portable hard drive might have exposed their names and Social Security numbers, though the company was not aware of access or misuse.","supporting_quote":null,"technology_involved":["portable hard drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-03-16","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c60364972ff91b98b9c842275dec2d932c89e32a","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-03-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Non-Massachusetts%20consumer%20notification%20letter%20FINAL%20AAG_0.PDF"},"notes":null,"org_country":"US","org_id":"d35c92815ad2","org_name":"Apple American Group LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Non-Massachusetts%20consumer%20notification%20letter%20FINAL%20AAG_0.PDF"}],"summary":"An outside consultant lost a USB flash drive containing Apple American Group employees’ W-2 information, with no evidence that the information was accessed or misused.","supporting_quote":"On that date, an outside consultant (that is, someone who is not an employee of Apple American Group, but rather a third party vendor hired to help us improve our payroll systems) lost a portable USB flash drive.","technology_involved":["portable USB flash drive"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed81fbb0efa2d4124484818c03be1e735437af7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"648B911B-F831-4B13-903F-628FA21D169D"},"incident_date":"2015-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f16e2ea9241","org_name":"university of california berkeley","org_type":"education","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://newscenter.berkeley.edu/2015/04/30/campus-announces-data-breach/;http://sanfrancisco.cbslocal.com/2015/04/30/uc-berkeley-students-notified-of-data-breach-involving-social-security-numbers-bank-accounts/;http://www.esecurityplanet.com/network-security/uc-berkeley-auburn-u-metro-state-acknowledge-data-breaches.html"}],"summary":"UC Berkeley officials announced today (Thursday, April 30) that they are sending alert notices to current students and other individuals regarding a computer data breach that may have resulted in unauthorized access to their Social Security numbers or other personal information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"289d52a2996e6204fe5f6ab6ceda25b35c5b7254","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D176688-D6A5-4213-965B-0CBFB0FCA2C9"},"incident_date":"2015-03-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6d79b912640c","org_name":"Western Australia Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.perthnow.com.au/news/western-australia/policeman-charged-with-leaking-information-about-ben-cousins-arrest-to-tv-reporter-girlfriend-keeps-his-job/news-story/63906e3d472650675cfe4f2d9fd87baa"}],"summary":"Police officer disclosed information to reporter/girlfriend.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-03-11","discovered_date":"2015-01-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2ff611e96f102b745617e8d586ea048a25a2433","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Painted%20Turtle_Campers%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f5bc4f952c5d","org_name":"The Painted Turtle","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48777"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Painted%20Turtle_Campers%20Notification%20Letter_0.pdf"}],"summary":"An error in The Painted Turtle’s online application database may have made applicants’ personal, medical, and health insurance information viewable to designated medical providers or emergency contacts.","supporting_quote":null,"technology_involved":["online application system","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-03-11","discovered_date":"2015-02-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17d069d97a5de1baf4659a4958acc439f2a91ded","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Providence%20Adult%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"be0dff356c5e","org_name":"Providence Saint Joseph Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Providence staff member inadvertently sent billing information to a billing company.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48785"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Providence%20Adult%20Notice_0.pdf"}],"summary":"A Providence staff member inadvertently sent patients’ medical billing information to a billing company.","supporting_quote":"On February 18, 2015, Providence St. Joseph Medical Center discovered that a Providence staff member inadvertently sent your billing information to a company that handles billing for some of our physician medical groups that Providence contracts with in Southern California.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-03-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"465b9fe8e373d634962e76e637413288433015dc","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Valley%20Community%20Breach%20Letter%2003-2015%20SRR%20Revised_0.pdf"},"notes":null,"org_country":"US","org_id":"aab6fd2e42e0","org_name":"Valley Community Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48745"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Valley%20Community%20Breach%20Letter%2003-2015%20SRR%20Revised_0.pdf"}],"summary":"Valley Community Healthcare reported that a laptop attached to an EKG machine was missing and contained patient names, dates of birth, and medical record information.","supporting_quote":"On February 24, 2015 we discovered that a laptop computer attached to the Electrocardiogram (EKG) machine in the General Medicine department was missing.","technology_involved":["laptop computer","Electrocardiogram (EKG) machine","medical record database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8ac8e4ef19e06123aa64b5e178dbbd6799b15aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC16FBD0-8500-4D43-A35B-7F106AC33F6D"},"incident_date":"2015-03-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-mar-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jan-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-apr-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jul-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jun-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-may-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-aug-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-sep-2015.pdf"}],"summary":"Veteran A contacted the National Call Center (NCC) to say that he received correspondence at his address but the correspondence contained Veteran B's full name and Social Security Number (SSN).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df2db0f9f74ce22bb9858f9be5e1568fc2a576d7","impact_type":"unknown","imported_from":null,"incident_date":"2014-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BistroBurger_LA%20Times%20Print%20Notice%20%2803.09.15%29_0.pdf"},"notes":null,"org_country":"US","org_id":"4ab9b5671f63","org_name":"Bistro Burger, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48758"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BistroBurger_LA%20Times%20Print%20Notice%20%2803.09.15%29_0.pdf"}],"summary":"Bistro Burger, Inc. filed a consumer notification concerning an incident dated October 2, 2014; the provided text does not include incident details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ecf5664146c38d0e18ba7b0deb5f7899a744652","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2BAFDD68-9DBB-4985-A51F-3A552554BAA5"},"incident_date":"2015-03-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"0cb4d917e4a0","org_name":"IBM","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-developer-arrested-for-theft-of-source-code-from-former-employer/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/us-ibm-crime-china-idUSKBN0TR2X820151208#eJEXPZp46zkGUzH9.97"}],"summary":"Ex-IBM employee from China arrested in U.S. for code theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"408d89bcc7e7d26aaffcf6976330ca924c2273ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56C452C6-DC38-4BBC-A5A3-BE55C9B368D3"},"incident_date":"2015-03-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a18689d3a44","org_name":"Saint Francis Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Gift-Shop-PoS-at-Saint-Francis-Hospital-Compromised-483613.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ok-saint-francis-hospital-gift-shop-acts-to-block-payment-card-security-incident/"}],"summary":"Hospital Gift Shop POS system attacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e7e1c170540d47fb42e4facaa1016398dcd7eb3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9754F225-C3FC-4FA7-8D6F-C531E0D40AA7"},"incident_date":"2015-03-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0d1f1f786845","org_name":"Princess Margaret Cancer Centre","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/life/health_wellness/2015/02/12/transparent-hospitals-tight-lipped-on-rob-ford-privacy-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/gta/2015/02/12/rob-ford-reacts-to-health-records-snooping.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.torontosun.com/2015/02/12/i-dont-know-what-theyre-fishing-for-rob-ford-reacts-to-medical-record-breach;"}],"summary":"unauthorized access to a public official health record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"310646c76894bf1ff45634bdccd371d89a43d1e6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/TDBank.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4806acf26a2a","org_name":"TD Bank, N.A.","org_type":"unknown","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/TDBank.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed72d0f07c505bb12dcee1f9d9c0a403b9b63cd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18F60955-A4EF-40F4-8030-642903AF44F2"},"incident_date":"2015-03-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1e32465fba6","org_name":"Louisiana Healthcare Connections","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://theadvocate.com/news/acadiana/14700782-148/lafayette-woman-accused-of-medicaid-fraud-said-to-have-stolen-information-from-13000-recipients"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/potential-medicaid-data-breach-for-13k-louisiana-recipients"}],"summary":"A Lafayette woman arrested Wednesday is accused of stealing personal information from more than 13,000 Medicaid recipients in attempt to defraud the program.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1146847d0d36d7b254f99aa38de7a375a5ca2b9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"781DF29C-F90E-4A4C-9E87-EA16746371F1"},"incident_date":"2015-03-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"084256e47559","org_name":"American Sleep Medicine","org_type":"healthcare","ransomware":null,"records_affected":1787,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/american-sleep-medicine-patients-notified-of-stolen-hard-drive/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/San%20Diego%20Patient%20Breach%20Notification%20Letter_0.pdf?;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-49386"}],"summary":"American Sleep Medicine of San Diego, which describes itself as conducting more than 4,000 sleep studies each year, is notifying an undisclosed number of patients that some of their personal information was on an external hard drive stolen from a locked server room. The theft was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f837332676ca68f188a44430c299110ed7c4490","impact_type":"disruption_or_ransomware","incident_date":"2015-01-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LT%20Clients%20Sample%20w%20How%20To_1.pdf"},"notes":null,"org_country":"US","org_id":"ba0e99cd2960","org_name":"Ziprick & Cramer, LLP","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48594"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LT%20Clients%20Sample%20w%20How%20To_1.pdf"}],"summary":"A Cryptolocker-type virus encrypted data on a workstation and shared folders on the firm’s in-house server.","supporting_quote":null,"technology_involved":["workstation","in-house server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-03-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18b23aa353d44096b9563d13413c89a102b197d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20of%20Perspectives%20Database%20Breach%202%20%2801075324%29_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1491","org_country":"US","org_id":"bc3f25161b81","org_name":"Perspectives","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A vulnerability in the class portion of the Perspectives website was the cause of the breach.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48592"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20of%20Perspectives%20Database%20Breach%202%20%2801075324%29_0.pdf"}],"summary":"A vulnerability in Perspectives' class website enabled an unauthorized advertising attack and database access, with no indication that personal financial information was retrieved.","supporting_quote":"The data breach was due to a vulnerability in the class portion of the Perspectives website only.","technology_involved":["Perspectives website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"903be839cce42d3817d8ece2f84ac886401f4b72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"545E6FD7-4DFA-434D-8FC5-561A24F3FFF0"},"incident_date":"2015-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42031d036d66","org_name":"Western Montana Clinic","org_type":"healthcare","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://missoulian.com/news/local/hackers-accessed-patients-credit-card-information-western-montana-clinic-says/article_a2410583-b3bd-5cf8-afcb-8d65828fc2c0.html"}],"summary":"Full credit card information for 44 patients was available to hackers who gained access to the Western Montana Clinic website last month.  The hackers also were able to access demographic and partial credit card information for nearly 7,000 patients. However the hackers didn't ga","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc822a71e6c07ec9c10a13da1faef5d2333eb2da","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C10B59D9-FE0F-421F-92CF-1E3CE3FB56E5"},"incident_date":"2015-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0c91bd62065","org_name":"Vibrant Body Wellness","org_type":"healthcare","ransomware":null,"records_affected":726,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/vibrant-body-wellness-notifies-patients-after-burglar-steals-hardware-with-phi/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/robbery-at-ca-practice-causes-possible-healthcare-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://vibrantbodywellness.com/we-were-robbed-literally/"}],"summary":"A California-based chiropractic office has notified 600 patients of a potential healthcare data breach after the practice was burgled in early March, reported EastBayTimes.com.  In an official statement, Vibrant Body Wellness explained that a laptop and backup hard drive were sto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d690402a473b02b985e1abff81671e4f2b453a94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"075EEACD-82AC-4312-8D8B-1C3BAAB255DA"},"incident_date":"2015-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.channel3000.com/news/Baldwin-calls-for-federal-investigation-after-News-3-stories/36251326"}],"summary":"This comes after a News 3 investigation into an instance in April when hundreds of Social Security numbers belonging to Wisconsin veterans were emailed to a random citizen from a federal VA.gov email address. Federal privacy laws and multiple VA regulations require all emails wit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"106170ea5aa81a821116d331c7465e0cda3cc848","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CFD3DE1-A01A-45B7-AC79-862F9D8B436D"},"incident_date":"2015-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3cd7cc26923","org_name":"UC Irvine Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4859,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/employee-667368-hospital-access.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-uc-irvine-data-breach-20150618-story.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20CA%20Notice%2006172015_0.pdf"}],"summary":"Medical records of 4,859 patients at UC Irvine Medical Center were breached over a nearly four-year period, the hospital announced Thursday.  An employee whose job required access to some patient records viewed thousands of additional records \"without a job-related purpose\" from ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f51ab957b83890be5f6260cd3737aaa4201e4d62","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14E90038-D57B-4482-9A02-EA7BF5A2A74E"},"incident_date":"2015-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39677f0da575","org_name":"Spartanburg School District","org_type":"education","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wspa.com/2016/09/08/hackers-holding-school-computers-hostage/"}],"summary":"Ransomware paid by school","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c94f20215f6e67f89ced697969f053f83c6739b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4765F3B9-7659-4688-82FC-4CD3224218A2"},"incident_date":"2015-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"257a75acbfa0","org_name":"Royal Cornwall Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.westbriton.co.uk/Patients-notes-left-display-parked-car/story-26118060-detail/story.html"}],"summary":"MEDICAL notes have been found on clear display in a car which was parked in a residential street for almost a week.  Mark Atkins said he and other residents of Lowen Bre near Royal Cornwall Hospital at Treliske had been fed up with vehicles being parked in their street.  But when","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d436492bb6659a7c18f0109067abe4e50b25c92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7e58cfa0-b34e-11e7-9de8-4bde146bf807"},"incident_date":"2015-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b86706632529","org_name":"PNC","org_type":"financial","ransomware":null,"records_affected":4350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.qchron.com/editions/central/queens-men-plead-to-atm-skimming-rap/article_b7c95480-b4ec-54a5-8dd8-2a6181981e57.html"}],"summary":"Queens men plead to ATM skimming rap - PNC, Bank of America ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"819dcea6a47e6ce6d102cd440a59975f266a4dc3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9299353B-C83B-45B3-AF72-472F381EF5F7"},"incident_date":"2015-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f389ef5a32","org_name":"Molina Healthcare Inc","org_type":"financial","ransomware":null,"records_affected":54203,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/cvs-employee-steals-data-on-55k-molina-healthcare-members/article/440099/"}],"summary":"Molina Healthcare is notifying nearly 55,000 current and former members that a former CVS employee __ CVS is Molina Healthcare's over-the-counter (OTC) benefits vendor __ took their personal information from CVS' computers and sent it to his personal computer.  How many victims? ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"658d09d53143fcb5ebeb014c6b32d19fb6270ace","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22EF350F-C06F-4CE1-BFA7-D80691298189"},"incident_date":"2015-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"28ffa00d94b1","org_name":"Madison Park Senior Community","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsaz.com/home/headlines/296597421.html"}],"summary":"Two women pleaded guilty Tuesday to their roles in a theft from an 88-year-old Alzheimer's patient. Prosecutors say Josie Nance, 20, of Chesapeake, Ohio was a Certified Nursing Assistant at Madison Park Senior Community in Huntington when she stole a patient's credit card and a n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d92d729b81dc0dd16e1cba75c659dcd0411d69b8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82EE66E7-AA8B-452B-AF23-E4D720CC9CCB"},"incident_date":"2015-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87a2d808b885","org_name":"LoopPay","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2015/10/08/technology/chinese-hackers-breached-looppay-a-contributor-to-samsung-pay.html?_r=0;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/chinese-hackers-breach-company-that-s-behind-samsung-pay-494069.shtml;"}],"summary":"State-affiliated group hacked mobile payment software company. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b63fe52df887e6c733549da295e4ea651a9cd56e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5103D87D-4B92-40A7-9A41-144131DEE4D1"},"incident_date":"2015-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a137f46b4662","org_name":"Life Choices Community Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ms-madison-resident-arrested-for-identity-theft-and-medicaid-fraud/"}],"summary":"Madison resident arrested for identity theft and Medicaid fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e61fa015c8402f2448d693c56e43ad83538ae4aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42DD2FF6-C2D8-4B7A-89C9-E5FAE5676CD4"},"incident_date":"2015-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f55df3b49ba","org_name":"Landry's, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/12/banks-card-breach-at-landrys-restaurants/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.landrysinc.com/pdf/pressReleases/2015/press_20151217.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://consumerist.com/2015/12/17/card-data-breach-hits-group-behind-golden-nugget-casinos-rainforest-cafe-and-more/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.eturbonews.com/68061/golden-nugget-and-landrys-complete-investigation-credit-card-dat;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcconnecticut.com/news/local/Connecticut-Restaurants-Affected-by-Massive-Credit-Card-Data-Breach-367380701.html;"}],"summary":"Findings from the investigation show that criminal attackers were able to install a program on payment processing devices at certain of the Companies' restaurants, food and beverage outlets, spas, entertainment destinations, and managed properties. The program was designed to sea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69f02153213f7ce7d055b3f4f9108e2a8d4e21f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA278F61-85C3-47E8-A59C-913EFB8139D5"},"incident_date":"2015-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c4e2d92bf64a","org_name":"ITBus","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://inforney.com/crime/item/4857-skimming-devices-located-at-two-other-area-service-stations"}],"summary":"New hire provided login details of former employee's emails","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bfeb09da2d43df7d409d5fde756b7d08fb388b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A6B1F1C-DFA1-4617-ABDF-2AD766A35E9E"},"incident_date":"2015-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"989d99e312d2","org_name":"Central Regional Dental Testing Service, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ksn.com/2016/03/15/topeka-company-fined-for-dumping-personal-information-in-trash/"}],"summary":"Attorney General Derek Schmidt announced Tuesday that a business that dumped more than 900 files containing the personal information of its customers will pay a $70,000 fine.  The files, found in March 2014 outside the office of Central Regional Dental Testing Service, Inc. of To","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bbb43e3562f04c69432050db3c1173a56c26a5b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55BF5F01-BA11-411E-BAA6-465E5FDEA0A4"},"incident_date":"2015-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"893da4ba1909","org_name":"Brighton and Sussex University Hospitals NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":79000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://breachwatch.com/2012/06/01/brighton-and-sussex-university-hospitals-nhs-trust/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworld.com/security/uks-11-most-infamous-data-breaches-2015-3604586/"}],"summary":"Initially four hard drives sold eBay in October and November 2010 were found to contain were found to contain sensitive personal data of both patients and staff. Despite the Trust's assurance that these were the only drives lost, further hard drives were recovered by the ICO afte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abc0091d0543d17ce862939da71dcde4472e5b71","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBF65864-518F-4697-8468-3A2B830E682D"},"incident_date":"2015-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"b566cb5efdc4","org_name":"Birth Certificates","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://au.news.yahoo.com/a/32198585/two-pensioners-allegedly-stole-identities-of-dead-queenslanders-in-ghosting-scam/#page1"}],"summary":"ghosting - stealing identity of dead person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25649790d73b4b0af52de48bb2fad04122c00026","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEBD9411-ABA0-45B0-A993-39F3F8B01F53"},"incident_date":"2015-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ede4a0f10acc","org_name":"Alaska Orthopedic Specialists","org_type":"healthcare","ransomware":null,"records_affected":553,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckersspine.com/orthopedic-spine-practices-improving-profits/item/29271-shuttered-practice-alaska-orthopedic-specialists-notifies-patients-of-security-breach-5-things-to-know.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckersspine.com/orthopedic-spine-practices-improving-profits/item/29271-shuttered-practice-alaska-orthopedic-specialists-notifies-patients-of-security-breach-5-things-to-know.html"}],"summary":"Anchorage-based healthcare provider, Alaska Orthopedic Specialists, has alerted 553 patients about a breach of their protected health information. The healthcare provider is no longer in business, having closed its doors in March 2015.  While closing the business, it was discover","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed96561240542520605c1ba2054f032ac4bd6fe0","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Uber%206_16%20updated%20%20DL%20Only%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"b896e553b1dc","org_name":"Uber","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Information allowing access to the database was available without intended access restrictions.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48540"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Uber%206_16%20updated%20%20DL%20Only%20%281%29_0.pdf"}],"summary":"Uber reported that a third party accessed its database on May 13, 2014, after access information had been available without intended restrictions.","supporting_quote":"Uber discovered in September 2014 that information allowing access to the database had been available without intended access restrictions.","technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2015-02-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f1502ba100ba28ecb95ecac447007bc468c23d4","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notifications_2.pdf"},"notes":"attack_techniques without supporting words dropped: T1110","org_country":"US","org_id":"4f3895984021","org_name":"Toys \"R\" Us","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The account may have been accessed with a password obtained from another source or successfully guessed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48551"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notifications_2.pdf"}],"summary":"Toys \"R\" Us reported unauthorized access to some Rewards\"R\"Us accounts using passwords that may have been obtained elsewhere or guessed.","supporting_quote":"It appears that your Rewards\"R\"Us account may have been accessed during this time frame by individuals who may have obtained your account password from another source or successfully guessed it.","technology_involved":["Rewards\"R\"Us website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"652769d672446bf919a2f9498775f5113706dfec","impact_type":"unknown","incident_date":"2015-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/PACU%20-%20Master%20Proof_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af3095053fa1","org_name":"Piedmont Advantage Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48543"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-02-27","discovered_date":"2015-01-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f3a58ed2908f4073d8c28a54da1e00335ef54d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BULKREEFSUP_1.%20BULK%20REEF%20NOTIFICAITON%20LETTER.DOCX_WPP_1.pdf"},"notes":null,"org_country":"US","org_id":"30db908da94b","org_name":"Bulk Reef Supply","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48537"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BULKREEFSUP_1.%20BULK%20REEF%20NOTIFICAITON%20LETTER.DOCX_WPP_1.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/BulkReefSupply.pdf"}],"summary":"Bulk Reef Supply reported that customer data for some people who logged into its website may have been compromised.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-02-25","discovered_date":"2015-02-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"917c3bc7fe1b7582e87ad4be6a33eb3c385cd9d1","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CP%20Franchising%20-%20client%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"6184fb4adcc2","org_name":"CP Franchising, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48518"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CP%20Franchising%20-%20client%20notice_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CPFranchising%2CLLC.pdf"}],"summary":"CP Franchising reported that an unauthorized person accessed its servers and may have obtained encrypted information, including personal and financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-02-24","discovered_date":"2015-02-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"142baef8b83e7a2d5976209e167aa79428707b2b","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-04","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LC%20CredCard%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"1a39e233cf5b","org_name":"Lime Crime, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48501"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LC%20CredCard%20Notice_0.pdf"}],"summary":"Lime Crime reported that unauthorized individuals installed malicious software on the server hosting its website, potentially compromising customers’ personal information.","supporting_quote":"On February 11, 2015, after an extensive forensic investigation, we learned that on October 4, 2014 unauthorized individuals installed malicious software on the computer server hosting the Website.","technology_involved":["website hosting server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2157ffe6a17aad4a33b1799f9b6d0f6017aa9623","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A72314F6-A5F8-4243-B100-471A2A708D4A"},"incident_date":"2015-02-24","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d229bd18b337","org_name":"Concrete companies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/central-concrete-supply-notifies-employees-of-breach-involving-w-2s/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Central%20Concrete%20Ad%20r1fin_0.pdf"}],"summary":"data breach by which we believe a third party obtained access to copies of your 2015 W-2 income and tax withholding statements","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"823081304e47f49b7914607427ab11bb917c05ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/employeenotificationofbreach_0.pdf"},"notes":null,"org_country":"US","org_id":"900db7a3c35b","org_name":"American Apparel, Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48484"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/employeenotificationofbreach_0.pdf"}],"summary":"Anthem reported that member data was accessed and could include data belonging to American Apparel employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anthem"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c9dc15af44b2","name":"Anthem"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf188e7c1e28767b6eea560282692f87a1c96b77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3ADBA53-2351-450C-9F35-E22CB50C930C"},"incident_date":"2015-02-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1503a42e7aa6","org_name":"Jersey City Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.barnabashealth.org/Press-Center/Jersey-City-Medical-Center-News/2015/Jersey-City-Medical-Center-Loss-of-Information.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/health-data-breaches-expose-info.-in-nh-nj-and-ny"}],"summary":"On February 19, 2015, as part of routine hospital operations, an employee of Jersey City Medical Center accidentally sent an e-mail meant for internal use that included an attached spreadsheet with some patient information to an unintended email recipient. The spreadsheet include","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f494f9fa0cd9009c8a2c92b58c73d328421df07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAF0FCCA-0191-4AF8-8AE2-B1DEC9EBB653"},"incident_date":"2015-02-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d23b99012b40","org_name":"Akron General Edwin Shaw Rehabilitation Hospital","org_type":"healthcare","ransomware":null,"records_affected":975,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/edwin-shaw-employee-loses-unencrypted-flash-drive-with-975-patients-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/edwin-shaw-rehabilitation-hospital-patients-phi-exposed-3408/"}],"summary":"kron General Health System is notifying 975 patients of the Akron General Edwin Shaw Rehabilitation hospital that some of their protected health information has been exposed after an employee lost an unencrypted flash drive.  The flash drive contained \"generic\" data on patients t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fea8da9a5d06f0c15f3aff6cfd012db807db658","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33234575-E00B-4134-9A54-07487F715BD0"},"incident_date":"2015-02-16","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"337e61ef20ec","org_name":"Main Line Health","org_type":"healthcare","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://6abc.com/news/main-line-health-employees-victims-of-email-scam-/1228291/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phillyvoice.com/almost-11000-main-line-health-employees-affected-phishing-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://6abc.com/news/main-line-health-employees-info-compromised-in-email-scam-/1228291/"}],"summary":"a spear phishing email was received via email by an employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32f5b84b9d001876dec50436234ce78f13ebcb7e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4B0271B-6972-4111-9A2D-233541C9A182"},"incident_date":"2015-02-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf84c9989cad","org_name":"Medical College of Wisconsin","org_type":"education","ransomware":null,"records_affected":401,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs58.com/story/28224655/security-breach-at-medical-college-of-wisconsin?clienttype=generic&mobilecgbypass"}],"summary":"The Medical College of Wisconsin is contacting hundreds of people after a patient privacy breach.  A spokesperson says a document containing private information on approximately 400 patients and a laptop with information on one patient were stolen.  It happened when somebody brok","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61c0259092c947cd52bc0a67987d7d8ca67eabc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D2F91BB-8C9A-4604-8510-2EB2235684AC"},"incident_date":"2015-02-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"794e5673a129","org_name":"Hershey Entertainment & Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/06/hershey-park-investigates-card-fraud-pattern/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://topnews.us/content/262754-data-breach-venues-hershey-entertainment-resorts-may-have-exposed-financial-informati"}],"summary":"POS malware at amusement park","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b81067a35d5ed8828ab9124e3d4c880d180dee3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF68AB7E-91B1-4772-BD2C-9F8F9F32D87F"},"incident_date":"2015-02-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa6e5157fc57","org_name":"San Francisco General Hospital and Trauma Center","org_type":"healthcare","ransomware":null,"records_affected":55900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/4236730-story;"},{"fetched_at":null,"title":null,"type":"press","url":"http://archives.sfexaminer.com/sanfrancisco/sf-general-hospital-patient-information-involved-in-security-breach/Content?oid=2922736"}],"summary":"The Department of Public Health is working to notify patients whose records were wrongfully removed from San Francisco General Hospital by a former UC San Francisco physician who worked at the hospital from 2005 to 2013. Public health officials learned of the security breach Feb.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41fbbba414be6490d04f2df7b3ff2fc9539987f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBCF8613-AAB3-45D7-BF1E-6B1F0DB78E03"},"incident_date":"2015-02-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4aa18b0c0910","org_name":"ndiana State Medical Association","org_type":"nonprofit","ransomware":null,"records_affected":39090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/indiana-state-medical-association-discloses-theft-of-backup-drives-with-39090-members-health-insurance-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ismanet.org/pdf/news/ISMALettertoCustomers_4AlternateEndingsIDEforregulatory_Final.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.insideindianabusiness.com/newsitem.asp?ID=69700;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/we-have-met-the-enemy-and-he-is-us-monday-edition/"}],"summary":"The Indiana State Medical Association (ISMA) experienced the theft of two archive backup hard drives on Feb. 13, 2015. The equipment stored the ISMA group health and life insurance databases, which contained information on 39,090 insureds. This was a random criminal act that occu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-02-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af7bd65ad406207bdbc23ea23fb2c0a80ec57b6d","impact_type":"data_theft","incident_date":"2015-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20Customers%20on%20Data%20Breach%20%283%29_0.pdf"},"notes":null,"org_country":"US","org_id":"5d8af1c47c4f","org_name":"Liberty Tax Service","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48438"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20Customers%20on%20Data%20Breach%20%283%29_0.pdf"}],"summary":"Burglars stole files and computer towers containing personal information from a Liberty Tax Service office.","supporting_quote":"We are contacting you to inform you that on February 1, 2015, a burglary occurred at our Liberty Tax Service office at 27214 Baseline Street, Highland CA, during which some files and electronic records were taken.","technology_involved":["computer towers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-02-13","discovered_date":"2015-01-12","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d9d8335c5d3dca25b749b76e4273273280ab962","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BFG%20-%20MULTI-STATE%20NOTIFICATION%20LETTER_Proof_1.pdf"},"notes":null,"org_country":"US","org_id":"c6fafdb477f2","org_name":"Big Fish Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48441"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BFG%20-%20MULTI-STATE%20NOTIFICATION%20LETTER_Proof_1.pdf"}],"summary":"Big Fish Games reported that malware on its online stores' billing and payment pages may have intercepted customer payment information.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-02-13","discovered_date":"2015-01-29","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fb7f32db37916f226ccdd847d0bf3dece774911","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_AG%20Anthem%20Member%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"c9dc15af44b2","org_name":"Anthem","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48418"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_AG%20Anthem%20Member%20Notice_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Anthem.pdf"}],"summary":"Anthem reported that cyber attackers accessed its IT system and obtained personal information relating to consumers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":"Researchgruppen","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3847a9f4d8b7055e10244460a178bf9b7194dd7","impact_type":"data_theft","imported_from":null,"incident_date":"2015-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SE","org_id":"2e211c3977d2","org_name":"Flashback","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Flashback","type":"hibp","url":"https://haveibeenpwned.com/Breach/Flashback"}],"summary":"Sensitive data belonging to Flashback members was published, including social security numbers, home addresses, and email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"researchgruppen"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-02-11","discovered_date":"2015-03-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f61db28e50143ff73dfced0d0d3eaf90fad312ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-02-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20to%20CA%20Consumers_0.pdf"},"notes":null,"org_country":"US","org_id":"3234c6a284bb","org_name":"MyFreedom Smokes","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hacksurfer.com/posts/breach-at-freedom-smokes-customer-shopping-cart-information-stolen"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-55579"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20to%20CA%20Consumers_0.pdf"}],"summary":"MyFreedom Smokes reported unauthorized code on its website that may have been used to obtain customer information entered during online purchases.","supporting_quote":null,"technology_involved":["website","shopping cart"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07e470531e4104ce896fde56c24a0db426c201c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"511fbaf0-e475-11e7-977c-0b3846f56840"},"incident_date":"2015-02-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf6bad29a4a7","org_name":"Commonwealth Primary Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/va-former-nurse-sentenced-for-id-theft-and-bank-fraud/"}],"summary":"Nurse uses patient data to commit identity theft and financial fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2015-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15bfb8b884cf10f67cf284ca94492729d75345e3","impact_type":"data_theft","incident_date":"2015-02-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/NOTIFICATION%20OF%20BREACH%20%282%29_0.pdf"},"notes":null,"org_country":"US","org_id":"e74eabdafb17","org_name":"Packers Sanitation Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48371"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/NOTIFICATION%20OF%20BREACH%20%282%29_0.pdf"}],"summary":"Packers Sanitation Services notified team members that their personal information may have been obtained from Anthem’s compromised database.","supporting_quote":null,"technology_involved":["Anthem computer system","Anthem database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Anthem"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"c9dc15af44b2","name":"Anthem"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e7e720b8f5d72687db604bfc713d6ee11cd3105","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Anthem%20Security%20Breach%202-09-2015_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ac7abb56295c","org_name":"Kings County Office of Education","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48368"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-05","discovered_date":"2014-12-22","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"504e5fbea529e2346fa492ad85e465f1adf81c66","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-12-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PHOENIX%20HOUSE_%20INDIVIDUAL%20NOTIFICATION%20VERSION%201_WPP-REVISED_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"73614e8fb9e2","org_name":"Phoenix House Foundation, Inc. and its affiliates","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48355"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PHOENIX%20HOUSE_%20INDIVIDUAL%20NOTIFICATION%20VERSION%201_WPP-REVISED_0.PDF"}],"summary":"Phoenix House reported that a payroll consultant appeared to make unauthorized changes in third-party-hosted electronic payroll systems, potentially involving personal information.","supporting_quote":"On December 22, 2014, Phoenix House learned that, on December 19, 2014, a consultant hired to perform payroll activities for us appears to have made unauthorized changes in our electronic payroll systems hosted by third parties.","technology_involved":["electronic payroll systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2015-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e990c5eed368601298de2ae86f5261059c44188","impact_type":"data_theft","imported_from":null,"incident_date":"2013-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"ced502297ff0","org_name":"Crack Community","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Crack Community","type":"hibp","url":"https://haveibeenpwned.com/Breach/CrackCommunity"}],"summary":"The Crack Community forum was compromised in 2013, and data from 19,210 accounts was published online.","supporting_quote":null,"technology_involved":["MyBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f79a76c3c485caf397a5a8e763356955cb2da3c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7425785-BD93-4229-B98B-0CA4D94AC7D6"},"incident_date":"2015-02-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07d5a560325c","org_name":"Sacred Heart Health Systems","org_type":"healthcare","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northescambia.com/2015/03/security-breach-affects-about-14000-sacred-heart-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pnj.com/story/news/2015/03/16/sacred-heart-health-system-billing-information-hacked/24859975/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/policy/cybersecurity/235979-second-major-health-insurer-breached;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/and-then-there-were-four-five-ascension-health-entities-breached/"}],"summary":"Sacred Heart Health Systems is reporting a security breach at one of its third-party vendors has resulted in the possible exposure of health and personal information of about 14,000 patients.  Monday, the hospital said that on February 2, they were by a third-party billing vendor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40fded590728df2a39b862f8dc386f8e5991bd56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0724DB6B-67FA-41FE-AF36-34068C01EB1F"},"incident_date":"2015-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"465db849c412","org_name":"Suburban Lung Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/il-medical-files-of-suburban-lung-associates-patients-found-in-filefax-dumpster/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.cbslocal.com/2015/02/25/2-investigators-medical-files-with-personal-info-found-in-dumpster/"}],"summary":"A massive breach of medical records containing confidential personal information has prompted both federal and state investigations. It all started when CBS 2 Investigator Dave Savini got a tip about what a dumpster diver found in the trash. Suburban Lung Associates has numerous ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18d17d58f3b439286277e0ab51719b2509914b19","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26A5AEB1-7E0C-463A-BE76-18AA095055B5"},"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b38ec632978a","org_name":"Slack Technologies","org_type":"professional_services","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://slackhq.com/post/114696167740/march-2015-security-incident-and-launch-of-2fa;http://www.ibtimes.com/slack-hacked-leaving-500000-user-emails-exposed-1862146"}],"summary":"Slack hacked. Not clear how. Slack Technologies sure is making headlines. The San Francisco maker of an online workplace collaboration tool -- which has drawn attention over its $2.76 billion market valuation -- revealed a major hack of its user database Friday, releasing email a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba442acaa380efb439ca656f9dae9e90e2abd0f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA2B2CE7-2E1B-46D9-AC54-3FF414AB2E82"},"incident_date":"2015-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dcd22c659812","org_name":"Seton Family of Hospitals","org_type":"healthcare","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kxan.com/2015/04/24/39000-affected-in-seton-phishing-attack-targeting-company-emails/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bsminfo.com/doc/seton-health-breached-through-email-phishing-scam-0001"}],"summary":"Seton Family of Hospitals will provide free identity monitoring and protection services for patients who had their personal information leaked in a phishing attack targeting employee emails. Approximately 39,000 patients received letters about the breach in which hackers accessed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"357195aeb86bd465dd358da55cd68c0788471082","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A55AE8D8-3536-421F-A615-8269CD93CB88"},"incident_date":"2015-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77d6902f683a","org_name":"RTA Paratransit","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkyc.com/news/local/cleveland/3-indicted-for-abuse-of-rta-paratransit-service/24272480"}],"summary":"A Cuyahoga County Grand Jury has indicted three people on charges they fraudulently used public transportation designed to serve individuals with disabilities to instead provide rides for themselves, friends and family members, Cuyahoga County Prosecutor Timothy J. McGinty announ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"255e26643e37b437e59766b3727c2b0aeb78aea3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE22A1C5-B481-4662-A14F-0DC16CFF2B51"},"incident_date":"2015-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"999fa7e4e4fd","org_name":"Novalnet","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://derstandard.at/2000011722368/Datenpanne-bei-Zahlungsanbieter-Betroffene-auch-in-Oesterreich;http://www.computerbild.de/artikel/cb-News-Internet-Novalnet-Skandal-11426294.html;https://translate.google.com/translate?sl=de&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.krone.at%2FDigital%2FLeck_bei_Zahlungsanbieter_Einkaufsdaten_online-Promis_unter_Opfern-Story-439297&edit-text="}],"summary":"Security leak transactions made by hundreds of cost online stores - data affected by celebrities such as Udo Lindenberg and Stefanie Hertel  A security breach at a German payment provider has made accessible to all transactions in hundreds of online stores without a password. The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f10b45af37718dac9e48fdd364e31b1d73308cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82902FE5-A498-4159-B2BC-38AC5C1A2884"},"incident_date":"2015-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3fd04b794ff","org_name":"Montana Department of Public Health and Human Services","org_type":"government","ransomware":null,"records_affected":185,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/lifestyles/health/sns-bc-mt--records-breach-20160714-story.html"}],"summary":"unauthorized PII in email","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcaaf5a257e14da6c35e38a9e76a0a46b04e18cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB6AD561-D2FB-4D90-8FBB-90DC47D2A9C2"},"incident_date":"2015-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c7551764d23a","org_name":"INTERCITY TELECOM LIMITED","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://chrisdale.wordpress.com/2016/01/05/a-failed-attempt-to-overwrite-stolen-company-data/"}],"summary":"trade secrets covered up with music on thumb drive","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4956ecd62bdfba04e0c6caf8852c6f611a2dbfab","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C24772E3-BDBB-4FD9-A19C-3A9E516EB120"},"incident_date":"2015-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ca04bab7b4e7","org_name":"SA Health","org_type":"professional_services","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.adelaidenow.com.au/news/south-australia/three-more-people-sacked-for-snooping-on-patients-records/news-story/dbd37e960f96e2f89b1ccc0cdb060ec6;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.adelaidenow.com.au/news/south-australia/three-more-people-sacked-for-snooping-on-patients-records/news-story/dbd37e960f96e2f89b1ccc0cdb060ec6"}],"summary":"Three more people sacked for snooping on patients' records - South Australian Health","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"258b5c23eeaa265bb745e8c4d4cb950e3ce34f3c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F30CBA5-656B-45A3-B651-383B3A34365D"},"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"942a5a407831","org_name":"gov't and business","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-merseyside-34796552"}],"summary":"DOS multiple government and business websites","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67ec23a68ade67072e3e46ac49480a5fbc7351dd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61f30dd0-df83-11ea-b677-2b9ec926ea06"},"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85a378126bfe","org_name":"Brooklyn Administration for Children’s Services and the Health and Hospitals Corporation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2015/02/02/nyregion/large-warehouse-fire-continues-to-burn-in-brooklyn.html?_r=0"}],"summary":"No lives were lost in the huge fire that gutted a storage building on the Brooklyn waterfront over the weekend. But the flames put plenty of lives on display as the crumpling warehouse belched up its contents: decades’ worth of charred medical records, court transcripts, lawyers’","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":"BG","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa3f9e78cba2b8cfb98c462b1d95d649b709b898","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB417E68-41B5-4157-80C7-C42727169DDA"},"incident_date":"2015-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"af8411abf07a","org_name":"Barclays","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenorthernecho.co.uk/news/14566618.Pair_jailed_after____skimming____device_and_camera_to_film_pin_numbers_found_at_Barclays_cashpoint/"}],"summary":"skimmer and camera landed two in jail","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6db2b8c0e4bc1148d377558042ad3adc77580ea7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1B4CBCA-A981-45AC-9D44-E896E22F16CD"},"incident_date":"2015-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EC","org_id":"6dda8e1ce533","org_name":"Banco del Austro SA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/now-its-three-ecuador-bank-hacked-via-swift/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsj.com/article_email/lawsuit-claims-another-global-banking-hack-1463695820-lMyQjAxMTA2NjI0MDQyNzA1Wj;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsj.com/articles/vietnamese-bank-says-it-was-target-of-attempted-cyber-heist-1463405095;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bloomberg.com/news/articles/2016-05-20/ecuador-bank-says-it-lost-12-million-in-swift-2015-cyber-hack"}],"summary":"Cyber-criminals stole about $12 million from an Ecuadorean bank in a 2015 heist that bears all the hallmarks of later attacks against Bangladesh's central bank and a small Vietnamese lender. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aca6e74f557b27e5d366b67b079ad46e90c98612","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1e95ecc0-fe79-11e8-aee0-f7420d4f3238"},"incident_date":"2015-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d005d950149","org_name":"Allergy Associates of Hartford, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/strong-message-on-improper-phi-disclosure-to-news-media-a-11728;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://www.hhs.gov/about/news/2018/11/26/allergy-practice-pays-125000-to-settle-doctors-disclosure-of-patient-information-to-a-reporter.html;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://www.hhs.gov/sites/default/files/allergy-associates-ra.pdf"}],"summary":"Allergy Associates of Hartford, P.C. (Allergy Associates), has agreed to pay $125,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle potential violations of the Health Insurance Portab","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0129deb54b04842e6ac64673c32f17c23aa8944","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F324476-3869-4461-865B-2C1F9EC8C299"},"incident_date":"2015-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc6e937d34c","org_name":"Advantage Dental","org_type":"healthcare","ransomware":null,"records_affected":151626,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/advantage-dental-hipaa-breach-exposes-more-than-150k-patient-records-623/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://portlandtribune.com/pt/9-news/253880-123802-advantage-dental-says-patient-records-were-breached"}],"summary":"Advantage Dental of Redmond, OR, has announced that hackers have successfully infiltrated its computer systems and have potentially accessed the records of over 151,000 of its patients, according to a report in the Portland Tribune.  The Oregon-based company, which primarily prov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"becf7cd6c9e60148ba7164e1d94fc844130b45b1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_N095_v01_0.PDF"},"notes":null,"org_country":"US","org_id":"1af3caef85dd","org_name":"CICS Employment Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48292"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_N095_v01_0.PDF"}],"summary":"CICS Employment Services notified individuals that personal information related to employment applications may have been accessed without authorization, although forensic examinations found no evidence of compromise.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-01-29","discovered_date":"2014-12-01","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c091a416ecd4fe38f65e97ac7ae72a55b3aa937","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Adult%20SSN%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"5400d94e1728","org_name":"Riverside County Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48266"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Adult%20SSN%20Sample_0.pdf"}],"summary":"Riverside County Regional Medical Center reported that a missing laptop may have contained unencrypted patient information.","supporting_quote":"On December 1, 2014, we learned that a password protected laptop used by our Ophthalmology and Dermatology clinics was missing.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a870df8020c01e56d8f2e44c4c5cd1af906ce41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FB444DA-2E2A-4724-B11E-BA8534BA591D"},"incident_date":"2015-01-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"07d32fc2b621","org_name":"Jewish General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cjad.com/cjad-news/2015/01/30/jewish-general-investigates-privacy-breach"}],"summary":"The Jewish General Hospital says it is taking very seriously a breach of patient confidentiality.  Hospital documents blew out of the back of a truck on Highway 15 near Mirabel yesterday.  One sheet of paper lodged on the windshield of a Laval woman who later retrieved it and was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab02e535c9c214cf5d6aed823a9feda4c9b1f982","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7812BBBB-1B05-4550-8D9D-563EEFBDF4A4"},"incident_date":"2015-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e74bf12a6cc9","org_name":"Blue Chip Dental","org_type":"healthcare","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/2200-michigan-dental-patients-warned-of-phi-breach-3374/"}],"summary":"2,200 Blue Chip Dental patients have been notified that a backup system installed to safeguard patients' protected health information (PHI) has played a part in its exposure.  The Social Security numbers, medical insurance information, names, and addresses of patients have potent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"espionage","name":"Scarlet Mimic","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e2a637b9a9a8290c5373063c8f9c93783be3df2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A58028D-6B5A-43B3-8913-6FF37ED4E532"},"incident_date":"2015-01-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"90a8b203168e","org_name":"Uyghur and Tibetan activists","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/single-group-of-hackers-targets-uyghur-tibetan-activists/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/3025849/single-group-of-hackers-targets-uyghur-tibetan-activists.html"}],"summary":"computer security company also concluded that the information stolen by the group, nicknamed Scarlet Mimic, would be of little interest to entities other than a nation-state","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"scarletmimic"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2e48fa135324de75edf35a1a6d3423c3d5a4c49","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4914041-1871-4E05-8E10-661649DAD91C"},"incident_date":"2015-02-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-feb-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jan-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-mar-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-apr-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-may-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jun-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jul-2015.pdf"}],"summary":"Veteran A was provided Veteran B's medication.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-01-23","discovered_date":"2014-10-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79b253c047c24e84cec59d1bc3672dd6fe4e8458","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-15","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CPMC%20PI%20Press%20Release_1%2023%2015_0.pdf"},"notes":null,"org_country":"US","org_id":"d2fd1e17c52a","org_name":"California Pacific Medical Center","org_type":"healthcare","ransomware":null,"records_affected":844,"reviewed":false,"root_cause":"A pharmacist employee accessed patient records without an apparent business or treatment purpose.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48217"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CPMC%20PI%20Press%20Release_1%2023%2015_0.pdf"}],"summary":"A California Pacific Medical Center pharmacist employee may have accessed 844 patients’ medical records without a business or treatment purpose.","supporting_quote":"California Pacific Medical Center (CPMC) recently notified 844 patients of its discovery that a pharmacist employee may have accessed their records without a business or treatment purpose.","technology_involved":["electronic medical record system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"476f1b1b99bbb2971fe391b0b33565bb68a093b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0135822E-3438-4DCD-BA27-99D252E8DBD6"},"incident_date":"2015-01-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"de61ee260fc7","org_name":"Terrasse-Vaudreuil Municipality","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://web.archive.org/web/20150320105642/;http://www.thestar.com/news/canada/2015/01/23/cyberattack-leaves-small-town-in-quebec-bewildered.html;http://digitallocksmithsinc.com/2015/01/24/terrasse-vaudreuils-website-one-many-hacked/#.Vqnjjo-cGUk;http://montrealgazette.com/news/local-news/terrasse-vaudreuil-website-hacked-by-meca"}],"summary":"The website has been hacked by someone claiming to be linked to Islamic extremists. The homepage of the Terrasse-Vaudreuil municipality website boasts a message which includes:   \"We are Muslims. Quran is our book. In Allah we trust. For Allah we work. SCREW YOU Charlie Hebdo.\"  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v4","run_date":"2026-10-12"},"first_seen":"2026-10-12","id":"e1782f6b7ba51b1bb91fb8d181d6ed26b0869901","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-13","outcome":"no_text","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/OppenheimerFunds.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5f5bc89ecb74","org_name":"Oppenheimer Funds Services","org_type":"unknown","ransomware":null,"records_affected":102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/OppenheimerFunds.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d11ba52ef2c204813aeb00d6077e007af70c8559","impact_type":"data_theft","imported_from":null,"incident_date":"2015-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e203a303bf7b","org_name":"Lizard Squad","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lizard Squad","type":"hibp","url":"https://haveibeenpwned.com/Breach/LizardSquad"}],"summary":"A breach of the Lizard Stresser service publicly disclosed user accounts, including plaintext passwords.","supporting_quote":null,"technology_involved":["Lizard Stresser"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11d10dbbf87d61b5e6b524f7b48328f32f752f78","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"690E5AD8-9F3E-4779-A935-1FD0C8C91E1A"},"incident_date":"2015-01-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71d9f296d454","org_name":"Winnipeg Regional Health Authority","org_type":"government","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegsun.com/2016/01/27/more-patient-records-stolen-from-wrha"}],"summary":"For the second time in a week, a WRHA staff member left patient information in a car that was broken into.  Records of 25 patients had been left unattended in a car Jan. 17 when the car was broken into and the confidential documents stolen.  \"Apparently the documents were in a ba","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ee692e375ea7c9a5735e07f4bcba4bb4cca72f0","impact_type":"unknown","incident_date":"2014-01-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Barbecue%20Renew%20Consumer%20Notification%20Sample_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7eae714bd7fe","org_name":"Barbecue Renew Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48107"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2015-01-15","discovered_date":"2015-01-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"513590fec99af649305c12bdca3e878d56bd040d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-04-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Security%20Breach%20Notification%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"011beeafa1b5","org_name":"OppenheimerFunds","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48071"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Security%20Breach%20Notification%20Sample_0.pdf"}],"summary":"OppenheimerFunds notified shareholders that their personal and account information was erroneously accessible to a representative of a brokerage firm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"746662b97044c729ec4d46273aae6234d742ba8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFFC2F32-5BFD-4398-A6E3-9F3B152F9E64"},"incident_date":"2015-01-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"58db32a35373","org_name":"Metropolitan Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":3957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-metropolitan-hospital-center-notifies-almost-4000-patients-of-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/hhc/downloads/pdf/20150601-data-breach-metropolitan-eng.pdf"}],"summary":"The New York City Health and Hospitals Corporation (HHC), which operates the Metropolitan Hospital Center (Metro- politan), values the importance of protecting the confidentiality of our patients' medical records. Therefore, we regret to inform you of an incident that resulted in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e1e690bbdfa8c75c2e0960a7852345ffb277f51","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CE98BB7-06A1-4459-8A5A-CD03267B7D72"},"incident_date":"2015-01-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc94394df990","org_name":"General Genetics Corp","org_type":"professional_services","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/to-your-health/wp/2015/11/17/federal-privacy-law-lags-far-behind-personal-health-technologies/"}],"summary":"Person sent in an over the counter paternity test and the website with the results showed over 6,000 other patients results as well as her own.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d720f0a4510dca4846a5a84c1d01a33cbd7aac83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DA357C3-6573-4404-B4E7-59ED147E762F"},"incident_date":"2015-01-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ebf67031c49","org_name":"Bellevue Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":3300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/thousands-of-bellevue-hospital-center-patients-notified-of-data-breach/article/416405/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/hhc/downloads/pdf/20150428-letter-to-patients-jacobi.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-bellevue-hospital-notifying-3300-patients-of-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-jacobi-medical-center-notifies-90060-patients-after-employee-emailed-phi-to-her-personal-account-and-new-email-address-at-another-employer/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.politico.com/states/new-york/city-hall/story/2015/05/hhc-reports-possible-data-breach-022367"}],"summary":"Bellevue Hospital Center operator New York City Health and Hospitals Corporation (HHC) is notifying roughly 3,300 patients that their personal information was included in a spreadsheet that was improperly emailed to an unauthorized recipient.  How many victims? About 3,300.  What","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e6232467306dca78a31117693ea7cc10c9b1fe5","impact_type":"unknown","incident_date":"2014-12-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/American%20Airlines%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3facdedacad1","org_name":"American Airlines, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48070"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3b6d8815c7b4aee56a74c9db238f41cde3f1974","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Breach%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"ae7a99f077b3","org_name":"ValuePetSupplies.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48068"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Breach%20Letter_0.pdf"}],"summary":"Unauthorized persons accessed ValuePetSupplies.com servers and installed malicious files intended to capture personal information entered on the website.","supporting_quote":null,"technology_involved":["ValuePetSupplies.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2015-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15a2c82b3cd8e919740b704a5a0dfcf292f50273","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Park%20n%20Fly%201_13_2015%2048024%20_0.pdf"},"notes":null,"org_country":"US","org_id":"47b251d5ee3c","org_name":"Park 'N Fly","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48024"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Park%20n%20Fly%201_13_2015%2048024%20_0.pdf"},{"fetched_at":null,"title":"South Carolina consumer affairs breach notice","type":"state_ag","url":"https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/ParkNFly.pdf"}],"summary":"Park 'N Fly reported a security compromise involving payment card and loyalty customer data processed through its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-12","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eba9495152b27feab1f6b7a74ec3b482265f3e77","impact_type":"exposure_no_theft_confirmed","incident_date":"2015-01-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0fd6fa46e852","org_name":"Law Offices of David A. Krausz, P.C.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48015"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice_0.pdf"}],"summary":"A laptop containing client identifying information was stolen from the Law Offices of David A. Krausz, P.C.","supporting_quote":"On January 6, 2015, Law Offices of David A. Krausz, P.C. experienced the theft of a laptop computer that contained identifying client information including names, social security numbers and dates of birth.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"teamcarbonic","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2015-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40b10274bb5ccaee4b6847f2393b0599c19877a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F9E77CD-DF28-4A7A-B177-DC835384F00F"},"incident_date":"2015-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3dd94c87b87c","org_name":"Kansas Insurance Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/cmon-folks-you-really-need-to-acknowledge-breach-notifications-monday-edition/"}],"summary":"  2015 .  \t   I haven't kept strict statistics, but in general, most entities that I try to notify of a breach fail to respond at all. Others may respond that they're looking into claimed hacks, but then fail to get back to me with a definitive answer or statement.  Here's anothe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"teamcarbonic"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5753303c01d00e78fb4c706e82d463bf4d11e0d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F97E369-49B0-4184-ACD6-8FEAC2ADBD12"},"incident_date":"2015-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"652bb869829d","org_name":"Florida International University","org_type":"education","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/florida-international-university-data-hacked-and-dumped-claim/"}],"summary":"data dumped of students","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2015-01-09","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a325d95d2fab8be80483fe8c4848ca9f9d68743","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Sample%20-%20IEHP%20PB%202014-00190_0.pdf"},"notes":null,"org_country":"US","org_id":"ba98fd65410a","org_name":"Inland Empire Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47991"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Sample%20-%20IEHP%20PB%202014-00190_0.pdf"}],"summary":"A computer containing IEHP member information was stolen from Children’s Eyewear Sight.","supporting_quote":"On October 28, 2014, a desktop computer and other items were reportedly stolen from Children’s Eyewear Sight, located on 11940 Foothill Blvd., Ste. 107, Rancho Cucamonga, CA, 91739.","technology_involved":["desktop computer"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Children’s Eyewear Sight"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"ead4008dc9bb","name":"Children’s Eyewear Sight"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39b3ce38bbff6622b681b8a93e3789a621de1bd9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2DF75BB-01C7-4C21-BA58-F546F7A40558"},"incident_date":"2015-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c034b691f7f","org_name":"Boomerang Rentals","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-boomerang-rentals-customers-report-fraudulent-card-charges/;http://www.theregister.co.uk/2015/01/12/boomerang_security_breach_fears_credit_card_details/;https://blog.malwarebytes.org/online-security/2015/01/popular-game-rental-site-issues-statement-on-alleged-fraudulent-payment-attempts/;http://static.ow.ly/docs/Statement%20Boomerang%2012.1.2015_2S27.pdf"}],"summary":"Boomerang Rentals customers report fraudulent card charges (Update 2)  Posted by Dissent at 7:42 am Business Sector, ID Theft Jan 13 2015   And for Tuesday's edition of \"How Not to Handle a Reported Breach,\" we give you__.. (drum roll)__. Boomerang Rentals.  John Leyden of The Re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8261f2dbe2a67a7ad9b18eeee9107c5d7958db6b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6846CB41-0F3F-46B2-BFAA-B8D0EDC752F8"},"incident_date":"2015-01-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abfc581a70f8","org_name":"Dr. Sharon J. Jones","org_type":"healthcare","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/03/09/stolen-patient-records-in-calif-mean-possible-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/important-security-and-protection-notification-300046534.html"}],"summary":"To past and current patients of Sharon J. Jones, M.D.:  On the evening of January 8, 2015, our office was broken into and our 2014 credit card transaction register and approximately 350 patient charts were stolen. Upon discovery the following morning, the San Pablo Police Departm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ede12a06f85fbef0e4e3e91eda92c12e3c600411","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notification1_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2c6cc66cd465","org_name":"United Airlines","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47959"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f8734452baa83274f71eecb448812145b5c60a9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F70131A0-76DD-4B03-98C2-CB66F9AD36C5"},"incident_date":"2015-01-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60f24674ba86","org_name":"Cathrine Steinborn, DDS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/breach-notification-in-three-easy-mailings-not/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/california-dentist-provides-public-notice-of-data-security-incident-300039197.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-48477"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48477"}],"summary":"Dr. Cathrine Steinborn, DDS, is providing notice of a recent office theft which may affect the security of patient and responsible party personal and protected health information.  On January 5, 2015, Dr. Steinborns office was burglarized and a server containing patient and respo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Rex Mundi","variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2015-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"071ae2c5f96993acb6741e9438e7e6884b9515ca","impact_type":"both","incident_date":"2014-06-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"a4baf59c01e1","org_name":"Domino's","org_type":"retail_ecommerce","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Domino's","type":"hibp","url":"https://haveibeenpwned.com/Breach/Dominos"}],"summary":"Rex Mundi hacked Domino's customer data in France and Belgium, held it to ransom, and later released it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"rexmundi"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1acdea69af1ad30169a88273684593ab13593c02","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55D48F7F-6C68-4CB6-A320-BAB754B42B35"},"incident_date":"2015-01-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jan-2015.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-feb-2015.pdf"}],"summary":"Two Veterans with the same last name received each other's medication in the mail.  Information exposed was the Veteran's name, address and\nprescription label. They both returned the inappropriate medications and were given the correct medications","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"566d114a7e1cb560a6041f93ef639b81d34f9b78","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification%20Letter%20Fast%20Forward%20Academy_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"169ad9eddc1e","org_name":"Fast Forward Academy, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47924"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"018b7028e93340e500d8cc7272dd41676ab4c79b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fa168470-a23b-11e8-ae61-0fc7f403e976"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c41e87d664ad","org_name":"Yonkers Fire Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.lohud.com/story/news/local/westchester/yonkers/2018/06/27/yonkers-records-containing-personal-info-found-condemned-firehouse/738849002/"}],"summary":"Records containing firefighters' personal information — including Social Security numbers, names, addresses and phone numbers — were found in the condemned firehouse in downtown Yonkers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12b6f519b954b50763e210ac70768b2766b9ac5d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73E7EB85-D398-48DB-91EF-74656A951AA6"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"4c80a9d8e0a2","org_name":"Yandex NV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.searchenginejournal.com/former-yandex-employee-allegedly-tries-to-sell-source-code-on-black-market/147905/"}],"summary":"employee misuse leads to attempt to sell source code","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"866cc56456e14c7764333bff423e1e27045c79d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE7DDE65-1F2D-416C-9884-8501154419B8"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"478d44399f8f","org_name":"Yale-New Haven Hospital","org_type":"healthcare","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ct-hospital-patients-caught-in-identity-theft-ring/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcconnecticut.com/troubleshooters/Hospital-Patients-Caught-in-Identity-Theft-Ring-394598611.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/yale-new-haven-hospital-sitter-charged-with-stealing-patients-identities.html"}],"summary":"Federal officials are investigating two women for stealing the identities of four patients at Yale-New Haven (Conn.) Hospital, NBC Connecticut reports. One of the women worked at the hospital as a patient companion.  One victim of the identity theft who was being hospitalized for","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"988788e40b2b5be9f05324abd99fe64c2c49310e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73081A0D-6CFA-4A24-A701-0B01750A7B37"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e64f93c10601","org_name":"Xytex Corp","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lifezette.com/healthzette/mentally-ill-sperm-donor-busted/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://onlineathens.com/mobile/2016-09-03/uga-employee-center-sperm-bank-fraud-lawsuit"}],"summary":"sperm bank is in an uphill battle  one of its donors admitted he lied about his health","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0ac5a1658d100986828e7aba20bda53fe843fc9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30A095E0-94FE-477D-851F-C808188B1294"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1c837ad1335","org_name":"Xtra Mile Ambulance Service","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krgv.com/news/local-news/State-Investigates-After-Medical-Files-Found-in-Dumpster/31596764;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-state-investigates-after-medical-files-found-in-dumpster/"}],"summary":"KRGV reports that patient and employee records from Xtra Mile Ambulance Service Company were found in a dumpster at a storage facility. The ambulance company is no longer in business. The medical files contain personal information including Social Security numbers, addresses and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3160819491a334f2055bf6dcc2e2d2a925fcc6cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE4ADF86-6177-46F6-8D47-004F3B47E130"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"49d1b59b0fd4","org_name":"Wycombe District Council","org_type":"government","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bucksfreepress.co.uk/news/11731440.Bungled_council_mail_out_sees_1_200_voting_forms_sent_to_wrong_residents/?ref=mr"}],"summary":"More than 1,000 residents across Wycombe have received the wrong details on a postal voting form __ sparking fears over the council's handling of confidential data.   Emma Banister Dean from Turville, near Marlow, told the BFP she opened her postal vote registration form yesterda","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cb3b8934133f63b3bb2de65abd77dd684a244d6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CBA87AB-2E1E-4990-9E15-6148A9295C90"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6d165c7d4ee","org_name":"Woodland Heights Medical Center","org_type":"healthcare","ransomware":null,"records_affected":450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktre.com/story/30704770/woodland-heights-employee-investigated-for-stealing-450-patients-info"}],"summary":"A Texas Ranger and a Lufkin hospital are investigating a former employee after the Ranger reported discovering approximately 450 patients' information in their home.  A letter to a patient dated on Dec. 1 states Woodland Heights Medical Center became aware of the unauthorized rem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e9c688a0be4e86ab828feaefe798685ef8533c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5721601B-A48C-48BF-91F9-F8B44A1DE07F"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c412527309d7","org_name":"Winthrop-University Hospital","org_type":"healthcare","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/long-island/nassau/winthrop-university-hospital-worker-charged-with-stealing-patients-personal-information-cops-say-1.10762842"}],"summary":"Account rep at medical center stole 11 patients' identities. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e9f56d9ce441f94467145370c6630d3920827ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C51878FB-9EDB-4607-8AE0-BA2447C69F60"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbd8515f5a56","org_name":"William W. Backus Hospital","org_type":"healthcare","ransomware":null,"records_affected":360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.norwichbulletin.com/article/20150822/NEWS/150829814"}],"summary":"A Norwich man received a letter from The William W. Backus Hospital on Saturday informing him of a possible data breach involving several pieces of sensitive patient information, one of more than 300 patients the hospital sent similar notifications to this month. Kenneth Keely Jr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e28fbfd8e62a42290d600667fe14606097b70abb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"021AD10F-6D53-4318-BB79-E20B2DEF39EF"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f84cbf2b3f73","org_name":"Western Missouri Medical Center","org_type":"healthcare","ransomware":null,"records_affected":6200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailystarjournal.com/news/local/article_3917801d-99bb-560b-9ded-54a4f3af9d4c.html"}],"summary":"About 6,200 accounts at Western Missouri Medical Center were turned over to a collection agency due to a glitch in the computer changeover, interim President/CEO Darinda Reberry said. Reberry said the glitch occurred among patients who had several accounts that the new computer s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d01345f32b8b2c1f8913653e0027a85c327e1034","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4574AC35-0637-4813-ADB9-C6551033C816"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"553f0b8b97ba","org_name":"Wellington Hospital","org_type":"healthcare","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/77976759/privacy-review-at-wellington-hospital-after-staffer-caught-snooping-on-records;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/78426129/wellington-hospital-paid-out-former-staffer-after-colleagues-breached-her-privacy"}],"summary":"A Wellington Hospital staff member has left after being caught accessing 33 patients'  records.  The breaches have sparked an independent privacy review of the Capital & Coast District Health Board's privacy practices, which recommended more thorough auditing, restrictions on acc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a05c85c679d74f20f47d123b5fc11848b5f66429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E43E6EF-5156-4CDD-A7AB-8BE393A5D390"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cef177a6864","org_name":"We End Violence","org_type":"education","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc7.com/education/california-state-university-officials-investigating-data-hack-impacting-8-schools/976462/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-cal-state-data-breach-20150908-story.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/WEV%20-%20Email%20Notice_0.pdf"}],"summary":"Students required to complete violence training course had credentials and PII exposed by vendor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":"Jason Martinez","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30496cd127e7abd5bb20b71b1e86f5715b02312b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B96FB77-498B-4ED1-BDD2-BF05E3923A8E"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a894792f1bb2","org_name":"Wash Tub","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kens5.com/story/news/crime/2015/05/12/warrant-man-stole-identities-from-customers/27163293/"}],"summary":"A man is accused of trying to open up bank accounts with stolen information.  According to the suspect's arrest warrant, he got a hold of sensitive information from two different people at his place of employment.  Police said 37-year old Jason Martinez tried to open up a bank ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical","derived":{"actor_id":"jasonmartinez"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b648106a496de08f255c60f4a86811b3805df92a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38E823FC-BE0A-4A80-9542-F0899C4EE613"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a6aaac86060","org_name":"Wabash College","org_type":"education","ransomware":true,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/some-previously-unreported-breaches/"}],"summary":"malware both exfiltrated personal information and locked up all files ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae4a8fd96a792a74671fba6db307d88a8c54f38d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89FFEBDB-3EBB-4F32-AC04-4975A9975A1C"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c13a7035d30","org_name":"Virtua Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1654,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nj-virtua-medical-group-notifies-1654-patients-whose-information-was-exposed-on-internet/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.burlingtoncountytimes.com/news/local/virtua-medical-group-patient-information-was-released-on-internet/article_5441640e-e7d3-11e5-ba14-7f927a0818ff.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.virtua.org/news/notice-to-patients-of-transcription-records-incident"}],"summary":"Virtua Medical Group (VMG) announced today that in early January 2016, one of its transcription vendors unintentionally caused certain patient transcription records to become viewable on the internet if searched with a search engine. Each year, VMG creates patient records for eac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7bc7056d3d3fbc335d19727757ab098d2d342d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F40E1F8-F7C6-4A7B-8DF5-19E46FAA5289"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b039cbdaa037","org_name":"Vidant Health","org_type":"healthcare","ransomware":null,"records_affected":897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/vidant-health-notifies-patients-whose-phi-was-exposed-in-court-bankruptcy-filings/"}],"summary":"Company failed to exclude sensitive PII in bankruptcy filings","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51b4fac52de17ce8c06af1a09638e94c9ea5ba24","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBDCDE9F-B47B-41B6-B79B-46DCAE8FB94E"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"government","ransomware":null,"records_affected":967,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ijpr.org/post/personal-info-hundreds-oregon-veterans-compromised#stream/0"}],"summary":"The Oregon Department of Veterans' Affairs says the personal information of hundreds of veterans may have been compromised.  ODVA Director Cameron Smith said discharge and release papers may have been in the possession of an unauthorized person, but so far there's no evidence of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbc6c116fac5d49e375aff8133644ff57f52639d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"feb40900-d967-11e7-8b17-fdfed30923dd"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"0f3d7d7a0144","org_name":"Verity Health System","org_type":"healthcare","ransomware":null,"records_affected":10164,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/business/article/Data-breach-at-Verity-Health-could-have-affected-10918419.php"}],"summary":"Website hack - no details provided","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b1f1a90115c2acbc0a90dfa020789dd5f2857c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AAEAC97-7CCA-419A-9BD6-ABE03BF115B3"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10d56b21dcea","org_name":"Vancor Manor","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/news/crime/2015/12/31/goodlettesville-nursing-home-tech-charged-identity-theft-patient/78122368/"}],"summary":"ID theft of nursing home patient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87e946e53e61a0cdd11ff03649bfa54ef14e3c81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA6DED80-AC43-420B-A250-A6EACE7760B3"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79358eb1ad98","org_name":"Valero Energy Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc13.com/news/two-men-sought-after-card-skimmer-attached-to-atm/1103287/"}],"summary":"ATM Skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5f02ff503e96c348ea1ee516598ce6ff56aa6d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE4059B2-F3E7-4E45-9320-2948A227A86A"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"702bfa29774a","org_name":"VA Long Beach Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc7.com/news/va-long-beach-hospital-may-have-improperly-disposed-patient-docs/671192/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Documents containing the personal information of veterans seeking treatment at the Veterans Affairs Long Beach Hospital may have been improperly disposed, Veterans Affairs officials said.  Army veteran and hospital patient Paulnhu Nguyen said he found a large stack of patient rec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c6f8598af5ca57646ab124b25fcb17aabfbb33c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"258C1629-2075-4361-BEDB-8918CD0B0E52"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fca8657f5de","org_name":"US Navy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/10/16/navy_engineer_attempted_espionage/"}],"summary":"Navy engineer gets 11 years for attempted espionage ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2da778d46217092743f64cc05238a84b8eea0040","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9EEC268-3935-4702-81AB-BB15021EB193"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c9e50ae0c3a","org_name":"US Department of the Navy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/local/crime/navy-engineer-admits-trying-to-leak-plans-for-new-aircraft-carrier-to-egypt/2015/06/15/dac351a4-0fa2-11e5-adec-e82f8395c032_story.html"}],"summary":"Attempted espionage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31079579065e78800b60ca211e1fd1e07240403","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D8DB525-8004-4E7F-95EC-C131CF2D9853"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87f7e200c251","org_name":"US Army","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mvariety.com/cnmi/cnmi-news/local/82299-reservist-charged-with-theft-wire-fraud"}],"summary":"Reservist charged with theft, wire fraud. Misused SSN for purposes of ID theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f866df77ad75a582b0f8f8648c9fd30cfd1e4cd0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"810360A6-E8A2-496F-8145-73FB068AB2D9"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75f20060d47d","org_name":"US Air Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/08/03/sysadmin_jailed_10_years_stealing_classified_usaf_docs/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2015/aug/3/it-worker-gets-10-years-hacking-military-email/"}],"summary":"hacking of a military email account and theft of sensitive files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fb401ae1850942ee395cec470f1180b1fa88f10","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDAB70AA-DC57-4195-A0E9-6C4E7F0E6B00"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b581f3c5e20","org_name":"University of Iowa","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thegazette.com/subject/news/education/higher-education/university-of-iowa-worker-fired-for-violating-privacy-law-20150523;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/careless-talk-iowa-university-worker-fired-for-hipaa-privacy-violation-7007/"}],"summary":"A University of Iowa student health employee was fired and a second staffer disciplined after discussing pregnancy test results of the girlfriend of a \"well-known athlete.\"  The university considered it a violation of the federal patient privacy law known as Health Insurance Port","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22be2524c7cf68da0480554e57c85ea4b79516f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA741AD6-26B0-491E-AF85-471B8CC83A1A"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fab5b6ae20f4","org_name":"University of Greenwich","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-35587529"}],"summary":"Personal details about hundreds of London-based research students were posted online in an apparent breach of data privacy laws. The University of Greenwich has apologised and said it is in the process of contacting those affected. The matter was brought to the BBC's attention by","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea7d617d03fd3223087533643c085a84ff42d600","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D63E6CD-9F18-4E35-9F15-2DE4AF8B9068"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d9d6ea9420e","org_name":"University of Colorado Health","org_type":"healthcare","ransomware":null,"records_affected":827,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/u-colorado-health-notifies-827-patients-that-employee-snooped-in-their-records/"}],"summary":"Nurse accessed medical records for patients in which he/she was not providing active care for.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f38583d084cd830fb13e3173da85f474c7f5f6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"228291D1-82AB-48DD-8CB3-A8C1360868B9"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"192ad82e443d","org_name":"University of Cincinnati Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcpo.com/news/local-news/hamilton-county/cincinnati/woman-with-syphilis-ridiculed-on-facebook-but-hospital-isnt-liable-even-though-employee-leaked-it;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cincinnati.com/story/news/2014/06/06/uc-health-outraged-employees-facebook-posting/10067089/"}],"summary":"A Tri-State woman with syphilis had her diagnosis posted on Facebook after a hospital worker leaked it. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecb7ad0ce89c0c7a0716135559166bdacf09969f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37BE6BE1-C1AF-4955-B868-6CEA1E51B8F4"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3488eda2b925","org_name":"University of California Los Angeles (UCLA)","org_type":"other","ransomware":null,"records_affected":4500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-ucla-medical-data-20150717-story.html"}],"summary":"MMarking another high-profile data breach, hackers broke into UCLA Health System's computer network and may have accessed sensitive information on as many as 4.5 million patients, hospital officials said.  This cyberattack at UCLA comes on the heels of a major breach of federal e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4af30bb9ec3f061b48bd7ae037230035c8bb787d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09C28A55-E262-49C3-81DB-FD9BE3EE5170"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d436f5f55c4b","org_name":"University of Bedfordshire","org_type":"education","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.timeshighereducation.co.uk/news/confidential-medical-data-found-abandoned-campus;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.timeshighereducation.com/news/university-of-bedfordshire-confidential-medical-data-found-abandoned-on-campus"}],"summary":"The University of Bedfordshire has launched a review after confidential medical data from teenage research participants was found abandoned in an unlocked filing cabinet.  Folders containing adolescents' names, addresses, stages of puberty and other details were discovered during","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d48a037ed343f9f8d123cb4351e993ea30292737","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"433047FE-CA30-4D1D-A37F-ED0FE773ADAD"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6421099e0765","org_name":"University Hospitals Elyria Medical Center","org_type":"healthcare","ransomware":null,"records_affected":297,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/unauthorized-phi-access-at-ohio-hospital-affects-300-patients"}],"summary":"An Ohio hospital is working to notify nearly 300 patients after unauthorized PHI access took place, potentially compromising their personal information.  Unauthorized PHI access puts patient information at risk A University Hospitals Elyria Medical Center employee allegedly acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3084cd5fdfac8a6c985a117fd10b9543893d43f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D77405E2-D1E1-4A85-94FF-486FF8A40EEF"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"65cb4a24f24f","org_name":"University Hospital of South Manchester NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-manchester-37223597;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/health-37152871"}],"summary":"medical breech released in journal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c40dcc7fc25684266a361cb9b63527ca755b6c23","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B0199A8-809D-42FF-82BD-E81F79AFF70E"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"60d345727bce","org_name":"University Hospital Galaway","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://connachttribune.ie/new-guidelines-after-data-breaches-at-uhg-981/"}],"summary":"New article w several data losses noted. This focuses on 2 instances of lost paper documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4debd444deba73b66133ccd4244e92bdc30fb845","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06EF40DF-B0ED-4335-ADB1-DC95A75AE0FC"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cfbd3b5f7428","org_name":"University College Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-3166496/Jeremy-Hunt-hot-water-breaching-patient-confidentiality-posting-hospital-visit-picture-Twitter-board-names-it.html"}],"summary":"Health Secretary Jeremy Hunt has been accused of breaching patient confidentiality by tweeting a photo to his 70,000 followers from a hospital visit.  He came under fire after the image of himself with medics at University College Hospital in London captured a board listing patie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a21f432ae7e2346bf4f0f4c2f0a1b85dae2ebac1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"597281EA-7C12-4E31-972B-61C6DDF9BF79"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fed005e549e2","org_name":"Univeristy of New Mexico Hospital","org_type":"healthcare","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nm-unm-hospital-notifying-patients-of-data-breach/"}],"summary":"UNM Hospital is notifying more than 2,800 patients of a data breach. They say that limited medical information may have been mailed to a wrong address due to a technical issue with the hospital's billing systems. Information like the names of patients, their providers' names and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c8f611f4c106403b259d021948448e41e06c917","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F59B48F9-B8CD-4F25-AF9E-179018157A07"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71eb2d8e8acf","org_name":"United States Veterans Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/local/296372321.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wi-ex-va-worker-charged-with-stealing-identities-from-hospital-mail-from-neighbors/"}],"summary":"A former lab worker at the Veterans Hospital in Madison used information stolen from VA records, from mail stolen from her neighbors and information purchased on the Internet to obtain credit cards and access other people's checking accounts, according to criminal charges filed t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91c7514fe532741e7c95f911c34c101001bcc34c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78CD4A4F-40DF-42C1-8184-5FB6AC708645"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21de0fc4ffda","org_name":"United States Government","org_type":"government","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/news/local/man-charged-stealing-secrets-charlotte-based-compa/nk7W4/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/news/local/crime/article37349634.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.fbi.gov/charlotte/press-releases/2015/chinese-businessman-charged-with-theft-of-trade-secrets"}],"summary":"A criminal bill of information was filed today in federal court in Charlotte, charging a Chinese businessman, Xiwen Huang, 55, of Charlotte, with one count of theft of trade secrets, announced Acting U.S. Attorney Jill Westmoreland Rose and Special Agent in Charge John A. Strong,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17f4a01f92d88ad90802715f58542371fdbfa2bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FCB3A78-A870-46D6-8B96-90E6E31C1BCD"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f223674de98","org_name":"United States Department of Veteran's Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ex-employee-of-u-s-department-of-veterans-affairs-sentenced-for-aggravated-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stltoday.com/news/local/crime-and-courts/feds-veterans-affairs-employee-stole-veterans-benefits/article_15a60768-963a-5ba9-ac21-83ea79c2de57.html"}],"summary":"Ex-Employee Of U.S. Department Of Veteran's Affairs Sentenced for Aggravated Identity Theft  A former employee of the U.S. Department of Veterans Affairs accessed a computer system to divert veterans' benefits to a girlfriend's bank account, federal prosecutors said Friday.  Terr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87728cd943d96f978beb867e590e1faaf1e7c1d0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC056D76-7482-4E2D-838F-818AD7B399FD"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ecf37f04a22","org_name":"United States Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wait-what-2/"}],"summary":"Ronald D. Garrett-Roe, MD notified HHS that 1,600 patients were affected by a hacking/IT incident involving a desktop computer  Alleged hackers gained unauthorized access to one or two hard drives on the desktop computers of the covered entity (CE), Dr. Ronald D. Garrett-Roe, aff","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b82178111abc04907e9d3c2ef5289632ccfe7d5b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30212d60-e910-11e9-b01d-8d8474fb7a4b"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe4eb940ea1","org_name":"United Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":6240,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/2017/12/11/former-u-s-postal-worker-sentenced-to-6-years-in-prison-for-stealing-6000-plus-credit-cards/"}],"summary":"Processing clerk for Santa Ana Postal service was stealing credit cards and selling them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae59d9033d3222ffbf956aee4e22d871e90c9fea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A95B4DA7-3607-4CDA-99C5-301818C997DE"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68d10a946a4a","org_name":"Union Bank & Trust","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsleader.com/story/news/local/2016/08/30/skimming-device-camera-found-waynesboro-bank/89597378/"}],"summary":"ATM Skimmer at two bank locations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85c0dcbb84658f18dcf257d17974d95e620a1185","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB2CF5A9-9895-4AF3-A105-9136352FD937"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebfb3239853e","org_name":"UCLA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://asianjournal.com/consumer/ex-lovers-quarrel-lead-to-disclosure-of-private-medical-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mynewsla.com/crime/2015/08/26/woman-suing-over-shared-medical-records-not-the-same-person-she-was-before/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/small-breach-big-impact-redux/"}],"summary":"Doctor shares password with medical assistant, against policy. Assistant misuses access to look up medical record of her boyfriend's ex-girlfriend.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f5c7497dd7bc4779c76d95240eceeedd214d1fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0C4B24D-4051-44DC-A004-09B009436AEE"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b35624ef373a","org_name":"UCHealth","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/uchealth-alerts-patients-of-internal-healthcare-data-breach"}],"summary":"Colorado-based UCHealth is notifying approximately 800 patients of an internal healthcare data breach that resulted from an employee inappropriately accessing electronic patient files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d69761737925587902a9883a13f2c416f79f9cf2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B33EE37B-A29B-42CF-9B57-0BACCDA925DF"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14468df2c101","org_name":"Ubiquiti Networks Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2961066/supply-chain-security/ubiquiti-networks-victim-of-39-million-social-engineering-attack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sec.gov/Archives/edgar/data/1511737/000157104915006288/t1501817_8k.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/"}],"summary":"Ubiquiti Networks Inc., the San Jose based manufactured of networking high-performance networking technology for service providers and enterprises, announced in its fourth quarter fiscal results that it was the victim of an email business fraud incident resulting in the loss of $","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e0363bcc25d217b3ec79e4b7cd8301770786c25","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3DF0C26-B6BB-471F-B31C-856B1D9B49A1"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e36e447f5fc8","org_name":"Uber Technologies","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/06/15/petitions_pulled_as_hacker_redirects_uber_loveres_to_lyft/"}],"summary":"XSS attack on Uber poll.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34fcb1c24eae131c98b8b2bd7b43984642ae62d7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"867D63A5-66C1-4C1C-B6D3-7C21AA2698D0"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6dc1ed2ad7d3","org_name":"U.S. Department of Justice","org_type":"government","ransomware":null,"records_affected":831,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox23.com/news/news/local/tulsa-man-arrested-68-complaints-identity-theft/npKN8/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newson6.com/story/30479086/hundreds-of-id-documents-recovered-during-tulsa-home-search"}],"summary":"stolen documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdf773b05beac900ade06ffb308d0642c914ecad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDEF0AB2-35B6-4716-B367-C52256E83907"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"636b3073c0a0","org_name":"Tunecore","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tunecore-has-been-hacked-sensitive-data-revealed-all-user-passwords-invalidated/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hypebot.com/hypebot/2015/12/tunecore-has-been-hacked-sensitive-data-revealed-all-user-passwords-invalidated.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.musictimes.com/articles/57447/20151208/tunecore-hacked-millions-musicians-private-information-compromised.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://help.tunecore.com/app/answers/detail/a_id/669"}],"summary":"Tunecore_CEO Scott Ackerman_sent an email to all users around midnight on Friday night that their accounts had been hacked three weeks earlier on November 17th. \"We recently discovered suspicious activity on TuneCore's servers in November,\" he wrote, \"and that on November 17th an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"593d8c2acfcc631b422450ddd2f51e60504be5cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A9204A4-C6B0-40B5-B1E2-5D9D74FEC7EA"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b37901d8b4d2","org_name":"Trillium Health Centre","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thestar.com/news/canada/2015/03/10/privacy-officer-accused-of-trying-to-block-investigation-into-hospital-breach.html"}],"summary":"Misdelivery of medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"730022b480529161236478827130d3dc99353baf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"331964D3-4D8B-4EB5-BC61-D7A9C25550EF"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4441f9e9697f","org_name":"Town & Country Financial Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lebanonenterprise.com/content/fraudulent-card-transactions-linked-skimming-device"}],"summary":"ATM skimming.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8601258321c610057cf1cebf3aff3116cc19188c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A53AD003-44E2-4B10-90ED-DEACAED9CBE1"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"723578f08db1","org_name":"Tidewater Community College","org_type":"education","ransomware":null,"records_affected":3193,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pilotonline.com/news/local/crime/data-breach-exposes-information-on-more-than-tcc-employees/article_6ab72a2f-52a0-533e-8060-a2d245c7f151.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.13newsnow.com/news/local/employee-data-breach-reported-at-tcc/102256781"}],"summary":"Social Security numbers and other personal information of more than 3,000 current and former Tidewater Community College employees were leaked this month in a phishing scam, officials said Friday.  The data breach happened March 2 when an employee in the finance department respon","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b40b873217f020eaf0abafa6cea8f749072abdb5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07424230-996c-11e7-a8f4-3b6b04fdb9a4"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"deecdcd35ef5","org_name":"The University of Iowa Health Care","org_type":"healthcare","ransomware":null,"records_affected":5300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://whotv.com/2017/07/11/university-of-iowa-health-care-investigating-data-breach/"}],"summary":"Publishing error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4c3a9773318481af9d4f2c9eebe5facbce1cf53","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECC71C88-CB25-4764-8C8D-501BD0C6AF56"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5bc4f952c5d","org_name":"The Painted Turtle","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/03/16/potential-data-breaches-from-breakin-computer-glitch/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Painted%20Turtle_Volunteers%20Notification%20Letter_0.pdf"}],"summary":"Misconfiguration would allow for possible disclosure of individual's data to people identified as a reference on an online application. The reference would also have to submit an application and if both were in 'pending' status they could view either by clicking a 'show related p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b86436ee2dff93381b6176eb2f91b3a6c4479aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82FEBEF8-9097-4C3B-A852-FEFB6B5EFF8C"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"03cd52ece0e0","org_name":"The Medicine Shoppe pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://london.ctvnews.ca/confidential-medical-records-found-abandoned-1.2348801;"},{"fetched_at":null,"title":null,"type":"press","url":"http://london.ctvnews.ca/pharmacy-customer-satisfied-with-response-after-medical-documents-found-discarded-1.2350864"}],"summary":"pharmacy placed PII in recycling bin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25c11670d2df9a6e676bc8e48812287725e31da9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"450F88DC-4B71-492B-9570-727F20AD0C04"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"25a9007d1e35","org_name":"TF1","org_type":"technology_saas","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://monetique.co.uk/french-customers-affected-by-tv-channel-mytf1-databreach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.connexionfrance.com/shoppers-data-hacked-tf1-magazine-subscription-website-16506-view-article.html"}],"summary":"HACKERS have stolen confidential data relating to almost two million online shoppers in France who made purchases via the French TV station website TF1.fr   The broadcaster says one of its third-party shopping tools, which gives TF1 viewers discounts on a range of magazine subscr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"243664f159882a8fe670af6b47eb933fc8f85542","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F24B1E4-A051-43A0-ACBE-CFED7647F7DD"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64863aa73a87","org_name":"Texas Health and Human Services Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/texas-health-human-services-commission-notifies-600-after-contractor-cant-locate-600-records/;"}],"summary":"Iron Mountain lost documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34553c31e0d7277626efc206085e22e63114d1d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2DDCE17-E8DB-4C8D-A3F7-1524B6D0C4E4"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"957b1611662b","org_name":"Texas Department of Family and Protective Services","org_type":"government","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wwlp.com/2014/09/16/computer-security-hole-puts-masses-at-risk/"}],"summary":"Two computer experts have discovered a way for strangers to get your personal information using a security hole that could leave you and your children vulnerable.  Bryan Seely and Ben Caudill say they've discovered one of the biggest potential security holes of the modern era, on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01b4e74711c17808e88ae26a38d856aa434103b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ACE59EE-9898-419B-9AD4-113BC72A5A5E"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"32dbb1569c25","org_name":"Tesco PLC","org_type":"other","ransomware":null,"records_affected":4850000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.yonhapnews.co.kr/national/2015/07/20/70/0301000000AEN20150720009000320F.html"}],"summary":"The chief of a sweepstakes agency has been indicted over selling the personal data of some 4.85 million people and fraudulently changing the winners of giveaways, thus pocketing some 8 billion won (US$6.9 million) in total, the prosecution said Monday.  The indicted chief, surnam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bed1ec82a2110dc63882989eeba41bab6ff93ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41B13F21-5477-455E-BE1F-65A0B4CC15B6"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"6a4550882cf7","org_name":"Telstra Corp Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Aussie-Telco-Telstra-Finds-Breach-at-Newly-Acquired-Data-Center-Service-481761.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?rct=j&sa=t&url=http://www.hacksurfer.com/posts/telstra-suffers-data-breach&ct=ga&cd_EYECoSODk5Njk2NjcyMzI5NDQ4NTEwMhowNjE4OTI4ZTY0YmQyYTE5OmNvbTplbjpVUw&usgQjCNGr2TUrwtzPyd1fWMeJiF-fqA6DZw;"},{"fetched_at":null,"title":null,"type":"press","url":"http://robertjgraham.com/?p=17322"}],"summary":"SQLi led to system compromise, installation of malware and admin credentials acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"836f3558f7fb6be995cc13d97a4fe33f96a45081","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25443487-100C-47B1-9336-9E1C14D1F8EA"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cc60fb876de3","org_name":"Telford & Wrekin Council","org_type":"government","ransomware":null,"records_affected":222,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shropshirestar.com/news/2015/11/12/probe-into-data-breach-at-telford-wrekin-council-as-it-sends-out-222-letters-revealing-personal-details/"}],"summary":"An investigation has been launched after Telford & Wrekin Council admitted sending out more than 200 letters disclosing personal information about other residents.  Telford & Wrekin Council 33 Comments \t \t  The error, which saw 222 incorrectly printed letters sent to homes in the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49bf562ee6bb38f4f800d1d4effa2332bdec27d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A75C2A7A-D4BB-42EB-8770-4779F80779CA"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"6be1cdade5c7","org_name":"Taranaki District Health Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/66275723/plunket-medical-records-found-in-taranaki-house"}],"summary":"Plunket have launched an investigation after medical records were found in a house at the Taranaki Building Removers' yard.  The records were uncovered at the weekend and handed to the Taranaki District Health Board (TDHB).  TDHB quality and risk manager Anne Kemp said the record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f029dc3df7db11c42b2ca380d7295b8f8e01930a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A0C3AA4-FDF0-4703-8D36-40D5A527876C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9d5d552d1e5","org_name":"Tampa International Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tampa-international-airport-infosecurity-breach-spurred-probe/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tbo.com/news/business/tia-computer-breach-fears-spurred-probe-20160423/"}],"summary":"shared his user name and password with 19 people in foreign countries.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83d180f43c9ad9b267fa248937d4e90768008135","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a6b0a830-e9d2-11e9-bcf0-459173902f03"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"ac70a2c31fad","org_name":"Taiwan Ministry of Civil Service","org_type":"government","ransomware":null,"records_affected":243376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.taiwannews.com.tw/en/news/3731444,https://www.spamfighter.com/News-22310-Ministry-of-Civil-Service-of-Taiwan-suffered-from-data-breach.htm,https://www.databreaches.net/taiwans-civil-service-system-reports-data-breach/"}],"summary":"Unknown actions breached civil servant information, then found on criminal forums.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38e05b8cf7c7c5635917e0eb2c3fd6434ad10606","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DA7032B-00CA-4C97-ACAD-2040FECB2FA1"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fab1d4056514","org_name":"Systema Software","org_type":"technology_saas","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gizmodo.in/news/Private-Medical-Data-of-Over-1-5-Million-People-Wound-Up-Exposed-to-Everyone-Online160/articleshow/49007807.cms;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/golden-state-risk-management-authority-notifying-members-of-systema-software-incident/"}],"summary":"Police injury reports, drug tests, detailed doctor visit notes, social security numbers-all were inexplicably unveiled on a public subdomain of Amazon Web Services. Welcome to the next big data breach horrorshow. Instead of hackers, it's old-fashioned neglect that exposed your mo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f1d94bee21ac2a930eac363aabe5150629ba9e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FE8AE1F-F9FF-4A25-B040-9E708BE9BCDD"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3d60dd45945","org_name":"Sun Trust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbtv.com/story/29243112/feds-man-arrested-in-charlotte-for-skimming-part-of-larger-conspiracy"}],"summary":"Federal prosecutors say a Florida man who was arrested in Charlotte for putting skimming machines on ATMs is part of a larger conspiracy.  Prosecutors say Sabin Iantoc is wanted on federal charges in Florida. The maximum he is facing is more than 30 years in prison.  Thursday, Sa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fc34241e4292e0a5002d4c3367b2922d1ebd108","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C6C0B06-91E1-4D8E-A86D-73E575C390F2"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1dd68aa7a3e1","org_name":"SuccessfMatch.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-29912279"}],"summary":"The owner of PositiveSingles was accused of sharing photos and profile details from its site with other dating services, despite promising a \"confidential\" service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcf5b255fdfcab64a7e663cfa66769d847a3962f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09B8D46E-599A-4340-A54F-F003E716AFA5"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"092703d379e0","org_name":"State of Franklin Healthcare","org_type":"healthcare","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/tennessee-healthcare-group-notifies-employees-of-payroll-breach/article/398240/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.johnsoncitypress.com/article/124335/scammers-target-state-of-franklin-healthcare-employees-in-payroll-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcyb.com/news/federal-officials-now-involved-after-data-breach-in-johnson-city/31244024;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.johnsoncitypress.com/article/124335/scammers-target-state-of-franklin-healthcare-employees-in-payroll-breach"}],"summary":"Tennessee-based State of Franklin Healthcare Associates (SoFHA) has notified all employees that their personal information was accessed during a security breach at the company's third party payroll vendor, and some if has already been used to file fraudulent tax returns.  How man","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd96cbaa13fc7bbcd45b3644e9e7433f7576de93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"186810C1-C5E8-4C26-BCA4-B99B192183B1"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"581426055334","org_name":"St. Peter's Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mt-st-peters-hospital-pharmacist-sued-over-medical-privacy-following-alleged-rape/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krtv.com/story/30959291/st-peters-hospital-pharmacist-sued-over-medical-privacy-following-alleged-rape"}],"summary":"A woman who went to St. Peter's Hospital in Helena after an alleged a rape is suing the hospital and a pharmacist, saying they violated her medical privacy.  The woman told authorities last year she was raped by Andrew Stevick back in January 2015.  He's admitted to criminal enda","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"660205a1552cb2138b0b8b98905e7ab8b34b572d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B66EFA91-71CC-4CDF-9418-4C53B5759A4F"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56cc09b22c3e","org_name":"St. Mary's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox59.com/2015/03/08/evansville-hospital-warns-4400-patients-of-hacker-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/03/09/cyber-attack-stolen-patient-records-equal-security-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.courierpress.com/news/local/st-marys-patient-information-compromised-in-email-hack-ep-975545178-324615681.html"}],"summary":"An Evansville hospital has informed about 4,400 patients that hackers may have stolen their personal information during an attack on hospital employees' email accounts.  St. Mary's Medical Center spokesman Randy Capehart says the hackers accessed emails that contained names, date","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d6a792672b28eb09c2e50a0acd92a5fbd634f33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B072C939-BDCA-4932-A8E6-7FF8B6A536B9"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1ffea3bb5d6e","org_name":"St. Jude Medical Inc.","org_type":"manufacturing","ransomware":null,"records_affected":4649,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/former-st-jude-exec-charged-with-theft-of-trade-secrets-cash/327804531/"}],"summary":"A former St. Jude Medical Inc. vice president has been charged with stealing more than $117,000 from the Little Canada company for expenses like basketball tickets and strip clubs and then absconding with sensitive company trade secrets when he was terminated.  Bryan C. Szweda, 3","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e0be65f76a6c895f8aa4a6ae80c6303cca1b1be","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"556BFE6C-9258-49B3-B45B-924FE50F1D77"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5631460dc9bf","org_name":"St. Elizabeth's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":498,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/SEMC/bulletin.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.globalprivacyblog.com/privacy/st-elizabeths-medical-center-pays-218400-to-settle-alleged-hipaa-security-case-stemming-from-use-of-cloud-based-document-sharing-service/"}],"summary":"Employees used cloud storage service to store PHI.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44497c0c3a85eb98ae7b7618e983cd885143d539","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89A98591-DE7B-4029-BBC1-EE15C78D4EB9"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25db71b7206d","org_name":"Springfield Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wdtn.com/investigative-story/hundreds-of-medical-records-found-in-dumpster/"}],"summary":"Paper records in dumpster","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal","personal","secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d4a39d9ba169a99dd150eadc1e2eb5cef76a054","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F2E5318-01C1-458B-BEC9-C71E4464B804"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59e5ef0a856c","org_name":"Southern New Hampshire University","org_type":"education","ransomware":null,"records_affected":140000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/3019278/security/snhu-still-investigating-database-leak-exposing-over-140-000-records.html;"}],"summary":" Southern New Hampshire University (SNHU) says they're still investigating how a database containing some student and class information was exposed to the public. The database was discovered by researcher Chris Vickery shortly before Christmas. flying ace Infosec jobs: 5 Ways to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"601b214ba8701482eb22ba206afc9ad85cdf5197","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B415B46A-E9A6-4B71-A798-ECECB8EE28AF"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"e91daf3ebe05","org_name":"Southern District Health Board","org_type":"healthcare","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressreader.com/new-zealand/the-southland-times/20150302/281483569838911/TextView;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/southland-times/news/66841318/Privacy-breach-victim-slams-Southern-District-Health-Board"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.odt.co.nz/news/dunedin/least-7-privacy-breaches-sdhb"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.odt.co.nz/news/dunedin/363170/least-7-privacy-breaches"}],"summary":"Email sent with confidential patient information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ff2b5470e17665ad7b35592f0af789aaee85091","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a32d0920-869b-11e7-8e76-6d3ed9e599f7"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fd128eb21b9","org_name":"Southern Commercial Bank","org_type":"financial","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmov.com/story/28416679/two-eastern-europeans-accused-of-stealing-tax-refunds"}],"summary":"Eastern European couple sentenced for tax identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ef3bce53d180346c165861d35974585d7e5fc82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03C3F272-E5F1-45A2-A33C-62ACDB07710E"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c80edad63f9a","org_name":"South West Yorkshire Partnership","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/media/action-weve-taken/undertakings/1431795/south-west-yorkshire-nhs-trust-undertaking.pdf"}],"summary":"The Information Commissioner (the 'Commissioner') was informed on 19 July 2013 that the Trust had disclosed a discharge letter relating to one patient to an unrelated third party. On further investigation it was discovered that the two discharge letters both ended up in the same ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8464ecc9c11f060e608c6f7b7c3dac314cdb6a2f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22EB19FE-8949-48E0-9EB3-E0BEE1F1C724"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41d2c3a142e2","org_name":"South Bend Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southbendtribune.com/news/business/data-breach-impacts-south-bend-medical-foundation/article_6fe99934-a54e-5318-b14b-e833bb2adde9.html"}],"summary":"South Bend Medical Foundation is alerting patients about a recent cyberattack.  The data breach affects only those individuals who viewed their laboratory results through \"My Lab Results,\" an external patient network portal offered by NoMoreClipboard, a subsidiary of Medical Info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b698819b9f843de0f3f81f8b90d89afb15b55d03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C42DA1EC-E43F-4D60-AA25-EF055BDDCDFA"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5d9945dea87b","org_name":"Soldiers' Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.orilliapacket.com/2015/05/15/employees-fired-disciplined-after-accessing-patient-records-hospital-says;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/life/health_wellness/2015/05/14/four-hospital-clerks-caught-snooping-in-patient-files.html"}],"summary":"Employees viewed medical records out of curiosity   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2544eb8771fe4e0b6e2c141bf09367a6dcc41ebd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"630b1110-e3a8-11e7-8742-2bc46bd10713"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4ef0b8e32ff","org_name":"Siobhan S. Dunnavant, M.D.","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hhs-ocr-henrico-sen-dunnavants-political-letter-to-patients-broke-health-privacy-rules-but-no-sanctions-needed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.richmond.com/news/local/henrico/article_f67a58a7-e663-572c-95c8-e038fe6467d3.html"}],"summary":"State Sen. Siobhan S. Dunnavant, a Henrico County physician, broke federal health privacy rules by sending a political solicitation to her patients during her 2015 campaign, according to a letter from the U.S. Department of Health and Human Services’ civil rights office.  Dunnava","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"125448f9ca84f45b28665f1fde421a9dbaea5b85","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F40AEF95-01B4-4905-B326-A7A14D5EDCD1"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VN","org_id":"aada6a0c40a0","org_name":"Silverland Hotel","org_type":"other","ransomware":null,"records_affected":6377,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/vietnamese-hotel-leaves-customers-credit-card-data-exposed-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/264-luxury-hotel-leaks-thousands-of-customers-credit-cards-online"}],"summary":"misconfigured database leaking credit card data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2b2d905a4a4131eb08db3af041d688073ddbe38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9C99875-4CE7-4775-A0AD-059462BC865A"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2cac823352d","org_name":"Silverberg Surgical and Medical Group","org_type":"healthcare","ransomware":null,"records_affected":857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Notfication%20Letter%20Template%20-%20Silverberg%20Medical%20Adult%20r1prf_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/document-scanner-error-exposes-phi-of-silverberg-surgical-and-medical-group-patients-8119/"}],"summary":"Silverberg Surgical and Medical Group is alerting patients to the potential exposure of highly sensitive Protected Health Information after an error made in the configuration of a document scanner resulted in patient information being accessible via the internet.  The device had ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54fd9770ef455798f075eba8dd2fc21bde675c89","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26A18F39-3BFB-4E4D-A1F3-F71BDBD56D19"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"289f8a8fc481","org_name":"Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hudsonvalleynewsnetwork.com/2015/11/17/credit-card-skimmer-found-at-newburgh-gas-station/"}],"summary":"Skimmer found on gas pump by employee ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0300609a2029d91a024ad7a097a164a32f11c8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E44CCDCD-30D3-4BAF-AFE9-99A7B24ABE8B"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"5fe6e2e04ebc","org_name":"Serum Institute","org_type":"healthcare","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/denmark-sent-sensitive-health-data-to-chinese-by-mistake/"}],"summary":"Sensitive health information about almost the entire population of Denmark ended up in the wrong hands when a letter by mistake was sent to a Chinese visa office in Copenhagen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b60a396e90278cccc4411036bdc7855a60a8066","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CFEEA22-7865-4EA5-981B-E56F733B85B9"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"9c2f2b361edc","org_name":"Sensis","org_type":"professional_services","ransomware":null,"records_affected":230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/telstra-sensis-leak-hundreds-of-silent-numbers-407359"}],"summary":"Sensis publishes 230 silent numbers online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27d3929cd21d1117edebf46bba8ceba47aa3e596","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A5AEB65-2A7B-4877-9D8C-D757AE060B5F"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7859d3b68f","org_name":"Securus","org_type":"technology_saas","ransomware":null,"records_affected":70000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/database-of-70-million-prisoner-phone-calls-leaked-online-496064.shtml;https://theintercept.com/2015/11/11/securus-hack-prison-phone-company-exposes-thousands-of-calls-lawyers-and-clients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/securus-provides-updates-on-investigation-into-stolen-data-records-300178709.html"}],"summary":"An anonymous hacker has breached the servers of Securus Technologies, a communications provider that logs phone calls made from US prison phones. The hacker has offered some of the stolen data to The Intercept, a website co-founded by Glenn Greenwald, the Pulitzer-winning journal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae540631b95589b84d6f00b8fff59bde60cd7325","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2001DC48-1808-4191-9540-CE40043AB8BF"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4fdb99ee2bc9","org_name":"Sault Area Hospital","org_type":"healthcare","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.saultstar.com/2015/05/06/former-sah-nurse-suspended-for-snooping"}],"summary":"A former nurse at the Sault Area Hospital has pleaded guilty to professional misconduct and has been suspended for three months for snooping into the personal health files of more than 300 patients. Marcella Calvano, 42, pleaded guilty Tuesday at a disciplinary hearing at the Col","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b7d3da7a199efc215b2fd47f24d830f01e53419","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"110777BE-8E74-4344-B65E-6F6ACC638A1F"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4bc17cf65e49","org_name":"Saratoga County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/moroccan-hackers-hack-saratoga-county/"}],"summary":"Moroccan Hackers deface Saratoga County Website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9506dab4dd5d4d4624ee8202f48a84d34daef8dc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD7161BF-4857-4102-A64F-FB23BB695D40"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"73ffc97e6f1c","org_name":"Santander","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/finance/personalfinance/borrowing/mortgages/12014589/We-complained-to-Santander-CEO-of-data-breach-and-were-sent-documents-of-three-other-customers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/we-complained-to-santander-ceo-of-data-breach-and-were-sent-documents-of-three-other-customers/"}],"summary":"documents mailed to wrong person by new employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f265a56545313a8db4631fd67919b7aed56bd6f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9FC622C-FBAC-48A3-8D7E-A40FC8F697D4"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b3abd43d21d","org_name":"Santa Barbara County Public Health Department","org_type":"government","ransomware":null,"records_affected":260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/santa-barbara-public-health-notifying-patients-after-employee-accessed-records-without-authorization/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.noozhawk.com/article/santa_barbara_public_health_employee_accessed_patient_records;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.com/news/2015/dec/02/public-health-warns-records-breach/"}],"summary":"Some 260 patients with records in the Santa Barbara County Public Health Department will receive notification letters explaining that a Health Care Center employee illegally accessed their personal health information.  The department announced the unauthorized data breach Wednesd","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b1eeafeb75164e60dff2020515f4c8cd96d04fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CEA8F81-1A9A-4890-B88D-B1237679B4C3"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cd0c77e9b8c","org_name":"Saint Agnes Health Care Inc.","org_type":"healthcare","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/baltimore/news/2015/04/27/saint-agnes-security-breach-affects-25-000-people.html?ana=twt"}],"summary":"Hackers accessed personal information of about 25,000 patients at Saint Agnes Health Care Inc. The breach resulted from an email phishing incident that targeted employee email accounts to access protected health information.  The Baltimore health system on Monday said it sent let","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"470f2ae2ec6e9465c7ca0b901a6c6c33ce8044d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F03A7455-0C06-4B41-AD3C-010B2D746061"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6697a2893989","org_name":"Sage","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://theantisocialengineer.com/potential-sage-uk-payroll-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-sage-suffers-data-breach-that-may-impact-employees-of-as-many-as-300-companies/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerweekly.com/news/450302518/Sage-data-breach-underlines-insider-threat;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computing.co.uk/ctg/news/2467913/sage-admits-security-breach-of-cloud-computing-systems-affecting-280-companies"}],"summary":"Internal login used to access B2B data; no info provided on whether this was an insider or an external actor that stole or guessed creds.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c934e5aaac287d83953e37c4a02158663ce00456","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78110A30-6C28-4196-A683-EE8C0E7FF6AD"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ccc0ad77d801","org_name":"Safeway Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/12/skimmers-found-at-some-calif-colo-safeways/"}],"summary":"Skimmers found in several grocery stores; CPP was discovery method.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e65f54ff62f79ac9f93c270e6b748314d9292819","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15D95D55-CA4D-4F98-A2D8-669C285341F5"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bc8c7961358c","org_name":"SACE","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-unknown-number-of-students-hit-by-glitch-that-delivered-sace-students-wrong-uni-entry-scores/"}],"summary":"Glitch led to students receiving others' university entrance scores","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aa0462194c1c6b01cdb9a4892b187bb4bcfcb1d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DE43778-BE78-44EE-8D2C-09DB28E01816"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2318c8be4393","org_name":"Royal Navy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breitbart.com/london/2015/05/19/awol-nuclear-security-leak-submariner-surrenders-to-police/;http://www.breitbart.com/london/2015/05/18/time-to-renew-trident-navy-whistleblowers-extraordinary-claims-about-dilapidated-nuclear-deterrent/;http://www.theguardian.com/uk-news/2015/jun/17/trident-whistleblower-william-mcneilly-discharged-from-royal-navy"}],"summary":"Missing submariner Able Seaman William McNeilly has, as promised, returned to the UK after releasing what he claims is a 'dossier' revealing the major security and maintenance lapses of the British nuclear deterrent.  A statement by the Royal Navy released today said: \"We can con","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d33662643dcb764518389853a6f7f349bca9eba1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96703BF5-F7AA-4733-83CE-FC0C4998BB13"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"88b65d819429","org_name":"Rocky Mountain Eye Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://apps.nlrb.gov/link/document.aspx/09031d4581c22761;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/an-unforgiving-nlrb-holds-that-27016/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.workforce.com/blogs/3-the-practical-employer/post/21312-nlrb-judge-strikes-down-termination-based-on-hipaa-violation"}],"summary":"Union employees accessed files with other employees info and give it to the union to contact them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8478548abccf1df98667b9cbd22d48d8511069b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7F0A90E-D25C-4852-9B7F-B1FE3F64BF48"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f4b83c152aa6","org_name":"Richland County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/pro-isis-group-hacks-us-veterans-services-website-in-wisconsin-496840.shtml"}],"summary":"Team System Dz, a hacking crew supporting the ISIS cause, has defaced three websites ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88c96e311f47511c4b64c67250b8023198b1441d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47CC18C3-7731-41B5-BA44-DB6EE70446FA"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a7fe5d409be","org_name":"RFG Services","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/hernandez-715825-police-customer.html"}],"summary":"Misuse of customer data leads to ID theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a25e954874e2d94b2a3a9542543c235823ee090","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD16BE8A-313D-4A7C-A004-F15A74BA3E3E"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8e05a6fbea1","org_name":"Reyes & Barsoum","org_type":"professional_services","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2015/07/01/major-workers-comp-insurers-hacked-legal-files-class-claims.htm"}],"summary":"Berkshire Hathaway Homestate Companies, Cypress Insurance and Zenith Insurance. Other corporate defendants are Broadspire Claims Services and the Knox Ricksen law firm. These organizations hired private investigators who hacked into the law firm to steal over 33,000 records of wo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78efb4d07dee71722cdca5cd2a42142e4caa54dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6E4B61A-CB6E-4A57-BAD8-78F876F215F7"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ecd22195b88","org_name":"Receivable Management Group","org_type":"other","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtoc.com/story/29115028/former-columbus-car-salesman-makes-court-appearance-on-id-theft-charges"}],"summary":"Insider took PII and payment card information for 150 customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7adc97d18787a46d858794196ed790ae7ccd12c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B91F652-EEFA-46E2-8B19-6AA2CF5A113C"},"incident_date":"2015-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e518c40a8b4a","org_name":"RE/MAX Holdings Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/1989075/realtors-security-breach-costs-young-home-buyer-10k/"}],"summary":"Real estate agents' Gmail breached used to pretext client and trick into fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d086d820cd8f5241461b93d884fd624e2027a78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F92873E2-5A01-4656-912F-545EC2A0CF5F"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"80c9987034d7","org_name":"Radiology Regional Center, PA","org_type":"healthcare","ransomware":null,"records_affected":483063,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fl-radiology-regional-center-notifies-patients-after-paper-records-fell-out-of-vendors-truck/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/that-radiology-regional-center-vendors-breach-potentially-affected-almost-half-a-million-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://radiologyregional.com/radiologyregional/index.php?option=com_content&view=article&id=255;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.clinical-innovation.com/topics/imaging/radiology-center-announces-privacy-breach-after-patient-records-fall-out-truck"}],"summary":"Radiology Regional Center, PA, a physician-owned and managed diagnostic facility with nine locations in Florida, announced today that on December 19, 2015, Radiology Regional Center was informed by its records disposal vender (sic), Lee County Solid Waste Division (\"Lee County\"),","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"The DarkOverlord","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fe167205e57c4e2be265b52f9ea72975f76521a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E98F7AB-2787-46A0-ACEA-1C93A1C7D83F"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8b4f3052b5e1","org_name":"Quest Records LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/quest-records-llc-breach-linked-to-thedarkoverlord-hacks-more-entities-investigate-if-theyve-been-hacked/"}],"summary":"data breech of PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thedarkoverlord"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4be9770a358337b9f265834b82805260200fa678","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DB4B9E8-C7AC-4AC9-8C19-F4369FC9BB1E"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f8fecd6c390","org_name":"Quest Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-hundreds-of-personal-medical-records-intended-for-lab-faxed-to-brooklyn-marketing-firm-in-error/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/news/local/Medical-Records-Mix-up-Investigation-Doctor-Privacy-351060331.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47804"}],"summary":"A Brooklyn marketing office was inundated for months by hundreds of private medical documents meant for Quest Diagnostics, but couldn't get anyone at the clinical laboratory services company to take action until she called NBC 4 New York's I-Team. Gabby Klotzman started working f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"551b2f0c9ca0aef0189bed11e6ba809a6b1290c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D08E033-CB62-4652-9450-F6A3F2A98995"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"2b04afdbfdbc","org_name":"Quaid-i-Azam Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pk-patient-data-stolen-from-quaid-i-azam-hospital/"}],"summary":"An employee of the Quaid-i-Azam Hospital stole data from the CT scan machine and according to a supreme court lawyer, the case might be the first of its kind in the country.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":"(@bozkurthackers","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2658502e4739c564fa9287aa8fa50fbb0edeafb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02B07D0D-57AC-4892-9AC9-5154AC896FD3"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"QA","org_id":"6c645380d499","org_name":"Qatar National Bank","org_type":"financial","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenational.ae/business/banking/qatar-national-bank-investigating-alleged-security-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/qatar-national-bank-leak-security-experts-hint-sql-injection-used-database-hack-1557069;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.trendmicro.co.uk/qatar-bank-breach-lifts-the-veil-on-targeted-attack-strategies/#more-520;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/qatar-national-bank-confirms-limited-hack-reassures-customers/"}],"summary":"bank database hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"bozkurthackers"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"849f5c528ba42852e8af6d1df34f834d223c1ee6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEAE4E02-0624-466A-ABA9-E7D18CBE82EF"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"26e36305cd59","org_name":"Prince Albert Parkland Health Region","org_type":"healthcare","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/1800984/privacy-breach-of-patient-records-in-prince-albert-health-region/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.paherald.sk.ca/News/Local/2015-01-29/article-4025507/Employee-fired-after-medical-records-looked-at/1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/saskatoon/saskatchewan-health-worker-loses-job-for-surfing-health-records-1.2936518"}],"summary":"An employee of the Prince Albert Parkland Health Region has been fired after 16 patients had their personal health information breached over the last year.  An employee of the Prince Albert Parkland Health Region has been fired after 16 patients had their personal health informat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c168ceabc534a41939d2ea7a3dd2b05f1d3eec20","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74DD050C-E22A-4CD9-9975-FAA1171BC46C"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cf5633624f8d","org_name":"Prime Medical","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bordermail.com.au/story/3863815/stolen-medical-records-found-flying-around-melbourne-park/?cs=7;"},{"fetched_at":null,"title":null,"type":"press","url":"http://myinforms.com/en/a/31153869-stolen-medical-records-found-flying-around-melbourne-park/"}],"summary":"Medical files belonging to at least a dozen patients have allegedly been stolen from a Melbourne GP clinic and dumped in a park, exposing people's most intimate personal history.  The privacy breach also puts the patients at risk of identity theft because the files included their","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db44ec5c3621d60404e4bb1abc9d5a44c1ba3d7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DC8EBDF-9D0D-4701-92F9-F78A56F3175B"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2facdbfe9323","org_name":"Positive Adjustments","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox13now.com/2015/08/07/medical-documents-filled-with-personal-info-found-filling-dumpster-in-taylorsville/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/positive-adjustments-illegal-dumping-of-medical-records-8063/"}],"summary":" Piles and piles of medical records, court documents and other personal files were found in an open dumpster in Taylorsville on Friday morning, and Saturday a former patient of the business they are believed to have come from spoke about the breach of confidentiality.  \"These doc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1f4db74afbb3ad9e3ef03cd989ab49ec38f0cdd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42486D15-7933-4A8E-9CC1-035F88EA31BC"},"incident_date":"2015-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed154219f3c0","org_name":"Pivotal","org_type":"technology_saas","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fortune.com/2016/03/25/pivotal-phishing-attack/"}],"summary":"Financial phishing scheme leads to disclosure of W-2 information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16cf7437b9d58e357fc766878f33df315caac5a4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9193C770-D9FC-464E-AFE1-E58AB7CBA362"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93f0d17fb73a","org_name":"Pinnacle Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.omaha.com/news/crime/california-teens-arrested-in-nebraska-atm-fraud/article_7f220140-66c0-11e5-befe-f3299b213fac.html"}],"summary":"Five California teenagers who may be part of a national ATM fraud scheme have been arrested in Nebraska, authorities said. The five were arrested Friday and remained in Lancaster County custody Tuesday, Lincoln police spokeswoman Katie Flood said. She didn't know whether they had","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73a5344a72c358890184ed26038cd3f62e916d6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E75C8FE-BD64-4489-9206-F7DDE4B0239E"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb94260f7727","org_name":"PillPack.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/security-advisory-pillpack-com-online-pharmacy/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/security-advisory-pillpack-com-online-pharmacy/"}],"summary":"During the signup process, PillPack.com prompts users for their identifying information. In the end of the signup rocess, the user is shown a list of their existing prescriptions in all other pharmacies in order to make the process of transferring them to PillPack.com easier.Test","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84aff6033fad99090c6fdc40ab2ec71ed77fb04b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04F3D748-A1D4-4260-BC08-83DC752E8621"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3dfe552f9175","org_name":"physcians offices","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-commissioners-investigation-determines-that-faxing-failures-put-sensitive-mental-health-information-at-risk/;"}],"summary":"Three separate breaches of sensitive mental health information have led Nova Scotia's Information and Privacy Commissioner, Catherine Tully, to call for improvements in how the health system transmits personal health information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0603cd29b742e4aa584933395787c08d38e98695","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F524229-EB8B-4EC6-87CF-C8BE64E57849"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3415832907db","org_name":"Phoenix Dental Care","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tennessee-dentist-notifies-patients-of-possible-data-theft-by-employee/;"}],"summary":"former employee printed documents containing patients' personal information from our computer files and removed these documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b1fbc623a93806141f4bd54941a5ca4afc500f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB4D175A-7B0D-41FC-BEB3-22662AC5658A"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2bfee299007","org_name":"Penn State Hershey Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1801,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/penn-state-hershey-medical-center-announces-hipaa-breach-7092/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://lancasteronline.com/news/local/hershey-medical-center-notifies-patients-of-data-breach/article_385c9ea2-edbb-11e3-9730-0017a43b2370.html"}],"summary":"Penn State Hershey Medical Center, in accordance with HIPAA Rules, has issued a breach notice out of an \"abundance of caution\" after an employee copied Protected Health Information (PHI) onto an unencrypted flash drive, took it home, copied it onto his home computer and emailed i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3192c5583652304f8d5ac855ea2ddcc1db6f2d5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6B08A21-282D-4096-80B0-D0E57A1E960D"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b1710e624fb","org_name":"Pediatric Gastroenterology, Hepatology & Nutrition","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/fraud-case-centers-on-alleged-stolen-pediatric-clinic-data-a-9383;"},{"fetched_at":null,"title":null,"type":"press","url":"http://668781195408a83df63a-e48385e382d2e5d17821a5e1d8e4c86b.r51.cf1.rackcdn.com/external/Harris-Indictment-9-6-16.pdf"}],"summary":"A former administrative worker at a Florida-based pediatric practice has been indicted in federal court along with two others for alleged identity theft and fraud crimes involving stolen patient information. But no HIPAA-related criminal charges were filed in the case.  The 23-co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"670e725765a29db40f8ef0c5471051c96c58ae90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F0EDE99-EA4F-421C-89C6-5A70A3B00F2E"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8578a2cf8bb9","org_name":"Peaks and Plains Housing Trust","org_type":"other","ransomware":null,"records_affected":994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.macclesfield-express.co.uk/news/local-news/probe-after-1000-tenants-caught-10399127"}],"summary":"Misdelivery due to use of CC: field","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d84ce98842e2ef11013e62745216a6c9fedb465","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB670FFA-3361-4129-8CF5-B3E0AAAA0F60"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d59e3d9646bf","org_name":"PeaceHealth St. John Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/patient-privacy-violated-following-employee-theft-in-oregon"}],"summary":"A former PeaceHealth St. John Medical Center employee reportedly accessed patient information from a home computer using third-party websites, according to a PeaceHealth statement dated November 24. The individual also used insurance verification websites and prior authorization ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f5987025c8da3d5c23ad27888e89a50f036dd11","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6FDCA7C-4AB7-4569-8D28-5B6CD438F09C"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6079b77902b","org_name":"Patterson Dental","org_type":"other","ransomware":null,"records_affected":22754,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/22000-dental-patients-info-exposed-on-unsecured-eaglesoft-ftp-server/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailydot.com/politics/justin-shafer-fbi-raid/"}],"summary":"Eaglesoft software by Patterson Dental is a popular patient management system.  But just as Justin Shafer had concerns about patient data security in Henry Schein's Dentrix G5 software, he's also had concerns about Eaglesoft, albeit for different reasons. Shafer contacted this si","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e6d22661ebfcddce8cde54b6e42e30367acce54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA5A4AE5-6C53-4369-84C0-70DF716C004C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e50a4a0e7677","org_name":"Parkside Manor","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/snapchat-video-posting-gets-nursing-assistant-fired-8274/"}],"summary":"A nursing assistant from the Parkside Manor assisted-living facility in Kenosha, WI., has been fired for taking a video of a virtually naked 93-year-old Alzheimer's patient and sharing the file on Snapchat.  The latest case involved a video of an Alzheimer's patient who was recor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"724c6ce001256d8d0320332b7970a1a421ededc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E55315D-3947-41A8-82D9-6B41043940B6"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfa7f10be51b","org_name":"Par Mar Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newswatchman.com/news/article_37ddcd26-6516-58e3-8246-001c68a85095.html"}],"summary":"Gas pump skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be5ccbaf6294d326842422efab6fe30ddb8a1f14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C51E6265-F69E-493C-B28B-E132D6608B56"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"367f4ef82a81","org_name":"Palmetto General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.local10.com/news/bso-breath-alcohol-technician-indicted-on-fraud-charges/33151064"}],"summary":"A fourth co-defendant, Marlin Mejia, was an employee of Palmetto General Hospital, where, according to federal prosecutors, she stole patients' personal identification information to further the fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"AU","motive":"financial","name":"Avalanche Network","variety":"unaffiliated"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f936254ab94bdcc60326c761d9f3f379a2ded762","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A564EB84-8047-4CC2-A870-4ED31319D2B8"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"165e2b3792fe","org_name":"PA state prosecutor's office","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/prosecutors_office_paid_ransom_to_regain_access_to_its_computers_internatio/?utm_source=maestro&utm_medium=email&utm_campaign=weekly_email;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/wireStory/feds-business-lost-387500-world-cybercrime-operation-43985864"}],"summary":"The prosecutor's office was hit by ransomware in January 2015 when an employee clicked on a link embedded in phishing email, Zappala said. Phishing is a process computer hackers use to try to get people to unwittingly install malware on their computer by clicking on what appears ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"avalanchenetwork"}},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97c8cf7c8bdd83a0404282cbf62690064fbad3bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F2930EE-A9B8-498D-8DC2-099E77EDA8A0"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"b1a700d73a67","org_name":"P-Two Industries Inc","org_type":"manufacturing","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chinapost.com.tw/taiwan/local/taipei/2016/01/30/457380/MJIB-launches.htm"}],"summary":"confidential information being leaked to a mainland competitor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a76549e13f229d0da9bd7cf2d010fb4a6d5cf5a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC43DD6A-C939-46A8-BFE3-DAB17B82E0D3"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f6ac333923","org_name":"Orlando Health","org_type":"healthcare","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.orlandosentinel.com/business/brinkmann-on-business/os-orlando-health-data-breach-20150702-post.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/orlando-health-reports-data-breach-due-to-illegal-employee-access-affects-3-200-patients.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/orlando-health-notifies-68-after-phi-found-in-neighborhood-driveway-4788/"}],"summary":"Orlando (Fla.) Health is notifying patients of a data breach after discovering a nursing assistant had accessed patient records in a manner unrelated to job responsibilities.  The health system learned of the inappropriate access to information during a May 27 routine patient rec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb8217caca7566385c2a969acb01bda4b91ac8ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DDF6924-F107-477F-A919-C1C8EC93FD6F"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c32f3d32578","org_name":"Orange County School System","org_type":"education","ransomware":null,"records_affected":95,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfloridalegal.com/newsrel.nsf/newsreleases/7120C04994ADCE3385257FF70054FF1A"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/two-more-arrested-in-fraud-scheme-involving-student-identity-information-one-still-at-large/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://myfloridalegal.com/__852562220065EE67.nsf/0/C0F64BD9DF1DC33285257F490053C5B7?Open&Highlight=0,revive,athletics"}],"summary":"Attorney General Pam Bondi's Medicaid Fraud Control Unit and the Cocoa Police Department today announced the arrests of three Brevard County residents, Bobby Lyons, Valerie Jackson and Kwanya Sanders. According to the investigation, the defendants participated in a scheme to defr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23028d52f653c0c37754567f7fa000d176612c5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29D83C84-0225-42EC-BA76-6343CABF8C50"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"852e5439e25a","org_name":"Orange Art of Dentistry","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-hundreds-of-dental-records-found-in-vacant-building/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/building-657641-orange-dental.html"}],"summary":"patient dental records stored in a vacant building owned by the  dentist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49217bbe282708c5c9012410cf6d34c1432de36b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96450F4F-1AC0-4930-9B2D-79D525708A26"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"15fc677b2341","org_name":"Ontario Disability Support Program","org_type":"government","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ourwindsor.ca/news-story/5738406-misdialed-fax-number-led-to-privacy-breach-liberals-say/"}],"summary":"The Liberal government is blaming a misdialed fax machine for a privacy breach affecting hundreds of Ontario Disability Support Program recipients.  \"We have taken steps to ensure that this situation will not occur again and have also arranged for additional staff training on man","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Databoss","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b141b7f48473a68c0b5ea71b7a1a31d877949b09","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E828B7B-B5E1-428F-98D3-ACEF7976CAEF"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"db6654f85d63","org_name":"online forums","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/databases-of-sumotorrent-qtorrent-and-deluge-available-for-sale-on-the-black-market-497967.shtml"}],"summary":"Databoss has managed to crack the forums of those two BitTorrent clients, and is now offering some of their data to other hackers.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"databoss"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebf042ebdb066d86b5a0050bb10cc9dd4920dd41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B6A425B-255B-4B1D-A8E7-83877E822D14"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"b90896256ee9","org_name":"One Stop","org_type":"retail_ecommerce","ransomware":null,"records_affected":58,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.iol.co.za/news/crime-courts/no-jail-for-card-skimming-petrol-attendant-1995719"}],"summary":"Cashier used handheld skimmer to capture payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c74e557c88a117efad4ee9d6230e0388c75df9e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4D668E6-D763-4180-B971-791B4C4B5EE2"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae85a5a54c4a","org_name":"Oklahoma Pain and Rehab","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kfor.com/2015/04/29/medical-records-found-illegally-dumped-outside-metro-clinic/"}],"summary":"Patient medical records are found dumped in a metro dumpster","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36be4d8f33ecea1bcb2f652c8cc644a87b321497","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DED635B4-F7D5-438B-A31E-3153DAFAA318"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"be463d27b8d9","org_name":"Office of Personnel Management","org_type":"government","ransomware":null,"records_affected":48439,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/cybersecurity/2014/12/opm-alerts-feds-second-background-check-breach/101622/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/washington/blog/fedbiz_daily/2014/12/keypoint-suffers-computer-breach-potentially.html"}],"summary":"The Office of Personnel Management is alerting more than 48,000 federal employees their personal information may have been exposed following a breach at KeyPoint Government Solutions, which conducts background investigations of federal employees seeking security clearances.  The ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83d1d04c3ef45b40c9eb1cb0e30932c1e1724ae6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADEFCB61-AF38-4372-A2F9-51D216F9F98A"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1fb2ba90425","org_name":"NYU Langone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nypost.com/2015/04/21/tiger-impersonators-ex-allegedly-lied-to-cops-about-harassment/"}],"summary":"First, Minochy Delanois, 29, pulled her Tiger Woods-impersonator boyfriend through the rough  telling cops he'd harassed her and had even threatened to send nude pics of her to her bosses at NYU Langone Medical Center after she dumped him.  But now, a little more than a year late","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdb53c760777680889219cd32081a48469086cfb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E05F3F9-1AB5-471F-8608-F72C928A42E3"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"4befad00a0cb","org_name":"Northside Psychology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canberratimes.com.au/act-news/canberra-psychology-clinic-accidentally-reveals-clients-personal-details-in-email-20160115-gm6iob.html"}],"summary":"A Canberra psychology clinic has apologised after it accidentally shared personal details of hundreds of patients in a group email.  The incident has triggered an angry response from clients who say the email was a serious breach of privacy and eroded the trust of patients who so","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3365ecad12a3d38c928b283a8c8ced9ec4e6ade","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24A7EA97-2B02-45F8-8F77-77408CFA7119"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"115aa9e6e4a1","org_name":"North Collier Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winknews.com/2016/01/27/cyber-attack-affects-collier-county-hospital-employees/"}],"summary":"Servers compromised, leading to disclosure of employee PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54d98520ea85b781129722b5f84d168ec44bfafd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A703FC6-972F-475F-857C-4CB39A808032"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7910cb3e410a","org_name":"North Church Nursing and Rehabilitation Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://thetelegraph.com/news/86927/woman-sentenced-for-nursing-home-fraud-embezzlement;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wlds.com/news/chaudoin-convicted-in-jax-nursing-home-fraud-case/"}],"summary":"A former nursing home office manager will serve nearly eight months in federal prison and pay restitution of more than $40,000 after stealing from four residents of two homes, one in Jacksonville.  The woman, Kristin Chaudoin, 34, of Decatur, pleaded guilty to embezzlement, use o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"777843c0c7f8905bc4fda7b183ca655e9c58be3e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F83B47B0-E7FF-40FE-83C1-C9CAF9C75624"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b7ccf5767f17","org_name":"Norfolk General Hospital","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/technology/norfolk-general-hospital-hack-1.3504229"}],"summary":"The website of an Ontario hospital may have infected the computers of patients and staff with ransomware planted on the site during a hack attack, the internet security company Malwarebytes warns.  Norfolk General Hospital, located in Simcoe, Ont., confirms its website was hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc5c29a233fdc0a29d393b7cc5158fe9748ed380","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"793BDA32-FA5E-4FB1-BE43-3B0D20C105EA"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21e4e7ae6012","org_name":"NGP VAN","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.usatoday.com/story/news/politics/elections/2016/2015/12/18/bernie-sanders-campaign-disciplined-accessing-clinton-data/77539432/"}],"summary":"Sanders campaign staff leveraged misconfiguration to access Clinton campaign data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6c6c39ad4797eaa3e9ffd14f397538ba9d44c9c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B52163E6-671D-43AB-B4EE-C1C481435A9C"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"3a4fad6d33de","org_name":"NFOrce","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.coindesk.com/bitcointalk-server-compromised/"}],"summary":"ISP was socially engineered to disclose password to bitcoin forum","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab107fb2c4f12eba4c5deb6dd3ddff0874aa4a69","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0584179A-92DC-418F-88B4-49C8CF6A127F"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"852384b339f1","org_name":"NextBus","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://smdp.com/data-breach-involves-big-blue-bus-customers/151000"}],"summary":"Database compromise discloses user credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"612a6dada36c23b5709374e3b6c9378645785912","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAF37CE3-3696-49B1-9281-7F7B90CFA905"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0eb63f3f82c2","org_name":"Newark Police Department","org_type":"government","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/essex/index.ssf/2015/06/newark_cop_and_ex-cop_arrested_for_data_theft_sche.html"}],"summary":"Insider abuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48b697c0e5c7e86c493d74e373fb233c2b89fa48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2A36A7B-DCD8-4997-BEAC-D76803BF51B3"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8586fa9c3f6f","org_name":"New York State Department of Health","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/personal-information-displayed-to-others-on-nys-health-exchange-website/"}],"summary":"The New York State Department of Health is responding to an issue with the state's health exchange website that allowed users to see the private information of other people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4483ee3ff77908fa7e4b03024c8e10eba73eff46","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d6557040-d0bd-11e8-bbbb-67b2993a8980"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1bd9a29e204b","org_name":"Nebraska Department of Administrative Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.prnewswire.com/news-releases/health-fitness-corporation---notice-of-data-privacy-event-300724069.html"}],"summary":"On August 29, 2018, Department of Administrative Services was notified by Health Fitness Corporation (\"HealthFitness\"), a former vendor for the State of Nebraska, that certain records relating to health coaching were being stored on a server that was inadvertently searchable on t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a5b457fb95b94ed4e98dd742ff978b6dfa6bec7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E605FA39-6AA8-45CD-AAE0-5E7486EF5822"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"81014bcddea9","org_name":"myfastlabs","org_type":"healthcare","ransomware":null,"records_affected":170,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nwitimes.com/business/healthcare/dumped-crown-point-medical-lab-leaves-patient-information-exposed/article_76006497-a972-5923-a2a5-3a081bd0eb90.html"}],"summary":" Northwest Indiana residents medical tests, copies of Social Security cards, driver's licenses and health insurance cards, names, addresses, phone numbers, blood types, credit card numbers with expiration dates and security codes all carelessly discarded into a dumpster in the ba","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"709f6b5f4f626174f117f09ea0d0e0eeeec71b5e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E217C8B-E75E-48D2-B5F0-A24C3872363D"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bef9e4b2963e","org_name":"Mt Annan Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytelegraph.com.au/newslocal/macarthur/medical-files-stolen-from-four-medical-facilities-in-the-macarthur-region/story-fngr8h70-1227532739747;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.camdenadvertiser.com.au/story/3365383/police-investigate-medicare-scam-in-macarthur/"}],"summary":"A NUMBER of Macarthur region residents are victims of a Medicare scam that has resulted in suspected identity and monetary theft.  Five medical facilities in Mt Annan, Holsworthy, Campbelltown, Eagle Vale and Harrington Park have had their medical records compromised.  Campbellto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f3b8a2d5b2f0ab3a742c2fc3a178271afe182ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34BADD18-D21C-474E-9249-56371B57A8F6"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"22f2d02a2cd5","org_name":"Mount Sinai Beth Israel Senior Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnewyork.com/investigations/medical-records-trash-Mount-Sinai-Beth-Israel-Senior--371731581.html"}],"summary":"Medical records found in trash.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96efc5f021ba1c80dc73360aeb8de6975e892a24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1881FAF-9A18-4655-AF97-BB78972D5005"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PA","org_id":"6044f68ca70d","org_name":"Mossack Fonseca","org_type":"professional_services","ransomware":null,"records_affected":11500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/the-panama-papers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.msn.com/en-gb/news/world/what-are-the-panama-papers-a-guide-to-the-biggest-data-leak-in-history/ar-BBrkHfL;"},{"fetched_at":null,"title":null,"type":"press","url":"https://panamapapers.icij.org/20160403-panama-papers-global-overview.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://secondnexus.com/politics-and-economics/panama-papers-leak/?utm_content=inf_33_1164_2&tse_id=INF_7bc49692ed184e4a9d3a2cdf638af609;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-3522798/Australian-companies-BHP-Bilton-Wilson-Security-named-Panama-papers-leak-exposing-use-offshore-tax-havens.html;"}],"summary":"Email server hacked leads to massive breach of banking data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77c56d1218a6c548f343d3c6f3194e0cb6bcaac9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B80F5550-296C-4136-ADDA-37FADF6BC9E5"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee97f3a6fd63","org_name":"Mosaic Medical","org_type":"healthcare","ransomware":null,"records_affected":2207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/potential-data-breaches-from-breakin-computer-glitch/"}],"summary":"Mosaic Medical said Thursday it has notified 2,207 patients of a possible breach of protected health information after learning of a break-in earlier this year at a temporary office.  Here's the statement issued Thursday on the event:  On the morning of Thursday, January 15, 2015","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97494457ee48bc4d7f1c4402780a6979cf38a20e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5526DFE-0F44-4190-83AA-04C60749AD18"},"incident_date":"2015-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"23f98ef289a5","org_name":"Moonpig","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/online-cards-company-moonpig-breached-again/article/429841/"}],"summary":"Online card company had customer data posted on Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1093469bca7a9432ad6f784530df043ed91eaef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FA251EA-49AB-46C9-A12B-695A1D9A42DA"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bd97c20282c","org_name":"Mohu","org_type":"retail_ecommerce","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/about-2500-customer-credit-cards-affected-in-mohu-website-breach/article/437357/"}],"summary":"2.5K payment cards compromised from web site","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89770a9390bb074cde4a7af61b9a4d70c8c4eaa2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2bc671a0-6c92-11e7-8419-7d473c8dcba3"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CR","org_id":"d5b12a82681b","org_name":"Ministry of the Environment in Costa Rica","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/costa-rica-government-website-hacked-by-pro-isis-group/"}],"summary":"Costa Rica Government Website Hacked by Pro-ISIS Group","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f78028bd03dce6abe0336ffd672a613939a544ca","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19E37AD1-D337-4266-AB2E-3D35675DE88B"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"f6c368cd7d50","org_name":"Ministry of Home Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.asiaone.com/news/crime/policeman-fined-10000-computer-misuse"}],"summary":"Insider misuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54a270d64385db33b221980e1a9705dac728c867","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26854142-BF0D-4AC7-83C0-1B8C35F641E7"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"3752b85a4392","org_name":"Ministry of Health","org_type":"government","ransomware":null,"records_affected":24092,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11522714;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.3news.co.nz/nznews/investigation-launched-into-ministry-privacy-breach-2015100216"}],"summary":"A Ministry of Health email blunder has spilled private medical information of 24,000 Kiwis.  Officials are investigating how a spreadsheet of National Health Index (NHI) numbers, containing the birth and death dates of 24,092 people, was emailed to around 950 pharmacists yesterda","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edff61c92998c9bf053912d43d9e72babea6351b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b8798b90-1485-11e9-9b0e-db2459a65ffe"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"19f8e68d00be","org_name":"Ministry of Education","org_type":"government","ransomware":null,"records_affected":3400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://hospitalsandprivacyandpolitics.noblogs.org/post/2016/02/08/another-major-privacy-breach-in-b-c/"}],"summary":"This time the education ministry  “lost” “personal information for 3.4 million B.C. and Yukon students and B.C. teachers from 1986 and 2009.   The hard drives included names, addresses, genders, birth dates and education identity numbers, teacher retirement plans, substance abuse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3928845ad9247cdbff51a82d7abd85f04e10b31","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89D5D1EC-6E04-4426-AE21-3495527A43D4"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"857746a124c4","org_name":"Middlesex Hospital","org_type":"healthcare","ransomware":null,"records_affected":946,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/patient-privacy-violated-following-employee-theft-in-oregon;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ct-data-security-breach-at-middlesex-hospital-946-patients-impacted/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.middletownpress.com/general-news/20151208/records-of-946-middlesex-hospital-patients-jeopardized-in-email-scam"}],"summary":"Connecticut-based Middlesex Hospital recently reported that four of its employees had fallen victim to a phishing scam.  The incident was discovered on October 9, 2015, and may affect 946 patients. Information potentially exposed includes names, addresses, dates of birth, medical","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a322482eb567d8ac3b66a739671975af9791bc20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8540A063-E7A6-43A5-8CE8-06A1F03ECFD6"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/3013113/security/microsoft-updates-trust-list-after-private-key-for-xbox-live-leaks.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcmag.com/article2/0,2817,2473228,00.asp"}],"summary":"Private key accidentally leaked to Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51caf0dc03a0ad347f8b59b80354b686ef55462e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1132591C-2971-4E80-B0B6-15C5BB843E38"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4dd3b1270ef0","org_name":"Miami-Dade County Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fl-clinic-owner-patient-broker-arrested-in-insurance-fraud-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.miamisao.com/2015/11/clinic-owner-patient-broker-arrested-in.html"}],"summary":"Insurance fraud against School system self-insurance","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01a452fad9d29b84fbd3ab3a82be251af5a4ba14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6EEADE9-82B5-489B-A352-278F2ED3DA0A"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8786dc79490","org_name":"MetroPCS","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/software-bug-in-metropcs-website-dumps-user-data-in-cleartext-496181.shtml"}],"summary":"Website dumps personal information via forced browsing vulnerability","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e36bfef9d29a4817bfdbda4e229830520969501","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D6CF6A0-F672-47B0-95BD-5D63BA71AB1A"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d29c8fc540c","org_name":"Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmcactionnews5.com/story/29222306/credit-card-stolen-at-doctors-office-suspect-arrested"}],"summary":"checks stolen from purse by nurse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44a1b93766a269c7ae81fcca38b8bf3f019388e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29951776-2357-442C-AB67-E53A45F2C9E0"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa2d8de16563","org_name":"Methodist Healthcare","org_type":"healthcare","ransomware":null,"records_affected":44000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tx-former-methodist-healthcare-employee-sentenced-to-more-than-10-years-stole-patient-info-for-unemployment-benefits/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://woai.iheart.com/articles/local-news-119078/san-antonio-nurse-allegedly-swiped-patient-11848103/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"A former San Antonio nurse, who allegedly stole the social security numbers of patients and used that information to file for unemployment checks, is set to go before a federal judge this week.  Andrea Brooks worked at Methodist Specialty and Transplant hospital during most of 20","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fb2004f16b3d84d7bf6c465fb7d3f4fb4067f53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A83A9CFC-424E-464A-807B-ADBD009B1E68"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"123924a15344","org_name":"Mercer County Department of Labor","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bdtonline.com/news/cole-s-dealership-wants-investigation-into-employee-privacy-breach/article_66e2f4e4-8ce1-11e5-b841-c39538b10a65.html"}],"summary":"Department of Labor released employee PII to newspaper in response to a request for a story","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4f3d2ca77ebb9db346a1c2369cad8a48f30c699","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08EBB221-6308-489D-A8E8-3ED46E587697"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e9277827320d","org_name":"Medvet Laboratories","org_type":"professional_services","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2011-07-18/internet-glitch-leaks-medvet-data/2799442"}],"summary":"Private information involving 800 Australians has been accessible online due to an apparent software glitch at one of Australia's largest DNA testing companies.  Adelaide-based Medvet Laboratories carries out paternity and drug tests and is owned by the South Australian Governmen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca7d2b1d49dfa7e4066ff649c1b3b2d355ac8d15","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29C04095-7771-476A-8C0A-E567D3BCE895"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"059b16ac87f9","org_name":"MedStar Health","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/medstar-health-hit-by-virus-affecting-system/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/local/virus-infects-medstar-health-systems-computers-hospital-officials-say/2016/03/28/480f7d66-f515-11e5-a3ce-f06b5ba21f33_story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2016/03/maryland-hospital-group-hit-by-ransomware/"}],"summary":"Baltimore's Union Memorial Hospital is the epicenter of a malware attack upon its parent organization, MedStar. Data at Union Memorial and other MedStar hospitals in Maryland have been encrypted by ransomware spread across the network, and the operators of the malware are offerin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1890311bbc76005432ed49701456443a07b417a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"bda8ee20-f6c0-11ea-b6fa-6deaa5aa80b0"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4117ee9eeb70","org_name":"Medpro","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf"}],"summary":"Medpro software company accidentally released domain credentials in public repos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"210dbe81c59f78918efc0bcd0fa108622d6204d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60963E5A-BCEE-4EB1-82FA-EC04A64E2DD7"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f082cbfef9be","org_name":"Medical Management LLC","org_type":"healthcare","ransomware":null,"records_affected":9200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/data-breach-at-three-bergen-county-hospitals-involves-thousands-of-patients-1.1340264;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/3-bergen-county-hospitals-reassure-patients-on-data-theft-1.1341257;"},{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/business/businessbriefs/8422234-74/hospital-patients-data;"},{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/business/businessbriefs/8422234-74/hospital-patients-data;"},{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/business/headlines/8376793-74/upmc-patients-stolen;"}],"summary":"insider at finance company steals data from 14 hospitals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8143425b272fb7bd50c9b328e74dd2ceeb0ce4b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9F5F796-8DA0-4072-9004-A83DC745695E"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8697c54ef6f9","org_name":"Mayo Clinic","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.republican-eagle.com/news/3783678-clinic-announces-inappropriate-access-records"}],"summary":"Internal monitoring uncovered employee misusing access to medical data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d049b0eac8cf46c5a73b0dd5a9cde0e72aa140b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A86DC3E-9217-41B4-83A3-9963D7629DDA"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"73f184673737","org_name":"Massey University","org_type":"education","ransomware":null,"records_affected":68,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11493213"}],"summary":"Personal information breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e015911da9f2121206443869e0343e6dbe34c88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FED0031A-CB54-4E9F-A9BA-3C85534D3648"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67b28bf0dbd8","org_name":"Massachusetts General Hospital","org_type":"healthcare","ransomware":null,"records_affected":648,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/email-error-massachusetts-general-hospital-data-breach-8052/"}],"summary":"Email sent to wrong recipient ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87e7701541baa2a3bd2a31956ac0517eebc5a835","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"939E10DE-6CC3-48D8-8887-7A63FCD28038"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1225fa74180","org_name":"Mary Ruth Buchness, MD","org_type":"healthcare","ransomware":null,"records_affected":14910,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ny-dermatologist-notifies-patients-after-email-error-exposes-phi/"}],"summary":"Email misdelivery exposed PII","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b43c41d769e35daf98542a088780c711dd92c895","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"721C9587-5F45-4860-8378-6C92F7319DAA"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1d23ddddc900","org_name":"Manukau District Health Board","org_type":"government","ransomware":null,"records_affected":90,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.3news.co.nz/nznews/private-patient-notes-stolen-from-car-2015060710;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11461049;"},{"fetched_at":null,"title":null,"type":"press","url":"https://cmdhbceoblog.wordpress.com/2015/05/21/a-breach-of-privacy/"}],"summary":"Private medical notes about 90 patients - including details of a woman suffering mental illness after childbirth - were stolen from a social worker's car.  The incident has sparked a warning for health workers to keep patient notes in secure containers.  Counties Manukau District","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2c7df1fa436fb23d46a8830d03c5c6df5a19af9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0669728-61F0-455C-8786-3A75AB36F1AE"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ab5ebbef9cf2","org_name":"Mandarin Hotel PCL","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/press-release-and-notice-regarding-mandarin-oriental-credit-card-breach-300111659.html"}],"summary":"Earlier this year, Mandarin Oriental discovered a malware attack on our credit card systems in a number of our hotels listed below.  In response, we issued a public statement on our website to alert guests to the attack so they could take proactive measures to monitor their credi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"405a13bf8e79db2e816f9f5c43e6c05bb0462fef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DF42B8E-3F42-44E9-842A-6F3E48CF0AE7"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"202aa3b6b3d9","org_name":"Mackenzie Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.citynews.ca/2015/02/18/personal-medical-records-found-strewn-along-street-in-richmond-hill/#__federated=1"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/toronto/medical-records-found-outdoors-in-richmond-hill-1.2962655"}],"summary":"Confidential medical documents have been strewn along a busy street in Richmond Hill for as long as a week, but its not yet clear how the breach occurred.  A CityNews viewer who lives along Major Mackenzie Drive East near Yonge Street says hundreds of documents have been scattere","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da664887a5d4893500461b58b469520348224aea","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9D2F782-A338-4C3C-9A87-8734C7C08B99"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"324fb8af0a75","org_name":"Lynn Talbot Jr, CPA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/to-the-clients-of-lynn-talbott-jr-cpa-cva-300283418.html"}],"summary":"Malware found on accountant firm's workstations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"833e8a98b7f19e45d9332475a6a835d5b6fd09ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48810C37-AB47-4E5D-917D-5FFA30FD4597"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2e1a4a808578","org_name":"Lyell McEwin Hospital","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2015-03-02/patient-seeks-answers-after-confidential-medical-records-leaked/6274944"}],"summary":"SA Health is investigating how confidential medical notes from three Lyell McEwin Hospital patients in Adelaide ended up in someone else's file.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b2e3814a258783a4b76d9970f7e0ca726428fb6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6EF096A-2AB3-4F51-AE81-90FC5B50F374"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09f865a77a77","org_name":"Louisiana Health and Rehabilitation Options","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://theadvocate.com/sports/lsu/13351506-123/former-program-director-for-in-patient;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/crime/baton-rouge/index.ssf/2015/09/rehab_director_baton_rouge_med.html"}],"summary":"The former director of a drug rehab center in Baton Rouge used Medicaid information stolen from patients there to illegally obtain more than 5,800 oxycodone pills, according to an indictment.   After obtaining the drugs, the indictment says, Shanta Barnes then \"enriched herself\" ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"633e28a2f7dac8f6ad584c6fb0ac7e6e4dfed403","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1344B3AA-B53B-4F49-81ED-6F9AF9EFF612"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7a8e8723599","org_name":"Livestream","org_type":"technology_saas","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2015/12/23/10661502/livestream-data-breach-password-reset"}],"summary":"Database breach led to potential disclosure of 300K names and encrypted pw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"650902f0f38c590375cb4decb741a4935674d530","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E49C5E7A-4F3A-461A-91EB-F0431C450457"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"51f081ce6985","org_name":"Liverpool Community Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nursingtimes.net/nursing-practice/specialisms/management/hr-firm-reviews-protocols-after-nhs-staff-data-breach-in-liverpool/5081951.article"}],"summary":"The outsourcing firm Capita has been responsible for a breach of NHS employees' personal data in Liverpool, according to board papers.  The company, which was providing human resources services to nine trusts in Liverpool until last year, mistakenly sent details of staff at other","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6d08b3402149c52a856ef278e9eec3fea73438c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D81B7A83-9927-480A-B163-C857D306C2C7"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13430beeaab1","org_name":"Little Rock dermatology clinic","org_type":"healthcare","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arkansasonline.com/news/2015/jun/04/patients-details-stolen-aide-says-20150/"}],"summary":"A former medical assistant at a Little Rock dermatology clinic admitted Wednesday that she used confidential information in 13 patients' medical files to open fraudulent lines of credit and go on an online Christmas shopping spree at the patients' expense.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0638662662f9a0cb3ce27938c3450e0a5926c75f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B63A2C20-63FB-4210-921D-8FB8544492E2"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1754357df44","org_name":"LifeWatch Services","org_type":"other","ransomware":null,"records_affected":54000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.natlawreview.com/article/when-relators-steal-corporate-documents-northern-district-illinois-dismisses"}],"summary":"Relator as a whistle-blower provided information to lawyer and the government.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d06d836d894702de4551a773053a40b60477d8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A9B4471-474D-400C-9F0B-BB3D79744F4B"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4ea19ccae12","org_name":"LifeHOUSE Vista Healthcare Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcknights.com/news/nursing-home-employee-charged-in-snapchat-video-of-showering-resident/article/459410/"}],"summary":"An employee of a California skilled nursing facility was charged last week for reportedly filming a 90-year old resident as she and another employee helped her into the shower. LaToya Walker and another employee of LifeHOUSE Vista Healthcare Center in Vista, CA, were the subject ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fde315af19a90c78a27796620cb02c49148ce1c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0615CB9-B22C-4EAE-B217-481D74A26C8D"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dd21aa2bdfa2","org_name":"Latham House Medical Practice","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.leicestermercury.co.uk/8203-GP-surgery-apologises-letters-personal-info/story-27991761-detail/story.html"}],"summary":"GP surgery bosses have apologised to parents after letters containing personal information about children were sent to the wrong addresses.  Bosses at the Latham House Medical Practice in Melton have apologised after up to 200 child flu vaccination consent forms were sent out to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17ba3ba475ba768ebe1991e66cc318a751c26cf2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78B3254F-44F4-4325-B8F6-FA41EC417A61"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27ad104f0c35","org_name":"LabCorp","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/local/lake-county-blood-lab-worker-accused-stealing-pati/20247929"}],"summary":"Blood lab worker stole customer's identities and opened up lines of credit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42473e58b5fb285ed93186e1a9712761e483c5b7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77D3F5AF-F9FC-42C4-B4CD-42CA1C552483"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2148d76c6986","org_name":"Kirkland Village","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcall.com/news/local/police/mc-bethlehem-nursing-assistant-stole-dead-womans-bank-card-20150527-story.html"}],"summary":"A former Bethlehem nursing aide charged with stealing a dead resident's bank card was accepted Wednesday into a first-offender program that will allow her to avoid a criminal conviction.  Jennifer Roque, 29, of Bethlehem will see her record expunged provided she completes a year ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70b7546cdce1cc0760c50be743c83d9aac2208b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"559EFC31-4047-4340-AC51-8FBAD527AE29"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad201e5d8968","org_name":"Kindred Transitional Care","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sgvtribune.com/general-news/20150227/nursing-assistant-accused-of-stealing-identities-of-elderly-glendora-nursing-home-guests"}],"summary":"Employee stole debit card and account information from two elderly guests of Kindred Transitional Care in Glendora to purchase items for himself online, including furniture, Nike tennis shoes and car parts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b95df3efc687eee7f717a816df3aa8318974fa9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B278AEB9-98A0-4776-B6E6-28679F13471A"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5925b2e45906","org_name":"Kiewit Energy","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vocm.com/newsarticle.asp?mn=2&id=56691&latest=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegram.com/News/Local/2015-08-14/article-4246661/Privacy-breach-class-action-suit-filed-against-Kiewit/1"}],"summary":"Employees concerned about potential for identity theft St. John's lawyer Bob Buckingham has filed a class-action lawsuit against Kiewit Energy for a privacy breach which happened earlier this year.  According to the statement of claim and an accompanying news release, a laptop co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d000a4284881cdf729825d053543c8b962854645","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D2CE939-62EF-4AFC-B2D6-DCB9851CCA79"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c7a17b0e46f","org_name":"Kankakee Valley REMC","org_type":"energy_utilities","ransomware":null,"records_affected":17700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/in-security-breach-reported-by-kankakee-valley-remc/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/suburbs/post-tribune/news/ct-ptb-remc-computer-breach-st-0217-20160216-story.html"}],"summary":"an internal audit discovered a compromise of employee information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0914243dc46a3f25892a2ee14b84d43e26ea4955","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E93009F1-C3F3-4390-9F07-6750378BDBF1"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8051eb38ac5","org_name":"Jawbone","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercemobilehealthcare.com/story/jawbone-sues-fibit-data-theft-employee-poaching/2015-05-27;"},{"fetched_at":null,"title":null,"type":"press","url":"http://consumerist.com/2015/05/28/clash-of-the-fitness-trackers-jawbone-lawsuit-accuses-fitbit-of-stealing-trade-secrets-other-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2015/05/28/business/dealbook/jawbone-sues-fitbit-over-data-plundering-by-ex-employees.html?smid=tw-nytimestech&seid=auto"}],"summary":"Fitbit is facing a legal battle from competitor Jawbone regarding alleged employee poaching and data theft, according to a New York Times report.                          Jawbone claims Fitbit is \"systematically plundering\" proprietary data by hiring Fitbit staffers who allegedly","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d09ee244a5d40bf9046610996cacc6ab6c3836f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"988A8BE7-1060-4F0E-9692-DFBFA5E03B44"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"37e114566d96","org_name":"Japan Ministry of Health Insurance","org_type":"government","ransomware":null,"records_affected":103000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://sputniknews.com/asia/20151230/1032484617/health-insurance-personal-data-leak-japan.html;http://www.japantoday.com/category/national/view/national-health-insurance-info-on-100000-people-leaked;http://www.japantimes.co.jp/news/2015/12/30/national/national-health-insurance-info-100000-people-leaked/"}],"summary":"National health insurance info on 100,000 people leaked    Lists containing personal information related to around 103,000 people, including public health insurance card numbers, have been leaked, with some of the information sold off in what could be Japan's largest ever case of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a76ff97ea69a9b5016ea5b4366bd00a23c652e41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D53D6571-88F9-4B20-A6DE-0E88FB44BA99"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd75929e9712","org_name":"Jacksonville Sheriff's Office","org_type":"government","ransomware":null,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://legacy.firstcoastnews.com/story/news/crime/2015/06/08/co-sentenced-id-theft-wire-fraud/28703835/"}],"summary":"JSO correctional officer sentenced for identity theft scheme; identity theft & wire fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d825a5c502428c3286ff18be7a86977b80813a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57FD17FB-958D-4855-AA11-A1D9B7957E4D"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"248c03aa618d","org_name":"Isreal Defence Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jpost.com/Israel-News/IDF-soldier-who-leaked-classified-data-to-price-tag-activists-sentenced-to-45-months-in-prison-439474"}],"summary":"Israel Soldier sold secrets ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6724a007c3e165e5fe67b1aa9eb1fea918bba4d0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8033C52-34C6-49F5-97F1-6B35565253CE"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"75f4d523ee54","org_name":"Israeli Defense Forces","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jpost.com/Israel-News/IDF-Chief-of-Staff-ejects-officer-who-left-classified-documents-in-car-438095"}],"summary":"Military officer left classified documents in car, which was stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4665f5a8e80f73cba9321e10bf5c3426645d6b3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76A716F3-0BB3-4EA1-A8A2-A68A7C0A5C3C"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":334000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/blogs/federal-eye/wp/2015/05/26/hackers-stole-personal-information-from-104000-taxpayers-irs-says/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?rct=j&sa=t&url=http://money.cnn.com/2015/05/26/pf/taxes/irs-website-data-hack/&ct=ga&cd=CAEYBSoUMTcwNzY3MDUwMzA2MDI4MzY2NDMyGjUxMmJhZjlkOGE3M2ZjOGY6Y29tOmVuOlVT&usg=AFQjCNF1J0_eO9WWVprRCLnTvPD6HHPYTQ;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdsu.com/politics/irs-believes-data-theft-originated-in-russia/33248584;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/maryland/rockville/rockville-man-indicted-for-identity-theft-and-tax-fraud"}],"summary":"The Internal Revenue Service (IRS) disclosed today that identity thieves abused a feature on the agency's Web site to pull sensitive data on more than 330,000 potential victims as part of a scheme to file fraudulent tax refund requests. The new figure is far larger than the numbe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39a5792622da58b6f0fadede1806ac269c7aaeee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF6A99C8-EDEA-4217-A5B1-23DCFC3E9FDA"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4009d38d5ce6","org_name":"Infowars motion pictures and films","org_type":"technology_saas","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tens-of-thousands-of-infowars-accounts-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/infowars-accounts-hacked-prison-planet-alex-jones"}],"summary":"Inforwars website hacked using a SQL injection exposing 50,000 accounts informations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a72189c1adf8f70f2313236a30308cbca201ac0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E707458E-F9B3-42B9-8718-38D8D13A67F3"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"552e32ef8bce","org_name":"Indian Health Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.redlakenationnews.com/story/2014/10/20/news/ihs-addresses-data-breach-by-contract-physician-at-three-facilities/28071.html"}],"summary":"On August 25, 2014, the Indian Health Service (IHS) Bemidji Area determined that a physician employed by a staffing company under contract with the IHS had improperly accessed protected health information from three IHS facilities. The three facilities affected are the Fort Yates","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01d68a23cd6b3cf31c27dbcd2d5e4166ebaeca63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05159AAB-78DD-4BFE-A258-069AEDAF90DC"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c120b3715d8e","org_name":"Illusion Medical Equipment","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://valleycentral.com/news/local/mcallen-man-charged-with-health-care-fraud-aggravated-identity-theft?id=1246633"}],"summary":"McAllen man charged with health care fraud, aggravated identity theft - Illusion Medical Equipment","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34c1f1488441862b378b13958ce2afcb59903d6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5DC733A-ADC9-4870-AEEE-FAEF8A01405D"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ddd19eff5de","org_name":"Illinois Department of Insurance","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtax.com/news/101101-illinois-department-of-insurance-discloses-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2015/nov/14/illinois-department-of-insurance-discloses-privacy/"}],"summary":"Illinois insurance officials mistakenly allowed the Social Security numbers of an unknown number of health care providers to be posted publicly.  The Illinois Department of Insurance disclosed the privacy breach Friday in a news release. Department officials learned of it Monday ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab3726834526721b6cf6be4467ff0bafef1cb80d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6EC0F01-F791-4BCA-8BE4-AA6D0A22851D"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd03a9e42a7","org_name":"HZone","org_type":"technology_saas","ransomware":null,"records_affected":4926,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/two-apps-with-health-info-found-leaking-researcher-part-2-hzone/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/developer-of-dating-app-for-hiv-positive-singles-threatens-to-give-aids-to-security-researcher-497614.shtml"}],"summary":"Insecured MongoDB exposes database of dating site for HIV+ individuals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2c03c19f6fad7452a04f709e95815b274cd9a63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9A9E091-CC9A-4192-92F9-32282CD06672"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"080700321239","org_name":"Hywel Dda University Health Board","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-wales-south-west-wales-36735065"}],"summary":"Nurse sacked for breaching patient confidentiality  Board chief executive said there was no evidence the nurse did anything other than view the records. The breach was discovered late last year and led to a review by the board","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6add0591bb152533897c453a10fd6f9f66f93a34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8460532-B04A-495B-9E06-1D09C0D771A2"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dff9a0ad6821","org_name":"Hyatt Hotels Corp","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2912891/data-breach/hyatt-resets-gold-passport-account-passwords-after-security-incident.html"}],"summary":"As part of Hyatt Gold Passport's routine monitoring of member account activity, we found a small number of accounts were accessed by an unauthorized individual utilizing member usernames and passwords. We have no reason to believe, at this time, the login information was obtained","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dcd55f97eaaa0e20d15b785d9605d30190d892a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EFA3B2F-B5AE-491E-AA65-8D92ABE94163"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97403944a281","org_name":"Huntington Retina Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huntingtonnews.net/115335"}],"summary":"Teresa Lewis, 60, of South Point, Ohio, was sentenced yesterday to a year and a day in federal prison for defrauding the Huntington Retina Center, where she worked, United States Attorney Booth Goodwin announced. Chief United States District Judge Robert C. Chambers imposed the s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b90064842658a70e863f38113a484fe44bf6fcb7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"228596FF-904C-4220-88AA-6619C9B032EC"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2e6687b797f","org_name":"Hunt Regional Medical Partners Family Practice at Westlake","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/tx-hunt-regional-medical-partners-family-practice-at-westlake-notifies-patients-that-records-were-stolen-from-warehouse/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huntregional.org/sites/www/Uploads/files/HRMP%20Breach%20for%20Web.pdf"}],"summary":"Between January 16-17, 2015, a warehouse storing patient records at Hunt Regional Medical Partners Family The intruders had access to an area that houses the records for Westlake Medical Center patients seen prior to 2010. As a precaution, Hunt Regional Medical Partners will also","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa64afb134b3da79c530d996fe1131b9f386feca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B364EA1-332E-43F7-8D78-DF09EB01EDEF"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"43110478fc36","org_name":"Human Rights Commission","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-reported-privacy-breach-involving-human-rights-commission/"}],"summary":"Privacy Breach Involving Human Rights Commission ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"148b7c280345ea97c1a8098f4a43ff00cbe03008","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99192DA7-AE49-4518-B112-EF320B38A50D"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c591632efdb4","org_name":"Howard Hospital","org_type":"healthcare","ransomware":null,"records_affected":1445,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mailing-error-causes-howard-university-privacy-breach-7021/"}],"summary":"Howard Hospital in Washington D.C has announced a mailing error resulted in letters containing patient names, account numbers and the dates of past visits being sent to the wrong recipients.  In this instance, only a limited amount of data was exposed. No financial information, i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f5c53ff5afb7a92ed0938fd0d18df0e079ad6fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C94FAC81-4E39-4A4A-81CC-98AEC93F2BD0"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0633a67b529f","org_name":"Horizon Blue Cross and Blue Shield of New Jersey","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/nj-horizon-bcbs-notifies-members-that-perps-posing-as-doctors-stole-their-insurance-information/"}],"summary":"Horizon BCBS notifies members that perps posing as doctors stole their insurance information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6af5f2f60a89df4ca974dfb8332dd0c86c4025ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F68E83D2-78C0-4164-B645-59D5C4981B66"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"67ee948aaed6","org_name":"Hopkins Correctional Centre","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/victoria/child-protection-workers-name-revealed-to-sex-offender-in-fresh-privacy-breach-20160727-gqeqjc.html"}],"summary":"Child protection worker's name revealed to sex offender in fresh privacy breach. A child protection worker is fighting the state government for compensation after an official revealed her confidential identity to a jailed sex offender whose case she worked on.  The former worker ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6430063c4175c5a52bf1ddf5b177adf4830f4e1b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0619f490-ded7-11e9-843d-75ce6c835970"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"1c4bbf399a10","org_name":"Hong Kong public library","org_type":"technology_saas","ransomware":null,"records_affected":130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://sg.news.yahoo.com/impatient-former-hong-kong-librarian-004752248.html"}],"summary":"A library employee accessed people's library accounts and cancelled their library cards to force them to return books early so that she could check them out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44c1f8875ce29136c0e2e7d3e9bcd681d46463cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F17F1A86-D5A6-48D6-962E-15A7B00A5B0A"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"ee933ad562b7","org_name":"Hong Kong Examinations and Assessment Authority (HKEAA),","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hongkong.coconuts.co/2016/01/11/hk-exam-agency-member-resigns-after-leaking-results-student-he-had-affair"}],"summary":"professor shared info with his student who he was having an affair with","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3460db652164880ff5cdcb03fc25de261f5b3e8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6850CFEA-DAEA-4B09-95A7-A19D4DC18760"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07d8e4c1b0a3","org_name":"Homebridge","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/california-based-home-care-services-co-notifies-employees-of-data-breach-tax-fraud/article/409006/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SCMagazineHome+%28SC+Magazine%29;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Homebridge%20Data%20Security%20EE%20Notification%20Letter%2013%20April%202015_0.pdf?"}],"summary":"California-based Homebridge, formerly In-Home Supportive Services (IHSS) Consortium, is notifying an undisclosed number of current and former employees that unauthorized access was gained to human resource records, and that the stolen personal information may have been used to fi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bb092410b5efd5d70f0b9448d27d24ad6e08c92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC8E4A1E-41EC-4459-98E4-D8849BB99AAA"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f55225b89d8e","org_name":"Holston Valley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1726,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcyb.com/news/patients-personal-information-found-In-recycling-bin/32647544;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkyt.com/wymt/home/headlines/Health-information-for-more-than-1700-Holston-Valley-Medical-Center-patients-found-in-recycling-bin-301824091.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/holston-valley-medical-center-hipaa-breach-5446/"}],"summary":"Medical records were placed in a recycling dumpster within confined spaces of the hospital by an employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46a36ab73b8cfbf8f8c7857bdaf653ea90acac2e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D908F5B4-6B87-4637-BBA6-20F910FBD07C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a306f240a8c2","org_name":"Hillcrest Care Center","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pe.com/articles/jackson-797050-years-identity.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/riverside-woman-to-be-sentenced-for-fraud-id-theft-of-50-medical-patients/"}],"summary":"Employee misuse of patient data for purposes of ID fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54be0823f920db6c1b593e78f7304cbcf16ed00c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14A54958-3A12-45CA-B19D-F04883BB3FA0"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"7313b23d4166","org_name":"Health Service Executive","org_type":"government","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/news/health/hse-apologises-for-under-6s-data-breach-1.2251307"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hisi.ie/news/view/1598"}],"summary":"The Health Service Executive has apologised for a data protection breach which allowed parents registering their children for the under-6s free GP care scheme to see an application from another person. The breach was reported as required to the Data Protection Commissioner after ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42edf129681c38dd9ca41647816905b7ab302545","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C7351F6-4E0E-4962-A216-3525BD939C5F"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3928f7ff04af","org_name":"Hawai'i Medical Service Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hawaii-medical-service-association-notifying-members-after-mailing-error-exposed-protected-health-information/"}],"summary":"Misdelivery via USPS.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff8cc7cd5c41787fbc48a43af7b8f2ad48b67dc3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C34ACFE-68AE-4CA3-A15D-FD4B36C2C781"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"92526e8d846d","org_name":"Hattiesburg Eye Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.supercoder.com/compliance/hattiesburg-hipaa-breach-caused-by-announcement-letter/"}],"summary":"An optometrist who used a clinic EMR to retrieve names and addresses of patients to send marketing letters has left the practice and prompted an apology letter from the clinic for the HIPAA breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c1e1a6695b3de0c7fe4ab42c705c462f526d696","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E980507E-7ABF-4593-8EF9-B2E4192F1FCD"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3e20b95e6a95","org_name":"Hamilton Children's Aid Society","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-childrens-aid-society-exposes-sensitive-information-to-a-womans-business-partner/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thespec.com/news-story/6231520-cas-discloses-woman-s-personal-information-without-her-consent/"}],"summary":"The Hamilton Children's Aid Society is apologizing to a city woman for mistakenly disclosing confidential information about her to her business partner.  Ayla Smith, 28, says the breach happened after her partner Robert Johnston, with whom she also shares an apartment, requested ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bef202277d23c5faef633ccc86f667379f158a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F02562A-C78B-4D28-853B-94B51D3BA54A"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"056c902109b7","org_name":"GTAgaming.com","org_type":"technology_saas","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gtagaming.com/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/grand-theft-auto-fan-site-hacked"}],"summary":"website hacked for users data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"241a00405f728a8e020c1a1716c7fec5cc516960","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2C3BDE5-7EE9-4CFD-8B51-E0871071458E"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0488335b7366","org_name":"Grey Bruce Health Services","org_type":"healthcare","ransomware":null,"records_affected":246,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-grey-bruce-health-services-fired-employee-who-snooped-in-emr/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kitchener.ctvnews.ca/grey-bruce-health-services-says-patient-records-accessed-inappropriately-1.3054455#;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blackburnnews.com/midwestern-ontario/2016/09/01/computer-medical-records-breached-grey-bruce-health-services/"}],"summary":"Grey Bruce Health Services says an investigation has determined a former employee inappropriately accessed the electronic medical records of 246 patients over a seven year period. The investigation began after four individuals reported concerns about access to personal informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2010bf9b10fb7a137b4f6a2e9cff1680360c3586","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1AAD5B9-6FEB-4382-BFD2-BCADAEB1B58C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8119f4c4707d","org_name":"Green Cross Evaluations","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcsandiego.com/news/local/Pot-Shops-to-Close-After-Owner-Admits-to-Identity-Theft-309584691.html"}],"summary":"A former doctor's guilty plea in federal court Wednesday will lead to the closure of six medical marijuana clinics across San Diego County. Defendant Nelson Leone, 72, of San Diego, pleaded guilty to identity theft for issuing forged recommendations under another doctor's name. A","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd1d575b114038d808c982523a7a50f1ffef5581","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0dd51e00-c965-11e7-93c5-ff5db9c7b572"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d6f38b4ad6c6","org_name":"Greater Manchester Polce","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitalbydefaultnews.co.uk/2017/05/07/greater-manchester-police-fined-for-losing-interview-videos/"}],"summary":"Greater Manchester Police has been fined £150,000 after three DVDs containing footage of interviews with victims of violent or sexual crimes got lost in the post. The force sent the unencrypted DVDs to the Serious Crime Analysis Section (SCAS) of the National Crime Agency by reco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a4b3f8a9fe0354b680083639a971144a9149d7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51A3474C-68F8-4F40-891F-C33C9C8B6A38"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d762fadd6f44","org_name":"Grace Hospital","org_type":"healthcare","ransomware":null,"records_affected":56,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/grace-hospital-pharmacist-inappropriately-accessed-health-information-winnipeg-health-region/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cjob.com/2015/03/17/66255/"}],"summary":"A proactive audit by the Winnipeg Regional Health Authority (WRHA) has identified the personal health information of at least 56 individuals was inappropriately accessed by an employee who at the time was working within the Region.  Following an investigation of the audit results","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"609f9f32a22b66f6b2d56ebb620045f817d6abb5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43c76f90-7c49-11e7-8ec0-e369e9638092"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"8d72fba255f0","org_name":"Gosford Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2017-03-20/nsw-hospital-patients-have-medical-records-compromised/8370584"}],"summary":"NSW hospital patients have had their confidential details compromised on multiple occasions, including medical records being found in a public carpark.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e527e4a975e527d13e6578793730b73912ae3bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"135a4820-c34e-11e9-9e37-df5a0636e02f"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24e5e12aa845","org_name":"Goldman Sachs","org_type":"professional_services","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://economia.icaew.com/news/november-2015/goldman-employee-charged-with-insider-trading"}],"summary":"insider trading based on email monitoring access","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22029b0d6bb9166ef48030687731b8148751b244","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAD45047-FA08-4D4A-AEEE-F506BDB56F47"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"93137503a939","org_name":"GM Financial","org_type":"financial","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/gm-financial-customer-details-inappropriately-accessed-by-ex-employee-1.3177092"}],"summary":"Customer information misused by employee for fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19ba0c1d94c022bfcb16c9946271a72839ad0377","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17182107-AF44-4C3C-B126-3EF605D878C2"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31436c536cf8","org_name":"Glidewell Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Glidewell_Proof%20Copy_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/glidewell-laboratories-reports-breach-of-employee-data-8113/"}],"summary":"Employee PII and banking data compromised via undisclosed method. Language points to it possibly being doen by an employee.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"070b0c994c792056bf8c32f37836ef5c914069c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6BE7EDF-BAA7-40EE-9697-E3C8742A0BE9"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"f179e4d0df85","org_name":"G","org_type":"technology_saas","ransomware":null,"records_affected":43000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/43-million-south-koreans-had-their-medical-information-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreaherald.com/view.php?ud=20150726000368;"},{"fetched_at":null,"title":null,"type":"press","url":"http://english.yonhapnews.co.kr/search1/2603000000.html?cid=AEN20150723008300315"}],"summary":"A company specializing in developing medical fees settlement programs used by hospitals and the Korea Pharmaceutical Information Center _ which distributed free pharmacy management software to nearly half of the country's pharmacies _ were caught having sold a vast amount of data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24baa0b3eb937c318393b9d5332bc16dd89aec3e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"538AA381-41F0-4E7C-ACFF-BB526BC99B60"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14f1848d70e0","org_name":"Fred's Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmcactionnews5.com/story/29825737/protecting-your-payment-card-data-in-the-wake-of-freds-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/06/discount-chain-freds-inc-probes-card-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsj.com/articles/freds-inc-discloses-cybersecurity-breach-1439248912"}],"summary":"Fred's Inc Credit card breach utilizing Track2data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11904bfccb20a1a32515158801559f430cdf43fb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D90BD9FD-A438-4F2A-AE2B-840BE7533278"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"537ef607d5b0","org_name":"Forest Hill Nursing Home","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wqad.com/2015/09/17/workers-want-personnel-records-retrieved-from-shuttered-nursing-home/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wqad.com/2013/11/19/forest-hill-nursing-home-abruptly-closing-workers-want-answers-and-paychecks/"}],"summary":"Some former workers and patients at a shuttered East Moline nursing home are questioning why their personnel and medical records were left behind at the abandoned site, and wondering why the state so far hasn't helped retrieve them.  \"I need them bad, in order to get this fixed a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fda4eff0e211616fc0f5c3f214e9cc481fc14cf9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52EC1D37-2331-452A-9E29-91027FABE9A1"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cac2f26513db","org_name":"Florida Department of Health","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fl-dept-of-health-palm-beach-county-notification-of-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/more-details-emerge-on-florida-dept-of-health-palm-beach-county-breach/"}],"summary":"Florida Department of Health in Palm Beach County is issuing a public notice of an unauthorized disclosure and/or use of protected health information pertaining to more than 1,000 clients of its Health Centers. Federal law enforcement officials informed the department they had ob","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34cd3b403b296e3ff879736a9480ac2fc9ea1969","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97405850-7E11-4279-BA7F-E608C2A2E2EF"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3e42aea8881","org_name":"FirstBank Financial Services Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kdvr.com/2015/09/15/local-first-bank-atms-reportedly-have-skimmers-to-steal-users-information/"}],"summary":"Skimmers found on FirstBank ATMs to steal users' information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"342b7791f3fe770597ba6ef98b63df9ef9f5b023","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AF50B9A-F7BF-424B-B9E6-FCECAA8A4F63"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"f7320c62fc87","org_name":"Finance Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.israelnationalnews.com/News/News.aspx/198513"}],"summary":"The insurance records of millions of Israelis were stolen out of the back of a motor scooter - but there's no need to worry, officials said.  The insurance records of millions of Israelis fell into the wrong hands on Thursday, after disks containing the records were stolen out of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a75a71ed23ed56fb64f027d29dfb974817dac0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85C5F8FD-CD30-4D06-BC49-CC50601F0A52"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f60a83be62e","org_name":"Federal Trade Commission","org_type":"government","ransomware":null,"records_affected":500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"WASHINGTON -- A data broker operation sold payday loan applicants' financial information to scammers, who took in millions of dollars by debiting bank accounts and charging credit cards without authorization, the Federal Trade Commission charged Wednesday.  The data brokers bough","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bed9fb63a748fa5e057094ed1d3238067c4dbc7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44E77A9C-BE93-4C11-8BA1-2A14342ADC46"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6242c8b958e","org_name":"EZ Mart","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://upnorthlive.com/news/local/credit-card-information-stolen-with-skimmer-at-gas-station"}],"summary":"Gas station skimmer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0124d7372f12b563d0acbda5a2bfab8aea02416","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0CC72B0-F53D-423D-A01C-A7F7D3E53CDF"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c0b0bdf95da","org_name":"Eye Institute of Corpus Christi","org_type":"healthcare","ransomware":null,"records_affected":43961,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/eye-institute-of-corpus-christi-notifies-patients-of-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/when-is-a-phi-breach-reported-to-hhs-not-a-breach-of-phi/"}],"summary":"Patient information was copied and provided to doctors previously employed by clinic and used to solicit customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8555f4fe50c4d7b5a9fd0c2ab516771910fc079","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0517CC7-32E5-4AEB-A49D-1B484D8DB230"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eedd5cd40949","org_name":"EWS","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/payroll-company-employee-stole-customer-funds-feds-claim/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stltoday.com/news/local/crime-and-courts/payroll-company-employee-stole-customer-funds-feds-claim/article_74a8843a-452d-5f44-badc-e898e25bb9cb.html;"}],"summary":"Payroll company employees redirect funds to their account","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c34e0b63cf01456807efff603190cf3fc3fe6dca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"180DFE1B-740B-425B-9024-2AB5DD408A24"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"2a36336ada7d","org_name":"European Space Agency","org_type":"government","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itpro.co.uk/security/25742/european-space-agency-hacked-and-details-leaked;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techweekeurope.co.uk/security/european-space-agency-breach-182326"}],"summary":"Anonymous has released thousands of login credentials and other data from the web servers of the European Space Agency (ESA) following a breach of several of the agency's Internet domains; did it just to prove it can be done. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"477cbf326ac3436cd28401b7d8fe1f0cc42e4903","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0D3AE68-4B77-4744-A4D1-FE047A6168B9"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b49a876d2afb","org_name":"Emailmovers","org_type":"professional_services","ransomware":null,"records_affected":2800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/12/15/four_sentenced_to_theft_of_three_million_data_records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazetteherald.co.uk/news/14145344.Four_sentenced_in_North_Yorks_web_fraud_case/"}],"summary":"Nearly three million data records worth tens of thousands of pounds have were stolen by four men from their employer, York Crown Court has heard. The men used millions of \"data lines\" they had fraudulently copied from their employer, Scarborough-based Emailmovers, before leaving ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56118ad856723c2116d9c8bc54cc2dc5270d09dc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6EBC5F3-E6DB-4E10-A62F-00038F601D36"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"34d99c358bf2","org_name":"Economic Freedom Fighters","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.iafrica.com/sa/1000954.html"}],"summary":"Political party office burglarized, documents stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"661ef575d0eef734b480d7ac942c10cb882ee7f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9608C5C-49EB-424C-98F4-51BBC9CB80C5"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"429d06f79ee0","org_name":"Eastern Health","org_type":"healthcare","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-patients-notified-after-insider-breach-at-eastern-health/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darpanmagazine.com/news/national/newfoundland-health-worker-fired-for-privacy-breach-involving-25-patients/"}],"summary":"Clerk fired; six-year-old Nevaeh Denine among Eastern Health patients whose information was accessed With her daughter undergoing chemotherapy treatments for cancer, it's understandable that Holly Denine's heart jumps up in her throat every time her phone rings and a 777 number a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c50831ca75f93a60e47366e590fb7f9c57b8b284","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AD69AF1-0DF9-4218-90D9-7C68616812BA"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8db2ff86de15","org_name":"East Sussex National Health Service","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerweekly.com/news/4500249366/East-Sussex-NHS-data-loss-highlights-insider-threat"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-sussex-33401806"}],"summary":"memory stick lost containing personal data of 3,000 East Sussex NHS Trust patients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd4dbb9ef5c3bb851e320304dbc5490ea649cf6a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9D56149-AEA1-46C7-A202-154155C0F0A0"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ae029886d0a8","org_name":"Easily.co.uk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/uk-netnames-confirms-easily-co-uk-whacked-by-cyber-crims/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/12/11/easily_hacked/"}],"summary":"website hosting business hacked with malware","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58a09dd5c38c007119e55389b83bb563e96b84d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7c215bd0-723b-11eb-b847-53c7fcddcc7a"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"dc85df17900d","org_name":"DXC Technology","org_type":"professional_services","ransomware":null,"records_affected":1200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://securityaffairs.co/wordpress/97571/data-breach/1-2m-cpr-numbers-leak.html"}],"summary":"A glitch in the TastSelv Borger tax service has sent over one million Danish CPR numbers to the US companies Google and Adobe.  The Danish Agency for Development and Simplification has discovered the data leak that involved the TastSelv Borger service, which is managed by the US ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a3107009bd12f60a10fd0bbdaae146fb6309093","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"eea2c910-f0ea-11e9-84f1-e9d602503a96"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2d9bfea0216","org_name":"Dr. Ulrich Klopfer","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/legal-regulatory-issues/thousands-of-medical-records-found-at-shuttered-indiana-clinics.html,https://calendar.in.gov/site/oag/event/ag-curtis-hill-pledges-fetal-remains-will-receive-proper-dignity-and-respect/,https://www.cnn.com/2019/09/21/us/indiana-abortion-doctor-abandoned-records/index.html,https://www.databreaches.net/thousands-of-abandoned-medical-records-found-in-deceased-indiana-doctors-abortion-clinics/"}],"summary":"medical records left in abandoned offices.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"598357d2f5c9dcf7daaac63a47e559b0253c3eaf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99A462AD-52B1-42B8-955D-F27D36677B0E"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"70d064e271b6","org_name":"Dr. Johannes Peil","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/machael-schumacher-medical-records-may-be-laptop-stolen-raid-1490663"}],"summary":"Michael Schumacher's medical records may have been stolen during a burglary at his doctor's office, it is reported.  Confidential files pertaining to the condition of the stricken German Formula One legend may have been on a laptop belonging to Dr Johannes Peil.  His surgery in B","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ce8de3a0b928e737bdb24b1b4c4f7954739dad6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFD74200-62A0-4906-8E97-6E44B226C6EE"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dfe6b4cf3dd4","org_name":"Doctor's Urgent Care Walk-In Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bn9.tpa.bhn.net/content/news/baynews9/news/article.html/content/news/articles/bn9/2016/2/10/private_medical_reco.html"}],"summary":"Closed medical clinic disposed of paper documents in an insecure manner, they were discovered at a landfill.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"449c1938fa2b8da7c39d522069d8afde5bed6857","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF95D3AA-B283-4DB0-BB67-8A068AD86F1A"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c76e5b404dd4","org_name":"Division of Workers' Compensation","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcbayarea.com/investigations/Private-Health-Info-Lost-Law-Provides-No-Recourse-293080441.html"}],"summary":"Even though online hacks and security breaches have become regular headline news, other, more traditional data privacy issues are still a threat. The NBC Bay Area Investigative Unit has found when it comes to workers' compensation, holding companies accountable for information se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af1659c567942388f854b7dea2f937c0693ef792","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76DA3F83-FED3-4F89-97A7-0AFFDF39F622"},"incident_date":"2015-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"6598eee42d16","org_name":"Distrct Health Board","org_type":"nonprofit","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/84415593/former-hawkes-bay-doctor-struck-off-for-duping-dhbs;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nz-former-hawkes-bay-doctor-struck-off-for-duping-dhbs/"}],"summary":"former Hawke's Bay trainee doctor duped two district health boards into revealing confidential medical information about members of his family","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6064238627590e61cbd07deddd097363e1590eeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11AE760F-AABB-4DC6-85DB-76A983DF019C"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"2887db30af82","org_name":"Derry Care Homes for Children","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.derryjournal.com/news/abuse-inquiry-forced-to-apologise-over-privacy-breach-1-6132532"}],"summary":"The body investigating historical claims of abuse at Derry care homes for children has been forced to issue an apology - after an error led to a number of names of witnesses who requested anonymity appearing on the inquiry's official website.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"223c9bbb28d0b1f6a3a72e2fe473b680835f2011","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7E0D1A3C-B735-4F9A-A1E1-710F81443F9C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/a-department-of-veterans-affairs-nurse-convicted-of-falsifying-medical-records-and-computer-fraud/"}],"summary":"A Department of Veterans Affairs Nurse Convicted of Falsifying Medical Records and Computer Fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1050dac478173f52d0c1041a622c0762f95d6ffa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F7CACD4-4A14-475D-9A99-6191D31264B5"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c73f93ec073","org_name":"Department of Human Services Division of Aging Services","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wjbf.com/2015/07/24/georgia-division-of-aging-services-notifies-3000-clients-of-data-breach/"}],"summary":"Georgias Department of Human Services Division of Aging Services has notified approximately 3,000 clients in the Community Care Services Program of an unauthorized disclosure of their protected health information.  The Department has identified the root cause of the issue, which ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e0272c6276c266b0613a0afc8b9945289653602","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CCAB6D6-756F-4CB9-9460-CE6399A2C77B"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cec586e31cc","org_name":"Department of Homeland Security","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/news/powerpost/wp/2016/05/27/41-secret-service-agents-disciplined-after-leaking-gop-congressmans-personnel-file/"}],"summary":"Secret Service agents involved in prying into and leaking information from an old personnel file of a top GOP congressman ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89da3437a0a1d8ce08a02384fad4d7d5b35e1a3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"632B57F0-983D-461F-940E-B0D3D98A9579"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94ea5b01b93b","org_name":"Department of Health Care Services","org_type":"financial","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/state-of-california-mistakenly-posted-14000-social-security-numbers-on-the-internet/"}],"summary":"State officials from the Department of Health Care Services admitted to posting nearly 14,000 Social Security numbers belonging to Medi-Cal providers working for In-Home Supportive Services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6fecd4a16fc288b8968875443237d9c6c2ea892","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D742FB7-ABF6-409D-9BB1-1CF1C84B41FC"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae667f951e12","org_name":"Department of Health and Environmental Control","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.postandcourier.com/article/20150911/PC16/150919818/drug-tester-pharmacist-deny-wrongdoing-in-alleged-prescription-records-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.propublica.org/documents/item/2640422-South-Carolina-indictments.html"}],"summary":"A Charleston drug screener and a Hollywood pharmacist pleaded not guilty Friday to conspiring to harvest confidential patient prescription records from a state database so attorneys could use them in Family Court cases.  The indictments against drug tester Robert Bennett and phar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9934cc961e74a3215b5c283ba7410989b91a575","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40A30166-0DE5-4BB6-B5B0-8D064A3F7178"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"94f8d2ebd0c4","org_name":"Department of Health and Community Services","org_type":"government","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vocm.com/newsarticle.asp?mn=2&id=55948&latest=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/privacy-breach-reported-over-prescription-drug-program-1.3146260"}],"summary":"Newfoundland and Labrador's health department is reporting a privacy breach involving six individuals who avail of the prescription drug program.  Of the 21,000 letters sent to beneficiaries on June 29, six people were sent letters intended for someone else.  In a news release, t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Guccifer 2.0","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3da2bd7400c65870cd9dba22a17d47d7987877d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E17954F-79AD-4318-9C28-79011D3A5612"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5b2dc381552","org_name":"Democratic National Committee","org_type":"nonprofit","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.politico.com/story/2016/08/democratic-donors-identity-theft-cyberhack-227140;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wikileaks-misstep-leaks-thousands-of-dnc-emails-some-containing-personal-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wikileaks-posts-nearly-20000-hacked-dnc-emails-online/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.amestrib.com/news/wikileaks-posts-nearly-20000-hacked-dnc-emails-online"}],"summary":"DNC hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"guccifer20"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6e8f06373f2c0f32b253691fc8dde9c9c621143","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE2357B2-B5DC-4343-9407-CF8A85E9423B"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30e23617fd9e","org_name":"Davis Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/news/local/medical-records-abandoned-more-30-years-statesvill/nk2pZ/"}],"summary":"Channel 9 News investigated hundreds of medical records abandoned inside a vacant hospital. Those documents found inside the old Davis Hospital in Statesville contained Social Security numbers, names, and even the dates that patients were born.  The pictures given to Channel 9 sh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5310ce345e96518c5ff8ba32ab7b3847246b7adb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24DE6FC9-4111-4859-85E6-C1322DE862D8"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04bfca9e4f32","org_name":"Dallas County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/dallas-county-officials-have-been-exposing-user-details-for-over-a-decade-496974.shtml"}],"summary":"Dallas County posted personal information on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba949320ed26bfd55ae612fb3ec436974f86a47d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04c9c2b0-eaae-11e7-92b6-dfe49f9d7042"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"28955ec10775","org_name":"Cygnet Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://en.brinkwire.com/6406/office-worker-hacked-computer-to-see-colleagues-salaries/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-5131937/Office-worker-hacked-computer-colleagues-salaries.html"}],"summary":"An embittered office worker hacked the leading private hospital where she worked so she could find out her colleagues' wages.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5a4581c83bc742667619a47c85b88bdd4886626","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E1CBE78-9EED-4D73-9779-F6B575481267"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d7cf674c5dae","org_name":"Crown Prosecution Service","org_type":"government","ransomware":null,"records_affected":43,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mcphersonsentinel.com/article/ZZ/20151104/NEWS/311049957;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/law/2015/nov/04/cps-fined-over-theft-of-laptops-holding-interviews-with-sex-attack-victims;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computing.co.uk/ctg/news/2433525/crown-prosecution-service-fined-gbp200-000-for-losing-unencrypted-laptops-holding-video-interviews-with-victims"}],"summary":"Britain's Information Commissioner's Office has fined the national Crown Prosecution Service 200,000 pounds ($308,000) for negligence in failing to ensure the security of laptops containing police interviews of victims and witnesses \" some in historic abuse allegations. The ICO s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"856a4fecd7581dd4bc9121cb3949ad56a0107ea0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24FCFCA0-D1AF-4DBA-AD76-52A6710C0648"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c0aaf0bd958a","org_name":"Credit Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mississauga.com/news-story/6716849-patient-privacy-breached-at-credit-valley-hospital-after-health-records-improperly-accessed-/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://myinforms.com/en-ca/a/36644268-comissioner-investigates-privacy-breach-involving-patients-records-at-credit-valley-hospital/"}],"summary":"Ontario's Privacy Commissioner is investigating a privacy breach at Credit Valley Hospital after the personal health records of five patients were \"improperly accessed\" by an employee at a nearby medical building.  One of the complainants, who asked not to be identified, said the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf2b5430f0d7e89ccb05a6a7078e2236ccf76a04","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50AECCDD-CD69-4818-89D6-91CBD28A95EC"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e468da9514ca","org_name":"County-USC Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiego6.com/news/state-news/Pencil-stabbing-photo-leaked-hospital-staff-info-301922701.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mynewsla.com/crime/2016/01/27/suicidal-woman-who-stuck-pencils-in-her-eyes-settles-part-of-suit-over-internet-photo/"}],"summary":"A hospital patient who stuck pencils in her eyes in a suicide attempt, then found out that a photo of her self-mutilation turned up on the Internet three years later, has agreed to settle the part of her lawsuit against Los Angeles County and one of its nurses, her attorney said ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f380ee7598400c7c98d4de632458aa2887c8f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26F99CDB-01D2-4EC6-9064-590222559097"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"117add25656c","org_name":"Countess of Chester Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chesterfirst.co.uk/news/145881/nurse-banned-for-confidentiality-breach.aspx"}],"summary":"A FORMER sexual health adviser at the Countess of Chester Hospital has been suspended from nursing after he disclosed details of a patient's illness to a third party.    Mark Henry Newman, 54, formerly of Acorn Court, Upton, has been suspended for nine months by the Nursing and M","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"426448b4fb772a20df7e9c1ce8db7c64363ae91c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFFBA21F-02FD-4614-A2AB-481AD8E24E49"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"231db946f4aa","org_name":"Corner Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/news/ci_28751479/aurora-police-find-atm-skimming-device-at-corner"}],"summary":"Aurora police found a skimmer device intended to steal banking information on an ATM located at a Corner Store location, officials said.  The ATM was at the store at 2601 South Tower Road and was removed Aug. 18, according to a Thursday news release from the Aurora Police Departm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eca48b1f09e4e6d7be9163b28f0a0dbbff160e9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"427574A4-98D4-4255-ACDF-E0D80A4B03A4"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"044bc9f7e18c","org_name":"Consolidated Tribal Health Project","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/consolidated-tribal-health-project-inc-notifies-employees-and-patients-of-a-data-security-compromise-300085168.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CTHP%20Exhibits_0.pdf"}],"summary":"Consolidated Tribal Health Project, Inc. (\"CTHP\") has become aware of a data security event involving unauthorized access by a former employee to certain CTHP systems and information maintained by CTHP.  CTHP has been working to understand the nature and scope of the incident, an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5491eb0702ad6419b6d19baa091bc74ba9ac265b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2525B3E6-C76F-4736-A52F-00017BD0A3F7"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0621aa3498a9","org_name":"Complete Family Foot Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://journalstar.com/business/local/local-health-provider-warns-of-possible-data-breach/article_08776611-402b-5c05-b722-fc820b7f4898.html"}],"summary":"A Lincoln medical practice is warning that some patients may have had personal and financial information exposed to hackers.  Complete Family Foot Care at 1001 S. 70th St., Suite 105, said Wednesday that a contractor it uses for the management and online storage of electronic hea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32aa327c97769e6fba6ded3dd2871bcd0d0950d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCB11714-0DDE-4862-BBD9-E163B51CE78C"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"428a0e7e99dc","org_name":"Compass group USA","org_type":"other","ransomware":null,"records_affected":70000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Compass_Proof%20Copy%20Media%20Notice_0.pdf?;http://news.softpedia.com/news/Compromised-PoS-Systems-at-Compass-Group-Expose-Payment-Info-479842.shtml;http://compass-usa.com/Documents/CustomerFAQ.pdf"}],"summary":"Self-serve kiosks installed at three Compass Group locations in the US have been compromised, putting at risk payment card information of customers.  Compass Group is a food service management company that serves about 8 million meals on a daily basis, through vending machines in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1da5ff463d32e5230ebd3564457450982cc5174b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71D4E39E-67B2-4ECA-9F20-CBEE8A63C666"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9e6b1ee8520","org_name":"Community Mercy Health Partners","org_type":"healthcare","ransomware":null,"records_affected":113528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.springfieldnewssun.com/news/news/local/community-mercy-alerting-patients-to-data-breach/nk3MK/#__federated=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-more-details-emerge-about-patient-records-found-at-recycling-center/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.daytondailynews.com/news/news/local/private-patient-records-found-dumped-in-springfiel/npgz5/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-community-mercy-health-partners-notifies-patients-after-vendor-improperly-discarded-patient-records/"}],"summary":"There's an update to the update below. The incident was reported to HHS as impacting Community 113,528 patients' records.  Original post:  There's an update to a breach reported previously on this site. From a statement on their site:  Community Mercy Health Partners (CMHP) and i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"018329453cc4f184b7655e52ee6fe04c699106c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3A5ECA0-A6D4-49F2-8769-D6DD17A83173"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2553bf373783","org_name":"Comcast Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bgr.com/2015/11/06/comcast-data-caps-network-congestion/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/comcast-to-pay-25-95-million-to-settle-charges-over-hazardous-waste-disposal-and-privacy-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Comcast-Employee-Helps-Identity-Theft-Ring-Collect-New-Customer-Signing-Bonuses-479835.shtml;http://wkrn.com/2015/04/29/tenn-woman-arrested-10-wanted-in-1-2m-identity-theft-scheme/;http://www.myfoxal.com/story/28946574/former-comcast-employee-charged-with-leaking-customer-info"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/comcast-customer-list-found-for-sale-online-company-resets-passwords-for-200-000-users-495905.shtml"}],"summary":"Comcast employee leaks documents about rate cap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edf6fb536dbcbe78d7922d1a394ddbffd05d1136","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39767ACD-8B46-4984-A59D-8EA4A4011A3D"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85290e06e6f8","org_name":"Colorado Medicaid","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/colorado-nurse-who-defrauded-medicaid-using-medically-fragile-childrens-claims-sentenced-to-probation/"}],"summary":"Medicaid fraud can pose risks to the patients, particularly when the patients are not well enough or old enough to check any explanation of benefits statements for themselves. In this case, an adoptive/foster mother used medically fragile children's information to defraud Medicai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"584e0241e2eefb129d2d6f9043c2d2a1b1ac7c7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCEBACC5-91DA-456F-97F6-E239FC89A61B"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7714e666f93a","org_name":"Cleveland Health Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.brownsvilleherald.com/news/valley/article_3cfceada-6360-11e6-b2df-0b79b4c3b7e5.html"}],"summary":"Man falsely claiming to be an LVN using a stolen identity","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f1edfec58a645cc84bad2097963f420e8d65afc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63DFF062-D800-4917-B6B3-C8F0B02D511D"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c03b8b9ffab","org_name":"Claridge House Nursing and Rehabilitation Center","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfloridalegal.com/newsrel.nsf/newsreleases/1489C9AF85E50DDD85258019005D1C32"}],"summary":"Attorney General Pam Bondi's Medicaid Fraud Control Unit and the Miami-Dade County Police Department today arrested a former nursing home employee for exploitation of the elderly and disabled. Haymee Hernandez, 49, is a former employee at Claridge House Nursing and Rehabilitation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71e9ebf995516d2f471549a6c9498cc96af6f411","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CE4E7D4-B52A-44F9-8EC0-3FB1ADC14EFB"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"67a46046231d","org_name":"City of Taipei","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.taipeitimes.com/News/taiwan/archives/2015/04/23/2003616595"}],"summary":"A large amount of information was leaked in a hacking breach of Taipei city computers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"936d580ae46d3318f3b1b9862ea6956608d237bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9958FCC-949B-42F4-874B-75515AD7B015"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"51341a5834b9","org_name":"City of Sakai","org_type":"government","ransomware":null,"records_affected":680000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantoday.com/category/crime/view/data-on-sakais-680000-voters-in-2011-election-leaked-online;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ajw.asahi.com/article/views/editorial/AJ201512220019;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/jp-data-on-sakais-680000-voters-in-2011-election-leaked-online/"}],"summary":"The municipal government of Sakai in Osaka Prefecture said Monday personal information on all the around 680,000 voters in the 2011 Osaka gubernatorial election had been leaked on the Internet, as an employee had handled the data inappropriately. The city fired the 59-year-old ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c6d2c761055f23b03b6f9a655519a9ea2727f53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B07A5C8E-545A-4060-8B32-6B43F05D66E1"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f1ed1fd594f3","org_name":"City of Oshawa","org_type":"government","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"machine malfunctions and double stuffs envelopes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb7298683a5ba9595f80afb243f805c2e97c2422","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1BDD0AC-49B1-44AA-AC17-939F7D24950A"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fea97dba95c","org_name":"Citizens Independent Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.americanbanker.com/news/community-banking/director-at-citizens-in-ohio-resigns-over-email-server-dispute-1090971-1.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ooyuz.com/geturl?aid=12922072"}],"summary":"Board member used unsecure Email server to send confidential customer information to other board members","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e88daf3cb315dbab8e73aa5c7ae7c4bebd5cfa01","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85F21223-5195-4A7C-9EC6-826D19C7CE52"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06df8ca50f7e","org_name":"Children's Medical Clinics","org_type":"healthcare","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/employee-theft-results-in-phi-data-breach-for-16k-children;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/16k-childrens-medical-records-potentially-stolen-in-east-texas-8178/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.childrensmedicalclinics.net/files/hipaa-breach-notice-letter.pdf"}],"summary":"An investigation conducted by Children's Medical Clinics of East Texas has revealed a former employee took copies of children's medical records and disclosed them to a third party. According to the breach report posted on the healthcare provider's website, the privacy breach was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f61a637feef86315fc8e64f511368956b41db50","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F070A514-CEA9-4F3C-A181-A82BAA23E24B"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9fae97918c47","org_name":"Chelsea and Westminster Hospital NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":781,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.v3.co.uk/v3-uk/news/2457358/london-nhs-trust-fined-gbp180-000-after-distressing-hiv-email-error"}],"summary":"exposed the email addresses of 780 HIV patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2345499d25055be2d8c06fe09679d8671f6c687","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BD9A9CA-CB27-4D97-A6CD-2951776FCC4E"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb27655151f","org_name":"charter schools defunked","org_type":"education","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wesh.com/news/people-trying-to-avoid-identity-theft-after-sensitive-documents-left-in-dumpster/38846566;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/fl-former-charter-school-employees-trying-to-avoid-identity-theft-after-sensitive-documents-left-in-dumpster/"}],"summary":"documents found","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fa33edd486e93b2903be3a209ac250adae4bab1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3516B42A-2159-4CF5-BC97-DBDA32DB1DD2"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95939efb8cee","org_name":"Charlotte-Mecklenburg Schools","org_type":"other","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/news/local/education/article35300451.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcnc.com/story/news/education/2015/09/15/cms-notifies-applicants-of-personal-data-breach/72314594/"}],"summary":"School system breached policy by sharing PII with contractor for 7K job applicants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a84bd326a2739035f2f15d346c6237c7bf063678","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B843EC0D-BF51-44AF-A75F-D4C3152DADE3"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"649588bb0ee2","org_name":"Central Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/privacy-breach-patient-lab-results-faxed-to-business-owner-not-doctor-1.3069254"}],"summary":"Misdelivery of fax","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5ebff8a28e322dd96c82e7e5ad7698e84348165","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F66101B-9C7A-440A-953B-0DF471C9F446"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f4d651336b2a","org_name":"Centene Corporation","org_type":"financial","ransomware":null,"records_affected":950000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/centene-discloses-missing-hard-drives-contain-personal-information-of-950000-people/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/centene-healthcare-data-breach-affects-950k-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://savannahnow.com/news/2016-02-03/data-breach-affects-thousands-georgia-medicaid-peachcare#"}],"summary":"Centene Announces Internal Search of Information Technology Assets  ST. LOUIS, Jan. 25, 2016  Today, Centene announced an ongoing comprehensive internal search for six hard drives that are unaccounted for in its inventory of information technology (IT) assets.  \"Centene takes the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a7592e880bafb93425aff546740b50a7237498e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0601CD9F-A16A-4468-8D86-C7E548640374"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"41a6f315912e","org_name":"CBHS Health Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/news/attackers-exploiting-cba-health-fund-data-breach-439154"}],"summary":"The not-for-profit health fund that services Commonwealth Bank staff is warning customers not to click on dodgy emails after attackers stole customer data from one of its third-party partners.  The affected data is \"primarily corporate marketing information\", CBHS said in the ema","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"707380f3d2ec915c1c5ad7ede9232add2c715ed8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B572E3A-4CAE-4E16-8080-DBC080ACF1F7"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d3264b4a04a0","org_name":"Carphone Warehouse","org_type":"retail_ecommerce","ransomware":null,"records_affected":2500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/08/08/carphone_warehouse_data_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/carphone-warehouse-coughs-to-mega-data-breach-hitting-up-to-2-4-meellion-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gagfacts.com/customers-personal-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.grantmcgregor.co.uk/2015/carphone-warehouse/"}],"summary":"Carphone Warehouse has taken three days to go public about a serious data breach affecting nearly 2.5 million customers __ with the confession that up to 90,000 subscribers may have had their credit card info ransacked.  The company said on Saturday afternoon that it had first di","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be198a9b1633d5c06fa8cd79414a09c575550877","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC569095-D812-409B-B58B-85E880C667BE"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff5b3e633273","org_name":"Carilion Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/mass-violations-of-patient-privacy-at-virginia-clinic-8074/"}],"summary":"After performing its access log analysis, Carilion discovered that fourteen individuals had snooped on a patient's records, which is against hospital policy and HIPAA rules.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d875bedf67c051b42eabd8fb2d468124ac0d1e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"753DC6D0-FB3B-45C0-94A1-93146C007611"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7cf98698d24f","org_name":"Cambridgeshire County Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bigbrotherwatch.org.uk/media-and-press/cambridge-news-county-councils-data-breach-shockers-care-papers-dumped-in-bin-and-personal-info-leaked-to-public/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cambridge-news.co.uk/county-council-s-data-breach-shockers-care-papers/story-29261360-detail/story.html"}],"summary":"Elderly care papers held by an agency were found dumped in a bin as part of a shocking series of data breaches by Cambridgeshire County Council, the News can reveal.  A report released by anti-surveillance group Big Brother Watch reveals that between April 2011 and April 2014, th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7042d3eeb2e20f44ca520d38e20a00e8598879a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BBAFB6E-2DBD-459B-B683-8EED92FBE5E8"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a80e4ab67b39","org_name":"California Hospice Care (CHC)","org_type":"healthcare","ransomware":null,"records_affected":79,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pasadena-doctor-sentenced-to-4-years-in-prison-for-falsely-certifying-patients-were-terminally-ill-as-part-of-healthcare-fraud-scheme/"}],"summary":"doctors misused patients data to commit fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f45dc155565bccf11ae6d3c5bd7814095d4c847","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90FC13E4-2DCF-4451-B00A-17E90A5E5F2C"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"7414e51d8554","org_name":"Bundeswehr","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thelocal.de/20150707/german-missiles-taken-over-by-hackers"}],"summary":"'Hackers' gained control over German missile battery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93c2a3efd130629eca64f73f51261d89437794ee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB547ECD-D17A-4EA0-9D14-87F432D09153"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d4a3a6bb472d","org_name":"British Columbia Coroners Service","org_type":"healthcare","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theglobeandmail.com/news/british-columbia/coroners-lost-camera-raises-privacy-fears-of-deceased-individuals-in-bc/article25051753/"}],"summary":"The British Columbia Coroners Service says a camera containing photos of a dozen deceased individuals has not been recovered after a coroner forgot it at a Lower Mainland bus stop.  But the Coroners Service says it does not believe the photos have appeared online or anywhere else","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbeb19dcd93742d5c1203f4b3739a02fcf77ad5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C600AF0-F4D2-4482-AB0F-6C965A2EDB15"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ee0b485e8ee","org_name":"Brigham and Women's Hospital","org_type":"healthcare","ransomware":null,"records_affected":1009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/compromised-email-account-exposed-patient-info-from-brigham-and-womens-and-brigham-and-womens-faulkner-hospitals/"}],"summary":"Phishing attack leads to compromised of web-based email credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c0542536a91bc3d3da13a532cef7abe147f2384","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97DDB8CB-67CF-4D14-9F1B-C055FD92A5AE"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5508dfcb8156","org_name":"BP PLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/story/news/local/2015/09/10/skimming-device-found-st-pete-gas-station/72019044/"}],"summary":"Gas pump skimmer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0123716a9da06ac9f52633e47e2dcf93c2bc6aa3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5C8A6A2-319C-4232-BB2F-34AA98308E79"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27f16a4432ba","org_name":"Bothwell Bracker's","org_type":"professional_services","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/paid_650k_in_bonuses_2_tort_lawyers_formed_new_firm_left_name_partner_in_em/?utm_source=maestro&utm_medium=email&utm_campaign=weekly_email&job_id=150716BE#A"}],"summary":"Lawyers stealing clients for new business","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61d042859eb632e537fddb896b706cd620f0d47c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8444DB7-5E67-4F26-8A26-E1F857DC7AE1"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a540fbf19f4","org_name":"Boston Transporation Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/boston-authorities-exposed-sensitive-data-from-automatic-license-plate-readers-491267.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.roadandtrack.com/new-cars/car-technology/news/a26641/boston-license-plate-database-no-password/"}],"summary":"Boston Authorities Exposed Sensitive Data from Automatic License Plate Readers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4584806a75885a7dbf55e5da6c70442a02c2be17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB7D29FB-8188-4F59-AA10-2B58A9138EF7"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da24383c7dff","org_name":"Bluegrass Pharmacy of Lexington LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/former-pharmacy-owner-sentenced-to-prison-for-stealing-from-charity/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentucky.com/news/state/article53823565.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentucky.com/news/local/counties/fayette-county/article91763777.html"}],"summary":"A former Lexington pharmacy owner stole more than $1 million from a charity through fraudulent requests for assistance with patients' medication costs, a federal grand jury charged Friday.  The grand jury indicted Adam K. Sloan on multiple charges of wire fraud, identify theft an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"059fd137f31e50c237a1c7858a6af61863661c7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"960C7E3D-C028-4A6A-9478-631E518AB0E2"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"be039569568e","org_name":"Blue Cross Blue Shield of Nebraska","org_type":"financial","ransomware":null,"records_affected":1872,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.omaha.com/money/blue-cross-blue-shield-says-it-disclosed-customers-personal-information/article_e8517590-bda1-5b0a-8244-2cc02395a801.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/blue-cross-blue-shield-mailing-error-disclosed-1872-dental-claims-statements-to-other-members/"}],"summary":"Off by one error results in 1872 dental claim records being sent to wrong person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa56d8bbb60ac5abb63819ed2f283a8caa7e2499","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3765208E-AB0D-49C0-9D7F-C9CA055C9036"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3adca0c21a6","org_name":"Blue Cross Blue Shield","org_type":"financial","ransomware":null,"records_affected":180,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/former-blue-cross-worker-pleads-to-woman-pleads-guilty-to-filing-over-180-fraudulent-tax-returns/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtvm.com/story/28993868/woman-pleads-guilty-to-filing-over-180-fraudulent-tax-returns;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ledger-enquirer.com/2015/05/06/3706391_former-blue-cross-worker-pleads.html"}],"summary":"WTVM reports that a former Blue Cross Blue Shield customer service employee has pleaded guilty to filing false tax returns, wire fraud, and aggravated identity theft.  Danielle Wallace admitted to filing 180 fraudulent tax returns and stealing nearly $500,000. The false returns u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de439d44228eb733b018b9c5415f1aa3c53de86c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B041779-20CC-47D8-8754-C99247946442"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4fc4d5d799aa","org_name":"Bloomsbury Patient Network","org_type":"healthcare","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-35131543"}],"summary":"Twice in 2014 members were emailed with all their addresses in the CC: field","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc9c16b34e21091be173c79df955c4089c94a1bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"863C96AA-89A5-4932-8D4F-C1E344AFC9E3"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b3c4521fd5b","org_name":"Bizmatics, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":350828,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/two-more-medical-groups-notifying-patients-of-bizmatics-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/over-19k-patients-notified-in-potential-ehr-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/eye-associates-of-pinellas-notifying-87000-patients-of-hackingit-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-health-longevity-institute-patients-notified-of-bizmatics-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/healthcare-data-breaches-expose-23000-patients-personal-information.html;"}],"summary":"On March 30, 2016, Integrated Health Solutions, P.C. was informed by Bizmatics, Inc. (\"Bizmatics\"), our electronic medical records service provider, that it experienced unauthorized access to its records which may have included our patient records. This information may include na","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ce08a170f8f9020d45cbd2048d03d3652f46392","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD1D9CB5-59A1-4296-B50F-EE4B593A2D4C"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c183741fb13","org_name":"Bexar County Sheriff's Office","org_type":"government","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksat.com/content/pns/ksat/news/2014/09/20/bcso--shared-hard-drive-left-employee-info-vulnerable.html"}],"summary":"A shared drive containing employee information could have been accessed by people outside of the department. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec4085e7a6f7dbb8fe00c30254c45f4abfc041d8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB3FF39A-876D-419F-A76E-5E465C42B4B6"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"813ce5cf70da","org_name":"Bettys","org_type":"retail_ecommerce","ransomware":null,"records_affected":120000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.misco.co.uk/blog/news/02979/trouble-for-ell-known-yorkshire-tearoom-as-120-thousand-customers-hit-by-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://bettys.cmail2.com/t/ViewEmail/r/AAFDD3F76E1CE30D2540EF23F30FEDED/46293443D387B5726CBD507C784BD83B"}],"summary":"User database breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a70450202906083cf8eca98623c7fec14a19d5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FA32E37-4C51-4995-BD80-6817A9EF92B0"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6b3bc18bc975","org_name":"Bendigo and Adelaide Bank Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mpnews.com.au/2015/05/25/customers-scammed-by-skimmers/"}],"summary":"ATM skimmers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cf0882308367ab0c2aab2cf45aaee6b12b36dc0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07A7B93B-12E5-43E3-BCBF-62DC53B85C5A"},"incident_date":"2015-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c09c863bb3b","org_name":"Beacon Health System","org_type":"other","ransomware":null,"records_affected":220000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.elkharttruth.com/living/Health/2015/05/25/Beacon-Health-System-target-of-phishing-security-attack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/hackers-hit-health-system-had-full-year-access-files;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/beacon-health-system-notifies-patients-of-possible-data-compromise/article/416853/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/beacon-health-provides-notice-of-data-security-event-300088014.html"}],"summary":"Although there is no evidence of any actual or attempted misuse of personal or protected health information belonging to Beacon Health System (\"Beacon\") patients, Beacon is notifying the media and affected patients that it was the subject of a sophisticated phishing attack, and t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59aa962c0502b8adb98ca151f401861c8e0b1cca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BAF1FC0-1110-47DD-B4F5-9FBCC2465CFB"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff7a4d0a93bd","org_name":"Bank of New York Mellon Corp/The","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/bny-mellon-wealth-management-client-data-breach--novick--associates-300134934.html"}],"summary":"Bank erroneously released Personal data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9039e32392ba0c1a9baf3cc39831ab8d1d95c99c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05E59C0D-6CCD-4823-816A-44F680CF753E"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"38a5a6b3b414","org_name":"Aurangabad divisional Commissionerate","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://timesofindia.indiatimes.com/city/aurangabad/3rd-attack-on-divnl-commissionerates-website-in-7-days/articleshow/49651323.cms"}],"summary":"Website defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47d91982740aad37187398b356a7dc3e726496c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18E7681D-C6F8-4FF6-BD6A-7D6D64D71284"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"631091ed9094","org_name":"Auckland District Health Board","org_type":"government","ransomware":null,"records_affected":890,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/auckland-lab-tech-caught-accessing-patient-records-890-times-can-return-to-work/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/business/82729430/auckland-lab-tech-caught-breaching-patient-privacy-890-times-can-return-to-work"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11568355"}],"summary":"An Auckland DHB lab technician has been censured after inappropriately prying into medical records.  Rosalinda Zabala inappropriately accessed the medical records of patients, including a one-year-old, just short of 900 times in a three year period.  Zabala, who worked for the DH","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02608e8ada89eb460b26ebda8fe33dca99d712fa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd70efd0-8e65-11ec-a600-657ec2694f8f"},"incident_date":"2015-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b972f962a464","org_name":"Auburn police department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nh-sentenced-to-over-a-year-in-prison-for-hacking-police-department-in-revenge-for-drug-arrest/"}],"summary":"After an arrest on heroin possession charges, some dude goes out on a hacking rampage, targeting the police station that arrested him","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d66f29c489ba430bb981b5f964cd2dcd2db1f19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED2DD118-5C2C-497B-A330-5574BB4A2758"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19aac8cd857f","org_name":"Atlantic Marine Construction Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pilotonline.com/news/local/crime/lawsuit-former-employee-used-computer-program-to-steal-trade-secrets/article_6e411c3d-8f0a-5a07-a5f5-17f396186d35.html"}],"summary":"Employee stealing trade secrets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c152bad35695bf092e5dbeec758d93246cc6fca","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48AB12CE-5479-48FC-924D-8CDE6CD2D569"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"4b967601602c","org_name":"Asia Pacific Telecommunity","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/anonymous-hacks-asia-pacific-telecommunity-portal-to-protest-against-censorship-in-asia-498094.shtml"}],"summary":"Anonymous Hacks Asia Pacific Telecommunity Portal to Protest Against Censorship In Asia ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68cafd64772a94e0815739480de48e734c55a5df","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA46642F-8B8C-44DB-A218-94321A5D0060"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f0cf9e3ff63","org_name":"Arthur Brisbane Child Treatment Center","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.app.com/story/news/local/neptune-wall/wall/2015/11/13/records-brisbane-wall/75705462/"}],"summary":"Inside the former Arthur Brisbane Child Treatment Center sat piles of cardboard boxes, turning the former psychiatric hospital into a makeshift storage facility.  The files contained within run the gamut of both state employees and Brisbane patients, including personal informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ffeee62df00853a3d0334d12aa927d41f7364ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C045BC42-2B4F-4CBF-89EE-C1374223F50C"},"incident_date":"2015-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CO","org_id":"3e9bae604d0d","org_name":"Armed Forces","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.elespectador.com%2Fnoticias%2Fjudicial%2Fsargento-vendia-bancos-datos-secretos-de-servidores-de-articulo-610717&edit-text=;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.elespectador.com/noticias/judicial/sargento-vendia-bancos-datos-secretos-de-servidores-de-articulo-610717"}],"summary":"selling secret data servers and officials of the Armed Forces of Colombia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc2607d2fa6e3b357cfcd707b098347117ef5e36","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18e0dc90-4886-11ec-9b2e-07c484f260d1"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15b04b19304c","org_name":"Apple Computer","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/gadgets/2021/05/apple-brass-discussed-disclosing-128-million-iphone-hack-then-decided-not-to/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://web.archive.org/web/20151101142446/http://www.apple.com:80/cn/xcodeghost;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securitymagazine.com/articles/95179-apple-failed-to-disclose-security-incident-affecting-128-million-users-in-2015"}],"summary":"In September 2015, Apple managers had a dilemma on their hands: should, or should they not notify 128 million iPhone users of what remains the worst mass iOS compromise on record? Ultimately, all evidence shows, they chose to keep quiet.  Further Reading Apple scrambles after 40 ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a397f6990b3085e84f6fe57f504181cb578a1702","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24FA6545-F6C2-48DF-BDC0-3C1CF75CE28F"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple Inc","org_type":"manufacturing","ransomware":null,"records_affected":225000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.inc.com/joseph-steinberg/massive-iphone-user-data-breach-what-you-need-to-know.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://researchcenter.paloaltonetworks.com/2015/08/keyraider-ios-malware-steals-over-225000-apple-accounts-to-create-free-app-utopia/"}],"summary":"Newly discovered malware is believed to have stolen the login credentials of more than 225,000 iPhone users. The compromise of such a large number of accounts makes KeyRaider, as the new stream of malware is being christened, one of the most damaging pieces of malware ever discov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1df6cd6654c68323247cea6df9efe921c263862","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"071afb80-0843-11e8-8ccf-e3865b9fabe5"},"incident_date":"2015-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"899dd75c7bbb","org_name":"Ancestry.com","org_type":"technology_saas","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/ancestry-com-data-leak-rootsweb-server-accidentally-exposes-300000-email-addresses-passwords-1652948;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/leaky-rootsweb-server-exposes-some-ancestry-com-user-data/129248/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://spacecoastdaily.com/2018/01/ancestry-com-data-breach-exposes-emails-login-information-of-300000-registered-users/"}],"summary":"Ancestry.com has confirmed that a leaky server on RootsWeb, its free community-driven genealogical website, inadvertently exposed a file containing 300,000 usernames, email addresses and passwords online. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9795b4f3b69e722fd453596079031fce524cc58","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B1DE07F-0937-4CBD-9ECD-6D0452613F3F"},"incident_date":"2015-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"professional_services","ransomware":null,"records_affected":6200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.financialbuzz.com/santa-ana-postal-worker-to-be-tried-for-identity-theft-502776"}],"summary":"Chinh Vuong would flick credit cards from his delivery list in order to make personal purchases in luxury products such as watches, cars, and designer clothes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9449b088eca828ef08c406a0345d608b53c0a48a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D21E86BA-1994-4F0B-B72D-6866C3E0F7DD"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c962c2ad7c1","org_name":"American Bankers Association","org_type":"nonprofit","ransomware":null,"records_affected":6400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/american-bankers-association-notifies-6400-to-reset-passwords-after-hack-and-data-dump/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fortune.com/2015/10/02/american-bankers-association-breach/"}],"summary":"SQLi (inferred) results in leak of 6400 credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4edde85faa2d54df1a95d6cb1e6f0e8c2ddcca72","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52D3AA9F-8DC7-4C1D-B4A2-D1D6CDF8D598"},"incident_date":"2015-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1e2e9be882c5","org_name":"Alzheimer's Society","org_type":"nonprofit","ransomware":null,"records_affected":66000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.alzheimers.org.uk/site/scripts/news_article.php?newsID=2534;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/news/uknews/12087713/Dementia-charity-warned-to-take-action-over-data-protection-failings.html"}],"summary":"Web application compromise leads to loss of medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6868ed6bf49fc11488b8e02f6381fec7901f9567","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F36BEEF-6538-48F1-9226-1A8F1CD2012C"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ea7c2f7f383","org_name":"Alternative Therapies Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":157,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mjbizdaily.com/massachusetts-dispensary-accidentally-shares-patient-e-mail-addresses/"}],"summary":"Marijuana dispensary shared patient's emails in cc field.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fac5abcf68e4a476ff67de17fd68bc0573de0da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF553603-5D0C-4147-AC4A-96E2E07E2210"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c131325dba0e","org_name":"Allina Health","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/allina-sends-private-patient-info-to-250000-people/"}],"summary":"In a breach of patient privacy, Allina Hospitals & Clinics included information on eight people __ the fact that they are a patient, their email address, and the name of the company they worked for __ in a mass email that went to a quarter of a million patients in Minnesota and w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cd17c592ad2c014305c108b83180733d4fefdc7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11999F47-2C92-425C-B5CA-4B029E559810"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95ce7db69452","org_name":"Alliance Health Management & Consulting Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tx-state-sues-defunct-health-care-management-firm-after-health-records-found-in-recycling-bin/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.expressnews.com/business/local/article/State-Health-records-found-in-recycling-bin-6652635.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.expressnews.com/file/133/2/1332-olveda.pdf"}],"summary":"A defunct home health care management company that was based in San Antonio has been sued by the state over clients' personal information found in a recycling container at Stevenson Middle School.  Files belonging to Alliance Health Management & Consulting Inc. were recovered by ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8725756e80b3c679a4142c7fc6053fb8f02489a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE1D4E89-2EC8-4A92-8586-820801D037CC"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b860e1981d54","org_name":"Alexian Village of Tennessee Retirement Community","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newschannel9.com/news/local/new-details-revealed-in-signal-mountain-identity-theft-case;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/741584235956646/photos/a.741978562583880.1073741828.741584235956646/950484638399937/?type=3&theater"}],"summary":"The Signal Mountain Police Department has revealed new details in the case of a nurse's assistant charged with identity theft.  A post on the department's Facebook page says 20-year-old Marcus Nix is accused of stealing information for several elderly victims at the Alexian Villa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d2eb40d244062ab9c1d9ae56cb5def546bde222","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79013D28-AFEE-456E-924C-D99D366437DC"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/jessica-christine-hagan-homicide-cranston-ahs-1.3386060"}],"summary":"Terminally ill mother kills special needs daughter just prior to her own death.  Staff at hospital snoops on medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a9f3639cbf2dd6f059c8b1bf15378659aa2688d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53042CB1-26C3-4BA8-8C23-3482695A01DF"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"912c275e26dc","org_name":"Alabama Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.annistonstar.com/news/state/database-misuse-ensares-officers/article_291648f8-3049-11e6-b76b-0bf60f1268d1.html"}],"summary":"Dennis Bodine, former chief investigator for the Alabama Criminal Justice Information Center, was accused of improperly searching for information on more than a dozen people; he pleaded guilty to one count. Bodine's former employer, ACJIC, runs the state's database on criminal of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"997b016c76dc524dc503793ba19562956c62c225","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69FCBF4F-2C83-4859-898A-1802894E0B75"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34949252b606","org_name":"Alabama Medicaid Agency's","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/owner-of-tuskegee-counseling-service-convicted-on-fraud-charges-misused-patient-and-childrens-info/"}],"summary":"Client PII misused to commit fraudulent transactions against Medicaid","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Mufasa","variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21b41a43e7d0a0798c9acd9112dfe318cfe68610","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1105D4B-62CA-469E-B28F-FE7246167310"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36dc238f02fa","org_name":"Akorn Inc.","org_type":"manufacturing","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2938032/data-breach/akorn-inc-has-customer-database-stolen-records-offered-to-highest-bidder.html"}],"summary":"Akorn Inc., a niche pharmaceutical company Lake Forest, IL, has had a customer database with more than 50,000 records compromised by a hacker who is offering to sell the data to the highest bidder or back to the company, whichever comes first.   The database was offered up on a d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"mufasa"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed605c35cc0ccef9acafeb210c0d3ada18416bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"829F71A9-40F7-48B4-8091-3B942E218596"},"incident_date":"2015-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9765483cd52b","org_name":"Advanced Radiology Consultants","org_type":"healthcare","ransomware":null,"records_affected":855,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ct-advanced-radiology-consulting-llc-notifies-patients-of-breach/"}],"summary":"Advanced Radiology Consulting, LLC notifies patients of breach  On May 28, 2015, ARC discovered that an employee had emailed certain patient protected health information to her personal email account. This protected health information included a combination of patient names, date","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ea75c3686296662e6b073a321762e50052544d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9253E473-62A6-4042-845D-11CA33C52010"},"incident_date":"2015-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e2a3785b5f0","org_name":"Acclaim Technical Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/ATS%20Sample%20Letter%201_0.pdf"}],"summary":"state-sponsored cyber intrusion which resulted in the theft of certain background investigation and other records containing personal information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac774ca0b75ede9cb7afc030dd2e75b558be7a7e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C1965420-4DCF-4123-A869-C96004DB5AAE"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c35cf29c206","org_name":"7-Elevan","org_type":"retail_ecommerce","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksdk.com/story/news/crime/2015/11/10/skimming-continues-in-st-louis-area/75553438/"}],"summary":"Skimming continues in St. Louis area - 7-Eleven","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c6fcfd08179106b61fbb506dbdfdfd14794491b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CE11E00-941D-4825-9886-761F7A4DF908"},"incident_date":"2015-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5592e65ed313","org_name":"56 Dean Street clinic","org_type":"healthcare","ransomware":null,"records_affected":780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://home.bt.com/news/uk-news/jeremy-hunt-says-hiv-patient-data-breach-completely-unacceptable-11364001461354;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.channel4.com/news/uk-sexual-health-clinic-apologises-after-email-mishap;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/05/london-nhs-trust-fined-for-hiv-newsletter-data-breach/"}],"summary":"The identities of hundreds of HIV-positive patients have been mistakenly circulated after a data breach at a clinic  The 56 Dean Street clinic in London's Soho sent a newsletter to about 780 patients on a group email, rather than to individuals.  It contained the names and email ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2015-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26bd4192b4eae34477d59e91a9be07797a379f28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"092E167C-243E-418B-9526-5F7A1679E7EC"},"incident_date":"2015-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69a204b9011c","org_name":"000Webhost","org_type":"technology_saas","ransomware":null,"records_affected":13000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://securityaffairs.co/wordpress/41521/cyber-crime/free-web-hosting-000webhost-hacked.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerweekly.com/news/4500256589/000Webhost-blames-PHP-exploit-for-breach-of-135-million-records"}],"summary":"Unencrypted passwords for a free web hosting firm were on sale for five months before customers were notified their records had been leaked, according to a security researcher  Free web hosting firm 000Webhost has blamed an exploit in an old PHP version of its website for exposin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"CoreSec","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ef6ad01cb0342f5040eab499a3032bd8bb485a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D630A26-B2FC-4A39-BD6E-7D7DA968B17C"},"incident_date":"2014-12-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"1b715436b268","org_name":"Pohjola Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=17785;http://www.inforisktoday.com/ddos-attacks-slam-finnish-bank-a-7761;https://www.op.fi/op/op-pohjola-group/op-pohjola-group?cid=-66116&srcpl=4;"}],"summary":"OP suffered from a denial-of-services attack on New Year's Eve   OP's services experienced some problems on New Year's Eve due to data communications disruptions. The disruptions were caused by a denial-of-services attack. The attack flooded OP's data communications systems and p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"coresec"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36877b50e1ccd880fc0e2725342609bad4364eed","impact_type":"unknown","incident_date":"2014-11-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Exhibit%20A%20revised_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f1f833c5a4f7","org_name":"La Jolla Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47915"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2014-12-26","discovered_date":"2014-11-04","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9728335de1143e710fa9a3618fc1c0fbe55e65f","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Physicians%20Skin%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"58168d400a70","org_name":"Physicians Skin and Weight Centers, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47861"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Physicians%20Skin%20Notice_0.pdf"}],"summary":"A laptop and external hard drive stolen from an employee’s vehicle may have contained patients’ personal, medical, and financial information.","supporting_quote":"On November 4, 2014, an employee’s vehicle was broken into in Fresno, California and a password protected laptop and external hard drive were stolen from the vehicle.","technology_involved":["password-protected laptop","external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-12-26","discovered_date":"2014-11-07","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11c28de70841dace6c58ae22334111928415e7bd","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notices%20Template%2012.24.14_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"59d572bfebeb","org_name":"Empi, Inc./DJO, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47856"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notices%20Template%2012.24.14_0.pdf"}],"summary":"A laptop containing personal and medical information was stolen from a locked car belonging to a DJO consultant.","supporting_quote":"On November 7, 2014, we discovered that, on that same day, a backpack containing a laptop computer was stolen from a locked car belonging to a DJO consultant parked at a coffee shop in Roseville, Minnesota.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f48dec4720296a8b9df30420c3a32263bfe4dc42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0734A6CA-CCF7-413F-9BCD-03D36FACDEDE"},"incident_date":"2014-12-26","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d543b03045c1","org_name":"Childrens National Health System","org_type":"healthcare","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://childrensnational.org/notice;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/childrens-national-health-system-notified-18000-patients-after-employees-fell-for-phishing-scheme/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/washington/blog/2015/07/childrens-national-medical-center-faces-suit-for.html"}],"summary":"At Childrens National Health System (Childrens National), protecting the security and confidentiality of patient personal and medical information is of the utmost importance. Regrettably, this notice concerns an incident involving some of that information.  On December 26, 2014, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-12-24","discovered_date":"2014-10-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04b23356e6a75b4cf9f25cb3a06ced7a2438890f","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-27","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_M978_v01_0.pdf"},"notes":null,"org_country":"US","org_id":"3e27ac8a7231","org_name":"Lokai Holdings LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47853"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_M978_v01_0.pdf"}],"summary":"An unauthorized person accessed Lokai’s website server and installed a program designed to record customer information entered on the site.","supporting_quote":null,"technology_involved":["website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2a7c6913f7c32479c5b3865557640f22c73cbcf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9179667F-D62C-4D68-9031-5F955AC48122"},"incident_date":"2014-12-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97ad9c2e06db","org_name":"District Medical Group","org_type":"healthcare","ransomware":null,"records_affected":616,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in the exposure of 616 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2ab616b1def11447405b2ee8120e56272cd2b65","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sent%20to%20CA%20Residents%20%286583414%29_0.pdf"},"notes":null,"org_country":"US","org_id":"dfe5255d96db","org_name":"Corday Productions, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47852"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sent%20to%20CA%20Residents%20%286583414%29_0.pdf"}],"summary":"Corday reported that personal information maintained by Sony could have been affected by Sony’s cyberattack, but a breach of Corday-related information had not been confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Sony Pictures Entertainment"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"7452dc549144","name":"Sony Pictures Entertainment"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-23","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da75abedfa4d1478d16d9e1ab85008dcfd29869b","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-12-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"2c11c139d108","org_name":"Rob Kirby","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47844"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification_1.pdf"}],"summary":"A vehicle break-in resulted in the theft of a laptop and flash drive containing client information.","supporting_quote":"My briefcase, laptop (password protected) and a flash drive containing confidential client information was stolen.","technology_involved":["laptop","flash drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1485"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-12-23","discovered_date":"2014-12-08","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caf1d99700d10ab38b4d5adb7d89119ab678ac47","impact_type":"disruption_or_ransomware","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hacker%20announcement_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1491","org_country":"US","org_id":"6bffafce1d1c","org_name":"Public Architecture","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47847"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hacker%20announcement_0.pdf"}],"summary":"A hacker defaced theonepercent.org, deleted files essential to its operation, and may have stolen user information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-23","discovered_date":"2014-12-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5e26ad5c99e54ffd8e694b506ec920dd43b4252","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Dutch%20Indiv_0.pdf"},"notes":null,"org_country":"US","org_id":"5cdce7a117e8","org_name":"DutchWear","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47840"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Dutch%20Indiv_0.pdf"}],"summary":"DutchWear reported that personal and payment information may have been exposed through its e-commerce website.","supporting_quote":null,"technology_involved":["e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6566a4f1db98844c961551f5e2871ee18094f1aa","impact_type":"unknown","incident_date":"2014-10-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%2C%2012-17-2014_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1cc0b0f316e6","org_name":"Nvidia Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47824"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b04d24e5e82e7756e96e4ad5b1ad2182026c5aa8","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Staples.CA_.Consumer.Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"e1cf2528c377","org_name":"Staples","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47797"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Staples.CA_.Consumer.Letter_1.pdf"}],"summary":"Staples reported that malware on point-of-sale systems at 115 U.S. stores may have allowed unauthorized access to payment card data.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-12-19","discovered_date":"2014-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fecd7b757590c05b92a33dad08d673436b31e12","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/14-4459%20Notification%20to%20Patient%201-%20MMCR%20Template%20with%20commentspb_0.pdf"},"notes":null,"org_country":"US","org_id":"0045b6c33b53","org_name":"Mercy Medical Center Redding Oncology Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47803"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/14-4459%20Notification%20to%20Patient%201-%20MMCR%20Template%20with%20commentspb_0.pdf"}],"summary":"Mercy Medical Center Redding Oncology Clinic discovered that transcribed physician progress notes containing demographic and treatment information were publicly accessible on a third-party website.","supporting_quote":null,"technology_involved":["third-party website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-12-19","discovered_date":"2014-10-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c8fe81db9b629e4e60cae55b0e9d9549633741a","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/notification_0.pdf"},"notes":null,"org_country":"US","org_id":"6932ad3237d4","org_name":"IDParts, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47779"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/notification_0.pdf"}],"summary":"IDParts discovered malicious code in functions processing customer payment information, which may have involved credit card information.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f80ddf52d38487d00e05d8524a92d8cba95e6d9","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Customer%20Letter%20-C2014080115_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47796"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47795"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-48072"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20AG%20-%20Customer%20Letter%20-C2014080115_0.pdf"}],"summary":"American Express notified cardmembers that a merchant where they used their cards detected unauthorized access to data files that may have included card account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-18","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d8c33c8d94e302d9495865a1fe2683bd765be68","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Laptop%20incident%20notification%20letter%20%28form%29_0.pdf"},"notes":null,"org_country":"US","org_id":"2f2accb94629","org_name":"Harmonic Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47778"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Laptop%20incident%20notification%20letter%20%28form%29_0.pdf"}],"summary":"A thief stole a Harmonic employee’s laptop containing files with personal information about current and former employees, consultants, and affiliates.","supporting_quote":"On the evening of October 17, 2014, an unknown person broke into the locked car of a H armonic employee and took a work bag containing documents and a laptop computer.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23cbd70b71fd3bd18ccb37dad023901345bb1af4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"818D73FE-7372-4438-8C0F-9AA4449B4994"},"incident_date":"2014-12-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e3c79904718","org_name":"Wallgreen's","org_type":"retail_ecommerce","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"160,000 paper records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-15","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bcd37d3c8d1d4587f7ee9bd932d9612193f6dfd","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-07","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PLNU%20Notice%20Updated%20M946_v01_0.pdf"},"notes":null,"org_country":"US","org_id":"548d791e24ca","org_name":"Point Loma Nazarene University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47722"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PLNU%20Notice%20Updated%20M946_v01_0.pdf"}],"summary":"Phishing attacks resulted in unauthorized access to five employee email accounts, potentially exposing personal information.","supporting_quote":"Between October 7, 2014 and October 20, 2014, the University became aware of and remediated instances of unauthorized access to five employee email accounts that occurred during this time period as a result of phishing attacks.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf26442615be06101e45d3e3d3ed6eb497fae598","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CB0CF6E-16C1-493C-8FAF-39ED3C66DE43"},"incident_date":"2014-12-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01a59d848823","org_name":"Mercy Medical Center Redding","org_type":"healthcare","ransomware":null,"records_affected":620,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/mercy-medical-center-redding-oncology-clinic-notifies-patients-of-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/14-4459%20Notification%20to%20Patient%201-%20MMCR%20Template%20with%20commentspb_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.redding.com/news/local-news/hundreds-of-mercy-patients-info-leaked-online"}],"summary":"About 620 North State Dignity Health patients personal information was accessible online for several weeks, the organization reported Monday.   A third party, contracted for transcriptions of physician notes at Dignity Health Mercy Oncology Center, accidentally made public a link","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a55de595acfda9260665a3d10925c2856828906b","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCB%2012-12-14%20Breach%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"1f16e2ea9241","org_name":"University of California, Berkeley","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47717"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCB%2012-12-14%20Breach%20Notice_0.pdf"}],"summary":"Unauthorized access to servers and workstations in the Real Estate Division may have exposed files containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-12","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b022413901458a3523c77f4e761cda3c712d7086","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/A6701_LV2_PRF_ADULT_NON-MASS_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"915c75c9197b","org_name":"Acosta, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47713"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/A6701_LV2_PRF_ADULT_NON-MASS_0.PDF"}],"summary":"A company laptop and personal items were stolen when an associate's automobile was burglarized.","supporting_quote":"On November 10, 2014, the personal automobile of an associate in the Company's Human Resources department was burglarized.","technology_involved":["company laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"869ecbc173bdb3dcf34dc6870b025af89ef185bd","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-29","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Press%20Release%20and%20Website%20notice%20%28clean%29_0.pdf"},"notes":null,"org_country":"US","org_id":"c8d32e7c7e27","org_name":"ABM Parking Services","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47710"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Press%20Release%20and%20Website%20notice%20%28clean%29_0.pdf"}],"summary":"ABM Parking Services reported a vendor data security incident that may have exposed payment card information at nine Chicago parking locations.","supporting_quote":"ABM Parking Services, Inc. (“the company”), today announced that Datapark USA Inc. a vendor that provides and maintains point of service software for several Chicago, Illinois parking facilities managed by the company, has confirmed a data security incident.","technology_involved":["point of service software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Datapark USA Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"7ed9d6401ddd","name":"Datapark USA Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adaf97097ea5bed736384014a12fe71fec663ca2","impact_type":"unknown","incident_date":"2014-11-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/12%2008%2014%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6e446bc07216","org_name":"Sony Pictures Entertainment Inc. (\"SPE)","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47706"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3195cfc7000610acd0e2fc5ccb623e1365608cad","impact_type":"unknown","incident_date":"2014-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Breach%20letter%20final%2012%2011%2014_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fb6bf681b32b","org_name":"EMCOR Services Mesa Energy Systems","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47705"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5918229d3e2db82adbc847f273ba6d27b544142","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B08097B8-4D6A-474E-9544-A40D7A824520"},"incident_date":"2014-12-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a65ecb180a35","org_name":"ReachOut Home Care","org_type":"healthcare","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop exposes 4500 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf4802fa3bdf46c06aad1ae19d2bc8700de3db39","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A17AAC0C-E541-4A27-9AA3-97F8CCF1567C"},"incident_date":"2014-12-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91805b7fdaf0","org_name":"Hearing Zone","org_type":"retail_ecommerce","ransomware":null,"records_affected":623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"theft of a laptop exposes 623 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e26251d3852f4acceda97707d673f71c69506d52","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-11-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/bebe%20website%20notice%20for%20AG%20attachment_1.PDF"},"notes":null,"org_country":"US","org_id":"182f3ae34c36","org_name":"bebe stores, inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47667"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/bebe%20website%20notice%20for%20AG%20attachment_1.PDF"}],"summary":"bebe stores detected suspicious activity on computers operating its store payment processing system, potentially affecting payment card data used during the stated period.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b357fadff9a3eded3fd144be5bc0e67a62bf0125","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A9FD045-46E5-4380-B3AB-A44F31AC0537"},"incident_date":"2014-12-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13adaef8987d","org_name":"St. Mary Mercy Hospital","org_type":"healthcare","ransomware":null,"records_affected":1488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"}],"summary":"Unauthorized access results in the exposure of 1488 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c17761e851c9a69f1ca9125d429d630e283df32f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5EBB7F6-8E30-420A-B6A3-16A9493340FD"},"incident_date":"2014-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16a90383df21","org_name":"WELLCARE HEALTH PLANS, INC.","org_type":"financial","ransomware":null,"records_affected":4469,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.democratandchronicle.com/story/news/2014/12/06/wellcare-medicare-hipaa-breach/19999423/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ny-wellcare-informs-medicare-subscribers-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-update-provides-some-new-details-on-breaches/"}],"summary":"Some personal information of a few dozen Monroe County residents who are Medicare subscribers with WellCare Health Plans recently was mishandled by a subcontractor for the insurer.  In late November, WellCare sent letters to 47 people affected in Monroe County, telling them the b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"236e58eb12e7671ff2fae83a608ace64a98052a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05B7D079-7E0F-4916-8B8B-035BDC65C96A"},"incident_date":"2014-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"efab3880e8bd","org_name":"Seven Hills Radiology","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/12/30/patient-privacy-compromised-with-theft-and-improper-storage/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.8newsnow.com/story/27725096/i-team-storage-unit-reveals-dumped-medical-files"}],"summary":"It is not uncommon for healthcare organizations to utilize offsite storage facilities. However, a standard, monthly rental storage unit may not necessarily be the best choice.  A woman purchased a storage unit in Henderson, Nevada that had been put up for sale due to non-payment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7ca82837cb37e6a339c6da86f18c083178295c1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B11D45C4-2F25-40A2-9C9A-1368DDB75821"},"incident_date":"2014-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b56d19db8ee","org_name":"Round Rock Hospital","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kxan.com/2014/12/08/hospital-employee-caught-on-camera-using-stolen-credit-carts/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://radionb.com/news/regional-news/article20411/round-rock-hospital-employee-arrested-credit-card-theft-charges"}],"summary":"Security camera video shows a hospital employee entering a patients room and then using the patients credit card at a liquor store and gas station.  Round Rock Police arrested 46-year-old Carol Ann Parks, an employee of St. Davids Round Rock Medical center, on two charges of cred","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed0b68e7b92ec64a6a5b1b1a0eeb416d0c858349","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34018629-55FE-47CB-9C04-6382DE84FCF3"},"incident_date":"2014-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95b87c551e7e","org_name":"North Big Horn Hospital","org_type":"healthcare","ransomware":null,"records_affected":1607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of paper records exposes 1607.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e08c2381211baceb529471b9a12952a091f7cdc2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97FA749B-3EC4-435D-BD39-91B385C22148"},"incident_date":"2014-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d3238c9d652e","org_name":"Luton & Dunstable Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.luton-dunstable.co.uk/luton-Data-hospital-probe/story-27737799-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0ahUKEwitwcf5yunOAhVB9h4KHaWOCLoQFggiMAE&url=http%3A%2F%2Fwww.ldh.nhs.uk%2FEasySiteWeb%2FGatewayLink.aspx%3FalId%3D14761&usg=AFQjCNHPugbRccxMLKc4KVyPNFyN0SKRnQ&bvm=bv.131286987,d.dmo"}],"summary":"patient data was disclosed in error","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c4ed63f605da5053ba49c6a480ee8a016fa6b23","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E3D8F06-35AC-435E-AACF-CF38EA9292F5"},"incident_date":"2014-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ec67278e649","org_name":"Lakewood Ranch Hospital","org_type":"healthcare","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/story/news/local/2014/12/10/manatee-nurse-stolen-credit-cards/20197305/"}],"summary":"A nurse at the Lakewood Ranch ER has been fired after using patients' credit card to buy things online.  Detectives began the investigation after they were assigned a fraudulent use of a credit card case where each of their respective victims had their credit card information sto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"903eca34f570cbfff9a8b9b1229b9ff14cc33837","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63A4CAF8-2F1D-4CB9-A1AF-E1A426EE5F04"},"incident_date":"2014-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fbb2121ef8bb","org_name":"JP Morgan Chase","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/articles/2015-04-28/ex-jpmorgan-worker-arrested-by-fbi-over-theft-of-consumer-data"}],"summary":"Peter Persaud, former employee for JP Morgan and Chase was arrested the  FBI, after Peter accessed unauthorized customers accounts and sold the data. Although, he was trying to make money on it, nut ended up sellin the data to undercover agent which finally led to prison.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf386431dfbd486efd6ecd836d893498a22f5c10","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCDD0B50-6514-4309-BABF-C057DC398C99"},"incident_date":"2014-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b952931bb91","org_name":"Inland Family Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.centralmaine.com/2014/12/23/fairfield-woman-idd-as-healthcare-employee-accused-of-stealing-patient-credit-card-data/"}],"summary":"Police have identified 37-year-old Heidy Tirado of Fairfield as the former employee of Inland Family Care  Unity whos accused of stealing credit and debit card information from patients and using the information to make online purchases totaling more than $1,000.  A Troy resident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31776c5dee795bf3fd1791432940eb7691cb9393","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7cfa2db0-7c5e-11e7-8ec0-e369e9638092"},"incident_date":"2014-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fd67d429ece9","org_name":"HSBC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.homecare.co.uk/news/article.cfm/id/1586670/HSBC-employee-jailed-after-stealing"}],"summary":"Bank employee misuses access to customers accounts to fraudulently transfer money","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37c9e5217ce60de506f9be0361a119487875e0ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0EA1B20-A05E-4889-89BC-8527F9CB7FB1"},"incident_date":"2014-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"34aea91ce00b","org_name":"Coventrys University Hospital","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.coventrytelegraph.net/news/coventry-news/coventry-patient-shocked-receive-peoples-8290263"}],"summary":"Coventry hospital bosses are investigating after a diabetic patient received other patients confidential medical notes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3452051c08f72d1b7ac6b9201c89f1cba2a62d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0728b850-a926-11e7-a3c5-dbae2580635b"},"incident_date":"2014-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12c2468685b4","org_name":"Children's Heart Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reviewjournal.com/crime/courts/las-vegas-lab-tech-gets-2-years-in-prison-for-identity-theft/"}],"summary":"pediatric laboratory technician was sentenced Monday to two years in prison for stealing the identity of a patient’s parent and using it to apply for credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07fb485bb8fa8c02035fb5a342aeca9e51f50aa0","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20template_0.pdf"},"notes":null,"org_country":"US","org_id":"231f3fc4d7a9","org_name":"American Residuals and Talent, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47623"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20template_0.pdf"}],"summary":"American Residuals and Talent, Inc. reported an unauthorized login to its web application, after which intruders had access to a database and personal information may have been accessed.","supporting_quote":null,"technology_involved":["web application","database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d750ec71906bffd311b896a02d99eed52aab3033","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tiny%20Prints%20Breach%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"d7872bfaf7a8","org_name":"Shutterfly","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47602"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tiny%20Prints%20Breach%20Notice_0.pdf"}],"summary":"Shutterfly reported a cyberattack on the Tiny Prints, Treat, and Wedding Paper Divas websites that may have exposed customer email addresses and encrypted passwords.","supporting_quote":null,"technology_involved":["Tiny Prints website","Treat website","Wedding Paper Divas website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-25","discovered_date":"2014-10-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a624b25e81372bede6db8a60e35e06bb886c15bf","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/11242014%20Notification%20Letter_AFFECTED_PROOF_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1114","org_country":"US","org_id":"364172971994","org_name":"State Compensation Insurance Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47592"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/11242014%20Notification%20Letter_AFFECTED_PROOF_0.pdf"}],"summary":"Email containing personal information related to workers’ compensation claims was stolen from interpreting services provider Lucy Gomez Blankey Interpreting, Inc.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Lucy Gomez Blankey Interpreting, Inc."},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"6cdb282a38c7","name":"Lucy Gomez Blankey Interpreting, Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal","secrets"],"disclosed_date":"2014-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b06bb179660314990205f5d8cae1b44d76b29c3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A1D0AB7-A914-44A3-B5CE-558B5823C090"},"incident_date":"2014-11-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7452dc549144","org_name":"Sony Pictures Entertainment Inc.","org_type":"technology_saas","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mashable.com/2014/11/25/sony-pictures-hack-inside/;http://securityaffairs.co/wordpress/30498/cyber-crime/sony-pictures-corporate-network-compromised-major-attack.html;http://bits.blogs.nytimes.com/2014/11/25/sony-pictures-computers-down-for-a-second-day-after-network-breach/?_r=1;http://www.theregister.co.uk/2014/11/25/sony_pictures_in_it_lockdown_after_alleged_hacker_hosing/;http://www.dailymail.co.uk/news/article-2852786/Spider-Man-studio-gets-stuck-web-Hackers-attack-Sony-Pictures-claiming-stolen-private-information-Angelina-Jolie-Cameron-Diaz.html;http://www.foxnews.com/tech/2014/12/01/sony-pictures-reportedly-investigating-whether-north-korea-hacked-studio/;http://deadline.com/2014/11/sony-computers-hacked-skull-message-1201295288/;http://deadline.com/2014/11/fury-annie-sony-leaked-piracy-hack-attack-1201302289/;http://www.cnet.com/news/sony-hack-said-to-leak-47000-social-security-numbers-celebrity-data/"},{"fetched_at":null,"title":null,"type":"press","url":"http://mashable.com/2014/11/25/sony-pictures-hack-inside/;http://securityaffairs.co/wordpress/30498/cyber-crime/sony-pictures-corporate-network-compromised-major-attack.html;http://bits.blogs.nytimes.com/2014/11/25/sony-pictures-computers-down-for-a-second-day-after-network-breach/?_r=1;http://www.theregister.co.uk/2014/11/25/sony_pictures_in_it_lockdown_after_alleged_hacker_hosing/;http://www.dailymail.co.uk/news/article-2852786/Spider-Man-studio-gets-stuck-web-Hackers-attack-Sony-Pictures-claiming-stolen-private-information-Angelina-Jolie-Cameron-Diaz.html;http://www.foxnews.com/tech/2014/12/01/sony-pictures-reportedly-investigating-whether-north-korea-hacked-studio/;http://deadline.com/2014/11/sony-computers-hacked-skull-message-1201295288/;http://deadline.com/2014/11/fury-annie-sony-leaked-piracy-hack-attack-1201302289/"}],"summary":"Unknown hacker used unknown attack to gain access to Sony Pictures. Released movies to the Internet that had not been in theaters yet. Also release internal documents with salary information and employee SSNs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"185af68a7c48df477c138b5869c5dca5f205aba7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88AF078E-0ADD-4054-86DB-3955E30FAEB6"},"incident_date":"2014-11-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fd0f6cb3c70","org_name":"Northfield Hospital & Clinics","org_type":"healthcare","ransomware":null,"records_affected":1778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Improper disposal of records exposes 1778.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-25","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7aed33fe57c05edc4b9a47e4260d74d2ddbe592","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-10-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice_M868_v02_0.pdf"},"notes":null,"org_country":"US","org_id":"9c0eab5e65f5","org_name":"Godiva Chocolatier","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47593"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice_M868_v02_0.pdf"}],"summary":"A suitcase containing a Godiva employee laptop was stolen from a rental car, and the laptop may have contained employees’ personal information.","supporting_quote":"On October 16, 2014, we learned that a suitcase was stolen from a rental car that a human resources employee was using to visit Godiva’s retail stores that day.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deaff9d1093bf2ae5f5f9d0b18eefde1a27183ef","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05DE5580-974B-410E-A9B4-FCB6293E6E06"},"incident_date":"2014-11-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c91c9a37041c","org_name":"Fraser Health Authority","org_type":"healthcare","ransomware":null,"records_affected":121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.msn.com/en-ca/news/canada/personal-details-of-121-home-care-clients-lost-in-surrey/ar-AA6URMY;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vancouversun.com/health/Personal+details+home+care+clients+lost+Surrey/10360008/story.html#__federated=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.surreyleader.com/news/282484151.html"}],"summary":"The Fraser Health Authority has told 121 home care clients that a book containing their personal information has mysteriously disappeared.  The names, addresses and telephone numbers of the clients  mostly seniors who need care at home  were listed for all 121. Fifty-eight client","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f9c7a78272b7b841e39d52a6bb163f24a53bca3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A709F818-004D-4388-BF34-5939CDDB32BE"},"incident_date":"2014-11-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e248b399d0d","org_name":"EMCOR Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/stolen-emcor-services-laptop-contained-social-security-numbers-other-data/article/388422/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Breach%20letter%20final%2012%2011%2014_0.pdf?"}],"summary":"Stolen EMCOR Services laptop contained Social Security numbers, other data.  Names, addresses, genders, ethnicities, dates of birth, dates of hire, salaries and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"665dfa1a846bda2b51a5a3b3699242ed3aff3d1e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAE3EE16-409E-4D79-9683-DDE997E0AE77"},"incident_date":"2014-11-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09a1157a7234","org_name":"Physicians Skin & Weight Centers","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/physicians-skin-weight-centers-notifies-patients-after-laptop-and-hard-drive-stolen-from-employees-car/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-47861"}],"summary":"On November 4, 2014, an employees vehicle was broken into in Fresno, California and a password protected laptop and external hard drive were stolen from the vehicle. Fortunately, the theft was discovered within an hour of its occurrence and the Fresno Police Department was immedi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59e4779c2085815a61e28ee9a3a17e8b59a73bd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D896469-955B-4B82-B16A-238170C8C3A8"},"incident_date":"2014-11-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"338d203c306f","org_name":"The Medical Center of Aurora","org_type":"healthcare","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/01/08/phi-exposed-in-colorado-through-discharge-paperwork/"}],"summary":"A patient who was recently discharged from The Medical Center of Aurora claims that she was also given the medical information of 20 other patients in her file. The Colorado-based hospital allegedly gave Karen Billings seven pages of operating room records after her Nov. 22 hospi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78363791aebc9164419ddac0fcd1a969fa8c9624","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"357161A6-5824-4188-A072-F1834773F42F"},"incident_date":"2014-11-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35d744721823","org_name":"Harel Chiropractic Clinic","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hudsonstarobserver.com/news/3664579-harel-chiropractic-clinic-hudson-notifies-patients-breach-unsecured-personal;"},{"fetched_at":null,"title":null,"type":"press","url":"http://dailyinbox.com/wisconsin-chiropractic-clinic-reports-security-breach/"}],"summary":"Harel Chiropractic Clinic of Hudson notified approximately 3,000 patients Tuesday of a breach of unsecured personal patient information after discovering the following event. The following information was sent in a news release:  Recommended for you Hudson Chamber welcomes Army C","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"603d00a87f67ab255c1597d00d1d101c01d982f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE0812A0-7FA1-4546-90B3-B66857CF2A36"},"incident_date":"2014-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7a44bfa02ba","org_name":"Life Care Center of Attleboro","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/phi-data-breach-announced-following-audit/"}],"summary":"Life Care Center of Attleboro in Massachusetts posted two separate announcements on its website about a potential PHI data breach after the company that stores its patient records could not find certain documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"BlueCross BlueShield","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eb01eff63106cbbd9b5650f62704173e9d36142","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73E9C889-EC8E-4236-9BD3-E55D56C2B8CD"},"incident_date":"2014-11-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"191376fa6083","org_name":"TRH Health Plan","org_type":"financial","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/money/industries/health-care/2015/01/13/bluecross-blueshield-mailing-violates-act/21718185/;http://columbiadailyherald.com/news/business/trh-health-announces-data-breach"}],"summary":"BlueCross BlueShield of Tennessee, which currently performs limited administrative services for certain health care plans offered by TRH Health Plans, recently used and disclosed a limited amount of TRH member Protected Health Information in an unauthorized and inappropriate mann","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse","derived":{"actor_id":"bluecrossblueshield"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"297d9e7a06b0696f1c0f55a9cd50bcdebd87e8a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6170DADB-046C-4094-9DD4-7FB05E36C459"},"incident_date":"2014-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65ffddda5846","org_name":"Senior Health Partners","org_type":"financial","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/senior-health-partners-shp-a-healthfirst-company-provides-notice-of-data-security-incident-300028811.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/Senior-Service-Breached-Offers-Protection-49747-1.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/stolen-devices-contained-data-2700-senior-health-partners-members-notified/article/396221/"}],"summary":"Senior Health Partners (SHP), a Healthfirst company, is today notifying approximately 2,700 of its members that a laptop and smartphone belonging to an assessment nurse employed by Premier Home Health (\"Premier\"), a business associate, were stolen from the nurse's apartment. SHP ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-11-14","discovered_date":"2014-09-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"baf3594170eb8643e0a37641f7d0d4c86dcd1024","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/3041402_1_0.pdf"},"notes":null,"org_country":"US","org_id":"98f9af94c349","org_name":"Reeve-Woods Eye Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47505"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/3041402_1_0.pdf"}],"summary":"Reeve-Woods Eye Center discovered malware on two computers that captured screenshots containing patients’ protected health information; it had no evidence that the information was viewed or used by a third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e047f8d65f68d16bdea568118e55e35eca51af1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22AE3EF1-3EF4-43EB-85B0-A42482CE2E09"},"incident_date":"2014-11-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46809ddcdaad","org_name":"Colorado River Indian Tribes","org_type":"government","ransomware":null,"records_affected":1296,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"email misdelivery of phi.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7182e5ac30fd6b1f377b2c3ef56dc5bb85a5f925","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A84AA087-52B6-46DF-B4E9-BBEB4F1BF8C7"},"incident_date":"2014-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a401aa0172b","org_name":"ST. PETER'S HEALTH PARTNERS","org_type":"healthcare","ransomware":null,"records_affected":5117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesunion.com/news/article/St-Peter-s-Health-Partners-warns-of-possible-6035391.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/albany/blog/health-care/2015/01/st-peters-health-partners-reports-potential-data.html"}],"summary":"St. Peter's Health Partners, the Albany, New York region's largest hospital system, is notifying 5,117 of its patients that some information about them was involved in a potential data breach after a manager's cellphone was stolen. The incident affected patients at St. Peter's Me","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb464aa20af5f50116a9604fc6d940b97dc5e20a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"180A2319-FAF4-4AA6-B1F3-AECDB4BBEC3B"},"incident_date":"2014-11-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fca096651dc","org_name":"Visionworks Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":74944,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of a server exposes 74944 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23e7f063f62e266063a50b296e3de6ecdd9586b1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CC4DBB7-F0D5-49F9-A3DC-115B11A7753D"},"incident_date":"2014-11-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"915c75c9197b","org_name":"Acosta Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/A6701_LV2_PRF_ADULT_NON-MASS_0.PDF"}],"summary":"Acosta Inc. had one of its employees personal vehicles broken into.  A company laptop was one of the items taken during the burglary.  Of course the laptop was password protected, but there is no mention of encryption.  They will be offering a free year of credit monitoring. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af5f80c2795a4762f0f48f1e3f23a12b40c941f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35ADB6D4-E3C8-4C15-ADFE-7F0A59BFC347"},"incident_date":"2014-11-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"334737e5d532","org_name":"DJO Global","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/yet-another-california-entity-notifies-patients-of-a-laptop-stolen-from-a-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/news/stories/S3667234.shtml;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notices%20Template%2012.24.14_0.pdf?"}],"summary":"An alert about a data breach involving an orthopedic medical device company in Shoreview affects not only Minnesotans, but others across the country as well. A contractor for the company DJO Global went inside a coffee shop in Roseville on Nov. 7 and left a laptop containing priv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deb45651fc781da97566ed79729d3fa99acf293e","impact_type":"data_theft","imported_from":null,"incident_date":"2013-05-30","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"a1d6cd43ed54","org_name":"AhaShare.com","org_type":"other","ransomware":null,"records_affected":180468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: AhaShare.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/AhaShare"}],"summary":"AhaShare.com user accounts and personal information, including IP addresses, were published publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac8a2a0b34f278040a7a7718c84effd0d141e5f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"529D58DD-6F30-485F-8AD0-CA40FC41724F"},"incident_date":"2014-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9f953d4d12e","org_name":"N/A","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wusa9.com/story/news/politics/elections/2014/11/04/voter-information-laptop-stolen-se-dc/18455153/"}],"summary":"Laptops were stolen from the Davis Elementary voting precinct in Southeast Washington D.C. The laptops contained voter information. Board of Elections claims no information can be obtained without a connection to the BOE network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e35fc2b1bade2cf3d215cf4a37b593475ca0608","impact_type":"unknown","incident_date":"2014-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/final%20letter%20sent%20to%20members_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d65aa6a56762","org_name":"Palm Springs Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47289"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"498c5cf87223b96e83efaf4414874b6af13092e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF54FCE2-80B0-4D17-A6EA-AEA2549C101C"},"incident_date":"2014-12-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1451724382a","org_name":"Clay County Hospital","org_type":"healthcare","ransomware":null,"records_affected":12621,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/2859952/illinois-hospital-reports-data-blackmail.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/clay-county-hospital-patient-information-compromised-300009670.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.modernhealthcare.com/article/20141217/NEWS/312179948"}],"summary":"Unauthorized access results in exposure of 12621 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09aae7145b6fab5738b5825be62f2abfbe665646","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"318074E2-982C-49A7-A5C1-05C20A4175C2"},"incident_date":"2014-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"25ca14c56090","org_name":"Winnipeg police officer","org_type":"government","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/iteam/police-officer-health-snooping-winnipeg-1.3554187"}],"summary":"Police officer accessed medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1b55b42ebdc650e4d4cec74e5d7f90a076472f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"604B416A-6EC4-4FC6-9914-9D4538021CB1"},"incident_date":"2014-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dab2adc4441a","org_name":"WellPoint, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2014/11/13/wellpoint-emails-idUSL2N0T22H120141113"}],"summary":"Some WellPoint Inc customers got a surprise in their inbox this week: emails meant to remind them to get a specific preventative screening such as a colonoscopy or mammogram mistakenly included personal and health information in the subject line.  WellPoint declined to say how ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d003cf03b653357f4652696f9bad6d5bdf0510dc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34E0F39C-3F0C-434C-9D4A-3D3E5676D626"},"incident_date":"2014-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"32dbb1569c25","org_name":"Tesco Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thecourier.co.uk/news/local/fife/cash-machine-skimming-devices-found-in-cupar-1.158764"}],"summary":"Police found a skimming device on a cash point at a Tesco store in Cupar.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8091ba76dad4dee065f1b6d36e3e3802f37b374","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f6feaf40-c593-11e7-8053-ff1e84d2b694"},"incident_date":"2014-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"aa7cd27ae4bd","org_name":"Stanton Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":4095,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/stanton-doctor-loses-usb-stick-with-4-000-patients-information-1.2852237"}],"summary":"The CEO of Yellowknife's Stanton Territorial Hospital is apologizing after a doctor there lost a USB stick containing the names, birth dates and health card numbers for thousands of Stanton Medical Clinic patients earlier this month.  Two weeks ago, a doctor was working on consul","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9693e0057113302290fc00bb9359bd48b2755d83","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB69C761-5992-4B53-AA85-C352D456DC06"},"incident_date":"2014-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68c481f113d8","org_name":"Sheehan Pipe Line and Construction Co","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://westmorelandtimes.com/news/17585/24/pipeline-company-field-office-manager-charged-with-fraud-identity-theft/"}],"summary":"Office manager misused access to forge payroll checks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1da54ddef170f7e599ddd908e1a75750d76c27","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"857E42B8-2B30-4915-9199-B311FCF5E2DF"},"incident_date":"2014-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"96ecfee0331b","org_name":"Province of Manitoba","org_type":"government","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegfreepress.com/local/province-investigating-after-health-records-breached-282675661.html"}],"summary":"POLICE could get involved after a former provincial employee inappropriately accessed the personal health information of at least 13 people. The breach of the Personal Health Information Act involved the province's Drug Programs Information Network computer system, said Bernadett","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6a36ec79b8af358766b78a812f79fc05b02ef20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBFC0D84-A774-4143-8205-2F0A2D37F9EF"},"incident_date":"2014-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e3281a15521e","org_name":"Pharmacy2U","org_type":"retail_ecommerce","ransomware":null,"records_affected":34000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techdirt.com/articles/20151020/10093632577/giant-uk-pharmacy-fined-selling-patient-data-to-scammers.shtml;https://www.databreaches.net/uk-online-pharmacy-pharmacy2u-fined-130000-for-selling-customer-details/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/news/uk/crime/pharmacy2u-nhs-approved-pharmacy-fined-130000-for-selling-patients-details-without-their-consent-a6701411.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/media/action-weve-taken/mpns/1433030/pharmacy2u-ltd-monetary-penalty-notice.pdf"}],"summary":"Put simply, a reputable company has made a serious error of judgement, and today faces the consequences of that. It should send out a clear message to other companies that the customer data they hold is not theirs to do with as they wish.  \"Once people's personal information has ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21db03833d447cb984e709b45fad3a8f0c22b4d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B4B9338-2CE9-4093-B8DF-148DF54A884C"},"incident_date":"2014-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c9c5d98b75c","org_name":"Partners Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcvb.com/health/patient-information-may-have-been-accessed-in-health-care-data-breach/32667428"},{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/Technology/wireStory/partners-healthcare-notifies-3300-patients-email-breach-30716877"}],"summary":"Employees of Partners Healthcare System received phishing emails which led to a data breach of patient information. The information was accessed but it is not known if any of the data was misused.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1151a500ac313e5d8a30a0f9dc90727c8199b05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93355071-8E52-49F8-9276-92AE669F0FED"},"incident_date":"2014-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"e7972655293b","org_name":"North Shore Hospital","org_type":"healthcare","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/auckland/10726343/Confidential-notes-found-on-driveway"}],"summary":"Confidential information found on a residential driveway has breached the privacy of 11 North Shore Hospital patients.  A document with information including the names, gender, age, national health insurance number, diagnosis and additional notes was found stuck to a Forrest Hill","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86896d348ce14db9daa18606f08d4e306ba02b7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51F19EB8-D7F8-4269-9F37-3EB28EC193E5"},"incident_date":"2014-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"89fc36c6abe6","org_name":"Manitoba Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://winnipeg.ctvnews.ca/charge-laid-against-manitoba-health-employee-accused-of-inappropriately-accessing-health-information-1.2869134;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegfreepress.com/local/ombudsman-lays-snooping-charge-against-former-provincial-employee-376431751.html"}],"summary":"Charge laid against Manitoba Health employee accused of inappropriately accessing health information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"234bb0e760dc17104e1819e646ab9be270ed56ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF861519-9AB9-4A3E-8A88-EB94331A2D3E"},"incident_date":"2014-11-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d29ce5d822e","org_name":"Hilton Hotels Holdings LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/"}],"summary":"Hackers are getting into Hilton rewards site and cashing out rewards points.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa12a7feb23ab2a2eafcd47fd2716ca587c0f648","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0D96EA2-E65C-4F16-82FD-8170E5CDB6A5"},"incident_date":"2014-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"7313b23d4166","org_name":"Health Service Executive","org_type":"healthcare","ransomware":null,"records_affected":180,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breakingnews.ie/ireland/laptop-containing-childrens-details-stolen-from-hse-staff-member-650798.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.highlandradio.com/2014/11/12/parents-warned-of-data-protection-breach-after-hse-laptop-is-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.highlandradio.com/2014/11/13/hse-confirms-details-of-180-children-were-on-stolen-laptop/"}],"summary":"A laptop containing the details of a number of children attending HSE Speech and Language Therapy services in Donegal has been stolen. It has emerged the laptop was taken from the boot of a staff member's car. Garda_ have launched an investigation. It is being reported that the p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc733891c164e8d5b1779320b297ccbda7fa8d83","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6952E457-25BB-4643-80BD-E5DAA0B6B40D"},"incident_date":"2014-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23899c15d2c0","org_name":"Groveland City","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickorlando.com/news/files-stolen-from-suv-issued-to-groveland-city-manager/29580180"}],"summary":"A Groveland City vehicle was broken into while unlocked in a city managers driveway. Confidential city files, paychecks, a flash drive, and a laptop were taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41b2645bf867cf0dbc329edf5f8e8a888c811ad9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB4AB0A6-0858-4090-81BE-6B587075F87F"},"incident_date":"2014-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b8032959948","org_name":"Dr. Huyen Nguyen and Dr. Orlando Kypuros","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksat.com/content/pns/ksat/news/2014/11/03/medical-documents-found-in-recycling-dumpster.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksat.com/content/dam/pns/ksat/news/2014/11/03/NGUYEN_KYPUROS_STATEMENT.pdf"}],"summary":"A box full of medical documents containing sensitive personal information from patients that was found in a recycling dumpster sparked a KSAT-12 Defenders investigation.  A good Samaritan alerted the Defenders to the dumpster outside a church in Alamo Heights.  Inside was a treas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72e8a2d3f52f6cba11c3f754f361c967f5a59d4d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B186952-BF4D-4E2D-BCFF-84A447A0B552"},"incident_date":"2014-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"aaff4cb55bd2","org_name":"Doctor Howard Libstug","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/1664109/dentists-patient-information-found-scattered-on-toronto-street/"}],"summary":"Ontarios acting privacy commissioner is concerned after documents containing personal patient information were recently found scattered across a Toronto neighbourhood.  Dozens of papers with patient names, addresses, phone numbers and social insurance numbers were found near Lesl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bd32f1858100aa1e9811a2e9f3b68fc3edaad81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36EB0A1F-0C0B-4136-B4EC-F948CF7E3322"},"incident_date":"2014-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b408b7299439","org_name":"Digital Extremes","org_type":"technology_saas","ransomware":null,"records_affected":775749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://motherboard.vice.com/read/gaming-site-warframe-hacked;"},{"fetched_at":null,"title":null,"type":"press","url":"http://en.yibada.com/articles/144499/20160723/digital-extreme-admits-warframe-hack-2014-2fa-system-implemented-protect.htm"}],"summary":"'Warframe' Hacked, Details on 775,000 Players Traded","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6256b14db58399a16e3a4f089f63d79ce4ec712d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FB608BA-B39A-4398-AB20-A0286EECC62E"},"incident_date":"2014-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f933d055cced","org_name":"Calgary Board of Education","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/2060359/calgary-teen-charged-in-public-school-board-student-data-hack/"}],"summary":"CALGARY __ A 15-year-old Calgary teen has been arrested and charged with hacking into public school board servers between November 2014 and March 2015.     Advertisement          Related   _ cbe Hacking scare at Calgary public school board     _ Anonymous, founded in 2003, operat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cae5cd5bfaf01be1620b97397e4ccc8501d330e1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E095DF18-480D-49CB-A613-515BE9367F32"},"incident_date":"2014-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"177eecf31fc0","org_name":"Aspire Indiana","org_type":"healthcare","ransomware":null,"records_affected":45030,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clinical-innovation.com/topics/privacy-security/indiana-breach-impacts-45k;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bcicomputers.com/45k-lose-data-due-lack-encryption/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Over-45-000-Aspire-Indiana-Employees-and-Customers-Have-Data-Exposed-472674.shtml"}],"summary":"An Indiana mental health organization is sending out HIPAA breach notification letters to about 45,000 people after one of its providers failed to encrypt laptops containing clients' medical data and Social Security numbers.  Several laptops were stolen from the administrative of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2014-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fb660d4ad28dd6a2fce3a71723f2fa7f3d01393","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D65C538-0DD9-4124-B483-0742DBF777C3"},"incident_date":"2014-12-10","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb9c47480263","org_name":"Anthem Blue Cross","org_type":"financial","ransomware":null,"records_affected":80000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2015/02/05/us-anthem-cybersecurity-idUSKBN0L907J20150205?feedType=RSS&feedName=technologyNews;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2015/02/06/us-anthem-cybersecurity-warning-idUSKBN0LA24F20150206?feedType=RSS&feedName=technologyNews;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/anthems-notification-letter-to-affected-members/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ahcmedia.com/articles/134824;"},{"fetched_at":null,"title":null,"type":"press","url":"http://bits.blogs.nytimes.com/2014/11/10/oops-health-insurer-exposes-member-data/?_r=0"}],"summary":"On January 29, 2015, Anthem, Inc. (Anthem) discovered that cyber attackers executed a sophisticated attack to gain unauthorized access to Anthems IT system and obtained personal information relating to consumers who were or are currently covered by Anthem or other independent Blu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85daa8b0fe0ce369cb843a8deb203ff4a0fe069f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b1c613c4a5e5","org_name":"US Investigations Services, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47193"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice_0.pdf"}],"summary":"US Investigations Services, LLC sent a consumer notification letter offering identity-theft protection services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"630b1e4aac38e4c8d02716d2a57623db1dc0cb76","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EWB%20Consumer%20Kmart_DB_10%2027%2014_SAMPLE_0.pdf"},"notes":null,"org_country":"US","org_id":"aeee36a6330a","org_name":"East West Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47156"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EWB%20Consumer%20Kmart_DB_10%2027%2014_SAMPLE_0.pdf"}],"summary":"East West Bank notified customers whose debit cards were used at Kmart during a period when Kmart reported unauthorized access to its payment data systems, with theft not yet determined.","supporting_quote":null,"technology_involved":["payment data systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-10-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0cabbfa4f7dbaddc21e818fe7ec783da7481c1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BF059D0-ED8F-467E-8918-2CD5B8114B6A"},"incident_date":"2014-10-24","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa77b0992868","org_name":"Inputs.io","org_type":"other","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techienews.co.uk/972801/secure-bitcoin-wallet-inputs-io-hacked-unable-pay-user-balances/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Bitcoin-Wallet-Inputs-io-Hacked-4-100-BTC-Stolen-397853.shtml"}],"summary":"Inputs.io has been hacked with total of 4100 BTC siphoned off.  The attacker managed to compromise the hosting account of input.io through the use of an old email address, which didnt have any phone numbers attached to it. The attacker was able to bypass 2FA due to a flaw on the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a889df31408147ac69b8e3d65a349e7c53493fe","impact_type":"unknown","incident_date":"2014-04-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20NotificationLetter%20Proof_2014%20Incident_0.pdf"},"notes":null,"org_country":"US","org_id":"89d4f41f603d","org_name":"Fidelity National Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47112"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20NotificationLetter%20Proof_2014%20Incident_0.pdf"}],"summary":"Fidelity National Financial notified people of an incident involving personal information and said it enhanced security measures for employees’ email accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-10-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c0e979dd1f123da7bed39675c6e1e11fc1438f8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"822E762C-8DBC-4DD0-83DE-C910B436B7F5"},"incident_date":"2014-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"8833d58a923d","org_name":"Warsaw Stock Exchange","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/policy/cybersecurity/221806-hackers-breach-the-warsaw-stock-exchange?utm_term=OSINT&utm_source=twitterfeed&utm_medium=twitter"}],"summary":"Warsaw stock exchange was hacked by activist group; credentials were posted on Pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2014-10-23","discovered_date":"2014-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50f639c9f0f1bcb4cfee8ba72789ce2f81e38fe9","impact_type":"data_theft","incident_date":"2013-03-31","initial_access":"malware_other","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/222309%20Reeves%20%28Non-Mass%29_0.pdf"},"notes":null,"org_country":"US","org_id":"21957eedc1cc","org_name":"Reeves International, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47096"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/222309%20Reeves%20%28Non-Mass%29_0.pdf"}],"summary":"Reeves International reported that unauthorized individuals installed malicious software on the server hosting the Breyer Horses website and took customers’ personal data.","supporting_quote":"On September 9, 2014, we learned that unauthorized individuals installed malicious software on the computer server hosting the Breyer Horses website and took certain personal data entered by our customers.","technology_involved":["Breyer Horses website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c19fd51a83009179639399af9c2d32b374a6a10","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F71DFA6-CEDF-4B1B-9B72-69F98409D9F0"},"incident_date":"2014-10-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51c80cccf6e8","org_name":"Multilingual Psychotherapy Centers","org_type":"healthcare","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-psychotherapy-center-notifies-patients-of-stolen-server/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wp-content/uploads/Data-breach-letter-request..pdf"}],"summary":"One of the breaches recently added to HHSs public breach tool involved Multilingual Psychotherapy Centers, Inc.in Florida.  PHIprivacy.net spoke with them about the incident and obtained a redacted copy of their notification letter to patients.  According to their October 23rd le","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-10-23","discovered_date":"2014-10-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d5d2110fe0bb0b8eb69d422ae2b97d5dc9fbb3","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Security%20Breach%20Oct%2023%2C%202014_0.pdf"},"notes":null,"org_country":"US","org_id":"e0ec38fdc79d","org_name":"American Soccer Company, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47102"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Security%20Breach%20Oct%2023%2C%202014_0.pdf"}],"summary":"American Soccer Company, Inc. reported that information from customers who ordered through its website was compromised.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40ebb2febc9a6f52f8060ea1b47a596e42fbbee7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1CBA3E5-4B4A-4E41-A348-0BF8FDEA1C05"},"incident_date":"2014-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3089636d018c","org_name":"Backcountry Gear","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itgovernanceusa.com/blog/backcountry-gear-hit-with-payment-data-breach-twice-in-three-months/"}],"summary":"Hackers installed malware and stole payment information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5bf40071f22ad4cf1ff8a98d421e8eaea4e7acf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0BE107A-893F-45B8-9E44-B89E2E4FA7BC"},"incident_date":"2014-10-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ddc2b9978ab","org_name":"Northwestern Memorial HealthCare","org_type":"healthcare","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcchicago.com/news/local/Northwestern-Says-Stolen-Laptop-Contained-Patient-Information-286458071.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/northwestern-memorial-reports-stolen-laptop-notifies-2-800-patients-of-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/northwestern-memorial-healthcare-laptop-stolen-patient-data-at-risk/article/389596/"}],"summary":"A Northwestern Memorial HealthCare (NMHC) laptop was stolen from an employee's vehicle, putting Northwestern Lake Forest Hospital, Northwestern Memorial Hospital, and Northwestern Medical Group patient data at risk.  How many victims? 2,800, according to reports.   What type of p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"899f357eecb105aa4e54867b58ea04db681f4f1a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"602AFBE0-3364-4903-9101-4580188C5E01"},"incident_date":"2014-10-21","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2fd1e17c52a","org_name":"California Pacific Medical Center","org_type":"healthcare","ransomware":null,"records_affected":844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/01/26/potential-healthcare-data-breaches-in-ny-and-calif/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cpmc.org/about/press/News2015/phi.html"}],"summary":"California Pacific Medical Center (CPMC) recently notified 844 patients of its discovery that a pharmacist employee may have accessed their records without a business or treatment purpose.   CPMC first learned of the incident through a proactive audit of its electronic medical re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e920f850e8e914a1daf8cfbfa4a31896e65aa1c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"619D0EDC-D415-479F-93F0-2FF9AB9B5F91"},"incident_date":"2014-11-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0adb6c297faa","org_name":"Baptist Primary Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1449,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2014-Breaches-Matrix.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.actionnewsjax.com/news/news/local/baptist-primary-care-former-employee-found-patient/njGBn/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baptistjax.com/doctors/baptist-primary-care/notice;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-baptist-primary-care-former-employee-found-with-patient-information-during-traffic-stop/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/update-baptist-primary-care-employee-stole-1449-patients-info/"}],"summary":"Patient names, dates of birth, and Social Security numbers stolen by an employee and used to commit identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-10-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd1c796dc4903f259ad55b7ef0ef43f8cf56ce95","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter_3.pdf"},"notes":null,"org_country":"US","org_id":"d83069c83fb6","org_name":"Sourcebooks, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47029"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter_3.pdf"}],"summary":"Sourcebooks reported unauthorized access to customer information through the shopping cart software supporting its website.","supporting_quote":null,"technology_involved":["shopping cart software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fe17d3918e6fecb659ed7a2e94c6651685cdca3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"465B29EC-81DE-4FFC-9879-2DE870153276"},"incident_date":"2014-10-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lethbridgeherald.com/news/local-news/2014/10/31/theft-of-laptop-from-sleep-clinic-being-investigated-by-ahs/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.brandonsun.com/lifestyles/breaking-news/alberta-health-services-dealing-with-another-stolen-laptop-with-patient-info-281098612.html?thx=y;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/laptop-stolen-from-lethbridge-clinic-had-patient-information-ahs-says-1.2819982?cmp=rss"}],"summary":"Alberta Health Services (AHS) is notifying approximately 5,000 patients after a laptop was stolen from a local clinic. The laptop, stolen from the Lethbridge Sleep Clinic on Oct. 17,  was not owned by AHS and not connected to any AHS network. The laptop contained a database with ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f381ac326da6662b3f8aca530c8948683159194f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47627A25-A50D-4E68-B887-8F44C03E02BF"},"incident_date":"2014-10-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"500c0b07e6d9","org_name":"Virginia Commonwealth University Health System","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/virginia-commonwealth-university-health-system-notifies-patients-after-discovering-cds-with-patient-info-had-been-donated-for-childrens-art-projects/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://literockz951.com/news/064460-vcu-medical-center-investigates-possible-security-breach/"}],"summary":"Information on Privacy Incident The Virginia Commonwealth University Health System (VCUHS) said today that it has notified certain patients about a recent incident involving the security of some patient information. VCUHS has mailed letters to notify patients who may have been af","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b4a8ef9606981c959556ae4b3bb30d1c8c5b493","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"039A534F-A945-4181-B9DB-3838893BE14E"},"incident_date":"2014-10-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe86a6f30dd5","org_name":"Graybill Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft results in the exposure of 1863 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ea087fdb61909e1344f386130b2e0e371350f45","impact_type":"unknown","incident_date":"2014-05-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notice%20Letter%20%28Cyberswim%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c1fd22e1b005","org_name":"Cyberswim, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46986"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-10-13","discovered_date":"2014-09-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a397b5d06b30d58362a9e3d2ffdd8f7d76ea7635","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Template%2014-503c_0.pdf"},"notes":null,"org_country":"US","org_id":"bd996abb4da3","org_name":"University of California Davis Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46960"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Template%2014-503c_0.pdf"}],"summary":"A provider’s email account was compromised, potentially exposing patient information included in the account.","supporting_quote":null,"technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c4940289a25ddab6ecd729c0887e557600e77b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0fe6a70-0b76-11e8-827c-bba53cbad290"},"incident_date":"2014-10-13","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"483a5cd860a7","org_name":"InterContinental Hotel Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/US-Secret-Service-Alerts-InterContinental-Hotel-Group-of-Data-Breach-480663.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tn-manchester-hotel-hospitality-first-notifies-customers-of-breach-ihg-knew-about-months-ago/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://uk.reuters.com/article/us-intercontinental-cyber-idUKKBN15I2VZ;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/bayarea/article/Top-of-the-Mark-other-local-IHG-properties-hit-10909831.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc7chicago.com/finance/michael-jordans-steak-house-intercontinental-bar-report-data-breach/1742127/;"}],"summary":"Cities Service received a notification from the InterContinental Hotel Group (IHG) it is part of, regarding a possible compromise of its payment processing systems at its Holiday Inn Express & Suites hotel in Sulphur, Louisiana.  IHG was alerted of the breach by the US Secret Ser","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-10-09","discovered_date":"2014-09-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc8e49de7ea9a1b6592387913c7405affcf29055","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Template%20%28Standard%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a8b44465dcae","org_name":"The Evolution Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46935"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Template%20%28Standard%29_0.pdf"}],"summary":"Unauthorized IP addresses used administrative credentials to access The Evolution Store’s e-commerce site, exposing customer order and personal and payment information.","supporting_quote":"During this investigation, on September 16, 2014, Stroz confirmed that the administrative section of Evolution’s e-commerce site was accessed by unauthorized IP addresses using administrative credentials, and that customer order information was exposed.","technology_involved":["e-commerce site"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92bf3af2108c7b8ca329f46023d755fcc016d1f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3E5917D-8912-4005-9D39-F2D975F6F316"},"incident_date":"2014-10-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a65ecb180a35","org_name":"ReachOut Home Care","org_type":"healthcare","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"ReachOut Home Care in Kentucky reported that 4,500 patients had PHI on a laptop that was stolen on October 9th. Their statement from their web site:  ReachOut Home Care customers in Texas notified of security breach  Unencrypted computer stolen from office facility contained pati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"437366f4bfde4e0e272ec661ef1387fc750cf08b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34C2B022-698F-4CEB-BD9B-7EDB2DE3439E"},"incident_date":"2014-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4812c30435b7","org_name":"Queen Elizabeth II Sciences Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thechronicleherald.ca/metro/1249356-abbie-lane-hairdresser-devastated-over-firing"}],"summary":"A woman who has cut veterans hair in a Halifax hospital for two decades says shes been unfairly fired for allegedly looking at patients charts.  Sandy Innocent operated Sandys Salon on the main floor of the Abbie J. Lane Memorial Building but said she was let go Oct. 9 after bein","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85fe695e8107e16b8c588b5bf069254c2f3c07de","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Attachments_0.pdf"},"notes":null,"org_country":"US","org_id":"c67b5bc2faf9","org_name":"International Dairy Queen, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46950"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Attachments_0.pdf"}],"summary":"International Dairy Queen notified customers who used payment cards at nine California franchise locations during the listed periods of a data security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8039271e949ca7761b5357bf53d68038ad6ebda8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB3EFDE2-A2C4-47DE-AEF5-499C7B72F940"},"incident_date":"2014-10-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1be7f0166bd4","org_name":"Herts Police","org_type":"government","ransomware":null,"records_affected":61,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hertsad.co.uk/news/st_albans_cases_highlighted_by_probe_into_data_breaches_by_police_and_health_trust_1_3825602"}],"summary":"An investigation has been launched into recent embarrassing data breaches following confessions by the police and the health chiefs who run St Albans hospital.  Confidential data from anti-social behaviour cases appeared on the Herts Police local priorities pages on the Home Offi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0f090a6f26593fb9f6ff555f5a0e06b16633506","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD3E4EC0-11E7-4F2C-AE4C-AE00B86C1E5A"},"incident_date":"2014-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d49c6cae7335","org_name":"Calypso St. Barth","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ago.vermont.gov/assets/files/Consumer/Security_Breach/2012-11-26%20Calypso%20St.%20Barth%20ltrt%20Consumer%20re%20Security%20Breach.pdf"}],"summary":"On October 11, 2014, Calypso St. Barth became aware of recent hacking activity into its e-commerce website by an unknown third party between October 9, 2014 and October 22, 2014.  Forensics confirmed credit card data was potentially accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2786054e07a343cff840ec4bfcc117647df1bbfc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"906C78C4-AA29-415C-B3DB-4780E33B0BED"},"incident_date":"2014-10-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3fcb41a319b","org_name":"The Hearing Zone","org_type":"retail_ecommerce","ransomware":null,"records_affected":623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"The Hearing Zone in Utah reported that 623 patients had PHI on a laptop that was stolen on October 8th.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c890f28a2aae446a1a3cccf4097bd0dd05764c47","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C23E0769-187E-496D-BCB3-015DB74238BC"},"incident_date":"2014-10-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e7777541e7a","org_name":"Department of Employment Oregon","org_type":"government","ransomware":null,"records_affected":851322,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kgw.com/story/news/crime/2014/10/13/cyber-attacks-target-state-of-oregon/17229347/?utm_content=bufferf20eb&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer;http://www.databreachtoday.com/oregon-employment-dept-reports-breach-a-7433;http://www.statesmanjournal.com/story/news/2014/10/11/initial-damage-unknown-employment-department-website-hack/17121433/;http://blog.credit.com/2014/10/job-seekers-may-have-been-exposed-breach-98959/;http://www.esecurityplanet.com/network-security/oregon-employment-department-notifies-851322-people-of-data-breach.html"}],"summary":"Oregon Employment Department Notifies 851,322 People of Data Breach  eports that the Oregon Employment Department recently began notifying 851,322 people that their personal information may have been exposed when the department's WorkSource Oregon Management Information System (W","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7f40058a98857ceb60d296c08c042964374aaa8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C0C29AF-F195-4DE3-BA3F-3161E4E58B82"},"incident_date":"2014-10-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f267b2e8ccef","org_name":"Touchstone Medical Imaging, LLC","org_type":"healthcare","ransomware":null,"records_affected":307528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46850"}],"summary":"Unauthorized access results in the exposure of 307,528 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b5beef1d503559e60fb60ef87045f93063f7fe6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13975080-2145-4164-B1BE-0C3A66E46350"},"incident_date":"2014-10-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95b87c551e7e","org_name":"North Big Horn Hospital","org_type":"healthcare","ransomware":null,"records_affected":1607,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"North Big Horn Hospital in Wyoming reported that 1,607 patients were affected by a breach on October 2nd involving the loss of paper records. So far, I havent found any statement on their site or in news media.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f69766d49adb599c4bbbb2e0a61b56b097f073d6","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EWB%20Consumer%20AB%20Acquisitions_Albertons_DBNotifySample_0.pdf"},"notes":null,"org_country":"US","org_id":"aeee36a6330a","org_name":"East West Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46835"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46831"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EWB%20Consumer%20AB%20Acquisitions_Albertons_DBNotifySample_0.pdf"}],"summary":"East West Bank notified a customer that their debit card was used at an AB Acquisition store during a period of unauthorized access to payment card data, and that it was not yet known whether cardholder data was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"AB Acquisition LLC"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"809a17870779","name":"AB Acquisition LLC"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-02","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21b4d669a72271376f26286f5f317d8c9d0099f1","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FINAL%20Santa%20Cruz%20client%20notification%20letter_1.pdf"},"notes":null,"org_country":"US","org_id":"0828d5f3f512","org_name":"Community Technology Alliance","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46834"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FINAL%20Santa%20Cruz%20client%20notification%20letter_1.pdf"}],"summary":"A laptop containing HMIS data and clients’ personal information was stolen from a vehicle belonging to Community Technology Alliance.","supporting_quote":"On July 28, 2014, criminals broke into a vehicle parked in a public garage and stole a laptop belonging to CTA which contained HMIS data, including some Clients’ personal information.","technology_involved":["laptop","Homeless Management Information Systems (HMIS)"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"904c03ddc488218a955eaa343df965ede3071105","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"174DA458-CFBE-465E-88BB-B5DC5C7A852F"},"incident_date":"2014-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"dd6fc8f9e1a4","org_name":"Vancouver Island Health Authority","org_type":"healthcare","ransomware":null,"records_affected":112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.citopbroker.com/news/health-authority-fires-employees-for-privacy-breach-7375;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.campbellrivermirror.com/news/284102801.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?rct=j&sa=t&url=http://www.vancouversun.com/news/metro/Curiosity%2BIsland%2BHealth%2Bemployees%2Bprivacy%2Bbreach%2Bprobe/10417256/story.html&ct=ga&cd_EYACoTNzI1MTc0OTEzMzIxMDYwMzYyMjIaNzY1Y2U5YTkyODg0NGFlZDpjb206ZW46VVM&usgQjCNEZ4Xlzk7NygzCqQjXfzKHcPa70dg"}],"summary":"Two employees have been fired from Island Health (formerly Vancouver Island Health Authority) after breaching the privacy of 112 individuals using the agencys Electronic Health Record system.  Island Health says they have notified and sincerely apologized to the individuals who w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9b80c72da518a529101f8fe16885f7ef1ccfa0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80ED9BAB-7CC3-48BA-8080-D1FB5893AF61"},"incident_date":"2014-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ede236ae8b4d","org_name":"Sausalito Yacht Club","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.databreaches.net/ca-sausalito-yacht-club-notifies-members-of-breach/;https://oag.ca.gov/system/files/SYC%20Private%20Member%20Information_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46958"}],"summary":"CA: Sausalito Yacht Club notifies members of breach  Business Sector, Hack, U.S. Add comments Oct 13 2014   Well, this is tacky, at best. It appears some members of the Sausalito Yacht Club gained access to the membership roster. From the notification letter of October 4:  We are","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"021a2163faac5332a7db7f16792b363d97f5f9ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5EDAEB8-0425-431C-A325-8B366E8E9FF4"},"incident_date":"2014-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"681c52b256f9","org_name":"Pilot Travel Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.monroenews.com/news/2014/nov/18/police-investigating-credit-card-fraud-monroe-gas-/"}],"summary":"A skimming device was found on a gas pump at the Pilot Travel Center in Monroe County, MI. More than a dozen people complained about fraudulent charges on their cards after using it a the gas pump.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e97e802cd341a1c9fd006712c8eadbddc5d50800","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D305CA4D-0909-4F8B-9BA5-4CC3BEA5D33A"},"incident_date":"2014-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fd0f6cb3c70","org_name":"Northfield Hospital & Clinics","org_type":"healthcare","ransomware":null,"records_affected":1778,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southernminn.com/northfield_news/article_550d4a03-738f-5c89-947d-6e46ed8b4e71.html"}],"summary":"Northfield Hospital & Clinics is in the process of directly notifying 1,778 patients about a recent breach in the handling of protected patient information. The notification stems from an incident over a period of eight days in late October when documents containing protected hea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d45cf265b3d7ef209affa70da7e4e87ba373ba8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3F4951D-0881-4981-AEBD-A9F46497A9A7"},"incident_date":"2014-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4d35c2b0649","org_name":"Macomb County","org_type":"government","ransomware":null,"records_affected":6302,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/macomb-county-michigan-notifies-employees-and-dependents-of-vendor-breach/"}],"summary":"Update: After this entry was posted, PHIprivacy.net received additional information indicating that there were actually two Macomb County Business Associates involved in the provision of the file to the County. One of these two Business Associates is U.S. Health Holdings subsidia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44bd360d2a78b188dbe29b7d555ec26b5bb0dc00","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C862F7E3-905C-4ADD-A00A-F176CB9A85EB"},"incident_date":"2014-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae0562d885c1","org_name":"James Madison University","org_type":"education","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breezejmu.org/news/article_d806545c-8861-11e4-989d-1bb141dcd74d.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jmu.edu/news/computing/2014/12/18-message.shtml"}],"summary":"Breach of college network led to file with 2800 records of employee PII being disclosed. No details of breach have been provided.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a02a81a89d0970ca121fe6f253f3ca7b8d71a43","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E230320B-8422-4FC1-AB49-3B8D7C10A602"},"incident_date":"2014-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba98fd65410a","org_name":"Inland Empire Health Plan","org_type":"financial","ransomware":null,"records_affected":1030,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailybulletin.com/general-news/20150109/iehp-data-breach-may-affect-more-than-1000;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pe.com/articles/health-757916-computer-information.html"}],"summary":"Inland Empire Health Plan suffered a possible breach of medical records after an unencrypted desktop computer was stolen from Childrens Eyewear Sight at 11940 Foothill Blvd.  The computer was reported stolen in October after burglars ransacked the optometry office, representative","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33b19ab5db245397094c7065e16205adf272a2bb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AFFAA89-F46C-423E-8A0A-B3A8C4EC8097"},"incident_date":"2014-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"652dfa7ec301","org_name":"Independence Blue Cross","org_type":"financial","ransomware":null,"records_affected":12500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.philly.com/philly/business/20141227_Old_fashioned_data_breach__Independence_Blue_Cross_paper_records_tossed_in_trash.html"}],"summary":"Independence Blue Cross on Friday disclosed a data breach affecting 12,500 of its more than 2.5 million members.  Unlike most high-profile cases of personal data loss, such as the one at Target stores last year affecting 70 million people, the IBC case did not involve computers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b41468b585d49cae84f1582b04c7cbfa663ade62","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E3165C4-1FC9-4F82-9F8A-081A41183F89"},"incident_date":"2014-10-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f484a583758d","org_name":"Harborview Medical Center","org_type":"healthcare","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wa-90000-patients-of-notified-of-breach-after-employee-opened-an-email-attachment-with-malware/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.geekwire.com/2013/seattle-hospital-discloses-malware-attack-exposes-90000-patient-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/university-of-washington-medicine-spills-patient-data/103060?utm_source=twitterfeed&utm_medium=twitter"}],"summary":"After opening a malicious attachment in a phishing email, an employee at University of Washington Medicine in Seattle may have exposed the personal information of more than 90,000 Harborview Medical Center and University of Washington Medical Center patients.  The breach took pla","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4333cda85a4c99c3c18369d48a6eec1d35f8146","impact_type":"unknown","incident_date":"2014-05-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Proof_Non_MA_0.PDF"},"notes":null,"org_country":"US","org_id":"7b3969c5dffb","org_name":"Flinn Scientific, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46816"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Proof_Non_MA_0.PDF"}],"summary":"Flinn Scientific notified an affected person of an incident, but the included text does not describe what happened or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51e5d531a28062e36bd83b0fd4fa72ffc38f26b1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5229CF68-16A1-40A9-B60A-F670EF5FCAAE"},"incident_date":"2014-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc38363a1341","org_name":"Dr. Nisar A. Quraishi","org_type":"healthcare","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/hudson/index.ssf/2014/10/medical_records_of_40000_patients_stolen_from_jersey_city_doctors_office_police_say.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/hudson/index.ssf/2014/10/medical_records_of_40000_patients_stolen.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/jjournal-news/index.ssf/2014/10/docs_stolen_records_were_for_i.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/goldilocks-and-the-3-data-breach-estimates/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tribeca-medical-center-issues-notice-regarding-a-potential-privacy-issue-involving-its-patients/"}],"summary":"Thousands of patients of a Jersey City doctor are vulnerable to identity theft after police say their medical records were stolen from a storage shed at the doctor's office earlier this week.  Dr. Nisar A. Quraishi, an internist with an office at 1 Chopin Court, told police Tuesd","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"118e04a876a3ec268623ddc96942a80e983ab886","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ad031ac0-e212-11e7-8553-197c24c367d2"},"incident_date":"2014-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1a61937fe0c3","org_name":"Covenant Health","org_type":"healthcare","ransomware":null,"records_affected":104,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/pharmacist-pleads-guilty-health-information-1.4404043;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.oipc.ab.ca/news-and-events/news-releases/2017/pharmacist-given-conditional-sentence-for-health-information-breaches.aspx"}],"summary":"An Edmonton pharmacist who wrongfully accessed the private health information of more than 100 patients while employed by Covenant Health has been sentenced to three months of house arrest.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","other","personal"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd62a9ffec2fa261ec519c5d1aad0fcd848536fe","impact_type":"unknown","incident_date":"2014-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"RU","org_id":"6e66ac33cbb4","org_name":"BTC-E","org_type":"financial","ransomware":null,"records_affected":568340,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BTC-E","type":"hibp","url":"https://haveibeenpwned.com/Breach/BTCE"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/popular-crypto-currency-websites-breach/"}],"summary":"In October 2014, the Bitcoin exchange BTC-E was hacked and 568k accounts were exposed. The data included email and IP addresses, wallet balances and hashed passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e9c2c94ba6a58955d37d5ca0e720b11a6857be0","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-13","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C2014060203%20-%20CA%20AG%20-%20Customer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46821"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-47376"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C2014060203%20-%20CA%20AG%20-%20Customer%20Notice_0.pdf"}],"summary":"American Express reported that a merchant detected unauthorized access to website files that included some cardmembers’ account and card information.","supporting_quote":null,"technology_involved":["merchant website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee3250da20bc460fc31e1f7677688aee9ac8c7e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8E159D3-8FF6-4BAA-8D20-3CE35CA1863F"},"incident_date":"2014-09-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"addeb717409a","org_name":"Memorial Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":1782,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/memorial-healthcare-system-apologizes-for-e-mail-gaffe-exposing-patient-info/"}],"summary":"Memorial Healthcare System (Memorial) is committed to maintaining the privacy and confidentiality of patient information at all times. We are providing this notice to formally inform a group of our patients about an email we sent to them on September 30, 2014, inviting them to an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3abf029232010c4a694cfaaf663643d977814d6d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8077F36-9DDB-4CB7-9B30-9BB5EAC9EAD0"},"incident_date":"2014-09-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35ebf30bbde8","org_name":"UC Davis Health System","org_type":"education","ransomware":null,"records_affected":1326,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/15/uc-davis-health-email-breach-exposes-1326-patients-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/hipaa-breach-letters-go-out-after-email-hack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kfbk.com/articles/kfbk-news-461777/uc-davis-notifies-patients-of-email-12874337/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ucdmc.ucdavis.edu/publish/news/newsroom/9313"}],"summary":"UC Davis Health System announced that it discovered a providers email had been compromised by an unknown source on September 26, breaching 1,326 patients data.  According to the release on the UC Davis Health website, the event did not involve access to patient EHRs, Social Secur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"987b6968886086202b1df7df2c19432b3992a63a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2609878-C15E-444E-9A38-D17B9BCCEB72"},"incident_date":"2014-09-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71e1e0437258","org_name":"Madison Street Provider Network","org_type":"healthcare","ransomware":null,"records_affected":523,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop leaves 523 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0123cd05d2e86c49b75545725fc70cb979ebd7c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BayBio_CreditAlert_9-26-2014_0.pdf"},"notes":null,"org_country":"US","org_id":"a7b4d396c24b","org_name":"Bay Area Bioscience Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46727"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BayBio_CreditAlert_9-26-2014_0.pdf"}],"summary":"Bay Area Bioscience Association reported that files inserted into its online payment system captured visitors’ keystrokes and may have captured credit card numbers.","supporting_quote":null,"technology_involved":["online payment system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43c20bbba5065d6521cd81f0ceb9d8fc4cf57e8c","impact_type":"unknown","incident_date":"2014-09-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/All%20Notices%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8042e3f24c8","org_name":"Pacific Biosciences of California, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46702"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-09-24","discovered_date":"2014-07-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad8b9c54edb857483cff37c0c6d270562cc29b47","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AG_CA_Notification_Letter_Jimmy_Johns_0_1.pdf"},"notes":null,"org_country":"US","org_id":"c332db2a9940","org_name":"Jimmy John's Franchises LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46686"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AG_CA_Notification_Letter_Jimmy_Johns_0_1.pdf"}],"summary":"Jimmy John's reported that payment card data was compromised after an intruder remotely accessed point-of-sale systems using credentials stolen from its point-of-sale vendor.","supporting_quote":null,"technology_involved":["point-of-sale systems"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2014-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5851777dcae971b5d5a8869ab4f4eb57964c2a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27A0CA77-4C3E-446A-A5AE-592374420331"},"incident_date":"2014-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ee0b485e8ee","org_name":"Brigham and Women's Hospital","org_type":"healthcare","ransomware":null,"records_affected":1801,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whdh.com/story/27409021/brigham-and-womens-reports-patient-privacy-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bostonherald.com/news_opinion/local_coverage/2014/11/hospital_patient_data_was_on_docs_stolen_laptop"}],"summary":"The medical information of some 1,000 Brigham and Women's patients was on a laptop computer stolen from a physician two months ago, the hospital announced this morning.  Brigham and Women's has sent letters to the affected patients, but stressed in a statement the data did not in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-09-22","discovered_date":"2014-09-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"913b0e61a792408b9886badafc2caa62cc792d8c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Viator%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"4fe1a55f5bd9","org_name":"Viator","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46657"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Viator%20Consumer%20Notice_0.pdf"}],"summary":"Viator reported a compromise that may have affected customers’ payment-card and account information after its credit card service provider notified it of unauthorized charges.","supporting_quote":null,"technology_involved":["Viator account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61b47416771b72587494f4bb8074c4725fb0ef27","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CF0BE4C-0030-491C-A26A-C4DFEFCC9693"},"incident_date":"2014-09-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff673ac64fb5","org_name":"Alliance Workplace Solutions","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/bits-n-pieces-74/;http://doj.nh.gov/consumer/security-breaches/documents/alliance-workplace-solutions-20141024.pdf"}],"summary":"Add Alliance Workplace Solutions to the too-long list of companies who have reported laptops with personal information stolen from an employees car.  Anderson & Murison report that the names, addresses, dates of birth, and drivers license numbers of propsective insureds were expo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3879d913e6a6ffc15c7c6187c498c7c4013c24cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"324DC8F3-ABDA-4617-93F2-665211E5FD9C"},"incident_date":"2014-09-17","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b896e553b1dc","org_name":"Uber","org_type":"transportation_logistics","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.latimes.com/business/technology/la-fi-tn-uber-data-breach-20150227-story.html;http://thehill.com/policy/cybersecurity/234177-data-breach-hits-uber-driver-info-vulnerable;https://oag.ca.gov/system/files/UBER%20Multistate%20Notice_0.pdf;http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensitive-database-key-on-public-github-page/;http://time.com/4155620/uber-data-breach-justice-dept/"}],"summary":"Thousands of Uber driver names and driver's license numbers may be in the hands of an unauthorized third party due to a data breach that occurred last year, the ride-hailing company said Friday.  In a statement, Uber's managing counsel of data privacy, Katherine Tassi, said the c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"701d1e69faaf3c4fe3f7848038b0cb4cb7e81954","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F92AED3-94C0-4496-BA31-B33294BC630F"},"incident_date":"2014-09-17","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98f9af94c349","org_name":"Reeve-Woods Eye Center","org_type":"healthcare","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/reeve-woods-eye-center-notifies-30000-patients-after-malware-discovered-on-computers/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/3041402_1_0.pdf"}],"summary":"I am writing on behalf of Reeve-Woods Eye Center (the Eye Center), which is an eye clinic with two facilities: (1) 460 W. East Avenue, Suite 110, Chico, California 95926; and (2) 6009 Pentz Road, Paradise, California 95969. We recently discovered a security breach of the Eye Cent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"862fe0bd8e374ae4d52c7cdaf9dea4c604d4e659","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"004BC977-E210-4AF8-8778-572E168A7B9E"},"incident_date":"2014-09-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"073612f047be","org_name":"Burlington Northern Santa Fe Group Benefits Plan","org_type":"financial","ransomware":null,"records_affected":507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/other-breaches-newly-disclosed-on-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Loss of portable electronic device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e360b49b00d0b979d10e448e5d5f1446b635c7de","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5F1914F-85F4-4BB7-9230-F1C58250757E"},"incident_date":"2014-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d60cbb83ed0","org_name":"Minecraft Survival Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/US-Network-of-Minecraft-Survival-Games-Disrupted-by-DDOS-Attacks-383303.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-15","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d051233a7f16b6ee50597a08f01d62129b6168f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TMA%20Contact%20Specific%20Sample_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"a39f60ff32c9","org_name":"Tim McCoy & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46601"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TMA%20Contact%20Specific%20Sample_0.pdf"}],"summary":"A laptop belonging to a Tim McCoy & Associates software programmer was stolen and contained personal information.","supporting_quote":"For this reason, we are writing to inform you that a laptop belonging to one of our software programmers was stolen on August 27, 2014.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a54d04e9c49af9a023d95aab97db67829b311e6","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"eb691522a5c0","org_name":"Mail.ru","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: mail.ru Dump","type":"hibp","url":"https://haveibeenpwned.com/Breach/MailRu"}],"summary":"A dump containing email addresses and passwords, predominantly associated with mail.ru, appeared on a Russian Bitcoin forum; the source says it was unlikely to result from a direct attack against Mail.ru.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b79116eb0ae0bbba222c1cda640ea0ad5d0d321f","impact_type":"unknown","incident_date":"2014-08-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Redacted%20copy%20of%20standerd%20IHSS%20notification%20letter%20sent%20to%20all%20affected%20IHSS%20clients_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dba673a9d240","org_name":"County of Napa, Health and Human Services Agency, Comprehensive Services for Older Adults","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46595"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edf00e0297b68089fd49f4f93d34233920b91693","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26C0F4D9-C6C0-4AE5-9148-022056DB2513"},"incident_date":"2014-09-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04dcafbd84c2","org_name":"Montgomery OB-GYN","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.roanoke.com/news/local/blacksburg/data-breached-at-a-blacksburg-ob-gyn-practice/article_b07acd9b-e6c2-503c-ac9a-6a811116d91c.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdbj7.com/health/patients-of-montgomery-county-gynecologist-notified-of-security-breach/29464236;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/11/03/va-ob-gyn-exposes-phi-data-breach/"}],"summary":"A person obtained patient information from Montgomery Obstetrics & Gynecology in Blacksburg in September, but the practice said Friday that it doesnt appear the information was used improperly. On Sept. 11, the practice learned that someone obtained access to multiple patients ch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08fc84f70167c86a3178ef29aef828c734854d87","impact_type":"data_theft","incident_date":"2014-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"from the Have I Been Pwned breach list","org_country":"unknown","org_id":"9be270f2c524","org_name":"Bitcoin Security Forum Gmail Dump","org_type":"unknown","ransomware":null,"records_affected":4789599,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bitcoin Security Forum Gmail Dump","type":"hibp","url":"https://haveibeenpwned.com/Breach/BTSec"}],"summary":"In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum . Whilst commonly reported as 5M \"Gmail passwords\", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff91de9b3b783586f76acdafc2e2053588b6bd48","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99A41B94-6776-42EC-9C34-5F26759F10DE"},"incident_date":"2014-09-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c96634593116","org_name":"Thomas Cristello, Chiropractor PC","org_type":"healthcare","ransomware":null,"records_affected":914,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of an electronic device results in the exposure of 914 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f735fb103bdac618b0dfb28bd4cd8932e0d97f2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Consumer%20Notice_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bb8383c302dd","org_name":"The Home Depot, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46534"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2e45d4ed9fe6ae5bdd9689f2cdcc508afeca977","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e6660ee0-d569-11e7-bfad-07ede9e0bc7c"},"incident_date":"2014-09-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"033121f9a112","org_name":"Central Huron Health","org_type":"healthcare","ransomware":null,"records_affected":139,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blackburnnews.com/midwestern-ontario/2017/03/16/central-huron-health-records-snooping-case-prosecuted/"}],"summary":"A university student who was on an educational placement with the family health team in Central Huron has been ordered to pay a $20,000 fine and a $5,000 victim surcharge for accessing personal health information without authorization.  The student pled guilty to willfully access","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81ab2fdd30053246389c29718c4880ed9c773f04","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3A4FCC6-68EC-4C9D-A1F8-50B1EE5432E7"},"incident_date":"2014-09-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab3cda5888df","org_name":"Bon Secours Kentucky","org_type":"healthcare","ransomware":null,"records_affected":697,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access exposes 697 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fc7cf858bde39f7098a2bdfdaf5472b369330fe","impact_type":"unknown","incident_date":"2014-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2312_001_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f6390ad2f8bb","org_name":"Yandy.com","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46527"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2707f9820e8e7a130d3c5e77984cb74618f07973","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB3752CD-AB72-432F-A9D1-33A9FB433F4A"},"incident_date":"2014-09-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8dd0b9b20afe","org_name":"MetroPlus Health Plan","org_type":"financial","ransomware":null,"records_affected":31980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.metroplus.org/member-services/public-notice-member-information-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ny-metroplus-health-plan-notifies-members-of-breach-after-employee-emails-info-to-personal-email-account/"}],"summary":"As posted on MetroPlus Health Plans web site:  Recently, MetroPlus Health Plan experienced a possible security breach involving some personal information (including name, member identification number, date of birth and social security number) of a number of our members. A MetroPl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"235fb080dace22f7b577b0a388d868fbc2492ac3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68B57F0D-4CD0-4B30-AB7A-7A16DF15628F"},"incident_date":"2014-09-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e4e967e091f","org_name":"Temple University Physicians","org_type":"education","ransomware":null,"records_affected":3780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"stolen computer results in exposure of 3780 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-09-05","discovered_date":"2014-08-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a66d6c95703d8cb02d0df27c45105bcf01e93c30","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JP%20Morgan%20Corporate%20Challenge%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"00386ae73fdb","org_name":"J.P. Morgan Corporate Challenge","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46496"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JP%20Morgan%20Corporate%20Challenge%20Notice_0.pdf"}],"summary":"J.P. Morgan Corporate Challenge reported that site passwords and contact information may have been accessed.","supporting_quote":null,"technology_involved":["J.P. Morgan Corporate Challenge website","website database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-05","discovered_date":"2014-08-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d53cceb6e5187efd75f38b068c7533d5b0c82e9","impact_type":"data_theft","incident_date":"2013-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20State%20University%20East%20Bay%20-%20Sample%20Notice%20Letter%20to%20CA%20Residents%20%285089625x7AB84%29_1.pdf"},"notes":null,"org_country":"US","org_id":"416dc1b2177d","org_name":"California State University, East Bay","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46513"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20State%20University%20East%20Bay%20-%20Sample%20Notice%20Letter%20to%20CA%20Residents%20%285089625x7AB84%29_1.pdf"}],"summary":"An unknown third party accessed a California State University, East Bay web server and copied a file containing personal information.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26c70bbcf2299744d931e0dd0b9088be742e2c47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA45269E-6777-4955-814E-AC49BA8A1B97"},"incident_date":"2014-09-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c17c426a2f4a","org_name":"Yorkville Endoscopy","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnn.com/2014/09/16/showbiz/joan-rivers-clinic/"}],"summary":"The cardiac arrest leading to Joan Rivers' death happened as the comedian's personal doctor began performing a biopsy on her vocal cords, a source close to the death investigation told CNN. A staff member at Manhattan's Yorkville Endoscopy clinic told investigators that the docto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"237964480f381db233e7c6bf375c1e2ef57fe253","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17094690-B9A2-4C4E-93FB-364F42BCF906"},"incident_date":"2014-09-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d7cc18fc229","org_name":"Bulloch Pediatric Group, LLC","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access exposes 10000 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c51c4f3dfe9d7db9bb18bfa070eb5d14e441521a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Goodwill%20Sacramento%20-%20Substitute%20Notice%20Materials_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"8621395287d3","org_name":"Goodwill Industries of Sacramento Valley and Northern Nevada, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46460"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5396443b8eabde1a39cb3c6799409f7ce133ea08","impact_type":"data_theft","imported_from":null,"incident_date":"2014-09-07","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"records_affected not found in source; cleared","org_country":"RU","org_id":"4c80a9d8e0a2","org_name":"Yandex","org_type":"technology_saas","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":"The companies said the credentials were acquired through phishing scams.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Yandex Dump","type":"hibp","url":"https://haveibeenpwned.com/Breach/Yandex"},{"fetched_at":null,"title":null,"type":"press","url":"http://en.itar-tass.com/russia/748557"}],"summary":"Yandex accounts containing email addresses and passwords were leaked, with the companies attributing the credential acquisition to phishing scams.","supporting_quote":"The purported million \"breached\" accounts were disclosed at the same time as nearly 5M mail.ru accounts with both companies claiming the credentials were acquired via phishing scams rather than being obtained as a result of direct attacks against their services.","technology_involved":["Yandex email service"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"912a9afa7e16848af7346462e375b83e9de33854","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7E62A3C-E559-4360-94D9-6BD1BF781AF4"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"70cbdb9eae07","org_name":"Viraj Profiles Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.co.in/news-releases/international-trade-commission-backs-valbruna-in-case-against-viraj-profiles-ltd-582870911.html"}],"summary":"Valbruna alleges the stolen trade secrets included proprietary knowledge regarding its processes for melting, refining, and casting or pouring stainless steel, as well as customer lists14","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4526318fe725f2fe1766ab865ceef7cbacf5189","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E18FAA55-DA0A-4BCB-8283-009B25DD1A7A"},"incident_date":"2014-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14f800b7f0ce","org_name":"U.S. Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":6200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-postal-worker-credit-card-stolen-20160705-snap-story.html"}],"summary":"stole credit cards as a postal worker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2e7242dafea2c89ae3930b5adfa02541ff5fa63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b5cb95a0-df52-11e7-98c9-5b20d709bc39"},"incident_date":"2014-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1929c00668dd","org_name":"St. Luke’s-Roosevelt Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ada.org/en/publications/ada-news/2017-archive/may/new-york-city-hospital-center-settles-387200-hipaa-breach"}],"summary":"New York City hospital center settles $387,200 HIPAA breach - The federal government in May settled a potential violation of the Health Insurance Portability and Accountability Act with a New York City hospital that reportedly disclosed sensitive health information to a patient’s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"169ce2d8038d5befc19b2d83ec23ab0e19fbd839","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0bd03b00-da34-11e7-a58f-dff506a792fb"},"incident_date":"2014-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"050585024354","org_name":"Spencer Cox Center for Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/10131"}],"summary":"Misdelivery of PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c36debef91ccb2c375aef0977ffbde020cfc200","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e08f7aa0-e06c-11e9-9b3e-615de4b5b4cd"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"1f54b1e42f8f","org_name":"Sopers MacIndoe","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11553944"}],"summary":"building supply company supplies building supply company with supplies to build company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbad0823ed1c28d42b862db103f88c1b0e50c036","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B68664E1-9446-43D9-A339-8D54FC3F7149"},"incident_date":"2014-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c2e2c9d0f09","org_name":"Sandy Spring Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.your4state.com/story/d/story/sandy-spring-bank-frederick-skimming-device/20246/wJ1hd8wZ4UGvChYvM0nBwg"}],"summary":"A skimming device was found on a ATM outside the Sandy Spring Bank in Frederick, Maryland.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b49c4ac42e31f4b885a5d3c8557d3fb6c1fe80a9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78F47E45-1E9C-47CC-83F1-3C1FD62A74E4"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"355d024d47c8","org_name":"Niagara College Of Applied Arts & Technology","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.niagarathisweek.com/news-story/4420343-student-charged-with-hacking-college-computers/"}],"summary":"For nearly six months, an array of machines at a computer lab was infected with keystroke logging software. The program recorded every single key entered into the computer between September 2013 and March 2014. My understanding was that the individual charged was a student at the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c26e6ca5f84b337244a5db3ebeb30ce7f505ac0c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBDB6312-35E1-4E6E-B33C-8FCB5DEACC1A"},"incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8700bd97d0b","org_name":"Mozilla","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2015/09/04/mozilla_firefox_bugzilla_leak/"}],"summary":"Use of stolen credential leads to access of nonpublic list of sfotware bugs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a33f15c2fb1294d0772ac2722aa1fdafd726ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3391E7BC-A746-4750-9F8F-D256B8F30327"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9b2f3ec262b","org_name":"Mayo Medical Laboratories","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kimt.com/2014/10/15/mayo-clinic-suing-former-executive/"}],"summary":"According to a criminal complaint, obtained through Mayo Clinic, Dr. Franklin Cockerill is accused of taking a high level position with a primary competitor of Mayo months before he actually left the clinic. Dr. Cockerill worked as a director and officer of Mayo Medical Laborator","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98346124f564d41d34c0cb7cb79424d473aaa414","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64006832-161F-4352-813E-A77E88DB7EBA"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10bd75f7722d","org_name":"iThemes","org_type":"other","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tripwire.com/state-of-security/security-data-protection/ithemes-plaintext/;https://ithemes.com/2014/09/23/important-security-update-for-all-customers/"}],"summary":"HACKED SECURITY PLUGIN FIRM STORED CUSTOMER PASSWORDS IN PLAINTEXT. SERIOUSLY?!   GRAHAM CLULEY SEP 30, 2014 Share on kindleit44 We all make mistakes. I know that sometimes I have made some real howlers, and lived to regret it, but at least we can try to learn from our past screw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f9538453e523d4ca45f95d6165f7e268012b3b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"777A5898-BFE9-4547-9EBF-911B3F655B83"},"incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"93b3d82d8db0","org_name":"Government of Pakistan","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dawn.com/news/1129615/hackers-continue-attack-on-pakistani-sites-leak-sensitive-data"}],"summary":"ISLAMABAD: A network of hackers claiming to be a part of Anonymous  the global hacktivist network  continued a campaign of hacking, DDOS attacks and defacing websites belonging to the Pakistan government, security forces and the Pakistan Muslim League-Nawaz (PML-N) on Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c0ce6924c7a35ead0465bb3dfd1a579372841cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A435213A-11D1-4CF0-B2CD-2A56BE643248"},"incident_date":"2014-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a6d91774acb0","org_name":"Enfield Council (UK Gov)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard.co.uk/news/secret-council-files-containing-private-personal-data-found-on-morse-set-8195506.html;http://www.databreaches.net/sensitive-social-service-files-found-on-tv-set-that-was-former-enfield-council-building/"}],"summary":"Document with personal information were found in a building after victm moved out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f33588d9b9e8091f83f8cf4e724596629eb87c01","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E1EBEA2-F164-4710-90E3-D3594B97149D"},"incident_date":"2014-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a9be1a45a81","org_name":"Dr. Loi Luu","org_type":"healthcare","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/physician-notifies-patients-of-theft-of-equipment-containing-personal-and-medical-information/"}],"summary":"Family medicine practitioner Dr. Loi Luu of Westminster, California recently notified patients and HHS of a potential breach, although the data were reportedly encrypted. PHIprivacy.net was able to access a still-cached copy of a substitute notice published in her local media:  P","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aec2e10e669759e9298e89b2a8500f24307299b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"797D9C83-D3BD-4B6A-B502-8675690CFE81"},"incident_date":"2014-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"965bcaa775f7","org_name":"Bethesda Hospital","org_type":"healthcare","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/hospital-employee-steals-protected-patient-data-to-commit-identity-theft-8064/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/local/palm-beach/boca-raton/fl-boca-raton-identity-theft-20150810-story.html"}],"summary":"Hospital employee stole other employees' PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-29","discovered_date":"2014-07-17","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91f7a051b571b5b58e240346396f4ab5b5de6e77","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/14-101%2C%20SISO%2014-0826%2C%20Sample%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Confidential documents were accidentally discarded and removed before shredding.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46433"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/14-101%2C%20SISO%2014-0826%2C%20Sample%20Notification%20Letter_0.pdf"}],"summary":"The California Department of Social Services reported that confidential documents containing personal information were accidentally discarded before shredding and could not be retrieved.","supporting_quote":"Confidential documents were accidentally discarded and removed from the office for disposal prior to shredding.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca3b499e654080800a7b6b979c18ac5aba78826a","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-02-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Website%20posting_0.pdf"},"notes":null,"org_country":"US","org_id":"eb09539eba02","org_name":"Bartell Hotels","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46440"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Website%20posting_0.pdf"}],"summary":"Bartell Hotels reported that its payment card processing systems at five hotels were compromised, potentially exposing customers’ credit card numbers and names.","supporting_quote":null,"technology_involved":["payment card processing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd739d2f43fc58396dc21a455385cb94ab9bd5b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A3B518C-1B3B-4952-87EC-AC75F0F82C44"},"incident_date":"2014-08-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e4ad28bac69","org_name":"AltaMed Health Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":3206,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46451"}],"summary":"Stolen computer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff9cf830ccdd42d8db9e77bceb3542d34e5d0766","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9E1EB50-1352-467B-8906-C160398DAA2A"},"incident_date":"2014-08-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"641317d4388a","org_name":"The Longstreet Clinic, P. C.","org_type":"healthcare","ransomware":null,"records_affected":720,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Improper disposal exposes 720 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df6ae900fe785abc467c05561f17d1cadbdf4c32","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A5DACE2-28A3-40F0-BF37-CFB75941CAD3"},"incident_date":"2014-08-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f786080e8bf5","org_name":"Sinclair Institute","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/sex-toys-e-tailer-notifies-some-customers-of-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Sinclair-Institute-Suffers-Breach-Customer-Info-Exposed-463077.shtml"}],"summary":"login information and customer information for some of Sinclair's customers had likely been illegally obtained.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e420c1aae6ad43125d25b7a799bd846c1ad09ac0","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California_0.pdf"},"notes":null,"org_country":"US","org_id":"cde32320dffb","org_name":"ClamCase LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46412"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California_0.pdf"}],"summary":"Unauthorized access to ClamCase LLC’s website exposed personal and payment information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2014-08-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"699c7c56fc7746f6efde9112d4639138901e4342","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB1BE989-6622-4CD4-9269-9601268542D1"},"incident_date":"2014-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"598977001b9c","org_name":"MagnaGamer","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.uk-anime.net/newsitem/MangaGamer_reports_database_security_breach.html;http://forums.mangagamer.org/viewtopic.php?f=3&t=348&p=9801#p9801;https://www.reddit.com/r/visualnovels/comments/2etexi/psa_mangagamer_database_compromised_if_you_have_a/"}],"summary":"Hactivist hacked MagnaGamer and posted userid/password/emails online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8eff7d13f0dd0ac5de9ab3cd5e95dedaf025125e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF71536D-1FA2-468F-BFAC-05F417589EF9"},"incident_date":"2014-08-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26ecaa101f35","org_name":"Health and Human Services Agency","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Redacted%20copy%20of%20standerd%20IHSS%20notification%20letter%20sent%20to%20all%20affected%20IHSS%20clients_0.pdf"}],"summary":"We are contacting you to inform you of a privacy incident related to the In Home Supportive Services (IHSS) program.  On August 27, 2014, the Comprehensive Services for Older Adults (CSOA) Division of Health and Human Services Agency (HHSA) discovered that a portable data storage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41bbebd199b72b4a74d752dec328cf500630f0a7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B506636E-A520-4B24-AF0F-4FD5E4B5D864"},"incident_date":"2014-08-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1740,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-aug-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-oct-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-sep-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2014/sep/9/columbia-hospital-some-information-compromised/"}],"summary":"A VA medical assistant took two provider panel lists home in March, 2014 to work on them over a weekend. It is estimated that approximately 1500 Veterans are included on the list. The facility Privacy Officer is attempting to get an accurate list at this time. In August, 2014, th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-26","discovered_date":"2014-06-27","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08409bdf9f7c9eb976ce7164e8714f7971ee33e3","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IMHOFF_Individual_Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"6075497500d5","org_name":"Imhoff and Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46366"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IMHOFF_Individual_Notification_0.pdf"}],"summary":"A hard drive containing backup files was stolen from an employee’s vehicle, and it may have contained personal information.","supporting_quote":"During the earlymorning hours on June 27, 2014, a hard drive containing backup files for one of the firm’s servers was stolen from the locked trunk of an employee’s vehicle.","technology_involved":["backup hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bf154fd34928a7b870fbfa91018f0970990e2b9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B69F776-2026-41C0-815E-CADB566848E8"},"incident_date":"2014-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e9f335c7c68","org_name":"Google Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boingboing.net/2014/08/26/google-images-hacked.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reddit.com/r/google/comments/2elwfz/is_google_getting_hacked_because_anything_you/"}],"summary":"Google's Image Search has apparently been hacked. All queries return a line or two of normal images, followed by thousands of differently-sized versions of the image above, depicting a grisly car-crash ganked from a Ukrainian news site's coverage of the wreck.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d41d10ed7594d89fa829168ae7113cad73dc4d8c","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GEN%20Breach%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"027fcebc0d07","org_name":"Geekface LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46353"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GEN%20Breach%20Notice%20Template_0.pdf"}],"summary":"An intruder accessed a Geekface LLC server containing personal information and account credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03b2d639a1508e461a12242c362b3fd7cbacbc7f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C0AA3AA-C1A7-476A-A844-A8B6E80DBA42"},"incident_date":"2014-08-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5635b426ffa7","org_name":"Mount Sinai Beth Israel","org_type":"healthcare","ransomware":null,"records_affected":10790,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ny-mount-sinai-beth-israel-hospital-reports-stolen-laptop/"}],"summary":"On August 8, 2014, a password-protected, personal laptop computer was stolen from a staff room on the premises of Mount Sinai Beth Israel. While the laptop was password-protected, its contents were not encrypted. Stored on the laptop were emails from an OB / GYN physicians Mount ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"047bb473fa7ed4e102043adc1159480d8d6d1892","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CC63328-D66F-42B7-B962-BB8FDFD4AD10"},"incident_date":"2014-08-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d675d7482c4","org_name":"Dr. Vonica Chau","org_type":"healthcare","ransomware":null,"records_affected":810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/other-breaches-newly-disclosed-on-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/tx-break-in-at-arlington-dentists-office-puts-hundreds-at-risk-for-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcdfw.com/news/local/Break-in-at-Arlington-Dentists-Office-Puts-Hundreds-at-Risk-for-Identity-Theft-274547971.html?_osource=SocialFlowTwt_DFWBrand"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcdfw.com/news/local/Break-in-at-Arlington-Dentists-Office-Puts-Hundreds-at-Risk-for-Identity-Theft-274547971.html"}],"summary":"An Arlington dentist says the personal information of more than 500 patients could be at risk following a break-in at her office.  Arlington police said some time between the night of August 23 and the morning of August 25, someone pried open the door to Dr. Vonica Chaus practice","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfe86edc0df35585852a23e22085f90d3dc63285","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2BB7E96-390E-46C6-A6C0-428274EEC949"},"incident_date":"2014-08-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae14f01a5abc","org_name":"Steven A. Goldman, MD Inc.","org_type":"healthcare","ransomware":null,"records_affected":6141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"stolen server results in 6141 exposed records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-08-22","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"717bf7a5fa01ce5765d66cff185eb1d80670d2f4","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CSHS%20Press%20Release_0.pdf"},"notes":null,"org_country":"US","org_id":"88e4c0145da2","org_name":"Cedars-Sinai Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The stolen laptop lacked additional encryption software, contrary to Cedars-Sinai policy.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46348"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46547"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CSHS%20Press%20Release_0.pdf"}],"summary":"A Cedars-Sinai employee’s laptop was stolen in a home burglary and may have contained patients’ medical and personal information.","supporting_quote":"The laptop, which was used by the employee for troubleshooting software used for clinical laboratory reporting, was stolen along with personal items of the employee in a June 23 burglary at the employee’s home.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aae7d6b8eb339467a21cc939779bf4fc49e3a150","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hanmi%20Bank%20Participant%20Letter%20%20-%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"17df59aee087","org_name":"Ascensus, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46305"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hanmi%20Bank%20Participant%20Letter%20%20-%20California_0.pdf"}],"summary":"Ascensus inadvertently sent a report containing a plan participant’s personal information to another client, whose plan administrator opened and promptly deleted it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"493f96ba89a23e659ae710cb4268886e928cc3d0","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Distribution_0.pdf"},"notes":null,"org_country":"US","org_id":"811818dfdaa9","org_name":"The UPS Store","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46291"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Distribution_0.pdf"}],"summary":"The UPS Store reported that malware at 51 franchised center locations may have exposed customers’ personal information and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"206f9b085e69fda63caf5e07c1632bc9cc5d80c5","impact_type":"unknown","incident_date":"2014-04-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20letter%20to%20patients_0.pdf"},"notes":null,"org_country":"US","org_id":"19fbbee2e81a","org_name":"Community Health Systems Professional Services Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46296"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20letter%20to%20patients_0.pdf"}],"summary":"A patient notification letter for Community Health Systems Professional Services Corporation was filed with the California Attorney General.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48b3454025530315de77b896dc8a9d32cb30a25b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13C2D1B4-21C0-4787-890B-62FABAB8B64E"},"incident_date":"2014-08-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e833020cf2b2","org_name":"Dennis Flynn, M.D.","org_type":"healthcare","ransomware":null,"records_affected":13646,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop leaves 13646 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7aa65de448296d0a7306a883b730ea29894839c3","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-08-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MeetMe%20Announcement_0.pdf"},"notes":null,"org_country":"US","org_id":"a9f7be9eed0f","org_name":"MeetMe, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46263"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MeetMe%20Announcement_0.pdf"}],"summary":"MeetMe reported that hackers accessed some user names, email addresses, and encrypted passwords in certain user accounts.","supporting_quote":null,"technology_involved":["MeetMe user accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfe3b7104dadea2674751a1218ccc56a7c1495b5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5851EDA4-8B1C-4C49-9DDE-5D440BEB223A"},"incident_date":"2014-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"afc5cd4a24f2","org_name":"Belgium Prime Minister","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://deredactie.be/cm/vrtnieuws.english/Politics/140821_laptop_DR_stolen"}],"summary":"Outgoing Prime Minister Elio Di Rupo was the victim of a theft in the centre of Brussels. A thief targeted his official car and managed to get away with the PM's laptop computer and some personal belongings. The news was released by Het Nieuwsblad and has been confirmed to the VR","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4889fce5319db628bed3a677a334305d231319dd","impact_type":"unknown","incident_date":"2014-06-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2014-08-15%20AB%20Acquisition%20Final%20Press%20Release_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b07704110c5a","org_name":"Albertson's LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46234"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46749"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9008f71a3e93bad7aded91f90027a065d965d115","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93CF18ED-B5A5-481F-A940-F6C3E81399FF"},"incident_date":"2014-08-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cac2f26513db","org_name":"Florida Department of Health","org_type":"government","ransomware":null,"records_affected":2477,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"The Florida Department of Health reported that 2,477 patients were affected by a breach on August 16th involving email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9765310092860310fb56397a1c1fec192792c108","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63BB2825-1095-4B6F-B54B-62558C8B6783"},"incident_date":"2014-08-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d72689949ce","org_name":"Georgia Department of Behavioral Health and Developmental Disabilities","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/16/laptop-with-phi-stolen-from-ga-health-employees-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.times-herald.com/Local/20141019state-laptop-stolen-21-?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+rss%2FTopStories+(The+Times-Herald+%3E+Top+Stories)"}],"summary":"The Georgia Department of Behavioral Health and Developmental Disabilities (DBHDD) announced earlier this week that a laptop containing protected health information (PHI) of approximately 3,000 patients was stolen from an employees car on Aug. 14, 2014. The employee was attending","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-08-12","discovered_date":"2014-07-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d9662436493c60000bdd885453418d1c44c0a23","impact_type":"data_theft","incident_date":"2014-04-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20to%20affected%20customers_0.pdf"},"notes":null,"org_country":"US","org_id":"a8d556d6bb33","org_name":"The Natural","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46191"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20to%20affected%20customers_0.pdf"}],"summary":"The Natural reported unauthorized access to customer payment card and personal information associated with purchases made online or by phone.","supporting_quote":null,"technology_involved":["TheNaturalOnline.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72524a13b1f2167ec0cf02d5447c0eb6ca6a1226","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8EF38B6-A1ED-4CBA-B3D7-793E9C0EC6BD"},"incident_date":"2014-08-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26a72dd25dc1","org_name":"Association of Corporate Travel Executives","org_type":"other","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://buyingbusinesstravel.com/news/1222943-acte-members%E2%80%99-data-stolen-hackers"}],"summary":"A \"malicious theft\" yesterday (August 11) of members' names and email address, although no other data such as credit card details or addresses was acquired by the hackers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Cruz Dusk","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"actor_claimed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88878f43f3482ecbf0bf35a838af3cc091693c6f","impact_type":"data_theft","imported_from":null,"incident_date":"2014-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"7653bfb8d136","org_name":"Pokémon Creed","org_type":"other","ransomware":null,"records_affected":116465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pokémon Creed","type":"hibp","url":"https://haveibeenpwned.com/Breach/PokemonCreed"}],"summary":"Pokémon Creed's MySQL database was hacked and usernames, email addresses, and plain text passwords were exposed.","supporting_quote":null,"technology_involved":["MySQL database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"cruzdusk"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a47a300060bd3e02e25f018f9974b0203dade4e1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEF76670-CA82-469B-BE0A-B5EFA2381D0F"},"incident_date":"2014-08-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"dc4f5ba7f220","org_name":"Kabel Germany","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.faz.net/aktuell/wirtschaft/unternehmen/glasfaserkabel-netzbetreiber-koennen-sich-gegen-angriffe-nur-schwer-schuetzen-13092296.html;http://www.faz.net/aktuell/wirtschaft/netzausfall-in-berlin-staatsschutz-ermittelt-nach-attacke-auf-glasfaserkabel-13091436.html"}],"summary":"Attackers broke into cable television and Internet service provider and cut cables servicing 160,000 homes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a07decb7266b82b285c12bd998d7a35ea4d46b70","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"745C9E6C-514B-4F25-BD76-B31A72EEB1AD"},"incident_date":"2014-08-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9388ae97e509","org_name":"Val Verde Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/val-verde-alerting-patients-after-data-breach-discovered/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://delrionewsherald.com/news/article_2525f1ca-f75b-11e5-acfe-875b966d8a87.html"}],"summary":"Val Verde Regional Medical Center recently discovered a security breach involving a small number of the facility's overall patient population.  On or about Aug. 9, 2015, an independent healthcare provider downloaded unsecured protected health information and emailed it to a perso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0c69f4f334a875cae37d07e69fbfbb3c8c48805","impact_type":"data_theft","incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UCSB%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"487df1a78373","org_name":"University of California Santa Barbara","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46145"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UCSB%20Notice_0.pdf"}],"summary":"University of California Santa Barbara reported unauthorized access to archival payroll data containing employee personal and direct-deposit banking information.","supporting_quote":null,"technology_involved":["archival payroll data"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6be1868e60292026cf313931c722c9bed3af84e","impact_type":"unknown","incident_date":"2013-12-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Data%20Breach%20Notice%20Letter%201_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"00da1794a154","org_name":"San Mateo Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46155"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"AU","motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c455b6c13ed96c1e63cdbf4b1d3d5c65db5cfd82","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A81BBD2-02B9-4CA7-BA70-BF587B2DACCE"},"incident_date":"2014-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2dccfeca14b4","org_name":"Flinders University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/au-pair-facing-10-years-jail-for-allegedly-hacking-students-facebook-and-deleting-his-uni-enrolment-data/;http://www.heraldsun.com.au/news/national/pair-facing-10-years-jail-for-allegedly-hacking-students-facebook-and-deleting-his-uni-enrolment-data/news-story/f154f26472b21cb1d4bea50b3d169015"}],"summary":"A young man and woman who allegedly deleted a student's university enrolment in five subjects and hacked his Facebook and email accounts face up to a decade in jail if convicted of the cybercrime.  Jake Anthony Parker Davis, 21, of Port Noarlunga South, and Sarah Ruqayyah Salah, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b26246c9ce9586806f79aaa9f9243bfeab0adf8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDB22CB4-43A5-47C6-B9EB-DBE62479A1CA"},"incident_date":"2014-08-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf6e38c8af5a","org_name":"EZcontactsUSA.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ag.ny.gov/press-release/ag-schneiderman-announces-100k-settlement-e-retailer-after-data-breach-exposes-over;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northcountrygazette.org/2016/08/05/data_breach/"}],"summary":"data breach resulting in the potential exposure of over 25,000 credit card numbers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-07","discovered_date":"2014-07-18","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e69f431fcf808a2098a46bf8bcb7eb04c01f41bd","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/template%20adult%20CA%20prf_0.pdf"},"notes":null,"org_country":"US","org_id":"bfed9217fe0e","org_name":"Anderson & Murison","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Some completed umbrella applications on the web-based rating system were accessible for viewing on the internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46150"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/template%20adult%20CA%20prf_0.pdf"}],"summary":"Anderson & Murison discovered that some personal umbrella applications on its web-based rating system were accessible on the internet.","supporting_quote":"On July 18, 2014, we discovered that some of the umbrella applications completed on our website were accessible for viewing on the internet.","technology_involved":["web-based personal umbrella rating system"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38060b800bdb2d82ab5c57ddee2e08182c915f00","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB0CE741-AF88-4E99-87A1-D44C8C8F1699"},"incident_date":"2014-08-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5ef7f30c6ae","org_name":"Malpitas Knights PAL Youth Football","org_type":"other","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mercurynews.com/sports/ci_26375263/milpitas-youth-football-players-birth-certificates-stolen-hayward"}],"summary":"A bag of registration materials -- including original birth certificates, physical forms, registration forms and photos -- had been stolen from the back seat of a volunteer's car on Aug. 6. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67e6ddb149c9e3ac534770fd0d3e43f786d185cf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"939884E8-0427-4B9B-A8C7-E73F75F85F4D"},"incident_date":"2014-08-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5e5ede93841","org_name":"Albertina Kerr Centers","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/gresham/index.ssf/2014/10/laptops_stolen_from_albertina.html"}],"summary":"2 laptops were stolen that may have contained medical information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c670cb350d3ac4b0fbeae775328a22f203b00b01","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"020FF053-BB59-4974-BDC9-24588C68BE01"},"incident_date":"2014-08-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43c154c771c8","org_name":"Northeast Rehabilitation Hospital Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/northeast-rehabilitation-20140814.pdf"}],"summary":"An employee lost documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a6c34bcf5a8c2f2166f7ff8f11f42fd683d1dcb","impact_type":"unknown","incident_date":"2013-12-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wireless%20Emporium%20Breach%20Notification%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"0b9e5f26b03c","org_name":"Test Effects, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46105"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wireless%20Emporium%20Breach%20Notification%20Sample_0.pdf"}],"summary":"Test Effects, LLC filed a consumer notification letter concerning a security incident; the provided excerpt does not describe the incident or information involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-08-04","discovered_date":"2014-06-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04921683e90eeba13d26e6bc629d767bdba6115d","impact_type":"data_theft","imported_from":null,"incident_date":"2013-10-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PFCB%20August%204%20Press%20Release_0.pdf"},"notes":null,"org_country":"US","org_id":"c5a1e49826d5","org_name":"P.F. Chang's China Bistro","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46115"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PFCB%20August%204%20Press%20Release_0.pdf"}],"summary":"P.F. Chang's China Bistro reported that its card processing systems were compromised and that an intruder may have stolen payment card data from certain restaurant locations.","supporting_quote":null,"technology_involved":["card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccb3fb25d3606b78063ff88c1e44498d47d7b15f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"138A8C95-337B-4C35-881A-704B6D2F8029"},"incident_date":"2014-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"f27f2a2d8307","org_name":"Whitehead Nursing Home","org_type":"healthcare","ransomware":null,"records_affected":75,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.belfasttelegraph.co.uk/news/northern-ireland/nursing-home-fined-for-data-breach-after-laptop-with-patients-details-stolen-34994692.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/08/northern-irish-nursing-home-fined-by-information-commissioner-s-office/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/data-breach-hits-whitehead-nursing-home-in-northern-ireland/article/518535/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/news/ico-fines-nursing-home-over-data/"}],"summary":"An unencrypted laptop was taken home by a member of the nursing home's staff, and then stolen in a break-in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c8fab4aa8167f7b64d8e41b37b79e96e76b24f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0660dc30-b119-11e8-ac9c-a56a5b5fabb0"},"incident_date":"2014-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8906f76a0ecb","org_name":"West Kendall Baptist Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/a-notice-to-patients-of-west-kendall-baptist-hospital/"}],"summary":"A registration employee of the hospital was stealing the personal information of patients they checked in and making fraudulent credit card charges.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"The Anti-Communist Party Hackers","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e393f1747cb4c06f4f217bf45acdb1826173f466","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B26D4A00-A1C9-44CD-A14D-E7BF47DAAED9"},"incident_date":"2014-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"0345427d4516","org_name":"Wenzhou Television Station","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/chinese-tv-channel-hacked-while-on-air/article/364439/"}],"summary":"Hacktivists in China put anti-government messages up over broadcast programmes while Wenzhou TV station was on air.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"theanticommunistpartyhackers"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"907b70f12f84435c3eb27323896ce2cb814649a1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"332457D2-669F-4D4D-8B01-0ABCD91A8B7B"},"incident_date":"2014-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Walgreen Co. reported that 160,000 patients had PHI involved in an August 1st  November 6th breach involving paper records.  I was unable to find any coverage of this, but this could be big, as Walgreen has had problems before with paper records, and was even fined in the past. T","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5e13e40d8ae167f683d8e056292792482a2ed6c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C0FCC7E-A613-4123-AC90-C3997E30756C"},"incident_date":"2014-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"a0f441bd38b0","org_name":"University Health System","org_type":"healthcare","ransomware":null,"records_affected":6073,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsstar.com/story/news/local/2014/08/19/conway-server-breach-personal-information-lost/14296833/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/professor-hacks-university-health-conway-in-demonstration-for-class/article/367123/;VirusShare_00137.zip"}],"summary":"Professor demonstrating server vulnerabilities views data on server in front of his class. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f672f83ba89652ef55e04c6e35903fd2b749a342","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C51642C-1D09-4C8D-863B-11171D35D0DC"},"incident_date":"2014-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.masslive.com/news/index.ssf/2015/10/atm_skimmer_pleads_guilty_in_s.html"}],"summary":"ATM Skimming operation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f18aa4688955705eaad354a787532a8628ab4fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83A2DC61-2F16-4D6A-BF91-9826525F7F7E"},"incident_date":"2014-08-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b9b7a8dcf91","org_name":"SUPERVALU INC.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/new-data-breaches-hit-supervalu-albertsons;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.supervalu.com/security.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.globalpost.com/dispatch/news/afp/140815/first-target-now-albertsons-supervalu-are-hacked;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagobusiness.com/article/20140815/NEWS07/140819895/jewel-osco-hit-by-computer-hack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wabi.tv/2014/08/15/shaws-customers-may-impacted-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/breach-hits-836-ab-acquisition-stores-a-7200;"},{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/supermarkets-nationwide-affected-by-albertsons-supervalu-data-breach/107791;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/business/chi-jewelosco-hit-by-data-hack-20140929-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecnews.org/ab-acquisition-llc-and-supervalu-inc-annouce-second-hacking-incident-involving-payment-card-data-processing/#.WIwk-7YrLUK;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/supervalu-s-cub-foods-hit-by-hackers-again/277515921/?utm_medium=twitter&utm_source=twitterfeed&utm_term=OSINT"}],"summary":"Supermarket chains Supervalu and Albertson's revealed on Monday that some of their payment processing systems have once again been breached.  In a security advisory posted on its website, Supervalu said cybercriminals installed a piece of malware on a section of its computer netw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2b5c69a1bf7df9db6ac795fc2fd22b3a2a33214","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65E4905C-9756-49FD-8923-4276830F194C"},"incident_date":"2014-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6403346a15c2","org_name":"Santander bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.silive.com/news/index.ssf/2014/08/nypd_warns_staten_islanders_to.html"}],"summary":"The NYPD's 122nd Precinct is warning Staten Islanders to keep an eye out for ATM machine scams after a \"skimming\" device was found at a Santander bank branch.  The police department announced the device's discovery on the 122nd Precinct's official Twitter feed Tuesday.  Police co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e919cb1f7741b71cdf78c0530cf17c6614e6917","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE68EF1A-9C4D-4C39-A6A8-DEA519B096D6"},"incident_date":"2014-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98f9af94c349","org_name":"Reeve-Woods Eye Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/3041402_1_0.pdf"}],"summary":"I am writing on behalf of Reeve-Woods Eye Center (the Eye Center), which is an eye clinic with two facilities: (1) 460 W. East Avenue, Suite 110, Chico, California 95926; and (2) 6009 Pentz Road, Paradise, California 95969. We recently discovered a security breach of the Eye Cent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1956ce0dcbd38fc5f43addaddafae260e7154e88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3d06c400-d56b-11e7-bfad-07ede9e0bc7c"},"incident_date":"2014-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f24ba03fc636","org_name":"Med Center Health","org_type":"healthcare","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bgdailynews.com/news/confidential-info-taken-from-med-center-patients/article_bbc3aa82-f779-591a-9660-0a12813def15.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.healthdatamanagement.com/news/inside-theft-breaches-database-at-med-center-health"}],"summary":"A federal agency is investigating a breach of confidential information from 160,000 patients at certain Med Center Health facilities.  Irregularities were discovered during a January internal investigation, and the information was then given to law enforcement officials, who disc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"MY","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcf76f11eb6d1a9e772fe79cb5bc2353e4b2564c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"526C72E8-24B3-443E-837B-E982C5EDB73B"},"incident_date":"2014-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"31e9a8be88ab","org_name":"Krungthai Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bangkokpost.com/news/local/426512/krabi-hit-hard-by-atm-skimmers"}],"summary":"An ATM-skimming gang has incited fear among residents in Krabi municipality after 40 cardholders had their electronic-card information stolen and used in fraudulent transactions worth more than a million baht.   The thefts began on last Thursday and had continued up until Wednesd","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74415d33d8eeaf346ddb8a52d9e9d6a098ad9ded","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8334F0B6-DFD4-4F00-ACBE-1346022E2F37"},"incident_date":"2014-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9745527652dd","org_name":"Exxon Mobil Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/nypd/downloads/pdf/crime_prevention/gasstationskimming.pdf"}],"summary":"Gas pump skimmers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a843c4ae2e4db3871fba4624bb66eae1930f5d70","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FCD9686-1AA3-464B-8A60-0E1C149963C5"},"incident_date":"2014-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2dfefdc8d743","org_name":"East Midlands Ambulance Service","org_type":"healthcare","ransomware":null,"records_affected":42000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.burtonmail.co.uk/East-Midlands-Ambulance-Service-admits-losing/story-22815682-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2732695/Personal-data-tens-thousands-patients-treated-paramedics-gone-MISSING-ambulance-HQ.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ilkestonadvertiser.co.uk/news/local/apology-over-lost-patient-data-1-6927668;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-nottinghamshire-29839234"}],"summary":"An ambulance service still cannot find a computer disk containing details of 42,000 patients which has been lost for at least two months. An investigation has now been completed, but East Midlands Ambulance service (Emas) has been unable to work out how the disk went missing or w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aad3d2c689e72ba2d91b257776b3fcb4df6675f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE88DF24-E940-4815-8938-F3C103B345A7"},"incident_date":"2014-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecdb25b9f240","org_name":"Department of Health and Human Services","org_type":"healthcare","ransomware":null,"records_affected":1720,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ihs-addresses-data-breach-by-contract-physician-at-three-facilities/"}],"summary":"Doctor accesses patient information without a good reason. On August 25, 2014, the IHS Bemidji Area determined that a physician employed by a staffing company under contract with the IHS had improperly accessed protected health information from three IHS facilities: the Fort Yate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f684db31531a3aa1bd48ce99a25d057da0d44360","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6854E61F-EB1E-4F03-82AA-CFD6E4388B06"},"incident_date":"2014-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5370fa38eef","org_name":"BTCJam","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forexminute.com/bitcoin/btcjam-breached-safe-41538"}],"summary":"BTCJam Breached but safe  A security breach was reported by BTCJam, the bitcoin lender, on August 10, but hastened to reiterate that accounts of users have not been compromised. In a statement, the spokesperson for the lender claimed that, the hack had reached the lenders website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"leak_or_reuse","cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-07-31","discovered_date":"2014-07-23","entry_asset":"saas_or_cloud_console","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"786a6476216c779f2339c90f40fc35ba3f7da605","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-07-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/REI%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"b07b39ce3d08","org_name":"Recreational Equipment, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attacker used email address and password apparently obtained from a security breach at an unrelated site or service.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46094"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/REI%20Notice_0.pdf"}],"summary":"An unauthorized user accessed REI.com accounts using credentials apparently obtained in a breach at an unrelated site or service.","supporting_quote":"On July 23, REI discovered that a third-party may have accessed your account without authorization, having apparently obtained your email address and password from a security breach at a site or service unassociated with REI and unknown to the co-op.","technology_involved":["REI.com"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93082782c87c314678c2221dd85fd0ab92265647","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D6FF53F-509D-44B1-9DFC-79E58A18BB96"},"incident_date":"2014-07-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"c40541d926a1","org_name":"Christchurch City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.3news.co.nz/nznews/extra-security-after-documents-leak-2014080108"}],"summary":"Break-in leads to actor taking parking ticket information in the form of documents and containing PII, and throwing them from the roof.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f60b92890a9c45102c315c7c4d4f986f4e396a4a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA379E9B-75DB-4A97-861B-4EE91358FF9A"},"incident_date":"2014-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"other","ransomware":null,"records_affected":2670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/thousands-of-veterans-notified-after-their-information-was-left-in-a-ladies-restroom/"}],"summary":"Folder containing documents that included 2670 PII records, and 80 medical records, was left in a lavatory for 2 hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ffd7e088a088e7b08d64001826b699edb911341","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51AE032F-48C0-43BB-B488-5697A98016E7"},"incident_date":"2014-08-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-aug-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://krwg.org/post/data-security-breach-albuquerque-va-affects-over-2600-vets"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-sep-2014.pdf"}],"summary":"Patient A received a prescription intended for Patient B. Patient B_s name and type of medication were compromised. Patient A reported the incident to the medical center and a replacement has been requested for Patient B. The Charleston Consolidated Mail Outpatient Pharmacy (CMOP","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de1571e027e6408cd18b60193f1eddd39ba3839e","impact_type":"unknown","incident_date":"2014-04-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Data%20Breach%20Letter%20-%20for%20merge_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"5eebe4bd5e67","org_name":"Mount Olympus Mortgage Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46085"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-30","discovered_date":"2014-07-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5159ef49d12a95caac716667925158f8f05e68ab","impact_type":"unknown","incident_date":"2011-12-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lasko%20-%20notice%20template_0.pdf"},"notes":"attack_techniques without supporting words dropped: T1566","org_country":"US","org_id":"8f57d9c086c0","org_name":"Lasko Group, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46073"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lasko%20-%20notice%20template_0.pdf"}],"summary":"Lasko Group learned that customers who recently purchased parts online were targeted by fraudulent phishing emails from an unknown third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7835afc393dce32785edf4f2eb1c33f77930bb90","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16ABCECA-367A-4E16-961C-AAA3F822D386"},"incident_date":"2014-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1a475faa623","org_name":"Compassionate Care Hospice","org_type":"healthcare","ransomware":null,"records_affected":707,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/recent-updates-to-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"On July 30, 2014, there was a break-in and theft at Compassionate Care Hospice of Central Louisianas office located at 5417 Jackson Street, Suite B, in Alexandria, LA. Compassionate Care Hospice immediately reported the incident to local police. On or about September 22, 2013 (si","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78a668bacabb89fe827b9b10811313866703ce0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"844D40C7-51E8-4298-831A-39E49686ECC4"},"incident_date":"2014-07-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3e0fb88d6c1","org_name":"Colorado Department of Human Services","org_type":"government","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kktv.com/news/headlines/Colorado-health-officials-announce-privacy-breach-278874071.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://colorado.icito.com/hipaa-breach-affects-colorado-behavioral-health-patients/"}],"summary":"Colorado health officials say they accidentally violated the medical privacy of about 15,000 people in a recent postcard mailing.  The postcards were mailed as part of a survey sent to people receiving behavioral health services through Medicaid or the Department of Human Service","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"666d7aed02def01fae84ebd2cefcfaedc01df3a4","impact_type":"unknown","incident_date":"2014-05-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/WASHINGTON_DC-%2379225-v1-NT_-_Attachment_A_-_General_Notification_Letter_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bf629d4a874c","org_name":"Northern Trust","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46054"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"177a2f7c07e87668ce8b615a905b1d9bc9aa6673","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7133BB82-0DA2-4F38-AAC7-922BDE08C15B"},"incident_date":"2014-07-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e1a9a319dfc","org_name":"Oklahoma City Indian Clinic","org_type":"healthcare","ransomware":null,"records_affected":6044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/recent-updates-to-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Oklahoma City Indian Clinic recently notified 6,044 patients that their names, email addresses and clinic-specific patient numbers were compromised after the following event: On July 28, 2014, an email was sent from the clinic to 360 patients advertising an upcoming adolescent he","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41356b21058ae0cd52204efe5c94ee36c61865c2","impact_type":"unknown","incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/071714SampleNotice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"fe2eefdce067","org_name":"Managed Med, A Psychological Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46039"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0800d94c0f8503cfe94d321487f392f60e73604","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"809A0DED-5951-4924-ADA4-D97C2F8CAFAA"},"incident_date":"2014-07-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c7cf0204594","org_name":"Service Employee International Union National Benefit Fund","org_type":"nonprofit","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/second-emdeon-client-reports-breach-to-hhs/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Service Employee International Union National Benefit Fund in New York reported that 800 members were affected by a breach involving Emdeon that was also coded as theft, paper. The date of the breach was reported as July 14, 2014. Emdeon is the SEIUs electronic payment partner.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"064668ace0ee3304c2be7f890ebc39fe6235984d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5E35320-F4FB-468E-86F6-840A2A552D8A"},"incident_date":"2014-07-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09678c18cc85","org_name":"Kaiser Permanente Health Plan of Colorado","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/news/ci_26303314/colorados-kaiser-permanente-sent-patient-letters-wrong-parties"}],"summary":"Kaiser Permanente Health Plan of Colorado reported Friday it mailed letters meant for one group of patients to the wrong patients on July 24.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Kim Jong-Cracks","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02e0e2817379fc2b19e3d82342d3ff36a2aabbf8","impact_type":"data_theft","imported_from":null,"incident_date":"2014-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"e1922fc0c1ce","org_name":"Insanelyi","org_type":"other","ransomware":null,"records_affected":104097,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Insanelyi","type":"hibp","url":"https://haveibeenpwned.com/Breach/Insanelyi"}],"summary":"Insanelyi was hacked in July 2014, exposing users’ email addresses, usernames, weakly hashed passwords, and website activity.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"kimjongcracks"}},{"actor":{"category":"external","country":"PS","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"727302d3510d598ea8b865865b0b1ea28cf7c05b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"621E03E8-6D61-4A06-B78B-0A3DF974AE43"},"incident_date":"2014-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"671c90eca9cd","org_name":"The Central Bank of Kenya","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Gaza-Hackers-Deface-Website-of-Central-Bank-of-Kenya-369847.shtml"}],"summary":"Bank website defaced by Gaza hackers. No information that would suggest banking information was disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d04233b6ccf7286c065a6cadeff8697183088fd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52D417E0-1FE0-4ABE-82B0-5D5EAAD580A0"},"incident_date":"2014-07-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"dd76df9f048f","org_name":"Centrelink","org_type":"nonprofit","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canberratimes.com.au/act-news/federal-privacy-authorities-called-in-over-centrelink-breach-20140818-105hjw.html"}],"summary":"Documents containing details of 23 clients full financial disclosures, including bank account numbers and details of property holdings, superannuation and investments, were left by an official from the welfare agency at Darra in the southern suburbs of Brisbane in mid-July.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f34c99f122d6df0a2b1d83b3b8d9185892f0f638","impact_type":"data_theft","incident_date":"2011-03-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/C2014050216%20-%20CA%20AG%20Letter_customer%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45937"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46023"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46110"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46140"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46151"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46374"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/C2014050216%20-%20CA%20AG%20Letter_customer%20letter_0.pdf"}],"summary":"American Express reported that a customer's card information, including account details and Social Security number, was recovered during an investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-16","discovered_date":"2014-05-20","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecdca7a8401f6dee4fa8f158233434a3222466bd","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-05-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BayArea_proof_0.pdf"},"notes":null,"org_country":"US","org_id":"87c986757614","org_name":"Bay Area Pain Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":2780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45926"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BayArea_proof_0.pdf"}],"summary":"A break-in at Bay Area Pain Medical Associates resulted in the theft of three desktop computers, and a spreadsheet containing patient names and years of service may have been accessible.","supporting_quote":"We are writing to inform you that on May 19, 2014, our office was broken into and many items were stolen including three desktop computers.","technology_involved":["desktop computers","Excel spreadsheet"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-07-16","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dea2e8d3b99987b35b853c1465bce9e101612143","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Sample_1.pdf"},"notes":null,"org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45891"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Sample_1.pdf"}],"summary":"An email scam compromised two employees’ remote email login credentials, and personal information in email messages may have been exposed.","supporting_quote":"In mid‐May we discovered an email scam that resulted in two employees’ remote Bank email login credentials being temporarily compromised.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3462e7bb5c3cc17da3385c1ce2df154f32d89c8d","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Living_0.pdf"},"notes":null,"org_country":"US","org_id":"3ddb5456cdef","org_name":"City of Encinitas and San Dieguito Water District","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45886"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20Letter%20Living_0.pdf"}],"summary":"A Cal-PERS payment document containing employee and former employee names and Social Security numbers was inadvertently accessible on the City’s website.","supporting_quote":null,"technology_involved":["City website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ac228750227c21e8c9ef3cb685b626c11f4d9bb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"783E9838-7FE7-484B-97D3-9FBB81F74343"},"incident_date":"2014-07-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c881ce320b4c","org_name":"Balfour Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.orcadian.co.uk/2014/07/nhs-orkney-to-take-action-after-confidentiality-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.orcadian.co.uk/2014/07/police-to-investigate-patient-confidentiality-breach/?utm_source=rss&utm_medium=rss&utm_campaign=police-to-investigate-patient-confidentiality-breach"}],"summary":"NHS Orkney chief executive Cathie Cowan has apologised after confidential patient information was found by a member of the public on a pavement near the Balfour Hospital.  Ms Cowan, who described the incident as very disappointing, also said an investigation into why the records ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3374bfd3f378ee405df6bc0f6c578ce54a8b7fca","impact_type":"unknown","incident_date":"2014-03-05","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MileOne%20Final%20Letter%20redacted_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63db5b49dd1c","org_name":"Atlantic Automotive Corporation d/b/a MileOne","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45884"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45ec20187057bab6e8ca26094ce3e97f76e28bbf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFF8DC5B-7D4D-4A36-BD3C-36FEEF13CFD2"},"incident_date":"2014-07-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f915876b5e0e","org_name":"Santa Fe Family Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.santafenewmexican.com/news/health_and_science/santa-fe-health-clinic-says-patient-information-stolen/article_da003586-4ff9-5d6d-a914-36a7a27867ab.html"}],"summary":"One of the busiest medical clinics in Santa Fe has reported a security breach affecting patients who were treated at Santa Fe Family Health Center during two weeks in July. The clinic, 2801 Rodeo Road, released a statement Friday afternoon saying the breach occurred July 14 for p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f92b4b8f49e5e77594938492eb5694d8eeeaf92e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7764276B-8227-4B3A-A11B-09BB18957DB3"},"incident_date":"2014-07-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c7d41879036","org_name":"MetroHealth","org_type":"healthcare","ransomware":null,"records_affected":981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/healthfit/index.ssf/2015/05/metrohealth_reports_data_breac.html"}],"summary":"Backdoor malware installed on three desktops puts 981 medical records at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2014-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2df7365ba24786faf74020f18d3865f0c759c27","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB1ED429-4807-4ECF-92EA-78C93D59D76F"},"incident_date":"2014-07-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87a0e397b40b","org_name":"Cnet","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itgovernance.co.uk/blog/cnet-hacked-one-million-users-data-stolen/"}],"summary":"Activist Hacker group hacked Web Application and stole usernames, encrypted passwords and emails from CNET","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-07-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3eebd34d639e020243d7932ccb50e3c7f654e2b3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE125AAC-5095-4832-8132-727D44A76B66"},"incident_date":"2014-07-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7c20e60cbb0","org_name":"Mintpal","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cryptocoinsnews.com/mintpal-gets-hacked-pos-vericoin-fork-result/"}],"summary":"the hacker specifically targeted Mintpal's large VeriCoin holdings. Mintpal was in control of 30% of existing VeriCoin, all of which was stolen by a yet unidentified hacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9211ece86441bcde980b827b28c33041022f1a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B553304-C9FE-4F01-BA82-A8AE64BC6F1D"},"incident_date":"2014-07-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56b5311debb9","org_name":"City National Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlestondailymail.com/article/20140721/DM02/140729835/1277"}],"summary":"Secret Service agents suspect the men who placed a card-skimming device on an ATM in Charleston were not local residents.  Bill Smarr, Charlestons Secret Service resident agent in charge, said Monday that the evidence looked similar to what investigators have found in surrounding","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":"AnonGhost","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c789e1ce687579e79a8b6cd2642570bb4bde21d0","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B9DDFF0-6F92-4504-AE19-B20251612925"},"incident_date":"2014-07-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"2335ab57cfe6","org_name":"Israeli Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/opsavegaza-anonymous-takes-down-1000-israeli-government-business-websites-1457269;http://www.hackersnewsbulletin.com/2014/07/list-damage-opsavegaza-israel.html;http://www.motherjones.com/politics/2014/07/anonymous-cyberattack-israel-gaza"}],"summary":"#OpSaveGaza: Anonymous Takes Down 1,000 Israeli Government and Business Websites  Hacker collective Anonymous has announced that it has taken down over a thousand of crucial Israeli websites in a huge new coordinated cyber-attack called #OpSaveGaza on 11 July and 17 July, in supp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonghost"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-11","discovered_date":"2014-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f54a05de05cf8b23b81f3ceb07a20202ba4163c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter%20070314_0%20-%20BSC%20notified%20AG_0.pdf"},"notes":null,"org_country":"US","org_id":"ede0c2ef3767","org_name":"Department of Managed Health Care","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Blue Shield inadvertently included provider SSNs in rosters, which the DMHC later released in response to public records requests.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45858"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter%20070314_0%20-%20BSC%20notified%20AG_0.pdf"}],"summary":"The DMHC disclosed provider Social Security numbers after rosters submitted by Blue Shield of California were released in response to public records requests.","supporting_quote":"On May 16, 2014, the DMHC discovered that Blue Shield of California had inadvertently included provider Social Security numbers (SSNs) in the rosters Blue Shield provided to the DMHC in February, March and April, 2013.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fa789ad515bede63b19cb4fb48cd0714240624b","impact_type":"unknown","incident_date":"2014-06-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Heartland%20Automotive%20Breach%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3b38710fa42b","org_name":"Heartland Automotive Services Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45807"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93e96dd1fd107f314f9126494f816668f3d5bf80","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CE070BF-EA18-43C5-8F91-8D1CC76D8323"},"incident_date":"2014-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"862870e0167e","org_name":"Haley Chiropractic Clinic","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer leaves 6000 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a59b307e63268e50ccb03beef39213b6daa6d8ce","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B602051A-98E4-405C-AE10-09FF18A4FF1F"},"incident_date":"2014-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"802576fc55ff","org_name":"Elizabethton City School System","org_type":"education","ransomware":null,"records_affected":2241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.johnsoncitypress.com/article/118907/personal-records-of-all-elizabethton-students-accidentally-emailed-to-parent"}],"summary":"Personal records of all Elizabethton students accidentally emailed to parent  ELIZABETHTON  The Elizabethton City School System accidentally released personal information on all the systems students on Tuesday. Superintendent Ed Alexander said the information was not further dist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"943d20223a5c2f8b368a9ceb8b4b3fc545489c3c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AECOM%20Letter%20Notification%20-%20F%20INAL_0.pdf"},"notes":null,"org_country":"US","org_id":"e981665fc6fc","org_name":"AECOM Technology Corporation","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45812"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AECOM%20Letter%20Notification%20-%20F%20INAL_0.pdf"}],"summary":"AECOM notified the recipient of uncertainty about whether personal information was exposed or used and offered identity protection services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d6f8beece960c9dafbf28dabcbbf1fdab11dc4","impact_type":"data_theft","imported_from":null,"incident_date":"2014-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"f019f6b2278a","org_name":"Verified","org_type":"other","ransomware":null,"records_affected":16919,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Verified","type":"hibp","url":"https://haveibeenpwned.com/Breach/Verified"}],"summary":"The Verified forum was hacked, exposing user accounts and data including personal messages.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0d8c7f9d1c20d814bb5c67ed2bc8b4d17f39fe4","impact_type":"data_theft","imported_from":null,"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"2ed58ac11e67","org_name":"Lounge Board","org_type":"other","ransomware":null,"records_affected":45018,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Lounge Board","type":"hibp","url":"https://haveibeenpwned.com/Breach/LoungeBoard"}],"summary":"Lounge Board accounts and their data were breached and publicly dumped.","supporting_quote":null,"technology_involved":["MyBB"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"738971eedac3cee88b91c6dc3ce5cd8ab6d40de1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89B5C0FB-ED32-46D4-911C-8370B9EA4549"},"incident_date":"2014-07-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"c06ad4527eec","org_name":"Charter Communications Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.recorderonline.com/news/vandals-blamed-for-charter-outage/article_efd72ef0-0849-11e4-95b1-0017a43b2370.html"}],"summary":"Vandals cut fiber optic cable resulting in disruption of service","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"604c3aaff7d118e0b73e5fc7865c7acd0cf30f05","impact_type":"data_theft","imported_from":null,"incident_date":"2013-12-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e57f425ad575","org_name":"AstroPID","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Astropid","type":"hibp","url":"https://haveibeenpwned.com/Breach/AstroPID"}],"summary":"AstroPID's vBulletin forum was breached and leaked publicly, exposing 5,788 user accounts and more than 220,000 private messages.","supporting_quote":null,"technology_involved":["vBulletin forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46fc9db496de34c1590171b9112e69887e27a717","impact_type":"unknown","incident_date":"2014-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Notification%207.3.14_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"140bf690b0a5","org_name":"Watermark Retirement Communities, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45750"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"929972102f1d0dbbf383aea19b9d7883e12dca56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8673565D-CBD4-4655-B802-D60B2398538A"},"incident_date":"2014-07-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca04bab7b4e7","org_name":"Group Health Incorporated","org_type":"financial","ransomware":null,"records_affected":802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/emblem-health-notified-802-ghi-members-of-breach-due-to-processing-error/"}],"summary":"Group Health Incorporated (GHI), which merged into Emblem Health, recently reported to HHS that 802 insured members were affected by a breach involving paper records. In a statement dated August 21 on their web site, Emblem Health explains:   EmblemHealth is notifying approximate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88de7e4af2e9cb700a884c1d7cf07a8b37aa58f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1232E61-68AC-4B75-897E-20961AE49E6C"},"incident_date":"2014-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"f93dba0e1924","org_name":"eToro","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://forexmagnates.com/etoros-website-down-due-to-malicious-ddos-attacks-restored-only-to-go-dark-again/"}],"summary":"DDoS attack causes online stock trading site to suffer availability loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3223ec65053cf333238e032967e95e2dd5c84f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15EA9AF3-8D2D-448A-92AF-C5FA260F5878"},"incident_date":"2014-07-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc6485d2539","org_name":"Emblem Health","org_type":"financial","ransomware":null,"records_affected":802,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/emblem-health-notified-802-ghi-members-of-breach-due-to-processing-error/"}],"summary":"Group Health Incorporated (GHI), which merged into Emblem Health, recently reported to HHS that 802 insured members were affected by a breach involving paper records. In a statement dated August 21 on their web site, Emblem Health explains:   EmblemHealth is notifying approximate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-03","discovered_date":"2014-05-16","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"979e2a768188ce3d5ae6d34a33109aa00f0286f5","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-02-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Notification%20Letter%20070314_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Blue Shield inadvertently included provider SSNs in provider rosters and did not mark the rosters confidential or alert the DMHC.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45753"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Notification%20Letter%20070314_0.pdf"}],"summary":"Blue Shield of California inadvertently included providers’ Social Security numbers in rosters that the DMHC later disclosed in response to public records requests.","supporting_quote":"On May 16, 2014, the DMHC discovered that Blue Shield of California had inadvertently included provider Social Security numbers (SSNs) in the rosters Blue Shield provided to the DMHC in February, March and April, 2013.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-03","discovered_date":"2014-06-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc1623f1b666bf7cd6e77817dab25696cc1158df","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BMS%20notification%20letters_0.pdf"},"notes":null,"org_country":"US","org_id":"dcb4fc659d49","org_name":"Black Mountain Software","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45747"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BMS%20notification%20letters_0.pdf"}],"summary":"Black Mountain Software reported that files belonging to eight client organizations were accessed without proper authorization, and some contained personal information.","supporting_quote":null,"technology_involved":["utility billing software"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a196b31cc06476093dc820bdd6a9ff06e3a5ed9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B385679-A011-49FA-8FE5-97497A6E4301"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"62f60db61ca7","org_name":"West Dunbartonshire Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-west-dunbartonshire-council-warned-of-court-action-by-ico-over-data-protection-failures/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.publictechnology.net/articles/news/laptop-theft-leads-information-watchdog-act-against-scottish-council"}],"summary":"West Dunbartonshire Council warned of court action by ICO over data protection failures","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe0ca91fae220c0866fa68cd7d294a7501b96d9e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A5CEA40-D064-4227-825B-0FB479C9D2D3"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"461efe7bf4f5","org_name":"Veterans Administration","org_type":"government","ransomware":null,"records_affected":3637,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/va-notifies-thousands-of-veterans-after-boxes-with-their-records-go-missing/"}],"summary":"Boxes of documents that contained PII for military veterans were lost.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18d86a60cc13535a81abb697d087e38347fe1a0e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FB93DD3-E4AF-4ADE-B7C4-A54243476EE0"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e5196907cdd","org_name":"Temple University","org_type":"education","ransomware":null,"records_affected":3780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.philly.com/philly/news/20140912_Temple_reports_health-data_breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://phillydeclaration.org/2014/09/12/laptop-containing-records-of-3700-temple-patients-stolen/"}],"summary":"An unencrypted desktop computer containing personal information on 3,780 patients was stolen during a break-in at a Temple University physicians' office in late July, the university said in a statement Thursday.  The computer, in the department of surgery, contained files with pa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"917041159239b1657b9e715262e4046adfc565fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EED85633-9212-4E4C-B3F3-1AFA6F416954"},"incident_date":"2014-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f95f5419c4","org_name":"SunTrust Banks Inc","org_type":"financial","ransomware":null,"records_affected":225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.11alive.com/story/news/local/mcdonough/2014/08/14/atm-skimmers-mcdonough-suntrust-bank/14091693/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/story/news/local/2014/07/09/brandon-atm-skimmers/12419163/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baynews9.com/content/news/baynews9/news/article.html/content/news/articles/bn9/2014/7/9/man_sought_for_attac.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wjla.com/articles/2014/07/police-search-for-suspects-seen-placing-skimming-devices-on-atm-machines-105007.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://annandale.patch.com/groups/police-and-fire/p/photos-police-seek-atm-skimming-suspects73569"}],"summary":"A well organized, sophisticated fraud ring is committing a crime that is becoming harder and harder to detect because of the technology they are using, according to Henry County Police.  ATM skimmers have been around for a long time but they are getting very hard for bank custome","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e6ebb5e1a784fd92989bc2feda8dcc35bc892a1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96D817C5-FA3F-4BC7-A3D5-432868F71210"},"incident_date":"2014-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"289f8a8fc481","org_name":"Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/publicsafety/crime/credit-card-skimming-devices-found-at-three-south-tampa-gas-stations/2190642"}],"summary":"three credit card skimmers found at Shell gas stations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2c80331755513689ae962269b51debcd96debbc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB7B85A4-CA81-4C83-8B1E-2F7319E0BCC4"},"incident_date":"2014-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"983531ca46be","org_name":"Samaritan Health Services, Inc","org_type":"other","ransomware":null,"records_affected":1222,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newslincolncounty.com/archives/97611"}],"summary":"The Oregon Department of Consumer and Business Services has fined Samaritan Health Services, Inc., for violating Oregon law by discarding business records with patient names and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bef37d2bb6e0315101dde1c5c3394ea38952b4a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9722089A-B7E0-494F-927E-23C72D6250CA"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"594ddbd877b5","org_name":"Rhode Island Attorney General","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/article/Case-files-taken-when-ex-prosecutor-s-car-stolen-5609044.php"}],"summary":"Attorney's car was stolen with case files in the car.  The files were found in a trash bin about half a mile from where the car was recovered.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff09edbf8d501386d0c40a4a5beae2e78c8ecbda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1E29BA2-D80D-4A76-9564-08812CAA59AA"},"incident_date":"2014-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"a13eda7c49a5","org_name":"PK Pakistan People's Party","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/pakistan-peoples-party-website-hacked/"}],"summary":"Pakistan political party website defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80e08e97fe1077c6b323b58c896f2cfc4a39a729","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFD46DB8-C3BE-4E2E-86CD-14085C6D47CE"},"incident_date":"2014-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c0e02c55398","org_name":"Payne County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kfor.com/2014/07/23/identities-in-danger-of-being-compromised-in-payne-county-after-treasurers-office-tosses-sensitive-documents-in-dumpster/"}],"summary":"Payne County residents are urged to keep an eye on personal information after the county treasurer improperly disposed of sensitive documents.  Tuesday, the county assessors office noticed a dumpster full of documents and files from the county treasurers office with personal info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dd8fd328de4e99cf183626de1574f5aebc77bba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"fc24c7b0-c594-11e7-8053-ff1e84d2b694"},"incident_date":"2014-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"00e2dead9fb7","org_name":"Northwest Territories Department of Health","org_type":"government","ransomware":null,"records_affected":195,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/north/195-nwt-health-cards-mailed-to-wrong-addresses-1.2715071"}],"summary":"The Northwest Territories Department of Health mailed 195 health care cards to the wrong addresses due to a spreadsheet sorting error, but the deputy minister says there are no privacy concerns associated with the mistake.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"435e7d355e75a680b6b1c197447825f20a5b853a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"444E3BE0-46A9-4137-8BBA-9321E7C2694C"},"incident_date":"2014-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"cecf1cb874a4","org_name":"Korean Air","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.upi.com/Top_News/World-News/2016/06/13/North-Korea-hackers-stole-military-information-Seoul-says/6261465824321/"}],"summary":"Seoul business' being attacked by Nk","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4751f17b3b672f55f86a5c0090d4f9ef88d08ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C3D58F3-E3F2-45BD-8CC9-928985478671"},"incident_date":"2014-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"87ecc79290aa","org_name":"Kenya Armed Forces","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/anonymous-hacks-kenyan-army-twitter-account/"}],"summary":"Anonymous hacked Kenyan Armed Forces Twitter Account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"174895e9857b446f15814a3dfad496c65e2db080","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D71B790-D82B-40E4-BC3B-BC742012023E"},"incident_date":"2014-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04235ffe5103","org_name":"Jessie Trice Community Health Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7888,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://miami.cbslocal.com/2014/11/03/nearly-8-thousand-patients-of-health-center-affected-by-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/miami-health-center-notifies-nearly-8000-patients-of-data-breach/article/381176/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jtchc.org/notice/JTCHC%20-%20Data%20Breach%20General%20Statement%2011%2003%2014_.pdf"}],"summary":"A South Florida health center was the target of a data breach that compromised the personal information of some patients. Jessie Trice Community Health Center, Inc. announced law enforcement notified the business of an identity theft criminal operation. The discovery was made in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb2b0a98a93f7c82d67ccc4106059fafa494b1b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E291DA05-716E-4B84-8B05-4B9F21382D92"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"552e32ef8bce","org_name":"Indian Health Service","org_type":"government","ransomware":null,"records_affected":620,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://rapidcityjournal.com/news/local/indian-health-services-addresses-breach-of-private-information/article_2ed1e8c6-089b-5b51-9113-5e1c9bb16cc0.html"}],"summary":"A folder containing personal information of 620 patients from the Indian Health Service Rosebud Service Unit was quickly recovered after being left in a public area. IHS officials discovered the folder filled with classified information that included names, Social Security number","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"415b13ab31d09e9272c3a1fa3120893e123b31e6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82EFE3C7-E8FC-439A-A05F-C29D560144CD"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db95b32cebc6","org_name":"Duke University Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/unencrypted-thumb-drive-containing-patient-data-stolen-from-duke-university-health-system/article/370033/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dukemedicine.org/blog/#!/notice-patients-regarding-stolen-thumb-drive;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dukechronicle.com/articles/2014/09/02/duke-medicine-announces-patient-information-was-stolen"}],"summary":"A thumb drive containing unencrypted patient information was stolen this summer, Duke Medicine announced in a statement Thursday.What do you think?  The drive contained information about some patients treated in the Duke Childrens Health Center and the Lenox Baker Childrens Hospi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"007dd1f2c8c7591ff06352b4229a806752ae4a7d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E37EF1F-CC86-4975-9CCC-FEA6ECE4E2BC"},"incident_date":"2014-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9033131c8c27","org_name":"Cook County Health & Hospitals System","org_type":"healthcare","ransomware":null,"records_affected":767,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/cook-county-health-hospitals-system-notifies-hundreds-of-patients-that-email-with-phi-was-sent-without-encryption/"}],"summary":"On September 17, Cook County Health & Hospitals System posted a breach notification on their site:  As part of a collaborative public health project, an individual working on behalf of CCHHS sent an e-mail to an authorized individual at a non-Cook County healthcare organization i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":"APT 18","variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35bb2a512bc296451bbb8ce7df94bc8378b26e03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E10B4A9-CC14-4A95-BD93-0B897110B702"},"incident_date":"2014-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"593d33df883d","org_name":"Community Health Systems Inc","org_type":"healthcare","ransomware":null,"records_affected":4500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/community-health-systems-says-4-5-million-patients-data-stolen-in-cyber-attack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxbusiness.com/industries/2014/08/18/community-health-systems-says-data-stolen-in-cyber-attack/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+foxbusiness%2Flatest+(Internal+-+Latest+News+-+Text);"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/08/18/chinese-hackers-compromise-4-5-million-patients-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2014/08/18/us-community-health-cybersecurity-idUSKBN0GI16N20140818;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bdtonline.com/news/article_5e7fbcd8-26fd-11e4-a127-0019bb2963f4.html;"}],"summary":"In July 2014, Community Health Systems, Inc. (the Company) confirmed that its computer network was the target of an external, criminal cyber attack that the Company believes occurred in April and June, 2014. The Company and its forensic expert, Mandiant (a FireEye Company), belie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"apt18"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"125ccb0f60be04ca2543f305c863e4913ef52ead","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61C210BD-511F-42FA-8429-2FD78BB5A83F"},"incident_date":"2014-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"213aa5142412","org_name":"American Family Care","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/birmingham/morning_call/2014/09/american-family-care-alerts-customers-of-stolen.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/american-family-care-data-breach-impacts-patient-data/article/374245/"}],"summary":"American Family Care of Birmingham is alerting customers following the theft of two laptops containing sensitive information from an employees vehicle earlier this summer. The laptops contain information concerning work-related injuries, physicals, immunizations and drug screens ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-07-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03825f2d5ca31b1b81604b8aa427cf9748444139","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E764C807-42E1-4686-AB93-F42384B4C1AA"},"incident_date":"2014-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f7c5dac6cac","org_name":"Acme Barricades Lc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wjrr.com/onair/lynch-taco-39830/interesting-message-displayed-on-hacked-construction-12535211"}],"summary":"Road construction sign hacked with profanity","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19d57646c87536706c03dd26870d8e1e95bfd4e9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DEAD589-FE8D-41D1-A262-9519FDF72087"},"incident_date":"2014-06-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3091f48dd87","org_name":"St. Francis College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/another-breach-in-post-secondary-education-reminds-us-again-that-no-ones-enforcing-data-security-at-the-federal-level/"}],"summary":"University employee lost hard drive that contained PII. Hard drive was password-protected, but not encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-06-26","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a039a528efba08b950b18f0208bcd69f30ba9418","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SALI%20Breach%20-%20draft%20State%20Notice%20-%20not%20MA%20-%286.27.2014%29_0.pdf"},"notes":null,"org_country":"US","org_id":"1b36ab195408","org_name":"Sterne, Agee & Leach, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45666"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SALI%20Breach%20-%20draft%20State%20Notice%20-%20not%20MA%20-%286.27.2014%29_0.pdf"}],"summary":"Sterne, Agee & Leach reported that a missing, unencrypted laptop may have contained personal and brokerage account information.","supporting_quote":"An employee of Sterne, Agee & Leach (“Firm”) was unable to locate their firm-issued laptop.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82c630a039409e78c38eb203818438d9d05f142f","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AllOtherStates_0.pdf"},"notes":null,"org_country":"US","org_id":"a4eae141cd30","org_name":"Record Assist LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45673"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AllOtherStates_0.pdf"}],"summary":"Record Assist reported unauthorized access to its ExpressVitals.com order processing system, which may have exposed customer personal and payment information.","supporting_quote":null,"technology_involved":["order processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-26","discovered_date":"2014-05-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed869425ae4859e9a6c8fb9784c92944c4854efd","impact_type":"data_theft","incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/L01_NONMASS_ALLSTATES_AG2_1.pdf"},"notes":null,"org_country":"US","org_id":"4a1f2fdd6ba9","org_name":"Butler University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45661"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/L01_NONMASS_ALLSTATES_AG2_1.pdf"}],"summary":"Butler University reported that a suspect in an identity theft investigation possessed a flash drive containing personal information.","supporting_quote":null,"technology_involved":["flash drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aabb4d91dd5bb6bb673a32115edba9df5b4b6fb1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DADD3C8D-51EE-4CBB-A70D-6CF90CF7D11B"},"incident_date":"2014-06-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1b0d76a8725","org_name":"Specialty Clinics Of Georgia  Orthopaedics","org_type":"healthcare","ransomware":null,"records_affected":2350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/a-few-more-recent-additions-to-hhss-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Specialty Clinics Of Georgia  Orthopaedics reported that 2,350 patients were affected by a breach on June 26, 2014 involving Theft, Paper.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dc9d368dda0dd1edb65182d98574aa7b467fc02","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58DD9676-52A4-40CB-895C-8358D52DB62D"},"incident_date":"2014-06-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdac1c2b09f6","org_name":"Sloane Stecker Physical Therapy, PC","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of an electronic medical devices exposes 2000 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-06-24","discovered_date":"2014-06-18","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb57d937e65c899a3bf985ddf4adb3cf3286ec60","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Riverside%20County%20Med%20Center%206_24_14_1.pdf"},"notes":null,"org_country":"US","org_id":"5400d94e1728","org_name":"Riverside County Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45615"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Riverside%20County%20Med%20Center%206_24_14_1.pdf"}],"summary":"Riverside County Regional Medical Center reported the loss of a laptop containing patients’ personal and medical information.","supporting_quote":"Riverside County Regional Medical Center (RCRMC) is writing to you with important information about the loss of a laptop computer that contained some of your personal information.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48eaf8fbeeaf35fea3627665c0c9bb206e39b032","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DA80E03-26C7-48F0-BF6B-D65C7CFE530D"},"incident_date":"2014-06-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eaa0faf059cd","org_name":"Owensboro Medical Practice","org_type":"healthcare","ransomware":null,"records_affected":4077,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/09/24/medical-practice-notifies-3000-patients-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.14news.com/story/26609328/data-breach-at-owensboro-medical-practice;"},{"fetched_at":null,"title":null,"type":"press","url":"http://drvora.com/Public%20Notice%20MI.pdf"}],"summary":"Owensboro Medical Practice is currently conducting an internal investigation into a data breach that exposed 3,000 patients data. There are conflicting reports on the scope, in terms of the involvement of a business associate (BA), and time line of the data breach.  According to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7796049e85616fb403c0e120013fa3ab0310b5f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B040AF5E-E527-4193-A95D-01592F7B6FA1"},"incident_date":"2014-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eweek.com/enterprise-apps/exchange-online-back-in-service-after-extended-outage.html?utm_source=twitterfeed&utm_medium=twitter"}],"summary":"Some customers suffer a one-two punch after Exchange Online and Lync Online experience outages less than a day apart. Cloud outages are nothing new. Yet on Tuesday, Microsoft and its business customers discovered just how disruptive one can be when it affects email, which is ofte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b0db0a47968ee818da3e35cdadd039d41621b48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE9ABB88-000B-433C-94C0-B6D2B6CCDF42"},"incident_date":"2014-06-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0962ce930bc","org_name":"Community Bank of Oak Park and River Forest","org_type":"financial","ransomware":null,"records_affected":59,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.chicagotribune.com/2013-07-05/news/ct-tl-river-forest-atm-skimming-20130705_1_community-bank-bank-customers-device"}],"summary":"Man, 31, charged with River Forest ATM skimming  A 31-year-old Arlington Heights man faces felony charges after police said he stole bank customers' data from an ATM outside a River Forest bank.  Stefan-Lorin Barbut is accused of working with a still-unidentified man to collect d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c32fb130b3bc761c7b8aca85943b039774dcecf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6CA4393-05F8-4BC7-A326-441769CBBB75"},"incident_date":"2014-06-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f3c45915b6c0","org_name":"School District No 36 (Surrey)","org_type":"education","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenownewspaper.com/surrey-school-district-accidentally-emails-out-student-information-1.1156430"}],"summary":"The personal information of about 250 students was mistakenly sent out as part of a schools online newsletter. A staff member at a Surrey school was sending out a letter to parents from the superintendent Monday afternoon when they inadvertently attached the wrong document.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d51b02b36c51a005027b51d31ec6e07b366aeb54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C620DB46-FEC6-4B03-9F3A-CE1D9258C237"},"incident_date":"2014-06-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"340ce55027d5","org_name":"Advanced Diagnostic Imaging, P.C.","org_type":"healthcare","ransomware":null,"records_affected":705,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e86331b4d71346118d0602a9f320ea2c99b5520a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5846A172-A489-4950-A9E9-1A712610B020"},"incident_date":"2014-06-22","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"383eb4081bb9","org_name":"ACME Markets","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.acmemarkets.com/recent-update/?utm_content=buffer4216e&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/philadelphia/morning_roundup/2014/09/possible-data-breach-at-acme-markets.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/south/index.ssf/2014/10/following_acme_financial_data_breach_nj_consumer_affairs_says_watch_your_web_info.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?rct=j&sa=t&url=http://www.newsworks.org/index.php/homepage-feature/item/73404-acme-grocery-chain-discloses-data-breach%3Flinktype%3Dhp_impact&ct=ga&cd=CAEYASoUMTExODIzMDI2NjQwNzM4MTQzMDIyGjY2NjAzMWMwZWRlYjc4OTA6Y29tOmVuOlVT&usg=AFQjCNHmXX49ss5DR2AoEqGUbay2x9o_hg;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/south/index.ssf/2014/09/acme_financial_data_breach_at_nj_stores_what_shoppers_need_to_know.html;"}],"summary":"Payment card information at-risk for retailer. Malware was installed on POS systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a2e4ed65e8f68a72c90df6d119929af80b010bb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AFFBDC8-59BE-46A8-B9B9-EA4337770B8D"},"incident_date":"2014-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"5df67c54c10e","org_name":"Popvote - University of Hong Kong","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/06/largest-ddos-attack-hit-hong-kong.html;http://www.theregister.co.uk/2014/06/23/most_sophisticated_ddos_strikes_hk_democracy_poll/"}],"summary":"Largest DDoS Attack Hit Hong Kong Democracy Voting Website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-06-20","discovered_date":"2014-06-08","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45d8357fcaf2e88e0206eed36d5a50c5168d55b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UC%20Washington%20DC%206_20_14%20_1.pdf"},"notes":null,"org_country":"US","org_id":"7cd03defc709","org_name":"University of California, Washington Center","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45553"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UC%20Washington%20DC%206_20_14%20_1.pdf"}],"summary":"UCDC reported unauthorized access to its GoSignMeUp-hosted pre-enrollment system, exposing account credentials and other personal information.","supporting_quote":null,"technology_involved":["GoSignMeUp","online course registration system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"GoSignMeUp"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"ba657364d58b","name":"GoSignMeUp"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0a39311aab854c88d155794f454bd8f60a2e24e","impact_type":"unknown","incident_date":"2014-06-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rady%20Childrens%20Number%20one%206_16_14_1.pdf"},"notes":null,"org_country":"US","org_id":"835d87b817b6","org_name":"Rady Children's Hospital-San Diego","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45587"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rady%20Childrens%20Number%20one%206_16_14_1.pdf"}],"summary":"A California Attorney General-filed notification associated with Rady Children's Hospital-San Diego is present, but the provided text contains no incident details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d7c67e9cb629a63559442018ab6aae7c2b4198e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFC191C7-6867-4F4E-AE89-3D33A9521E22"},"incident_date":"2014-06-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c9f8fea4f89","org_name":"Abrham Tekola, M.D.,INC","org_type":"healthcare","ransomware":null,"records_affected":5471,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"253620fa1ba06af2f47135f135a0a277a74aa210","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9730B10C-10EF-4FF0-BF58-32650862B2B5"},"incident_date":"2014-06-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa9d7824083c","org_name":"New Mexico State University","org_type":"education","ransomware":null,"records_affected":171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abqjournal.com/448644/abqnewsseeker/personal-data-on-170-nmsu-students-stolen.html"}],"summary":"http://www.abqjournal.com/448644/abqnewsseeker/personal-data-on-170-nmsu-students-stolen.html","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57996efc18518a64f7563e1fe9f91a4b31b7b001","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DFFD3B1-499A-44FC-BE70-9860C44CFE45"},"incident_date":"2014-06-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/broker%26member%20notification_0.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01c1f7046531","org_name":"CareFirst BlueCross BlueShield","org_type":"financial","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/05/carefirst-blue-cross-breach-hits-1-1m/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Data-Breach-at-CareFirst-Health-Insurer-Affects-1-1-Million-Customers-481850.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.carefirstanswers.com;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/seek-and-ye-shall-find-carefirst-notifies-brokers-and-members-of-2014-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-56038"}],"summary":"CareFirst BlueCross BlueShield on Wednesday said it had been hit with a data breach that compromised the personal information on approximately 1.1 million customers. There are indications that the same attack methods may have been used in this intrusion as with breaches at Anthem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59a128b62aba0337743bce57c50253202cfff067","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"098B1311-40C2-4649-BEF7-C0FA30B19679"},"incident_date":"2014-06-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"73b4d770d955","org_name":"United States Airforce","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://timesofindia.indiatimes.com/city/delhi/2-computers-stolen-from-Air-Force-headquarters-vital-data-lost/articleshow/36779612.cms"}],"summary":"Two laptops were stolen from the Air Force headquarters in New Delhi. The laptops were stolen from the office of a senior official. Investigation is on going.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-06-18","discovered_date":"2014-04-21","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30a9118882304355778474b013cd813a32a74f39","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Metropolitan%20companies%20notice%20only6_18_14_1.pdf"},"notes":null,"org_country":"US","org_id":"598c2c21292b","org_name":"The Metropolitan Companies, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45526"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Metropolitan%20companies%20notice%20only6_18_14_1.pdf"}],"summary":"The Metropolitan Companies reported that an unauthorized third party may have accessed its computer systems and that personal and financial information may have been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2dda9d514cc80a306600b41766cba7f3d9783ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4C476B3-C32E-4B20-BB35-C364065EB3A6"},"incident_date":"2014-06-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f235a0222fdf","org_name":"Sunday Times","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackersnewsbulletin.com/2014/06/sun-sunday-times-websites-hacked-syrian-electronic-army.html"}],"summary":"SEA (Syrian Electronic Army) is back again, Yesterday they hacked two UKs news websites, The Sunday Times and The Sun.  For about 20 minutes, the websites were hacked and defaced with a message showing in the image above, after that company restored the website to its original st","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2014-06-16","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3468fdd4c4c38c0d9d2134de47e9275745dd1fef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E411354B-C90A-4A71-B079-49C18C64D94B"},"incident_date":"2014-06-16","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ea03abde359","org_name":"Signature Systems","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/07/sandwich-chain-jimmy-johns-investigating-breach-claims/?utm_source=twitterfeed&utm_medium=twitter;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pymnts.com/news/2014/cyberthieves-reportedly-crack-into-sandwich-chain-jimmy-johns-pos/#.U-AbuFaFr7Q;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxdetroit.com/story/26622236/customers-say-jimmy-johns-data-breach-release-anything-but-freaky-fast;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/PoS-Vendor-Signature-Systems-Informs-of-Credit-Card-Breach-Affecting-324-Restaurant-Locations-460160.shtml#hyperanchor1.3%3A%2F%2Fdiv%5B%40id%3D%26quot%3Bnewsbody%26quot%3B%5D%2Fp%5B1%5D%2Fstrong%5B1%5D%280%29%283%29%28Ven%29%26%2F%2Fdiv%5B%40id%3D%26quot%3Bnewsbody%26quot%3B%5D%2Fp%5B1%5D%2Fstrong%5B1%5D%28204%29%283%29%28es.%29%26border%3A%20thin%20dotted%20;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/09/signature-systems-breach-expands/;"}],"summary":"A nationwide data breach has Jimmy John's with a fiasco on its hands.   The company released a statement today saying that it became aware of the incident at the end of July.  Many customers think that the place that promises \"freaky fast delivery\" took its time alerting them.  A","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":"Sean Caffrey","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c69aee1b4105b957424798275eaf134a3b08cb4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75887510-c960-11e7-a5ba-7f961e325ca3"},"incident_date":"2014-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c880ff4cfa7","org_name":"US Department of Defense","org_type":"government","ransomware":null,"records_affected":30800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.infosecurity-magazine.com/news/uk-hacker-pleads-guilty-us/"}],"summary":"Sean Caffrey, 25, of Sutton Coldfield, admitted illegally accessing and stealing the ranks, usernames and email addresses of more than 800 users of a military communications system, on June 15 2014.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"seancaffrey"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2014-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6d524c6ab335ea9f8d6291bc15731f11361bdbd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E32CBC0-D262-465E-9D89-A7B007A9CBB0"},"incident_date":"2014-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f2b3d8fbe5d","org_name":"American Income Life","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/09/medical-records-for-sale-in-underground-stolen-from-texas-life-insurance-firm/"}],"summary":"Customer records found for sale on the dark web.  This incident is not listed in the HHS database under either of the companies names listed.    Sure enough, the source who alerted me to this listing had obtained numerous fullz from this seller. All of them contained the personal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-13","discovered_date":"2014-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c902e9c543475244ef8abeb2f81c6d7ecfd5d902","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-09-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SafetyFirst%20-%20Client%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"95cf46495d1d","org_name":"SafetyFirst","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A configuration error during a routine upgrade made the SafetyFirst FTP server publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45481"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SafetyFirst%20-%20Client%20Notice%20Template_0.pdf"}],"summary":"SafetyFirst reported that a configuration error made an FTP server publicly accessible, exposing drivers’ personal information.","supporting_quote":"The forensics investigation team determined that the information on the SafetyFirst FTP server became publicly accessible after a configuration error during a routine upgrade.","technology_involved":["FTP server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-13","discovered_date":"2014-06-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cc2bd77cc82200d191ddb467bb0648c932f393f","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-05-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Riverside%20Adult%20Notice_0.PDF"},"notes":null,"org_country":"US","org_id":"28a1ecf11235","org_name":"Riverside Community College District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45469"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Riverside%20Adult%20Notice_0.PDF"}],"summary":"Riverside Community College District reported that an email containing student records was sent to an incorrect external email address.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f8d0d8fa3be10b0be165836a83965985bb9d6ad","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fidelity_proofC_V2_Gen_0.pdf"},"notes":null,"org_country":"US","org_id":"89d4f41f603d","org_name":"Fidelity National Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45463"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fidelity_proofC_V2_Gen_0.pdf"}],"summary":"Fidelity National Financial notified individuals that their personal information may have been accessible during an incident, though its investigation found no evidence that the information was accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44f0f3bb2174de0d7b9f80209b55064c9c8784d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"917C6FF1-2E50-44F0-A406-0F28F615978A"},"incident_date":"2014-06-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c40883a97cc0","org_name":"Baylor Medical Center at Carrollton","org_type":"healthcare","ransomware":null,"records_affected":2874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access to medical records exposes 2874 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"471e47976331ef4dce0ddb6236bf4b61c262cf43","impact_type":"unknown","incident_date":"2014-02-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Ind%20Notification%20PII%20PHI_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af78af33f457","org_name":"The Union Labor Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45457"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Rex Mundi","variety":"activist"},"attack_techniques":["T1190","T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2cc7fd16a06169b82fb803d7a1cb85ba2cfc5fb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FE3D16A-1992-4C94-9F55-2FC541DEDB0C"},"incident_date":"2014-06-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7ee2a196f27","org_name":"Americash Loans LLC","org_type":"financial","ransomware":true,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infoworld.com/t/hacking/hacker-group-demands-idiot-tax-payday-lender-195964;http://news.softpedia.com/news/Hackers-Leak-Data-from-AmeriCash-Advance-After-Company-Refuses-to-Pay-Up-276608.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infoworld.com/t/hacking/hacker-group-demands-idiot-tax-payday-lender-195964"}],"summary":"Hackers from Rex Mundi group steal customer data from AmeriCash unless ransom is paid. AmeriCash does not pay ransom and so data is released.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"rexmundi"}},{"actor":{"category":"external","country":"AT","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00f88e98682d3e91246b5603088c66a9bc9556a5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F07998E9-79FF-4211-B44B-1F618CC7B81A"},"incident_date":"2014-06-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8648ef570bd","org_name":"Tweetdeck, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/38827/tweetdeck-taken-offline-after-xss-flaw-hits-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/06/powerful-worm-on-twitter-unleashes-torrent-of-out-of-control-tweets/"}],"summary":"External actor discovers XSS vulnerability in Tweetdeck and creates a tweet that would execute code on his Tweetdeck-using followers' browsers. The code would retweet the tweet and essentially turned into a XSS worm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3f7de280ee53d5f8da79bd3d2627ef0b8dd6211","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Stanford%20FCU%20Email%20Notification%20letter%2006.2014_0.pdf"},"notes":null,"org_country":"US","org_id":"e208f31199bd","org_name":"Stanford Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45455"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Stanford%20FCU%20Email%20Notification%20letter%2006.2014_0.pdf"}],"summary":"A staff member mistakenly sent member information to an individual outside the credit union, and the credit union said the information was destroyed before being viewed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99933e60dfb60f08a6fa4c9dde1465f045763095","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E2A6DBE-AD85-4382-B3D2-C9876E405B8C"},"incident_date":"2014-06-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0100bab92ae5","org_name":"Feedly","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcpro.co.uk/news/security/389233/feedly-and-evernote-hit-with-ddos-after-refusing-to-pay-ransom;http://mashable.com/2014/06/11/evernote-feedly-hacked/;http://blog.feedly.com/2014/06/11/denial-of-service-attack/;http://www.forbes.com/sites/jaymcgregor/2014/06/11/feedly-and-evernote-go-down-as-attackers-demand-ransom/"}],"summary":"Criminals are attacking feedly with a distributed denial of service attack (DDoS). The attacker is trying to extort us money to make it stop. We refused to give in and are working with our network providers to mitigate the attack as best as we can.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1e3a0d17ddeb3f376e27680847497c10d4f087a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DDA2CE4-CC2A-4787-96ED-18F1BD5EB468"},"incident_date":"2014-06-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff4118c43f03","org_name":"RADISSON HOTELS INTERNATIONAL, INC.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/billing-information-of-guests-at-radisson-hotel-fishermans-wharf-accidentally-sent-to-a-hotel-guest/"}],"summary":"So it seems an employee of Radisson Hotel Fishermans Wharf in San Francisco accidentally sent an email to a hotel guest that had an attached spreadsheet with some guests billing information that included their company names, credit card numbers and expiration dates, mailing and e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03aa5ef4bb3bd1ee14d5f96ed38dccdfffe27314","impact_type":"data_theft","imported_from":null,"incident_date":"2014-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"143c536fa444","org_name":"Manga Traders","org_type":"retail_ecommerce","ransomware":null,"records_affected":855249,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Manga Traders","type":"hibp","url":"https://haveibeenpwned.com/Breach/MangaTraders"}],"summary":"Manga Traders user email addresses and passwords were leaked online.","supporting_quote":null,"technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a27847b4aca9d0996f52ccaf2aa22fd1865c0029","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E05A6918-6983-43C5-B2C3-908512AC57FC"},"incident_date":"2014-06-09","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f333f5f5709f","org_name":"St. Francis Hospital","org_type":"healthcare","ransomware":null,"records_affected":1175,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Email incident exposes 1175 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ab9eeb778486362468f918199e33bd0d349f553","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9159572E-339C-44A2-ADBD-AAB03315B087"},"incident_date":"2014-06-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33d2d8625257","org_name":"Central Utah Clinic","org_type":"healthcare","ransomware":null,"records_affected":31677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/central-utah-clinic-notifies-over-30k-patients-of-potential-hipaa-breach/article/370959/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.centralutahclinic.com/news/potential-hipaa-breach"}],"summary":"More than 30,000 patients of the Central Utah Clinic in Provo, Utah might have had their personal health information viewed by an unauthorized intruder who broke into one of the clinic's servers.  How many victims? 31,677 patients, according to a Central Utah Clinic release   Wha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ef37242ed3bdc700a4da819cce375530ecd6919","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0568BB2C-A0D2-4188-91DB-75A24EC3C4A2"},"incident_date":"2014-06-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Computer theft exposes 540 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c48de6a6436662847aa47daa86d3a9d168f7459","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-06-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/VIBRAM%20NOTIFICATION%20FINAL_0.PDF"},"notes":null,"org_country":"US","org_id":"b7596ab85bfb","org_name":"Vibram USA, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46130"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2597530/supply-chain-security/vibram-suffered-five-finger-data-breach.html"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/VIBRAM%20NOTIFICATION%20FINAL_0.PDF"}],"summary":"Vibram USA reported that its website was targeted in a hacking attack that may have compromised customers’ credit card numbers.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cff4c7db68c5ead0058602352a83288d68f5aed7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"cef75210-d559-11e7-bfad-07ede9e0bc7c"},"incident_date":"2014-06-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8143805c73df","org_name":"Rady Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.law360.com/articles/987237/children-s-hospital-sues-insurer-for-data-breach-coverage;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Rady%20Childrens%20Number%20one%206_16_14_1.pdf"}],"summary":"An employee accidentally attached a file containing the data of 20000 young patient's to  job applicants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3cc818757b6fb762a32c0744572b60352edad28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CDFAAC0-7952-488C-A60B-A0A8E67DF26A"},"incident_date":"2014-06-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f8b5e162d6b","org_name":"Portsmouth Naval Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wvec.com/news/NAVY-Medical-records-of-Portsmouth-stabbing-suspect-victim-compromised--268313442.html"}],"summary":"Hospital employees accessed medical information of two patients without a need to know and thus without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d5a12af9abceac712cecc351225565413f0f61d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98FCEEEE-7F49-4870-8D2C-0F4C06C10E1D"},"incident_date":"2014-06-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25c2484c18ec","org_name":"MAXIMUS Inc","org_type":"professional_services","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/id/101739222;http://www.cnbc.com/id/101743080"}],"summary":"Internal actor wrote down social security numbers and other personal information of users of the Connecticut health care exchange. The data was found in a backpack that was found on the street later.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab352131a0d1201eecaba4125b7ae59c50ffb1e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56F8D536-1F28-4757-9460-7A808D579EC6"},"incident_date":"2014-06-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48596ea0c2c0","org_name":"Mark A. Gillispie","org_type":"healthcare","ransomware":null,"records_affected":5845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer leaves 5845 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3183e1793a93188b358c9db6243813ce6c3ffff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6496DB03-11D1-4331-B33A-BCBC4D7DDBC8"},"incident_date":"2014-06-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9a50b642432d","org_name":"Curledge Street Academy","org_type":"education","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.westernmorningnews.co.uk/Probe-possible-data-protection-leak-Devon-primary/story-21263719-detail/story.html"}],"summary":"Email misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4045acfc4365c3000273f8fcdf8326140d32ff2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDD022AD-5207-4895-B41F-5F176E4FC815"},"incident_date":"2014-06-05","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37f056953892","org_name":"Open Cities Health Center","org_type":"healthcare","ransomware":null,"records_affected":1304,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Email breach results in the exposure of 1304 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67ef320065292ec7018474e19b3e1cd1451e4758","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE0AF7D6-B863-4605-A5D3-8087ACD7CA56"},"incident_date":"2014-06-05","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb9a5f98d725","org_name":"Durham NH Police Department","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boston.cbslocal.com/2014/06/06/virus-infects-police-computer-system-in-durham-nh/"}],"summary":"End user received an email with malicious attachment. The user opened the attachment and infected machine with ransomware. The malware spread to a total of 20 machines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b887371586b5de4f643574c08cbe00b246e8bdc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC503F2C-800F-4764-9F9A-6313ED8FE1C3"},"incident_date":"2014-06-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e05098a336a3","org_name":"College of the Desert","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/College%20of%20the%20Desert%20Data%20Security%20Breach%20Notification_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45403"}],"summary":"The College of the Desert experienced a data security breach on Thursday, June 5, 2014.  The data security breach involved the release of the following types of your personal information:  your name, ssn, dob, gender, home zip code, the titles of positions you held at the college","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f595a89606596c61e0db7643963849271def6cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E4B183F-B6DC-4F52-92D8-4D98A36432BD"},"incident_date":"2014-06-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6bbd08295aa","org_name":"University of Virginia Law School","org_type":"education","ransomware":null,"records_affected":155,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/news/uva-law-school-official-inadvertently-sends-gpa-class-rank-data/article_937210ca-ed06-11e3-b453-001a4bcf6878.html"}],"summary":"A University of Virginia School of Law School administrator accidentally sent an email Wednesday with a spreadsheet attached to 155 law students that contained their GPAs, class ranks and personal biographical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46a1ecc71bcf6fe05f97d68f492fd789789fb6ca","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02DB61B2-D23A-42CB-A13A-8D2BF784962F"},"incident_date":"2014-06-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"29af1c14f730","org_name":"Operation for Security and Cooperation in Europe","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://au.news.yahoo.com/thewest/news/a/24150033/hackers-target-osce-website/"}],"summary":"Organisation for Security and Cooperation in Europe suffered DoS attack on Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b662d7d52ed1bb3ff36acf3872d302ddbaa61d76","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NCA%20Sample%202014-6-4_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cb678fb4ddc7","org_name":"National Credit Adjusters, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45330"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea151074bd5750bf33c8cf26ac695b51c7fbb642","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E45D2C1-4EC5-4910-BC2B-15EB72B8E3C7"},"incident_date":"2014-06-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"47c69d920894","org_name":"State of North Carolina","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/06/they-hack-because-they-can/"}],"summary":"news media in North Carolina reported that at least three highway signs there had apparently been compromised and re-worded to read Hack by Sun Hacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca71b75a106c13a75e248c0535c5a0c6fdc8c38c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E95B763-86A2-4442-99DB-E09D094BAC16"},"incident_date":"2014-06-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a1e8d688902","org_name":"St. Joseph Health","org_type":"healthcare","ransomware":null,"records_affected":33702,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressdemocrat.com/article/20140611/articles/140619898;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/06/12/st-joseph-health-sends-patient-breach-notification-letters/"}],"summary":"Over 30,000 records  are lost when a thumb drive was stolen from an office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a1d0aa684e3f6446116c1b321b0120cee3c2fff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E0C9AF8-6791-4FBC-A651-50F4B5E16811"},"incident_date":"2014-06-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3a6a3d082540","org_name":"Santa Rosa Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":33702,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/HIPAA-breach-34K-after-staff-slipup"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45460"}],"summary":"Unencrypted USB drive w/ PHI stolen from unlocked locker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f145b906894a557a8b6aeb0bd487661fdf209d17","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC64852D-C869-431D-B6FF-F2AC486299B7"},"incident_date":"2014-06-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a2d035f3da87","org_name":"Institute for Supply Management","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/leoking/2014/06/03/oops-bad-software-code-knocks-down-us-manufacturing-dow-jones-and-sp-500/"}],"summary":"Programming error leads to incorrect market data that caused a drop in the Dow Jones index.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","internal","other"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"773bb94eed6b9236523d8964b70b1b4034023fe0","impact_type":"data_theft","imported_from":null,"incident_date":"2013-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"27bb3ccb816a","org_name":"Win7Vista Forum","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Win7Vista Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/Win7Vista"}],"summary":"Win7Vista Forum was hacked in September 2013, and its internal database was dumped with members’ personal information and other internal data.","supporting_quote":null,"technology_involved":["forum database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e05d27a7298475ed88f3eca4cb7beeb1645dd14","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F234922-1F5E-481D-9F37-ACEABB17C218"},"incident_date":"2014-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fca096651dc","org_name":"Visionworks","org_type":"retail_ecommerce","ransomware":null,"records_affected":75000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pennlive.com/midstate/index.ssf/2014/11/highmark_visionworks_data_brea.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/11/11/penn-health-insurer-suffers-potential-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/statement-on-recent-visionworks-privacy-issue-affecting-75000-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/visionworks-notifies-75k-maryland-customers-of-missing-database-server/article/382915/;;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.visionworks.com/announcement/"}],"summary":"Even with strong administrative safeguards and comprehensive firewalls, a health data breach can occur if employees at an organization are careless with computers and portable devices that store sensitive information.  Visionworks, a subsidiary of Pennsylvania-based health insure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"248503f3b89c0a4dce586b84068b19b71339ac65","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00C84D6A-CDB8-4A5B-A1A6-0D75A65274D7"},"incident_date":"2014-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d65a3459d93","org_name":"University of Pennsylvania Health System","org_type":"healthcare","ransomware":null,"records_affected":661,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://robertjgraham.com/?p=13819;"},{"fetched_at":null,"title":null,"type":"press","url":"http://articles.philly.com/2014-07-18/news/51663609_1_data-breach-social-security-numbers-identity-theft"}],"summary":"Officials at the University of Pennsylvania Health System have notified 661 patients about a data breach that occurred when receipts from Penn Medicine Rittenhouse containing personal health data were stolen last month, the Philadelphia Inquirer reports.     Last week, the health","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65ec45ec4c5cdd20eb98eecdc533f6df3b53c07e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"912342D5-3365-4482-98D8-114CF3A144CA"},"incident_date":"2014-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1c600d138a7","org_name":"Summit School District","org_type":"education","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.summitdaily.com/news/11956738-113/district-information-student-file"}],"summary":"Last week Summit School District officials discovered a security issue that made some student and parent information available online. The district immediately investigated why the file was accessible, found a setting that allowed for a security bypass. the incident appears isola","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65a944c6d4caa4f7ca37998c81c5202440cc8916","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA707295-7395-4014-8F5C-2C33DE88A881"},"incident_date":"2014-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6403346a15c2","org_name":"Santander Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southendstandard.co.uk/news/11283531.Shoppers_warned_over_High_Street_cashpoints_after_scammers_strike/"}],"summary":"POLICE are warning people not to use High Street cash machines after fraudsters used skimming devices to steal cards.  Rayleigh Neighbourhood Policing Team issued the alert after card slot jamming devices were found on two cash machines in the High Street.  The device makes it ap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"589518cd94eedaba601773ad42e8c84abc9a88a3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4281122D-F1D1-4FA8-A660-B4DCAB9215E5"},"incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"f666ffc75b34","org_name":"Russian Radio","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://voiceofrussia.com/news/2014_06_26/Cyberberkut-organized-a-DDoS-attack-on-Russian-Radios-website-in-Ukraine-5755/"}],"summary":"Journalists of the Ukrainian branch of the Russian Radio bought and organized the transfer of military equipment to a unit of the National Guard, which is to participate in the punitive operation in the East of Ukraine in the near future. In protest against the explicit support o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e293a95afae44906ff44a018a67282b2d4fc0a21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b3f6ce70-c287-11e8-bf07-99bafabab839"},"incident_date":"2014-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a11e948b7d0a","org_name":"Polk County Health Services, Inc. Crisis Observation Center","org_type":"healthcare","ransomware":null,"records_affected":1071,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/polk-county-health-services-notifies-mental-health-patients-of-breach-that-began-in-2014/"}],"summary":"Polk County crisis center in Iowa unwittingly allowed sensitive patient information to be disclosed to unauthorized persons.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57881fa8281633dba9487c7eae7f91eb1d2a83a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA5EF1DD-AE57-40F6-BB7F-F6303BB4840E"},"incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1fe89231933","org_name":"Madvapes","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vapesquad.com/madvapes-security-breach/"}],"summary":"Madvapes sent a notice to customers about a security breach. No details given and the breach \"may or may not have\" involved credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["secrets"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ead8d8cf17ff05c687d06adf54289f47c89d3456","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFCE0252-2B4E-481D-84FC-2A167389F391"},"incident_date":"2014-06-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd9329f6981d","org_name":"LANDESK","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/11/breach-at-it-automation-firm-landesk/"}],"summary":"Software company suffers network compromise via stolen credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d06028acac73b2d22ead08f029175954a5ee8827","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B88E09D1-8309-4C06-9E4F-1A776189A8CB"},"incident_date":"2014-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"430920fe3d24","org_name":"Ken-Crest Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pottsmerc.com/general-news/20150122/woman-charged-for-16000-theft-from-lower-pottsgrove-patients"}],"summary":"A woman is facing felony charges after allegedly stealing more than$16,000 from special needs patients.  Christine Louise Yetter, 46, of Douglassville has was arrested by Lower Pottsgrove Police following a six-month investigation of missing funds from three special needs patient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f4236acb6c14df2ee4220074a000a74c6c4f14","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1994EA5A-E83C-4319-85E2-B46447A6188C"},"incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e2bf83ea6d8","org_name":"Just Yo","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2014/06/20/yo-app-allegedly-hacked-by-college-students/"}],"summary":"A Georgia Tech student, together with two of his roommates, claims to have hacked Yo, the Poke-like app that has set some (though not all) of Silicon Valley alight in the last 48 hours. [See update below: Yo has confirmed it has been hacked].  The student emailed TechCrunch detai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09e7a94691d0e2821f53065417ddfbea53edb659","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F61D6C46-14A7-42B2-8AD4-3808270BF631"},"incident_date":"2014-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co","org_type":"financial","ransomware":null,"records_affected":83000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/2014-08-27/customer-data-said-at-risk-for-jpmorgan-and-4-more-banks.html;http://www.theguardian.com/business/2014/aug/28/jpmorgan-chase-us-companies-hacking-attack-russia;http://www.theguardian.com/business/2014/oct/02/jp-morgan-76m-households-affected-data-breach;http://www.claimsjournal.com/news/national/2014/10/03/255787.htm;http://www.securitymagazine.com/articles/85854-jp-morgan-chase-sees-cyber-security-spending-doubling"},{"fetched_at":null,"title":null,"type":"press","url":"http://dealbook.nytimes.com/2014/10/02/jpmorgan-discovers-further-cyber-security-issues/?_php=true&_type=blogs&_php=true&_type=blogs&_r=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.consumerreports.org/cro/news/2014/10/protect-yourself-from-chase-mystery-breach/index.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/fbi-investigates-hack-of-jpmorgan-other-us-banks-7000033080/;http://www.nytimes.com/2014/08/28/technology/hackers-target-banks-including-jpmorgan.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/interactive/2014/10/03/business/dealbook/jpmorgan-documents.html"}],"summary":"In August, Bloomberg reported that the attack on JP Morgan had been linked to Russian hackers who FBI sources said had been able to extract gigabytes of sensitive data. The hack began in June but was not discovered until July and criminals were able to access the accounts of more","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3887fb1e5beb6623a3e88a22abac91356ecbc53b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBDB1622-F2AF-4B8B-9F45-9408370E2D01"},"incident_date":"2014-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"03827e32f700","org_name":"HM PASSPORT OFFICE","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://travel.aol.co.uk/2014/06/22/passport-sent-to-wrong-person-latest-blunder-backlogs/"}],"summary":"A passport, birth certificate and visa documents were mailed to the wrong person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":"RedHack","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f35f6da084ccf3823d46ef411ff1bfbbd46328a3","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F99A077-B1CF-43B7-B148-013264171636"},"incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"e5212aa05726","org_name":"Governors Office in Tunceli","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/RedHack-Hacks-Governor-s-Office-in-Tunceli-Urges-Govt-to-Punish-Child-Abuse-444807.shtml?utm_term=OSINT&utm_source=twitterfeed&utm_medium=twitter"}],"summary":"Members of the hacktivist group RedHack have hacked the website of the Governors Office in Tunceli (tuncelisodes.gov.tr) with the social support program SODES, leaving a message behind for everyone to read. ... Despite the fact that its been over half a day since the hack occurre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"redhack"}},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b5afa28e7277654cc22bb49d21c8f2d8923f143","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"234DF890-29E8-421D-A69F-062701170D54"},"incident_date":"2014-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed3aae23b1a6","org_name":"GE Healthcare","org_type":"other","ransomware":null,"records_affected":2400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/news/crime/chinese-engineer-accused-of-stealing-trade-secrets-from-ge-unit-b99344912z1-274122821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://media.jrn.com/documents/gecomplaint.pdf"}],"summary":"A Chinese engineer who worked in Waukesha for a subsidiary of GE Healthcare stole about 2.4 million files of trade secrets and other confidential company information and sent it to China, according to GE and the FBI.  Jun Xie, 41, who joined the medical equipment giant in 2008, h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Rex Mundi","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a3cb48c52732f9c54af4eb628f091cee1a599ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10D119F7-A282-4724-A5D5-D14CB7B07157"},"incident_date":"2014-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"996b1d723ed2","org_name":"Domino's Pizza Inc","org_type":"other","ransomware":null,"records_affected":650000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myce.com/news/hackers-compromise-personal-data-of-600000-dominos-pizza-customers-71814/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/RexMundi_Anon/status/477433239251189760"}],"summary":"Hackers have reportedly stolen data of more than 600,000 Dominos Pizza customers. A group of hackers demand  30,000 before next Monday or they will make captured data public. The hacker group goes by the name Rex Mundi and claims to have hacked the websites of Dominos Pizza in Fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"rexmundi"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55b1a9af9c7d4e2099e19a8edc714a739aba641b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"852B989D-71D4-4ACA-BF77-5FCDC2F92F5E"},"incident_date":"2014-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea0c58400f22","org_name":"Colorado Neurodiagnostics","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/06/23/colorado-neurodiagnostics-notifies-patients-of-data-breach/"}],"summary":"Lost laptop with PHI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0e0e4b813834c7ccaa3af184e6731a1d2bc3dcb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FB704C1-8641-4E94-82B4-4B49AC9185D8"},"incident_date":"2014-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3639bfabccb6","org_name":"Circle K/Shell","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baynews9.com/content/news/baynews9/news/article.html/content/news/articles/bn9/2014/6/25/credit_card_skimmers.html"}],"summary":"Card skimmers found on 2 gas terminals","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e4951deae5a3c39a7f4e8c11ca822504b26586d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C39C24E-F765-4D01-9F09-F4816B6BF85C"},"incident_date":"2014-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4722437d5be0","org_name":"Children's National Health System","org_type":"healthcare","ransomware":null,"records_affected":4107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/washington/blog/techflash/2016/05/childrens-national-health-system-hit-by-another.html"}],"summary":"Children's National Health System hit by another data breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03a30ce1eb9650326a0fe01c4dfc497e2b51687d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D46ECDAD-0B7A-4ED2-A09C-7DDE01067BC4"},"incident_date":"2014-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ca60bdbabb0","org_name":"Cedars-Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":33136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-cedars-breach-20140823-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-cedars-data-breach-20141002-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/cedars-sinai-increases-number-of-affected-patients-in-data-breach-to-33k.html"}],"summary":"Cedars-Sinai Medical Center in Los Angeles has reported the scope of their previously reported data breach is much larger than they initially realized, according to an Los Angeles Times report.  In August, the hospital reported at least 500 patients' protected health information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6a2a0604154ace7a9befacab9543703c7c097c9","impact_type":"data_theft","imported_from":null,"incident_date":"2014-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"df50cd966166","org_name":"Cannabis.com","org_type":"other","ransomware":null,"records_affected":227746,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Cannabis.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/CannabisForum"}],"summary":"Cannabis.com’s vBulletin forum was breached in February 2014, and data from over 227,000 accounts and nearly 10,000 private messages was leaked publicly.","supporting_quote":null,"technology_involved":["vBulletin"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5590a2e99fab9ee22537c48a0f06073a26a9f874","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F673E491-3C16-43B6-AA3A-673B8EFF88A5"},"incident_date":"2014-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"21d8b0cd87e1","org_name":"Bendigo Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.boorowanewsonline.com.au/story/2408418/locals-at-loss-after-suspected-card-skimming/?cs=545;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyadvertiser.com.au/story/2423363/bank-alert-after-reports-of-boorowa-atm-skimming-device/?cs=148"}],"summary":"According to local police, reports have been received relating to a possible card skimming device being used on the ATM at the Boorowa branch of the Bendigo Bank.  Senior Constable Randall Obrien warns the community to protect themselves by covering their PIN numbers when using a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e22b1a97069545cffb5daf512a5dead5dd00d8e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7DBF70B-AC39-4059-9BD9-F1C9DB7B6D0E"},"incident_date":"2014-05-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"f22f4df7573c","org_name":"www.aso.org.tr","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/redhack-anonymous-hacks-turkey/"}],"summary":"The famous Turkish Anonymous hacktivist group RedHack has hacked and defaced the official website of Ankara Chamber of Industry ASO, Turkey website (www.aso.org.tr).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b31dc95bc0ffe6b28b118484000ea7428b49f555","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"529719B8-605A-459A-AF5B-E28CDAEB6152"},"incident_date":"2014-05-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea509f46f570","org_name":"Midwest Urological Group","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/il-urology-patients-notified-after-laptop-attached-to-testing-equipment-was-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pjstar.com/article/20140604/NEWS/140609564/10924/NEWS"}],"summary":"A laptop valued at $4,000 was reported stolen from the Midwest Urological Group on Tuesday. According to a police report, the laptop contained patient information on its hard drive. An employee of the group contacted police Tuesday after noticing a laptop used by employees had be","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"526584168c66b3d7bd8f454806cc5abd1df63896","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D7227C5-E384-4745-A96F-B33F2042BDA6"},"incident_date":"2014-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"d10cd59b677c","org_name":"ARY News Channel","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/pakistan-ary-news-channel-hacked/"}],"summary":"The official website of Pakistans famous ARY News Channel website has been hacked and defaced by Pakistani hacker hasnain haxor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"998515e3e4368c62fcc17be2c7d24d34630b3492","impact_type":"data_theft","incident_date":"2013-03-08","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AMEX%20-%20Anonymous-5_29_14%20CA%20AG%20Letter_0_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45273"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45289"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45484"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45504"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AMEX%20-%20Anonymous-5_29_14%20CA%20AG%20Letter_0_0.pdf"}],"summary":"American Express notified a cardmember that their card information had been recovered during an investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a6b8d7fbff51387126649efb9f8a875672533d9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"246EDDF6-3EE6-4883-B6C3-5EA4BC1DA0EA"},"incident_date":"2014-05-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63462395c13a","org_name":"Byron Mallott Gubernatorial Campaign","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktoo.org/2014/05/30/mallott-campaign-computer-stolen/"}],"summary":"A laptop computer with donors financial information has been stolen from the Anchorage office of the Byron Mallott gubernatorial campaign.  The laptop was discovered missing about 7 p.m. Wednesday, as volunteers were wrapping up their day.  Campaign advisor Bruce Botelho says the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3033aecbde1bfb1ff2e5c01b07f6341e5b19f35","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EA13E95-074E-4EEB-9A13-33164C481772"},"incident_date":"2014-05-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.imore.com/apple-confirms-icloud-breach-not-reason-behind-apple-id-hijack?utm_source=dlvr.it&utm_medium=twitter;http://www.securityweek.com/compromised-apple-ids-used-hold-iphones-ransom;http://www.pymnts.com/news/2014/paypal-australia-reassures-customers-after-potential-data-breach/#.U4f4g16nvXU"}],"summary":"Abuse of \"Find My iPhone\" service (possibly through stolen credentials) to hold users for ransom.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd50407459b966dcf9bc2f2ed1f3d233531c0e16","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A7C7F8D-C9DB-4D77-8895-380CD23F06AD"},"incident_date":"2014-05-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3440a2c09f57","org_name":"US Central Intelligence Agency","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/world/2014/may/26/identification-cia-station-chief-afghanistan-reporter"}],"summary":"The White House blew the cover of the top CIA agent in Afghanistan on Sunday, when the persons name was included on a list given to reporters during a visit to the country by President Barack Obama. The name was then emailed by the White House press office to a distribution list ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3bcda1c6ec40349500fca69d74b76d061304d78","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7485F510-8C98-470E-9B22-3E4EF0DA52C2"},"incident_date":"2014-05-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85a7c8e7cd54","org_name":"Benjamin F. Edwards Co.","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/davelewis/2014/06/28/benjamin-f-edwards-co-discloses-data-breach-affecting-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/brokerage-firm-benjamin-f-edwards-fell-victim-to-cryptowall-infection/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://insurancenewsnet.com/oarticle/2014/07/17/knowbe4-warns-new-ransomware-strain-causes-data-breaches-a-531470.html#.U8gMPFaFr7R;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/benjamin-f-edwards-co-20140627.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45686"}],"summary":"Cryptolocker varient infects user laptop and encrypts files on the user devices and on shared file servers. In addition to the utility loss, there is evidence of data exfiltration.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f95bddebb3d58a53409164f9a95bc0f33044814","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2014-05-007%20Notice%20SDSU%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"d0b7ed88b7b9","org_name":"San Diego State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The database was misconfigured to allow any computer connected to the SDSU wired network to open it.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45195"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2014-05-007%20Notice%20SDSU%20Final_0.pdf"}],"summary":"San Diego State University disclosed that a misconfigured FileMaker database containing personal information could be opened by computers connected to its wired network, with no evidence of malicious access.","supporting_quote":"The database was intended to be used only by Pre-College Institute employees, but it was misconfigured to enable any computer connected to the SDSU wired network, with the program “FileMaker”, to open it.","technology_involved":["FileMaker database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"455503dd6f216151094d3bba10203cc1fe4ff42c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48D085F3-90D3-489B-BB3E-3C323EF5D580"},"incident_date":"2014-05-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"88df00536518","org_name":"New Zealand National Institute of Water and Atmospheric Research","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/386441,nz-meteorology-supercomputer-hacked.aspx"}],"summary":"An unknown intruder broke into the New Zealand National Institute of Water and Atmospheric Research (NIWA) supercomputer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eed3e6613669e4dc0d34e0605340ae08ffe6fde","impact_type":"unknown","incident_date":"2014-04-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20Exhibits%20A%20%20B_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"dd039f40a646","org_name":"Paytime Harrisburg Inc. d/b/a Paytime, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45149"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccebbe759e0d80f40ea11c906d09372c2c4f96fd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BA5B1DA-7892-4261-91EB-CFA9903EA22A"},"incident_date":"2014-05-20","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5d85801c97e6","org_name":"Aviva PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/06/23/aviva_heartbleed_hack/"}],"summary":"Mobile device management systems at insurance giant Aviva UK were last month hit by an attack  purportedly based on the Heartbleed exploit, although the firm denies this  that appeared to allow the perpetrator to royally screw with workers' iPhones.The insurance giant has played ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ff2228e14ead959e65a9ca293e96cd2c2cb524f","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Lowes%205-19-14%20Notice%20Letter_1.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"4422644a480a","org_name":"Lowe's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The vendor backed up the data to an unsecured computer server accessible from the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45134"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Lowes%205-19-14%20Notice%20Letter_1.pdf"}],"summary":"Lowe’s reported that a vendor’s unsecured internet-accessible backup server may have exposed personal information stored in E-DriverFile.","supporting_quote":"We recently learned that the vendor unintentionally backed up this data to an unsecured computer server that was accessible from the Internet.","technology_involved":["E-DriverFile"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"system_admin"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-05-19","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91741d2f897f4744a2a9be6989d159ecb5248d07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4db1e770-e924-11e9-b01d-8d8474fb7a4b"},"incident_date":"2014-05-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bcf2bd82501f","org_name":"American Crane and Tractor Parts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/former-sysadmin-caught-hacking-his-ex-employer-by-his-replacement/"}],"summary":"Kansas City court sentenced a Missouri man to six years in federal prison without parole for hacking his former employer, stealing trade secrets, and for accessing child pornography.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-19","discovered_date":"2014-04-17","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f969fbf5c757c4910ffe67fb9b92e7d53b884eb","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-12-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Affinity%205%2016%20Notification%20to%20Affected%20%28Website%20and%20Press%20Release%29%20PDF_0.pdf"},"notes":null,"org_country":"US","org_id":"caf4c0ac57f4","org_name":"Affinity Gaming","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Affinity%205%2016%20Notification%20to%20Affected%20%28Website%20and%20Press%20Release%29%20PDF_0.pdf"}],"summary":"Affinity Gaming reported unauthorized access to the system processing customer credit and debit cards, exposing card information used for non-gaming purchases.","supporting_quote":null,"technology_involved":["payment card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6656a457fcc344fa096882c33ed968e545b9efb7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4C34B77-0397-46B4-83D3-001E75F6D335"},"incident_date":"2014-05-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"4bd02ce25870","org_name":"American Health Inc.","org_type":"financial","ransomware":null,"records_affected":11531,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of 11531 documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c26a9898b2c6fb8540667c8010632e4bd7313dd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAAEBA52-1808-455F-A50A-B0285738C4F0"},"incident_date":"2014-05-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fdc8e7dc0d7f","org_name":"University of Nottingham","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timeshighereducation.co.uk/news/nottingham-apologises-after-personal-data-leak/2013528.article"}],"summary":"Two automated emails were sent out over the weekend of 17-18 May to users of the universitys online recruitment system. Some of them included not only details of jobs advertised since November 2013 but information  including dates of birth, telephone numbers and home addresses  a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccc99cb3a9268e5d9f51de8b4eed909647a24cf3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42618A70-B7F9-474B-BCC6-2D4D7DDAB304"},"incident_date":"2014-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d6fb3549bf0","org_name":"Operation Supply Drop","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.polygon.com/2014/5/17/5726526/operation-supply-drop-donate-troops-hackers-ddos"}],"summary":"Less than half an hour after beginning, the third annual 8-Bit Salute of Operation Supply Drop  a fund drive to send video games to U.S. troops serving abroad  was beset by hackers and the site was taken down by DDos attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fc19ddaaf7e3384b9b2c94111b4de784b8a6180","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"093AA315-EBB6-47DB-9533-1FFE795D5BD1"},"incident_date":"2014-05-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ddd25833f290","org_name":"Pacific Highway Rentals","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcbayarea.com/news/local/Hacked-San-Francisco-Message-Board-Warns-About-Godzilla-Attack-259449961.html?_osource=SocialFlowFB_BAYBrand"}],"summary":"Someone hacked into an electronic traffic sign on Van Ness Avenue in San Francisco Wednesday, posting alerts that said \"Godzilla Attack\" and \"Turn Back.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b2b0dd1ecae2e1a632b7736e3c8fbcf84c599cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72E1DDDB-74FE-490A-9343-0DC0278D6A89"},"incident_date":"2014-05-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5795aa6d00f2","org_name":"Symbius Medical","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CCkQFjAA&url=http%3A%2F%2Fwww.symbiusmedical.com%2Fwp-content%2Fuploads%2F2014%2F07%2FWebsite-Posting-071114.pdf&ei=CHxuVPTKOYyqogSi-YLQAw&usg=AFQjCNFoFHt0Ly_ZB2cszfAYnE2EmsDz5g&sig2=kLuCBojmMQnojPLyCzeePA&bvm=bv.80185997,d.cGU"}],"summary":"On May 15, 2014, Symbius Medical became aware that five former sales representatives accessed the companys electronic records and downloaded health information to non-Symbius devices in the weeks leading up to their resignations from Symbius Medical and subsequent employment with","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2014-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e312834d673b53b19e898ab5b71d8856db9882b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6155DA32-DEC0-4E9B-97D3-85F6D7260FBA"},"incident_date":"2014-05-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"618865be83fd","org_name":"State of Montana's Department of Public Health and Human Services","org_type":"government","ransomware":null,"records_affected":13000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=17052"}],"summary":"Hackers gained entry to a State of Montana's Department of Public Health and Human Services (DPHHS) computer server, state officials announced on Tuesday,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":"Syrian Electronic Army","variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-05-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e986d6687bfba297e505c37996ebb6375013ba5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF1140AD-5AFE-4629-8A48-D0FCF6723A0E"},"incident_date":"2014-05-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"757536b54f24","org_name":"Financial Times Group Ltd.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://labs.ft.com/2013/05/a-sobering-day/"}],"summary":"Hackers from Syrian Electronic Army using phishing to steal credentials and then deface pages.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"syrianelectronicarmy"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6cc07d9b186067e99e6930a2beb554454bfa170","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5822B8C-E33E-4139-89CD-0EBF92B74D79"},"incident_date":"2014-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f133411eaf11","org_name":"Antiwar.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/antiwarcom-server-hacked-during-fundraiser/article/347143/"}],"summary":"A libertarian website's server was hacked after the start of its fundraising drive. Foreign attackers allegedly took down Antiwar.com which devotes itself to non-interventionism via a DOS attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb440b0a5520ba6697d02aa67aaddec1845082ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"167ECA3D-1510-4BF3-9AFC-EB0E8CDC920C"},"incident_date":"2014-05-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61cb1827dc39","org_name":"Hurley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/mi-hurley-medical-center-e-mail-error-discloses-some-employee-and-retiree-social-security-numbers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mlive.com/news/flint/index.ssf/2014/05/hurley_medical_center_accident.html"}],"summary":"Hurley Medical Center inadvertently released the names and social security numbers of an undisclosed number of employees and retirees while trying to fix issues with its health care plan.  According to a news release from Hurley Medical Center, the hospital recently discovered th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77772993c1205d5ef3129912b428dfab9c3f00e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"113894CF-3622-4EB1-B73E-FC9D1CBB958B"},"incident_date":"2014-05-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"b1f3206f9e50","org_name":"Tata Motors Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/05/tata-motors-website-hacked-by-pakistani.html"}],"summary":"he official website of Tata Motors, the Largest Indian multinational automotive manufacturing company, has been breached and defaced by a Pakistani Hacker who uses the online moniker \"H4$N4!N H4XOR\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"LulzSec","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c593098682d9ff78c62de8ea8ffc7024586541d","impact_type":"data_theft","imported_from":null,"incident_date":"2011-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"2125a5b638c1","org_name":"Hack Forums","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: hackforums.net","type":"hibp","url":"https://haveibeenpwned.com/Breach/HackForums"}],"summary":"LulzSec leaked credentials and personal information from the Hack Forums website in June 2011.","supporting_quote":null,"technology_involved":["Hack Forums website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"lulzsec"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"1337MiR","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c031ef45aae2e921867cf35676c90621dd35e5a","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"AU","org_id":"d5a004af0430","org_name":"Business Acumen Magazine","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Business Acumen Magazine","type":"hibp","url":"https://haveibeenpwned.com/Breach/BusinessAcumen"}],"summary":"Business Acumen Magazine’s website was hacked in April 2014, exposing account details including usernames, email addresses, passwords, and website activity.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"1337mir"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88e47831b8dae36c68023d72d668683aa87f1a93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D70BCC9B-1440-4276-A865-28DE1D260544"},"incident_date":"2014-05-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f267b2e8ccef","org_name":"Touchstone Medical Imaging","org_type":"healthcare","ransomware":null,"records_affected":307528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/update-touchstone-medical-imaging-breach-affected-over-307000-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.touchstoneimaging.com/notice_to_patients_regarding_privacy_incident.aspx?utm_content=9196641&utm_medium=social&utm_source=linkedin;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Touchstone_2.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2691601/data-breach/touchstone-medical-imaging-reveals-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/touchstone-medical-imaging-reveals-data-breach/"}],"summary":"Touchstone Medical Imaging is a company that is based in Brentwood Tennessee. This is a medical firm that provides services such as MRI, CT scans, Ultrasound and Mammography. Today they announced that they suffered a data breach as the result of an open share that was exposed to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1ffe62342c779372359c3b2987899402c25aa3f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70D6F5D8-F9F2-4414-99F5-0B0DB7D57227"},"incident_date":"2014-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfcee2bed950","org_name":"Point DNS","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/38370/global-hoster-point-dns-suffers-major-ddos-attack/"}],"summary":"Domain hosting service Point DNS suffered a major outage on Friday after it was hit with a serious DDoS attack on all of its DNS servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b7f5a2426587853bd6088ff9f2462d32bccae8f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"480A3058-26EA-43E3-8792-FE5B60315C98"},"incident_date":"2014-05-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cce8b961ce4b","org_name":"Options Counseling Center","org_type":"healthcare","ransomware":null,"records_affected":2828,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft od documents exposes 2828 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83f94b276748c88176340616fb572f78ccf05c78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2FA8CF1-3914-4126-8C36-32275DFFAFA5"},"incident_date":"2014-05-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31a87f4fec9d","org_name":"Mizado Cocina Restaurant","org_type":"other","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nola.com/business/index.ssf/2014/08/restaurant_mizado_cocina_says.html"}],"summary":"New Orleans restaurant Mizado Cocina says customers' credit and debit card information could have been stolen by a hacker who breached the restaurant's point of sale system between May 9 and July 18.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40489c9ce1a73b7432a1a8d686ada0fac41a9248","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41232BB7-201C-4FE7-B5A5-0FF041D84962"},"incident_date":"2014-05-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ddd76e2823f","org_name":"Bluefield State College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wvnstv.com/story/25465912/men-wanted-in-connection-to-stolen-credit-cards-at-bluefield-state-college"}],"summary":"two men who reportedly went into an on- campus office at Bluefield State College and stole credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb22de99f07c63f4f67d8eb55bf9cd3819091cbe","impact_type":"unknown","incident_date":"2014-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter%20from%20Green%27s%20Accounting_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f8f737803b0c","org_name":"Green's Accounting","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45036"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66f2be6e3db3aa8f407a4c4e324968663420e848","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-11-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GSC%20-%20Sample%20Consumer%20Notification%20%28v.1%29_0.pdf"},"notes":null,"org_country":"US","org_id":"fd7f17502f18","org_name":"Gingerbread Shed Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45053"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GSC%20-%20Sample%20Consumer%20Notification%20%28v.1%29_0.pdf"}],"summary":"An unauthorized third party may have accessed customer personal information, including credit card information and website account usernames and passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"ID","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9fc79174406f57d8e4674289b45dbfae1b40fcc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68B747A3-DCBB-4E72-98A6-0155439FD478"},"incident_date":"2014-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"YE","org_id":"e168c7e962dd","org_name":"Yemen Ministry of Human Rights","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/indonesia-hackers-hacks-yemen-domains/"}],"summary":"A group of Indonesian hackers going with the handle of Gantengers Crew have hacked and defaced the official website of Yemens Ministry of Human Rights, United Nations Development Programme (UNDP), United Nations and United Nations Volunteers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-06","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b9d6e47b63cdc97bedba2e4309b5af59040ee9d","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-04-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Solano%20Security%20Incident%2005-2014_0.pdf"},"notes":null,"org_country":"US","org_id":"37b20dd3d6b4","org_name":"Solano County Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Several letters were misplaced while in the custody of a contracted courier transporting mail to the US Post Office.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45026"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Solano%20Security%20Incident%2005-2014_0.pdf"}],"summary":"A contracted courier misplaced letters containing personal information, though the county had no evidence that the information was actually lost or disclosed to an unauthorized individual.","supporting_quote":"On April 7, 2014, several letters from the Solano County Department of Child Support Services were misplaced while in the custody of a contracted courier who was transporting mail to the US Post Office.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Deletesec","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","other"],"disclosed_date":"2014-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc7f17bbbec0701f318bbfc83acf566348658040","impact_type":"data_theft","imported_from":null,"incident_date":"2014-05-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"8f1828e216cc","org_name":"Fridae","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Fridae","type":"hibp","url":"https://haveibeenpwned.com/Breach/Fridae"}],"summary":"Fridae user accounts were breached, exposing email addresses, passwords, usernames and website activity.","supporting_quote":null,"technology_involved":["Fridae website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"deletesec"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36ab6ca3a5c15e5403dbdadbc19a684a25ddf8d0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B64B656E-64EA-46DD-A7BC-8BAAB6595E8B"},"incident_date":"2014-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"48f4e517ff64","org_name":"Virgin Mobile (Australia) Pty Ltd","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://community.virginmobile.com.au/t5/Phones-Forum/Network-Outage-3-May-2014/td-p/35927;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.ninemsn.com.au/technology/2014/05/03/11/31/virgin-mobile-outage-leaves-millions-without-service"}],"summary":"Outage leads to disrupted service for Virgin Mobile customers. Glitch caused postpaid customers to be shown as prepaid customers with no credit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Anon Ghost","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d8ddefe2ad9a2afa9a99de98ed343736c2509d1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F06FEB16-5FD3-4D19-ABDC-91F891B44A0C"},"incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"765602615537","org_name":"\"ybs-bank.com\" a Malaysian imitation of the real Yorkshire Bank website","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/03/06/fake_bank_website_defaced/"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonghost"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0263d7acf03c945ea83271acfa446e00284f3e4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50AE857A-767B-4A66-AE2A-B56C39118A00"},"incident_date":"2014-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"13d748b54a52","org_name":"Student Loans Company","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timeshighereducation.co.uk/news/slc-rapped-over-data-breach/2013647.article"}],"summary":"mailing error sent three medial records to the wrong people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6010c27f0f2149aaf8f748bb0aa3a3de967cd658","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A5B4C17-D784-40F3-A85C-E22C01A5E5A2"},"incident_date":"2014-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"916b76317333","org_name":"Siam Commercial Bank PCL","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phuketgazette.net/phuket-news/Phuket-Police-warn-new-ATM-skim-device/29596#ad-image-0"}],"summary":"Skimming device discovered on ATM in a Phuket 7-11.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce00991caa11e52192ad52e1bfa00e2d59f28a8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C714836-60BB-4645-A27D-1A70D0B8957B"},"incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d474640d7d6e","org_name":"Premera Blue Cross","org_type":"financial","ransomware":null,"records_affected":11000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/two-more-health-insurers-report-data-breach/d/d-id/1319511"}],"summary":"target of sophisticated cyberattacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92119772b16220b453c727e54d10dadac7ec2dda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5256D61-27F2-4CA5-A40E-19309B3C99AF"},"incident_date":"2014-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1128c639e60d","org_name":"Mobilex USA","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/mobilexusa-notifies-affected-patients-of-possible-privacy-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"https://finance.yahoo.com/news/mobilexusa-notifies-affected-patients-possible-100000549.html"}],"summary":"On or about May 1, 2014, Mobilex mailed a package from its office in Indiana to a corporate office in Pennsylvania. The package contained patient records related to x-ray services that Mobilex provided. After numerous emails and phone calls to inquire about the package, on or abo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"444e91bc565360f3dacf1c7f2e28de33b48f0aff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9EDDE18-32CA-4181-B29D-B672A405ECA9"},"incident_date":"2014-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"2f2f1ce626e0","org_name":"Ministry for Economic Affairs and the Interior","org_type":"government","ransomware":null,"records_affected":900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thelocal.dk/20140703/900000-social-security-numbers-leaked;http://cphpost.dk/news/security-breach-leaks-900-000-cpr-numbers.10100.html"}],"summary":" The social security numbers of all Danes on the so-called Robinson List, a list of individuals who have opted out of receiving advertisements in the post, were released due to an error within the ministry.    Carsten Grage, an official with the national CPR registry, confirmed t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bd14cffbc67f0aaacb0e58757e520747d404c4b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A144FC0C-40AE-4997-9B2A-D7DAF7816467"},"incident_date":"2014-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6d7b1756803","org_name":"Midwest Womens Healthcare Specialists","org_type":"healthcare","ransomware":null,"records_affected":1532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kshb.com/news/local-news/exclusive-settlement-reached-over-improper-disposal-of-womens-medical-records;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kshb.com/news/local-news/medical-records-lost-outside-research-hospital"}],"summary":"Attorneys representing more than 1,500 women whose personal medical information was compromised when their records were blown from a dumpster on a windy day in May have reached a settlement agreement with the medical group responsible.   In the settlement agreement, which still h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea02ccfbe4013067f99b048db8031ab48da42a42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB9939F6-CC3B-43FF-8AF7-DD501BEF9700"},"incident_date":"2014-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"b363c3eefbf8","org_name":"Mandiri Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thejakartapost.com/news/2014/05/13/mandiri-withdraws-cards-over-skimming-indication.html"}],"summary":"ATM skimming in Jakarta, Java, Bank there re-issued millions of debit cards over the incident.  Identified through internal fraud, no mention of finding the skimmer on ATM(s).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b1a7fca038ff0efce2b4f39233391840d6d4c83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB546E55-78B5-46E1-8F74-37B0793EB637"},"incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5380e69e10e8","org_name":"LifeWise","org_type":"financial","ransomware":null,"records_affected":250000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/two-more-health-insurers-report-data-breach/d/d-id/1319511"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/two-more-health-insurers-report-data-breach/d/d-id/1319511;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/portland/blog/health-care-inc/2015/03/premera-data-breach-affected-oregons-lifewise.html"}],"summary":"target of sophisticated cyber attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d221e17deda0ca22ab3ba7c5f0490c7796b7d501","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/JCM%20Next%20of%20Kin%20Notice%20Letter%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"569070db031f","org_name":"JCM Partners, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/JCM%20Next%20of%20Kin%20Notice%20Letter%20Template_0.pdf"}],"summary":"JCM Partners sent a consumer notification letter concerning an incident involving a deceased person's personal information; the excerpt does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6afb1412dd401cc7681cddf76635b97f472c9c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31bb7940-1c51-11ea-a7e6-812a11e02697"},"incident_date":"2014-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99df9299c8eb","org_name":"InfoTrax Systems","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2019/11/breach-affecting-1-million-was-caught-only-after-hacker-maxed-out-targets-storage/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/company-discovered-it-was-hacked-after-a-server-ran-out-of-free-space/"}],"summary":"The US Federal Trade Commission has sued an IT provider for failing to detect 20 hacking intrusions over a 22-month period, allowing the hacker to access the data for 1 million consumers. The provider only discovered the breach when the hacker maxed out the provider’s storage sys","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bc81215eaed54d111b8192432c502ef2cb0e8af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74EAE6D1-C634-4F82-9389-5D6327F8F094"},"incident_date":"2014-05-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cfedfaba10b6","org_name":"HEATHERWOOD AND WEXHAM PARK HOSPITALS NHS FOUNDATION TRUST","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-hampshire-27730252"}],"summary":"Inpatient surveys were sent to the third party Picker Institute Europe and to data analysis company Ciconi, without patient identification being removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63df0626b40ee96fa7111dfd27728a792bc4980e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55F078A6-A2E9-4CC3-B9DA-784A69CDE41E"},"incident_date":"2014-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"048377173e4d","org_name":"H&R Block Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc22now.com/shared/news/top-stories/stories/wkef_vid_20046.shtml"}],"summary":"Thieves break into multiple H&R Block stores in the Miami area and steal personal records for identity theft purposes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53ff44e28833947745b5208705d706853e9ac6da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C162377C-13F1-4777-9105-CD85FBE7354D"},"incident_date":"2014-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"28a609a943ce","org_name":"Greater Manchester Police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-domestic-abuse-privacy-breach-greater-manchester-police-pays-victim/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-manchester-37035874"}],"summary":"Domestic abuse victim has medical information released by police in training session. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bda9870cf4031faa0d847bc43b047d55e75e90b4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D00E63A-E509-4421-BF87-7DB145AA70CD"},"incident_date":"2014-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"692e48ffaf0c","org_name":"Emory University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/shareables/2014/05/16/emory-university-server-accidentally-sends-reformat-request-windows-pcs-including/"}],"summary":"Emory University System Center Server accidentally sends out a command to all workstations and servers to format themselves and install Windows 7. By the time the error was discovered even the SCCM server itself had formatted itself.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1249c384ee6e0fc8e0aee7ae0b45d0f24eef2166","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CF4C633-1914-4907-B0C9-59ECCDD64BBA"},"incident_date":"2014-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d9769ee9fc8","org_name":"Denver VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":239,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/news/ci_25844884/two-laptops-stolen-from-denvers-va-hospital"}],"summary":"Two laptop computers containing information on 239 veterans have been reported stolen from the Denver VA Medical Center. Somebody broke into a locked lab and stole laptops. The data, which includes names, ages, Social Security numbers and test results is encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"420829182f82c1c215d773707615fbb439cd9088","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E51087D5-25DA-4DD7-A451-7046ADC80542"},"incident_date":"2014-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11e4a7908937","org_name":"City of San Antonio","org_type":"government","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/news/local/article/City-owned-laptop-with-immunization-records-stolen-5591217.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://shererandcrow.com/uncategorized/city-owned-laptop-with-immunization-records-stolen/"}],"summary":"A San Antonio city-owened laptop with &lt; 300 people's immunization records was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"708f4034936094520e2350b20be990dd06d09766","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3408E758-56A9-4395-9EE1-3735E589E419"},"incident_date":"2014-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e26a8690d4f2","org_name":"City of Rogersville, AL","org_type":"government","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.waaytv.com/appnews/rogersville-employees-personal-information-accidentally-posted-on-facebook/article_70e87706-dbc7-11e3-b5b9-0017a43b2370.html"}],"summary":"Employee mispublished personal information of over 20 city employees to facebook for 2 hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64739878698dfa3b6175030d6b55db77e47ca0a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3A16A12-9948-4DA7-8549-B337E62BB2AE"},"incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e41371db132","org_name":"bit.ly","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.bitly.com/post/85169217199/urgent-security-update-regarding-your-bitly-account"}],"summary":"bit.ly suffered a data breach but didn't tell anyone how it happened. Update: Audits to the hosted source code repository, which contains the credentials needed to access the offsite database backup, turned up an employees account that had been improperly accessed. This access wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"323783e4dda2c4834666c5c05e1d88ba2dfc765f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBAA50ED-63DE-4F24-9076-F89A4B44C83A"},"incident_date":"2014-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"d5e897b4c213","org_name":"BE Foreign Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2014/05/12/us-belgium-cybercrime-ukraine-idUSBREA4B0EB20140512"}],"summary":"Hackers stole data related to the Ukraine crisis from Belgian foreign ministry servers. \"It was malware which copied documents specifically related to the Ukraine crisis,\" the spokesman said, giving no further details on the type or sensitivity of the files stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b8b39df588b0524086cd79fa455dac33a479eaa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CEE2285A-3EFE-40D5-9129-61CA3D662DF6"},"incident_date":"2014-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87c986757614","org_name":"Bay Area Pain Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":2780,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/patient-data-compromised-after-computer-theft-at-bay-area-pain-medical-associates.html;http://www.scmagazine.com/thousands-had-data-on-computers-stolen-from-california-medical-office/article/361852/"}],"summary":"A physician office in Sausalito, Calif., is notifying nearly 3,000 patients of a potential data breach after three desktop computers were stolen from their office.  Bay Area Pain Medical Associates' office was burglarized on May 19. In the notification letter sent to patients, th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fdec4c791fff771ba20fbb7f2450a98cdeb509a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C295514-3249-4178-9DB7-D205F93E3E90"},"incident_date":"2014-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"1fe0d4a856a9","org_name":"Avast Software NV","org_type":"other","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/05/avast-community-forum-hacked-user-names.html#sthash.FQYnwhtP.dpuf;https://isc.sans.edu/diary/Avast+forums+hacked/18171;http://www.tomsguide.com/us/avast-antivirus-security-forum-hacked,news-18835.html"}],"summary":"Community support forum for AV company hacked with personal information of users (name, email, sha-1+salted password).  Web site used \"Simple Machines Forum (SMF)\" software that apparently was not the current version.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aa243485b3d0e9078fda292f965d28f5e18dc1f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8B8DFCE-3018-4627-916F-399BEBA65DD2"},"incident_date":"2014-05-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0fde5e1d8931","org_name":"AFGlobal Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2016/01/06/wire-scam-worked-texas-company-says.htm"}],"summary":"insurance company will not cover whaling event","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e56778ca237808ef9cefaf238a4d6f39a03dcb29","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59FAF83E-10B7-49EF-A454-C63C7F05119F"},"incident_date":"2014-04-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7202465e2d08","org_name":"Neustar UltraDNS","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://isc.sans.edu/diary/UltraDNS+DDOS/18051"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"The GreaT Team(TGT)","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2404e136dd8a2532e568fac185725cb6541bd7ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35C188A4-39E8-440F-AF51-7D4E7E4D5784"},"incident_date":"2014-04-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1dde9a27418e","org_name":"Kali Linux","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/04/kali-linux-website-hacked-by-great-team.html"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thegreatteam"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4b3e0f66451ce1114c78950d8678419e5608ac7","impact_type":"data_theft","incident_date":"2013-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Breach%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"2087e6e81458","org_name":"Boomerang Tags","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44963"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Breach%20Notification%20Letter_0.pdf"}],"summary":"Boomerang Tags said malicious software installed on its website hosting server compromised payment card data of customers who made purchases between July 4, 2013 and February 18, 2014.","supporting_quote":null,"technology_involved":["Website hosting server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29d4f6d9a701b96a76727e77115b1ebf364c6288","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86C4E1F1-822D-4313-B78C-784CEB5861BE"},"incident_date":"2014-04-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9de6d2a48ac8","org_name":"Reading Health System","org_type":"healthcare","ransomware":null,"records_affected":1845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of documents exposes 1845 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"KH","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b10fb414e5db82c3f3649815f9921b27efcea655","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CF529BF-B044-490C-8280-074A03780222"},"incident_date":"2014-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KH","org_id":"41452e8f5a9a","org_name":"KH Cambodia Anti-Corruption Unit (ACU)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cambodiadaily.com/news/hackers-confess-to-infiltrating-anti-corruption-unit-58181/"}],"summary":"Two alleged members of the hacking group Anonymous Cambodia who were charged Monday with infiltrating the website of the Anti-Corruption Unit (ACU) confessed to their crimes Tuesday, the ACUs chairman said.  Keo Sipheng, 26, and Sohang Ratana, 26, told authorities they hacked the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"LY","motive":"unknown","name":"The GreaT TeAm","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f133602325a07821c9ed1c243db1c52c2f34e690","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FCA1D02-6BB3-491D-9EB0-0D5854EC2C98"},"incident_date":"2014-04-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"b3ebe3c67cf9","org_name":"Egypt’s Ministry of Information","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Egypt-s-Ministry-of-Information-Hacked-and-Defaced-439700.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"thegreatteam"}},{"actor":{"category":"external","country":"SY","motive":"grudge","name":"SEA","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9dea4c1ec3c49ddd4bdcd344b9cce8654edb918","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C78C3E57-89C5-467B-A037-2192FE7343ED"},"incident_date":"2014-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4165ff641ad1","org_name":"RSA Conference","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Defaces-Website-of-RSA-Conference-439866.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"sea"}},{"actor":{"category":"external","country":"SA","motive":"unknown","name":"NeT-DeViL and Dr-TaiGaR from Group Hp-Hack","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29f18dc1d471eb6d8ea3dea8a641bfddc0b12698","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1524FE3D-9826-40AE-ABBB-DC67A90EC8A3"},"incident_date":"2014-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"236d087bf8e8","org_name":"City of Westminster","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/group-hp-hacks-westminster-city-website/"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"netdevilanddrtaigarfromgrouphphack"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"558750215a0213917279f133d3e2bc2b9983c623","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F6DCBE0-4814-46BA-AEBA-EC6E76FC6924"},"incident_date":"2014-04-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3089636d018c","org_name":"Backcountry Gear","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/malware-on-backcountry-gear-website-payment-cards-compromised/article/363888/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-46047"}],"summary":"Malware installed on the Backcountry Gear website for about three months beginning in late April likely resulted in a compromise of customer information, including payment card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6929c5113034dfb0de48ec02ab504ebf70e5391","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A8802A7-B065-46D0-AB75-3FDFDEF7B812"},"incident_date":"2014-04-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db7ebeb8fe96","org_name":"The Garlands of Barrington","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyherald.com/article/20150423/news/150429392/"}],"summary":"A former Elgin woman pleaded not guilty in Lake County court Thursday to charges she assumed the identity of an elderly resident at The Garlands of Barrington to steal thousands of dollars.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09d9d4c909c4dd69a3ab280370d9b314a57a1979","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DB32A25-E8DE-4DE3-8307-46B0E2FCDAAB"},"incident_date":"2014-04-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85b6673ffa50","org_name":"New York University Langone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nyu-langone-medical-center-notified-patients-of-stolen-unencrypted-laptop-containing-patient-information/"}],"summary":"NYU Langone Medical Center notified patients this week that an unencrypted personal laptop containing patient personal and/or protected health information (PHI) was stolen on Friday, April 25, 2014, from the car of an employee traveling in California. Upon discovering the theft, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fb93115db4ef168b3f99c4022704f07e34826bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67AC8D2D-633F-471D-8A2E-443A5F58965B"},"incident_date":"2014-04-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5b9101fc7e4","org_name":"Iowa Medicaid Enterprise","org_type":"healthcare","ransomware":null,"records_affected":862,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in the exposure of 862 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d27883ff75cf12fd9efe9ab8fe721f79d6ba107c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCE8F3DD-47C3-4DE7-9432-165413F5B97A"},"incident_date":"2014-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f072e8817e4","org_name":"Baylor Medical Center at McKinney","org_type":"other","ransomware":null,"records_affected":1253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Email hacking exposes 1253 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2014-04-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef3b18c6b67ac777b9a5334d22bee80927538805","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28B31611-C87F-447F-B618-2D6FBC834E51"},"incident_date":"2014-04-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43096392a114","org_name":"NRAD Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/employee-accesses-nearly-100k-patient-files-in-nrad-medical-associates-breach/article/357218/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/radiologist-bypasses-billing-system-computer-security-and-acquires-97000-patients-info-from-nrad-medical-associates/"}],"summary":"As many as 97,000 current and former patients of New York-based NRAD Medical Associates had personal information  including Social Security numbers  compromised by a former employee radiologist who accessed and acquired the data without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"910d5623cb4e93bf18d6144af7187c2be5d02d74","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A8FFED6-0418-480D-9938-55B09F638126"},"incident_date":"2014-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53d98b845f5e","org_name":"Charles Schwab Corp/The","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.yahoo.com/?err=404&err_url=http%3a%2f%2fnews.yahoo.com%2fschwab-website-hit-second-cyber-attack-problem-resolved-173019949--finance.html"}],"summary":"Charles Schwab website down after being hit with DoS attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80dd3843543a70a4bd5ab4fc0f611787d3ee1ff7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F98019C7-8068-40D1-983D-3CB6493D5EFC"},"incident_date":"2014-04-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77a11f9bd8c7","org_name":"Boston Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/business/2014/04/23/boston-children-hospital-comes-under-repeated-cyber-attacks/RBTgg9pT2YU8upp3W4IpzI/story.html"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec0ad2d4919a30838d9888037ed35d5dc3c6b2c1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8AA4C30-B802-4E73-A159-FED91FE023F1"},"incident_date":"2014-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8d556d6bb33","org_name":"The Natural, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/vitamin-seller-website-attacked-payment-cards-and-other-info-compromised/article/366314/"}],"summary":"Anyone who made credit or debit card purchases on TheNaturalOnline.com website between April 22 and July 17 may have had their information compromised by an attacker who forced their way into The Natural's computer system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-22","discovered_date":"2014-01-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557c8f9acbe7726a61277a00fa487d7e50ca3698","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Snelling%20-%20Sample%20Individual%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"7c930390b0d8","org_name":"Snelling Staffing, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44897"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Snelling%20-%20Sample%20Individual%20Notification_0.pdf"}],"summary":"Snelling Staffing discovered unauthorized access to certain electronic information that may have exposed personal information of some current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2014-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97fd957072fd094053cfd2c2961b594017133b7e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D94C7D1-D0F2-493B-BB3F-314043B33D14"},"incident_date":"2014-04-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f5d455834f1","org_name":"Quincy MA Veterans Services Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ma-records-with-private-info-about-quincy-vets-found-on-city-streets/"}],"summary":"Records with private info about Quincy vets found on city streets","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4dec24892334b2320cd348284bf80c33be5c9a1","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA_SAMPLE-0-D_0.pdf"},"notes":null,"org_country":"US","org_id":"b1efda48bcbb","org_name":"NCO Financial Systems, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44894"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA_SAMPLE-0-D_0.pdf"}],"summary":"NCO Financial Systems said its communications vendor mistakenly emailed some loan customers an attachment containing unrelated loan statements and personal information.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":true,"vendor":"RevSpring, Inc."},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"fc609ad7eee9","name":"RevSpring, Inc"}]}},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"214b009590b68fe0f2891c5f4d11037a7366c19c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33742D25-46BD-4497-97BB-9E3C48E4566E"},"incident_date":"2014-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c097c57b55af","org_name":"LK Advani","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/04/lk-advanis-official-website-hacked-by.html"}],"summary":"Hacker defaces website of government representative","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4777ad89723ce16f9e2048a3e011a041f0008f15","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3F08223-0046-42CF-8723-E335031AF1B8"},"incident_date":"2014-04-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d67b2b297c3a","org_name":"Scoop.it","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.scoop.it/2014/04/24/explanations-and-lessons-from-the-ddos-attack/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33f4d55b94632466450eccfe6f761a629a5194d3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68EF076E-8D78-4A60-A398-86C38F4046C5"},"incident_date":"2014-04-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5ff5878beb2","org_name":"Metropolitn Companies, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2365808/cyber-attacks-espionage/metropolitan-group-suffers-data-breach.html"}],"summary":"not much informtaion is available. Writer sys 'somebody snuck in through a back door'. It is assumed he ment that a C2 was utilized and not as a figure of speech. Some fault in the firewall allowed someone accesss to file server with PII on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5793d88f56ade16522efd157ac7e2fa3f782c00b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60A730F2-39C9-43FA-A5FB-630AB8CD18ED"},"incident_date":"2014-04-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"17a967f6ad0d","org_name":"Haneda Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2014/04/23/tokyo-airport-employee-loses-handwritten-passcodes-ahead-of-obama-visit"}],"summary":"Employee loses print out of security codes prior to arrival of the President of the United States.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbda71b42a0297dbfa6ba25d748e3a5c0337ba77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF5C0857-B950-4F3B-A28A-D96C435D6CF8"},"incident_date":"2014-04-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"643173013a58","org_name":"Highmark Inc.","org_type":"financial","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://insurancenewsnet.com/oarticle/2014/06/06/health-insurer-highmark-blames-mailroom-error-as-private-data-sent-to-wrong-subs-a-514636.html#.U_t1rlaFr7Q"}],"summary":"Highmark Inc. notified nearly 3,700 of its Medicare Advantage members that some of their personal and medical information may have been disclosed to others without authorization and in violation of federal law.  The state's largest health insurer said an error by a mailroom emplo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"393111a92521edfcb7cbc49c11e1a6e539681e43","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65D93B3D-1235-432B-A563-BBA359EC8848"},"incident_date":"2014-06-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jun-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-may-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-apr-2014.pdf"}],"summary":"Veteran A and Veteran B were seen in the same clinic on the same day. Veteran A received a printed prescription intended for Veteran B containing full name, full SSN, and date of birth.  his is informational for Mis-Handling incidents and is the representative ticket. There were ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"533bb0de260cff74370bc54ab556218cd9dbf233","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17264144-297C-475E-A0C5-05401290F6B4"},"incident_date":"2014-04-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f3cc86d31a7","org_name":"Gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.click2houston.com/news/man-sought-in-skimming-id-theft-case-in-pearland/25723690"}],"summary":"ATM skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d56f32bf31b8c005c690ca028861f1bb0601b963","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A88790CC-37AA-43D1-8FBC-EF8C84E831EB"},"incident_date":"2014-04-17","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"377c38023ca1","org_name":"Pine Environmental Services, LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/news/volokh-conspiracy/wp-content/uploads/sites/14/2014/08/download-1.pdf;http://www.washingtonpost.com/news/volokh-conspiracy/wp/2014/08/25/does-the-federal-computer-hacking-law-apply-to-a-laptop-not-connected-to-the-internet/"}],"summary":"Plaintiff Pine Environmental Services, LLC (Pine), a New Jersey company, provides rental environmental equipment to other businesses in the United States. 1st Am. Compl.  1 [#16] [hereainafter Am. Compl.]. On November 6, 2012, Defendant Charlene Carson (Carson), a Massachusetts r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5846341db0b554d8c540231b29e80d45619d2955","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A59251A-12FA-4E8A-AD7D-CE3D7E102523"},"incident_date":"2014-04-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ffc40d472b9","org_name":"Greenwood Leflore Hospital","org_type":"healthcare","ransomware":null,"records_affected":3750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a device leaves 3750 records exposed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c9c3370f598190a52d90fc8d4cab3794a71778e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB51E07A-7C80-42DB-B9EB-CD5E3190535F"},"incident_date":"2014-04-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9d13e88a8d7","org_name":"Healthy Connections, Inc","org_type":"healthcare","ransomware":null,"records_affected":793,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of an electronic device exposes 793 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab1e957fd17e56a32fe3501c2fbfcae37d556945","impact_type":"unknown","incident_date":"2014-02-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MX-M450N_20140411_170105_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2841b480f51d","org_name":"Veterans of Foreign Wars of the United States","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44774"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91635004a8d6f49ab8a465d262572fae6dd46db0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF90C988-BD6D-4CD2-A00C-519EFA4CB563"},"incident_date":"2014-04-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2bfee299007","org_name":"Penn State Hershey Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lancasteronline.com/news/local/hershey-medical-center-notifies-patients-of-data-breach/article_385c9ea2-edbb-11e3-9730-0017a43b2370.html"}],"summary":"Penn State Hershey Medical Center said it has notified 1,801 patients of a privacy breach, after it was discovered an employee had been working with protected health information from his home computer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d67fa535ee8621f1ce70ba9d44f65a1defa4334b","impact_type":"unknown","incident_date":"2013-03-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/La%20Brienotice_only%204_14_14_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2992dad0bb58","org_name":"LaCie USA","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44782"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27bb3d7cc9181bc98e5039d03e26b29fc0f1647b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62945AFB-B628-4F19-8551-3D06B33D899D"},"incident_date":"2014-04-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07c8befeede3","org_name":"Blue Cross and Blue Shield of Kansas City","org_type":"financial","ransomware":null,"records_affected":2546,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access exposes 2546 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-04-10","discovered_date":"2014-03-13","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3b6128f0ef52669fe78d5e91c11ca7950dbe8c4","impact_type":"data_theft","incident_date":"2013-07-13","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/California%20Notice%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"0450b354fe19","org_name":"Deltek","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A security vulnerability in GovWin IQ was exploited to gain unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44769"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/California%20Notice%20Letter_0.pdf"}],"summary":"Deltek reported that an attacker exploited a vulnerability in its GovWin IQ website and accessed personal, payment card, and login information.","supporting_quote":"We have remedied the security vulnerability that we believe the hacker exploited in order to gain unauthorized access to our GovWin IQ system.","technology_involved":["GovWin IQ"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2014-0160"],"data_types":["personal"],"disclosed_date":"2014-04-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb097c95a54dbb8d433cd6c8dba898548a1d54ca","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0B3FC0C-0F6F-4C1C-8356-6EBC5F26451A"},"incident_date":"2014-04-09","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"181d352f2ae4","org_name":"Canada Revenue Agency","org_type":"government","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/business/2014/04/16/heartbleed_rcmp_charge_19yearold_over_cra_heartbleed_hack.html"}],"summary":"Canada Revenue Agency hacked using Heartbleed bug to acquire data on 900 people","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2014-0160","kev_added":"2022-05-04","name":"OpenSSL Information Disclosure Vulnerability","days_listed_before_incident":-2947,"product":"OpenSSL OpenSSL"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"186aafab186d291afdf1ec52260107e7d08f5e76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40004386-18ED-4116-B7E9-9CD3CF874462"},"incident_date":"2014-04-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95563f37442a","org_name":"AT&T Mobility","org_type":"technology_saas","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2363380/data-protection/atandt-mobility-data-breach.html?utm_content=buffer75b17&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/CA%20Customer%20Notice.doc__1.PDF"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45415"}],"summary":"AT&T Mobility filed a breach notification in California. Apparently from April 9 until April 21, 2014 one of their third party providers violated their security and privacy guidelines and was accessing customer data. AT&T believes that the data was accessed in a effort to unlock ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"281b2f6ccd571bb6f8757a126c3dab4e565f7ad2","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/StumbleUpon%20Password%20Reset%20Apr%202014_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d0f8e2b4f6c","org_name":"StumbleUpon, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44746"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"758c51e2a20cb20b82e6384bc18ae44a00585013","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3517714-441E-4187-941D-38E683A91F7F"},"incident_date":"2014-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UY","org_id":"b4ca8623db88","org_name":"Curse/MMO-Champion","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/CurseNetworkSys/status/453569002368147456"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"ProbablyOnion","variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-04-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3acb3fa6ec4a41d14f65ff07f9a073315310167c","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-04-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"eefbc12f03b7","org_name":"BigMoneyJobs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The attack allegedly used a SQL injection vulnerability.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: BigMoneyJobs","type":"hibp","url":"https://haveibeenpwned.com/Breach/BigMoneyJobs"}],"summary":"BigMoneyJobs exposed user account information in an attack allegedly mounted through a SQL injection vulnerability.","supporting_quote":"The attack was allegedly mounted by exploiting a SQL injection vulnerability.","technology_involved":["web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"probablyonion"}},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2014-0160"],"data_types":["credentials"],"disclosed_date":"2014-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc95e0313d9bcea0d14205175c6e74c37997465e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90ECF562-4958-4A55-907F-F046A371AA1A"},"incident_date":"2014-04-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo! Inc","org_type":"technology_saas","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnet.com/news/heartbleed-bug-undoes-web-encryption-reveals-user-passwords/"}],"summary":"Yahoo! hacked using heartbleed bug and passwords stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2014-0160","kev_added":"2022-05-04","name":"OpenSSL Information Disclosure Vulnerability","days_listed_before_incident":-2949,"product":"OpenSSL OpenSSL"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2014-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d798b5fe0d0152348f4834da09cc182450f80ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6881E006-BB63-41C1-A000-F3A73B24CA94"},"incident_date":"2014-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9ba2f44ccc6","org_name":"Paytime, Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cumberlink.com/news/local/hackers-breach-upper-allen-payroll-company/article_fd9b037a-dae7-11e3-99aa-001a4bcf887a.html"}],"summary":"Intruders identified and exploited a vulnerability in Paytimes client service center, which allowed them to access employee information. A subsequent investigation by third-party forensic IT experts found that the intruders  which the statement described as skilled hackers workin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7be93eff1de2c868b9886b12dfe446ba6d27d50c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E77C30FA-7E54-4CFA-8A0F-0225AB0CCE1D"},"incident_date":"2014-04-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee40832e682f","org_name":"California Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/solano-county-dept-of-child-support-services-letters-lost-by-courier/"}],"summary":"On April 7, 2014, several letters from the Solano County Department of Child Support Services were misplaced while in the custody of a contracted courier who was transporting mail to the US Post Office. Although many of the letters were subsequently recovered, there is no way to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b0e1746241813b77265defe221b91a51bdf2c69","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51398B0F-BDEB-41D1-8DD1-6A01E3C76CA7"},"incident_date":"2014-04-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"091c00113511","org_name":"Bangor Daily News","org_type":"technology_saas","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcsh6.com/story/news/local/downeast/2014/04/23/washington-county-social-security-data/8071823/"}],"summary":"Mispublication error results in PII being available via a publicly-facing web site for hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76628395ed0cd52fbdec4e0819b658ecb53faf76","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7320B741-8C68-4638-AEDB-76D404A03E90"},"incident_date":"2014-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bcac8614efaa","org_name":"Orange Community MRI","org_type":"healthcare","ransomware":null,"records_affected":35357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/other-breaches-newly-disclosed-on-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Orange Community MRI in New Jersey notified HHS of a breach involving their business associate, Vcarve LLC, who does business as MD Manage. The breach tool entry indicates that 585 patients were affected by a breach on April 6, 2014 that involved Unauthorized Access/Disclosure of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ba8834c1c120def8e656d6f65ec3648fa9e23d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAE1A88D-E74F-4589-8F64-1053E291E429"},"incident_date":"2014-04-06","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"922a3cf76e79","org_name":"New Era Photography and Film","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2014-04-07/triathlete-injured-as-drone-filming-race-drops-to-ground/5371658"}],"summary":"Hijacked video drone drops and injures a triathlete.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcd7cd315f50f1ba60d1a21d27f4c7c68a2a5aee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64E37D4A-C3E7-4369-8809-0E5D46AAB546"},"incident_date":"2014-04-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"086768adad0b","org_name":"Greene's Accounting","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20from%20Green%27s%20Accounting_0.pdf"}],"summary":"perps broke into the office by throwing a rock through the back window. They stole cash and equipment, including a server with customer info stored unencrypted. No evidence of fraud. Server was password-protected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5eeab411a5a93f3272e88399e51805eac8912f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4286C6E4-0C10-464C-AFFF-04851C2CCE1F"},"incident_date":"2014-04-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"e04ec3f1c4e3","org_name":"BJP Junagadh","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/04/bjp-junagadh-website-hacked-by.html;http://indianexpress.com/article/india/politics/hackers-deface-bjp-junagadh-units-website-target-modi-rss/"}],"summary":"Indian political website compromised via unknown methods by Pakistani hacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f136873c66f4fcbb5a2e5e6f2ac70ee56c24c70a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"544D856A-2EF8-42A7-A713-22EA9D9343C7"},"incident_date":"2014-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4b397cf78791","org_name":"csahell.com","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/CSAhellcom/posts/366360510170190?stream_ref=10"}],"summary":"Our website is down at the moment as someone has targeted it with a DDOS attack using thousands of IP addresses. This is a professional attack from someone very good at what they do, and not something easy to perform. We're wondering if the CSA's technical team could be behind th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a206d9b0a4fcbd5099a81b47ee0586e6093337d","impact_type":"unknown","incident_date":"2014-02-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Template%20Letter%20for%20California%20Submission_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4dfd924bcc18","org_name":"Cole Taylor Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44701"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-04-02","discovered_date":"2014-02-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9c44f21cb18d39fb7dbdc192be676beb4e5712f","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DOR%20Incident%20Sample%20Pt%20Notice%20Ltr_0.pdf"},"notes":null,"org_country":"US","org_id":"2233bc865d9d","org_name":"Kaiser Permanente Northern California Division of Research","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44690"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DOR%20Incident%20Sample%20Pt%20Notice%20Ltr_0.pdf"}],"summary":"Malicious software infected a server containing research data, but the organization found no evidence that unauthorized people opened, copied, or used the information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"758888beca30d580c437ea954279794a880953b4","impact_type":"unknown","incident_date":"2014-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CCI%20Breach%20Letter.pdf.doc__0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44678"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae89dcddb53a9cc0362adfc336d0a88d389d1832","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"868CDD06-FADB-4689-BD5F-5EF61A6AF15C"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52f874000a15","org_name":"Virgin Media","org_type":"technology_saas","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2606706/Virgin-Media-forced-apologise-data-breach-accidentally-copying-130-000-customers-email.html"}],"summary":"Virgin Media forced to apologise for data breach after accidentally copying-in 130,000 customers into email Problem occurred when company's suppliers mistakenly sent out email When it was replied to was then sent to all the other people in the group Virgin Media insisted only 'sm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99b556b54180fba22f4fc1a5fa7b72dbf1e8bf02","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7EB3D1D-48F3-4FE6-B784-1F3764CC7E02"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e7c9f6739fba","org_name":"Typepad / Say Media","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://everything.typepad.com/blog/2014/04/response-to-downtime.html;http://techcrunch.com/2014/04/21/say-media-owned-blogging-platform-typepad-enters-day-5-of-on-and-off-ddos-attacks/"}],"summary":"Repeated DDOS attacks on Typepad. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19ef0b8735da896b25bcec50f8d246213d59a162","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99747F66-E0BC-4B56-8A4A-2DA12D90ED1B"},"incident_date":"2014-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb8383c302dd","org_name":"The Home Depot","org_type":"retail_ecommerce","ransomware":null,"records_affected":109000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2602002/data-breach/new-details-suggest-that-home-depot-breach-is-nationwide.html?utm_content=7775563&utm_medium=social&utm_source=linkedin;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldtribune.com/article/20140909/wire/140909703;"},{"fetched_at":null,"title":null,"type":"press","url":"http://investmentwatchblog.com/alert-home-depot-admits-massive-customer-payment-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://media.corporate-ir.net/media_files/IROL/63/63646/HD_Data_Update_II_9-18-14.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/home-depot-reports-another-insider-breach/"}],"summary":"The Home Depot, the world's largest home improvement retailer, today confirmed that the malware used in its recent breach has been eliminated from its U.S. and Canadian networks. The company also has completed a major payment security project that provides enhanced encryption of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1c19c4e08134fa49755ec4730b30abdb4345fc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E711901-E481-4CEB-B430-46D86FAF8CD3"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"32dbb1569c25","org_name":"Tesco PLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buryfreepress.co.uk/news/crime/skimming-device-found-on-fuel-pump-in-bury-st-edmunds-1-6026834"}],"summary":"A skimming device was found on a fuel pump in Bury St Edmunds last week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73cdd407b74e1a4f01c6f5ffcdf9c16af95acd99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65ED6D32-2E2C-4881-8EA8-40042AEF5D2F"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8081781054","org_name":"Sunoco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/nypd/downloads/pdf/crime_prevention/gasstationskimming.pdf"}],"summary":"Gas pump skimmers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40b535611cc77062bcc6542cba90f9d08828db3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8F5BFCE-5979-46A2-8B6C-F07EDF541500"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"001f1591c028","org_name":"Shell Oil Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yourhoustonnews.com/courier/news/skimming-device-found-on-conroe-area-gas-pumps/article_2ab2ef15-2bfb-5d81-8dfe-a8bf64d323ec.html"}],"summary":"A technician was doing routine maintenance on the gas pumps electronic equipment when he discovered a piggy back device installed on the credit/debit card reader. All pumps at the location were checked and the skimming device was found on pumps seven and eight. The device was ins","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f72e147624a67f2220e261e97029ecad7a074edf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A966924-89AA-4F41-9D2B-F5967595B3AA"},"incident_date":"2014-04-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ddacf970592","org_name":"Reyes & Barsoum L.L.P","org_type":"professional_services","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/lawsuit-claims-workers-comp-insurers-hacked-into-injured-workers-files/"}],"summary":"Lawsuit claims workers comp insurers hacked into injured workers' files - HQSU Sign Up Services Inc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"@G3NTbl4ck","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fedf059cfd549149c9b85565f953a2fcc8090ee6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"803350CC-C320-49F0-B825-DDB0C642B9F1"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"946f08ee5c4d","org_name":"Rat Resource & Research Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cyberwarnews.info/2014/04/03/rrrc-rat-resource-research-center-hacked-defaced-and-data-leaked/"}],"summary":"Rat Research center hacked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"g3ntbl4ck"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33457d698678073340f0991429170dedd10d8fda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34AD1419-31BD-4BA7-A37A-473AA663F532"},"incident_date":"2014-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5327adbb821","org_name":"ProMedica Bay Park Hospital","org_type":"healthcare","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northwestohio.com/news/story.aspx?id=1050422#.U4ZUN16nvXU;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Medical/2014/05/28/ProMedica-Bay-Park-Hospital-investigates-patients-privacy-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Medical/2014/06/26/ProMedica-data-breach-investigation-findings-to-be-released-today.html"}],"summary":"Officials at ProMedica Bay Park Hospital are notifying almost 600 patients after it was discovered that a former employee accessed patient records last month.  The hospital says 594 patients will receive individual letters notifying them of the breach, after it was discovered tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb78e6db82e5f7ed8651c90b2a9c2110b88245b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59385D17-0156-47FB-A593-12070AF7B04F"},"incident_date":"2014-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4064dfa0cd30","org_name":"Pennsylvania's Lake Erie College of Osteopathic Medicine (LECOM)","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/pennsylvania-dental-students-hit-by-data-breach.html"}],"summary":"misconfigured \"test\" web server exposed spreadsheet containing \"personal information\" of students, including names, Social Security numbers, e-mail addresses, and in some cases, birthdates.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf1dbc86723836e194a21905d6213554a8cc14b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"752FC584-A2C7-4FF2-8ADD-59081ED85186"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4f527a2b397e","org_name":"NatWest Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chiswickw4.com/default.asp?section=info&page=concrime764.htm"}],"summary":"An eagle-eyed member of public spotted that a skimming device had been fitted to a cash machine outside NatWest Bank on Chiswick High Road. The scam, known as the 'Lebanese Loop' involves fitting a false cover over the card slot.  Police said the man noticed the device when the m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a91bf0a5dfb452e4e00c955412fc143103025ff8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5447F473-1FE3-4095-B721-8C5E90994B91"},"incident_date":"2014-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2dc41d285483","org_name":"Moshtix","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/05/09/moshtix_admin_account_popped_by_partypooper_skids/?utm_source=twitterfeed&utm_medium=twitter"}],"summary":"Threat actors logged into \"front-end area\" of ticket selling website and raised the ticket cost and fees to crazy amounts for a single event.  It was corrected, those who paid were reimbursed and event ended up being sold out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff124205903ad32305a9ee9cb2da782e36b34b94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6a669590-da31-11e7-a58f-dff506a792fb"},"incident_date":"2014-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5a117f91a664","org_name":"Manioba Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/phia-manitoba-health-employee-daughter-1.4303743"}],"summary":"Healthcare employee accesses medical records of daughter","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a72aa36c6b439e0b28253ffb8914213ea82e9b52","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4883BFB-38A6-49FE-9766-5E53C020D1BA"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"ab9fd669aa38","org_name":"IN Bangalore City Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Bangalore-City-Police-Hacked-and-Defaced-438626.shtml"}],"summary":"Website of Bangalore City Police Hacked and Defaced","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86c7a47b2674f775de604117259f658a819d6a97","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C25171C6-94FA-4C92-B26D-3B741404BABB"},"incident_date":"2014-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b748bde09c13","org_name":"Honolulu Star-Advertiser","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hawaiinewsnow.com/story/25708622/star-advertiser-victim-of-thieves-customers-accounts-stolen"},{"fetched_at":null,"title":null,"type":"press","url":"http://khon2.com/2014/06/05/star-advertiser-customers-victimized-in-id-theft-case/"}],"summary":"The Honolulu Star-advertiser's  storage unit was burglarized and at least one banker box was taken.  The box contained account information for hundreds of customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ea463b4b6647589a0d489e92d526833d8ff7219","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27A53617-0630-4822-BC0C-114ABDA69AB6"},"incident_date":"2014-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15aab2cf0eb3","org_name":"Hackensack University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.my9nj.com/story/26326328/hospital-worker-arrested-for-stealing-patients-personal-id-information"}],"summary":"Police have arrested 38 year-old Latoya Sapp of Wayne, New Jersey for identity theft. Sapp worked as a coordinator of medical records at the Hackensack University Medical Center and it's believed that she was trafficking personal identification information that belonged to hospit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e09803617acce2f6caf841f5f90480b2a57ed798","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D89EA5E5-129D-4FCC-B5AE-94C709A4B942"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"922f0bdf2c91","org_name":"Government of Thailand","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.netcraft.com/archives/2014/05/06/thai-government-websites-infested-with-malware.html"}],"summary":"Nearly 100 Thai Government websites were hacked and used to serve malware last month. More than 500 distinct attacks were launched from these websites, representing about 85% of all government-hosted malware in the world.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a27628186742bcc2b21d3fca4c493dc7a2e3ce19","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB2A85CB-AA3D-4B96-980E-16416FDC3B90"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d9755c3998e","org_name":"Florida Radiology Consultants","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc-7.com/story/25134018/patient-information-compromised-in-fort-myers#.UzxaNNx_nXU;http://www.winknews.com/Local-Florida/2014-04-01/Possible-security-breach-at-Florida-Radiology-Consultants"}],"summary":"External agents hacked into patient information system and looked at patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd8e792076b5ace8e128d747e263c11ba96746bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FDDBA26-D54A-4B4A-A864-AF550DAB2F61"},"incident_date":"2014-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4ca49d955869","org_name":"England Football Sqaud","org_type":"other","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.welivesecurity.com/2014/06/04/england-footballers-passport-details-leaked-twitter/?utm_source=rss&utm_medium=rss&utm_campaign=england-footballers-passport-details-leaked-twitter"}],"summary":"Insider, who was excited to get \"an official FIFA team sheet\" (which included names, birth dates and passport ID), took a picture of it on their phone and tweeted it (error).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68cf436d3e6f1e987fda0f273df2879d315c2c45","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAB39F60-79BF-4831-B005-7B6D84DA7276"},"incident_date":"2014-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4b0543f3ee75","org_name":"Croydon University Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.croydonadvertiser.co.uk/Hospital-trust-rapped-sent-sensitive-medical-data/story-28528580-detail/story.html"}],"summary":"Hospital mistakenly sent a patient's sensitive medical information to the wrong person. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbd826bce89a434b769aad26d9dee932d328d3f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62170885-6627-42E2-9EBF-574F8DC67680"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CO","org_id":"14b8d4199498","org_name":"Colombia Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/spy-targeted-colombia-peace-talks-president-official"}],"summary":"an unnamed \"engineer\" tried to \"interfere with the peace process\" and had acted against \"national security.\" (quote from article)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d4dc561a5279a8c03617edb2c8427993647b669","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49E230C5-7478-468C-9066-BE39B77DA2E2"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5b8480fad461","org_name":"Blockchain","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsbtc.com/2014/04/21/blockchain-info-services-due-ddos-attacks/"}],"summary":"higher than usual traffic volumes due to DDoS [distributed denial of service] attacks on servers locked users out of their blockchain.info wallets.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f3cc5975e46f88c90da293e62613512a7044657","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"329DC598-FDEF-440A-9655-6F4B34C0E95D"},"incident_date":"2014-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c80618524481","org_name":"Australian Federal Police","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/act-news/canberra-centenary/afp-officer-accused-of-stealing-information-on-exgirlfriend-20140502-zr3ke.html;http://www.canberratimes.com.au/act-news/former-federal-police-officer-faces-new-charges-over-stalking-of-exgirlfriend-20140722-zvm6s.html"}],"summary":"Police Officer abused logical access privileges to spy on ex-girlfriend and her new boyfriend.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5a6a157c517ee6027828c9e7cce1deeed7a89ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C297DC8-058F-4068-B555-EE1ECA45FD0B"},"incident_date":"2014-04-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"48f022446952","org_name":"Al Arabiya","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/anti-media-cybercrime-spree-continues-al-arabiya-hacked-by-nullcrew-7000028004"}],"summary":"Hackers use Zimbra vulnerability to hack mail server and publish user authentication details","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c27b833e9ea23b189a80fc696c193176c12fa58","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F3FBED1-F33D-47AD-B41E-EB2B9F8FC673"},"incident_date":"2014-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24a7b4e63ad0","org_name":"4chan","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.4chan.org/post/84289353232/concerning-a-recent-intrusion"}],"summary":"4chan hacked by person targeting information about users posting habits. Used a web vulnerability but not clear what kind of vulnerability.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da734b03a72657605de894e760a39818b9171d84","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D58A7DFF-EFAB-47ED-8D93-5A4A4E323AE6"},"incident_date":"2014-03-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4fdb99ee2bc9","org_name":"Sault Area Hospital","org_type":"healthcare","ransomware":null,"records_affected":144,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sootoday.com/content/news/details.asp?c=72559"}],"summary":"A Sault Ste. Marie woman is angry, emotionally distraught and considering legal action over the fact her mothers medical records were inappropriately accessed by an employee of Sault Area Hospital (SAH).  The woman, who prefers to remain anonymous, has told SooToday.com a letter ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e7628a67f1ef30de5d3613837acd3de5b21de5f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/User%20Notice%20MyJSTOR_03.28_0.pdf"},"notes":null,"org_country":"US","org_id":"a20d7603219a","org_name":"ITHAKA","org_type":"unknown","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44654"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/User%20Notice%20MyJSTOR_03.28_0.pdf"}],"summary":"An unauthorized third party accessed MyJSTOR accounts, and profile information including usernames and passwords may have been accessed.","supporting_quote":null,"technology_involved":["MyJSTOR"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9d0f7ad786b4f9a35741b88b48c1dcdfaad039a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA1D9761-CA1E-4F51-8EC0-5EB70AC3600E"},"incident_date":"2014-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e417cd4616b3","org_name":"Mad Mimi","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2014/03/31/email-marketer-declines-to-pay-its-ddos-attacker-1-8-bitcoin-bribe-to-prevent-repeat-attack-seriously/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0ab703b08390a23b2f2b0f892cb32b702e37a85","impact_type":"data_theft","imported_from":null,"incident_date":"2014-03-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"f728884061d9","org_name":"Boxee","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Boxee","type":"hibp","url":"https://haveibeenpwned.com/Breach/Boxee"}],"summary":"Attackers obtained Boxee’s vBulletin MySQL database and posted it for download, exposing user information, password histories, and private messages.","supporting_quote":null,"technology_involved":["vBulletin","MySQL database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"external","country":"FR","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eadee5724d1e6aafb9023e9e6b44858656028c8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B3C0E5F-BDAF-422F-BB83-6BC7B2BBDB5A"},"incident_date":"2014-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"f7f58d2faff0","org_name":"Blizzard","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://eu.battle.net/wow/en/forum/topic/10219252538"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fd181a677915490da8a73d0b0022fe966431691","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5408911-CEE9-4011-990C-B42DC9E11BC2"},"incident_date":"2014-03-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c162b110fd36","org_name":"Albuquerque Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.com/anonymous-ddos-attack-hits-albuquerque-police-dept-response-homeless-man-james-boyds-murder-1564905"}],"summary":"Anonymous launches DDoS against police department site in response to a shooting.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea897a4d785551ce807ba05d9949676c7a219271","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F34062B6-3AEA-4CE0-A449-4269C70670D7"},"incident_date":"2014-03-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9dd97c94c0b","org_name":"Sharper Future","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sharperfuture.com/LCB%2052114.PDF;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/sharper-future-reports-burglary-of-mental-health-data-of-clients/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45269"}],"summary":"Sharper Future is a private-sector mental health services provider in Los Angeles specializing in the assessment and treatment of forensic populations and others with behavioral and mental health issues. They have posted a breach notification (pdf) to their site, and a copy has b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20fdb55cc9a7376b020b7fc9ad3e71fcac4a5ee0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A257E206-0DEF-4959-841C-25E2A12658E9"},"incident_date":"2014-03-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e1ebe2c451f","org_name":"NCO Group","org_type":"other","ransomware":null,"records_affected":2468,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.esecurityplanet.com/network-security/nco-financial-acknowledges-data-breach.html;http://www.databreaches.net/student-loan-debt-collector-exposes-thousands-of-students-loan-debts-to-others/;https://oag.ca.gov/system/files/CA_SAMPLE-0-D_0.pdf"}],"summary":"NCO Group a collection company's communications vendor accidentally sent out loan statements to customers, which contained other customers loan statements.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5faf68f099c367a23591612db4230ce60ac04234","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1174F249-26D4-446F-A55B-4AD76EE9FD87"},"incident_date":"2014-03-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d805e283ab2","org_name":"Myriad Genetic Laboratories, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in the exposure of 643 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f691db5635b35b966d8f346a4e2870e7c5b98e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ACF13596-54EE-4542-95E0-B9CA991D063B"},"incident_date":"2014-03-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a4551bad71f","org_name":"ABC, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsbusters.org/blogs/dave-pierre/2014/03/30/privacy-breach-abc-broadcasts-names-birth-dates-and-personal-email-addr"}],"summary":"Television news broadcast shows names, email addresses, and birthdates of aspiring underage models.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":"Redhack Group","variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c536591b238824344b82fce9abb0aec839f5058","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F465E537-9AA6-483A-9493-51E9641C058D"},"incident_date":"2014-03-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"f9adcfb8a5be","org_name":"Turkey's Telecommunications Directorate","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Turkey-s-Telecommunications-Directorate-Attacked-by-RedHack-434637.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"redhackgroup"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-03-27","discovered_date":"2014-03-07","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32bb7f0d43353d2102ad53515118c63d986c2969","impact_type":"data_theft","incident_date":"2014-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/US%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"035231628129","org_name":"Sorenson Communications","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44635"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/US%20Letter_0.PDF"}],"summary":"Unauthorized access to Sorenson Communications employee HR information occurred through attacks on its payroll vendor account.","supporting_quote":null,"technology_involved":["payroll vendor account","HR account"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d24b90229374b37fa3f816756bcbe202d2bf2464","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF108731-F2F5-4B1E-B75E-0FC9FFFDE9D9"},"incident_date":"2014-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de7b38871341","org_name":"Funnyjunk, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.funnyjunk.com/FJ+March+27th+Update/text/5073835/"}],"summary":"\"Site was DDOS'd and went down for 90 minutes today. Working on moving whole thing over to cloudflare.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6657b48b6765792d798b347998c0a991b2acce39","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2463672C-E0D9-4F6D-B9EA-6A2D36CC1F37"},"incident_date":"2014-03-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57ef4ea0a932","org_name":"Elliot Hospital","org_type":"healthcare","ransomware":null,"records_affected":1208,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/elliot-health-system-notifies-some-individuals-after-computers-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/elliot-health-system-20140520.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmur.com/news/hospital-data-breach-could-affect-more-than-1000-patients/26151974;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.unionleader.com/article/20140527/NEWS03/140529164"}],"summary":"Hospital officials said the PCs were stolen from an employees car in March. The employee was transporting the PCs to a location where they could be destroyed.  Hospital officials believe the information on the hard drives would not be useful to identity thieves.  However, the hos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a4e46228e6f8f83721a59af37a3c1aedd4b3996","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A0BA2E7-AC69-4C69-8845-C0D4C4C3BDD1"},"incident_date":"2014-03-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e92a5c8e5e9","org_name":"Kansas State Department of Education","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.edweek.org/edweek/DigitalEducation/2014/04/kansas_suspends_state_tests_fo.html"}],"summary":"Kansas Suspends State Tests Following DDoS Attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4654aa3fb68fc6ecef764b90dec243d97263b87d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C52BB004-153C-43DB-955B-26152825BD3A"},"incident_date":"2014-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43db88d38ad0","org_name":"WAZE","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nocamels.com/2014/03/technion-students-carry-out-successful-traffic-jam-cyber-attack-on-waze/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b19a7b38c50820601155ce35c1ff4ab672576624","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"276F4597-CF92-4B2E-90D3-B2EDC68EE145"},"incident_date":"2014-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"80c0e8b6b6fa","org_name":"StayWell Healthcare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dispatch.com/content/stories/local/2014/08/27/hackers-break-into-wellness-program.html"}],"summary":"PII of patients was disclosed to external actor due to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Team Appunity","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a8ecb49a9b576def9c88f97443c574c602d6635","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"NO","org_id":"d711d3b40457","org_name":"hemmelig.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: hemmelig.com","type":"hibp","url":"https://haveibeenpwned.com/Breach/Hemmelig"}],"summary":"A breach of hemmelig.com exposed usernames, email addresses, nicknames, gender, year of birth, and password hashes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown","derived":{"actor_id":"teamappunity"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2014-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14a28e84d598073babcda8a7fe7cd3c35ac5655d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25C42355-1105-4994-8830-4F97F20FA6DD"},"incident_date":"2014-03-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2179dd80402f","org_name":"Catholic Health Initiatives","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kirotv.com/news/news/catholic-hospitals-suffer-second-data-breach-year/nfsb6/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/catholic-health-initiatives-victim-of-dns-hijack-doctors-e-mails-redirected/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wp-content/uploads/CHI_Doe.pdf"}],"summary":"Hacker compromises hospital group's mail server and redirects e-mails send to doctors to external email accounts under the hacker's control.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c54e2367ffe8f050624324249bd8554d47badaa1","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Server_AD01_Active%20%28MSCSBMMYY%29%20CM%20Letter_Final_071912_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44555"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44666"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44727"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Server_AD01_Active%20%28MSCSBMMYY%29%20CM%20Letter_Final_071912_0.pdf"}],"summary":"American Express notified cardmembers that a merchant where they used their card detected unauthorized access to data files that included card account numbers, names, and expiration dates.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10360013c9ce73c1653e1fc497b62b94790fd02d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE9B03D3-6903-4EB1-9CE2-285DC968FF41"},"incident_date":"2014-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"90faf148b5d8","org_name":"Zbot, Zeus and Blackhole.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blogs.rsa.com/battle-botmasters/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd448519350ee1a9f0f038b9dce15a68354de7b8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A91010F-5F4C-47EA-B3AB-75C8DE88A9AF"},"incident_date":"2014-03-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8c6072bbbd7","org_name":"Yellowstone Boys and Girls Ranch","org_type":"healthcare","ransomware":null,"records_affected":623220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents exposes 543 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-03-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c8e6d1f705cf7431857a0320648cbd736db50b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DCA5FFCF-B092-4C43-A28A-A6C1EE5EB2FB"},"incident_date":"2014-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"cc0848351d71","org_name":"Ctrip.com International Ltd","org_type":"other","ransomware":null,"records_affected":93,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ecns.cn/business/2014/03-24/106150.shtml"}],"summary":"Chinese tourism website is compromised by a security research group. 93 payment card records were exposed. Articles reference a \"security loophole\" in the website, but does provide further detail.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c0e6e8e0b3e6415fcc4457f11cfa304399a8bc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7866B7EE-A40E-463B-A4BD-B0DEC7A3DB94"},"incident_date":"2014-03-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"699a8f88676c","org_name":"Basecamp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gist.github.com/dhh/9741477"}],"summary":"DDOS and extortion attempt on web services provider","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff5db5658504ae5dd76eee0a2dd77af28ea5d579","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"158106FD-8A8B-4244-9759-B05C206F0B2E"},"incident_date":"2014-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegram.com/article/20140323/COLUMN73/303239976/1002/business"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d956758deb17ad939697e58cc21a60d72ea8d85","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13188709-C0E4-43C8-881F-F00F330353E1"},"incident_date":"2014-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"489488102600","org_name":"PlanetRomeo BV","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://planetromeoinside.tumblr.com/post/80570978238/site-downtime-q-a"}],"summary":"DDOS on dating website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"YE","motive":"ideology","name":"Ymh","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea26ae8ca0fe9709bc5591f4820491e68aced5f8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19CBFD33-D4D7-4858-8AAB-86C10A2C1467"},"incident_date":"2014-03-23","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"f7b32586dd86","org_name":"Egyptian Govt Military education","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Egyptian-Military-and-Government-Websites-Defaced-by-Hacktivist-435687.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"ymh"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c8086db636d9296cc092579528c0eb46db9f2fb","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rosenthal%20Sample%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"12df202e8342","org_name":"Rosenthal the Malibu Estates","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44531"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rosenthal%20Sample%20Notice_0.pdf"}],"summary":"Malicious software was installed on systems used to process credit card transactions at the Rosenthal wine shop, potentially compromising customers’ payment card data.","supporting_quote":null,"technology_involved":["payment card transaction processing systems"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"baed0ad124f7ba595bb8b0c7b81c4d22063767f6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB66BF76-C10E-4B8D-8C13-12B928C89347"},"incident_date":"2014-03-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"94bbda1849b6","org_name":"Hootsuite Media","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/dos-attack-takes-down-hootsuite/article/339248/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2bc1051b95690a548db6fd25d86c4dcf8c44428","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C684D76D-1936-4CAB-9956-4FD999CDF0C7"},"incident_date":"2014-03-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1c155d97cb7","org_name":"Publix Super Markets Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/palm-beach/boca-raton/fl-delray-boca-skimmer-arrest-20140404,0,6488993.story"}],"summary":"Small ATM skimming operation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a519c1abad6afc77c5771fa7bc00bcc15ccf453","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-03-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Patient%20letter%20with%20phone%20number_0.pdf"},"notes":null,"org_country":"US","org_id":"32972486ab51","org_name":"Marian Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44522"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Patient%20letter%20with%20phone%20number_0.pdf"}],"summary":"Marian Regional Medical Center accidentally sent a secured electronic file containing limited patient information to a contracted health insurance plan other than the patient’s own.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f74b3e2fc92cff44aca5a9a6496a7a52f040ec3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFD31FE4-976B-48CA-A111-EF84EBAB9B0F"},"incident_date":"2014-03-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"329d54d7b264","org_name":"Willis North America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/employee-error-causes-data-breach-at-insurance-broker.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/willis-north-america-20140417.pdf"}],"summary":"Willis North America recently began notifying an undisclosed number of employees that their personal information may have been exposed when a health plan administrator mistakenly attached a spreadsheet containing sensitive data to an e-mail sent on March 19, 2014 to company emplo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"253e80947ed8625152838a348a07be22fb43f0a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3937C635-5C22-47DB-9357-CD7086D03635"},"incident_date":"2014-03-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdc6e9a8f9b2","org_name":"Johns Hopkins University","org_type":"education","ransomware":null,"records_affected":2166,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/bs-md-hopkins-data-20140426,0,2351317.story"}],"summary":"More than 2,000 Social Security numbers of former Johns Hopkins University graduate students were exposed to potential hackers, the university confirmed Saturday.   Hopkins officials discovered on March 19 that the names and Social Security numbers of 2,166 former students were s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":"Charles E. Symes, II","variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02fdadfc8bc6fecc77f5960d1a7dabec0ed3dd2d","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Arcadia%20%28Form%20OAG%29%20March%2016%202014_0.pdf"},"notes":null,"org_country":"US","org_id":"47f12d5768ea","org_name":"Arcadia Health Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An independent contractor who was authorized to use Arcadia's database accessed personal information for unauthorized purposes.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44461"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Arcadia%20%28Form%20OAG%29%20March%2016%202014_0.pdf"}],"summary":"An independent contractor accessed personal information in Arcadia's database for an unauthorized purpose.","supporting_quote":"Mr. Symes was previously authorized to use Arcadia’s database, which contained your personal information, but only for authorized purposes and access.","technology_involved":["database"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"actor_id":"charlesesymesii"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9418ef7c84c72aade2805500384f55bb267cb93","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7759BCD8-1F35-4CC4-89CA-83448ED6D571"},"incident_date":"2014-03-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"399378803d4b","org_name":"NATO","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/nato-websites-targeted-attack-claimed-ukrainian-hackers"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f266e66a103452fc2a06c8082e831e671d8349d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62980911-9065-4E5B-9CF8-AAFF2D1F6D50"},"incident_date":"2014-03-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a35125904625","org_name":"Hospitalists of Arizona","org_type":"healthcare","ransomware":null,"records_affected":1706,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop leaves 1706 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e28b2a2c9fa3948a71a59f6a30bd7e74322d6cf1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D71420D1-B8C6-471F-85BB-300BE15930E8"},"incident_date":"2014-03-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"142d4461a467","org_name":"Buncombe County Schools","org_type":"education","ransomware":null,"records_affected":173,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.citizen-times.com/story/news/local/2014/07/02/checks-buncombe-school-employee-information-stolen/12110699/"}],"summary":"Buncombe County school officials have alerted more than 170 employees after an envelope containing checks with their names and Social Security numbers was stolen and some of the checks were cashed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b64e8e1f6bc496997c8187d73719d010a89ae548","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1003F66F-2557-4FCE-A726-4A1652D52283"},"incident_date":"2014-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"e2901d1ff2cb","org_name":"Kremlin","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://i-hls.com/2014/03/hackers-shut-kremlin-website/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de9ebc48b0996c5df4d6c0db1bb629d8514d6218","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"795624A1-E367-4DCB-950E-70AE076339CA"},"incident_date":"2014-03-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64276e1e0825","org_name":"Howard L. Weinstein D.P.M.","org_type":"other","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/four-more-breaches-added-to-hhss-breach-tool/"}],"summary":"Howard L. Weinstein D.P.M. of Texas reported that 1,000 patients were notified after a laptop with their information was stolen on March 13.  A statement on his website says that names, addresses, Social Security numbers, and medical information were on four computers stolen from","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9402eeee8230f2e06f1306705ff5b79c31fdffc9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E68565A5-6CB5-411B-A952-4EA430D4531C"},"incident_date":"2014-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb5c7930c1ff","org_name":"Dropbox, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/tech/internet/dropbox-temporarily-goes-down-friday-n52846"}],"summary":"Dropbox, the cloud storage service, temporarily went down on Friday morning, leaving users unable to access their files.  \"This morning from 7:53 a.m. until 8:35 a.m. PT we experienced a site outage during which time the service was not available,\" the company said in a statement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11ca427f593d562c6a961c3aa4bc7450d9515d92","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35414DAA-B76E-4E59-AD9C-D2CE4E957194"},"incident_date":"2014-03-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec308ae4603c","org_name":"Todd M. Burton, M.D.","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a device results in the exposure of 5000 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-03-13","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdcf955f0b0e01674c7e5959a54bf9446eeb5577","impact_type":"data_theft","incident_date":"2014-02-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Client%20Security%20Breach%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"37345e59754f","org_name":"Silversage Advisors","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44391"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Client%20Security%20Breach%20Letter%20Sample_0.pdf"}],"summary":"Silversage Advisors reported that backup computer drives containing client personal and account information were stolen from an offsite location.","supporting_quote":"On February 20, 2014, back-up computer drives were stolen from a secure offsite location used as part of our disaster recovery plan.","technology_involved":["backup computer drives"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7dd7b7f2f3e27560550a8690b48af738170fca3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AD2BC44-4883-45E9-9E43-24EC205DF244"},"incident_date":"2014-03-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b7ad9fbb882","org_name":"Detroit Medical Center - Harper University Hospital","org_type":"healthcare","ransomware":null,"records_affected":1087,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2014-Breaches-Matrix.htm"}],"summary":"Patient names, dates of birth, reasons for visits, and in some cases Social Security numbers held on documents stolen by an employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d6d8a0934019abd899e3ac202a1e59bd2d3fbc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14DEC90D-DC19-485C-A2B3-4FF1768B76D9"},"incident_date":"2014-03-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b8a9a93409d","org_name":"University of Central Oklahoma","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/university-of-central-oklahoma-discloses-hack-notifying-those-affected/;http://www.uco.edu/technology/cybersecurity/incident-03132014/index.asp"}],"summary":"On March 12, 2014, the University of Central Oklahoma discovered a breach of sensitive personal information due to unauthorized access to information stored on one of our servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-03-12","discovered_date":"2014-01-13","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb2902d9fdf50c35c24af9e22cb72f2aa42d5c08","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20no%20SSN_0.pdf"},"notes":null,"org_country":"US","org_id":"792aefdade52","org_name":"UCSF Family Medicine Center at Lakeshore","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44385"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter%20no%20SSN_0.pdf"}],"summary":"Burglars stole unencrypted desktop computers containing files with names or medical record numbers and health information from the UCSF Family Medicine Center at Lakeshore.","supporting_quote":"On January 13, 2014, UCSF learned that unencrypted desktop computers were burglarized from the UCSF Family Medicine Center at Lakeshore on or about January 11, 2014.","technology_involved":["desktop computers"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-03-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65d53254f26adff546d4de1cf24e4866cee90026","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D633CADE-3EE7-414E-BBDE-5CF410007586"},"incident_date":"2014-03-09","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9cc7decdbabb","org_name":"Craftsman Book Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Craftsman%206_2014%20Attorney%20General%20Sample%20Letter_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45299"}],"summary":"On Tuesday, May 27, we discovered unauthorized activity on a website maintained by our company, Craftsman Book Company. On May 28 we sent a message recommending a change of your password on the Craftsman site: http://craftsman-book.com/products/index.php?main_page=login. Since th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eb45ec3b8e938683ef6e2c751a85dc3b091da4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FBA39C9-1207-40F5-8D0D-6FF4C5616CF6"},"incident_date":"2014-03-09","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4cdd140f12ea","org_name":"British Columbia Ministry of Health","org_type":"retail_ecommerce","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/prescription-information-network-breached-a-7057;http://www.phiprivacy.net/privacy-breach-in-british-columbias-prescription-system/;http://www.britishcolumbia.name/news/pharmanet-privacy-breach-victims-to-be-offered-protection/"}],"summary":"Canadian authorities are investigating whether a hacker or healthcare insider used a physician's credentials to gain unauthorized access to a British Columbia prescription information network, accessing information on about 1,600 patients.  In a statement about the breach issued ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-03-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b505a6e366d0dc85e777873f9f51a95439553f5b","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-03-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/groundctrl-notification%282%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4fe81d4b3c0f","org_name":"ground(ctrl)","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45022"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/groundctrl-notification%282%29_0.pdf"}],"summary":"An unauthorized peson gained access to part of our computer network that supports the websites we operate.  Based on the investigation, we believe an unauthorized person may have been able to acquire a copy of the email addresses and account password, as well as the last four dig","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"545988ad25f3b50712f6a05e3d357cb71d4c4f67","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12B45927-7707-4B4E-A1B9-CEF4188489BA"},"incident_date":"2014-03-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bbb1ac04acc","org_name":"The Johns Hopkins University","org_type":"education","ransomware":null,"records_affected":1307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbaltv.com/news/fbi-probes-johns-hopkins-university-data-breach/24858850"}],"summary":"PII posted to public site by Anonymous after exfiltration from database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2014-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8df1b478fe9bf55a7ef1ce5c3ac2332f15bc1eb6","impact_type":"data_theft","incident_date":"2014-03-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2014-03-03%20breach_0.pdf"},"notes":null,"org_country":"US","org_id":"eca6e2f99498","org_name":"OANDA Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44326"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2014-03-03%20breach_0.pdf"}],"summary":"OANDA reported that an unauthorized breach accessed a historical PayPal payment log and may have accessed fxPense usernames and passwords.","supporting_quote":null,"technology_involved":["fxPense"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acbc7646a76f5d1ee88d3c3b0b32cd6e8133b294","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CD8F63FC-D539-4147-A968-F4396377D5E9"},"incident_date":"2014-03-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2c360c8339c","org_name":"Veterans of Foreign Wars","org_type":"nonprofit","ransomware":null,"records_affected":55000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/MX-M450N_20140411_170105_0.pdf"}],"summary":"On March 4, 2014, VFW received notice that an unauthorized party had gained access to the VFW's web server through the use of a remote access trojan and malicious code.  VFW removed the malicious code from its servers and terminated the hacker's access shortly after discovery.  V","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"052c9f123b1c49d8066b021db1772aa895d702d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4817272B-136A-4992-A533-D46D66A573CB"},"incident_date":"2014-03-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66c312ce82aa","org_name":"University of Massachusetts Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2387,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/insider-breach-affects-about-2400-umass-memorial-medical-patients/article/345695/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://umass-memorial-hospital-main.centreteksolutions.net/sites/umass-memorial-hospital/files/Documents/Emergency_documents/document-notice-001.pdf"}],"summary":"About 2,400 patients of University of Massachusetts Memorial Medical Center (UMMMC) are being notified that their personal information  including Social Security numbers  was accessed by a former employee and may have been used to open commercial accounts.  How many victims? Abou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RU","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483739dcca485fc62c63702ed273ff4169c9b6e5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2A31FEE-1861-488A-80F1-50D490A269B9"},"incident_date":"2014-03-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"4a31375bd4a3","org_name":"UA Ukraine telecommunication systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/russia-suspected-of-ukraine-cyber-attack/article/337578/"}],"summary":"Ukraine's telecommunications system has come under attack, with equipment installed in Russian-controlled Crimea used to interfere with the mobile phones of members of parliament, the head of Ukraine's SBU security service said on Tuesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e1bda127831fc08e3bcca36644a65075a3aa1a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38C4401B-7EB2-4881-A495-720AEED0AB8D"},"incident_date":"2014-03-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f1e76d5e8a7","org_name":"Saint Francis Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newson6.com/story/21476118/tulsa-medical-records-turn-up-on-ponca-city-newspaper-loading-dock"}],"summary":"Shredding partner fails to lock medical documents in containers in transit. Records are discovered on a newspaper loading dock by newspaper employee. The discovery was then published in, you guessed it, the newspaper.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8710b75f1a6dd04e43c3106f4ed9906c5a83ace7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4146679-35A9-45C5-A788-5E58E49C331E"},"incident_date":"2014-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"15c51a3fc96c","org_name":"ruptly.tv","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-International-Video-News-Agency-Ruptly-Hit-With-DDOS-Attack-430390.shtml"}],"summary":"Moments ago, the Ruptly international video news agency, which is part of the RT (Russia Today) global news network, announced that its website is under a distributed denial-of-service (DDOS) attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57d30c7eb6c1a645d9ae595ab490ae6c4ec12623","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87B7BFD5-CFE0-43A8-8199-99F03792A5BE"},"incident_date":"2014-03-04","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"bff93d0993fb","org_name":"Poloniex","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bitcointalk.org/index.php?topic=499580;"},{"fetched_at":null,"title":null,"type":"press","url":"http://globaleconomicanalysis.blogspot.com/2014/03/more-bitcoin-exchanges-hacked-flexcoin.html"}],"summary":"Bitcoins stolen from victim through a logic flaw in their software.  Since transactions where simultaneous, multiple transactions where pushed through allowing a negative balance. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed51385bb907959188c9b437ddf8b1754832861e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0F38FC6-43A7-44EA-A444-86111900374E"},"incident_date":"2014-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a9bb4b85bc4","org_name":"Larsen Dental Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/id-larsen-dental-care-notifies-patients-of-stolen-hard-drive/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpvi.com/content/news/local/story/Patients-Private-Information-Stolen-On-Dentists/owvbyXzTgUq1fbj3EMjKqQ.cspx"}],"summary":"unencrypted external hard drive stolen from employee's car. Had customer personal info on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c7ec1452244eb584bcb62b51bb1235aa44896f4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D248F60-1911-4A9F-A486-E59518E97E57"},"incident_date":"2014-03-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8955d825a2f0","org_name":"South Dakota Air National Guard","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.keloland.com/newsdetail.cfm/sd-air-guard-members-urged-to-protect-identities/?id=161404;http://projects.registerguard.com/apf/tech/sd-military-data-breach/"}],"summary":"SD Air Guard Members Urged To Protect Identities  SIOUX FALLS, SD - 1,000 men and women who have defended South Dakota though the National Air Guard are being urged to protect their identities.  That is because their names, social security numbers, home address, birthdays and pho","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a54c09ebc2dfe62379964a95130ccb0f78a0377","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5127FA36-0133-4FCB-AC19-EBA5C15DE142"},"incident_date":"2014-03-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"aa2575d47931","org_name":"Russia Today media agency","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://securityaffairs.co/wordpress/22716/cyber-crime/russia-today-hacked.html"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"833c84e831d8f9cd18e6af6a5b9a3042db85c994","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E1478E5-6407-4694-9EF0-7AEA8C98F0B3"},"incident_date":"2014-03-02","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8f8b67323a71","org_name":"Flexcoin","org_type":"financial","ransomware":null,"records_affected":896,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnet.com/news/bitcoin-bank-flexcoin-shuts-down-after-hack/"}],"summary":"A bitcoin bank loses all of its coins due to flaw in frond-end code that allowed simultaneous coin transfers to occur from 1 account into several accounts before the overdraw was identified. This was repeated until 896 bitcoins were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"712472959f69751af91e0312a0856f89a24c946c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A696DC25-CECF-4C0B-826D-652A0765669B"},"incident_date":"2014-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9676df6af81","org_name":"Warrick County Prosecutor's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tristatehomepage.com/story/d/story/former-prosecutor-accused-of-keeping-quiet-on-data/34693/kAR977duwE-jv08a00E4Sg;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www2.tristatehomepage.com/media/lib/190/9/7/0/970aa460-2500-4c86-a54e-9e073752ff6d/JoAnn_Krantz_Email.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www2.tristatehomepage.com/media/lib/190/a/4/0/a40ec1d3-310e-4862-9f0e-32757aab8fb4/Press_Release.pdf"}],"summary":"A computer in the Prosecutor's Office was infected with a crypto locker virus, and the prosecutor didn't fulfill their legal obligation to report it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"UA","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"882c6114bdd88773c5f02641f0ebbae40cd6dde9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F152BAD2-55DC-440E-8DD5-7CB1CA0B83C3"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8cfad01d57","org_name":"Visa Inc","org_type":"financial","ransomware":null,"records_affected":7020402,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/anonymous-ukraine-leaks-seven-million-credit-card-details/article/339629/"}],"summary":"Hactivist Group posts Credit Card details of millions of Customers Online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"625f08aa178aa1adce5821dcea5516b1d0b12100","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B814334-F357-4588-860B-D69E0DE1DAB9"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2b07e74113c","org_name":"US Office of Personnel Management","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/world/national-security/chinese-hackers-go-after-us-workers-personal-data/2014/07/10/92db92e8-0846-11e4-8a6a-19355c7e870a_story.html;http://www.nytimes.com/2014/07/10/world/asia/chinese-hackers-pursue-key-data-on-us-workers.html?"}],"summary":"The hackers gained access to some of the databases of the Office of Personnel Management before the federal authorities detected the threat and blocked them from the network, according to the officials. It is not yet clear how far the hackers penetrated the agencys systems, in wh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d706ebd0a0d2d1754413b358203ad9af948e4646","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48C4571D-CDB7-43E9-83AC-0F061CE2890C"},"incident_date":"2014-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0189af7e255","org_name":"United States Post Office","org_type":"government","ransomware":null,"records_affected":72,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/kellyphillipserb/2016/04/29/former-postman-admits-to-stealing-tax-refund-checks-sent-through-the-mail/#630a8c304538"}],"summary":"postman paid for income checks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b44c346eaaa9e8384c62d18c858f7d97316ec4c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B656C149-01B6-45FB-B7A0-6E3D84099AF3"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4febdba1f7a5","org_name":"UK Rhondda Cynon Taf","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-wales-south-east-wales-27159648"}],"summary":"City council accidentally sends non-public election rolls to a private company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dc4fd33bb96f59d6ce75af2b20a93aeefa039a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2128CDD-12E5-4142-9BF8-16185ADAF542"},"incident_date":"2014-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6fe9674c52f","org_name":"Tulsa Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tulsaworld.com/news/courts/former-tpd-officer-ordered-to-repay-in-bribery-case/article_1e23fa69-5681-513a-975a-4924e29e52c7.html"}],"summary":"Officer sells private data in exchange for a bribe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50769ba3dc70aff05273446bcb310b3836ef725f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA75991A-84C6-414D-A399-B00F26860597"},"incident_date":"2014-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d8d6b92c16c","org_name":"TrustHCS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/your-employee-info-is-in-the-mail-somewhere/"}],"summary":"Partner sends unencrypted thumb drive through the mail which goes missing before delivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35ec357d890db1a49a73bad75ade8a0b51edf981","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31BE49CB-FCB9-4CB3-B4C5-E8FCC010447F"},"incident_date":"2014-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f05833b7ddab","org_name":"State Office of People with Developmental Disabilities","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.timesunion.com/capitol/archives/237971/ig-group-home-supervisor-charged-with-identity-theft/"}],"summary":"The supervisor of a cluster of Long Island group homes for the disabled is charged with stealing the identity of a client.  Blossom Officer Thame is charged with using a client's name to open a PSE&G electricity account. She is a treatment team leader for the State Office of Peop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"ideology","name":"#OpRussia","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc0b9de802753c340822ecb0bf4a835e7f385cd7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78DA2E52-DDC2-48CB-85EB-02C0BA6A3B67"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"bf1e0b4577b5","org_name":"Russia Today","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/03/russia-today-hacked-russian-replaced.html"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"oprussia"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f66bd4c336c027d193ebc016b2f5da63f77588","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D51012B7-7B2D-45F7-AD32-D8DE755F5916"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eeb44b164347","org_name":"Pinterest","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2014/03/27/pinterest-butt-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.business2community.com/social-buzz/pinterest-hacked-butt-pics-placed-various-accounts-0827102?_escaped_fragment_=BOlla#!BOlla"}],"summary":"Multiple Pinterest accounts hacked, flooded with butt pics.  \"Our systems were alerted to some incidents of spam yesterday evening. These reports did not come in at a large scale. We began working on cleaning up and placing the accounts in safe mode immediately. The accounts have","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63f638f7f9ef4c1fdc8b1274e81253725b8bae77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F8088A2-8AA2-4741-A6B0-10C7EA5751E1"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb678fb4ddc7","org_name":"National Credit Adjusters","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/NCA%20Sample%202014-6-4_0.pdf?"}],"summary":"National Credit Adjusters receives certain personal information about reatal customers from retailers that sell us delinquent accounts.  Some customers reported being contacted by certain unauthorized third-party debt collectors.  The personal information that may have been acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d963215787d619489cecdd79cf9f08c6e0974620","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76C77310-82D7-4874-9B3F-DBC4662054F8"},"incident_date":"2014-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f389ef5a32","org_name":"Molina Healthcare Inc","org_type":"healthcare","ransomware":null,"records_affected":5261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abqjournal.com/393608"}],"summary":"Molina Healthcare said Friday personal information on some of its 5,261 former members was inadvertently mailed out to individual households via postcards in mid-March.  The postcards contained a tracking number that included Social Security numbers  although not names  of indivi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2012-5385"],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adad2f778ab2011996da4d4a52c89d24de39b40c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A0FB892-4C6C-4979-91C6-536AA72A8AF0"},"incident_date":"2014-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"314ea2ef408b","org_name":"Electronic Arts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://informationwise.net/news/compromised-ea-server-hosts-phishing-malware/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.netcraft.com/archives/2014/03/19/ea-games-website-hacked-to-steal-apple-ids.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/03/ea-games-website-hacked-to-host-apple.html"}],"summary":"A webserver belonging to the EA Games has been compromised by cybercriminals and it is now hosting a phishing page attempting to steal Apple IDs. The compromised server is used by two websites in the ea.com domain, and is ordinarily used to host a calendar based on WebCalendar 1.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2012-5385","kev_added":null,"name":null,"days_listed_before_incident":null,"product":"webcalendar project webcalendar"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0397071ea06cd1b9dd64106f4cf136083dbe4b49","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDEEC5FB-6393-4E30-A220-DC73AD1BC1FA"},"incident_date":"2014-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97ad9c2e06db","org_name":"District Medical Group","org_type":"healthcare","ransomware":null,"records_affected":616,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/httpwww-phiprivacy-netbrigham-and-womens-hospital-notifies-patients-after-data-stolen-in-armed-robbery/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"District Medical Group in Arizona reported that 616 patients had PHI involved in a breach that occurred on March 1, 2014. A statement on their web site explains:  [_]  On October 24, 2014, we became aware that patient information was made potentially accessible on the Internet. W","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20bf6cc2a4d556fd487f42665d44dc34fa874e5c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"719AC0BA-39F6-4F10-A7D3-141A1721DD78"},"incident_date":"2014-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55b9f8bca611","org_name":"Coordinated Health","org_type":"healthcare","ransomware":null,"records_affected":70,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/stolen-laptop-exposes-733-pennsylvania-patients-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/second-burglary-breach-within-a-month-for-coordinated-health/article/344022/"}],"summary":"The theft occurred on Feb. 21, making it the health group's second burglary-related data breach to occur within a month. Coordinated Health announced last month that fewer than 70 Pennsylvania patients may have had personal information  including Social Security numbers  compromi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47022d5da0fed42577833e5003bde4cc49347a21","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46054ABD-6470-4E12-8588-5262F42C901B"},"incident_date":"2014-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d671026760a","org_name":"Cerberus Mortgage Capital Inc","org_type":"financial","ransomware":null,"records_affected":96564,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/cerberus-notifies-users-to-reset-paswords-after-some-users-usernames-and-encrypted-passwords-accessed/"}],"summary":"attacker accessed logfile with 96564 usernames and  passwords.  unknown actions, unknown attacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b7ec7edfed87918e3f7def6703bbb2e0155aad9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"962C8FDE-3DC3-48A9-BBD1-8BA8171162A5"},"incident_date":"2014-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c50da70c8f63","org_name":"Century II","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/news/local/williamson/2016/12/05/brentwood-companys-former-employee-indicted-wire-fraud-identity-theft-charges/95001428/"}],"summary":"A former payroll specialist with the Brentwood-based company Century II has been indicted for wire fraud and identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05978a4fe11cc646fe0d2e5ec5b79a990e7d5921","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0605ed50-9190-11e8-ad4c-017f2df1a0a0"},"incident_date":"2014-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"882027c3aafa","org_name":"Carnival Village Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.caribbean360.com/news/trini-woman-jailed-in-uk-for-defrauding-charity-of-almost-us1-million;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.newsamericasnow.com/this-woman-defrauded-a-nottinghill-uk-carnival-charity/"}],"summary":"Nadia Deone Chase Ali was employed as a financial officer with Carnival Village Trust (CVT), a charity of the carnival.  But over the course of two years, from March 2014 to December 2016, investigators and prosecutors claim Ali was essentially overseeing her own interest, siphon","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42a2121fa9b7ba09bc113e27e02f9aa1ead8c827","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0EA3856-AA96-4D40-940A-F2BA88D1FD78"},"incident_date":"2014-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0fe3f388eab","org_name":"Buffalo Heart Group","org_type":"healthcare","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkbw.com/news/patient-information-compromised-in-security-breach"}],"summary":"Between 500 and 600 patients' information was accessed by an unnamed third party under the direction of a then-associated physician to \"solicit patients in connection with the physician's new employment.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b87087424bf18c8c3459c2e5264dd3fed34ee77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DBEF811-01AD-469C-8F46-F46304AFBE04"},"incident_date":"2014-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"db892e216175","org_name":"Blackpool Teaching Hospitals NHS Foundation Trust","org_type":"financial","ransomware":null,"records_affected":6574,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-health-trust-fined-after-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-lancashire-36203807"}],"summary":"Health trust fined after data breach - Blackpool Teaching Hospitals NHS Foundation Trust","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b80d77d599ed1a20e2e1849e4da0ee80605df1ee","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50F0C9FB-F607-4335-A76B-57C1AAEF6F78"},"incident_date":"2014-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"788a62660e2f","org_name":"Amazon Web Services, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nvenky.in/2014/03/bitcoin-mining-closed-my-aws-account.html"}],"summary":"Stolen private key used to authenticate into Amazon Web Services and utilize cloud services and possibly mine Bitcoins.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61175830abd4ca398ea660d1bf01d8b1a08a495d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD6DA0CA-F804-4B3D-8578-CA80752463A8"},"incident_date":"2014-02-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f298199c82","org_name":"VGM Homelink","org_type":"professional_services","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/four-more-breaches-added-to-hhss-breach-tool/"}],"summary":"VGM Homelink in Iowa reported that 1,400 were affected by a breach involving their business associate Tri State Adjustments on February 28.  On April 25, they posted a statement on their website:  HOMELINK, a Waterloo, Iowa-based provider network of ancillary health care services","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f903fbfe18459376ab9601776549cd9c0bed5dda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFBAEE10-4025-4DE7-BBA6-EFC8DFE7F222"},"incident_date":"2014-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"fa5e4f80e8b0","org_name":"UA Right Sector nationalist movement (banderivets.org.ua)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hacktivists-Disrupt-Websites-of-Ukrainian-Parliament-and-Right-Sector-429853.shtml"}],"summary":"Political Party Incident: Hacktivists continue to launch attacks against Ukrainian government websites. The latest targets are the sites of the parliament, or the Verkhovna Rada (rada.gov.ua), the Right Sector nationalist movement (banderivets.org.ua), but also some Euromaidan we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1f2ffd92d3d99a57f4419bf7bb90b9d0b71a668","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A46E1691-E394-406A-BA5A-FC90BE31398E"},"incident_date":"2014-02-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"142f3f42df72","org_name":"UA Parliament Verkhovna Rada","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hacktivists-Disrupt-Websites-of-Ukrainian-Parliament-and-Right-Sector-429853.shtml"}],"summary":"Government incident: Hacktivists continue to launch attacks against Ukrainian government websites. The latest targets are the sites of the parliament, or the Verkhovna Rada (rada.gov.ua), the Right Sector nationalist movement (banderivets.org.ua), but also some Euromaidan website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50f27556a87577a09c01994c4aaef094f5db3dd1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C102D942-2886-4EE7-9B7A-FEF852F4DABB"},"incident_date":"2014-02-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"205dab2c3303","org_name":"Entercom Communications Corp.","org_type":"technology_saas","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/storage-devices-stolen-from-entercom-portland-employee-13k-affected/article/346897/"},{"fetched_at":null,"title":null,"type":"press","url":"http://koin.com/2014/05/13/portland-radio-contestants-data-breached/"}],"summary":"Entercom Portland, the Oregon-based branch of the national radio broadcasting corporation, is notifying about 13,000 individuals that their personal information may have been compromised after storage devices containing the data were stolen from an employee's vehicle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1db25544c77b67e6c2c2cc00693c5591db410386","impact_type":"unknown","incident_date":"2012-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Resident%20Notice%20Letter_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ea847cbe4336","org_name":"80sTees","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44281"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26ec9c83d697b1372e6e387d7040afc19753ab0d","impact_type":"unknown","incident_date":"2012-12-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/SmuckerBreachCALIFORNIA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b19e71d7eb6c","org_name":"The J.M. Smucker Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44253"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-27","discovered_date":"2014-01-24","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acd91f5774e075143b7fd1b6e7cde5d271892afe","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notice%20FINAL%20220_0.pdf"},"notes":null,"org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44232"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notice%20FINAL%20220_0.pdf"}],"summary":"L.A. Care Health Plan reported that a manual processing error in its payment portal exposed some members’ names, addresses, and member identification numbers to other members.","supporting_quote":null,"technology_involved":["payment portal"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3acb3588c95f1ea46fe68c1214dc89db2a16fa3","impact_type":"unknown","incident_date":"2007-10-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/VALIC%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"3d046f83cc67","org_name":"The Variable Annuity Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44213"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cbb0154a5bdf5ada3c5641090de0b57e47b2b17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F508946B-7B68-407B-8D7E-ACA9A79C6C66"},"incident_date":"2014-02-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37e45adddb70","org_name":"Seven Counties Services, Inc.","org_type":"nonprofit","ransomware":null,"records_affected":727,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/other-breaches-newly-disclosed-on-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Improper paper disposal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45d5bdac51ed675959468f2af215d363be4e0c6f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75DE9AC7-73EA-49F7-AE79-FF88A6427A13"},"incident_date":"2014-02-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09b2b3988e43","org_name":"Kroger Co/The","org_type":"retail_ecommerce","ransomware":null,"records_affected":504,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"504 electronic medical records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc24c17c23be21a1e6b93b51bf3b0d7e0e5f4d69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7862A10F-D8C7-45C7-A924-ACF7E758F5AC"},"incident_date":"2014-02-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bec412b6d179","org_name":"Care Advantage, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3458,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Laptop theft leaves 3458 medical records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f4d95a6bdb1edc2e67249e7a21bdc5f04352517","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A695E842-89AD-4547-B767-076CF8EE6205"},"incident_date":"2014-02-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc4fa150c5cf","org_name":"BOARD OF EDUCATION OF CARROLL COUNTY","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/carroll-county-md-schools-reveal-cyberattack/2014/03/05/3c16cc5a-a47f-11e3-b865-38b254d92063_story.html"}],"summary":"School networks brought down for 1 day due to DoS attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Deletesec","variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"914ed12572e2608f21f01e6ad0041ad3cfbf231b","impact_type":"data_theft","imported_from":null,"incident_date":"2014-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"fabda07e98f6","org_name":"UN Internet Governance Forum","org_type":"government","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: UN Internet Governance Forum","type":"hibp","url":"https://haveibeenpwned.com/Breach/IGF"}],"summary":"The UN Internet Governance Forum's website was breached, and 3,200 email addresses, names, usernames, and cryptographically stored passwords were leaked.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"deletesec"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":"@th3inf1d3l","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e1e5a774fe74c3347955ea8db56ab5aa31f5cd6","impact_type":"data_theft","incident_date":"2014-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"GB","org_id":"0c79689fc16d","org_name":"Muslim Directory","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Muslim Directory","type":"hibp","url":"https://haveibeenpwned.com/Breach/MuslimDirectory"}],"summary":"Muslim Directory was attacked, and user web-account data including personal information and plaintext passwords was publicly dumped.","supporting_quote":null,"technology_involved":["web accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown","derived":{"actor_id":"th3inf1d3l"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"893236e01280f7602a4a13d4294fcbb885c11631","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":null,"org_country":"US","org_id":"b7728ec722db","org_name":"Spirol","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A SQL injection vulnerability in Spirol’s CRM was allegedly exploited to extract data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Spirol","type":"hibp","url":"https://haveibeenpwned.com/Breach/Spirol"}],"summary":"Spirol’s CRM was allegedly accessed through SQL injection, exposing customer records and contact information.","supporting_quote":"The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirol’s CRM system ranging from customers’ names, companies, contact information and over 55,000 unique email addresses.","technology_involved":["CRM"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d12c6b8ce47708ae15f3502dacf27c54899b3176","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"098FBBDE-658C-4DAB-BE46-8C0F2DFC7B10"},"incident_date":"2014-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9736278d02e","org_name":"Palomar Health","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ca-data-stolen-from-5000-palomar-health-patients-after-flash-drives-left-in-employees-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.utsandiego.com/news/2014/mar/28/palomar-health-data-theft-5000-patients/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44642"}],"summary":"About 5,000 patients of Palomar Health had personal information  including medical diagnoses  stolen last month when someone swiped a company laptop and two flash drives from an employees SUV, a company official announced Friday.  The inland North County health care system is rea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2014-02-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00427f137f15d6ce3fddbd44272cc260cf8c79b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C2FE126-C3E6-407C-BA8F-8197C0403A0C"},"incident_date":"2014-02-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36e9ce04d2d4","org_name":"EC Council","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/03/13/ethical_hacker_cert_org_pwned/;http://www.eccouncil.org/news/ec-council-takes-the-privacy-and-confidentiality-of-their-customers/"}],"summary":"Outsourced email system was compromised as well as website control panel also managed by a third party. Very little information on how either compromise occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e316ff21aef717af8be44b39318338c9202eb2d4","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DC7F44C-B350-4578-8948-86974D1C5028"},"incident_date":"2014-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b77ce62c4714","org_name":"NBC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/nbc-confirms-hack-nbccom-a-5530"}],"summary":"Users visiting the NBC.com website were exposed to malicious iframe attempting to run code on their system. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5948a44997e362e15c279b51e6f2389df6ab088d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E869FE59-1161-46F2-ACFF-E1C75A4E49C7"},"incident_date":"2014-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"952004096e40","org_name":"Namecheap","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Massive-DDOS-Attack-Launched-Against-Namechap-s-DNS-Platform-428467.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0a5f5e6a0faf6d474564e319629b36ab80525cc","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Card%20Carrier_HB_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44178"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44520"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864ca65ec2fe130f916e3516ff1d4775151e84b9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC19AECD-C568-49D6-ABEE-A8FB1E7EB661"},"incident_date":"2014-02-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ee3eb1a359b","org_name":"COORDINATED HEALTH SYSTEMS","org_type":"healthcare","ransomware":null,"records_affected":733,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/pa-patient-information-may-have-been-on-stolen-coordinated-health-laptop/"}],"summary":"Lost laptop with sensitive patient data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cea33f2dc2dbb7d0c008c5a989b25615e6f6226","impact_type":"unknown","incident_date":"2014-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EE%20Notification%20Letter_Security%20Breech_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd2cc3ef120e","org_name":"Department of Resources Recycling and Recovery","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44175"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dec28f5f18824aa3363dbd1d63331dac110ab636","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72B82612-2DC6-447B-BD42-6DDFBBE2E2BD"},"incident_date":"2014-02-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6e3e3fb8020","org_name":"Grand Sierra Resort","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/grand-sierra-resort-guest-payment-cards-breached-in-2014-and-again-in-2015/"}],"summary":"Grand Sierra Resort ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34bad933fcde324fb4cd55bc3a6ad159e66096e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"610EAC63-00BA-45AB-A9DA-9EEF93086A8B"},"incident_date":"2014-02-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a1e8d688902","org_name":"St. Joseph Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/st-joseph-health-notifies-patients-of-hipaa-breach-due-to-failure-to-redact-patient-names-from-file-sent-to-investment-firm/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Main%20Patient%20Letter%20%20Cain%20Brothers%20%20Home%20Care%20Network%20r2prf_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44318"}],"summary":"We take patient privacy very seriously and it is important that you know of an issue that, although involving some of your information, did not compromise your social security number or other financial data. St. Joseph Health provides central support services to its members inclu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4cb5fea048ff9cf668556d70c778361da36e3b0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"481AC9C4-40FC-408F-936A-CF8BC8FF76EC"},"incident_date":"2014-02-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f0dd139f2aa","org_name":"Shaker Clinic","org_type":"healthcare","ransomware":null,"records_affected":617,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/four-more-breaches-added-to-hhss-breach-tool/"}],"summary":"Shaker Clinic in Ohio, a psychiatric care facility for adults and seniors, reported that 617 patients were notified of loss of paper records on February 18.  There is no statement on their website at this time that provides any explanation of the incident and they did not respond","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"ZHC (Z company hacking crew)","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2acf2d905fee19507e6c216360fc482bfb29ec1b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1E7BCC9-EFAE-4E3C-9FD1-6D40C6319143"},"incident_date":"2014-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"da4640230b68","org_name":"National Portal of India","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/zhc-hacks-national-portal-of-india/"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"zhc"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"686449fed7003b3733d933fde59e5928abd0ecc6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61BCDB75-75F7-4B2D-9BEB-53E126E667DD"},"incident_date":"2014-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"c689b1076b6d","org_name":"Code Club AB","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wurmonline.com/2014/02/18/launch-day-ddos-game-offline/;http://forum.wurmonline.com/index.php?/topic/96315-update-concerning-ddos-attack-and-downtime-updated-1820-cet-february-20th/"}],"summary":"Online game suffers DDOS during launch day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b20f7e7fa80ccf97a5e8531b418d489375ab8f36","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/98368-PROOF2_0.pdf"},"notes":null,"org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44151"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/98368-PROOF2_0.pdf"}],"summary":"Blue Shield of California disclosed that its Agent ID numbers, which were Social Security numbers, were disclosed to clients in connection with attempted online policy payments.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"AR","motive":"ideology","name":"Cyber protest","variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"775178a1d50e1acd458d4e18c3b27ca3e773c591","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D80516D-7EE9-4C0E-AA44-E4FA95D62395"},"incident_date":"2014-02-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"6653c7676ff4","org_name":"Venezuelan government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Venezuelan-Police-and-Government-Sites-Hacked-in-Protest-Against-Killing-of-Students-427223.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"cyberprotest"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c307482621ba432564abacd23356f927adcf17b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8804EE9-CAA8-4649-A85D-99038027E857"},"incident_date":"2014-02-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ccc8cafe9ba6","org_name":"Union Labor Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":46771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/union-labor-life-insurance-notifies-46771-after-laptop-with-personal-info-was-stolen-from-their-offices/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ullico.com/datafaq"}],"summary":"Union Labor Life Insurance Co. (ULLICO) has notified 46,771 participants, dependents, and insurance applicants after a laptop with personal information was stolen from their Silver Spring, Maryland offices on February 17.  The theft was discovered on February 18.  In an FAQ on th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19f36572d1a059c63292690f8abb79d667994fea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA91B028-B567-4D35-B799-BE47DD8F90ED"},"incident_date":"2014-02-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"924f44769426","org_name":"UK Army","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://grahamcluley.com/2014/02/passwords-leaked-live-tv-flood-emergency/"}],"summary":"TV crew films man talking about emergency response. System passwords are written on the whiteboard behind him.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Syrian Electronic Army","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18481936d946004a1d1f2196211726af47dba2f5","impact_type":"both","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"dedf7454dd1b","org_name":"Forbes","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Forbes","type":"hibp","url":"https://haveibeenpwned.com/Breach/Forbes"}],"summary":"An attack on the Forbes website leaked user accounts and led to fake news stories being posted to forbes.com.","supporting_quote":null,"technology_involved":["Forbes website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"syrianelectronicarmy"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2014-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92705a2df6984b38cedea7dcfc1a937853dbcc27","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAE8091E-14DD-4BD7-A637-F7FBFD4FFD0E"},"incident_date":"2014-02-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0eaf33c06835","org_name":"University of California, Irvine","org_type":"education","ransomware":null,"records_affected":1836,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/keylogger-malware-found-on-three-uc-irvine-health-center-computers/article/347204/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-45106"}],"summary":"More than 1,800 University of California (UC), Irvine, students, as well as nearly two-dozen non-students, are being notified that they may have had unencrypted personal information compromised after keylogger malware was discovered to have been on three Student Health Center (SH","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9862a3127e2030ec3b11e222a842a1db1d974c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A073AA0E-CC7E-416F-9A59-4D97A39FF367"},"incident_date":"2014-02-14","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"232d85dc5fbc","org_name":"Assisted Living Concepts LLC","org_type":"healthcare","ransomware":null,"records_affected":43601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/assisted-living-concepts-notifying-over-43000-employees-after-hack-of-payroll-database-at-vendors/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/assisted-living-concepts-20140226.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/payroll-vendor-breached-data-on-more-than-43000-employees-at-risk/article/336973/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/business/breaking/chi-assisted-living-data-breach-20140312,0,7486040.story"}],"summary":"More than 43,000 former and current employees of Chicago-based Assisted Living Concepts (ALC) are being notified that their personal data  including Social Security numbers and pay information  may be at risk after an unauthorized third party breached ALC's payroll vendor and gai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31b583a829c9089e84d6c3118fb5244e616e386","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6c8b3df0-c25a-11e8-bf07-99bafabab839"},"incident_date":"2014-02-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2a0b675e1479","org_name":"Smoky Lake Health Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://edmontonjournal.com/news/local-news/victim-furious-over-health-record-snooping-wants-changes-to-albertas-prosecution-limit"}],"summary":"Acquaintance misuses access as an employee of doctor's office to spy on patient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f1ccbb920e4d966a3429ea987d0d060f1abe62","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6B1832A-9783-482D-A961-E76534793D35"},"incident_date":"2014-02-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f6ac333923","org_name":"Orlando Health","org_type":"healthcare","ransomware":null,"records_affected":586,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.orlandosentinel.com/2014-03-24/health/os-orlando-health-data-breach-20140324_1_flash-drive-orlando-health-winnie-palmer-hospital"}],"summary":"A computer flash drive containing limited patient information on 586 children treated at Orlando Health's Arnold Palmer Medical Center has been misplaced and is being treated as a data security breach.  The information includes last names, assigned medical record numbers, dates o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","financial","medical","personal"],"disclosed_date":"2014-02-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56136aa4cc11bffa1e44dac34bf24fdd52375d36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C83F276A-32AE-47FD-8004-C1D32E2ADBB0"},"incident_date":"2014-02-12","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8cbe474e53f","org_name":"DeKalb Health","org_type":"healthcare","ransomware":null,"records_affected":1361,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/1-361-dekalb-health-patients-information-compromised-by-cyberattack-phishing-scheme.html"}],"summary":"Hacking incidents at Auburn, Ind.-based DeKalb Health have compromised the personal and health information of more than 1,000 of the system's patients.  On Feb. 12, DeKalb Health became aware a server controlled by a contract that operated DeKalb Health's website had been hacked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34a4b7ad7fb79ffb82cc6245a5748b3000cc756e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD56CE95-965E-4E3B-AAE6-8F3DF9DFE3EC"},"incident_date":"2014-02-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a81258c9fa82","org_name":"British Ministry of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-British-Ministry-of-Justice-Disrupted-by-DDOS-Attack-426652.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b762b9b378cbe54cf330e2b61dd3efa2a20b5c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAE5B59A-6247-4375-920E-86338BF77464"},"incident_date":"2014-02-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f428a887bee9","org_name":"Department of Social & Health Services","org_type":"government","ransomware":null,"records_affected":3104,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/washington-dept-social-health-services-sends-sensitive-info-to-wrong-addresses/"}],"summary":"The personal information of up to 7,000 households receiving assistance from the state Department of Social and Health Services (DSHS) was sent in error to incorrect or old addresses, according the state Economic Services Administration (ESA).  The administration confirmed in a n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa784b63dcda46c555d971fd15d5211277c7e07c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CDA0162-110F-4867-98C3-A7D9C2111F0C"},"incident_date":"2014-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2eebd212acf1","org_name":"BITSTAMP","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessweek.com/news/2014-02-11/bitcoin-exchange-bitstamp-halts-withdrawals-citing-web-attack"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dba005bf02b83e161231887c18cc6b32a5ade3b","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Home%20Depot%20Data%20Breach%20NOTICE.%20pdf_0.pdf"},"notes":null,"org_country":"US","org_id":"bb8383c302dd","org_name":"The Home Depot","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"HR associates used their authorized access to personal information for unlawful purposes.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44115"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Home%20Depot%20Data%20Breach%20NOTICE.%20pdf_0.pdf"}],"summary":"The Home Depot reported that three HR associates may have accessed personal information for unlawful purposes.","supporting_quote":"Our investigation indicates that your information may have been accessed by one of these three associates for unlawful purposes.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"vendor_control_failure","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-10","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6850ab0bb7b90054476dfbcea70f8dc2414cc7ae","impact_type":"exposure_no_theft_confirmed","incident_date":"2014-01-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Employee%20Notification_2.4.14_all%20other_final_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"6dac7b293941","org_name":"The Freeman Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A glitch in the mail vendors’ technology caused a barcode to be printed on W-2 envelopes, exposing employees’ names and addresses through the envelope window.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44098"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Notification_2.4.14_all%20other_final_0.pdf"}],"summary":"A mailing technology glitch caused a barcode containing employees’ names and addresses to be visible through the windows of W-2 envelopes mailed by The Freeman Company.","supporting_quote":"A glitch in the mail vendors’ technology caused the barcode to be printed on the envelope.","technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":"ADP"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"1996f17e4011","name":"ADP"}]}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80e5dceb9b9f978a9a386866d196b2612d413d32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97F9F79B-2F8C-4238-8167-C2872816F30D"},"incident_date":"2014-02-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"03abf7c61723","org_name":"CloudFlare","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/02/NTP-Distributed-Denial-of-Service-DDoS-attack.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/02/biggest-ddos-ever-aimed-at-cloudflares-content-delivery-network/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f134987aa0d743b02a0e436e322463a3b02935a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBA80AC3-B971-4F42-8B2C-B7AB0A3E0E8F"},"incident_date":"2014-02-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09bf2b2554de","org_name":"Skepchick.org","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://skepchick.org/2014/02/were-back-sorry-lady-haters/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22a25965e81adae2c0de0e8f4bfed8e2699d86bc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA054FFA-2B77-47F9-9ABC-F205B96B1387"},"incident_date":"2014-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb3339609ccc","org_name":"PruittHealth Pharmacy Services","org_type":"healthcare","ransomware":null,"records_affected":841,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"A manager's unencrypted laptop computer was stolen from the back seat of an employee's car.  The laptop contained the protected health information (PHI) of 841 individuals and included names, possible diagnoses, prescription names, dates of service, and service locations.  The co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"ideology","name":"Dr.Sha6h","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c9bea31911681818e5dbd35df7f808f178f6732","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"117CF68F-C3CA-426A-903D-FD1FBEBCF237"},"incident_date":"2014-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TM","org_id":"3239e31ef831","org_name":"PrezidentBank and Turkmenbashi bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkmenbashi-and-PrezidentBank-State-Commercial-Banks-of-Turkmenistan-Hacked-424965.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"drsha6h"}},{"actor":{"category":"external","country":"IR","motive":"unknown","name":"Dr.3v1|","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ebeeb7af420e6d07ed4c6853cec3fa79800eea5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48F0D580-18BF-4CAE-8F3C-90BE43218A5B"},"incident_date":"2014-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NP","org_id":"f564b45f1985","org_name":"presidental office website of nepal","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Nepal-s-President-Hacked-and-Defaced-425171.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"dr3v1"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea866fbc3e61d88f305c0aa9e5996315c557d15e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C3AA142-B5E2-4E95-A7FA-420DF39E366E"},"incident_date":"2014-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69e85051d15b","org_name":"Emory HealthCare","org_type":"healthcare","ransomware":null,"records_affected":826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/breaking-news/laptop-patient-information-stolen-emory-clinic/nd9SQ/"}],"summary":"A laptop stolen from a vehicle at an Emory Healthcare clinic contained limited information for 826 patients, the university said Monday.  On Feb. 7, a car belonging to an employee of the Emory Dialysis Clinic was one of several broken into, according to Vince Dollard, spokesman f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5ebb904105aa9affb8c83edd78acac66bf6cc0f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6CA3D50-2CA9-46D3-A746-10AFE75AAE0E"},"incident_date":"2014-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6121a6e65f61","org_name":"Easter Seal Society of Superior California","org_type":"healthcare","ransomware":null,"records_affected":3026,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44067"}],"summary":"Theft of a laptop leaves 3026 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a1ce4ed7662713e54d26926a8050003970c34a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF63C96F-04ED-408B-97FF-9DADA885402A"},"incident_date":"2014-02-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e46bb2cc104","org_name":"Cole Taylor Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Letter%20for%20California%20Submission_1.pdf"}],"summary":"Please read This Important Notice Regarding: your mortgage loan number(s) ending in 0146, 1234. Dear Joe Smith, Protecting the privacy and security of your personal information is extremely important to us.  We are writing to let you know about a recent incident in which certain ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4948f7e9a5ded3be5ad5e475de90a3ac53a4c3c7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D643740-0538-409F-8570-104CAD5BA5D5"},"incident_date":"2014-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7a385d35e85","org_name":"Keith & Fisher, DDS, PA","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking incident puts 6000 records at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f6810385d71cd43b21bd8f468ad9213635bcd66","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD333E32-C733-4D1D-831A-EE7DC7E4CD2C"},"incident_date":"2014-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"324407045851","org_name":"Clinical Research Laboratory","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/News-stories/identity-protection/Clinical-Reference-Labs-Repeats-Data-Breach;http://www.phiprivacy.net/clinical-reference-laboratory-notifying-some-insurance-applicants-that-personal-information-was-lost-in-the-mail/"}],"summary":"Despite reinforced packaging, a shipment from  was damaged in the mail, and when it was returned to  by the post office, some pages of invoices were missing. Those pages  would be segregated and destroyed by USPS under their procedures, but that is not recorded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ff8c8c7793b3c78d7c8ef80b4435798ba44535c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"535A6DF2-7B0B-466E-B572-6EEA78B352BE"},"incident_date":"2014-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da674551a7e7","org_name":"Clinical Reference Laboratory","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/News-stories/identity-protection/Clinical-Reference-Labs-Repeats-Data-Breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/clinical-reference-laboratory-notifying-some-insurance-applicants-that-personal-information-was-lost-in-the-mail/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2014%2004%2008%20CRL%20ltrt%20Consumer%20re%20security%20breach.pdf"}],"summary":"Another one? Really, youd think the folks at Clinical Reference Laboratories (CRL) would have found a better way to mail packages by now. For the second time in six months, CRL is reporting a package damaged in the mail has created a data breach.  This breach involved tests run i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25879af9a68fabd4b1bb295d07430e9df1fc39a5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99C64ACD-4FA1-456C-A1B4-47BB216FE158"},"incident_date":"2014-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3af3cefe609b","org_name":"Sutherland Healthcare Solutions Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/SFHN%20Notification%20Ltr%20Signed%20RP%20March%2019%20%20Final_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44698"}],"summary":"The San Francisco Department of Public Health has a contract with a billing vendor named Sutherland Healthcare Solutions. On February 5, 2014, Sutherlands office located in Torrance California was burglarized and desk top computers were stolen. The police were immediately notifie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"639a5edb089d3683ae80258b1eac7bc279e84c32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"080E98BA-AABC-4B35-9788-BCF665C4271D"},"incident_date":"2014-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0912b895bf19","org_name":"Sutherland Global Services","org_type":"other","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.4medapproved.com/hitsecurity/l-business-associate-causes-hipaa-breach-165000-health-records/"}],"summary":"Actor broke into victim office and stole 8 laptops which contained unencrypted medical data that the victim was processing for several partner organizations","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f19d701942ecff770967ae12d70d29e4376a2a6b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D73B3496-1479-476C-AD3F-3D4244A10552"},"incident_date":"2014-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd16dd3cc33b","org_name":"Min Yi, M.D.","org_type":"healthcare","ransomware":null,"records_affected":4676,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a device leaves 4676 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86849bbd5d4fa9d7778ec1693bf2ba085139268f","impact_type":"unknown","incident_date":"2013-05-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Yi%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cfa32039fafe","org_name":"K. Min Yi, M.D. General Surgery","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44028"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93858707d05d49983100d00db7b3f5039284f204","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20email%20notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44030"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9fc5fa12807ca681aacbd9164e5da2cd3451a40","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54169DC0-E965-421D-A4C5-2413DD9A453B"},"incident_date":"2014-02-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0d29cff2ad8","org_name":"University of Kentucky HealthCare","org_type":"healthcare","ransomware":null,"records_affected":1079,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/more-than-1000-uk-healthcare-patients-impacted-by-stolen-laptop/article/339842/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ukhealthcare.uky.edu/one_default.aspx?id=22974"}],"summary":"A password protected laptop stolen from Talyst, a provider of pharmacy billing management services, has resulted in the compromise of personal information for more than 1,000 patients of University of Kentucky (UK) HealthCare.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":"Voice Of Black Hat Hackers","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6eea198b51f7ff75b4c114fe5735ec9563de8e7f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"604A27A9-A409-4808-A1FD-59BB96F47FFC"},"incident_date":"2014-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"344aa2330ca2","org_name":"Rajasthan Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/02/two-rajasthan-government-websites.html#sthash.LAKBNvPT.RTG5wUIt.dpuf"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"voiceofblackhathackers"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8290db83e363832f01938fbf636845a07a8b1a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E116AE0-E63D-41AB-BB7D-53CBBF6A4E6E"},"incident_date":"2014-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9591396d8555","org_name":"Alabama Criminal Justice Information Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/anonymous-posts-over-4000-u-s-bank-executive-credentials-7000010740/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/hackers-posts-info-from-bank-execs-2013-2"}],"summary":"4000 PII records, acquired from an unknown victim is posted on a government web page.  I am modeling the compromise of the web server and change in content.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2014-02-03","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"570f0f9b200fbc40f1a1c18ce29be60ce6f0133d","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-12-13","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%2014-008e_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"bd996abb4da3","org_name":"University of California Davis Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43996"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%2014-008e_0.pdf"}],"summary":"UC Davis Health System reported that a medical provider’s email account was impacted by a phishing scam, potentially exposing patients’ names, medical record numbers, and clinic visit dates.","supporting_quote":"We recently learned that one of our medical provider’s email accounts was impacted by an email “phishing” scam.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99f195228d650121ea34ceae93fbabe2f658ce7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70AE5FF8-CEB6-40B2-9014-F0405E533BE1"},"incident_date":"2014-03-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-mar-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-feb-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-apr-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-may-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jun-2014.pdf"}],"summary":"Veteran A reported he found Veteran B's medical report on a CD from Release of Information (ROI) that contained his military records. The information was scanned from his VA medical record. The information at risk included Veteran B's name, date of birth, partial SSN and protecte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e9b78f092aa3d126cdb3e5e6111d1508cf7c90d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE9D7B58-B353-43E2-834B-53CB748938F2"},"incident_date":"2014-02-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5631460dc9bf","org_name":"St. Elizabeth's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":6831,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/business/2012/04/06/elizabeth-medical-center-notifies-patients-billing-data-breach-charlestown-incident/yknvi1ffpVJCI42h6pfazN/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/32173"}],"summary":"St. Elizabeths Medical Center said Friday it is notifying 6,831 patients that their billing information, including credit card numbers and security codes, may have been compromised when documents the hospital planned to shred were removed by a vendor from a building scheduled for","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c7736b71c94beaedf463b73bd17b8ff769b2e6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3318d260-ffe1-11e9-830f-9f9afa6b578d"},"incident_date":"2014-02-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"1bbe8f40054e","org_name":"Queensland Police department","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.abc.net.au/news/2018-05-11/officer-who-leaked-womans-address-has-pay-docked-no-charges/9748818"}],"summary":"a police officer looked up the address of an abuse victim and provided to her abuser","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1715b69457dcb6efbe0ed62818130ebed8de91b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94CFFBBE-0E54-4C9F-8DF7-32153DCD758F"},"incident_date":"2014-02-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85248623c97a","org_name":"Northrim Benefits Group","org_type":"financial","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationaljournal.com/health-care/obamacare-enrollment-firm-fumbles-client-data-20140204"}],"summary":"In a slipup to stoke Republicans' Obamacare security concerns, Enroll Alaska accidentally released email addresses of about 300 clients. An employee forgot to hide the recipient list when sending out a mass email regarding a glitch with the HealthCare.gov, according to the Anchor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbc09eb45855ef02d661a7bd4398a0fda9656b6e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2198417A-8CEF-45AC-92EA-5B683134AF5A"},"incident_date":"2014-02-02","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9e452a5d67b7","org_name":"PayPal, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/02/ebay-and-paypal-uk-domains-hacked-by.html"}],"summary":"Incident 2: Ebay and Paypal UK domains hacked by Syrian Electronic Army","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c283ea37bfaf95a43540baffbd09302dfa687193","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94973642-EC14-4137-AFED-A62C76323E91"},"incident_date":"2014-02-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59ae11ee9c33","org_name":"NEW MEADOWLANDS STADIUM COMPANY, LLC","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/Jhaddix/statuses/430071676986867712"}],"summary":"CBS broadcasts the wifi SSID and Password being used by the Super Bowl physical security command center. CBS news posted a picture on Twitter of a computer screen where the password had been written down.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"@smitt3nz","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a7d919b439c65a92e1ef49a9a68a898b1fa668f","impact_type":"data_theft","imported_from":null,"incident_date":"2014-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"49d28fad74a2","org_name":"WPT Amateur Poker League","org_type":"other","ransomware":null,"records_affected":175000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: WPT Amateur Poker League","type":"hibp","url":"https://haveibeenpwned.com/Breach/WPT"}],"summary":"The WPT Amateur Poker League website was hacked, exposing account information that included email addresses and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"smitt3nz"}},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d55ef70131f8cc9cdc52af24a6c9710f530444f1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42F0CC86-615E-4D90-83E7-1C9496E6E629"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2841b480f51d","org_name":"Veterans of Foreign Wars of The United States","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html"}],"summary":"Attackers leverage IE10 zero day and a watering hole attack to install malware on US Department of Defense computers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5419a19ed3601bf94851376c4d4a0f92b0d5deee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB3C9429-6EF0-4EBC-8D8D-D538658CAC07"},"incident_date":"2014-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79358eb1ad98","org_name":"Valero Energy Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://santamariatimes.com/news/local/crime-and-courts/thieves-steal-card-data-with-skimmers/article_c7110540-a750-11e3-a685-001a4bcf887a.html"}],"summary":"Police removed two illegal electronic skimmers from gas pumps at a Valero station on East Ocean Avenue after receiving a report March 5.  The illegal skimmers had been attached to the legitimate card reader in the pump itself, Chisholm said, meaning the thieves were able to open ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e23fb3e43a996acab56881337ab0f46023eb760d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA2736DF-67A2-4157-A4CC-042911398A93"},"incident_date":"2014-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7962201e96b","org_name":"University of Maryland","org_type":"education","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://umd.edu/datasecurity/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2014/04/whitehat-hacker-goes-too-far-gets-raided-by-fbi-tells-all/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/information-technology/2014/05/why-he-hacked-university-of-maryland-contractor-turned-hacker-tells-all/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/politics/blog/bs-md-university-cyber-20140723,0,623215.story"},{"fetched_at":null,"title":null,"type":"press","url":"http://washington.cbslocal.com/2014/03/20/maryland-hacked-again-2nd-data-breach-in-4-weeks/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalbay.com/news/washington-dc/490617-univ-of-maryland-victim-of-another-cyber-attack.html;"}],"summary":"A whitehat hacker from the Baltimore suburbs went too far in his effort to drive home a point about a security vulnerability he reported to a client. Now hes unemployed and telling all on reddit.  David Helkowski was working for Canton Group, a Baltimore-based software consulting","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf623bc629a15ebb95612097f1d5bbd9df312b70","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DC43342-03B8-46E0-9654-C83E7A3DB038"},"incident_date":"2014-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7900423f484","org_name":"United Stated Department of Defense","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html"}],"summary":"Attackers leverage IE10 zero day and a watering hole attack to install malware on US Department of Defense computers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3175d58fc8a09af986a6ac521ed52ce139ad5b30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E8E5A65-40BC-42CF-B652-377B2FD0C504"},"incident_date":"2014-02-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d070f9e9fbef","org_name":"Tinder","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/02/Online-Dating-app-Tinder.html"}],"summary":"Researchers discover flaw and create app to reveal exact location of users of a popular dating application called Tinder","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9875bda6dad818b6b481f4d7ef4046b63fcf7800","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12E1E6D6-6BCF-4879-840B-152571828370"},"incident_date":"2014-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c6bec544f83","org_name":"Supportive Concepts for Families, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/pa-supportive-concepts-for-families-notifies-clients-after-personal-information-was-exposed-on-google-for-10-months/"}],"summary":"SCFFI maintains an internal database that contains health information about our consumers. This database is used by our employees as they provide care to our consumers. The health information in this database is designed and intended to be accessible through our internal web port","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82f54ea9c8b3e173d4fb30adfde4bab6914d312b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A79BFF68-888E-44CE-B28D-E54C596FE5E6"},"incident_date":"2014-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df6861d3c6e0","org_name":"State of the Heart Cardiology","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/tx-former-heart-clinic-employee-admits-to-illegally-disclosing-patients-medical-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://crimeblog.dallasnews.com/2015/12/former-heart-clinic-employee-charged-with-illegally-disclosing-patients-medical-records.html/"}],"summary":"Employee at heart clinic disclosed medical information to FAA of a pilot due to an argument. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d760635d3d757959e1792b66e6d7fcd87c763a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18501D62-FADA-47FB-8E04-4FC7B06EB793"},"incident_date":"2014-02-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4004a3957f86","org_name":"Spirol International","org_type":"manufacturing","ransomware":null,"records_affected":70000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Details-of-70-000-Users-Leaked-by-Hackers-From-Systems-of-SPIROL-International-428669.shtml"}],"summary":"Hackers stole email addresses, usernames, passwords of users/customers and posted online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"affd5f4b3421f1f7be580e0a57fd286beaa42f6d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D431BA39-A3DF-4728-96BE-5288402882B8"},"incident_date":"2014-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9293d993448","org_name":"Seton Northwest Hospital","org_type":"healthcare","ransomware":null,"records_affected":180,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxaustin.com/story/25372824/computer-containing-patient-data-stolen-from-seton"}],"summary":"A computer-like device was stolen from Seton Northwest Hospital. Now two months later, nearly 180 patients possibly affected are just finding out. One of them came to FOX 7 for help.  It was inside a locked storage area at Seton Northwest Hospital where a device was stolen.  We'r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c49ae6b9931d9bb8f94db436c883c7654837f9e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F35A3BF5-CFFA-403A-BE67-AA674907F441"},"incident_date":"2014-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"d4d4d1301240","org_name":"Queen Elizabeth Hospital","org_type":"healthcare","ransomware":null,"records_affected":92,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cso.com.au/article/539192/hk_hospital_worker_mum_patient_data_loss_till_3_days_later/"}],"summary":"Employee lost a USB flash disk containing patient records in a secure location. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63d860059465fe0bfbc17ae9d9bc3b7492fa2091","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D73DAE3-B143-41B1-9DCF-8A5F478A6588"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e0bdd925fe8","org_name":"Oregon Secretary of State","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/politics/index.ssf/2014/04/oregon_secretary_of_state_webs_3.html"}],"summary":"Oregon Secretary of State website hacked by foreign entity.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8332054b0b3f5afff99048a151e97674817a2c2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D776443-6054-451D-80ED-8B7577938EF9"},"incident_date":"2014-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a37100960d3","org_name":"Medi Home Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc-7.com/story/25134018/patient-information-compromised-in-fort-myers#.UzxaNNx_nXU"}],"summary":"Patients in Fort Myers have had their personal information compromised. It's happened to two separate businesses; one was a physical theft and the other a digital compromise.  Monday, Florida Radiology Consultants asked the Lee County Sheriff's Office for help when it noticed a s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cb9bcf08f45f932ab9f7d2a09c0effd0045496b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6F921C8-9A6A-424A-841F-F1BCD0CCE5DF"},"incident_date":"2014-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"230227a98be8","org_name":"Los Angeles Department of Health","org_type":"government","ransomware":null,"records_affected":55900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.in/Theres-Been-A-Big-Breach-Of-Patient-Data-In-California/articleshow/32446985.cms;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/crime-law/dph-patients-personal-info-stolen-computer-theft/nfJQZ/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/health/article/Theft-of-computers-endangers-data-of-55-900-S-F-5339240.php"}],"summary":"The Social Security numbers and billing information of hundreds of thousands of patients in San Francisco and Los Angeles have been stolen after a break-in at a billing contractor.  The information was stored on computers that were stolen from Sutherland Healthcare Solutions in T","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9132179747e68c22d22cb5e649b83b6174a1f31a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BC1BDE8-6C8A-47E8-92BE-735F49C8D51C"},"incident_date":"2014-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc7c2ff05c97","org_name":"Indiana University","org_type":"education","ransomware":null,"records_affected":146000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://indianapublicmedia.org/news/data-breach-impacts-146000-iu-students-grads-63490/"}],"summary":"The names, social security numbers and addresses of 146,000 Indiana University students and recent graduates have been compromised in a data breach.  People across all seven campuses who attended IU from 2011-2014 are potentially at risk.  University officials say the problem was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":"Pakistan Haxors CREW","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b438434a70fc1587095b2deaf6545ae067909548","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37B47D8F-DBD2-489D-B159-7C9C3A960E7B"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"075eac70e6c0","org_name":"Indian Government Website","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/world-news/europe/iranian-hacker-uploads-dead-baby-image-onto-university-servers-30103901.html?utm_content=bufferc3f7c&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pakistanhaxorscrew"}},{"actor":{"category":"external","country":"UA","motive":"unknown","name":"Svoboda","variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859e325576bdfc3d6559e9c507b2ca1ea5672801","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3ADF169-744F-4470-BFBA-3D140042B800"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"c439548dadbe","org_name":"Government of Ukraine Websites","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/ukrainian-government-websites-hacked-by-new-nazi-hackers/"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"svoboda"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97502e5b0534c52877a17be608e6ed4c3dbeb93e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A90CFAA-F288-4CBA-9133-6998A318307D"},"incident_date":"2014-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0efdb91c0e51","org_name":"Goodsons Law Firm Charlotte NC","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3501017/cryptolocker-scrambles-us-law-firms-entire-cache-of-legal-files/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/news/local/computer-virus-locking-important-files-targets-loc/ndF4Z/"}],"summary":"Cryptolocker infection at a small law office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aff66987d13fdf48fe4d34f022bc4a8be338dfd0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5632AB3-4BC7-4F5E-9AF6-83CB349ABD54"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"2df48657c541","org_name":"Energie Steiermark","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Systems-of-Austrian-Energy-Provider-Energie-Steiermark-Hacked-428187.shtml"}],"summary":"According to a notice published on the companys website on Wednesday, its uncertain who is behind the attack. Their motives are also not known at this point, but the most likely scenario is that theyve been looking for some information they could monetize.   The cybercriminals ha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ee550afde3c698f7967a3aeec51922701fc7fec","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"298285BA-7F14-452E-A5D1-B8FB6B02AD03"},"incident_date":"2014-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"802576fc55ff","org_name":"Elizabethton City School System","org_type":"education","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.johnsoncitypress.com/article/118907/personal-records-of-all-elizabethton-students-accidentally-emailed-to-parent"}],"summary":"The Johnson City School System faced a similar situation in February when the wrong personal information cards were inadvertently sent home with Woodland Elementary School students. Debra Bentley, the systems supervisor of instruction and communication, said some students in six ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"299010b4a74bad785561ae6797e061638b45ca46","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2176C88-8511-404B-8342-369FBF8C5236"},"incident_date":"2014-02-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b1622c2a0a4","org_name":"eBay Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":145000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.alertlogic.com/the-ebay-breach-in-review/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/02/ebay-and-paypal-uk-domains-hacked-by.html"}],"summary":"Attackers use a combination of social engineer and stolen credentials to access eBay users data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25c60f363c8f1a0594b0009bfa3119b88b3390cf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3A68E68-0ABA-46AE-B153-1C2A21A5B180"},"incident_date":"2014-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c69d7732f41","org_name":"Dr. Samuel Kim","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://losangeles.cbslocal.com/2014/02/26/confidential-patient-records-from-local-dentists-office-found-dumped-in-apple-valley/"}],"summary":"confidential records thrown in the trash","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"045014967facc43601514b5bfce78e0149af0637","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FEAAF24-C1A9-4BD6-968B-2D12FB778A57"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82f3466668b5","org_name":"Comixology","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Access-ComiXology-Database-Users-Advised-to-Change-Passwords-430915.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hollywoodreporter.com/heat-vision/comixology-hacked-advises-users-retail-686548"}],"summary":"Unauthorized (and unknown) access to their user DB exposed user name, email and \"cryptographically protected\" passwords. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a411106f6d55456fddae74d2235bcd057fc818c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAA40F5A-6E1A-48EE-9E56-6D77EFD4FA2E"},"incident_date":"2014-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3adca0c21a6","org_name":"Blue Cross Blue Shield","org_type":"financial","ransomware":null,"records_affected":2546,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/additional-information-on-blue-cross-and-blue-shield-of-kansas-city-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-239343.pdf"}],"summary":"On April 22, I noted that HHS had added a report from Blue Cross And Blue Shield Of Kansas City (Blue KC), but that I had been unable to find any information on the unauthorized access/disclosure breach that reportedly affected 2,546.  It turns out that this was an insider breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f432569b63a62188eef144bca50fd7e18f25372b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38D440C8-5802-4880-BAA2-612B50D70B3F"},"incident_date":"2014-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75488ea2db5e","org_name":"Bennington VT Chamber of Commerce","org_type":"nonprofit","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3508499/cryptolocker-infection-forces-chamber-of-commerce-spend-5000-on-new-pcs"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reformer.com/morelocalnews/ci_25412333/bennington-chamber-loses-data-ransom-virus"}],"summary":"Bennington, VT Chamber of Commerce struck by Cryptolocker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"NullCrew","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ece08ac92a81acfd878546840ddd124da6b1e0f","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"CA","org_id":"560e58e28ebe","org_name":"Bell","org_type":"telecom","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Bell (2014 breach)","type":"hibp","url":"https://haveibeenpwned.com/Breach/Bell"}],"summary":"Bell reported a 2014 data breach attributed to NullCrew that exposed personal information, passwords, and credit card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"nullcrew"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Pinoy Anonymouz","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dd2f43efbd2735c570b50ffe60203eff5d40df0","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1E19C63-1F06-487B-AC1C-1C958AE78CB8"},"incident_date":"2014-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"b4966b7f37ae","org_name":"Ateneo de Manila University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Ateneo-de-Manila-University-Website-Hacked-and-Defaced-by-Pinoy-Anonymouz-423187.shtml"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pinoyanonymouz"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb5fe83095df773d9c414a62ec56b61dee929f8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87BBDFAF-06A0-48FB-B26A-2B4BFFCB9F26"},"incident_date":"2014-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c05a1d7177c6","org_name":"Advanced Care Hospitalists","org_type":"professional_services","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-press.com/story/news/investigations/melanie-payne/2014/06/20/tell-mel-security-breach-worries-fort-myers-woman/11026143/;http://www.phiprivacy.net/advanced-care-hospitalists-notifies-patients-of-breach-at-billing-vendor/"}],"summary":"As best as I can tell, a healthcare billing company sent patient records/billing info to the wrong processor (who processed the billing info).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14993f4f9f1c30825d657b0cbe30b39e96e5c729","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA3902D1-6146-4EFF-8149-6CFA1ED7E92F"},"incident_date":"2014-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a500583c5879","org_name":"PNC Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/news/adminpage/5768047-74/pnc-daly-lawsuit"}],"summary":" A former senior vice president of PNC Bank's Palm Beach, Fla., office used her cellphone to snap pictures of her computer screen hours before she resigned to take a job with a competitor, the Pittsburgh-based bank claims in a federal lawsuit filed on Friday.  PNC Bank and PNC Fi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7521b56c5b24dc9f1f6f75f71dd40c54dac079a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4462949-34D4-4486-ACC8-29CD984F429F"},"incident_date":"2014-01-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfeab5c3cb74","org_name":"Michigan Department of Community Health (MDCH)","org_type":"government","ransomware":null,"records_affected":2595,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.michigan.gov/mdch/0,4612,7-132-63157_64754-325431--,00.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytribune.com/general-news/20140403/security-breach-reported-in-records-of-michigan-long-term-care;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/michigan-department-of-community-health-notifying-2595-individuals-of-breach/"}],"summary":"The Michigan Department of Community Health (MDCH) recently became aware of a breach of protected health information under the Health Insurance Portability and Accountability Act (HIPAA) and is notifying 2,595 individuals and the Department of Health and Human Services regarding ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"523e694a96cc66518d470ad0ae9e204cb7b71f1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FBC1667-BD53-402C-A8DE-1ED725619DB2"},"incident_date":"2014-01-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab18052ed217","org_name":"Clinkle","org_type":"professional_services","ransomware":null,"records_affected":33,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2014/01/30/clinkle-gets-hacked-before-it-even-launches/?ncid=twittersocialshare"},{"fetched_at":null,"title":null,"type":"press","url":"http://valleywag.gawker.com/startup-gets-hacked-reveals-child-ceo-posing-with-cash-1513142187"}],"summary":"Clinkle Gets Hacked Before It Even Launches. Attacker misuses the autocomplete function of the app to get data about all users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"783a6710c363f699b8e3977fa58199fc132621f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E19FBC94-3F2D-4E04-95B8-672BD5384F87"},"incident_date":"2014-01-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"financial","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/california/manhattanbeach/accused-atm-skimmers-plead-not-guilty"}],"summary":"Accused ATM Skimmers Plead Not Guilty The two allegedly left the skimming device on an ATM at a Chase bank branch in Manhattan Beach Saturday and returned later the same night to retrieve it, authorities said.  Two Los Angeles men accused of placing a skimming device on a bank AT","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2014-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10184343d09ce65dc2579af2d8703ff365581503","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2014-01-13","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bring%20It%20to%20Me%20-%20Notificaton%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"33365b3d7b3e","org_name":"Bring It To Me, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43944"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bring%20It%20to%20Me%20-%20Notificaton%20Letter_0.pdf"}],"summary":"Bring It To Me, LLC notified customers that unauthorized modifications to its online ordering provider’s software may have exposed payment card information.","supporting_quote":"Our online ordering software provider, Big Tree Solutions, recently informed us that they identified unauthorized modifications in their software","technology_involved":["online ordering software"],"third_party":{"archetype":"vendor_product","involved":true,"vendor":"Big Tree Solutions"},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"vendors":[{"id":"b499d3172b27","name":"Big Tree Solutions"}]}},{"actor":{"category":"external","country":"PK","motive":"unknown","name":"ZHC","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b126abc050f07c4ae8bb12bd162b50a132bfe74","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2AAA5380-1AAF-417B-9434-C9CF61D5063A"},"incident_date":"2014-01-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"e163799c58f1","org_name":"TeaM Madleets","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/01/team-madleets-wesbite-hacked-by.html#sthash.vKsnqa4a.dpuf"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"zhc"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1529a77fc35527c5ce496f715e3b0c65962c006b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D06A24B-DAB5-4239-8288-6B9E8F0547B5"},"incident_date":"2014-01-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FI","org_id":"ed825d53f7ff","org_name":"Rovio","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/01/angry-birds-website-defaced-following-reports-it-enables-government-spying/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itworld.com/security/402392/hackers-deface-angry-birds-website-following-nsa-spying-claims?page=0,0"}],"summary":"The official site for Angry Birds was defaced in response to allegations that government agencies use data mined from the mobile gaming application. The website was not comproised, but the DNS was hijacked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"NZ","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3df1fbe345ba6816d5f6c04328fe2f3d78593245","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECEFF3C5-1A56-4EF0-9334-8AD1314FF476"},"incident_date":"2014-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"cf39d174cd75","org_name":"Whaleoil (Cameron Slater)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationalmortgagenews.com/news/technology/ellie-mae-confirms-denial-of-service-attack-caused-outage-1041487-1.html"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"601dc3646db1926660a47886b2b670ef668f6259","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D81B53F-5F5C-4AEB-98B9-367B18AD33D9"},"incident_date":"2014-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b944b13d5c9","org_name":"Whaleoil","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ddosattacks.net/whaleoil-down-due-to-ddos-attack/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8d002377b75f6a7b705f137183325c6ec502ab7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CEO%20Letter%20-%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"a44a6f85faa6","org_name":"Michaels Stores, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CEO%20Letter%20-%20FINAL_0.pdf"}],"summary":"Michaels reported possible fraudulent activity on payment cards used at its stores and said it was investigating a potential data security attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d4163cb79e12f4a6154883a74586864249484e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52F008F1-E8F2-4A99-9D8A-F1239077DE23"},"incident_date":"2014-01-27","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5e2e25cddbe","org_name":"Franciscan Medical Group","org_type":"healthcare","ransomware":null,"records_affected":11946,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2014/03/31/3126217/phishing-e-mails-net-medical-records.html?sp=/99/261/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/medical-staffers-fall-for-phishing-emails-data-on-8300-compromised/article/340590/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedenverchannel.com/news/front-range/englewood/privacy-breach-involving-englewood-health-organization"}],"summary":" Tacomas Franciscan Health System is notifying some 8,300 patients that their personal information  including in some cases medical records and Social Security numbers  may have been shared with computer scammers who accessed staff email accounts.  Franciscan estimates more than ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7567b48cbeac378babc8b6d73b9ead1c39b99f07","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/neiman%20notice%20only%20CA%20AG%20PDF_0_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"53dd66944572","org_name":"Neiman Marcus Group","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43881"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6748bf34f690a07db8974ada6e8e82002cb91310","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F3704A1-771D-4E77-9B71-2C76DA743381"},"incident_date":"2014-01-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eafae74eee01","org_name":"Martin Memorial Health Systems, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/network-glitch-brings-down-epic-emr?topic=08,17,19"}],"summary":"Hardware failure results in medical record systems for 13 facilities to suffer a 2-day availability loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"789f87f95e0c24366584f120129c28e73bb752dd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B6D006F-BE4B-4240-B011-226DB23247E5"},"incident_date":"2014-01-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"0e9f335c7c68","org_name":"Google Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://googleblog.blogspot.fr/2014/01/todays-outage-for-several-google.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2014/01/24/gmail-goes-down-across-the-world/"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/information-technology/2012/12/why-gmail-went-down-google-misconfigured-chromes-sync-server/"}],"summary":"Misconfiguration of load balancing servers caused a 25 minute outage for Google services.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bee1737500939764fd00b93126e9518f454005b4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5085366-AC6A-4F1A-95F8-48A151895D45"},"incident_date":"2014-01-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45b47ded405c","org_name":"MIDLAND INDEPENDENT SCHOOL DISTRICT","org_type":"education","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcdfw.com/news/local/Security-Breach-Compromises-Midland-Student-Info-243433801.html"}],"summary":"Laptop stolen from person's car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal","medical"],"disclosed_date":"2014-01-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5978cca0b40f515c363777795b7fdfbc0bebfcd6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2532904F-F4E0-47C7-BF92-3253CE310573"},"incident_date":"2014-01-23","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"dbb104e26f84","org_name":"Baylor Health Care System","org_type":"other","ransomware":null,"records_affected":5542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-breaches-reported-by-baylor/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-breaches-reported-by-baylor/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/tx-baylor-regional-medical-center-at-plano-notifies-patients-after-physicians-fall-for-phishing-attempt/"}],"summary":"Article covers phishing attack that affected multiple locations and an incident involving Misuse. This is modeling the phishing campaign. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"LulzSec","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96f6c8a963efed594b1132fb934ff2e9f5b388f4","impact_type":"data_theft","imported_from":null,"incident_date":"2011-06-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5efb2d7d35e1","org_name":"Battlefield Heroes","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Battlefield Heroes","type":"hibp","url":"https://haveibeenpwned.com/Breach/BattlefieldHeroes"}],"summary":"LulzSec obtained and released usernames and passwords from Battlefield Heroes.","supporting_quote":null,"technology_involved":["Battlefield Heroes"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"lulzsec"}},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9068215db5781ec3e9f87158c1bfbf82a51bc73","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B0AC644-05EA-49BE-9321-7EC4AE86C76F"},"incident_date":"2014-01-17","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"33d9591bbe6b","org_name":"Snecma","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.yahoo.com/exclusive-france-39-snecma-targeted-hackers-researcher-202729022--sector.html"}],"summary":"MSIE vulneability exploited via drive by.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0607fa1380d25d09d6eb9eca32feed9c21069014","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8C9B3C0-4B94-4353-A7C7-D7776226B4F4"},"incident_date":"2014-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"295e67665987","org_name":"Iowa Department of Human Services","org_type":"government","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcrg.com/news/local/Iowa-DHS-Medicaid-Records-Sent-to-Wrong-Clinic-256787431.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/iowa-dhs-data-breach-dates-back-2008-more-than-2000-impacted/article/337493/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dhs.state.ia.us/uploads/PR_Data_Breach_2-7-14.pdf"}],"summary":" Iowa officials say personal information from more than 800 Medicaid clients was accidentally mailed to the wrong health clinic.  Iowa Medicaid Enterprise, a division of the state Department of Human Services, says Friday the error occurred during the mailing process. Patient lis","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc4b18474dcc4ee75513463a05209ec84485cce9","impact_type":"unknown","incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EBSports%20Notification%20Letter%20Including%20California_0.pdf"},"notes":null,"org_country":"US","org_id":"99d1a106b7e4","org_name":"Easton-Bell Sports, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43834"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EBSports%20Notification%20Letter%20Including%20California_0.pdf"}],"summary":"Easton-Bell Sports sent a consumer notification letter about a security incident, but the provided excerpt does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59b5c68fd7f770dcd5e4b5096befafeda7e31fc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79CC2E92-66EB-4B5B-9D75-7087289BE2F6"},"incident_date":"2014-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"6a39b45b0f15","org_name":"Orange","org_type":"technology_saas","ransomware":null,"records_affected":800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/02/800000-customer-details-stolen-in-data_2.html"}],"summary":"Actor gained access to a website run by French telecom company Orange and made off with 800000 authentication records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f06cb67c504315373cb0ff35c67f261d94520ebb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94460E47-5820-4AD6-8B1C-94080918F132"},"incident_date":"2014-01-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6da0c0b0209","org_name":"University of New Mexico Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/roswell-shooters-medical-privacy-violated-lawsuit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abqjournal.com/485352/news/shooters-records-improperly-accessed.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krqe.com/2014/10/24/school-shooter-sues-hospital-for-record-breach/"}],"summary":"Hospital employees access medical data of infamous patient and were not involved in his treatment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-13","discovered_date":"2013-09-09","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3172d671be2a6d0ba29f9416754190fdf901c347","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20Exhibit%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"206032b8f805","org_name":"Update Legal","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43785"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Exhibit%20A_0.pdf"}],"summary":"Update Legal reported that photos of I-9 forms from a filing cabinet were found on a smartphone and that the information in the forms may have been viewed.","supporting_quote":null,"technology_involved":["smartphone"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"421885774c0dd05605eb01e497970559ec719d5a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BEDE02B-16F8-46C9-AF14-747E896C36D3"},"incident_date":"2014-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California, San Francisco","org_type":"education","ransomware":null,"records_affected":9986,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ucsf.edu/news/2014/03/112556/computer-theft-uc-san-francisco"}],"summary":"UC San Francisco has (another) unencrypted laptop stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85940a2cd660a166de7beeb084056622ac81f6e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D349D62-8E7C-4041-B602-D60ADF5765B1"},"incident_date":"2014-01-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c084a01df14","org_name":"Taco Bell Corp.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://woodtv.com/2014/01/23/credit-card-number-stolen-at-taco-bell/"}],"summary":"Employee steals customer credit card and makes unauthorized purchases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d215607424423ab644008bbb0e0a61323b3b886d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37509C2A-6998-4C25-9AC7-4858EE0DC463"},"incident_date":"2014-01-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"238e87cdd9ba","org_name":"Sims and Associates Podiatry","org_type":"healthcare","ransomware":null,"records_affected":6475,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/three-laptops-stolen-from-new-york-podiatry-office-6475-at-risk/article/343644/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://simsandassociatespodiatry.com/wp-content/uploads/2014/03/Web_Notification_Sims_Podiatry.pdf"}],"summary":"Nearly 6,500 patients of Sims and Associates Podiatry may have had personal information  including Social Security numbers  compromised after three laptops containing the patient data were stolen from the New York office.  How many victims? 6,475, according to HHS.gov.   What typ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df16e7d767d897135fd59f17916549b0c9a42d73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39960CF8-C4E3-4064-B144-E4220302FE49"},"incident_date":"2014-01-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84d9809725d9","org_name":"Hasbro Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hasbro-s-Website-Hacked-Abused-for-Malware-Distribution-420884.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://barracudalabs.com/2014/01/hasbro-com-toys-games-and-malware-for-boys-and-girls/?utm_source=twitterfeed&utm_medium=twitter"}],"summary":"The website was found to push malicious software on numerous occasions, including on January 10, 11, 14 and 20. Visitors of the site are taken, via multiple redirects, to a site that serves several Java exploits. If the exploits are successful  meaning that a Java vulnerability i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29389a0532120202471a5df235da455d1ce9a61f","impact_type":"data_theft","incident_date":"2013-12-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Straight_Dope_E-mail_Notice_to_Affected_Users_0.pdf"},"notes":null,"org_country":"US","org_id":"1d56d056c03a","org_name":"Straight Dope LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43757"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Straight_Dope_E-mail_Notice_to_Affected_Users_0.pdf"}],"summary":"Straight Dope reported that its message board forum was hacked and users' usernames, email addresses, and passwords were acquired.","supporting_quote":null,"technology_involved":["Straight Dope message board forum"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"ID","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c584f278beaba98f5761985e2ee0b9918f8b7f2f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05449222-6D97-4F2F-9D69-D7C883B6CDC3"},"incident_date":"2014-01-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AL","org_id":"e16aa7c49b04","org_name":"Government of Albania","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Two-Albanian-Government-Websites-Defaced-by-Indonesian-Hacker-415474.shtml"}],"summary":"2 governmental websites defaced by unaffiliated external actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0266c2fd3f40235465ca950b112af9e49fa1acef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A229A7EF-D7CA-44C8-BB86-2F7063525110"},"incident_date":"2014-01-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a975ee0513ff","org_name":"UMass Memorial Health Care","org_type":"healthcare","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegram.com/article/20150130/NEWS/301309587/1116;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lowellsun.com/news/ci_27432048/data-breach-probed-at-worcester-medical-group"}],"summary":"The UMass Memorial Medical Group said Friday it is working with law enforcement after a former employee allegedly accessed thousands of patient billing records that contained credit card and debit card information, Social Security numbers, dates of birth and medical record number","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ebe4fbe7202cb8b0af2ae74897f20b58ae7aaa9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08C57E01-8CC1-43E4-9195-C06F1FC9A9A9"},"incident_date":"2014-01-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3cfdedf964d","org_name":"Steam, Origin, Battle.net, and League of Legends","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/01/dos-attacks-that-took-down-big-game-sites-abused-webs-time-synch-protocol/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6225c075147df1f529656e3e1fc5e4b4aa21c49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"524CDEAE-468F-403F-B07C-9670AB76CD03"},"incident_date":"2014-01-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec2d71ec2a59","org_name":"Valve Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/01/06/online_gaming_ddos_spate/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/NTP-Protocol-Abused-in-DDOS-Attacks-on-Gaming-Servers-415059.shtml"}],"summary":"Valve's online gaming platform Steam was hit by a DDoS attacks over the weekend. An assault by a crew calling themselves DerpTrolling left EA Origin's online systems intermittently unavailable for around 24 hours","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"655a5377f2b5cdf650a724df18bea90a1f99d685","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2375D260-0725-4D77-8AC8-FEBA6ADDF934"},"incident_date":"2014-01-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65626c282223","org_name":"Sioux Falls Fire Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.argusleader.com/story/news/city/2014/09/17/ex-fire-division-chief-charged-hacking-documents/15805819/"}],"summary":"firefighter accessed something he wasnt' supposed to but there are no details on how that happened","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"011e01d656cfbeefa55727511765672e86a44a5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58701CE8-27D2-4453-887A-DA8A7E6E6078"},"incident_date":"2014-01-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b4ed321df40","org_name":"Illinois State Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wls/story?section=news/iteam&id=9461309"}],"summary":" The ABC7 I-Team has learned some people who applied for Illinois concealed carry gun permits are being notified of a computer glitch that may have allowed other applicants to see their personal information.  State police tell the I-Team the problem happened on the first day that","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a48324366ec8b26f1f30ff078b63c07d9b1bd130","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25D63703-1657-42E6-A1CE-DEF68166AD66"},"incident_date":"2014-01-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"314ea2ef408b","org_name":"Electronic Arts Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/01/06/online_gaming_ddos_spate/"}],"summary":"Electronic Arts' Origin were hit by separate DDoS attacks over the weekend.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e837245c90c1b72b809f6d451cd87d535120517a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF8CD58E-7F61-4DC8-B3C0-815D83CBA4F4"},"incident_date":"2014-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4d66f9d89342","org_name":"Fasthosts","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/01/06/fasthosts_weekend_outage/"}],"summary":"Storm-realted outage affects UK hosting organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b62ba490175c2bf90b3a563100cdb15bfa0233c7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"438607BB-8961-417E-B895-F68F9A396569"},"incident_date":"2014-01-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e0324ac9a1e","org_name":"Pentagon Force Protection Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.defenseone.com/technology/2014/05/pentagon-police-hit-catastrophic-network-outage/83944/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/media/gbc/docs/pdfs_edit/050614bb1.pdf"}],"summary":"Failure of a unidentified legacy device caused network outage for Pentagon Police ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2014-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b44bf57491eda00435f3ae9cbde2bced93556b3","impact_type":"data_theft","incident_date":"2013-11-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Target%20Letter%20NotificationLetter_Credit_1.2.14_Final_0.pdf"},"notes":null,"org_country":"US","org_id":"aeee36a6330a","org_name":"East West Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43690"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Target%20Letter%20NotificationLetter_Credit_1.2.14_Final_0.pdf"}],"summary":"East West Bank notified a customer that their card had been used at a Target store during a period when Target experienced unauthorized access to payment card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4eef2c5c5c01d00fe1e05be2e77a5c9bcb3550f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E92936F6-A899-4CB1-8F38-0F7C623D1E62"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"bc37754e1803","org_name":"Zilveren Kruis","org_type":"financial","ransomware":null,"records_affected":2643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dutchnews.nl/news/archives/2014/11/health_insurance_company_botch.php#sthash.VA7ru5o6.dpuf"}],"summary":"Tuesday 04 November 2014 Health insurance company Zilveren Kruis has apologised to policyholders after sending them a survey about their hospital treatment using the details of another patient. The mistake meant policyholders received a form containing the initials and surname, h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b76679cac8084182069bbd664c9aa8ee94cb713","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"229d4a70-027a-11e9-aee0-f7420d4f3238"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99fb488dda29","org_name":"ZeniMax","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/facebooks-oculus-ordered-to-pay-500-million-to-zenimax/"}],"summary":"Facebook must pay $500 million to ZeniMax, a Dallas, Texas-based jury ordered on Wednesday.  The jury found that Oculus co-founder Palmer Luckey failed to comply with a non-disclosure agreement. In 2014, ZeniMax alleged Oculus and Facebook of \"misappropriating\" trade secrets and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c76977ef73ddb9a0bc504de30c6c1073d695400","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C7D9315-68D2-417D-BFB9-F00F1A584EE7"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2168fa59100f","org_name":"Zendesk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tgdaily.com/security-brief/69686-twitter-tumblr-and-pinterest-users-hit-by-data-breach"}],"summary":"Data on an unknown number of Twitter, Tumblr and Pinterest users is at risk after customer service software provider Zendesk was hacked. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca327a910652e2411716fa513acea6aa65a88807","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9D0E060-89A3-4F69-B264-C9AF8D24EFC8"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c684e8b26bf6","org_name":"Ysgol Sant Dunawd School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-wales-north-east-wales-28311301"}],"summary":"Ysgol Sant Dunawd, Bangor on Dee, confirmed an external hard drive has gone missing. Head teacher Sara Tate said the device is encrypted, files are password-protected, and an inquiry concluded the drive was probably still on-site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1afd565bce7d35d83acbbabb7f69f148659b6d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F29D5AD5-2A91-4FFC-A529-36B595EF9AC0"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b98df60fd12","org_name":"York Academy of Surgery","org_type":"healthcare","ransomware":null,"records_affected":47,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ydr.com/local/ci_25980746/private-medical-records-found-at-public-dumpster-manchester;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ydr.com/local/ci_25988934"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox43.com/2014/06/18/former-patients-concerned-after-private-medical-records-discovered-near-dumpster/#axzz36YPzgFnm"}],"summary":"Stanley Hill was dropping off some personal items at the York County Solid Waste Authority incinerator Memorial Day weekend when he noticed bundles of documents strewn across the ground and filling a nearby dumpster.  The Shrewsbury Township resident stopped to pick one up and fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"611ff2516a55b60c3b635bdd4da51d5e2a449751","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E34D0DA-F238-4398-8B1A-985D1ED6A50A"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6cd2440f60a","org_name":"Yakima Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kimatv.com/home/video/KIMA-asks-police-about-sensitive-record-security-after-recent-breach-264825911.html"}],"summary":"Former Police officer accessed files from open murder cases and internal investigations into other police officers without proper authorization or need to know.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"802862924595a64737d790dc54d599ec3d19e95f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"754bcb00-1488-11e9-9b0e-db2459a65ffe"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"efb471d077a9","org_name":"Wrexham Maelor Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.leaderlive.co.uk/news/17324190.health-service-employee-who-worked-at-wrexham-maelor-charged-with-40000-fraud/"}],"summary":"It is alleged that Neil Stephen Roberts, who worked at Wrexham Maelor Hospital, sold NHS laptops on eBay over a four year period.  Roberts is charged that between June 2013 and March last year that while occupying a position of trust as a desktop support technician, in which he w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d3351bf92bda2ee9ad163fa66e43922b19e23a8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50BCAD67-A423-4DF2-A0FE-991F7322546A"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"045bcc0ac2e8","org_name":"World Poker Tour Amateur Poker League","org_type":"other","ransomware":null,"records_affected":175000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Credentials-of-US-Government-Workers-Compromised-in-Poker-Site-Hack-413443.shtml"}],"summary":"A hacker that uses the online moniker smitt3nz claims to have breached the website of the World Poker Tour Amateur Poker League (wptapl.com).  Cyber War News reports that the email addresses and passwords of over 175,000 users have been published online by the hacker. Unfortunate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32be7a86ae66f291aca7d9cb979b4765653a1d3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADDCEC58-3F7C-4584-87A4-A8DBE90B0F0B"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"30d091192233","org_name":"WooThemes","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.woothemes.com/2014/05/important-info-for-woothemes-customers/"},{"fetched_at":null,"title":null,"type":"press","url":"http://ventureburn.com/2014/05/woothemes-hopes-security-breach-1-000-fraudulent-cases-will-make-it-even-stronger/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hotforsecurity.com/blog/woothemes-hacked-premium-wordpress-theme-manufacturer-warns-of-credit-card-leak-8578.html"}],"summary":"WooThemes notified of attack due to customer complaints of credit card fraud. The investigation has not revealed method of intrusion, but noted \"three modified files on its servers pointing towards an attack.\" WooThemes stresses that it does not store any credit card details and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"477fc163e90f10ada2ec59874cff2d025d27ed2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62293FE7-E0F4-4167-A49B-A22D3643B97B"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"edd1a40f9c2f","org_name":"Westpac Banking Corp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/waikato-times/10371517/Card-skimmers-hit-three-Waikato-towns"}],"summary":"Thieves have cleaned out potentially hundreds of Waikato people's bank accounts months after harvesting their details in a card skimming scam.  Matamata woman Tania O'Leary found over $400 had been taken from her bank account in recent days after a card skimming machine was belie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"671f7c2a613b6cf08622bb3de5915e7c6199796c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E68C118A-E10C-4351-B22F-E35E40820E30"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f6f0460f251","org_name":"Western Regional Center for Brain & Spine Surgery","org_type":"healthcare","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/insider-breach-at-las-vegas-brain-and-spine-surgery-center/article/364837/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wrcbss.com/wp-content/uploads/2014/07/wrletter.pdf"}],"summary":"In July, Las Vegas-based Western Regional Center for Brain & Spine Surgery (WRCBSS) began notifying patients that their personal information  including Social Security numbers  might have been stolen by a former employee and used for fraudulent purposes.  How many victims? 12,000","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c97a27e2e15fe51b196d86c8c9be82dd093a06cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8B2E146-A3C5-44ED-8C51-387F38C8D951"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9f16af6e688a","org_name":"West Herts Hospitals NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hertsad.co.uk/news/st_albans_cases_highlighted_by_probe_into_data_breaches_by_police_and_health_trust_1_3825602"}],"summary":"Meanwhile Samantha Jones, chief executive of West Herts Hospitals NHS Trust said staff had been informed of three information breaches.  She said: On two separate occasions, two members of staff sent staff data to their personal email address so they could work on it while out of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":"H4$N4!N H4XOR ","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c48068fb6d20158ca8ea5e487991fdf41a5de8a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4EEC65C6-B345-477B-9656-00360847F0BE"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"cad95cd1e1ee","org_name":"West Benagals public health engineering department","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/02/indian-public-health-engineering.html#sthash.uNHYXIiV.dpuf"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"h4$n4nh4xor"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56882a7b1d1ed977b1f2f6aee1057716b4f4a6d8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9167F761-16C2-4F5E-B1D4-E3BC43FFF8A5"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b189fc2199c","org_name":"WellPoint Affiliated Covered Entities","org_type":"financial","ransomware":null,"records_affected":1464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/a-few-more-recent-additions-to-hhss-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The WellPoint Affiliated Covered Entities in Indiana reported that 1,464 people were affected by a breach on April 1 that was coded as Unauthorized Access/Disclosure of paper records. Wellpoint did not respond to an email inquiry sent to them about the breach, so we dont know if ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"179c4e152b4ce5726c27593fc7648391650b2647","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3E40875-8BFF-49E9-B18C-1042EE1F97F0"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c36bd42d9e92","org_name":"Weill Cornell Medical College","org_type":"healthcare","ransomware":null,"records_affected":3936,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.idtheftcenter.org/images/breach/DataBreachReports_2014.pdf"}],"summary":"Laptop stolen with data from 3936 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"DK","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51ecd94b264446aa3401515b8246f03660283846","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41C7FDD4-8C28-4486-A622-1F80D99ABB40"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"e81df084717b","org_name":"Webdeveloper Ecommerce","org_type":"professional_services","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2017/01/17/police_warn_of_dutch_developer_who_built_backdoors_for_carding/"}],"summary":"Dutch police are this week warning 20,000 users that their email accounts were hacked after a malicious web developer left backdoors in the sites he built.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IL","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa788e651ec68ada14fdf0db929554e5e5cfc30f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10650166-6280-4477-9C8A-8669EF6EB295"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43db88d38ad0","org_name":"Waze","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.algemeiner.com/2014/04/01/israeli-students-hack-gps-app-waze-to-create-fake-traffic-jam/"}],"summary":"Israeli Students Hack GPS App Waze to Create Fake Traffic Jam. Created hundreds of fake accounts and then sent fake data to the service","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a15b8e79427e2efd29e275d57ab77c527b220c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F418DC1-E700-4D7D-8D11-0D62E4A859BA"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e17cd065ee5f","org_name":"Washington Department of Revenue","org_type":"government","ransomware":null,"records_affected":38,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.wa.gov/pressrelease.aspx?id=32152#.U57vO8e7lZx"}],"summary":"he Attorney Generals Office filed charges  late yesterday against a former Washington Department of Social and Health Services (DSHS) employee for allegedly using his access to confidential state databases to commit identity theft and steal more than $150,000 in unclaimed propert","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5a79dd0127671a2f9ef0ba6b3d4217826619884","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"101ED498-A0F3-4786-BC00-8F8454FA8B3B"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e066ae930ed","org_name":"Warren County Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bgdailynews.com/news/investigators-continue-work-on-data-breach/article_79821047-32a5-5942-b82e-7504b11a7b00.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbko.com/home/headlines/Student-Hacks-Public-School--279516992.html"}],"summary":"Student gained unauthorized access to employee and student PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92b9d37e2210bc5086e22a17ca539584e38387cf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57991851-E459-4801-AE79-C555DEE6EDFA"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"fc632aa1e91a","org_name":"Waikato Regional Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newstalkzb.co.nz/auckland/news/regun/1918013922-security-breach-at-waikato-regional-council"}],"summary":"Paper document stolen from persons home","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38b24638b892f7718d50af424beacf5fb301058f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79209CA2-C801-42CB-B683-19D1EC52303A"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4bae21dd3b97","org_name":"Vodafone Group PLC","org_type":"other","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dutchnews.nl/news/archives/2014/03/vodafone_blunders_by_publishin.php"},{"fetched_at":null,"title":"Have I Been Pwned: Vodafone","type":"hibp","url":"https://haveibeenpwned.com/Breach/Vodafone"}],"summary":"Phone firm Vodafone has admitted publishing the phone numbers and addresses of thousands of people who wanted to be ex-directory - by mistake.  The company blames both technical and human failings for the fact that over 90,000 numbers have been inclued in paper and electronic pho","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4c175cdd28a9fc060cdba91f9357f11315f52af","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF222A57-5B8D-4739-9C10-D52A27797232"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fe1a55f5bd9","org_name":"Viator","org_type":"other","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/travel-site-breach-impacts-14-million-a-7342;http://www.net-security.org/secworld.php?id=17391;http://www.infosecurity-magazine.com/news/viator-data-breach-hits-14-million/"}],"summary":"Someone broke into Viator but there are no details as to how it happened","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4669ed9cb6cd0bf18079064f4776884d016faed","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6CC356A-CB4F-4F98-B641-37CBA5934BBF"},"incident_date":"2014-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c129d9e6cbc","org_name":"Valley View Hospital Association","org_type":"healthcare","ransomware":null,"records_affected":5400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vvh.org/pages-pdfs/ComputerVirus.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/co-valley-view-hospital-hacked-5400-patients-affected/"}],"summary":"Hospital discovered a system infected with malware. The investigation revealed the virus had captured screen shots of Internet web pages and stored these images in an encrypted, hidden folder on the Valley View Hospital system. This folder could have been accessed by an outside e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a5568443d0570cb823eeb1ad98cd62b1d280a06","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"894F4346-30C1-4C5C-9822-90CC3901DA1B"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9c479dc0933","org_name":"Uxbridge public schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegram.com/article/20140624/NEWS/306249589/1116"}],"summary":"Stolen laptop from car had student information on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfd37cf797da17af854b9ab0ef7815eca928f9a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"373A43F4-E656-48F5-BF18-DAC041BECFFC"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba98921702db","org_name":"USIS US Investigative Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.usis.com/Media-Release-Detail.aspx?dpid=151;http://www.esecurityplanet.com/network-security/breach-at-usis-exposes-government-employees-data.html;http://www.washingtonpost.com/world/national-security/dhs-contractor-suffers-major-computer-breach-officials-say/2014/08/06/8ed131b4-1d89-11e4-ae54-0cfe1f974f8a_story.html"}],"summary":"State sponsored attackers breach a company that provides background checks to the US Government.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18a02b355936b9fca3869ec100a09c24d471d8e1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96940160-fb23-11e9-ac31-5797fdf8a397"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"082218617878","org_name":"US Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.theherald-news.com/2018/11/30/joliet-tax-preparation-business-owner-convicted-of-identity-theft-in-2016/aoicl04/"}],"summary":"tax preparer committed identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d52c8a9b578d94b84415d037b6d7edf97b2bb06e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B4A1564-CB5F-4D97-B876-94E14E813F2C"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ce68eeae090","org_name":"US Army, 14th Combat Support Hospital","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/former-fort-benning-hospital-employee-steals-military-ids-to-commit-tax-refund-fraud-indictment/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/fort-benning-employee-allegedly-steals-military-identities-commit-multi-million-dollar-tax"}],"summary":"Tracy Mitchell, a resident of Phenix City, Ala., was indicted for her involvement in a stolen identity refund fraud scheme, Assistant Attorney General Kathryn Keneally of the Justice Department's Tax Division and U.S. Attorney George L. Beck Jr. for the Middle District of Alabama","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4680703060c8fc3b6896c5e28df33f4c7bbbc0c4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1010A34-343D-4299-993C-B1A261A707A5"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ebc2fcfa651c","org_name":"UPC Polaska","org_type":"technology_saas","ransomware":null,"records_affected":36,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.broadbandtvnews.com/2014/03/26/data-breach-at-upc-polska/"}],"summary":"Personal details of UPC Polska subscribers have been made offered for sale online by hackers.  In a statement, the Polish operator says its security experts have now blocked access to the information and are monitoring the situation.  It adds that access to the details would have","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a309304547552a9fbaa5d61aaf4d437557efc31b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D82EBB1-7303-47BE-AB63-20EBF72324CB"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35806e544b34","org_name":"University of Pittsburgh Medical Center (UPMC)","org_type":"financial","ransomware":null,"records_affected":62000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/business/headlines/6201904-74/upmc-employees-email#axzz33rxtpWIS"}],"summary":"Breach (without details), \"exposed Social Security numbers, addresses, salaries and bank account information to identity thieves has widened to potentially include all of its 62,000 workers\".  There has been confirmed identity theft, fraudulent tax returns.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"846fd5e4b369942b1bfa66d62846a0ec33bc91fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F261A108-E745-47B0-8963-C619FB25B803"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6f847aa765e","org_name":"University of Pittsburgh Medical Center","org_type":"healthcare","ransomware":null,"records_affected":27000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/news/adminpage/5717110-74/employees-upmc-theft#axzz2v7nV2USp"}],"summary":"There has been a breach at UPMC but the source is not clear. Unknown actor, Unknown action. Number of records is up and there is known identity theft involving several hundred employees. Originally thought to affect 300 employees, number is now estimated at 27,000.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7be54c3ef8f836816b73d1a61c2652260a610eb6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD49A521-FBD7-430F-9FE5-EEA0C7951BAD"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"192ad82e443d","org_name":"University of Cincinnati Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcaredive.com/news/feds-investigate-embarrassing-hipaa-breach-in-cincinnati/279023/?utm_medium=email&utm_campaign=Healthcare+Dive+created+2014-06-25+105610412219&utm_content=Healthcare+Dive+created+2014-06-25+105610412219+CID_395de659269e923e22ccd0040987a9d0&utm_source=campaignmonitor&utm_term=Feds%20investigate%20embarrassing%20HIPAA%20breach%20in%20Cincinnati;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcaredive.com/news/feds-investigate-embarrassing-hipaa-breach-in-cincinnati/279023/?utm_medium=email&utm_campaign=Healthcare+Dive+created+2014-06-25+105610412219&utm_content=Healthcare+Dive+created+2014-06-25+105610412219+CID_395de659269e923e22ccd0040987a9d0&utm_source=campaignmonitor&utm_term=Feds%20investigate%20embarrassing%20HIPAA%20breach%20in%20Cincinnati"}],"summary":"The U.S. Department of Health & Human Services has launched a federal probe into HIPAA privacy violations at the University of Cincinnati Medical Center, according to an HHS spokesperson.  The investigation stems from when a financial services employee of the hospital accessed th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a1114ae299bb244c6696fb8575c4586ea357d18","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A21ED145-362D-4E77-8ECE-956E6DF8BA42"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e8c45d5b7f3a","org_name":"University Medical Center Groningen","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nltimes.nl/2015/01/15/patient-records-stolen-groningen-hospital/"}],"summary":"Medical records from the University Medical Center Groningen (UMCG) that were supposed to be destroyed, ended up in the spotlight on regional broadcaster RTV Noord. The program shows the workers of the employment company Synergon handling old x-rays carelessly. Synergon has repor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2466c13bfdf1f2c07ef8b064e02f4f37119c710","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"508E2680-75C4-440F-8116-9803477056E0"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"7997efedd79f","org_name":"University Malaya Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":46000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/my-46000-medical-images-lost-by-contractor-for-university-malaya-medical-centre/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesundaily.my/news/948355"}],"summary":"Some 46,000 electronic images of X-rays and scans of patients at University Malaya Medical Centre (UMMC) have been lost during a migration process from the old computer system to a new one.  As a result, some patients may be left in the lurch as their old medical information dati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0096b2ce0deac9865a4ebd411aab8d28748a4e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"897D05E7-0F6C-406F-9E62-C90F20E7FEA1"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"5fc1acd65902","org_name":"University Hospital of Lausanne","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/sport/2014/jul/07/michael-schumacher-police-target-swiss-helicopter-firm-medical-records;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/world/2014/jun/24/europe-news-michael-schumacher"}],"summary":"French authorities have tracked down the IP address of the computer used by the alleged thief of Michael Schumacher's medical records, prosecutors said on Monday, locating it in the offices of a Swiss helicopter firm that had reportedly been due to transport the Formula One champ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e03cc6f3932669e0272b00dad1511b777497a98","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1993D926-E8E5-4B7F-B688-4E0A44571556"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4f378ba89a7","org_name":"United States Sentencing Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/United-States-Sentencing-Commission-Hacked-by-Anonymous-Video-324313.shtml"}],"summary":"Anonymous hacktivists have initiated a campaign called OpLastResort, a new operation that comes in response to the death of Reddit co-founder Aaron Swartz.   The first target of this operation is the website of the United States Sentencing Commission (ussc.gov), which the hackers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e9b56fc39e25bd3cde5b7509745d729bd3281ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D59C6713-6F68-4817-95E5-5237D1A77647"},"incident_date":"2014-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed8c1aacc480","org_name":"United States Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://time.com/3575963/usps-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/blogs/federal-eye/wp/2014/11/10/china-suspected-of-breaching-u-s-postal-service-computer-networks/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2014/11/10/us-cybersecurity-usps-idUSKCN0IU1P420141110?feedType=RSS&feedName=technologyNews;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/11/all-us-postal-service-employees-personal-data-exposed-by-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fedscoop.com/usps-cyber-breach-agency-halts-teleworking-union-files-charges-nlrb/;"}],"summary":"USPS attacked via VPN connections by state-affiliated threat actor. 800,000 employee PII records are considered compromised. Limited details to date on methods utilized.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce261c565daa03f0afa95f8cc37781d49451203b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32E01565-88B0-4729-B60B-7F2DF283D53E"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76cd13395ff1","org_name":"United States Department of Defence","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/politics/blog/bal-defense-secretary-russians-hacked-defense-department-networks-20150423-story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2015/04/26/us/russian-hackers-read-obamas-unclassified-emails-officials-say.html?_r=0"}],"summary":"Russian hackers infiltrated State Department and DoD servers and gained access unclassifed networks and to Pres. Obama's email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2abe8741a1ebd882a86627326e7f08e48d9d7c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A9DD279-9F16-44CE-B932-8A40F18FE811"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c08deb919e22","org_name":"United States Army","org_type":"government","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2014/jul/24/army-patient-ids-wrongly-trashed-at-ala-base/"}],"summary":"The military says as many as 2,300 patients are affected by a breach of personal information at the Lyster Army Health Clinic at Fort Rucker.  Paper records with the names and Social Security numbers of patients were tossed into a recycling bin at the southeast Alabama base on Ju","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ae62af41541427cbb3a401c760a13438eb398e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F57AB301-0D09-4AD2-82BA-5332EB6DAE6B"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad26d42eabe0","org_name":"UniHealth SOURCE","org_type":"healthcare","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/two-laptops-with-phi-stolen-from-uhs-pruitt-employees-cars-in-a-two-week-period/"}],"summary":"In the process of researching this breach, I discovered a press release from UHS-Pruitt that seemed to contradict the media notice above. Then I realized the press release was from a UHS-Pruitt affiliate, UniHealth SOURCE, and it was reporting a second breach that also involved a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1c59eb9cf4bb5989d11d44d151e3de395caf496","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4135A837-4B0A-4139-9218-E082262B84E7"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85c7eb66f327","org_name":"Ulysses Acquisitions Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-principal-in-28-3-million-medicare-fraud-scheme-sentenced-to-11-years-in-prison/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/opa/pr/disbarred-attorney-sentenced-prison-her-role-283-million-medicare-fraud-scheme"}],"summary":"Medicare fraud scheme ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eea815cedfb79220d7b105fbb82958e829d45eb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBCBFCDC-BA20-4ADA-B61A-BF9677435B96"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"1990c29927a1","org_name":"Ukrainian Government","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Disrupt-Ukrainian-Government-Websites-During-Kiev-Protests-405132.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46de667c7e760b41c753ee081b25eec2c87f752b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15B01A12-0FED-47E2-A97E-C12518C382E1"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"58acef3a0eba","org_name":"UK National Health Service","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/1679"}],"summary":"Partner uploads non-public data to Google servers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"295c72f2989aad08605830509c423a09ee8b5f06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"183A7B21-2DE8-4A8B-B829-0F1900ED96AE"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"f1b0e5befa8d","org_name":"Turkish Foreign Ministry","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hurriyetdailynews.com/turkish-foreign-ministry-bans-use-of-cell-phones-on-premises-after-leak.aspx?pageID=238&nid=64514&NewsCatID=338"}],"summary":"Classified meeting is recorded via cell phone and leaked to social media.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2d7d27c0903f97641fc3bafb609633393745f5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c2210820-1461-11eb-ac54-3bea5c26f172"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9cc55466a01e","org_name":"Turf & Needle","org_type":"retail_ecommerce","ransomware":null,"records_affected":236000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.azcentral.com/story/money/business/consumers/2019/12/03/report-tuft-needle-customer-data-exposed-internet/2595427001/"}],"summary":"Tuft & Needle accidentally exposed 236k customer data for four years on an unsecured server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb16c6ed5c955d0596a9fbda9ec922a61b212b6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0055CC7-23F7-43E5-9632-DEB29C4A74E9"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed62d3b716ff","org_name":"Tufts Health Plan","org_type":"financial","ransomware":null,"records_affected":8700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegram.com/article/20140424/NEWS/304249554/1116;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/business/2014/08/14/former-health-plan-employee-pleads-guilty-data-theft/YfM73nG1IRDwyZ3cl0MIuN/story.html"}],"summary":"Tufts Health Plan warned subscribers Thursday that personal information for about 8,830 seniors enrolled in the insurer's Medicare plan was stolen.   The Watertown-based organization said the theft included the names, birth dates and Social Security numbers of current and former ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b2884c69d443a62be93308198720e42b1b3275e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"406D61FF-C3C6-4EE1-B072-3749AB21D518"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"04aac3d6fcaf","org_name":"Trustmark Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxal.com/story/25506104/centreville-bank-manager-arrested-on-theft-charges"}],"summary":"Bank manager arrested for identity theft and fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1f772f772915f58b53b230b3bc2c8780d93dc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DCA0B0F-CF1F-4DA3-B233-F0C188A098A0"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"130455644dbf","org_name":"True Vision Eyecare","org_type":"retail_ecommerce","ransomware":null,"records_affected":542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lancastereaglegazette.com/story/news/local/2014/11/21/true-vision-eyecare-laptop-stolen/19358159/"}],"summary":"True Vision Eyecare experienced a theft on Oct. 3 which included a laptop computer containing some patient information.  The only individually identifiable information available on the stolen laptop was the first and last name and spectacle lens order of some of the patients who ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75a10f9f7475bfedf8c79dcbf2658122c6679e54","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F78A3B4-B9B7-40F3-B650-E60B1BC868AC"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9eb0edad0e8","org_name":"Tri-City Medical Center","org_type":"healthcare","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10news.com/news/security-breach-at-tri-city-medical-center-08162014;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/medical-records-of-6000-plus-patients-taken-from-oceanside-hospital/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tricitymed.org/app/files/public/4947/Records-Breach-Letter-of-Disclosure.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tricitymed.org/app/files/public/4948/Records-Breach-PR-August-22.pdf"}],"summary":"10News has learned of another security breach at one of the county's hospitals.  Tri-City Medical Center in Oceanside admits that logs containing 35,000 patient names, dates of birth and diagnoses were wheeled out of the hospital on a cart.  The cart was being used by an ex-emplo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dea73a6dcc8d24f7fda5b45d517ae332bd196029","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4FF6839-D564-45C8-986B-0926724BC772"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3b96377e210","org_name":"Tinker Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kfor.com/2013/07/24/thousand-of-tfcu-customers-at-risk-after-security-breach/"}],"summary":"Tinker Federal Credit Union is sending a warning to about 8,000 of its members.  It details a security breach that left credit and debit cards issued by the credit union compromised.  Theyll get a letter telling them that their card was on that list and that we want to be a prote","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c29d30e800e77a2cd3c8a44a852f379c289d2a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD5C2E7F-2EC9-433C-84FE-06C4F78A8187"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"734c9b18719e","org_name":"TIAA-CREF (Teachers Insurance and Annuity Association - College Retirement Equities Fund)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.local10.com/news/jeffrey-martin-sentenced-in-id-theft-tax-return-fraud-scheme/25469708"},{"fetched_at":null,"title":null,"type":"press","url":"http://articles.sun-sentinel.com/2014-01-06/news/fl-id-theft-financial-company-brf-20140106_1_identity-theft-fraud-fraudulent-tax-returns-wire-fraud-conspiracy"}],"summary":"Insider abused access to steal identity info on customers to fuel a massive identity theft tax refund fraud scheme.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25d9ff53140d97dd236901c30bcc65a6f2852374","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADD62D8D-2951-4CB9-81A3-336B12F20F34"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edf14927ce28","org_name":"ThruWay Service Area","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wham1180.com/articles/local-news-122742/henrietta-charged-in-id-theft-at-12336444"}],"summary":"Henrietta, NY -- State police say a gas station worker at the Thruway Service Area in Henrietta is facing identity theft and larceny charges.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b334aeaa9c7bc67a815cdae7a5134e82498a332","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"645472C8-30F8-4D59-AD86-BC19E8E964B7"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d6ab51e58604","org_name":"Three Oaks High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.modernhealthcare.com/article/20130403/NEWS/304039954/wash-health-department-reports-laptop-theft"}],"summary":"High school students obtained password for admin and logged into school files and changed records. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"833eecc2a0dd7201eea50c616746c93b9f58e1fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9C47A4C-9037-4167-BF42-CF8597E36982"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc23249776fe","org_name":"The Stop & Shop Supermarket Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/union/index.ssf/2014/07/elizabeth_couple_netted_more_than_30000_in_ran_year-_long_identify_theft-scam_police_say.html"}],"summary":"A supermarket cashier and an accomplice have been accused of running an identity theft scam that netted more than $30,000 over the last year, authorities said. He said Carter would use customers credit card information to activate gift cards that she then passed along to Garnett.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"622d839b3a6552eb673d32f849ba9023e30415d1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D89D0E2-85F2-4B0D-BD71-D823ABAB3A6F"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c023486a43b","org_name":"The Coca-Cola Company","org_type":"manufacturing","ransomware":null,"records_affected":74000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/36627/74000-data-records-breached-on-stolen-cocacola-laptops-/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43871"}],"summary":"Laptop stolen by former employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43af212298d5943417bf8f6bb69770cdd987d13b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"488462DC-0675-415F-8C46-C0C7FB49A591"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93bbb5628cf0","org_name":"Texas Health Care, P.L.L.C.","org_type":"healthcare","ransomware":null,"records_affected":554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents exposes 554 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3b5d14d990ac51ac8ddf53dc2d472c4385ebca7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF66B534-9DB3-4B98-9522-C7E8242D00F6"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64863aa73a87","org_name":"Texas Health and Human Services Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/news/politics/texas/article/State-fires-employee-for-alleged-leak-during-5794951.php"}],"summary":"The Texas Health and Human Services Commission has fired a senior-level manager for allegedly giving sensitive information to a private company negotiating a multimillion-dollar state contract.  Leah Rayne, the commission's business technology architect, admitted to officials she","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a1e029dccd0d389e9ee7994b6c78651882e44b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B262B582-C7EC-4C02-AB1B-215B31F99058"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32dbb1569c25","org_name":"Tesco Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.law360.com/articles/573216/tesco-says-former-vp-took-trade-secrets-to-nabors-unit"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.suffolkfreepress.co.uk/news/latest-news/skimming-devices-found-on-two-petrol-pumps-at-town-store-1-5955945;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.buryfreepress.co.uk/news/local/latest-news/warning-after-skimming-machine-found-on-pay-at-pump-machine-in-suffolk-1-5948915"},{"fetched_at":null,"title":"Have I Been Pwned: Tesco","type":"hibp","url":"https://haveibeenpwned.com/Breach/Tesco"}],"summary":"Tesco Corp. sued the former vice president of its North American business unit in Texas state court Tuesday, accusing the executive of violating his employment agreement and stealing trade secrets before going to work for a Nabors Industries Ltd. unit.  The oilfield services comp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e83e4d4764353f92ac102d4d6a823e50b288a2e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9B3BCE7-FA5D-4763-AF10-7CA8BDDB710E"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62b806ebe6d7","org_name":"TennCare","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.waaytv.com/appnews/former-caretaker-faces-theft-and-abuse-charges/article_8b0fafae-8843-11e4-9a37-6707ea1264e1.html"}],"summary":"A woman is accused of mistreating a TennCare recipient, who the Tennessee Bureau of Investigation say was in her care.  Brandie Lynn Carver, was first investigated back on January 22nd by TBI special agents, after receiving information from the Department of Human Services. Agent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62fc012268f59450eb7759ab1bca0835500304ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"564620A1-8C2E-4AAC-A967-E0249F9EEA44"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b327a9365739","org_name":"TD Bank","org_type":"other","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.antonnews.com/plainviewoldbethpageherald/news/36955-locals-scammed-by-breach-at-td-bank.html"}],"summary":"Skimming device on ATM leads to payment card theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23476e1a4956c0ac185c218cb205c860c75f1de5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24D1B369-DB99-417B-9A38-1F50285651A6"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7e2d41c1bb","org_name":"Tampa General Hospital","org_type":"healthcare","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/publicsafety/crime/tampa-general-fires-employee-in-patient-data-breach/2197405;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.upi.com/Top_News/US/2014/09/14/Data-breach-at-Florida-hospital-releases-patient-info/1251410715836/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxtampabay.com/story/26519730/hundreds-of-tgh-patients-affected-by-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxtampabay.com/story/26597786/tgh-data-theft-victim-speaks-out"}],"summary":"Tampa General Hospital has fired an employee who accessed without authorization the cover sheets of 675 patients  information that can include Social Security numbers, a spokesman said Friday.  It's the second data breach in recent weeks involving local hospitals and one of sever","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57a96f77cca2cd2b0c732c2ffe5127a51880ad70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E4B2241-960D-4997-9677-1CB019D18EA5"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab8852cb28a2","org_name":"Tacoma-Pierce County Health Department","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2014/03/24/3114238_former-tacoma-pierce-county-health.html?rh=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2014/11/03/3467609_former-health-department-worker.html?rh=1"}],"summary":"A 40-year-old woman has pleaded guilty to stealing nearly $17,000 from the Tacoma-Pierce County Health Department while she worked there as a budgeting and accounting coordinator.  Dolanna K. Burnett, convicted late last month of first-degree theft, identity theft and forgery, es","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5dfdfd98777344572980b7a65758a45caed57d71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F609B785-E35F-453C-9103-DB895E759C13"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31e5006522a3","org_name":"Taco Bell Restaurants","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmbc.com/news/overland-park-man-admits-skimming-credit-cards-at-taco-bell/29526950"}],"summary":"A Kansas man pleaded guilty to using a skimming device to steal credit card information. Yao Vignon Kpade used a skimming device while working at Taco Bell to put stolen info onto bank cards with his name on them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58c53b923852ca61bdc504605e6b5e0e0d278e58","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCAC8674-8D63-4A40-A5D3-122E68C201DC"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"9936851a78a8","org_name":"SyriaJOB Ltd.","org_type":"technology_saas","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/04/european-cyber-army-leaks-60k.html"}],"summary":"Hacker posts credentials from 2 Syrian websites to pastebin. This entry is for job.sy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28a9600022044bd435f7ec9aeee3e0017169ba46","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCAA3342-59D4-4B52-96C3-5024B2103F6E"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21c7a9e6fe38","org_name":"Synergy HomeCare","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.greenwichfreepress.com/police-fire/multiple-counts-of-impersonation-forgery-and-identity-theft-charges-for-home-health-worker-33242/"}],"summary":"On Feb. 20 Ketty Placide went to Greenwich Police Headquarters to meet with officers regarding a larceny in Greenwich that she was charged with last November. She was taken into custody on an active arrest warrant for the November larceny.  Placide was processed for Illegal Use o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b47e4bd7a4d706df8c1bf10f9cd0c0a5e54ac9e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBEFE960-98A1-4099-A422-BC1F3E9F2CCE"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2796a76f195e","org_name":"Swedish Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/crime-law/charges-seattle-doctor-has-sex-was-sexting-during-/ngHjS/"}],"summary":"Among other things duly noted in the article, a doctor misused his access to medical record images for sexual gratification.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"839b7a530cee3a6fcf48e76c0b809d105c7d8b64","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6903BBCA-822A-448E-9ECF-859A8A9D3903"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5280695f41b","org_name":"SunTrust Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wate.com/story/27056743/oak-ridge-police-warn-residents-about-atm-skimming;"},{"fetched_at":null,"title":null,"type":"press","url":"http://oakridgetoday.com/2014/10/28/orpd-warns-atm-skimmers/"}],"summary":"Skimmer found on ATM at SunTrust Bank.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e6f6b51f1d6ad0d7837de8876d9f6da19c8b429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40382821-778E-415C-88E8-C52D7CB9A306"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8081781054","org_name":"Sunoco","org_type":"retail_ecommerce","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailycommercial.com/news/article_b98d2442-8541-5d3b-a87b-341f719e0fe5.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sheepsheadbites.com/2014/11/thieves-skimming-credit-cards-local-gas-stations/"}],"summary":"Gas pump skimmer linked to 5 payment card accounts used in fradulent transactions. Likely more victims, but only the 5 are confirmed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"441a9d0b7c38f98ef6c9ba7e428ab55ec839c6ea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C3A08BE-EF75-4011-8150-B0B02C2ED9BA"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d0f8e2b4f6c","org_name":"StumbleUpon","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/news-stories/mobile/StumbleUpon-Alerts-Users-To-Possible-Data-Breach"}],"summary":"StumbleUpon has locked out an unknown number of app users following detection of unusual activity on their accounts. A password reset is being required to regain access but the nature of the unusual activity has not been disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a68485e3f11f428842e7ec5135c4064da3c3b9ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF123461-C24B-445E-A5BF-08C3DB726068"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2afeb7d3fc1b","org_name":"Stoke City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://staffslive.co.uk/2013/04/21/dumped-pupil-records-and-lost-ipads-among-stoke-city-council-data-breaches/?goback=%2Egde_4636751_member_234933076"}],"summary":"Student records discovered dumped.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f465b786dc7628b1db9739cd34df80e084ff7875","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AB26852-E530-420E-9EED-2420D4B067B0"},"incident_date":"2014-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"7457b744f977","org_name":"Statoil ASA","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.thelocal.no/20140827/norwegian-oil-companies-hacked;http://www.newsinenglish.no/2014/08/27/oil-industry-under-attack-by-hackers/;http://www.databreaches.net/dozens-of-norwegian-oil-companies-hacked-others-warned/"}],"summary":"External agent using spearphishing and hacking to break into oil companies in Norway. 50 have confirmed that they have been attacked, but it is unlcear how many have actually been breached.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7ebb5fdce8251a4104c9f560a95e349edf9dd3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA1FC0DB-0D95-4945-AC24-E68D215DE905"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3b5ffff6163","org_name":"State of Tennessee","org_type":"government","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsmv.com/story/26265101/state-employees-notified-of-stolen-personal-information;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/08/14/tennessee-subcontractor-tells-60000-employees-of-phi-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hackers-get-thousands-of-government-workers-info-from-healthways-subcontractor/"}],"summary":"State employees' personal information could be in the wrong hands after letters were recently sent to notify them of a data breach.  \"We want our members to know what happened,\" said Joan Williams with the Tennessee Benefits Administration. \"We wanted to let them know that some o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a3f226617b386511b6f29c43a69a0326fedcb55","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C578D9B-FB98-4458-8805-E236C2A3661E"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b4e90e0d8c6","org_name":"State Bar of Nevada","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abovethelaw.com/2014/03/treasure-trove-of-confidential-exam-applicant-info-stolen-from-state-bar/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/criminal-steals-treasure-trove-of-info-on-applicants-to-nevada-state-bar/"}],"summary":"Bar applicants need to supply every single piece of personal information imaginable, from their birthday and Social Security number to their 10-year work history. If anyone with criminal intent ever got their hands on that information, we cant even begin to describe how screwed t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0212742b485f1762cc48985521b87f9f774a1e5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41143E67-DABE-4F94-9494-ADB4E917C895"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1633fa9efd71","org_name":"ST. VINCENT ANDERSON REGIONAL HOSPITAL, INC.","org_type":"healthcare","ransomware":null,"records_affected":63000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/in-st-vincent-breast-center-sends-63000-letters-to-wrong-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wishtv.com/2014/07/04/st-vincent-sends-63000-letters-to-wrong-patients/"}],"summary":"St. Vincent Breast Center officials said patients health information may have been compromised after they sent around 63,000 letters to the wrong patients.  The letters included patient names, addresses, and in some cases, a reference to a scheduled appointment. Officials said no","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6cd54f7e7b4b3c93a0cd34003a4b3d7cb15b1876","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"363807D2-D984-4811-8A5B-39631DEB8F74"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7817acb8e850","org_name":"St. Louis Housing Authority","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.maryvilledailyforum.com/news/state_news/article_54570187-b371-51b2-9cd7-e5d7340114e3.html"}],"summary":"Housing manager misused tenant information to commit tax fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eac39e5a11c7bbaaca84053766e346e549e89fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F2EF4B3-D7BE-431F-AAC9-65ACEFEE263D"},"incident_date":"2014-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"525b4c52f198","org_name":"St. Aldhelm's Academy","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://metro.co.uk/2014/04/08/school-with-worst-gcse-results-lost-1million-to-textbook-fraud-4692001/"}],"summary":"School employees provide banking information via a phishing site. 1.1M pounds are lost in fradulent transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06260112f7d8fb22927d2eb3fff0cb7ce1972973","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B26AB0A0-E9BD-42C1-A51B-6B6BA3A1FC74"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b4254b586791","org_name":"Sprint Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/sprint_uploaded_intimate_photos_from_my_trade-in_phone_to_my_facebook_page_/"}],"summary":"Woman files lawsuit against mobile phone company that leaked personal information from her trade-in phone to her social media page.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0e596a99b601d4922084d0988ed9c32be6203a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEA53A7C-A1E5-4333-99D1-C0271E79F1C0"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a856c09045c1","org_name":"Spotify","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/technology/digital-living/60080374/spotify-user-data-breached"}],"summary":"Spotify was hacked but nobody knows how or when.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5de7340e32348978ea9cc89c3cbc86d15ef323e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"355ADFCD-F460-448A-8C72-7D2EB90DE66C"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ccbd98993ff","org_name":"Southwest Virginia Physicians for Women","org_type":"healthcare","ransomware":null,"records_affected":568,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/other-breaches-newly-disclosed-on-hhss-public-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of paper records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aab15be7ff4f1b1eb510fb109bffc5bb2fab5770","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9DB3B93-FC35-4693-BCFA-885F272D2758"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe843ae79baa","org_name":"South Shore Physicians Group","org_type":"healthcare","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.silive.com/news/index.ssf/2014/07/bronx_man_senetenced_to_at_lea.html"}],"summary":"A Bronx man will be spending at least three and a half years behind bars for his role in an elaborate identity theft scheme he concocted with a West Brighton woman.  Clyde (C-Money CEO) Forteau was sentenced to three-and-a-half to 10-and-a-half years Tuesday for enterprise corrup","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fdd0b5642b5893666acf1947964797385d843f8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E650FA83-BC14-43E3-9DE3-1C48036BF63E"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6e40597918a","org_name":"South Jersey Hospital Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-additions-to-hhss-breach-tool/"}],"summary":"South Jersey Hospital loses medical records stored on partner laptop that was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09d7ef1baa34a2b694dec8fa1f03e834cd1206cf","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CC3B41B-6001-4B5C-B093-EB7C940B8A60"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"5a0051b85657","org_name":"Sohu.com Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cmswire.com/cms/customer-experience/incapsula-names-the-site-hackers-used-in-major-ddos-attack-024926.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/XSS-Vulnerability-in-Sohu-com-Leveraged-for-Large-Scale-DDOS-Attacks-439606.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/hijacked-anti-ddos-servers-used-to-carry-out-massive-ddos-attack/article/346619/"}],"summary":"Sohu.tv utilized in XSS attack to cause its viewers to also DDoS another website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"grudge","name":"Syrian Electronic Army","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"757252b9724672627c4eb06113e3b645e8fd4fd1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F5D3214-1E7A-49D7-A241-E98C9259589C"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2e7f7ae462eb","org_name":"Sky Network Television Ltd","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-22679099"}],"summary":"It follows an attack which saw the logos of six of the UK broadcaster's apps replaced by that of the SEA.  The hackers also breached one of the firm's Twitter accounts, allowing them to post messages urging users to view the defaced programmes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"syrianelectronicarmy"}},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"402eccd915288d90b6f886b76669a20d065db99f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3E3590F-E6A1-4219-B68F-6921F05E6F91"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9af333d5ff3","org_name":"Skrillex","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/07/skrillex-website-hacked-by-eboz.html"}],"summary":"Skrillex website hacked by \"Eboz\"  by Suriya Prakash on Wednesday, July 24, 2013 |  Sponsored Links    The Turkish hacker known by his handle \"Eboz\" who breached Pakistani NIC and left the top websites defaced has hacked into the Skrillex's website and defaced it with the same pa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06ccfc276a935184e309265bdea68e8bcce556aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D954CC3-A959-4723-A6B3-D885136AB9BF"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9506dba0d997","org_name":"Short Hills Associates","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2015/12/24/nyregion/a-patient-is-sued-and-his-mental-health-diagnosis-becomes-public.html"}],"summary":"Mental health clinic included diagnosis codes in publicly filed court documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"265c3617ed80b4af4a317f4694b2e98a940b03d8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F7B09DA-2508-4B05-82A1-F70365A8EF10"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"321333d77f5b","org_name":"Self Regional Healthcare","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/laptop-stolen-from-self-regional-healthcare-contained-patient-data/article/362937/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.selfregional.org/announcements/07-23-2014_Self_Precautions_Unauth_Use_Patient_Info.asp;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.indexjournal.com/Content/Default/Homepage-Rotating-Articles/Article/Self-Regional-announces-security-breach-of-patient-info/-3/225/26721"}],"summary":"South Carolina-based Self Regional Healthcare (SRH) is notifying at least 500 patients that their personal information  including Social Security numbers and financial data  was on a laptop stolen from an SRH facility.  How many victims? At least 500.   What type of personal info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ff38ed9ba4c732524c71cfd00b3cbc8c3d9a598","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EC20274-30D3-48E4-98FF-F7DB6B86E421"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62f639fbf56f","org_name":"Schlumberger Omnes, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.msternberg.com/blog/2014/06/former-schlumberger-employee-sued-for-confidentially-breach.shtml;http://www.bizjournals.com/houston/blog/drilling-down/2014/06/schlumberger-sues-new-baker-hughes.html"}],"summary":"Employee exfiltrated trade secrets just prior to leaving company and working for a competing organization. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"521470c7a5ce38572fbba9fce1baa6789eea03db","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37F7577A-66DC-4398-BE96-6C387F6F5431"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6403346a15c2","org_name":"Santander bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.edp24.co.uk/news/crime/man_jailed_for_possessing_card_skimming_device_used_at_norwich_bank_1_3608842"}],"summary":"Man arrested and sentenced for installing Credit Card skimming m/c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9dd84376b5ff3374662be079a60c1544ba20fbb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71B4D1E6-771B-47F7-8586-5564B17A2E05"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bddc2ae83d4","org_name":"San Antonio Metropolitan Health District,","org_type":"government","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.woai.com/articles/woai-local-news-sponsored-by-five-star-cleaners-119078/stolen-laptop-leads-to-data-breach-12517324"}],"summary":"There is word today of a disturbing data breach at the San Antonio Metropolitan Health District, Newsradio 1200 WOAI reports.    Officials say a thief stole a laptop computer which contained the vaccination records of as many as 300 children that are stored in the records of the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5783dd064f44d528d2b100647fc2ef5ffa4f5ba5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C49F9178-41FA-4971-818F-A6124B96D1EB"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"fa32dad011e7","org_name":"Samsung SDI Co Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.redorbit.com/news/technology/1113125612/samsung-website-smart-tv-hub-servers-down-fire-042114/;http://www.fiercecio.com/techwatch/story/samsung-data-center-fire-highlights-importance-redundancy/2014-05-02"}],"summary":"A fire reportedly swept through a Samsung data center in Gwacheon, South Korea early last week, resulting in the company stopping all services offered through its website and smartphone apps for a few hours. As reported by TechNewsWorld, the affected data center hosted the main s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2663a0807e563d7d6c44b1dde53c40a007604d79","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D72FAD3-1D68-4D7C-8BC7-6929D682600D"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"98c00237078d","org_name":"Sally Beauty Holdings Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/03/sally-beauty-hit-by-credit-card-breach/"}],"summary":"Sally Beauty suffers data breach in their payment card environment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ff89788eef2c796ae264c015ebc1499750f39e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1F92496-10CF-4103-993F-2FDF661B3C86"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4d59d7396df","org_name":"Salina Family Healthcare Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/salina-family-healthcare-center-notifies-9640-patients-after-email-attachment-error/"}],"summary":"employee sent database (I assume Access DB) through email, but left in patient personal information the receiver had no authorization to see.  Receiver noticed error, deleted the data immediately and notified the sender of the security incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7f04108bc3c8e6e276c4d534f0a17e666d56eda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28E2B8D8-6D3D-4462-A468-1D84EBF904D5"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"60adbc159612","org_name":"Russian Embassy in the US","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Attacks-Russian-Websites-for-the-Arrests-of-Greenpeace-Activists-Video-401262.shtml"}],"summary":"Anonymous hackers have launched distributed denial-of-service (DDOS) attacks against a number of Russian website in protest against the arrests of 30 Greenpeace activists, known as the Arctic 30. The attacks are part of OpGreenRights. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76d80d0181b527ce12c7bc7b1f90ca6c0af4b1bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17437313-82FE-4D41-8B3D-003E0EB03B83"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"13607093b997","org_name":"RS McColl","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.stv.tv/east-central/280114-skimming-devices-found-on-cash-machines-in-edinburgh-city-centre/"}],"summary":"Police in Edinburgh have warned people who used two cash machines on Saturday to check their accounts for unusual transactions.  Card skimming devices were found on machines at RS McColl in Frederick Street and Thomas Cook in Hanover Street in the city centre.  Anyone who used th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"317ed5db151f405f6b3bd97dcbab236eb6e7be8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B09F4C80-19AA-4C6D-B024-FD85179A6555"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"df18b117834d","org_name":"Royal Prince Alfred Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/nsw/hospital-breached-privacy-rules-by-releasing-womans-details-to-exhusband-20140911-10erxy.html"}],"summary":"A mother of two says a Sydney hospital released sensitive details about her health to her hostile ex-husband, who used it against her in his attempt to gain sole custody of their children.  The woman could receive up to $40,000 in compensation after a tribunal found Royal Prince ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6060f5718de2135ebd4fb6625ea903c7aac9212a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0A27979-2E44-472A-84E6-680CB92380A3"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6d7debfe12e7","org_name":"Royal Blackburn Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.blackburncitizen.co.uk/news/11311421.East_Lancs_hospital_bosses_apologise_to_former_employee_for_breach_of_patient_confidentiality/"}],"summary":"HOSPITAL bosses have admitted an ex-employee suffered a breach of patient confidentiality when a former colleague read out her medical notes to other staff.  East Lancashire Hospitals NHS Trust (ELHT) has apologised to Ewood mum-of-three Kate Beardsworth for the distress caused b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3feacc408e2f209d71fb0436cba72fb9d880d28a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA97F258-D0CF-40B0-8ED0-AA855C0BAF67"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5400d94e1728","org_name":"Riverside County Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ca-riverside-county-regional-medical-center-notified-563-patients-about-missing-laptop-with-phi/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.pe.com/breaking-news/2014/06/24/health-care-laptop-with-sensitive-patient-information-missing-from-county-hospital/"}],"summary":"Heres yet another case involving a missing (presumed stolen) laptop with unencrypted PHI that was used with a medical device, but seemingly not physically secured enough. This breach involves the  Riverside County Regional Medical Center. I recently reported a similar type of bre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7da26684e7e9585cf1d161ae6ce597034537df2e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC640713-74EC-48EE-BF97-C071522DB937"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":522,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2014/07/30/3309632/expired-prescription-records-stolen.html"}],"summary":"Someone stole a stack of expired prescription records from a Rite Aid pharmacy in Milton, the company announced Wednesday.  The records did not contain Social Security numbers or credit card numbers, and there has been no sign of resulting identity theft, spokeswoman Ashley Flowe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"540bf17295b8d71d1bb24631c8981acb96039bca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F83DB7BB-EEDB-492C-A132-3256197F46A1"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"64893c69d22c","org_name":"RISCO Group","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/brazil-world-cup-security-center-wifi-details/;http://www.infosecnews.org/want-to-know-the-wifi-password-for-the-brasil-world-cup-security-center/#.U6wvUo1dWfQ;http://grahamcluley.com/2014/06/brazil-password/;http://www.correiobraziliense.com.br/app/noticia/cidades/2014/06/22/interna_cidadesdf,433890/quem-sao-os-homens-responsaveis-pela-seguranca-dos-chefes-de-estados-no-df.shtml"}],"summary":"The WiFi SSID and password for the football World Cup security centre in Brazil have been exposed after a photograph of the nations Federal Police captured the credentials written on a white board.  The photograph appeared in a local news outlet Correio Brazilienseshowing Cravo D","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8518a47038625518dcde59f32aae7ae18c6adc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"af1befd0-c49e-11e7-9a8b-47d1b690bc01"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75e51e423b2c","org_name":"Reservation Counter","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://skift.com/2017/04/03/expedia-sued-by-affiliate-for-allegedly-stealing-data-and-handing-it-to-a-competitor/"}],"summary":"Employees steal proprietary partner data and launch their own company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29e2dc7be98eafaf55474517dfe94b92a0e2fbad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BDF73C1-C69F-48B9-BC70-4B0CD76343C3"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fbb95ec5dcdc","org_name":"Regional Transportation District","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://denver.cbslocal.com/2014/11/07/three-suspected-in-light-rail-skimming/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://denver.cbslocal.com/2014/11/05/skimmers-discovered-at-light-rail-ticket-machines/"}],"summary":"DENVER (CBS4) - Three men are now suspected of installing devices at light-rail ticketing machines that steal consumers credit card information.  The devices, called skimmers, were discovered before they could transmit any information. Investigators said nobodys information was c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d30fe4e0bff9327ed6fb0105cc7715614a74ee4a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6168D43E-76A9-4456-814D-C4F709638BAF"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fc8f4111bc8a","org_name":"Regal Chambers","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/media/action-weve-taken/mpns/1624800/mpn-regal-chambers-surgery-20160808.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.co.uk/tech-policy/2016/08/medical-data-leak-doctors-hit-with-40000-fine-from-uk-watchdog/"}],"summary":"Medical information was improperly provided to former partner of victim. Information included her as well as other family members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fee09a70d6bbeecede1c710c7a09f24e51bf2007","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48584010-18FA-48F6-8E5D-B4B2B580F9F1"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"0a1f95dab692","org_name":"realestate.sy","org_type":"technology_saas","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/04/european-cyber-army-leaks-60k.html"}],"summary":"Attacker posts credentials stolen from 2 Syrian websites to pastebin. This is modeling the realestate.sy site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc5875c0a26ff36f00239e80c827941742f0f99b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81DD3D68-334A-4915-BCA2-2E1F2A776C54"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aed12df6e846","org_name":"Raval Medical Center","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/20/data-breach-news-pa-server-hacked-records-found-dumped/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickondetroit.com/news/medical-files-found-dumped-in-oak-park/29089014"}],"summary":"A Michigan medical center could be facing harsh scrutiny after a news report stated that medical files were found dumped outside near the building.  According to a Local 4 report, a patient who was picking up a prescription found a stack of boxes outside. The files contained Soci","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f1a2ae19cfb9ca0fe2952ca6b9b61d6a9c74442","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B0BE5F4-394B-4A69-949A-62216EC69A57"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c1e0967c560b","org_name":"Rajasthan Information and Public Relations Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Government-Websites-of-India-s-Largest-State-Hacked-by-Pakistani-Group-424002.shtml;http://www.ehackingnews.com/2014/02/two-more-indian-government-websites.html"}],"summary":"web page defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16b9ca3462ec3cb7b51116f977b375ef459cb1fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16410CEA-1A09-4BA0-8FC2-3FBF8CBC3E1C"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d989df9737f9","org_name":"Rady Childrens Hospital","org_type":"healthcare","ransomware":null,"records_affected":14121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/2014/06/18/4186057/patient-data-breach-at-san-diego.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox5sandiego.com/2014/06/18/hospital-admits-releasing-sensitive-patient-info-by-mistake/#axzz35BzI90rJ;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.rchsd.org/about-us/newsroom/press-releases/files-containing-patient-information-released-in-error/"}],"summary":"Hospital employees sent out detailed personal information about more than 14,000 patients to several job applicants by mistake this month, officials at Rady Childrens Hospital said Wednesday. Officials said the security breach, which happened on June 6, prompted an internal revie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ca776e6ef834383dc1953365ef4f4098ed24d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3735D426-3CAA-4160-B850-50FF72A81F20"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8143805c73df","org_name":"Rady Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":6307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox5sandiego.com/2014/06/18/hospital-admits-releasing-sensitive-patient-info-by-mistake/#axzz35BzI90rJ"}],"summary":"Officials said the security breach, which happened on June 6, prompted an internal review and the discovery of a second breach in 2012 in which less detailed information about more than 6,000 patients was mistakenly sent to job applicants. In both cases, the files were sent as tr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b47346424ecd6f1497a4c6e33f22e1bca5891b56","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0EFEB54-B629-43A8-AAB1-7D49B9E2B0EB"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb5f2b9740c3","org_name":"QCA Health Plan, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kdhealthlaw.com/2014/05/unencrypted-laptops-stolen-resulting-in.html"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/qca_agreement.pdf"}],"summary":"stolen laptop; data not encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eb1b86e8e652e6dc8e8a17c2e854018e5fb81c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5721C459-6684-4904-81FA-161FE81F56CB"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4eb9b17b64d","org_name":"Providence Hospital","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktva.com/anchorage-woman-sentenced-for-hipaa-violation-201/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.hcpro.com/hipaa/2015/06/ex-hospital-worker-gets-2-years-for-giving-phi-to-drug-kingpin/"}],"summary":"financial counselor, looked into each patient's records as a favor to Seugasala to learn what each had told police and hospital staff about the origin of their injuries and how badly they were hurt.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"931b9ae155fe8c61e517f3855e07834519eee926","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B862CACF-DABC-4257-BFEB-610C19428F2B"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ccd3f92995d","org_name":"Pride Medical Services","org_type":"professional_services","ransomware":null,"records_affected":379,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2014/03/03/65774.htm"}],"summary":"An Atlanta doctor sent unencrypted \"HIV/AIDS Patient Lists\" to a \"gay-oriented\" magazine, disclosing 379 patients' names and HIV status, a class action claims in court.      Lead plaintiff John Doe sued Pride Medical Services, three doctor/owners, a pharmacist and another part-ow","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"449cb26a11b465ad8fc041f2a8fa9f23be949c7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D390FCA7-8F0A-4A43-BEBC-5F41BA4A0DEB"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"165c49f9e9b5","org_name":"Pret A Manger (usa) Limited","org_type":"other","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/2152"}],"summary":"Manager stole customer credit credit card numbers at restaurant, likely via a handheld skimmer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11757b5cbfbd5dbafb34fc3f1d97e598e8769df2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26471DFE-E2C7-4319-9808-D27490CE8F87"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4d033d513b0","org_name":"Presence Saint Joseph Medical Center","org_type":"healthcare","ransomware":null,"records_affected":874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bolingbrook.patch.com/groups/business-news/p/joliet-hospital-notifies-patients-of-possible-info-breach-bolingbrook"}],"summary":"Presence Saint Joseph Medical Center has notified patients about a potential leak of patient information  but said the accidental disclosure does not include financial information.  \"Presence Saint Joseph Medical Center has notified 874 patients about a potential disclosure of ce","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c7f4015a23efa029f4df7ec1bb5e3ee39e10d0e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E211BC69-F299-4719-AEAD-2E6D34108805"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"dc1e3c27ff39","org_name":"PR Puerto Rican Association of Surgeons","org_type":"nonprofit","ransomware":null,"records_affected":9950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/world/the_americas/personal-information-of-puerto-rico-doctors-stolen/2014/01/17/e8354b96-7f9b-11e3-97d3-b9925ce2c57b_story.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/identity-info-of-every-licensed-physician-in-puerto-rico-acquired-in-hack/"}],"summary":"Officials say someone stole the personal information of all medical doctors licensed to practice in Puerto Rico.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73dd1312f036d04567c089401553937033935f12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1d9eb3c0-8902-11e8-82c8-d50e157d53ee"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"3f1f99bb9d9c","org_name":"Polar","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.csoonline.com/article/3287646/security/polar-fitness-app-exposed-personal-information-of-soldiers-and-spies.html#tk.twt_cso"}],"summary":"For the second time this year, a fitness app is to blame for revealing the locations of people working at military bases, intelligence agencies and other sensitive sites, as well as pinpointing those users’ homes.  The fitness app Polar Flow allows users to share the GPS location","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c766f4c795e06ca909e6c0c9cdc92a6cfcd53ceb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A4D3A12-C20F-4917-A85B-C0D48056C637"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"1e68c302f3dc","org_name":"PNC Financial Services Group Inc/The","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/news/adminpage/5768047-74/pnc-daly-lawsuit#axzz2vyk3Ih00"}],"summary":"A former senior vice president of PNC Bank's Palm Beach, Fla., office used her cellphone to snap pictures of her computer screen hours before she resigned to take a job with a competitor.  The bank's security software thwarted Daly's attempt to download customer data, the lawsuit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c094d452c402c4fadfa336e2ca7cf5431f7bcda9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BF6DB70-BC1A-4B46-95C9-867728CAD858"},"incident_date":"2014-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"3c9969a1d28c","org_name":"PhysioMedicor","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.dynamoo.com/2014/01/script-exploits-lead-to-adscend-media.html"}],"summary":"Physical therapy website is hacked and used to serve up malicious code under the guise of a software update banner.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d9bdbe435e2a9f956949b521e402754e35d0b24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D44013EA-1423-423F-8BA9-E29E39893CF7"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5de3f9404881","org_name":"Penryn College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.falmouthpacket.co.uk/news/11163418.print/"}],"summary":"Penryn College has apologised unreservedly after accidentally emailing confidential pupil details to all students.  A weekly summary of all students commendations and behaviour incidents was sent before the start of the Easter holidays.  After being contacted by the Packet, headt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"176aa16c8efee0aa6db9f0e2faf1b9510bf774ff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6955F207-425C-40D2-86A6-DC028A0232DC"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0524081bba00","org_name":"Penn Medicine Rittenhouse","org_type":"healthcare","ransomware":null,"records_affected":661,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.philly.com/2014-07-18/news/51663609_1_data-breach-social-security-numbers-identity-theft"}],"summary":"Penn Medicine Tuesday announced a data breach involving receipts from Penn Medicine Rittenhouse that were stolen last month from a locked office in Pennsylvania Hospital.  Notifications of the theft were sent to 661 patients Monday, said Susan Phillips, a senior vice president an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48c81583b280493cd9715b91621717ac5a35b4db","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5370F663-AC43-430C-94E1-93095FD51973"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17d1b544e64f","org_name":"Penn Highlands Brookville","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/20/data-breach-news-pa-server-hacked-records-found-dumped/;https://www.phhealthcare.org/penn-highlands-brookville/penn-highlands-brookville-provides-public-notice-of-data-security-incident/page.aspx?id=2038"}],"summary":"Somebody hacked into a partner organization and may have stolen patient data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"313ab43b935a8d23fa57efe8562959482e7137fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2666B18C-9432-401D-9999-2065FEE44BFE"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31eeeecd9a5d","org_name":"Partners in Care","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.silive.com/news/index.ssf/2015/02/home_health_aide_with_troubled.html"}],"summary":"A 29-year-old home health aide chugged Four Loko on the job and stole a credit card from the 93-year-old woman under her care, according to authorities and the alleged victim.  The arrest, which took place Thursday, is the latest black eye for Partners in Care, a Manhattan-based ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49197caa7f5e14a49556867cb2e6e7d8053c0422","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"552CB23E-2C89-47E5-AF60-1F0570B204FD"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79f7bb8b8ae8","org_name":"PARK HILL SCHOOL DISTRICT","org_type":"education","ransomware":null,"records_affected":10210,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmbc.com/news/park-hill-school-district-warns-of-possible-data-breach/26843048#ixzz371MyB2OD;http://www.kshb.com/news/local-news/park-hill-more-than-10k-impacted-by-possible-security-breach;https://www.google.com/url?rct=j&sa=t&url=http://fox4kc.com/2014/07/08/park-hill-school-district-announces-privacy-breach-private-info-including-sss-accessible-on-internet/&ct=ga&cdEYAioUMTE3OTIwOTk2NDA3NjUwMzgxODQyGmFlZTg1YzhlZWRjNDcwODc6Y29tOmVuOlVT&usgQjCNH-MWZtY5tkTxOnS8GL4L8V-PUwnQ;http://www.scmagazine.com/former-employee-posts-data-online-10k-impacted-in-missouri-school-district/article/360008/"}],"summary":"Former employee posts data online, 10K impacted in Missouri school district  At Park Hill School District in Missouri, more than 10,000 current and former staffers and students are being notified that their personal information  including Social Security numbers  was accessed aft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97a9deb6d2f67a85f29f7f3878d77b9dba211c99","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8BD28A1-4609-4310-A75E-742CB14919E8"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e8d683201b1a","org_name":"Oxford County Department of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.woodstocksentinelreview.com/2014/09/24/vehicle-break-in-results-in-theft-of-sensitive-oxford-county-public-health-information"}],"summary":"Oxford County public health is apologetic after sensitive information was stolen from a car belonging to a health inspector working on call earlier this month.  An on-call bag containing a book of handwritten notes dating back about two years was stolen during a vehicle break-in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbe05bf1568c3111e3ff0ffcf7c2c2455f63d88d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32DB78FE-39BA-49E5-95A4-066306D58190"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6aae4847fa80","org_name":"Orthomed Appliance Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/southern-california-man-found-guilty-health-care-fraud-and-aggravated-identity-theft-role-15"}],"summary":"A Southern California man who ran a durable medical equipment (DME) supply company has been found guilty by a federal jury in Los Angeles for his role in a $1.5 million Medicare fraud scheme.  Acting Assistant Attorney General David A. ONeil of the Justice Departments Criminal Di","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84d10137122ece157945a04b9861328d4f0267f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"918ECE5F-C96F-48A7-9887-E38EF083490D"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b46f0fafcf38","org_name":"Optum Idaho","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.idahostatesman.com/2014/08/28/3344946_patient-data-goes-to-wrong-providers.html?sp=/99/103/&rh=1"}],"summary":"Optum Idaho, a unit of United Behavioral Health, took over insurance management for Idaho Medicaid's mental-health and substance-abuse patients last fall.  Local health care providers who treat those patients say Optum has erroneously sent them reports meant for other providers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b90cb1f55b9b56f148e37cea849538dd76019f0a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB9C7AE4-1D0E-4F98-B382-201EC05D9E53"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9df79373133","org_name":"Olmstead Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.postbulletin.com/news/crime/law-enforcement-confirms-cases-of-tax-theft-in-omc-breach/article_f5ebb883-a7cd-5a96-a6aa-72f3828adc92.html"}],"summary":"Data breach in hospital leads to fraudulent tax returns.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a180238f2d3bbfdcf7233b7d305270110f3555ea","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"244C5358-9B32-4381-B2E5-24A14FB522AF"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"349b948741b7","org_name":"Oakland Township","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theoaklandpress.com/general-news/20150422/oakland-township-trustees-parks-commission-to-hold-joint-meeting-after-document-leak"}],"summary":"Following a board of Trustees meeting, a review of all township email accounts and found that privileged information had been leaked through an error of omission by the township_s legal counsel.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ca748cc18c045a9765a2794d5fe6e540c04a3f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43235DF2-FDD5-4C03-93DB-CBC27EBB08C3"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"04aab1bfa199","org_name":"NTT Communications Corporation","org_type":"technology_saas","ransomware":null,"records_affected":768,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2014/12/09/business/chinese-man-arrested-for-illegal-access-to-ntt-server/?utm_source=rss&utm_medium=rss&utm_campaign=chinese-man-arrested-for-illegal-access-to-ntt-server#.VJS52BtDB"}],"summary":"Tokyo police have arrested a Chinese man on suspicion of illegally accessing a server operated by NTT Communications Corp.'s Internet service provider OCN, it was learned Tuesday.  The 32-year-old company employee, Geng Qiang, who lives in Tokyo, has admitted to the charge, infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71e6b87b1eee9ceec6b344cb2bd3433705586cba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C995A60F-F152-435A-92E2-642EF935DD34"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fc8c8570151","org_name":"NOVA Chiropractic & Rehab Center","org_type":"healthcare","ransomware":null,"records_affected":5534,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/fate-of-unencrypted-drive-unknown-phi-of-5500-in-virginia-at-risk/article/343831/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sterlingchiropractortherapy.com/"}],"summary":"More than 5,500 patients of Virginia-based NOVA Chiropractic & Rehab Center of Sterling may have had personal information  including Social Security numbers  compromised after an unencrypted thumb drive containing the data was possibly thrown away.  How many victims? 5,534, accor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":"Christopher Wilson","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8436c6de667c318b79a921e731870f3fdf11c008","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DC26EB3-1414-4D9C-BE74-B16B46203085"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"267d52ca9c43","org_name":"Northumbria Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclelive.co.uk/news/computer-whizzkid-jailed-failing-provide-7375293"}],"summary":"A computer whizzkid suspected of trying to hack into police websites has been jailed for refusing to hand over his password in the interests of national security.  University student Christopher Wilson caused the Northumbria Police website to shut down after ringing the force usi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"christopherwilson"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6534f57d0403889edad358ae4c9336944fe21a0f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0FE9734-298C-4BF1-A077-8B1FAE6FE41C"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db092f2b8890","org_name":"North Lincoln County Community Health Center Clinic","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsguard.com/news/article_6cae4b3c-d549-11e2-9aeb-0019bb2963f4.html"}],"summary":"\"It feels really not good and it is a violating feeling to have someone break into your clinic,\" said Gretchen Gantz, HIPAA Privacy and Security Officer for Lincoln County Health and Human Services. Her statement follows the break-in of the North Lincoln County Community Health C","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6ad90ccf2b291d823899e21dc98c46bb11572a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A034B2DF-D01E-4721-A11B-10A2AE58ADD5"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3d4b27736ef8","org_name":"North Bay Regional Health Centre","org_type":"healthcare","ransomware":null,"records_affected":5800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nugget.ca/2013/06/11/hospital-defends-private-records"}],"summary":"North Bay Regional Health Centre could be forced to turn over medical information for almost 40,000 patients dating back to 2004 in a privacy case involving a nurse accused of illegally accessing data.  Melissa McLellan faces nine charges under Ontario's Personal Health Informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7192b463e4ea111dc88a52c6a8f888fb286e37a7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10B9F526-E803-4D8E-895F-69A1D306EEFB"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"a8a3656aec24","org_name":"Nintendo Co Ltd","org_type":"manufacturing","ransomware":null,"records_affected":23926,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2013/07/06/business/corporate-business/japan-customer-data-exposed-in-massive-breach-of-nintendo-member-website/"}],"summary":"Customer Login & PII stolen from Nintendo's member website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"495e1ae7a43828efafa630e87f0f1e22cc332801","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EDDC24C-F83B-4F22-AC4B-07B7412F050F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"151eb7d47261","org_name":"NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":47000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/health/healthnews/10656893/Hospital-records-of-all-NHS-patients-sold-to-insurers.html"}],"summary":"The medical records of every NHS hospital patient in the country have been sold for insurance purposes, The Telegraph can reveal. The disclosure comes days after controversial plans to extract patient data from GP files were put on hold, amid concerns over the scheme. Those in ch","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acbcebfc2b2f4c828f2f266a726cbbd48c6c0cbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86D6D91F-666B-4D9B-9D95-FE9F627E35EA"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec560eedff8e","org_name":"New York City Taxi and Limousine Commission","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fastcompany.com/3036573/fast-feed/nyc-taxi-data-blunder-reveals-which-celebs-dont-tip-and-who-frequents-strip-clubs;https://medium.com/@vijayp/of-taxis-and-rainbows-f6bc289679a1"}],"summary":"Researcher de-anonymizes FOIA'd cab ride data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b564b1c475a1284293d5c15a84ec991165776579","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F45139AD-8978-44C1-BF5C-3503CDA0A50F"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"903f728b2391","org_name":"New York City Metropolitan Transportation Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/news/crime/article/APNewsBreak-NYC-Transit-has-data-breach-5314325.php"}],"summary":"CD with personal data found inside a CD-ROM that was refurbished and sold.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"low","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa12c8df4537f957e6bda1a127d8ab2d7406510a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ba376f0-c48f-11e7-9a8b-47d1b690bc01"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2d5db6ffca96","org_name":"New Delhi Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.reuters.com/article/us-uber-lawsuit/rape-victim-sues-uber-claiming-it-wrongly-obtained-her-medical-records-idUSKBN1962E5"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce5f8b0ee7ea3dea9d44b6fa69b34db2265e2b1d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58411537-222B-403F-818A-F958DC9BD7DB"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"66a447de615f","org_name":"Netlima","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/01/peruvian-local-news-website-netlima.html"}],"summary":"Defaced website by anonymous groups","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"121f6f15e56731e8c1e9c0c0d677fa398ce69e85","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D4445AB-A4C1-471B-A15F-386ACE62A76F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a0560702b68","org_name":"Nebraska Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.linkedin.com/pulse/article/20141022044536-2259773-ebola-and-privacy-snooping-confidentiality-and-hipaa;"},{"fetched_at":null,"title":null,"type":"press","url":"http://journal.ahima.org/2014/10/08/hospital-employees-fired-for-illegally-accessing-ebola-patients-health-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wowt.com/home/headlines/Two-Med-Center-Employees-Fired-For-Accessing-Dr-Sacras-File-277242411.html#pubId=40518&siteId=40901&adId=63231&kadwidth=300&kadheight=250&SAVersion=2&js=1&kdntuid=1&pageURL=http%253A%252F%252Fwww.wowt.com%252Fhome%252Fhea"}],"summary":"Two hospital employees have been fired for illegally accessing the electronic health record (EHR) of a Massachusetts physician who was being treated for Ebola in the facilitys isolation unit. The HIPAA violation was discovered by Nebraska Medical Center officials conducting an au","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf11edfd816baf4b5128364e16dfec478fd66486","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A4B05DA-2E21-449F-BA5B-21D883BAD4DD"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9479368b33b3","org_name":"National Research Council","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canadianunderwriter.ca/news/cyberattack-breached-system-holding-personal-data-privacy-watchdog/1003184502/?&er=NA;http://www.ctvnews.ca/canada/chinese-cyberattack-forces-computer-shutdown-at-national-research-council-1.1936483;http://www.nrc-cnrc.gc.ca/eng/statements/20140729_cyber.html"}],"summary":"DAILY NEWS Jul 31, 2014 2:53 PM - 0 comments Cyberattack breached system holding personal data: privacy watchdog  TEXT SIZE bigger text smaller textBy: Jim Bronskill, THE CANADIAN PRESS 2014-07-31 OTTAWA - Hackers who targeted Canada's National Research Council infiltrated a syst","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f62337ad426f39c10fd495c0e7e655c378138fd4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2977BBB-2132-4A58-A69D-614EBD59EBC8"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NA","org_id":"3085efb7d568","org_name":"Namibian Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Launch-DDOS-Attack-on-Namibian-Government-Portal-in-OpFunKill-414769.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48b33429383939c16cacde29afc7cdf37f2788af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66971F0C-2885-4B07-9A04-3DAAF12505C1"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2970c32ec81f","org_name":"N.C. Behavioral Health and Counseling Services","org_type":"healthcare","ransomware":null,"records_affected":56,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/durham-businesswoman-charged-with-health-care-fraud-id-theft/13795545/"}],"summary":"A grand jury has indicted the owner of a Durham-based health care company on 15 criminal charges, including health care fraud and identity theft. A warrant has been issued for her arrest.  Investigators say Tracie Yvette Clay, chief executive of N.C. Behavioral Health and Counsel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"865daf9a52c035d8012c8cf96108ebc565358c4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D61CFC66-C52E-41E8-BEDB-7FD1C4CA8705"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5adc09a6939","org_name":"Multicard","org_type":"manufacturing","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/multicard-leaks-data-online-in-privacy-breach-oaic-7000028967/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com.au/article/544105/multicard_breached_privacy_act_maritime_id_card_data_leak_commissioner/"}],"summary":"Identification card solutions provider, Multicard, has been found to have leaked the personal information of approximately 9,000 maritime security identity card (MSIC) applicants online.  The Office of the Australian Information Commission (OAIC) found that Multicard stored perso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d8307a6f5f2944645df718ad0c9379650ce7c26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD47F388-AFCB-4774-8BF5-E26C898C65D5"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f8469aa29c37","org_name":"Mount Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/2014/08/29/privacy_breach_six_gta_hospitals_gave_patient_info_to_photographers.html"}],"summary":"Six GTA hospitals compromised their patients personal health data by routinely handing it over to baby photographers who paid for access to maternity wards breaches revealed by extra scrutiny following a major breach at Rouge Valley Health System. As far back as 2009, Mount Sinai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2154690fefbacf4e33a025eadb7de20762568cf7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C61A3CD8-352E-424F-8B50-B1974D70DD11"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"13af1eb7f4f5","org_name":"Mount Sinai Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/gta/2014/10/16/mayor_rob_fords_privacy_breached_hospital_says.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theglobeandmail.com/news/toronto/rob-ford-hospital/article21123503/?cmpid=rss1"}],"summary":"Two employees at the Toronto hospital where Rob Ford is undergoing cancer treatment inappropriately accessed the mayors confidential medical records, a breach that led the hospital to mete out unspecified action against the staff members.  Mount Sinai Hospital confirmed Thursday ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44078b771e5fb0a807108dbf5e9f3f112f32e53b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9C3A0BC-1161-4266-9826-BB27E6DB12F5"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5eebe4bd5e67","org_name":"Mount Olympus Mortgage Company","org_type":"financial","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/data-652639-companies-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.housingwire.com/articles/36597-guaranteed-rate-ordered-to-pay-25m-to-mount-olympus-mortgage-for-data-theft"}],"summary":"A California jury ordered Guaranteed Rate to pay more than $25 million in damages to a fellow mortgage lender, Mount Olympus Mortgage Company, stemming from accusations that a former employee of Mount Olympus Mortgage stole client information and loan files and took them with him","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ad23e0a0dc9f7199c0c282dda0d442d83f0260f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73B58A67-BD54-41DB-942E-599F1FF179B3"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44f61888d8ad","org_name":"Motion Picture Industry Health Plans","org_type":"financial","ransomware":null,"records_affected":703,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"The covered entity (CE), Motion Picture Industry Health Plans (MPIHP), mistakenly sent mailings containing protected health information (PHI) to the prior address of approximately 700 individuals due to a computer error.  The PHI involved in the breach included names, claim numbe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c22d7d9be109e35d58ea777f4c5b875bc058591","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B60D63C-B555-45CA-AE70-B540127DC3ED"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f8d52cc09b4","org_name":"Mohegan Sun Casino","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://citizensvoice.com/news/former-cocktail-waitress-agrees-to-plead-guilty-in-420k-casino-scam-1.2073422"}],"summary":"Collusion of a waitress to steal info off of physical casino debit cards, an executive to create copies of cards and add value and an external actor to utilize those cards on slots to cash out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dcc77beb165e9b9d4184fb68fc5f828f7419f89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"470744D0-1D16-4E05-A86D-5C012A272094"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66920844c7a4","org_name":"Moca Asian Bistro","org_type":"other","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://centrevilleindependent.com/restaurant-worker-accused-of-skimming-over-1000-credit-cards/"}],"summary":"employee used credit card skimmer to steal PAN data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"476e72a13e812d8911b997ec963a4e03a9269aef","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4dc0d0f0-c496-11e7-9a8b-47d1b690bc01"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2212084f65cb","org_name":"Mississippi Division of Medicaid","org_type":"government","ransomware":null,"records_affected":5220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/mississippi-division-of-medicaid-notifies-more-than-5000-after-discovering-data-were-not-securely-transmitted-for-more-than-three-years/"}],"summary":"Potential disclosure of data due to lack of HTTPS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a6d6e41c3f39bb18df71071d3bef8f56fa841c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0BA9C34-ADAA-4964-97B2-C8E908E4D682"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"107053d8527c","org_name":"Mission City Community Network","org_type":"healthcare","ransomware":null,"records_affected":7800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of email exposes 7800 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25324fdb2f253e297d9fd6be4dcd343dfe309140","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93F26708-4C2A-4A77-9F94-166CF255C3BA"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"f1a424cc7084","org_name":"Millet","org_type":"technology_saas","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tech.ifeng.com/bat3m/detail_2014_05/14/36310226_0.shtml"}],"summary":"Chinese cloud computing platform Millet was hacked and a database of user credentials from pre-August 2012 was exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b45f5c37514d568dd6f3868a04d6a0c9fbe996d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C31B2716-19F4-46F5-BB66-201D645C4174"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6d7b1756803","org_name":"Midwest Womens Healthcare Specialists","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/12/04/phi-exposure-case-1500-patients-settled/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmbc.com/news/patient-records-found-outside-research-medical-center/26071174;"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox4kc.com/2014/05/20/medical-records-with-private-information-found-strewn-across-local-field/"}],"summary":"Approximately 1,500 patients were notified of PHI exposure last May at a Missouri facility.  Last May, more than 1,500 women in Missouri had their protected health information (PHI) compromised after their personal records blew out of a dumpster on a windy day.  Midwest Womens He","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80702862e431a5e6b82f8fb64004a0e23ea053f5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98E90353-B419-46DB-834B-A4513B049C11"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"681d13edc314","org_name":"Midwest Orthopaedics at Rush","org_type":"healthcare","ransomware":null,"records_affected":1256,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.chicagotribune.com/2014-04-05/news/chi-chicagoarea-doctors-group-announces-data-breach-20140404_1_midwest-orthopaedics-advocate-medical-group-data-breach"}],"summary":"Surgical information for more than 1,200 patients may have been compromised in February when an unknown person accessed a doctors Gmail account, a Chicago-area physicians group announced Friday.  Midwest Orthopaedics at Rush said in a news release that names and dates of birth fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"330ec5ce349b85fffb151f9835bf2cbec8b80cd4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5A19BED-66B7-440C-95BB-A337EBBECC87"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsledge.com/leak-windows-8-secrets-get-3-months-prison-7113"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/skype-social-media-and-blog-hacked-by-syrian-electronic-army-7000024698/;http://www.darkreading.com/attacks-breaches/syrian-electronic-army-takes-credit-for-skype-hack/d/d-id/1141123?"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesmokinggun.com/documents/Microsoft-Xbox-hackers-576321"},{"fetched_at":null,"title":null,"type":"press","url":"http://segmentnext.com/2014/01/04/xbox-live-downtime-following-ddos-attack-derp/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2014/01/12/microsoft-no-idea-what-to-do-after-breached-by-syrian-electronic-army/#.UtH60u5ay4k.twitter"}],"summary":"A former Microsoft employee who leaked the code for the ARM devices version of Windows 8 has pleaded guilty to stealing company secrets.  The employee, Alex Kibkalo, will serve three months in jail and pay a $100 fine as part of a plea agreement.  So why is this news.  Plenty of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11cf9c8a403dbc5df0456c303be56332008de53c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18EC3FC4-D62E-4D03-B9D3-963E654EC566"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c26bd839f67","org_name":"Miami-Dade County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamidade.gov/mayor/library/memos-and-reports/2014/06/06.27.14-Identity-Theft-of-County-Employees.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/news/local/Massive-Data-Breach-Affects-Hundreds-of-Miami-Dade-County-Employees-262169331.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/news/local/County-E-Mails-Employees-About-Data-Breach-262809151.html"}],"summary":"New report on massive data breach of government employee PII. Still no information on threat actor/action. Government has not discovered a device compromise. WIll model with numerous unknowns.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"079e299ba10c29443e8ddd1714d5c1804dba5b75","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E725360C-B969-433D-BB7B-BF4004800FBD"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8557335ac310","org_name":"Metro Public Health Department","org_type":"government","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/22/second-data-breach-hits-tenn-facility-files-misplaced/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsmv.com/story/26818479/hiv-records-mistakenly-sent-to-metro-school"}],"summary":"The first data breach occurred in July when it was discovered that approximately 1,700 index cards with names, dates of birth, Social Security numbers, addresses and medical coding were missing after the department moved to its new building. The information affected patients in t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2b46841d1d5150ff6a8bdfdef4e0e6d1e74fb6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57B6FA41-1E6F-4469-BB81-D0631D19A6E0"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77bdaa1f9fa6","org_name":"Medical Services of America","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc-2.com/story/28280514/local-nurse-accused-of-exploiting-patients"}],"summary":"A Cape Coral registered nurse was arrested and accused of exploiting some of her patients ranging in age from 65 to 92, according to the Lee County Sheriff's Office.  Lynn Schlosser is charged with criminal use of personal information, identification theft and exploitation of the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"270e8d3d9bbfa837f539d00bc3343b77cba78e9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5EFA49A8-C7EE-4921-A022-3180246A09A8"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eccaa20a123b","org_name":"McDonald's Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/local/crime/fl-accused-skimmer-recruiting-20140514,0,5201549.story"}],"summary":"Man convicted of soliciting a McDonalds employee (through social media) to use a hand held skimmer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03ea2fe6d2005edce7d5ba5072eb5529df64cb68","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80C48D4D-E246-458F-8020-A939E3CBBB85"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"ee46a051c5e5","org_name":"Mass Event","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Supporters-of-Nationalist-Party-Svoboda-Hack-Ukrainian-Government-and-Media-Sites-422886.shtml"}],"summary":"Hacktivists who back the Ukrainian nationalist political party Svoboda have allegedly breached and defaced a total of 300 Ukrainian government and media websites. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"134512e4ecbc2040e29c9328e2c89d84c2bfb895","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE96934D-AC0A-40F2-81AD-D33DBDFA2C3F"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed9d370f76b9","org_name":"Maryland Health Benefit Exchange","org_type":"government","ransomware":null,"records_affected":1078,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc2news.com/dpp/news/state/medicaid-mailing-mishap-leaks-personal-information;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/md-medicaid-mailing-mishap-leaks-personal-information-state-blames-health-exchange-contractor/"}],"summary":"The Maryland Health Benefit Exchange has another problem on their hands after hundreds of Medicaid enrollment packages were mistakenly mailed to the wrong addresses.  The Maryland Department of Health and Mental Hygiene explained they were first alerted to the problem on Friday. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33b3efa77fdec7f13083f9bc93424bcc62ae913f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3205A2D-992C-4087-8FFA-35A7458B927E"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9707ae1b0f41","org_name":"Martin Army Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtvm.com/story/33297919/martin-army-community-hospital-alerts-patients-of-possible-hipaa-violation;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ga-martin-army-community-hospital-cant-individually-notify-1000-patients-impacted-by-insider-breach-that-began-in-2011/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://3dpromote.com/martin-army-hospital-warns-patients-of-possible-hipaa-breach/"}],"summary":" possible HIPAA breach occurred at Fort Benning","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fefe92cc8f07150ffd1f582efe448f191dd094f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D479C4D-E345-44BA-AC69-4D90164E5097"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32972486ab51","org_name":"Marian Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/marian-regional-medical-center-notifies-patients-whose-files-were-sent-to-the-wrong-insurance-plan/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Final%20Patient%20letter%20with%20phone%20number_0.pdf"}],"summary":"Marian Regional Medical Center (part of Dignity Health) recently notified patients after electronic files with limited patient information was sent to the wrong contracted health insurance plan during the first week of March. The agent who received it promptly notified MRMC.  Acc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Islamic Cyber Resistance (ICRG)","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a81bc497e4d7e1d3a51e29b11d1010a624fa1640","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63D72315-DA6B-4D99-8DA3-3C8F9D2B20B2"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"3ced6a1cbe90","org_name":"Manpower Corporation","org_type":"other","ransomware":null,"records_affected":70000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/opsavegaza-anonymous-iran-hacks-israel/"}],"summary":"A group of Iranian hackers going with the handle of Islamic Cyber Resistance (ICRG), who call themselves Anonymous as well have claimed to breach an Israeli job (http://www.zerem.co.il/) website and leak personal details of 70,000 registered users. The breach was conducted under ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"islamiccyberresistance"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61d32a1fbf9c1593182331d9872496c3d565b6d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8899211E-A9B6-48FF-ACDC-0ECECD53820B"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3346423982a","org_name":"Macon-Bibb","org_type":"government","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.macon.com/2014/04/03/3028447/macon-bibb-scrambling-to-fix-personal.html?sp=/99/148/;http://www.macon.com/2014/04/29/3072436/macon-bibb-tells-more-than-12000.html?sp=/99/148/"}],"summary":"Mispublication of application information puts 12000 PII records at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5b04d4457a8ada699571337f5f8881e9655ef53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"673146C8-F64B-472C-9D56-95275DD4430C"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"734bdb48b445","org_name":"M.D. Manage","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2014/05/29/cbs-2-exclusive-n-j-medical-billing-company-leaves-records-out-in-the-open/"}],"summary":"Records from the New Jersey medical billing company M.D. Manage have been the subject of a huge data breach, with sensitive information from hundreds of local residents posted on the Internet for everyone to see. Social Security numbers and tax information were all out in the ope","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67ff7b0051e365cf9954d163fe25553209fc94fe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F514849-50A4-48EC-9C16-88D562F70CB9"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"de48febc820d","org_name":"Lutheran Church Australia","org_type":"nonprofit","ransomware":null,"records_affected":1484,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2014/02/22/lutheran-church-australia-hacked-1484-user-accounts-leaked/"}],"summary":"Lutheran Church Australia Hacked & 1,484 user accounts leaked","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58d8aad4b5dcba51694b7155468f6e5a56f2ff7e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C68E906-7F6D-4593-8DFC-915A07C4DC79"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d8af1c47c4f","org_name":"Liberty Tax Service","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazettetimes.com/philomathexpress/local/ups-driver-s-tip-leads-to-arrest-of-alleged-rip/article_3d6cb6c8-d4a9-5a21-af91-066eb7f31642.html"}],"summary":"It's the busiest stretch of the mailing season from mid-November through Christmas. But for the United Parcel Service, one of its drivers not only focused on the timely delivery of packages, but also helped Philomath police nab a bad guy.  The UPS driver, who regularly serves the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"403b75a31404530471bcb20c36fc22e389bc203a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05C349C4-BE1F-430A-841A-272CD26EC974"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef06c5538fcd","org_name":"LeapLab","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/12/payday-loan-network-sold-info-to-scammers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ftc.gov/news-events/press-releases/2014/12/ftc-charges-data-broker-facilitating-theft-millions-dollars;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ftc.gov/system/files/documents/cases/141223leaplabcmpt.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/wp-content/uploads/2014/12/sunyich-et-al.pdf"}],"summary":"According to the FTC's complaint, data broker LeapLab bought payday loan applications of financially strapped consumers, and then sold that information to marketers whom it knew had no legitimate need for it. \"At least one of those marketers, Ideal Financial Solutions __ a defend","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9d5e60bf3ea8ac2b88fc8f0a7efed0cdc8e4e96","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FB8D06D-DDE6-4D66-B61F-F0E15196ACCD"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c969b8aab2e0","org_name":"Lawrence Melrose Medical Electronic Record","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12037"}],"summary":"On Tuesday, Lawrence Melrose Medical Electronic Record, Inc. in Melrose, Massachusetts notified the New Hampshire Attorney General office that an employee of a medical practice  improperly accessed the EMRs and patient registration information of patients at six medical practices","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19748fc1d92fffc810b0d0867ff7dab47c7115e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68763E6A-8CBB-45A4-9E29-56EBD99FA592"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"b83d09082877","org_name":"Lakes District Health Board","org_type":"government","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/65138103/abortion-data-leaked-by-mistake"}],"summary":"A privacy breach blunder has resulted in personal details of more than 600 females, some as young as 13, who had abortions in the central North Island being given to a reporter.  The data was mistakenly released by a junior staff member at the Lakes District Health Board who was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22710a977ddb30d624410728d54be954fbd9e1c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F72AD11-5AAA-45F5-B8F7-933EECF40C8F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe12c5bc4e5f","org_name":"Ladies First Choice","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ladiesfirstchoice.net/wp-content/uploads/2014/04/LFC-HIPAA-Notification-Letter.pdf"}],"summary":"Insider took customer personal info and is using it to solicit those customers at a competing business. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a53d10d068ad33e17082257a12937b08396e3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d0674c40-e440-11e7-977c-0b3846f56840"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ac37f7bde51","org_name":"La Gloria Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/former-owner-of-florida-pharmacy-convicted-at-trial-of-700000-medicare-fraud-scheme/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/usao-sdfl/pr/former-owner-miami-based-pharmacy-convicted-trial-700000-medicare-fraud-scheme"}],"summary":"The former owner of a Miami based retail pharmacy was convicted, following a three-day trial, for his participation in a scheme that involved the fraudulent submission of approximately $700,000 dollars in false billing to Medicare by stealing the identities of doctors and Medicar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0fababca1a99b0be15b136f319ea114728abf9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CE4FCBC-819E-46DC-A621-2F6B8B96AB00"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/l-a-care-health-plan-replacing-some-members-cards-after-unintended-exposure/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notice%20FINAL%20220_0.pdf"}],"summary":"For 2 days, \"manual information processing error\" causes authenticated customers to see information about other customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78e2d2080b28cd3a2ad42288a35e6ed015556ae2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D0F9CD5-3EAF-4BF3-BF9B-BC2F16C38971"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"f48c516aa7ea","org_name":"Korea Coast Guard","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.yonhapnews.co.kr/national/2014/05/08/68/0302000000AEN20140508003600315F.html"}],"summary":"Korean Coast Guard officer leaked information regarding an on going investigation to friend who could be involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1206443b175e2d93edf058801faf03d10dd633ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6954B63-E731-4586-A199-35088EEE6B59"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e2ece0a2224","org_name":"Koch Brothers","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.motherjones.com/politics/2014/02/koch-brothers-palm-springs-donor-list"}],"summary":"The Koch Brothers Left a Confidential Document at Their Donor Conference","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa21b890ef5697891409e9c92da23ef0950671e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F61D5071-1734-4277-BDC4-CE523F924BC8"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f528c5b996bb","org_name":"Kettering Health Network","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wdtn.com/2014/08/13/hospital-responds-after-privacy-allegations/"}],"summary":"When you go to the hospital you expect your private health information to be kept private.  But 2 NEWS Investigates uncovered a lawsuit by two local women that alleges they repeatedly had the privacy of their health information violated by employees at Kettering Health Network, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b19b44bd8c0f2cc57100bbee8f566b170ee70c6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6102699B-FF77-4844-A8F7-64E4318BA3A2"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"3d81ae3fa9b6","org_name":"KCG Holdings Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2014/06/04/kcg-holdings-theft-idUSL3N0OL0D220140604"}],"summary":"Employee allegedly stole code before leaving company and took it with him to new employer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de6ee8502791748038c5c751f7c3e1fab947b2f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C58540E-27A7-4599-8AB6-C7921A14DA47"},"incident_date":"2014-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"e83717d66c22","org_name":"K Box Entertainment Group","org_type":"other","ransomware":null,"records_affected":90000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.todayonline.com/singapore/slack-security-measures-led-leak-k-box-customers-data"}],"summary":"one character password was \"brute forced\" to access DB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff1e0694966abe4f4bcfd97dac2d66f4e5a74cda","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF364902-10F9-4C2E-A2DA-73E5CFB29E4B"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"a1e79505c1c6","org_name":"Jobs.sy","org_type":"other","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/european-cyber-army-hacker-targets-syria.html"}],"summary":"European hackers leaked over 60,000 full names, user names, phone numbers and home addresses, along with several encrypted passwords and several in clear text from syrian websites Jobs.sy and RealEstate.sy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d7524321c6f9c2f132e49eb6a23ebc9b2f7d94a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5D2EE43-143A-430D-BAED-4D6CCD4CCF43"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4401f7a9352","org_name":"Jersey City Public School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/news/region-state/jersey-city-probes-possible-student-data-breach-1.8435286"}],"summary":"A possibility exists that the METS Charter School obtained students' names, addresses, phone numbers, birthdays and possibly Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"950ba57477841450e3e44c4a4c390bde260b14c7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"000D403E-2DC9-4EA7-9294-BD3938D1C3C7"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1503a42e7aa6","org_name":"Jersey City Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.njbiz.com/article/20140811/NJBIZ01/140819976/Jersey-City-Medical-Center-suffers-data-breach%3B-2011-Medicaid-patient-info-lost-in-transit;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/patient-data-at-risk-following-missing-unencrypted-cd/article/365919/"}],"summary":"Jersey City Medical Center said a computer disk containing 2011 Medicaid patient information was lost in June when a package sent via United Parcel Service failed to arrive.  The medical center, part of the Barnabas Health system, said that on June 13, 2014, it sent the disk to a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be6b2f381e26d9d22e531b35e5026338bc3b89ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"769A12FE-59F7-405D-9343-B7F79DB376AC"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c13d5675e024","org_name":"Jefferson Medical Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ms-jefferson-medical-associates-notifies-patients-of-new-and-old-breaches/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdam.com/story/32574292/laurel-clinic-warns-patients-of-data-breach"}],"summary":"Database misconfigured with default setup had no security; found by security researcher.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"102e78ca1861d3210a51cabf9c0185e38c88ee29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCDDC231-D4BF-4BDC-A236-4D06533D5CE7"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"67f5ae4c2c55","org_name":"James Paton Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ntv.ca/privacy-breach-at-central-health/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://home.mytelus.com/p/news/source/news_cp/category/health/article/29631524"}],"summary":"Central Health has been contacting a group of clients after their private health information was accidently sent to a private company in Alberta. Today the health authority is continuing to correct the situation and make changes to prevent it from happening again. NTVs Colleen Le","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be11e26c475a413fe456de029160652b21c94c20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C6BA3B8-3DA5-48E4-8173-D2B99831CA4F"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"0886d3892e31","org_name":"James Dean Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spec.com.au/blog/2014/05/06/medical-privacy-breach-probed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/au-prescription-records-found-strewn-in-street-after-contractors-employee-forgets-to-shred-first-then-haul/"}],"summary":"Hamiltons James Dean Pharmacy has resolved the issue with its secure document disposal contractor after a number of prescription receipts were left beside Digby Rd earlier last month.  The documents were strewn across 30 metre stretch of road on April 24 and the contractor respon","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d303f6c7f3343b24b1925708791c95d89fe37007","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFA352CA-24D1-46B8-A162-5E083878A9BE"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"555bd89113a7","org_name":"James A. Haley VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/military/veterans/man-accused-of-stealing-haley-va-patient-id-info/2194269"}],"summary":"The documents with the Social Security numbers of veterans treated at the James A. Haley VA Medical Center were supposed to be shredded by a company whose website warns, \"Don't become a victim of identity theft.\"  But the firm, federal prosecutors say, employed a 24-year-old with","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"AR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f93c76b7f5e54bd361af8805732a8f506f6f6c1e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FBD2992-44EB-4AA8-9A48-CFA6DC7809E0"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"453b8376c990","org_name":"Jaime Delgado Zegarra","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Peruvian-Congressman-Jaime-Delgado-Hacked-by-Argentinian-Group-415450.shtml"}],"summary":"Politician site hacked by Argentinian group. A new directory was uploaded, no modification of home page occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd18d5466455136e0e5c0f680b1763cff0f27e9a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E46B7D78-660F-4093-A088-021129A6BDAE"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"ee9ef58e0c60","org_name":"Israeli Postal Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jpost.com/Defense/Shin-Bet-says-Anonymous-hackers-inflict-minor-damage-on-Israeli-web-sites-347747"}],"summary":"Anonymous launches DDoS attack against Israeli government. Minor successes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16e5af3920ea0f7e6db923792e2f6400c1fbf6f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09EEC02C-ADE7-49E3-9C0F-4007F75059EE"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8de310b70708","org_name":"Island Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ca-island-health-investigating-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pqbnews.com/news/247575061.html"}],"summary":"ohn Harding reports:  One never knows what one will find for sale in the SOS Thrift Store.  The personal information of someone who has sought medical help isnt something one would expect to be for sale, however. Denise Whitson was in the Parksville SOS Thrift Store last weekend,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"793e2c77651c96a52701d427d203463cd56fb2a4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76423401-B9CF-4263-901A-B722FD373CF6"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55a0621ef800","org_name":"Iron Mountain Inc","org_type":"transportation_logistics","ransomware":null,"records_affected":12691,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/long-beach-internal-medical-group-patients-also-victimized-by-two-rogue-iron-mountain-employees;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/iron-mountain-employees-suspected-of-stealing-selling-old-x-rays-files-for-silver/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lbimg.com/LBIMG%20Media%20Notice%20081414.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://technologyadvice.com/cloud-backup-and-storage/blog/iron-mountain-data-warehouse-burns-buenos-aires/"}],"summary":"Based on Iron Mountains internal investigation conducted by members of its Global Security group, Iron Mountain believes some of the missing files were stolen through the actions of two individuals who were employees of Cornerstone Records Management, a company acquired by Iron M","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b5dd176c3ce5f7b4cb175e8a576809b160a8afd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"490AD16C-4484-4841-AEB9-60F544DA7A53"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45d970812f95","org_name":"Internal Revenue Services","org_type":"government","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2014/nov/2/irs-employee-not-guilty-of-inadvertent-disclosures/"}],"summary":"IRS employee stored personal computer to store records of IRS personnel, and stored it on a FTP server which was indexed by Google and thus made available on the net.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70a57858c7b952547a2c23facf91062198e518c2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A8C1D63-AB1A-4187-9A50-CFB89154EFC4"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Employee-Exposes-Personal-Data-of-20-000-IRS-Workers-433193.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2014/03/18/usa-tax-data-idINDEEA2H0GM20140318?rpc=401&feedType=RSS&feedName=technologyNews&rpc=401"}],"summary":"The United States Internal Revenue Service (IRS) has suffered a data breach in which the personal details of 20,000 employees have been exposed. The incident is a result of an employee mishandling an unencrypted thumb drive, not a malicious attack from outside the organization.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78338d5a2ec391946424c8f8a97b73e341ea8fd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"913E3962-6CEB-4E07-BDC0-F0D03E14A401"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3a42cf1ec2d1","org_name":"Interactive Response Technologies","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://identitytheftsolutiontips.com/eight-indicted-in-id-theft-fraud-scheme-in-broward-sun;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/fls/PressReleases/140603-01.html"}],"summary":"Internal actors, conspiring with external actors used access to customer PII to  add themselves as authorized users of victim payment cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2014-01-01","discovered_date":"2017-11-23","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d90f112f4710680572d974d602907b12d650191b","impact_type":"data_theft","incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Email%20for%20Impacted%20Users%20from%202014%20Data%20Breach_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"859d1473d85a","org_name":"Imgur","org_type":"technology_saas","ransomware":null,"records_affected":1700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.medianama.com/2017/11/223-imgur-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theregister.co.uk/2017/11/27/imgur_breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.engadget.com/2017/11/24/imgur-hack/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-113864"},{"fetched_at":null,"title":"Have I Been Pwned: imgur","type":"hibp","url":"https://haveibeenpwned.com/Breach/imgur"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Email%20for%20Impacted%20Users%20from%202014%20Data%20Breach_0.pdf"}],"summary":"Imgur reported that an unauthorized third party stole user account data, including email addresses and passwords, in a breach that occurred in 2014.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9c256d23753c5437e8cca4d1153ddd4890d99a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75B67072-BF5A-47AD-B186-953F1854DCAC"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"3a21e5c95f50","org_name":"IDOX PLC","org_type":"other","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2623853/Electoral-roll-data-leaked-Millions-names-addresses-illegally-sold-junk-mail-firm.html"}],"summary":"Millions of voters had theri PII provided to direct marketing agencies against their wishes. A software error redacted their opt-out of having their information provided to third parties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d04ca6c47fb366c813694f2d38bcda8c2c5ac71","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2823B704-2C58-49C8-9E42-A0F36518F83A"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aef88e9dd69a","org_name":"Hurricane Electric llc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fireeye.com/blog/technical/targeted-attack/2014/08/operation-poisoned-hurricane.html;http://blog.trendmicro.com/trendlabs-security-intelligence/unplugging-plugx-capabilities/"}],"summary":"Targeted malware campaign aimed at internet infrastructure providers, financial services, and government.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e996d9648b32c0918272d0ac317936268c42b6a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C21444F-9269-4F1D-9A9F-B238F80180D5"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"516fa16089b7","org_name":"Hunter United Credit Union","org_type":"financial","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2013-11-18/anger-over-credit-union-breach/5098078"}],"summary":"Customer email addresses were copied in an email to at least one customer. That customer notified the other parties via email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d6fc1c794ace15a8eeca61dd2c22cbd1a2f3dca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"701ED674-99AF-48A3-8D10-13D29A03A151"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c09c92c8d004","org_name":"Humber River Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/gta/2014/10/22/second_hospital_admits_breach_of_mayor_rob_fords_privacy.html#"}],"summary":"A spokesperson for Humber River Hospital has confirmed individuals gained inappropriate access to Mayor Rob Ford (open Rob Ford's policard)s medical records.  Gerard Power, director of public and corporate communications for the Toronto hospital, said in an emailed statement to t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a659b9300436d3ee82178b0009aff32c20aa023b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0281F3B-92F2-4F10-80D6-1715D6D98E66"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc","org_type":"financial","ransomware":null,"records_affected":2962,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.11alive.com/story/news/local/2014/05/23/humana-security-breach/9506077/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tweaktown.com/news/38018/humana-customers-at-risk-data-breach-of-unencrypted-usb-drive/index.html"}],"summary":"Health care company Humana is warning Atlanta residents about a possible security breach that could affect nearly 3,000 members in the area.  According to the company, an Atlanta-area Humana associate's vehicle was broken into and an unencrypted USB drive was stolen with the asso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d04e7a3d993c26b31b625b36b4caceeaa6ba3885","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50108842-B865-464F-8C69-8851762F7600"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"fd67d429ece9","org_name":"HSBC","org_type":"financial","ransomware":null,"records_affected":2700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/2014-11-13/hsbc-loses-2-7-million-customers-data-in-turkey-attack.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.asia/hsbc-turkey-confirms-card-breach-a-7558"}],"summary":"HSBC Holdings Plcs (HSBA) Turkish unit said it lost 2.7 million customers bank data in a cyber-attack, after a similar security breach at JPMorgan Chase & Co. (JPM)  The hack resulted in the theft of data on cards and related bank accounts, Europes biggest lender said in an e-mai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2537645347ad91bb34fff169a433597fcb5c22b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5549506A-E66B-4714-93A2-F19519E07AE1"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5121023144a1","org_name":"Hotel Hippo","org_type":"other","ransomware":null,"records_affected":24,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-28107277;https://scotthelme.co.uk/hotel-hippo-insecure/;http://www.scmagazineuk.com/hotel-hippo-closes-for-good-after-data-breach/article/359767/"}],"summary":"NVP found a flaw in victims website that divulged customer personal information (session jumping) and later found them susceptable to SQLi.  As a result of the NVP and publicity, the parent company shut down the service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6175e3486b3f19809512910c0323cf248de1b0a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CDBE12F-2279-49C7-A5D5-95267288546F"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"62a8b3157d55","org_name":"Hospital Auxilio Mutuo","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theboltonnews.co.uk/news/local/10326409.Hospital_notes_found_in_street/"}],"summary":"papers found on street from a local hospital.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ca148c64e6c429942c86c0b4e72962fb46e5bd0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3EA16CF9-45E2-4A1E-96A4-BC48FFA87018"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"0bb7e5477787","org_name":"Homeplus","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreaherald.com/view.php?ud=20140919000623;http://twatchin.com/tescos-homeplus-investigated-bysouth-korea-over-privacy-breach-and-competition-rigging/"}],"summary":"Public furor erupted in July after it was revealed that workers at the Homeplus insurance brokerage division had rigged the raffles to illegally obtain the prizes. Four people, including two officials from the division, had already been indicted for the cited charges.  The offici","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e945dbec61fcbfcb0d52258218079084da01f1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20EBC303-64CF-4392-8D96-7E2F2DB59F66"},"incident_date":"2014-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ae69f5241e8","org_name":"HESS AG","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/nypd/downloads/pdf/crime_prevention/gasstationskimming.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tcpalm.com/news/2014/apr/11/hess-warns-customers-criminals-trying-steal-credit/"}],"summary":"Gas pump skimmers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"410a15c716351a901410f5eb2ed9a13095913902","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18021FAF-2FDE-4C50-8C77-D1281CA63AD6"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1be7f0166bd4","org_name":"Herts Police","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whtimes.co.uk/news/probe_launched_into_police_data_breach_1_2176602"}],"summary":"HERTS Police is being investigated after sending personal details to a private security firm during a failed outsourcing bid.  The force, and its partners in Beds and Cambs, shared information on more than 1,000 of its staff with G4S during fruitless negotiations at the start of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5aae1f51688159435c20b8dfbfd6e63d7225f845","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD0B337F-557F-42EB-B199-FC6A2872699D"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d631befee1a4","org_name":"Hearth of Hendersonville","org_type":"healthcare","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/news/local/hendersonville/2014/04/28/assisted-living-facility-worker-stole-ids-police-say/8422389/"}],"summary":"A temporary employee at a Hendersonville assisted living facility was charged Thursday with three counts of identity theft after one of the facilitys residents called police.  Shamiah Monique Henry, 32, of Nashville confessed to three counts of identity theft at the Hearth of Hen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"469872a02567020a9a22b5625090ac8dcf6c4915","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AAB1B5B-6502-4D67-BE55-F91D28C5570F"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ba63cdf69a9","org_name":"HealthTexas Provider Network","org_type":"healthcare","ransomware":null,"records_affected":2742,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f69ac5bf426203a7fab7de7c677cab3fd8f9700e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF950CBF-B7A5-40CA-83AF-E2674E8CC607"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"840acf23170a","org_name":"Health Sciences Centre","org_type":"healthcare","ransomware":null,"records_affected":322,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegfreepress.com/local/patient-info-stolen-from-laptop-at-hsc-275870041.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegfreepress.com/local/Laptop-stolen-from-HSC-office-held-patients-information-275788361.html"}],"summary":"A laptop containing the personal health information of 322 patients has been stolen from the office of a doctor working at a clinic at the Health Sciences Centre. The Winnipeg Regional Health Authority reported the incident this morning. It did not say which day the computer was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9df1384f8577cd653065b153aa4916c13c95fd2b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CBF8964-F1B4-4A3E-9DE5-4D39A405AF64"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f3823a831e0d","org_name":"Health PEI","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ca.news.yahoo.com/health-records-derelict-buildings-careless-145344597.html"}],"summary":"P.E.I.'s Opposition Health Critic James Aylward is demanding the provincial government move all health and financial records to a secured location at once. Earlier this week, CBC News reported that boarded-up buildings near the Hillsborough Hospital, currently used to store some ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal","medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99078b47c04d2c5f0f3fa1674bbf801f4724b700","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D74FC29C-8D89-4BC0-94BE-8CC7A517F5F5"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6d372bcf17e7","org_name":"Hatfield City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whtimes.co.uk/news/fury_as_confidential_documents_found_blowing_in_the_wind_in_hatfield_1_2267606"}],"summary":"Records blowing in the wind. Papers, believed to have come from the former county supplies depot in Mount Pleasant Lane, included an employee appraisal form which featured a workers name and employment number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2e71ad88c676de576bc3cad0c5d410a6488a482","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D77C34A8-01CA-475D-B963-929EA7D35B0F"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8164f2b61759","org_name":"Harley Medical Group","org_type":"healthcare","ransomware":null,"records_affected":480000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/plastic-surgery-provider-hacked-500000-peoples-data-exposed.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2604805/Cosmetic-surgeons-targeted-hackers-personal-details-500-000-people-enquiries-clinic-stolen.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Details-of-480-000-People-Compromised-in-UK-Cosmetic-Surgery-Company-Hack-437731.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/technology/2014/apr/15/hackers-accessed-details-cosmetic-surgery-harley-medical-group"}],"summary":"Harley Medical Group, a British plastic and cosmetic surgery company based in Thames Ditton, Surrey, has suffered a data breach in which the details of 480,000 individuals have been compromised. The attackers have reportedly attempted to blackmail the company.  According to The G","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6599636eacb7a987f0965bd184d9356d34dc8610","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE678FD1-E70F-41E2-908F-6A4B7FE5AE4C"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c8f285297632","org_name":"Hampshire County Council","org_type":"government","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-hampshire-county-council-fined-100000-after-confidential-social-services-papers-found/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/media/action-weve-taken/mpns/1624822/mpn-hampshire-county-council-20160810.pdf"}],"summary":"Hampshire County Council has been hit with a 100,000 fine by the Information Commissioner's Office (ICO) after documents containing personal details of over 100 people were found in a disused building.  Social care files, along with 45 bags of confidential waste, were found at To","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51b25d6dfb7d8a31bc4f1cf27b46e710f3aafba9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8436210-64F3-41A2-8B9A-361160069974"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5250480db027","org_name":"Hale & Hearty Soup","org_type":"other","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2014/04/30/manhattan-da-hale-hearty-soup-worker-used-job-to-aid-identity-theft-fraud-ring/"}],"summary":"Employee, who was part of a \"criminal ring\" of 11 people, was supplied a hand held card skimmer by boyfriend and exfiltrated at least 60 records to be used for CC fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03633bfd2d35792edbec47f87a5739e7498cbb91","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B20755D-8CDA-4404-BA1F-C76960E802FB"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd44454d4b90","org_name":"Gwynedd Mercy University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/pa-blue-bell-man-admits-tampering-with-gwynedd-mercy-computer-system/"}],"summary":"former faculty member hacking into the school's intranet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3de16415d63dae871a4f1db84c47bb6e65094999","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB0802AD-B689-4EAB-8371-5B1F4F9EDC86"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c825d8f1b9c","org_name":"Grampian Health Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itpro.co.uk/data-loss-prevention/23566/grampian-health-board-rapped-over-patient-data-security-failures"}],"summary":"Scottish NHS organisation warned over mishandling of data after sensitive information abandoned in supermarket  The Information Commissioners Office (ICO) has ordered the Grampian Health Board to clean up its act after suffering six data breaches in thirteen months.  The data pro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f29154abb0c112102ed8873f2e3c88af8b292b77","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A93E4696-57AF-468B-B6C9-CADC2B7FBAED"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"4a31f7af8681","org_name":"Gordagen Pharmacetuicals","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/gordagen-pharmaceuticals-wins-high-court-of-malaysia-judgement-for-breach-of-confidentiality-300087059.html"}],"summary":"Accountant steals confidential information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f00dbce4bd5975df167cd505b67adbf830d7d7a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E76081BD-16EB-4975-B0C8-B5675772B01C"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d72689949ce","org_name":"Georgia Department of Behavioral Health and Developmental Disabilities","org_type":"government","ransomware":null,"records_affected":3397,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.list-online.com/cowetans-info-likely-on-stolen-laptop-newnan-times-herald/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Information on Cowetans who get state help for mental disabilities may have been on a laptop stolen last month.  The good news is that  as of Friday  there are no indications that information has been accessed and there have been no reports of identity theft or other types of fra","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91c879855934d149dba9f81afec405c673f65400","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A167BD1-D1A3-4E32-9E77-B626ADC5B952"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cf60e0772cc4","org_name":"GCHQ","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/uk-intelligence-agency-stores-passwords-in-plain-text-7000013113/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/GCHQ-Websites-Attacked-by-Anonymous-Hackers-426359.shtml"}],"summary":"Blogger discovers that a government career site sent back password information in clear text.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d0d8ad6c75c068efb669bc9401864ea40726a64","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E48CC490-0C18-455E-B186-2A1DDB9B8431"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5273277142e","org_name":"Gastroenterology Consultants","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://miami.cbslocal.com/2014/08/14/hollywood-medical-assistant-pleads-guilty-to-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/local/crime/fl-identity-theft-guilty-plea-20140814,0,7158404.story"}],"summary":"A Hollywood medical assistant has pleaded guilty to two identity theft charges. La Toya Yvette Tillman, 33, used her position at Gastroenterology Consultants in Hollywood to access the Memorial Healthcare System database through her computer at work to steal patient identities, i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"537b56f64b71e056645526bc4c9f763cdf366783","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD176F1A-4D0C-4D18-8B54-7CD080071625"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"6229cb45e96d","org_name":"Garda (Irish Police)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/gardai-checked-private-files-on-model-more-than-80-times-30115460.html"}],"summary":"CONFIDENTIAL information on six \"high-profile\" personalities on the Garda Pulse computer system was accessed \"inappropriately\" by members of the force.  The multiple access to their details was uncovered by auditors from the Data Protection Office.  The findings, in a report publ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba3d640ecbf4a821bdc84b9cf1289d3bbff1dff5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4E0D5C8-C103-4AFE-ABEB-F6700BB45D39"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bffd784f94ec","org_name":"G.E. Consumer Finance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://olatheedge.com/news/2014/04/30/7956-olathe-man-pleads-guilty-to-computer-fraud#.U2Ph99q9KSM"}],"summary":"Employee used various credentials to login to the companys databases and transfer account numbers and information including customers names, dates of birth and Social Security numbers in exchange for Bitcoins.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"501a5e2e85191d30ddec14285a458d16ae23a1e6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A816DA24-CEF3-412C-BE36-F544127D9935"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7146708f037","org_name":"Fort Lauderdale-Hollywood International Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs12.com/news/top-stories/stories/vid_15460.shtml"}],"summary":"Dozens of flights were delayed, rerouted or canceled Wednesday when a construction crew cut a fiber optic cable at Fort Lauderdale-Hollywood International Airport, aviation officials said.  The crew was working outside Terminal Four when the line was severed just before 4 p.m., a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5e54d747a2cd4031d2b481291234d5bab6b70f7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3617DDBB-3279-41BF-83D3-9CCF558D8ABD"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"770f575e5c55","org_name":"Flying J","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.richfieldreaper.com/news/local/article_8825e54c-5158-11e3-8c0e-001a4bcf887a.html"}],"summary":"Credit card skimming devices were found at the Flying J truck stop in Richfield Nov. 11. The last time credit card skimmers were found in Richfield, it resulted in two men being arrested and charged federally for credit card fraud in 2010. The men were caught on surveillance vide","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd36384b16de4fc71f4a61ffc0cde660477cadb5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B2A07EE-E4C7-4D23-8764-2CF66100BFA4"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96ebe0b47b81","org_name":"Federal Privacy Commissioners Office","org_type":"government","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-federal-privacy-commissioners-office-loses-backup-drive-with-personal-information/"}],"summary":"Lost hard drive with 800 PI records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b08996c067feeab228f0613ac9001609748618fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"800FFA62-BA0D-4FDE-AFEC-8F86DA346D57"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d9c1e2d3574","org_name":"Family Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wabe.org/post/nurse-indicted-health-care-fraud-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mediad.publicbroadcasting.net/p/wabe/files/201502/Indictment021715.pdf"}],"summary":"A wellness nurse practitioner in Stone Mountain allegedly pocketed more than $1 million by charging insurance companies for services she never performed.    This week, a federal grand jury indicted her on charges of health care fraud and identity theft.  Between May 2013 and Sept","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfd1e33e3ee50f3cfc972ce65019a8c6b31f9258","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A73B4191-BF5F-448B-992A-FE2013867453"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d30eb67d4ad7","org_name":"Essentia Health","org_type":"healthcare","ransomware":null,"records_affected":430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/essentia-health-patients-angered-over-sharing-of-information-to-marketers.html"}],"summary":"Duluth, Minn.-based Essentia Health has acknowledged a patient information breach after several patients complained that their names and addresses were given to a marketing firm without their consent, according to a Jamestown Sun report.  The marketing firm sent out invitations t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db74f9e8db7cfef50949297125f7ca643a0eddd4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A77AA791-6319-411D-A34D-E246BC2D1AC2"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"08869b81dacd","org_name":"Epsom and St Helier Hospitals NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gponline.com/gp-anger-outrageous-loss-patient-blood-samples-data/article/1306933?HAYILC=SHOWCASE"}],"summary":"Merton Police have called off the search for the van, stolen with up to 300 vials of blood, smears, other samples and patient-identifiable data, because of a lack of evidence.  The vehicle was stolen from outside a GP practice in Surrey after collecting test samples from 10 pract","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b9f316e031b2cae6acaaa0fb90ad307ae57e70d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E04532A-65A3-491B-9489-59C4DB6F56A9"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"119116b5bb24","org_name":"ENT Partners of Texas","org_type":"healthcare","ransomware":null,"records_affected":789,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/burglars-steal-ent-patients-information/"}],"summary":"One laptop contained several hundred audiology tests. The data on the laptop containing the audiology tests was limited to the patients name, audiology test, and possibly date of birth. The data on the stolen computer did not contain the patients address, social security number, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9494dc7950782b61d4a00c3fde9624043d127825","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBF240DF-157F-44D2-8BB6-8E9A14262278"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bb255912099d","org_name":"English Defence League","org_type":"nonprofit","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-22698510"}],"summary":"Anonymous released a list apparently showing the contact details of English Defence League members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6e507288026add79130ad555063f09f37e73604","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B356D3E7-A041-427F-9477-D25AF2F6E9C6"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8bb077a25c06","org_name":"EnerVest","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9248499/IT_pro_gets_4_years_in_prison_for_sabotaging_ex_employer_39_s_system?taxonomyId=17;http://www.statejournal.com/story/25567009/enervest-saboteur-gets-four-years-in-prison-ordered-to-pay-428000-restitution-100000-fine;http://www.wsaz.com/news/headlines/Former-Engineer-Sentenced-to-Prison-for-Destroying-Companys-Computer-System-259992681.html"}],"summary":"In June 2012, Ricky Joe Mitchell found out he was going to be fired from EnerVest and in response he decided to reset the company's servers to their original factory settings. He also disabled cooling equipment for EnerVest's systems and disabled a data-replication process.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee47749504552d7dc33984bece0fd6723b60cda8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CA8005D-C670-41E3-8B72-291DEB3C7D76"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c52919609c13","org_name":"Empowerment Non-Emergency Medical Transportation, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/in-founder-of-empowerment-non-emergency-medical-transportation-found-guilty-of-fraud-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.fbi.gov/contact-us/field-offices/indianapolis/news/press-releases/wanda-c.-shorter-found-guilty-by-jury-trial"}],"summary":"From 2011 to 2014, in the Northern District of Indiana, the defendant knowingly engaged in a scheme to defraud Indiana Medicaid and knowingly misused the means of identification of Medicaid clients. As part of the fraud scheme, the defendant caused billings and claims for reimbur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd095bfcd63de0398cebb77c456a7ac8497f7823","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"480FB8D3-4BBA-43BB-85CA-11C2C93A7CC9"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"c86507fb28e8","org_name":"eircom Limited","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/business/technology/eircom-urges-email-users-to-change-passwords-after-security-breach-30232171.html"}],"summary":"Eircom detected an intrusion into their email system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Eugene Belford","variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8f874ed454bac2f777604fd2d8dd6f07245f94e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD71EF22-F735-4AE9-A9A4-3F39DABF6169"},"incident_date":"2014-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a09755692dd","org_name":"Ec-Council Foundation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/03/13/ethical_hacker_cert_org_pwned/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecnews.org/so-who-hacked-ec-council-three-times-this-week/#.UxnmDnk3-5c"}],"summary":"Unaffiliated hacker utilizes DNS hijacking to route traffic destined to EC-council's domain to a controlled website. The same threat actor was able to access the control panel for the website and gain access to their enterprise mail server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"eugenebelford"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cca5eb2a79248b6f4ae5226079585481400b4d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"040A2937-FB99-45E0-B9A5-D35A34EA2143"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"7675e434bd61","org_name":"Earthquake Recovery Commission","org_type":"government","ransomware":null,"records_affected":83000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.labour.org.nz/media/eqc-privacy-breach-affects-67000-people"}],"summary":"Following a disclosure on March 22nd that a privacy breach at New Zealand's Earthquake Commission (EQC) had exposed the personal information of 9,700 claimants, the EQC has now stated that information was exposed regarding all 83,000 people who filed 98,000 claims following the F","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f66c7c61e067b9933262b1132574788c3285a55","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74B37E79-ABA4-46CB-8132-CE59AE76D50F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43d6cf842fe0","org_name":"Early Learning Coalition","org_type":"healthcare","ransomware":null,"records_affected":177,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbs12.com/news/top-stories/stories/vid_21310.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.palmbeachpost.com/news/news/state-regional-govt-politics/data-security-breach-reported-in-palm-beach-county/njRb3/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cbs12.com/news/top-stories/stories/local-security-breach-compromises-peoples-information-21310.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-early-learning-coalition-of-palm-beach-county-announces-breach-at-family-central-inc/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/12/15/personal-data-of-200000-compromised-by-former-employee/"}],"summary":"A former employee improperly accessed the personal data of approximately 200,000 individuals.  Often discussed on this website is the importance of healthcare organizations  and facilities that store individuals healthcare information  must have the necessary HIPAA administrative","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3419a44e54b9faaea7cbf59a6fbd155750e67250","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFA3654D-8F46-4EB5-9DA3-BFB2A7CE89DA"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"2c6027446be4","org_name":"Dublin City University","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/business/technology/news/dublin-university-students-targeted-in-cyber-attack-30478542.html"}],"summary":"STUDENTS in one of the country's largest universities have been warned to change their passwords after a user's login details were compromised in a 'cyber attack'.  The Office of the Data Protection Commissioner was alerted by management at Dublin City University (DCU) last month","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce25df9b32b58d681eb67442e197fb66a383595d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E9F9932-9E6B-440E-A9A8-6E0D6F80C873"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc38363a1341","org_name":"Dr. Nisar A. Quraishi","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/23/potential-health-data-breach-40000-patient-records-stolen/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/update-on-jersey-city-theft-of-patient-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/jjournal-news/index.ssf/2014/10/docs_stolen_records_were_for_i.html"}],"summary":"A New Jersey doctors storage shed was reportedly broken into and 40,000 patient records were stolen.  The case of a potential health data breach in New Jersey has grown stranger throughout the week.  On Tuesday, Dr. Nisar A. Quraishi found that both latches on the shed door of hi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"154979d1c1fb2d8b1ac94234e023c1934de6807d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72B321D9-E313-442E-858C-8F7C1C37F0B6"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"43b7f43c6af3","org_name":"Dr. Axel Velez","org_type":"healthcare","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen desktop leaves 2800 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Legionnare","variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f4a2ca4a896bc596abc1b71bcec0032a63214f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDB75E84-D1EA-4166-99AE-69B16F131B96"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"427b487c7a77","org_name":"Directors Guild of Canada","org_type":"nonprofit","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Clear-Text-Passwords-of-over-2-000-Users-Leaked-from-the-Director-Guild-of-Canada-414106.shtml"}],"summary":"Clear Text Passwords of over 2,000 Users Leaked from the Directors Guild of Canada","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"legionnare"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db3657d3fe8cfbd9115e7559da9c13ad28991f60","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF519EB5-AFCA-446F-A6A9-9529DFB7BE02"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"67d98b61db7d","org_name":"Diagnostic Health Systems","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-27864798;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/shameful-data-breach-may-affect-10000-nhs-patients/article/356073/"}],"summary":"The personal data of up to 10,000 NHS patients may have been compromised in a data breach that one leading industry expert has described as showing a \"truly shameful level of negligence and disregard for personal data\".  NHS website directs visitors to malware NHS website directs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ea18be436910296dd482ea47f00a03c1a606205","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23FD1B2C-2E9A-4391-9AD6-0D68FC1B772B"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.washingtonpost.com/local/public-safety/woman-accused-of-stealing-identities-from-veterans-affairs-workers/2016/10/11/658d6580-8fd7-11e6-9c85-ac42097b8cc0_story.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://baltimore.cbslocal.com/2014/07/14/congress-to-hear-testimony-about-mishandled-records-at-baltimore-va-office/"},{"fetched_at":null,"title":null,"type":"press","url":"http://abc7chicago.com/archive/9398689/"}],"summary":"Employee misuse ID theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2bf59122629dfda02f19a26621b493111a7f3ca","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2cb22d40-e92f-11e9-b01d-8d8474fb7a4b"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"de520654dae5","org_name":"Department of Employment Affairs and Social Protection","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thejournal.ie/personal-data-tipperary-car-park-3727072-Dec2017/"}],"summary":"Data files of one man stolen from car of Social Protection employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cd3c4cd9b5209f566934114d392cef8e00a6229","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6AFE976-6043-4762-906C-49F74C8BA94B"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d6088bed46f","org_name":"Dental Arts Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://foreignaffairs.co.nz/2015/02/28/dental-practice-owner-charged-with-health-care-fraud-and-identity-theft/"}],"summary":"Nazanien Ebrahimi, a/k/a Nancy Ebrahimi, 32, of Fairfax County, Virginia, was indicted by a federal grand jury on February 26, 2015, on charges of wire fraud, health care fraud, aggravated identity theft, and making false statements relating to health care matters. Dana J. Boente","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43e04f5523086bfda03342e3e4564f70fdebbc11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43437810-64A5-4D55-B3FF-A31D09195B81"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"f945b8fd8bb5","org_name":"Delhi Metro Rail Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehindu.com/news/cities/Delhi/shocking-breach-of-privacy-says-ncw/article4904699.ece"}],"summary":"Video footage of passengers engaged in sexual acts was leaked/stolen from the Delhi Metro Rail Corporation. No info on who did it or how.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"489454363de50d4ba42ddd8fcbb2df4a821b32a1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0FA64B7-8596-4D95-8D55-121ADD4CB554"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09caea35b333","org_name":"David Digiallorenzo DMD","org_type":"healthcare","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48678436ad5f713cc4e0b79d9fa6941d9af14fcb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20BDB44C-4860-46FA-950B-7BBCBBA73D26"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"502dbc11668b","org_name":"Dave & Buster's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/dave-buster-s-waitress-accused-of-stealing-credit-card-numbers"}],"summary":"A waitress at a Dave & Busters location on Long Island has been arrested and stands accused of being involved in an identity theft scheme and using a skimming device to collect credit card information from customers, Nassau County police said March 17.  Investigators allege that ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7e5a47a75fb9e1af641f0d21e744bfb43b7452f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"899EB808-02D9-409A-9C5F-18A25793CEB9"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a92931b59d01","org_name":"D.W. McMillan Hospital","org_type":"healthcare","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.brewtonstandard.com/2014/11/04/woman-faces-76-theft-charges/"}],"summary":"A Brewton woman was indicted on more than 70 charges of theft and identity theft after she allegedly used patient information to file false insurance claims. Subrina Barlow is charged with 35 counts of theft of property II deception of the elderly, four counts of theft of propert","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f0cd9f137ae2ebc7075f343ecd7c6d9cf13d72c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"151BB776-14C2-468C-A615-AC550F82B575"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e56cf4f2ce58","org_name":"D&J Optical Inc.","org_type":"other","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24754946016aa39bceea53e2a111064a789735e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F77B892A-9E0A-4A67-B5B3-7A2858FE04BC"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"5755f239306a","org_name":"CVS Caremark","org_type":"other","ransomware":null,"records_affected":4395,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/content/northrop-grumman-retiree-health-plan-cvs-caremark"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/programming-error-results-in-cvs-caremark-mailing-blunder/article/363641/?utm_term=OSINT&utm_source=twitterfeed&utm_medium=twitter;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/news/local/customers-concerned-after-cvs-prescription-info-mi/ngqnH/"}],"summary":"A breach involving paper records from CVS Caremark affected 4,305 Northrop Grumman Retiree Health Plan enrollees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ed11314393de3e9ab7e8072c3ac98bf2b143540","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25C7BF98-4CFB-4712-9211-A9EE9415C88B"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"ace2d5164492","org_name":"Crytek","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techspot.com/news/53517-crytek-security-breach-results-in-possible-loss-of-user-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.joystiq.com/2013/08/05/loss-of-user-information-in-crytek-security-breach-is-possible/"}],"summary":"Crytek recently took down a number of their websites following the discovery of suspicious activity. The company said in a press release on the matter that the incident may have resulted in some users login data being compromised. Were told that the security breach affected Cryte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea4abe6c83ecb8b30166e693c4a67ee1fdab5f00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F69F37B-7502-440C-9C1B-FE389B39BFAC"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb6c9a950f9b","org_name":"Cozby Germany Hospital","org_type":"healthcare","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ketknbc.com/news/crimewatch/etx-hospital-owner-convicted-of-health-care-fraud"}],"summary":"A Dallas County, Texas, physician has been convicted of 15 counts of health care fraud violations in the Eastern District of Texas, announced U.S. Attorney John M. Bales today.  Tariq Mahmood, 63, of Cedar Hill, Texas, was found guilty by a jury of conspiracy to commit health car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93173d18e00e41f1756e4d4ab311bd30f7a994f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A00869B-D847-41AD-B5B0-F28AE6915BEC"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b25e9ffec15a","org_name":"Cover Oregon","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldandnews.com/news/ap_news/cover-oregon-team-looks-into-security-breach/article_d97c621c-55b8-11e4-92af-d751b8f03f7e.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://lockerdome.com/6307147461963585/7067093708325652"}],"summary":"customers data was mailed to wrong customer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e54cf7007b154309e201da6ad3c39b77f682a46","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0008DADB-E83D-4278-A19A-CEE01610CF43"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"81b4eea97129","org_name":"Corvallis Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/12/11/laptop-with-phi-stolen-from-oregon-employees-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.corvallisclinic.com/clinic_information/patient-privacy-disclosure"}],"summary":"Patients at an Oregon healthcare facility were notified this week that their protected health information (PHI) was potentially exposed after the theft of an employee laptop.  A Corvallis Clinic employee was attending a work-related conference in Portland in mid-November and had ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"669269b5e92381235d1a9941411c0267c18f355f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83EEDE50-216A-452C-8C81-1ACD0BD6F340"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03c4f1270c9d","org_name":"Cornerstone Health Care","org_type":"other","ransomware":null,"records_affected":548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/triad/news/2014/03/11/cornerstone-alerts-patients-after-laptop-with.html"}],"summary":"High Point-based Cornerstone Health Care has alerted more than 500 patients after a laptop at one of its practice locations that contained patient information was stolen earlier this year.  On Feb. 26, Cornerstone began reaching out to 548 patients of Cornerstone Neurology in Hig","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"968a05fda5c864b66b991a51d528867501cf1508","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E6D9C3B-0BDB-4762-AB10-91E72C687B82"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55b9f8bca611","org_name":"Coordinated Health","org_type":"healthcare","ransomware":null,"records_affected":13907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/stolen-laptop-exposes-733-pennsylvania-patients-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.poconorecord.com/apps/pbcs.dll/article?AID=/20140423/NEWS/140429901;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-update-provides-some-new-details-on-breaches/"}],"summary":"A laptop computer that may have contained the files of more than 700 Coordinated Health patients was stolen from an employee's car on Feb. 21 and has not been recovered, according to a press release issued by Coordinated Health today. The laptop was stolen from the car of an empl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"grudge","name":"Team MaXiMiZerS","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61d73895f60ec0d1a3f82d57414c69f28334da72","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C0685F9-DBB3-4C96-B4C1-D769B6C76152"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"9225a96075e7","org_name":"Cooperative Institute of Management and Technology and Kerala Cultural Welfare Development","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/02/pakistani-hacker-group-team-maximizers.html#sthash.2mJqs7QU.dpuf"}],"summary":"Web site defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"teammaximizers"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a636bf1f29cf5ef6a7d9e262f61ad5cfa91b1ef4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EFD8BCC-1CF4-4CC3-ABB6-FC8ABA770B15"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fbf24b25dc9","org_name":"Cone Health","org_type":"healthcare","ransomware":null,"records_affected":2076,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/news-analysis/cone-health-suffers-data-breach-by-sending-letters-to-wrong-addresses.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.conehealth.com/news/2014-news-releases/letters-addressed-to-incorrect-group-of-patients-/"}],"summary":"Cone Health is notifying 2,076 patients of Southeastern Heart and Vascular Center about a very limited breach of patient information.  A clerical error resulted in patient letters being sent to the wrong addresses. The letters named the patient, their doctor and the name of the p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f2303bea8f0214e80c68daf9687d5b5c8f368a2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DBBA0C7-0BC9-4CB5-A18F-F20D108C8A8E"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ede8458c55aa","org_name":"Concentra","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.hcpro.com/hipaa/2014/06/concentra-in-hot-water-over-hipaa-breach-again/"}],"summary":"Improper records disposal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PH","motive":"unknown","name":"Pinoy Vendetta","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e69c6aa64fbf1af1d4d9a8b71ea048722a62d7e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8103C497-03D0-4B34-B33F-A0F61376641E"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"8475f098c7a1","org_name":"Computerworld Philippines","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Computerworld-Philippines-Breached-by-Pinoy-Vendetta-Hacker-369359.shtml"}],"summary":"web defacement by actors who posted the message \"patch your system\", (hacktivist collective Pinoy Vendetta, specifically an actor named 4ntipatika)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"pinoyvendetta"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3744e85057e1a1436ed2008b2a534d230e83d1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8C47B4F-7298-4E27-8829-39C963252B91"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a63703d72622","org_name":"Complete Medical Homecare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/complete-medical-homecare-20140121.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-237698.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/complete-medical-homecare-reports-unintended-disclosure-of-phi-to-business-partner/"}],"summary":"  Complete Medical Homecare didnt encrypt emails sent to trusted business partners like All American Medical Supplies. That failure to encrypt, combined with human error, resulted in a regrettable privacy breach.  On December 27, CMH discovered that materials with patients names,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"426f07195b466402cb621376b81e3df82bd2c8e4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F323B3F-C1BE-451A-B48D-E6878346DC54"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12cfd0e5c51f","org_name":"Compassionate Care, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagotribune.com/suburbs/morton-grove/crime/ct-mgc-id-theft-tl-1126-20151207-story.html"}],"summary":"Caregiver steals physical credit card from patient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"406be4df331ab406fc4cd2eb04057c0dc4fc3d9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61DF7FB8-E1E6-4566-9BD1-DF615CE8CCC1"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"711d64fc4145","org_name":"Community Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jrn.com/tmj4/news/you-ask-we-investigate/Oregon-man-reveals-massive-Wisconsin-patient-privacy-breach-247691461.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/oregon-man-reveals-wisconsin-patient-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/faxes-containing-patient-data-breached-from-roper-hospital/"}],"summary":"UPDATE 03/12: United Healthcare tells TODAY'S TMJ4 the insurance company was not at fault in this case.  Tyler Mason, a spokesman, maintains an investigation revealed the records were faxed from hospitals. It appears staffers may have misdialed the correct number by one digit.  F","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a895b4b682c67398368628ea5bcbde138c1fdb9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13E7BC72-E278-48D1-8814-A0F9BBEB88FC"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6929e4d7c3b","org_name":"Community Health Center, Inc","org_type":"healthcare","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courant.com/community/middletown/hc-middletown-data-breach-0614-20140613,0,6203865.story"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/conn-ag-investigates-breach-dispute-a-6959"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.middletownpress.com/general-news/20140624/community-health-center-suing-a-former-it-director-over-data-breach"}],"summary":"This is a bit hard to understand what's going on. The hospital alleges that a former IT director kept a hard drive with patient info as retribution. The IT director alleges that he dropped the hard drive off to the org and it was sent to him in his personal effects after terminat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d6bba46158cc8f33dc6c769254de1dbdb296b78","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3EC2909-F494-4B2C-B500-031C4D05A962"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e81924b067fd","org_name":"Club World Casino","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Two-Polish-Men-Arrested-in-London-for-DDOS-Attack-Against-Gambling-Website-374813.shtml"}],"summary":"A couple of Polish men  Piotr Smirnaw, 31, and Patryk Surmacki, 35  were arrested at the Heathrow airport in London last week. The two are accused of blackmailing a major Manchester-based company and launching a distributed denial-of-service (DDOS) attack against one of its websi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e24c41bfb4af7de59130552fbc0a16f89963a0a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"850F3B3B-F884-4B74-8CF4-4A703EEBEDEC"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e195eca4f6f","org_name":"Civilian Human Resources Agency Far Eas","org_type":"government","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.usfk.mil/usfk/Uploads/210/20140605_PII_Compromise_English.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.680news.com/2014/06/05/us-general-says-databases-on-south-korean-employees-hacked-apologizes-for-possible-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stripes.com/news/breach-of-usfk-website-could-affect-16-000-south-koreans-1.287092"}],"summary":"16,000 PII records compromised from database through a web server. Records were from Korean citizens employed by US Armed Forces in the area.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"512d88189c0c04a7514ae497e4f171b4ea7b0f5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"f76201a0-aa24-11e8-9604-77188de09ef1"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"237fba7fe718","org_name":"City of Tampa","org_type":"government","ransomware":null,"records_affected":58,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/fl-audit-finds-tampa-put-city-workers-at-risk-of-id-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.tbo.com/news/politics/audit-finds-tampa-put-city-workers-at-risk-of-id-theft-20151117/"}],"summary":"TAMPA — The city broke federal law and put some workers at risk of identity theft by including their Social Security numbers on child support and other garnishment checks, a city audit found.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b9f52b4f2fa8bddb5975fee21cde912437a1e1f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9C5CA62-FB99-43E0-BB1B-FAA662B6107C"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8e1e2ed9308","org_name":"City of Philadelphia","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.princelaw.com/2014/07/22/settlement-in-philadelphia-class-action-lawsuit-regarding-disclosure-of-confidential-ltcf-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://princelaw.files.wordpress.com/2014/07/filed-settlement-agreement.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://princelaw.files.wordpress.com/2014/07/press-release-7-22-14.pdf"}],"summary":"Joshua Prince, Esquire of Prince Law Offices, P.C., Benjamin R. Picker, Esquire of McCausland Keen & Buckman, Jonathan Goldstein, Esquire of McNelly & Goldstein, LLC, Jon Mirowitz, Esquire, and attorneys for the City of Philadelphia (the City), jointly announced today that a prop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f35a0878ccd773032efab2a18e287260d605e46f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBA78E1B-7851-430F-AA39-33C0CEFF29FF"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"538cd13e3452","org_name":"City of Long Beach","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2013/07/11/59291.htm"}],"summary":"Not sure this should be included in this db. An attorney who worked for Long Beach, CA. apparently took documents from the city to obtain grounds to sue Verizon and ATT for unlawful wireless taxes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ca70c89ac1b4aba2172c7f374ee39cb3868500a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"594F0950-52EE-4B37-B3E8-6CD997B5975D"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd8479def605","org_name":"City County Alcohol Drug Program","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/woman-sues-pennington-county-authorities-for-alleged-violation-of-her-civil-rights/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://rapidcityjournal.com/news/local/woman-sues-pennington-county-authorities-for-alleged-violation-of-her/article_e136dc0b-47c3-508a-9f9c-3c1d5354af30.html"}],"summary":"Woman sues Pennington County authorities for alleged violation of her civil rights  a woman is suing Pennington County because employees at City County Alcohol Drug Program (CCADP) violated federal law when they notified law enforcement that they had found a used syringe in her p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78591c44d0c9efafca9ddd0975c988c0af81e59b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFBA2710-7918-4866-9975-3044930D6917"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd5c54600ef","org_name":"Circle K","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fontanaheraldnews.com/news/article_ad660d4e-1757-11e4-b510-001a4bcf887a.html"}],"summary":"A credit card skimming device was found at a gasoline station in Fontana, promoting the Fontana Police Department to issue a warning to residents about the dangers of this type of fraud. On July 28, officers responded to a call from the Circle K gas station located in the 16900 b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6763eb12eadf7715d0127cafa088a7ff8389e5ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0CF6044-0552-48E3-9682-3E56F701D7EB"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b03ebcd999c3","org_name":"Cintas Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcdfw.com/news/local/Employee-of-Document-Shredding-Company-Eyed-in-ID-Theft-Ring-252992761.html"}],"summary":"Employee of document shredding company provided PII to external actor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae7e6e538cae875461dbe39da45bb251cabc004","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53440EAB-890C-45A6-82FA-383DCABD6A06"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"5f2078c36bcf","org_name":"Chinese Government (unknown)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chinadaily.com.cn/china/2014-05/05/content_17483608.htm"}],"summary":"Chinese gov worker was bribed to exfiltrated Classified information to unknown external foriegn actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af0394be0f4c9f94355bb540e8f6b01daf1468c5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBEA3438-A152-4417-9376-A6D801B96690"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"5c0b656ab77a","org_name":"China Railway Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.cntv.cn/2014/12/28/VIDE1419699240053257.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/130k-users-data-leaked-via-chinas-train-ticketing-site/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://sputniknews.com/asia/20141226/1016271073.html"}],"summary":"The personal information of more than 130,000 users has been compromised in a data breach of the official website of China Railway Corporation, ZDNet business technology and IT news reported Friday. Data including usernames, e-mail addresses, passwords and phone numbers have been","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04909542bbc2fb30aedc2f330a5dd79554ce04b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D00CA9CD-19BF-45E3-83FD-DD8176018D62"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"0f7a32f1b8ba","org_name":"China Academic Degrees and Graduate Education Information","org_type":"education","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.cri.cn/6909/2014/05/11/2821s825950.htm"}],"summary":"Many on-job postgraduates applying for master degrees in China are fearing a possible leak of their personal information, the Wuhan Evening News reports on Sunday. It's reported that many of the candidates have been receiving phone calls and text messages touting test questions a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0d5c0b4c10d9c57a2305577d449ca774a4fb310","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D4EE546-AB71-443E-821D-F3F6BC678449"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d031bf4b031","org_name":"Children's Mercy Hospital","org_type":"healthcare","ransomware":null,"records_affected":4076,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/08/20/childrens-mercy-hospital-notifies-employees-of-data-breach/"}],"summary":"Childrens Mercy Hospital of Kansas City, Mo. recently alerted 4,076 employees data may have been exposed in a breach involving its online scheduling application.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d179bf17c81c318e00f9c341832929f3c518792","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D292041-B110-4AA4-8A5D-EE062A061B4B"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1062fac17ed","org_name":"Cheyney University","org_type":"education","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://philadelphia.cbslocal.com/2013/01/25/officials-at-cheyney-u-warning-students-about-personal-data-breach/"}],"summary":"Officials at Cheyney University are urging students to check their credit reports after an inadvertent release of their personal data, including Social Security numbers.An administrative email was sent with an attachment containing PII to students.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4420fd424a39b0e5eb88fc0e236750610725b552","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D46C8F9F-04F9-42B4-A5BA-FC0D3917F518"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b50f2b52fd9","org_name":"Chestnut Pathology Services, PC","org_type":"other","ransomware":null,"records_affected":67000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/01/08/ma-billing-company-reaches-140k-health-data-breach-settlement/"}],"summary":"In July 2010, the medical billing company dumped records and a Boston Globe photographer noticed them while dumping his own trash out. There ended up being 67,000 individual records that included names, addresses, Social Security numbers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8a0d98d3281d3285be892c9c1f0866607b42730","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4D34388-8B62-4DFB-9922-17EC505DAEC1"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"12dd455794ca","org_name":"Cheeverstown","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/courts/worker-at-care-facility-stole-960-30797443.html"}],"summary":"A care assistant who stole almost 1,000 from his intellectually disabled clients has received a two-year suspended sentence.  SHARE Spanish national Jorge Garcia (41) had been working at Cheeverstown, Dublin, for six years when it was discovered he had been stealing money, a tota","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99ce3b9f4299c18e3b1dd5d05c5babbce44ed84d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19067ec0-e442-11e7-977c-0b3846f56840"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"390f55210e94","org_name":"Charleston Area Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/woman-accuses-camc-of-confidentiality-breach-with-infants-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wvrecord.com/stories/511044664-woman-accuses-camc-of-confidentiality-breach-with-infant-s-information"}],"summary":"In late 2014, Z.D. was a patient in the Neonatal Intensive Care Unit at CAMC and Andrekia Lawton was informed by an acquaintance of hers that a representative of the hospital’s NICU had contacted the acquaintance and shared Z.D.’s medical information for the purpose of seeking au","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30f7877b494b6d024913c80756e1600c5f8b0edf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5599F122-D09D-4BB8-90A5-8A7D0FC91C0D"},"incident_date":"2014-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51e46674d9ac","org_name":"Centura Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.durangoherald.com/article/20140428/NEWS01/140429556/article/20140428/NEWS01/140429556/Mercy-patient-info-hacked-?utm_content=bufferc21fa&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer"}],"summary":"Phishing campaign results in a small group of hospital employees taking the bait. Patient information was not confirmed as compromised, but at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19a009a4d8cd22a01ac93e3cebe89f62c647b49e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6B57420-EE12-4DDE-8C2C-592D9D6CC6A0"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d118bda7ed3","org_name":"Central Utah Clinic, P.C.","org_type":"healthcare","ransomware":null,"records_affected":31677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e67ce4998d28a12b60739971512bbfd3788ee6fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14D1C730-E695-426A-90FF-F45E2E5E60B4"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"649588bb0ee2","org_name":"Central Health","org_type":"healthcare","ransomware":null,"records_affected":52,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ganderbeacon.ca/News/Local/2014-08-27/article-3849485/Human-error-results-in-privacy-breach/1"}],"summary":"To err is human, and thats just what happened, said Rosemarie Goodyear, in reference to a privacy breach that occurred between May and August.  The staffer had a 1-800 telephone number and a 1-866 fax number, and the two things got transposed, said the Central Health CEO.  The in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"UA","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d47c1ed7c868f06caf3d6a6db60f99372711517","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8990053-C530-43F6-9459-22A2752ADB72"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"907d8972f0d2","org_name":"Central Election Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techweekeurope.co.uk/news/cyberberkut-hackers-attack-central-election-commission-of-ukraine-146180?ModPagespeed=noscript"}],"summary":"Unknown hacking incident, \"CyberBerkut\", a pro-Russian Ukranian hacker group, compromised unknown systems to steal 1.2GB of emails, and 1.78 GB of technical documentation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39419c885e16930f14195b200d620f70a380219a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0404DE5A-E7C0-495A-8827-05BA5FA8DBA1"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f8c03cbd387","org_name":"Centers for Medicare & Medicaid Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://insurancenewsnet.com/oarticle/2014/09/08/healthcaregov-breached-no-data-stolen-a-552719.html#.VBB1qlaFr7Q;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/policy/healthcare/216700-report-healthcaregov-was-hacked-in-july;"},{"fetched_at":null,"title":null,"type":"press","url":"http://dailycaller.com/2014/09/18/issa-confirms-that-healthcare-gov-revealed-customers-personal-information/"}],"summary":"Rep. Darrell Issa slammed Obamacare administrator Marilyn Tavenner Thursday for failing to disclose that HealthCare.gov actually has revealed some customers personal information.  During heated questioning from Oversight Committee chairman Rep. Issa, the committee determined that","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bc890388be6de93832de16a5e58e262a4274de0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ece5b760-eab4-11e7-92b6-dfe49f9d7042"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"61daf8a8a6d6","org_name":"Center for Disease Control and Prevention","org_type":"government","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/cn-jail-sentences-for-selling-data-on-200000-newborns/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.shanghaidaily.com/metro/society/Jail-sentences-for-selling-data-on-200000-newborns/shdaily.shtml"}],"summary":"EIGHT people involved in stealing, selling and buying information of more than 200,000 newborns have been sentenced for infringing citizens’ personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a1fb6a771f30919392454d22499a7bd0f61c942","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29E99647-7C9D-48E7-BD81-B4EC59E4CB21"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43b146587f7e","org_name":"CBS Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.politico.com/blogs/media/2013/05/sharyl-attkissons-computers-compromised-164456.html"}],"summary":"Sharyl Attkisson, the Emmy-award winning CBS News investigative reporter, says that her personal and work computers have been compromised and are under investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7b0a65a8fc83f5069effdf8578318d759adc309","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3FB9877-8BE3-4CBF-9FA0-DA825DA10765"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f9292f5e812","org_name":"CareAll Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":28300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c063986d926d39f3e2b37b77e143789e2d9c3326","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA15782D-A6D6-42AB-8778-6620A6B73F56"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86f9d3e3e228","org_name":"Cape Fear Valley Health System","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/if-you-dont-respond-to-notifications-of-a-leak-the-problem-doesnt-go-away-it-gets-worse/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://vulnerabledisclosures.blogspot.com/2014/09/wakemed-wwwwakemedorg.html;"}],"summary":"On September 3, SLC alleged that WakeMed was leaking patient information:  Type: PII Area: Healthcare First Noted: 3 September 2014 Location: NC Total Records: 5000+ Status: Not Monitoring for Follow Up (Not a client)  SLC Security Services LLC has noted that this medical establi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f548ccdedb545b2a80c5322a3942df0f53f4195","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F20F3319-347B-4B5D-AD20-5FCAC5BE3518"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a1f2fdd6ba9","org_name":"Butler University","org_type":"education","ransomware":null,"records_affected":163000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=17069;http://wishtv.com/2014/06/30/butler-university-warns-of-identity-theft-risk/"}],"summary":"University was notified by law enforcement that a suspect had personal data from their system in their possession. University found evidence of breach, occurring sometime between 11/2013 and 5/2014.  No other details given.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83d176909505ad385981810bc808fcc3ea133460","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3701372E-48D4-447C-9BBE-87E50EA072B5"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f90f310d8756","org_name":"Bucks County Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bucksherald.co.uk/news/more-news/council-apologises-for-data-protection-breach-after-personal-mental-health-report-sent-to-man-in-oldham-1-6108158"}],"summary":"A council has apologised after it sent confidential information regarding a clients mental health to a man living in Lancashire.  Bucks County Council was forced to send a courier 211 miles to Oldham to pick up the wrongly addressed letter at a cost of around 200.  The informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c291961b7a69fd3f83093612e62ce31c847b1860","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCFAAF05-E0AD-48BF-BB57-DE0C33158F4F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb4b0c977041","org_name":"Brown Mackie","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/local/palm-beach/fl-broward-college-arrest-20150514-story.html"}],"summary":"Consultant misused access to college network to commit fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8885566d36033e8c0bda86b3ef0ead8e5316311","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84C85652-F723-4A53-BD9A-01AAF6309663"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25fc2826013d","org_name":"Bradley Hubler Chevrolet","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wishtv.com/2014/05/21/police-credit-card-info-stolen-from-car-wash/"}],"summary":"Police say several people may be victims of a credit skimming device that may have been placed at a Franklin car wash.  Police say at least 13 people say their cards were used to make fraudulent purchases out of state.  Detective Pete Ketchum with Franklin Police says the victims","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fb49957c4fef102a9a9b157f2b0becd4f36cca8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"462183EA-46E6-49ED-A260-174A4BD21D44"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f94fd8148a95","org_name":"BRADFORD TEACHING HOSPITALS NHS FOUNDATION TRUST","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegraphandargus.co.uk/NEWS/11292828.Hospital_bosses_order_urgent_probe_after_confidential_medical_document_found_in_Bradford_car_park/?ref=rss"}],"summary":"A document with personal medical information about child patients was found abandoned in a car park. The Trust has accepted the loss of the document is a serious breach of confidentiality and it is now trying to find the source of the document and how it came to be lost. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77b51e07af6294eb7c7181058417791875621e44","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30EFA074-7928-431D-B607-B93CAD067124"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f116a9157bda","org_name":"Boy Scouts of America","org_type":"nonprofit","ransomware":null,"records_affected":70,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox4kc.com/2014/06/09/van-gets-stolen-with-medical-records-could-keep-boy-scouts-from-attending-camp/"}],"summary":"Parents of boy scouts in troop 221 are worried that their childrens medical records have been compromised, after a family van is stolen in Independence.  Kathleen Pace says she volunteers for her son`s boy scout troop and was in charge of gathering copies of the children`s physic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13b56238f2a9e40d31de67501f638fa12f94ffb2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9789A56F-0533-4520-B3A2-8A18FBF08225"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"35fcad2a083b","org_name":"Boxee.tv","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/04/hack-of-boxee-tv-exposes-password-data-messages-for-158000-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Web-TV-Service-Boxee-tv-Hacked-Details-of-158-000-Forum-Users-Leaked-435460.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3509783/boxeetv-still-silent-after-mystery-158000-database-breach-of-forum-users/"}],"summary":"Web-based television service had database compromised and posted to public forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f6cbc5c2b7d73b1682be7bb6d2e136e7be9825a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA75F8CF-4736-469A-8DE2-94CDF3EE7F01"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b38e6aa66c7","org_name":"Boulder Community Health","org_type":"healthcare","ransomware":null,"records_affected":9,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailycamera.com/news/boulder/ci_25719824/boulder-community-health-investigating-stolen-patient-records-3rd"}],"summary":"Article references 3 data breaches, this is modeling the 2014 breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1c6f96aebce54268f53c837f8e932d64d155b60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D9F5230-4D6C-430A-8DC3-932E75AA8276"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1f4d330ece9","org_name":"Boston Medical Center","org_type":"healthcare","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/business/2014/04/29/boston-medical-center-fires-vendor-after-data-breach/jboHN1Aq1x2JAE5amyEHiO/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/vendor-sacked-after-HIPAA-breach-blunder"}],"summary":"Can a subcontractor expect to keep the job after accidentally posting protected health information of some 15,000 patients online? A Boston teaching hospital says, 'definitely not.'   The 496-bed Boston Medical Center in Massachusetts has fired third-party vendor MDF Transcriptio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5050d7ab9edc894599525874b1e0e46b8a2f1406","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1AC7F4E-9431-46AD-99F5-DD1B435C6A78"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41075637c261","org_name":"Bon Secours St. Francis Health System","org_type":"healthcare","ransomware":null,"records_affected":2027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.greenvilleonline.com/story/news/2015/10/26/employee-fired-after-st-francis-data-breach/74638284/"}],"summary":"Employee fired after it is discovered that she viewed medical records inappropriately ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f76e0d39048944220a6fa8c605289d310aefaab9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E73989C-4DF7-452E-97C1-F3844E0FDF20"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e301ba084e44","org_name":"Bluewater Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theobserver.ca/2013/01/28/privacy-breach-at-bluewater-health"}],"summary":"Hospital staff have reportedly been fired after a privacy breach at Bluewater Health.  Multiple sources told The Observer Monday as many as 17 people were dismissed after non-clinical staff accessed patient information through a password-protected system  without authorization  e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7695e8bb23e80605022de826ac1fc2742d2543d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14A68CE2-AE69-455C-8146-70B108EA4098"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f63549f17490","org_name":"Blue Shield of California","org_type":"financial","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/2450493/privacy/blue-shield-leaks-social-security-numbers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.medicaldaily.com/california-apologizes-after-social-security-numbers-18000-doctors-released-public-292042"}],"summary":"A California health department apologized Monday for releasing the Social Security numbers of around 18,000 doctors.  The mix-up started when the insurance company Blue Shield of California gave a list of health-care providers to the state agency but forgot to take out their priv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a78dbdd0618d359c6311ea691dbaed3408a6bd2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75FD8C54-8080-4ABE-834F-C339E27F1DD2"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f8a47844b21","org_name":"Blue Cross Blue Shield Michigan","org_type":"financial","ransomware":null,"records_affected":5514,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.freep.com/story/news/local/michigan/detroit/2015/03/10/identity-theft-blue-cross/24718251/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mi-indictments-issued-in-blue-cross-blue-shield-identity-theft-case/"}],"summary":"The federal government has busted an alleged identity theft ring involving 10 people and a Blue Cross Blue Shield of Michigan employee who stole the personal information of more than 5,000 subscribers, used it to open fake credit cards and then went on thousands-dollar shopping s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aabd4b4726a5481e00dafbe05722ae6f0bb26e52","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b6cf8990-c4a2-11e7-9a8b-47d1b690bc01"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"474e1c7e7a01","org_name":"BJC HealthCare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/bjc-healthcare-raising-st-louis-notifies-participants-of-unencrypted-emails/"}],"summary":"Data was transferred in an unencrypted manner against policy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34593cefa9d63b3555a05a1d9df443ac23964c83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D58CD22-225C-4766-89F1-F94F367F0992"},"incident_date":"2014-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"080a01696eb4","org_name":"BioReference Laboratories, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/bioreference-laboratories-notified-over-3000-patients-after-misconfigured-server-allowed-their-info-to-be-indexed-by-search-engines/"}],"summary":"We at BioReference Laboratories, Inc., and our subsidiary CareEvolve, Inc., take very seriously our responsibility to protect the privacy and security of our patients personal information, as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bea3e2301f5cca1d7d2707ab6ba63250f0b6682","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D1A3679-8A10-4CF3-858C-79024EF19838"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9b4a7b52019","org_name":"billorielly.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/2091058/a-hackers-story-mitchell-frost-explains-his-motivation.html"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bb147212675727274776a56b6a87fc9999d5077","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6CBA096-5E5C-4D27-9E12-5CC9D5A3E9A0"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b398332c160a","org_name":"Betfair Group PLC","org_type":"professional_services","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.information-age.com/technology/security/1659443/betfair-security-chief-departs-after-data-breach-exposed"}],"summary":"News emerged last week of a data breach in which millions of customers' contact details and credit card numbers were stolen by hackers. The breach took place in May 2010, six months before Betfair launched on the London Stock Exchange. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaddad692821b7e316b5aafabd64747bfccabeff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"421ADD8A-41DD-4909-8AB0-8C8EB1F1555D"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"71c0183f1815","org_name":"Bell Canada","org_type":"technology_saas","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.troyhunt.com/2014/02/heres-how-bell-was-hacked-sql-injection.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/mW9dXUkd;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.publicmobile.ca/pmconsumer/coverage/?lang=fr&tabName=%27%22()%21%251%3Cscript%3Ewindow.location=%22http://www.twitter.com/deletesec%22;%3C/script%3E"}],"summary":"http://pastebin.com/mW9dXUkd  Target: Public mobile Website: publicmobile.ca Attacking method: XSS and Blind SQLI XSS www.publicmobile.ca/pmconsumer/coverage/?lang=fr&tabName=%27%22()%21%251%3Cscript%3Ewindow.location=%22http://www.twitter.com/deletesec%22;%3C/script%3E  Blind SQ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6650372710344f2fd5228fa6707b8e1923434b99","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E35DAD05-7891-4A80-A150-D7A7F0C71103"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae42a95bf579","org_name":"Beebe Healthcare","org_type":"healthcare","ransomware":null,"records_affected":1883,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/beebe-healthcare-suffers-breach-through-contracted-employee"}],"summary":"Contractor with ID theft priors had access to ~1900 patients medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"256aa4cbbe144d75530f38f3c8cfb43cb7c01e8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0E70057-E538-4740-8A03-817FD88E058B"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"be961b55de01","org_name":"Bedford Hospital","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-187466/Medical-records-dumped.html"}],"summary":"A hospital has launched an investigation into how confidential medical records dating back 60 years came to be found by a group of teenagers at a disused building site. The youngsters discovered the documents, including one psychiatric report on a child and details of baby deaths","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3001696d00892bf2e96f97b16982c81895f6526","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B13EC1D-E9A6-4C81-8925-6E7FD7C14E12"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d54efe6ecf1","org_name":"Beachwood-Westlake Plastic Surgery and Medical Spa","org_type":"other","ransomware":null,"records_affected":6141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/computer-hardware-containing-patient-data-stolen-from-ohio-plastic-surgery-office/article/370808/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://drgoldman.com/patient-notice/"}],"summary":"More than 6,000 patients of Beachwood-Westlake Plastic Surgery and Medical Spa in Ohio are being notified that their personal information was on computer hardware that was stolen during an office burglary.  How many victims? 6,141, according to HHS.gov.   What type of personal in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4e1b86284cf152a464e8f3b2ac2b2e4f3d4cd7e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80BE1C1D-23DE-4A7A-AA67-5F4138529C7B"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3b3eb2f5b7df","org_name":"BBC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techradar.com/news/world-of-tech/bbc-panorama-researcher-involved-in-data-breach-1256054;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/07/03/bbc_panorama_team_loses_confidential_files_on_secret_british_army_unit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/news/uk/home-news/exclusive-bbcs-panorama-team-loses-confidential-information-relating-to-a-secret-british-army-unit-9580340.html"}],"summary":"BBC researcher downloaded sensitive information and provides to third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8afd2b39bc25c17641440ca74153365e4fec944a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"282895FA-FBFF-4BA6-9D94-A3BD43E17071"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7625050b853","org_name":"Baylor Regional Medical Center at Plano","org_type":"healthcare","ransomware":null,"records_affected":1981,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ff96cbb46ef236b14ebbda0a587272ea9e81df4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F0BECD5-A793-4F8B-BC9D-391861B61064"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4a5e5927b5f","org_name":"Baylor Medical Center at Irving","org_type":"healthcare","ransomware":null,"records_affected":2308,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27f1db5b74d6557e2d7cc502a84e7477583fd187","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1DD9FC8-8DAD-41A6-BE3C-01E55EC33FE6"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eeffc784273d","org_name":"Banner Health","org_type":"healthcare","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/health-magazine-containing-social-security-numbers-on-address-labels-mailed-to-50000-medicare-recipients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arizona.newszap.com/westvalley/129918-114/health-magazine-containing-social-security-numbers-on-address-labels-mailed-to-medicare-recipients"}],"summary":"The latest issue of Banner Healths Smart &Healthy Magazine arrived to mailboxes over the weekend containing Social Security numbers of recipients on the address labels.  We try so hard to protect our Social Security number and then to have it publicized, its very disturbing, Sun ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd7d53fef35be87c50b1d3dfb706cba0984691b7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6A5C211-22B3-414F-804C-6F3EFB4391D6"},"incident_date":"2014-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d824dfd8fd2e","org_name":"Bank of Montreal","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/bank-of-montreal-atm-hacked-with-weak-password-7000030365/"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/06/ninth-grade-students-hack-into-atm.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.winnipegsun.com/2014/06/08/code-crackers--charleswood-teens-hack-into-grant-avenue-atm"}],"summary":"two boys (in 9th grade) found a manual for local ATM online, read it and were able to put it into \"operator mode\" from an easily guessable password (123456).  They told the bank who didn't believe, so they went back, modified the login screen to say \"go away, this ATM has been ha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57e06c1a96991f3f4aa1d2b4017b248a12c6fafd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55CED6F3-E34F-4D5B-8797-14D40E8C072B"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"bc848c9d9cc6","org_name":"Bank of America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxphilly.com/story/25373205/police-skimming-device-found-at-evesham-bank-atm#ixzz30YopGclr."},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/south/index.ssf/2014/04/evesham_township_police_look_for_man_who_put_atm_skimmer_in_bank_of_america.html"}],"summary":"Evesham police are asking for the public's help in identifying a suspect who they say installed surreptitious surveillance equipment on an ATM located inside the Bank of America. Police say the suspect first attached a small electronic device over the card slot, to record custome","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e44f9af792ada46899f7021bbd000c641a67dc48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B45A620E-0559-4002-B147-9A22F2AC7736"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"8d1488eb8a09","org_name":"Bank Mandiri Persero Tbk PT","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thejakartapost.com/news/2014/07/04/police-bust-members-international-credit-card-fraud-ring.html"}],"summary":"ATM Skimming ring run from Canada, and conducted in Indonesia was broken up. over 300,000 USD in fraud was committed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbcad4c238b52bf25d0bc2dab0fc88eb4154b38e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A92E7691-61CE-4AA5-9E17-7E6BC603768F"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cd4d1306ae9d","org_name":"Australian Bureau of Statistics","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2014-05-09/two-men-arrested-insider-trading-abuse-public-office-charges/5442602"}],"summary":"Employee of the Australian Bureau of Statistics leaked information to college friend who uses it for insider trading.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caea5debcd1f70303c4506ccfa0e7c02ac0a2c24","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E375BD3F-BB99-4235-9D1C-C42905257762"},"incident_date":"2014-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65a012b6fd29","org_name":"Ars Technica","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2014/04/dear-readers-please-change-your-ars-account-passwords-asap/?utm_medium=linkedin&utm_source=twitterfeed"}],"summary":"For more than two years, the Internet's most popular implementation of the Transport Layer Security (TLS) protocol has contained a critical defect that allowed attackers to pluck passwords, authentication cookies, and other sensitive data out of the private server memory of websi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9041b3b64d23ed473f74663566c43385596726b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA9D0D53-6C35-4F29-84A9-68B86BB6593E"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"adc5d72249be","org_name":"arkview Health System","org_type":"healthcare","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/news/press/2014pres/06/20140623a.html"}],"summary":"Parkview Health System, Inc. has agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule with the U.S. Department of Health and Human Services Office for Civil Rights (OCR).  Parkview will pay $800,000 and adop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"750560b76856e2d04041b070f873bc34b2044ce6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56362DDC-705E-4DBA-A78A-5189DB438E86"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"8cf7ff8cca4e","org_name":"Arizona State University","org_type":"other","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.campussafetymagazine.com/article/as_many_as_50000_affected_by_arkansas_state_data_breach/university;http://www.esecurityplanet.com/network-security/data-breach-at-arkansas-state-university-affects-50000-people.html"}],"summary":"Victim database compromised, no details on actions, but an estimated 50,0000 records of customer personal information reported compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4df38d56158e0eebe966ae414cfd65e35318ad8c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3A0FD5D-A3AB-4533-8629-A7203BF3B714"},"incident_date":"2014-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a063aab81ff8","org_name":"Arizona Department of Homeland Security","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/arizona-department-of-homeland-security-website-hacked/"}],"summary":"A Turkish hacker going with the handle of Swan had hacked and defaced the official website of Arizona Department of Homeland Security along with its server on 26th May, 2014. Hacker also defaced the official website of Arizona Commission of Indiana Affairs website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4fe6403e4d6657584b87168685dfd745d7179d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9A3A8DD-E2AD-40D8-A2B3-9C663A1AE097"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3470654872a","org_name":"Arcadia Home Care & Staffing","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/breaking-up-is-hard-to-do-tuesday-edition/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/arcadia-home-care-acknowledges-insider-breach.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification%20Arcadia%20%28Form%20OAG%29%20March%2016%202014_0.pdf"}],"summary":"Arcadia Home Care & Staffing recently began notifying an undisclosed number of employees that their personal information may have been accessed inappropriately by an independent contractor (h/t DataBreaches.net).  \"The security breach stems from the unauthorized access of your pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50ff2eec9bb47c68d919666ae3224c1ac033b787","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C308866-625F-433E-AD03-7563C4298FF3"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"88c1151e78b4","org_name":"Applecare Insurance Services Inc.","org_type":"financial","ransomware":null,"records_affected":7500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://heralddemocrat.com/news/local/security-breached-patient-information-compromised-office-dr-jm-benson"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44302"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ce427b4131074955ed416e2a9168aae8f91c400","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81BAAAE5-4484-4AA6-9E13-8F4B25D48349"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52dba16845bf","org_name":"Apple Valley Christian Centers","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vvdailypress.com/article/20140711/News/140719970;"}],"summary":"APPLE VALLEY  A breach of unsecured private health information involving more than 500 people last month has been remedied, a local care center announced Friday, and administrators say the breach was a technical glitch rather than a criminal intrusion. Apple Valley Christian Care","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75abdd0100a514008aa5b178df7597bbfc0e038a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EBB1ADC-0A84-4E7B-915C-7B794277CCC1"},"incident_date":"2014-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8c89cad1ddb","org_name":"APEX CARY INSURANCE AGENCY","org_type":"financial","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansas.com/2014/01/26/3249851/malware-threatening-small-businesses.html"}],"summary":"cryptolocker infection at insurance company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83e54b428b54b4d6a117897c1fde72df7136effe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C987EFE-031E-4880-BC6C-BB053877835B"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad00c3410107","org_name":"Anchor BanCorp Wisconsin Inc","org_type":"financial","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wls/story?section=news/local/wisconsin&id=9458157"}],"summary":" Anchor Bank is offering an apology to nearly 200 customers who were sent the wrong mortgage statements.  Janesville railroad engineer Joe Martin says he received a March statement that should have been sent to a Madison couple. Martin tells WISC-TV that he's concerned his statem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c869c2566f5afc04e679123c9213cd420a09dea6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66ABAE42-C861-4755-AB15-4367257313E2"},"incident_date":"2014-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"4bd02ce25870","org_name":"American Health Inc.","org_type":"healthcare","ransomware":null,"records_affected":17776,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d7bbefc0a1ec39beaae3765c62b22183f8dd191","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E281C3C-5B6B-4AB5-ACE6-D8B5D87E70AC"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2669b05fdd1e","org_name":"Amedisys","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/tn-hospice-patient-records-found-blowing-along-road/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.atlantic.net/blog/2015/01/02/hipaa-on-the-highway-tennessee-hospice/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/amedisys-notifies-6909-patients-after-failure-to-locate-142-devices-during-inventory/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/amedisys-notifies-nearly-7000-individuals-of-potential-breach/article/405456/"}],"summary":"An ex-employee of a hospice did not destroy protected health information as the law demands, resulting in a critical investigative news segment.  When Sandra Rambo found medical records while walking with her daughter at the side of a highway, she knew immediately that it violate","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efdae78c57b35fc30c8448ead9b671cbdae31638","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD3C7799-796D-476A-A9FC-5A398CE64065"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"887f3d1ec98e","org_name":"Altnagelvin Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.highlandradio.com/2014/06/18/western-trust-confirms-its-investigatin-patient-file-data-breach/"}],"summary":"The Western Trust says it is investigating a data breach after a patient who had requested his medical records was given a file containing another persons records.  Jonathon had attended Altnagelvin Hospital with a heart condition and as he wasnt happy with his diagnosis he reque","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c13b1ede84dccb2f8de10e1b96c54c9b668a99eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBEBEFE2-869F-4535-BE91-EA17614F8C71"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"904a4db1adcb","org_name":"Albany Medical Center","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news10.com/story/25462838/nurse-at-albany-med-charged-for-stealing-identities-of-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wnyt.com/article/stories/S3444838.shtml"}],"summary":"A nurse and co-conspirator used PII to apply for credit cards in patients' names. They would use the cards for fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ea729fb5878731fb4299d496b588418340e866c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95B69AF8-6989-4C94-874F-916336989516"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"912c275e26dc","org_name":"Alabama Police Department","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.annistonstar.com/news/state/database-misuse-ensares-officers/article_291648f8-3049-11e6-b76b-0bf60f1268d1.html"}],"summary":"Lawrence County Chief Sheriff's Deputy Harold Knighten was convicted in 2014 of using the Law Enforcement Tactical System database to look up information on a man he suspected of having an affair with his wife. The Decatur Daily's accounts of the trial indicate Knighten parked ne","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed0bc640316c715884c562c09308d587f80ea670","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57854608-9AC5-4B4D-91B9-33818AD46B1A"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"38cb90a009ec","org_name":"Aflac Inc","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/continental-american-insurance-20140117.pdf"}],"summary":"employee misuse, reportedly accessed 1 NH resident personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5facda9b443f54be8715cf7c6c24f5157a7178c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90B1613A-356F-4719-977D-5E337F043367"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5e6b63ca1dc","org_name":"Advantage Physical Therapy","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.khq.com/story/26621760/former-physical-therapy-employee-arrested-for-stealing-patients-identity-thousands-of-dollars"}],"summary":"McKenzie Greener, who Spokane Police say stole the identity of an 88-year-old woman and more than $13,000 from her, was arrested Tuesday and made a first appearance in court Wednesday.  Police say Greener worked for Advantage Physical Therapy in the late Spring, and that's when s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557d6ccc567ba69547bf9e34556e04793cbdc087","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DFB257E-75C9-4C54-8254-5616B882A1C0"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb32dcd77815","org_name":"Abeo Management Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://losangeles.cbslocal.com/2014/03/04/la-woman-arrested-in-connection-with-identity-theft-of-hundreds-of-victims/"}],"summary":"Insider uses customer information to commit multiple acts of identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2014-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c52d8a0bfc4fc8f26295f6fafcc2a877c8c23087","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E52F20CC-0C4E-4CB3-AE34-18FEC59BA3E6"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-Eleven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gazette.com/thieves-use-digital-pickpocketing-to-skim-credit-card-data-from-colorado-springs-customers/article/1534079"}],"summary":"Credit card thieves are using a type of \"digital pickpocketing\" technology to steal credit card information from unsuspecting victims.  Technology has emerged in recent years that enables thieves to intercept credits card information with a simple swipe during a purchase. That in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0c9b9b07563f10c9a3ba8d56e83d606e1ab50af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02973E91-8604-4813-9506-089E0E053F2F"},"incident_date":"2013-12-31","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67b6ba1ebfc4","org_name":"Snapchat","org_type":"technology_saas","ransomware":null,"records_affected":4600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalgazette.net/article/20140103/BIZ/301039976/1031/BIZ"},{"fetched_at":null,"title":"Have I Been Pwned: Snapchat","type":"hibp","url":"https://haveibeenpwned.com/Breach/Snapchat"}],"summary":"Attackers misuse the functionality built into snapchat to enumerate personal information of 4.6 million users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e35cc9a924a1f434aadf66870b0b49308a5d0f6f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC8C7426-80E5-449C-AF06-D12B1657B735"},"incident_date":"2013-12-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dd208959c79c","org_name":"Magiled UK Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.expressandstar.com/news/crime/2014/01/03/boss-will-pay-500-for-return-of-laptop/"}],"summary":"Laptop theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0068943a66f7707f6bc5c4fbd3cc3429213383f","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/wichcraft%20Notice%20to%20Customers_0.pdf"},"notes":null,"org_country":"US","org_id":"3a8d7fa320a9","org_name":"‘wichcraft Operating, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43683"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/wichcraft%20Notice%20to%20Customers_0.pdf"}],"summary":"‘wichcraft Operating, LLC reported that an unauthorized party accessed its systems and may have accessed customer names and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b7a6b805162d64abba8121cda2e9a14ef33ba64","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice_Final_Generic%20version_0.pdf"},"notes":null,"org_country":"US","org_id":"392979fe3217","org_name":"T-Mobile US","org_type":"telecom","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43681"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice_Final_Generic%20version_0.pdf"}],"summary":"Unauthorized access to a file containing T-Mobile customer personal information on servers managed by a supplier was discovered in late November 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c01f34cf3ea9a923aed696af288b0da89d32b985","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13F68BDD-BC7D-40CD-B4BE-BA861A371182"},"incident_date":"2013-12-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0f8c08bc467","org_name":"Riot Games","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-25559048"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48d4e588c9dc500a254f842fdd5a97045b38aeab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5278F77-4311-4E9D-95B0-0E2D3AB74018"},"incident_date":"2013-12-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"a236fa62a190","org_name":"openssl.org","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/12/29/openssl-org-breached-by-turkguvenligi/#.Ur981rMRdyE.twitter"}],"summary":"hacker using the handle @turkguvenligi who has been around for some time now has announced a breach on the well known openssl.org website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18bfab8a91ff89a3f770952dad0750fd9fdf3e84","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2468560D-187F-4A41-99C0-127E8F576F0E"},"incident_date":"2013-12-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32a02415a548","org_name":"OpenSSL","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/12/29/openssl-org-breached-by-turkguvenligi/#.Ur981rMRdyE.twitter;https://www.openssl.org/news/secadv_hack.txt"}],"summary":"Last updated: 3rd January 2014  On Sun 29th December 2013 at around 1am GMT the home page of www.openssl.org was defaced.  We restored the home page just after 3am GMT and started forensics, investigation, and recovery.  The OpenSSL server is a virtual server which shares a hyper","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4fe4d9539d954db52936bbe6922c7c8b478badc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47050599-2315-4DE1-8243-8CC69D3BB643"},"incident_date":"2013-12-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c01ad542c8dd","org_name":"United Nations Population Fund (UNFPA)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/United-Nations-Population-Fund-Websites-Hacked-by-Syrian-412464.shtml"}],"summary":"Syrian hacker Dr.SHA6H has breached and defaced a couple of United Nations Population Fund (UNFPA) websites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6c9533c830df148bb19718b51be02e30c55dc17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10084AC2-945E-417F-AB63-CF916A85E674"},"incident_date":"2013-12-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98c445321d09","org_name":"The Houstonian Hotel, Club & Spa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc13.com/finance/security-breach-reported-at-houstonian-hotel/170410/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityinfowatch.com/news/11565835/computer-breach-at-houstonian-hotel-club-spa-impacts-at-least-10000-customers"}],"summary":"Hotel suffers breach in POS environment that led to malware installation and payment card data loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1bd106f1f9a60140309b8f9507c5ab67c26ec88","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AE02D59-931F-45C6-A4BF-73173BE3AE50"},"incident_date":"2013-12-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0c537a1bd68c","org_name":"NatWest","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/12/natwest-ddos-cyber-attack.html"}],"summary":"Natwest, an online banking establishment, suffered a DDoS attack. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80b641fa9d2be2dc77515b3b5e79c22d419d6cd7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D5AEF06-501B-4D6F-A167-A73526CBEDDE"},"incident_date":"2013-12-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a9ac689cc56","org_name":"City of Sumner","org_type":"government","ransomware":null,"records_affected":3600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2013/12/27/2967063/sumner-fires-temporary-court-clerk.html#storylink=cpy"}],"summary":" city of Sumner has fired a temporary employee after she sent information about 3,600 people, mostly residents, to her personal email.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d27787b54346d5330c098f961bd0d0c8b1c4c9ed","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0ADEEB8-FEE4-4255-8A91-D7C9A366DC46"},"incident_date":"2013-12-26","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a676ee094138","org_name":"Greenland Town Hall New Hampshire","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3495635/cryptolocker-scrambles-eight-years-of-data-belonging-us-town-hall/"}],"summary":"Small town hall infected with cryptolocker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-12-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08473f13a0460c97f8ed0bfa19600a92909462fb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"818DC1B3-43C8-4C7D-818A-A765316CB425"},"incident_date":"2013-12-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"93465b3085a3","org_name":"British Broadcasting Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/business/technology/hacker-took-over-bbc-server-and-tried-to-sell-access-29873335.html"}],"summary":"A hacker secretly took over a computer server at the BBC, Britain's public broadcaster, and then launched a Christmas Day campaign to convince other cyber criminals to pay him for access to the system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a5fff289368f2aa1a1d5d7c0f538884e3002384","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C3D5AF2-CF59-41A6-9550-9261D4AAD55A"},"incident_date":"2013-12-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c7b6951aea1","org_name":"Wireless Emporium","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.scmagazine.com/payment-cards-used-on-wireless-emporium-website-compromised-by-malware/article/364686/;http://oag.ca.gov/system/files/Wireless%20Emporium%20Breach%20Notification%20Sample_0.pdf?"}],"summary":"Malware discovered on Wireless Emporium website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f037fd60cbc139d9047611ced9f3c314fb81b60a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C67F357-FD18-4A44-B801-526461B71E3B"},"incident_date":"2013-12-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf238620554d","org_name":"Tranquility Counseling Services","org_type":"healthcare","ransomware":null,"records_affected":1683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Incident exposes 1683 paper records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60b296d7661e6e10361636129491cec245a61e19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CD2B7E9-0D45-498B-8CC2-2A72305D656A"},"incident_date":"2013-12-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d3679eed237","org_name":"Jeff Spiegel","org_type":"healthcare","ransomware":null,"records_affected":832,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized email access resulted in the exposure of 832 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed6e4e7e750171323fde2d19ef62b50cab7201f7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"322F47AA-E1A1-4F06-92F3-1A5B815AA6C9"},"incident_date":"2013-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f24f0d439a67","org_name":"Inspira Health Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1411,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/inspira-vineland-notifying-patients-about-december-theft-of-computers-with-phi/"}],"summary":"Laptop stolen from hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df36a4c4a845e6c6969c4a2b7d35a1b2f4ecd8c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F916098-22D7-4EE5-B20E-251CA28EDFD1"},"incident_date":"2013-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1a61937fe0c3","org_name":"Covenant Health","org_type":"healthcare","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/1108228/briefcase-containing-resumes-patient-information-stolen-from-covenant-health/"}],"summary":"Laptop stolen from person's car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a0d62acf5e6332e4d9a134e610c279505008daf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF825C71-D50B-4219-B6B9-DA1C2F64BEC8"},"incident_date":"2013-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f44406052bd5","org_name":"ST. VINCENT HOSPITAL AND HEALTH CARE CENTER, INC.","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/in-st-vincent-hospital-notifies-1100-patients-that-stolen-laptop-contained-protected-health-information/"}],"summary":"Laptop stolen from hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e18b09e5a2a5d6473aaf7937bbcca202e23f36e0","impact_type":"unknown","incident_date":"2013-12-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/scan2_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"120a934e3804","org_name":"Robert Meaglia, DDS","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43597"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":"Shelly Logemann","variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a49320da53268f8cc1532f641a3cecdad29be3cb","impact_type":"data_theft","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"0522f74f2da0","org_name":"W.J. Bradley Mortgage Capital, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A loan officer took customer files from WJB’s computer systems while she was still employed there.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43590"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43869"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice_0.pdf"}],"summary":"A W.J. Bradley Mortgage Capital loan officer and RPM Mortgage took customer files, including personal and financial information, from WJB’s computer systems.","supporting_quote":"During late July and early August 2013, one of WJB’s former loan officers, Shelly Logemann (“Ms. Logemann”), in concert with another mortgage company, RPM Mortgage, Inc. (“RPM”) took files from WJB’s computer systems, including some of your personal data while she was still employed with WJB.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse","derived":{"actor_id":"shellylogemann"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"840483bba74818c1446b77e2ac8108309bea1366","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F74F2B68-74E9-4DD4-A14C-395C4B92D214"},"incident_date":"2013-12-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-jan-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/news-analysis/south-texas-va-reports-data-breach-due-to-printing-error.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-feb-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security-mar-2014.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/veteran-affairs-e-benefits-website-exposing-veterans-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wtvd/story?section=news/local&id=9396295"}],"summary":"A Pharmacist self-reported accidently dispensing the wrong medication to Veteran A at the pick-up window. Veteran B who picked up the wrong medication was immediately notified per protocol, and asked to return it to pick-up the correct medications. Veteran B' name and medication ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa311f9c046fd579d724616100a78a631cecfa8e","impact_type":"unknown","incident_date":"2013-10-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Techmedia%20Individual%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"6b6bfd2dfcdd","org_name":"TechMedia Network","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43575"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Techmedia%20Individual%20Notification_0.pdf"}],"summary":"TechMedia Network sent a customer notification regarding a security incident, but the provided text does not describe what happened.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26f2b442f5c8b23dc14d7abc0b1a303347d2d284","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7992561-034A-44C4-AADC-23928DA989D9"},"incident_date":"2013-12-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bad087e58de","org_name":"Stakerlaw Tax and Estate Planning Law","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/StakerLaw%20Notice%2012-26-2013_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43653"}],"summary":"Laptop theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"330a4ad64f59f83098ee5cd7419c7a7d4473850e","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DC_Notification_form_1013_3.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43574"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43573"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa5aae6124a1fe1d36564096f507a2504f7398e4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-03-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Affinity%20Press%20Release_0.pdf"},"notes":null,"org_country":"US","org_id":"caf4c0ac57f4","org_name":"Affinity Gaming LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43592"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Affinity%20Press%20Release_0.pdf"}],"summary":"Affinity Gaming reported malware-related compromise of payment card information processed for its casinos and Primm Center Gas Station.","supporting_quote":null,"technology_involved":["customer credit and debit card processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9ad2ad3e3fff0d4aff538a14c6ae2b39a9c25b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D8B3C4F-A6AB-4ACF-8663-8D711455707A"},"incident_date":"2013-12-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d4cf90a9d5b","org_name":"Jumbo Chinese Buffet","org_type":"other","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://citizensvoice.com/news/police-waiter-stole-restaurant-customers-credit-card-info-1.1610793"}],"summary":"A man who waited tables at a Hazle Township restaurant only a handful of times is believed to have stolen customers' credit card information and then racked up purchases totaling between $18,000 and $20,000, by skimming their credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e419b2b39da9ea2adbf9787a0d3ae5fd22b67b4","impact_type":"unknown","incident_date":"2013-10-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20California%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0bb986f21e7a","org_name":"CITGO Petroleum Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43544"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aff8e21d7b99b9078f784c4f1c4dfde823245fbb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D09C7AF-54AF-40A4-842C-D7DF6227AF49"},"incident_date":"2013-12-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f61b3ab0c0b5","org_name":"Barnabas Health Medical Group's Pediatric Specialty Center","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nj-barnabas-health-notified-patients-after-laptop-with-with-pediatric-patients-pulmonary-testing-data-was-stolen-from-center/"}],"summary":"An unencrypted laptop was stolen on September 24, 2013 from the Barnabas Health Medical Groups Pediatric Specialty Center, which was then located in Livingston, NJ. The theft was detected on that same day, and internal security and the police were promptly notified, but the lapto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a07094a63c9b68a7fcf0ccb6eb4c5a9adfc76d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE62667C-4636-448A-A8C3-2581EBF496D3"},"incident_date":"2013-12-17","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1029aad3aba2","org_name":"Shiloh Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access exposes 1900 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-16","discovered_date":"2013-12-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82bad72a0163fad65b58a68344d0cd18b9f85522","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-12-16","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/StJo501_AdultrPat_PrintersProof2_0.pdf"},"notes":null,"org_country":"US","org_id":"959cbe07bb78","org_name":"St. Joseph Health System","org_type":"healthcare","ransomware":null,"records_affected":405000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/hackers-break-server-st-joseph-health-system-putting-405000-risk;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/healthcare/security-and-privacy/texas-hospital-discloses-huge-breach-/d/d-id/1113724;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/tx-st-joseph-health-system-confirms-hacking-incident-affecting-405000-patients-employees-and-beneficiaries/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44027"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/StJo501_AdultrPat_PrintersProof2_0.pdf"}],"summary":"Hackers gained unauthorized access to one St. Joseph Health System server, but the investigation could not confirm whether personal information was accessed or taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89751105fba2fd857ca5823d4c827a5d53f7313e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A19BE90-9137-4CC3-8F40-60190D4FEB92"},"incident_date":"2013-12-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98bbbc9f6e55","org_name":"Nationalist Movement Website","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rawstory.com/rs/2014/01/03/anonymous-hackers-deface-mississippi-based-white-pride-website-with-anti-fascist-message/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-The-Nationalist-Movement-Hacked-by-Anonymous-413213.shtml"}],"summary":"The official website of the Nationalist Movement, a white supremacist organization based in Mississippi, was defaced by Anonymous hackers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-12-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"936a499358c6eabce5f4fc394ade824bda9ec9ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DE82803-F9AA-4BF5-818C-C825FEB3D012"},"incident_date":"2013-12-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d819a31a9ebc","org_name":"Dr. Rob Meaglia","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/dentrix-claims-it-encrypts-their-data-but-does-it/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/hhs-updates-breach-tool-part-2-its-news-to-me/"}],"summary":"Computer stolen from dentist office results in medical records and PII at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3693208d5236c9b610f6dbecfbf38a49e243bbc","impact_type":"unknown","incident_date":"2013-09-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EDD%20Break-in_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2ba70f57a935","org_name":"EDD","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43526"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bab8c3d8109930453dc419e3e742fb638e482781","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E83E60C-64AC-4DA5-B964-C2798C775D5B"},"incident_date":"2013-12-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4110f0191a6c","org_name":"Unity Health Insurance","org_type":"financial","ransomware":null,"records_affected":41000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/unity-health-insurance-notifying-over-41000-patients-after-hard-drive-lost-by-university-of-wisconsin-madison-school-of-pharmacy/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox47.com/newsroom/top_stories/videos/unity-security-breach-missing-drive-included-info-40k-thousand-patients-8747.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://host.madison.com/wsj/news/local/health_med_fit/health-information-for-more-than-unity-members-missing/article_b33d5042-d7ce-5f34-b1a6-a033a1de2fbb.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/wisconsin-health-insurer-loses-hard-drive-41k-members-impacted/article/332213/"}],"summary":"About 41,000 members of Wisconsin-based Unity Health Insurance are being notified that their personal information may be at risk after a portable hard drive was reported missing from the University of Wisconsin-School of Pharmacy.  How many victims? 41,437.    What type of person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a4fef704971d9054976edef94a675280a4e8c84","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04C930EE-9C0B-4E0F-8074-3AA47E2E1D95"},"incident_date":"2013-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d6abd6dcdb2","org_name":"Edgepark Medical Supplies","org_type":"other","ransomware":null,"records_affected":4230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2014%2001%2002%20Edgepark%20ltrt%20Consumer%20re%20Security%20Breach%20.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/edgepark-medical-supplies-notifies-patients-after-malware-may-have-compromised-their-personal-information/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"  Edgepark Medical Supplies in Ohio (RGH Enterprises) is notifying some patients that their personal information, including full credit card number in approximately 126 cases, may have been acquired in March 2013 due to a malware infection that evaded detection by their anti-viru","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7e4a55ca453a8f0977baaa2123611410413e949","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FD052FA-89FF-443D-B831-B64682D29B81"},"incident_date":"2013-12-11","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2648c0f6f1d5","org_name":"Mosaic","org_type":"healthcare","ransomware":null,"records_affected":3857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-on-todays-hhs-update-newly-disclosed-incidents/"}],"summary":"Mosaic in Nebraska reported that 3,857 were affected by a breach on October 11th coded as Other,E-mail. A notice on the non-profits site says: On October 16, 2013, Mosaic discovered that client information was in an email account of an employee who had fallen victim to an email p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-12-11","discovered_date":"2013-12-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d71e288ba6b7308161560cac1725b2dddb5a118","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cottage%20notice%20only%201-%231636861-v1-AG_Notification_CHS_-_CA_0_0.pdf"},"notes":null,"org_country":"US","org_id":"7d7b17788bfb","org_name":"Cottage Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43473"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cottage%20notice%20only%201-%231636861-v1-AG_Notification_CHS_-_CA_0_0.pdf"}],"summary":"Cottage Health System reported that patient information stored on a server was exposed after a third-party vendor removed electronic security protections.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2897ea196867b7729bf7e67eeb75d5f493e2841","impact_type":"unknown","incident_date":"2013-09-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/FINAL%20Imrie%20notification%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a617e2a0e53","org_name":"Stephen T. Imrie, M.D.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43466"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2013-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"629c17f9663b3a43793847c9ac20e60004f81ee4","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-09-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LAGLC%20Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"cb39195a09b0","org_name":"Los Angeles Gay and Lesbian Community Services Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43465"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LAGLC%20Individual%20Notice_0.pdf"}],"summary":"The Center reported a criminal cyber attack that potentially exposed personal, medical, and financial information, with no evidence that information was actually accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38a6cfdcd70d4d8ec872154df594335f37674ac9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"269B6D03-AC50-42F6-84D8-90837F905B74"},"incident_date":"2013-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b43e3736064a","org_name":"Health Help, Inc.","org_type":"healthcare","ransomware":null,"records_affected":535,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"An unencrypted portable computer drive containing the electronic protected health information (ePHI) of 535 individuals was stolen from a workforce member's unlocked personal vehicle parked at home.  The ePHI involved in the breach included names and birthdates.  Upon discovering","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c3c8fd1791e4464e937c5ecd81cb53b65bbc39f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2440E4F-0A77-429D-9F19-3390D484C01E"},"incident_date":"2013-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"1ef670dffd76","org_name":"Yahoo","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techcrunch.com/2013/12/11/trouble-at-yahoo-partial-webmail-outage-hits-day-two-surprise-small-business-websites-shutdowns-anger-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2013/12/13/5209132/marissa-mayer-apologizes-for-lengthy-yahoo-mail-outage;"},{"fetched_at":null,"title":null,"type":"press","url":"http://help.yahoo.com/kb/index?page=content&page=content&y=PROD_MAIL_ML&locale=en_US&id=SLN22473"},{"fetched_at":null,"title":"Have I Been Pwned: Yahoo","type":"hibp","url":"https://haveibeenpwned.com/Breach/Yahoo"}],"summary":"Yahoo mail servers suffered outage due to hardware problem. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d391dafde7c01c91d88bdb69b8003797443d963","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B129FE7-323E-4EE5-996E-74120D07AF2C"},"incident_date":"2013-12-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"20d20b531453","org_name":"Banco do Brasil SA","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/largest-brazilian-bank-exposes-customer-data-7000024184/"}],"summary":"mobile bank app randomly showed other customers personal data and balance (but would not allow xfers or modification) for about an hour.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"LT","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adc931bae33c58ee0ea6a8ea2adaafe79d406d48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B415D2D0-5ECA-4D3A-A37B-640FF659C53E"},"incident_date":"2013-12-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e43729679601","org_name":"Royal Bank of Scotland Group PLC","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyrecord.co.uk/news/local-news/three-men-arrested-west-stirlingshire-2945395"}],"summary":"Police in Stirlingshire have been investigating a spate of incidents in which thieves out to plunder bank accounts have added skimming devices to hole-in-the-wall machines. Police probing ATM fraud in Stirlingshire have this week made arrests. Three Lithuanian men were taken into","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84a21ec8ad2b73473123597b5e745f58b39646e3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"376F9AAD-7EA1-4B15-8BDC-EE457BFCF152"},"incident_date":"2013-12-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"984f86e6b59b","org_name":"Radio Free Europe / Radio Liberty","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Radio-Free-Europe-Website-Hit-by-DDOS-Attack-During-Kiev-Protests-407319.shtml"}],"summary":"\"The website of Radio Free Europe/ Radio Liberty, a media organization that has 700 journalists across 21 countries, was disrupted by a distributed denial-of-service (DDOS) attack on Sunday, just as it was providing extensive coverage on the ongoing protests in Kiev, Ukraine.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"807dc706032949a9e4e8cd8114a3e9402d0a41f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24CDDAD9-E931-44F8-8AF8-21AE8ACC426C"},"incident_date":"2013-12-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9d57493dd68c","org_name":"National Air Traffic Services, Ltd.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/travel/article-2520645/Ryanair-condemns-Air-Traffic-glitch-delayed-100-000-flight-passengers-weekend.html"}],"summary":"Technical issue causes availability loss of the telephone computer system at National Air Traffic Service. Flight delays were realized at major UK airports.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"daf0eca2c4bdcf8ba481c1401ff329f86246a6e7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3B096B4-FB2B-4434-AB85-21F2746E6BC9"},"incident_date":"2013-12-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f572bdf0eb6b","org_name":"Vegas Tripping","org_type":"technology_saas","ransomware":null,"records_affected":4366,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/12/07/vegas-tripping-hacked-4000-accounts-leaked/"}],"summary":"Website hacked via unknown method and credentials posted to public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"488fad0c0a306a5802a0a456e4abefb656ffae43","impact_type":"data_theft","imported_from":null,"incident_date":"2013-12-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"SK","org_id":"a57c6dbe996e","org_name":"Pixel Federation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Pixel Federation","type":"hibp","url":"https://haveibeenpwned.com/Breach/PixelFederation"}],"summary":"A breach of Pixel Federation’s web-based game community exposed email addresses and passwords from 38,108 accounts, which were posted online.","supporting_quote":null,"technology_involved":["web-based game community"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"666b84a1a58887b30ad0734afc792a74c5b43b8e","impact_type":"unknown","incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Horizon%20BCBSNJ%20-%20Incident%20Notification%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"85b35ee0212c","org_name":"Horizon Healthcare Services, Inc.,dba Horizon Blue Cross Blue Shield of New Jersey, and its affiliates","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43443"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78b7e7839da04af61b00600fc845aafc45f31b8c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4DBD8F6-35E6-4330-8C83-123382BDC232"},"incident_date":"2013-12-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56e7c349100b","org_name":"Associated Urologists of North Carolina","org_type":"healthcare","ransomware":null,"records_affected":7300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen laptop stored medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f63e3b7d0b8f3d5424177b5b4525d8ba5fd924f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB2D8E43-7A5E-490D-AA59-3EF0A87596DD"},"incident_date":"2013-12-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0161a98f5f50","org_name":"UK Council for Graduate Education","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/12/05/uk-council-for-graduate-education-rehacked-internal-message-from-janet-posted-in-deface/#.Up-x6gF00co.twitter"}],"summary":"Website defaced (again) by unaffiliated external actor. No details provided on exact methods used to compromise site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"660dc8325c62c107c3222a4c397b2cfcf4dfa4d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2968131A-3B99-44E4-9665-0458FB929388"},"incident_date":"2013-12-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"494047fc2bcd","org_name":"Susquehanna Health","org_type":"healthcare","ransomware":null,"records_affected":657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/additional-information-on-susquehanna-health-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-239980.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/latest-update-to-hhs-breach-tool-discloses-previously-unknown-breaches/"}],"summary":"On April 22, I noted that Susquehanna Health had notified HHS that 657 patients were affected by a breach on December 5, 2013 involving Unauthorized Access/Disclosure, E-mail. I could find no statement on their website at that time. I still cant find one, but their report to the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9dd885bf8ec9fca06d9ab2812e214739791f504c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F6EEA86-BBE6-4E5B-8BEE-752D8167884A"},"incident_date":"2013-12-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc90f92e1489","org_name":"Southwest General Health Center","org_type":"healthcare","ransomware":null,"records_affected":480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/healthfit/index.ssf/2014/01/southwest_general_notifies_obs.html"}],"summary":"Southwest General Health Center is notifying about 480 patients who were part of an obstetrics study that some of their private information was recently lost, including names, clinical information, data on births and medical record numbers.  The data was included in one binder, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials","financial"],"disclosed_date":"2013-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7022e1e2da78eae1919fcfc3d150960be90c618c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/12.5.13%20Letter%20to%20Cardholders%20CALIFORNIA_0.pdf"},"notes":null,"org_country":"US","org_id":"85847079d597","org_name":"JPMorgan Chase Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/12.5.13%20Letter%20to%20Cardholders%20CALIFORNIA_0.pdf"}],"summary":"JPMorgan Chase said some personal information may have been viewed improperly on databases supporting its website, with no evidence that the information was used improperly.","supporting_quote":null,"technology_involved":["website databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bec605d614608da997ff3ed7f3a918940f8e32c8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"504273CF-C450-4673-AD26-702CFD78EB14"},"incident_date":"2013-12-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8bd1706300d","org_name":"Houston Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/houston-methodist-hospital-acknowledges-data-breach.html"}],"summary":"A laptop belonging to the Houston Methodist Hospital containing encrypted information from 1,300 patients was stolen on Thursday, according to KHOU.com. Paper files were also reported missing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials","internal"],"disclosed_date":"2013-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"545dc7b2a32db355d024e2817698fc78ab96ab70","impact_type":"data_theft","imported_from":null,"incident_date":"2011-12-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"5bb9c326e0e8","org_name":"Stratfor","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Stratfor","type":"hibp","url":"https://haveibeenpwned.com/Breach/Stratfor"}],"summary":"Stratfor was attacked in December 2011, and user accounts, email, internal system data, and credit card details were disclosed.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-12-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb3f533e8b3699609a4cc83bf3f8f3f319c13756","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2011-06-02","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"c3bd7530b050","org_name":"Sony","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A SQL injection vulnerability in sonypictures.com exposed accounts across multiple systems.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Sony","type":"hibp","url":"https://haveibeenpwned.com/Breach/Sony"}],"summary":"A SQL injection vulnerability in sonypictures.com exposed accounts and plain-text passwords across multiple Sony systems.","supporting_quote":"A SQL Injection vulnerability in sonypictures.com lead to tens of thousands of accounts across multiple systems being exposed complete with plain text passwords.","technology_involved":["sonypictures.com","web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":"Gnosis","variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"001827bfe3e7826c7beaeb7cf2652a3920f9b7c6","impact_type":"data_theft","imported_from":null,"incident_date":"2010-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"records_affected not found in source; cleared","org_country":"unknown","org_id":"e7153d05152d","org_name":"Gawker","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Gawker","type":"hibp","url":"https://haveibeenpwned.com/Breach/Gawker"}],"summary":"Gawker was attacked by the hacker collective Gnosis, which published information about users including email addresses, passwords, and usernames.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"hacking","derived":{"actor_id":"gnosis"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36b9204afaf9d13273fe7ef430fd1d9dac300214","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Data%20Server_Active%20CM%20Letter_%28MSC%29_EN_Final_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43422"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43483"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43514"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43530"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43655"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43737"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Data%20Server_Active%20CM%20Letter_%28MSC%29_EN_Final_0.pdf"}],"summary":"A merchant where American Express cardholders used their cards detected unauthorized access to data files that included card account numbers, names, and other card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1ca33ac8b359405f51a2c92ad9b519c699a1f6","impact_type":"data_theft","imported_from":null,"incident_date":"2013-10-04","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"unknown","org_id":"c33b99e67332","org_name":"Adobe","org_type":"technology_saas","ransomware":null,"records_affected":152445165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Adobe","type":"hibp","url":"https://haveibeenpwned.com/Breach/Adobe"}],"summary":"Adobe accounts were breached, exposing usernames, email addresses, encrypted passwords, and plain-text password hints.","supporting_quote":null,"technology_involved":["Adobe accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":null,"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c10e8c1e7ad6bba5e2407c7fa0b6e81ec9d9ea2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"624BE66F-5041-4E5D-8910-5C13A2ED4E10"},"incident_date":"2013-12-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/RS%20RMD%20Incident%20121313%20notification%20letter_0.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/drowning-in-breach-reports-today/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-235444.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43534"}],"summary":"A MassMutual retirement services account manager sent a secure email to an individual at a MassMutual retirement services client.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-12-03","discovered_date":"2013-11-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cefad18639fd8887165b0d3f0386f744172f7a39","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-11-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/B%26G%20Foods%20Consumer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"95b659daf360","org_name":"B&G Foods, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/B%26G%20Foods%20Consumer%20Letter_0.pdf"}],"summary":"B&G Foods reported that an unauthorized third party attacked the Maple Grove Farms e-commerce website and may have accessed customers' personal and payment-card information.","supporting_quote":null,"technology_involved":["Maple Grove Farms e-commerce website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68410023280a00f195f259397bb32df731e46c15","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FBE7156-1272-402A-BA4C-5A23A7D0C4D9"},"incident_date":"2013-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cbd4bf787a2","org_name":"University of Texas MD Anderson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":3598,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhs-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mdanderson.org/about-us/compliance-program/substitute-notice.html"}],"summary":"The University of Texas MD Anderson Cancer Center in Texas reported that 3,598 were notified of an incident on December 2 involving a portable electronic device.  The missing thumb drive is believed to contain some patient information, including first and last names, medical reco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b225545faf4d8dfdd12bc741ca8f3653399825","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1CE7A1C-DBA8-478B-8213-28F21E54AD1C"},"incident_date":"2013-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"185a060946cc","org_name":"The Brooklyn Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":2172,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/brooklyn-hospital-center-notifies-patients-of-stolen-usb-with-medical-information/"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb95dff63dcdccc3d930178a7f67bf21d4a3ba2f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"354A6BE6-50DA-48A9-AB27-D86851AB90AC"},"incident_date":"2013-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"787539fe80cd","org_name":"Ohio Department of Job and Family Services","org_type":"government","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox45now.com/shared/news/top-stories/stories/wrgt_vid_17667.shtml"}],"summary":"Hard Drive with Social Security Numbers Stolen from State Agency","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-12-02","discovered_date":"2013-10-18","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35abe11ad67823bf45eeeee01891693865f0c0d8","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Maricopa%20breach%20notice11_13_0.pdf"},"notes":null,"org_country":"US","org_id":"b8f57f590841","org_name":"Maricopa County Community Colleges District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43403"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Maricopa%20breach%20notice11_13_0.pdf"}],"summary":"Maricopa County Community Colleges District reported that its IT systems may have been accessed without authorization, potentially exposing personal and financial aid information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00e19d84b804aa2b3fb4fbe5b84c05bafbe813c6","impact_type":"unknown","incident_date":"2013-08-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/BBC_Sample_Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"57dce5170d3d","org_name":"Board of Barbering and Cosmetology","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43399"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ddedae70fa04572f332a364fd6a07e503f71c00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEF7A235-EAE6-469E-9B2E-B6EA30FC54A4"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"26af69d88e94","org_name":"Well.ca","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itbusiness.ca/news/well-ca-loses-customer-credit-card-data-in-security-breach/46993;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.squawkfox.com/2014/02/18/well/"}],"summary":"Customer payment card information breached at \"service provider\" of victim. Says a vulnerability was exploited, but that's it. Unknown amount, \"thousands\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63067d222b8caeb73a7cd9cf2fe9302f9a70d15b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"091C4449-F7D2-4378-9A06-641F6EEB272E"},"incident_date":"2014-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/30/phi-mishandling-montana-va-leads-possible-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://content.foxtvmedia.com/whbq/Patient_Information_Incident_2-13-14_release.pdf"}],"summary":"PHI was mailed to the wrong individual","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1e1c7b1c9e94c0dbf3d75c3e8c7044a9462673f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1129B03-711E-4D0A-8973-866551374EC1"},"incident_date":"2013-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37e0605bb213","org_name":"University of California Davis","org_type":"education","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news10.net/story/news/2014/01/27/patient-information-may-be-exposed-in-uc-davis-health-system-breach/4954555/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/uc-davis-warns-of-potential-data-breach-after-abnormal-activity-detected-in-email-account.html"}],"summary":"UC Davis Health System officials are notifying 1,800 patients that their personal or medical information may be compromised after three doctors were hit with an email phishing scam.  The physicians' email accounts were exposed to malicious software in the mid-December security br","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"UA","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"892a486ddb4ae57fde6f1831aaa7de9ac8c35f4e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AD01CA4-AE59-433A-8EE0-066B2A9E7D2F"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"0d58877c7c28","org_name":"Ukraine's Interior Ministry Website","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://en.ria.ru/world/20131201/185186195/Ukrainian-Interior-Ministry-Website-Reportedly-Hit-By-Hackers.html"}],"summary":"The website Ukraines Interior Ministry is currently inaccessible, having apparently fallen foul of a distributed denial-of-service (DDoS) attack by hackers, local media said Sunday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aa7f01fa30dbcba9011921609aaf8e5fac32900","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BAD622D-EF36-4254-BB38-6C9A3C69CE7D"},"incident_date":"2013-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"18b1e0fe2bc4","org_name":"Tullamore Credit Union","org_type":"financial","ransomware":null,"records_affected":3577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.herald.ie/news/5000-hit-by-credit-union-online-data-breach-29864857.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/news/ireland/irish-news/tullamore-credit-union-to-write-to-customers-over-data-breach-1.1643467"}],"summary":"Publishing error exposes 3,577 accounts on public credit union site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72ccccd62b86cc569e7ec63822cf5b539e75bd3a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF3B4A64-A925-4A8E-9BC7-37CAA609A267"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"42fa60108427","org_name":"The Ministry of the Interior of Peru","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Peru-s-Ministry-of-Interior-Admits-Being-Hacked-by-LulzSec-Peru-415640.shtml"}],"summary":"Peru's Ministry of Interior compromised by LulzSec faction.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TH","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2beb02eba19df310ab5fda6319eff946bfb9c59","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2640A6B4-7F2D-43AF-93E6-DD9CBE19658F"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"e9120120f891","org_name":"TH CAT Telecom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bangkokpost.com/most-recent/382888/internet-firms-count-b1bn-cost-of-outage"}],"summary":"A power cut by anti-government protesters at CAT Telecom in Bang Rak district the past weekend cost internet-related firms opportunities worth at least 1 billion baht, says an internet service provider. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"387f320455faed6c119d54965d82df4a97266faf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B492479-EF98-4426-8FA2-81843D407844"},"incident_date":"2013-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6106f411168","org_name":"Saint Francis Hospital and Medical Center","org_type":"healthcare","ransomware":null,"records_affected":858,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/patients-notified-after-paper-records-stolen-47149-1.html"}],"summary":"Hartfords Saint Francis Hospital announced last week that printed records, which carried medical information of 858 patients, were stolen late in December.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f668c4e726f5562d98ac5e7e13d6c2a1a6241e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5476074D-ECF9-4031-B9E8-0B47B1DEBA84"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97f1845b1419","org_name":"Purple Cow gas station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wkrg.com/story/24208554/credit-card-numbers-stolen-in-dawes-area"}],"summary":"Credit card compromise at a gas station. Unknown actors and actions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00886d4982a47756a271c6e560a064c20fbb52d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"331DF63A-C160-406E-AAFD-B3BB173D6E77"},"incident_date":"2013-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4faf7df7cef9","org_name":"Obamacare","org_type":"financial","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.click2houston.com/news/crime/man-stole-personal-information-from-people-signing-up-for-obamacare_20151123143124540"}],"summary":"A government contractor in Houston who was supposed to be signing people up for Obamacare stole personal information from at least 17 people around the country.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b36ef3f27f3d53334514103a6d6977aa5925a2f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"720099DE-69A3-4762-B660-9825E00FE355"},"incident_date":"2013-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"322da77c3dc6","org_name":"Nielsen Audio","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/nielsen-staffer-accidentally-sends-mass-email-containing-employee-data/article/333320/"}],"summary":"HR employee erroneously emails employee PII to other employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffe4230fca0fbae320728c52ca20856fef9c92b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21A801A7-9C83-436C-AC6B-97C62B17DFA7"},"incident_date":"2013-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e1cef463a23","org_name":"New York Department of Motor Vehicles","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ig.state.ny.us/pdfs/BourneDMVSenecaCoPR5-31-13.pdf"}],"summary":"Patricia I. Bourne, a 56 year old License Clerk from Waterloo, was charged with 11 felony counts of Computer Trespass and one misdemeanor count of Official Misconduct for repeatedly accessing the records of an individual known to her between December 2012 and January 2013. Bourne","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"981038b0e63fd3ffbcca5cefed427af7b2613b3c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E10B620B-0055-4CEF-892B-96BCE7EFD7F4"},"incident_date":"2013-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1d6e40511181","org_name":"Ministry of Highways and Infrastructure","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://regina.ctvnews.ca/sask-privacy-commissioner-blasts-ministry-over-handling-of-snooping-incident-1.1575875"}],"summary":"Employee misused privilege to lookup personal contact information of a resident they were in an accident with.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84f616d1f54899a61fc09e7a2232111d6e183590","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8564AAFD-FD15-4A66-8A9C-7CFC4D7AFF8C"},"incident_date":"2013-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c218683d3008","org_name":"Fresenius Medical Care of North America","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fresenius-medical-care-notifies-dialysis-patients-of-missing-usb-drive/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-237719.pdf"}],"summary":"In December, Fresenius Medical Care of North America (FMCNA) discovered that a USB drive with patient information was missing from their Robinwood Dialysis Center in Hagerstown, Maryland. The drive had been attached to a computer in the dialysis center.  The information on the mi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38be221fed1f9ebc071ed76741bb5422fcecc22e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5AA49BCD-3D1C-457D-B534-BE303CA67B05"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"23153c4a79eb","org_name":"Federal Government of Brazil","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/More-Brazilian-Government-Sites-Hacked-in-Protest-Against-2014-FIFA-World-Cup-413594.shtml"}],"summary":"Multiple Brazilian government sites defaced by Anonymous in protest to upcoming FIFA World Cup.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6af72dbc7b214fa9a04ab7b86ffaebde5dad5f97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42D99EE9-709A-4CB6-AD3D-C5C4E1FB59EF"},"incident_date":"2014-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5b9fc4dd5386","org_name":"Department of Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ntnews.com.au/news/northern-territory/health-workers-bullying-problem-in-nt-out-of-control/story-fnk0b1zt-1226909409824"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/mygov-health-records-breached-in-site-flaw-7000035180/"}],"summary":"TERRITORY Health Department insiders have aired claims of endemic bullying at the hands of departmental managers they say are shielded by a culture of intimidation.  One manager, who spoke on the condition of anonymity, said he had never seen anything like it in more than two dec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"065aa5ba4998b40c495efb5dc8bcf08df8127e57","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D8523AB-0087-461A-8409-EB7731178267"},"incident_date":"2013-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85d1b3ec47b6","org_name":"BRG Sports, Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eastonbellsports.com/general-letter/;https://www.idradar.com/news-stories/identity-protection/Is-Easton-Bell-The-Big-One-Breach-Experts-Have-Predicted;http://www.databreachtoday.com/sports-equipment-retailer-hit-by-breach-a-6423;http://www.scmagazine.com/card-data-accessed-in-malware-attack-on-easton-bell-vendor-servers/article/330214/"}],"summary":"Malware was introduced into vendor servers, which gave an unauthorized party access to the personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01330dcec3702b0f1d9e841645f4379db0b3fcba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"731CFC33-3576-4C11-814F-3A2D66795DF1"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RO","org_id":"3fec12aaa1f3","org_name":"AdNet Telecom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hacker-Claims-to-Have-Breached-AdNet-Telecom-Customer-Information-Stolen-408869.shtml"}],"summary":"Extenal agent compromises telecom servers and posts information to public sites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e25ab27841f94d45be1862dd368cd04ced88489","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D2F56B9-6C27-4D38-9D97-8A026140F830"},"incident_date":"2013-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"59ae8e0524b3","org_name":"\"a college in Songjiang District\"","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shanghaidaily.com/metro/society/Two-students-accused-of-hacking-school-grade-system-altering-records-for-200-classmates/shdaily.shtml"}],"summary":"two students hacking into school system to change P.E. scores for students, 200 other students then started to pay them to modify theirs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e03c7dc38cced639d1478304a078b672ae820ad7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E653E42A-5D59-4933-944B-CE1BE222E68B"},"incident_date":"2013-11-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87f7e200c251","org_name":"US Army","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://identitytheftsolutiontips.com/pomona-men-accused-of-stealing-identities-of-us-army-reservists"},{"fetched_at":null,"title":null,"type":"press","url":"http://archive.armytimes.com/article/20140513/NEWS06/305130064"}],"summary":"US Army Reservist provided PII to external actors who used information for ID fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b7f31029b0d054383e91de84aa5a0c8ce079e04","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7987E38C-19E5-4D95-950D-F2838B6CCC9B"},"incident_date":"2013-11-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33e2efa70ce9","org_name":"City of Chicago","org_type":"government","ransomware":null,"records_affected":2080,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in exposure of 2080 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ceaf471b218d8f0e959c5983167444eb0391ffcf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF3BEE5E-7FF8-4C93-B703-EF9E8C9AE142"},"incident_date":"2013-11-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3359c883fd0b","org_name":"The Royal Bank of Scotland Group plc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cumbernauld-news.co.uk/news/local-news/atm-skimming-device-found-in-kilsyth-1-3219713"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/36033/second-rbs-outage-in-a-week-paves-the-way-for-phishing-extravaganza/"}],"summary":"Police say they retrieved a skimming device from the Royal Bank of Scotland in North Lanarkshire. It is believed the device may have been placed on the ATM sometime between 5pm and 6.30pm on Thursday, November 28. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27d07a5ab09ff673cb763c5026ea5f98243cadda","impact_type":"unknown","incident_date":"2013-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/MMC%20Notification-Kroll%20Data%20Incident%20Individual%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"40adef7bb54e","org_name":"Marsh & McLennan Companies, Inc. and our affiliates","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43389"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d5fd5c2c97fc1c7c070163cd6a5fec1ff569cde","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37BB4D4A-FE99-418A-9D6D-EFAEF716DC1E"},"incident_date":"2013-11-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c02406c0d1b4","org_name":"Jones Chiropractic and Maximum Health","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen desktop computer leaves 1500 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47e3e279cb16e93c5e2da986d15a9ef2340b19e1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95C3DCCB-329F-4580-AFFB-D7B0486B2F5F"},"incident_date":"2013-11-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce366697449f","org_name":"Geisinger-Bloomsburg Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/pa-geisinger-bloomsburg-hospital-notifies-patients-of-missing-laboratory-records-and-specimens-from-2006-and-2007/"}],"summary":"Geisinger-Bloomsburg Hospital in Pennsylvania posted this notice to their patients on the home page of their website:  Geisinger-Bloomsburg Hospital (G-BH) is committed to serving the health care needs of the Bloomsburg and surrounding communityincluding protecting the confidenti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6214aa8796a1fb93ef3f8335a0245ff9ffb036a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B88F791-35FD-401C-800D-29F7F4300C7C"},"incident_date":"2013-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"77a435d6d11c","org_name":"Telecom Test Australia","org_type":"other","ransomware":null,"records_affected":78,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/atd5DiJH"}],"summary":"Telecom Test Australia admin and user passwords leaked. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7b82e9e145589ee334cabee7d090c2622e25ed8","impact_type":"unknown","incident_date":"2013-09-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/2013-09078%20Patient%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1d5b3ba4e8d9","org_name":"Kaiser Foundation Hospital Orange County, Anaheim Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43366"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-11-25","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73ab3f3cd0af02b2280deebcb1b1fa947fd3ffd3","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/FRN%20Breach%20Notice%20Letter%20%28CA%29%20%28SSN%29_0_1.pdf"},"notes":null,"org_country":"US","org_id":"0a939b4501b3","org_name":"Foundations Recovery Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43360"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/FRN%20Breach%20Notice%20Letter%20%28CA%29%20%28SSN%29_0_1.pdf"}],"summary":"Foundations Recovery Network reported that an employee’s stolen company laptop contained patient personal and medical information, though access to the information was unknown.","supporting_quote":"On Saturday, June 15 th, one of our employees informed us that she had been the victim of a burglary during the early morning hours on June 15 th at approximately 2:45 a.m. and that her company laptop had been stolen.","technology_involved":["company laptop"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a02ec5438690ce5b4e67248404cdba1b244d8ff5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5a6d4a10-cf3c-11e9-89a9-015b821d7cea"},"incident_date":"2013-11-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CO","org_id":"c33731b892df","org_name":"Filialcoop","org_type":"financial","ransomware":null,"records_affected":54000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://the-parallax.com/2019/08/27/colombia-filialcoop-loan-calls-leak/"}],"summary":"Colombian Load Provider leaks recording of customer calls and is discovered and notified by security researcher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56b5bb7d1551adc4ab7d3aedfc92262370511497","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38269AFD-8CEF-4109-92CE-8ABCF8C60E5C"},"incident_date":"2013-11-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"e841204951c8","org_name":"Tumblr","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ouch-tumblr-gaffe-exposed-passwords-in-plain-text/"}],"summary":"Tumblr sent emails to members with their password in the subject line and body of the message. A mail merge error of some sort substituted users' passwords for their usernames in the messages. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ef26038e25b198499b80e9b3e9caf5a635ad9cd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43BD03E8-9BDB-4E5D-89C5-50293F5E4DDF"},"incident_date":"2013-11-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8020b0d3fbe","org_name":"101 Family Medical Group","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrnotifications.hhs.gov/iframe?utf8=%E2%9C%93&location_ids[]=1&state_id=&start_breach_date=&end_breach_date=&business_associates_present=&search_box=101+Family+Medical&commit=Apply+Filters"}],"summary":"Laptop contained 2500 patient's data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fad8725077396c4c671ebc128936f297d675fc86","impact_type":"unknown","incident_date":"2013-09-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CUBS%20-%20Potential%20Privacy%20Breach%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1fe8fd36d7ef","org_name":"Employment Development Dept.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43354"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a914593c9b4869e09776bd623526fd60d6aa46a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46B231B2-C6C1-4A74-B163-DE02D7F725E0"},"incident_date":"2013-11-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eb0eb35381b7","org_name":"Dr. Ronald Schubert","org_type":"healthcare","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/hundreds-impacted-after-washington-doctors-laptop-is-stolen/article/331635/"}],"summary":"Laptop stolen from person's car","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdd9894269da3fda1ad5795142d16318376842cd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7593CD4E-09E0-4CC2-8DE4-D4F1888AE3B2"},"incident_date":"2013-11-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"af8411abf07a","org_name":"Barclays PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stourbridgenews.co.uk/news/10834707.Cash_skimming_device_found_on_Kinver_cash_machine/"}],"summary":"PEOPLE in Kinver are warned to be vigilant after a cash skimming device was found on a village cash machine. The device was found on the Barclays Bank cash point in the High Street by a man who went to make a withdrawal at 7.10am on Friday November 22.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd49a3e9fa16f29f28bb9b379bce0b640cc84800","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2CE5D9F3-4B12-43BD-9C6A-6E31D0056F5C"},"incident_date":"2013-11-21","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f3cdf8d4e79f","org_name":"The Department of Health Care Policy and Financing","org_type":"other","ransomware":null,"records_affected":1918,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/colorado-notifies-1918-medicaid-clients-of-hipaa-breach-by-contractors-employee/"}],"summary":"The Department of Health Care Policy and Financing announced today that client information was sent from a work to a personal email address by a temporary employee of its contractor, the Colorado Community Health Alliance (CCHA). The list may have been sent for the employees pers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"968e44f98ca24c9f71c96311831d97bd01e28c88","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20-%20State%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"630ea16dfb3a","org_name":"Kroll Background America, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43342"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1973c8ed1028528d3c9393135db82a6b99e82438","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/To%20whom%20it%20may%20concern_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c63313f71f56","org_name":"Flamingo Resort and Spa","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43343"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83514c5397a6f32277042a40b323dfb39829823c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5AD26EE-822D-4C2B-A0D8-C9ACA82068C7"},"incident_date":"2013-11-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f088bbd31393","org_name":"Redwood Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1039,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/11/20/over-1000-notified-of-missing-thumb-drive-patient-data/"},{"fetched_at":null,"title":null,"type":"press","url":"http://mobile.esecurityplanet.com/network-security/redwood-memorial-hospital-admits-data-breach.html"}],"summary":"Redwood Memorial Hospital of Fortuna, California mailed letters to 1,039 patients informing them of a missing thumb drive from the Cardiopulmonary Service Department that may have been storing protected health information (PHI), according to the Times-Standard. The drive, which w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e70c5e20d47427e40534d62acc3d68f1d90db5c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25A62530-4C21-496C-8141-F269356C45B5"},"incident_date":"2013-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"5d8bf8c35c62","org_name":"Raffles Girls' School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.asiaone.com/news/digital1/sam-singed-13-schools-hacked?page=0%2C1"}],"summary":"schools website defaced. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-11-20","discovered_date":"2013-04-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69ee7b59d03ce64e059b3e102708b137b250c453","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"afd82bd2a1b2","org_name":"Kathleen E. Whisman MD","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43325"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification_2.pdf"}],"summary":"Patient information from Kathleen E. Whisman MD was found on a suspect’s computer, and the organization said it could only speculate that it had been removed from a stolen computer.","supporting_quote":null,"technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"ID","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bea7dd32156dd433ddabe22053529f08fcfeee7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"078D63FA-B949-4357-8E4D-431D5252183D"},"incident_date":"2013-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c80618524481","org_name":"Australian Federal Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/technology/technology-news/afp-and-rba-websites-suffer-cyber-attacks-20131121-2xwns.html"}],"summary":"The Australian Federal Police and the Reserve Bank of Austrailia were victims of a DoS attack. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"298c527121fc6e9a5cfb22fd8b6abfbc09adb91a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"616C7BEB-4F4C-4673-8177-BAD8DC5A9658"},"incident_date":"2013-11-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ff526bb88716","org_name":"Wellington City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.radionz.co.nz/news/regional/230827/privacy-breach-at-wellington-council"}],"summary":"Contractor for New Zealand city council provided PII as part of an official information request.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f540975e29d7cd34ca761d7368dbb1c3b080c1b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4D747A1-D7B2-4FFE-B71B-70DE1673DF72"},"incident_date":"2013-11-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bf1ad1c8a5c","org_name":"Oregon Health Insurance Exchange Corperation","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/health/index.ssf/2013/11/cover_oregon_health_exchange_w_1.html"}],"summary":"3 misdeliveries in November send PII from one or more applicants to another. Issue stemmed from picking up the wrong papers from a shared printer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95c8f7dc0f4ca0ababa17278cf761fc37d690bb9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2574A0E5-B22E-4C22-B866-11D9CE0920BF"},"incident_date":"2013-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c69e9d4e8759","org_name":"United Dynacare, LLC dba Dynacare Laboratories","org_type":"healthcare","ransomware":null,"records_affected":9328,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen portable electronic device results in exposure of 9328 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c5b3e7855f0e126e8666e36c6ab36f64128fe20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4BB2551-B201-4BFE-ACAB-5DA3DA6BAAE9"},"incident_date":"2013-11-18","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4daf8d16ef85","org_name":"Omnicare, Inc.","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kake.com/home/headlines/Wichita-man-believes-identity-thief-was-medical-billing-employee-236496351.html"}],"summary":"Billing employee used credit card number acquired during her job duties to make several fraudulent transactions. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94569428963c692664f8a5ecf86c89b411326e2d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0B388C8-69EB-4F12-8F28-7EA24EFF0131"},"incident_date":"2013-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"935c9b43e342","org_name":"Network Pharmacy Knoxville","org_type":"retail_ecommerce","ransomware":null,"records_affected":9602,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhs-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Network Pharmacy Knoxville in Tennessee reported that 9,602 patients had data on laptop that was stolen on November 18. A cached copy of a legal notice that appeared on January 20 in the Times Free Press reads: LEGAL NOTICE Network Pharmacy, Knoxville Reports Possible Breach of I","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0516f79fe9302d5e2ef91744b0a94abaa62e420e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"058F2F26-43D1-4B74-B280-5E456FD11D24"},"incident_date":"2013-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b99063355c0a","org_name":"Battlefield","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/battlefield-4-pc-servers-experience-ddos-attack/article/321506/"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0998620a75d5ba48ab9a48537b3543fa3f149726","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09DE2624-943D-4751-AD84-51A402B8E920"},"incident_date":"2013-11-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"515b3c8efa0c","org_name":"Hetzner","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Web-Hosting-Provider-Hetzner-Hit-by-Large-DDOS-Attacks-401121.shtml"}],"summary":"the systems of Germany-based web hosting provider Hetzner have been hit by a distributed denial-of-service (DDOS) attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5585a66e2aaf1498ddc1fdf0449c35b834d6a51a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD1AA7B0-BBDC-4A1E-BEDE-5C093717B194"},"incident_date":"2013-11-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4341a7aa6e2","org_name":"Virginia Department of Medical Assistance Services","org_type":"government","ransomware":null,"records_affected":25513,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrnotifications.hhs.gov/iframe?utf8=%E2%9C%93&state_id=&start_breach_date=&end_breach_date=&business_associates_present=&search_box=Virginia++Dept.+of+Medical+Assistance+Services&commit=Apply+Filters"}],"summary":"Unauthorized Access/Disclosure, Other","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-11-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af31555c2e7d37528e920d7b169b188c2fee9d73","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C67C9D3-9D12-4839-93FA-3BC16DC4527C"},"incident_date":"2013-11-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ee774b66acc","org_name":"Target Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":110000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nypost.com/2014/05/21/target-misses-the-mark-after-data-breach-canada-woes/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kare11.com/story/news/2015/03/18/target-poised-to-settle-2013-data-breach-lawsuit/24995033/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnbc.com/2015/08/18/target-to-pay-visa-issuers-up-to-67m-to-settle-over-data-breach-dj.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43585"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbd84f76311615b6f5241f3f641a3ebe1de49bf6","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/LCC%20-%20Client%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"61a908539869","org_name":"Lincoln Credit Center","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43266"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/LCC%20-%20Client%20Notification%20Letter_0.pdf"}],"summary":"Lincoln Credit Center notified customers that personal information related to their accounts may have been compromised at a physical location.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d94ee15c166f6bcc2f2cc3070d184247419a0b65","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"452A1A1E-053C-46D6-8387-1227F1002793"},"incident_date":"2013-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"bbd0e2ee7e2c","org_name":"BIPS","org_type":"financial","ransomware":null,"records_affected":1295,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Bitcoin-Payment-Solutions-Provider-BIPS-Hacked-1-295-BTC-Stolen-403365.shtml"}],"summary":"Bitcoin payment processor hacked, over 1000 Bitcoins were stolen. A DDoS was launched as the first phase of the attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e1a2165cbc9a4f69904e08a35f80502ab75ecc0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5924E26D-93DA-45F7-B674-A353E0A368BF"},"incident_date":"2013-11-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"b7910040080d","org_name":"Radio Free Eurpore","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.yahoo.com/us-funded-radio-says-faces-153507327.html"}],"summary":"U.S.-funded Radio Free Europe/Radio Liberty says its news services have been disrupted a cyber-attack (DDoS).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2eee76ccb33e3387842edc6797524655319c0b83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CA1B729-971B-4660-8456-4DAA4F252C8A"},"incident_date":"2013-11-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d0ec21c048a0","org_name":"Commercial Metals Co","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.amm.com/Article/3298287/Scrap/Former-CMC-employee-accused-of-taking-trade-secrets.html"}],"summary":"Employee misuses network access to copy customer information, including phone numbers and purchasing information. This information was used after he left the company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1552"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"026b73b42d54532c44f2eeaf7cb2d9386e0f245f","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%201_0.pdf"},"notes":null,"org_country":"US","org_id":"2f0e0a15a350","org_name":"USI Insurance Services LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43247"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%201_0.pdf"}],"summary":"USI Affinity reported that malicious software was used to view files containing credentials that could access personal information, but it had no evidence that customer personal information was accessed or acquired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d4651b1f9efb30b74b0f6027962cf22c48a61b4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3397E89F-30B6-48C9-A89C-7A306F006ED5"},"incident_date":"2013-11-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02c001d599af","org_name":"New Mexico Oncology Hematology Consultants, Ltd","org_type":"healthcare","ransomware":null,"records_affected":12354,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nmcancercenter.org/hipaa-security-breach/"}],"summary":"The New Mexico Oncology Hematology Consultants breach involving a laptop stolen from an employees office has been added to the list. It reportedly affected 12,354 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cda2a22f51f3b6776bfe62f9ef3b8f17d290338d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FEFE6D3-3B58-46F8-8EEA-440DCA079EE5"},"incident_date":"2013-11-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"34c60169bbec","org_name":"Department of Arts & Heritage","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/news/ireland/irish-news/humphreys-riled-by-comments-on-data-security-1.1994305"}],"summary":"genealogy website inadvertently publishes birth/marriage/death records of citizen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2013-11-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f2eeb7d0eef9942fd6a8d5cec4ebaa40d0b2c7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6BCD580-A5F3-46D6-8046-4655BCCE36D9"},"incident_date":"2013-11-12","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f7562c20c21","org_name":"Partners In Nephrology & Endocrinology","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/pa-security-breach-compromises-credit-card-info-of-partners-in-nephrology-endocrinology-patients/"}],"summary":"A detailed statement on PINEs website explains that their login credentials to their vendors payment processor system were compromised, which gave the attacker access to patients credit card numbers, card expiration dates, and in some cases, addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1a1f696612398e2b8925712ec7f04cb43d22284","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9839935-6A5C-48A6-B0F0-5486B2665CA1"},"incident_date":"2013-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8801d86816a","org_name":"Kemmet Dental Design","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents exposes 2000 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e86f06e82b2ec8244f1763c1a4e17473d24781c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA5DC8A2-8CC8-4B46-B822-039EBCEEA69A"},"incident_date":"2013-11-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"90a12726d544","org_name":"Health Care Organization in Milwaukee","org_type":"healthcare","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jsonline.com/blogs/news/231918731.html"}],"summary":"Health care org hit with cryptolocker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46545b15337730d8f4f3206146fb5459fe20b6e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B50839C3-B491-478A-AAD7-A31FF541981B"},"incident_date":"2013-11-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9033131c8c27","org_name":"Cook County Health & Hospitals System","org_type":"healthcare","ransomware":null,"records_affected":22511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhs-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Cook County Health & Hospitals System in Illinois reported that 22,511 were notified of a breach involving e-mail that occurred on November 12.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-11-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd3f5e8f41a44c7f5a0fe9f1eac9ab542c5f663c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27E4BB0A-365B-4DBA-A140-0477F7F71647"},"incident_date":"2013-11-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7865a210d7e3","org_name":"macrumors.com","org_type":"technology_saas","ransomware":null,"records_affected":860000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/11/hack-of-macrumors-forums-exposes-password-data-for-860000-users/"}],"summary":"MacRumors user forums have been breached by hackers who may have acquired cryptographically protected passwords belonging to all 860,000 users, one of the top editors of the news website said Tuesday evening.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a785eabd07ed649e01ebbc3f733901dab35e08e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6f8afee0-e20a-11e7-8553-197c24c367d2"},"incident_date":"2013-11-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d962a50c0b","org_name":"Interventional Pain Management","org_type":"healthcare","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wivb.com/2017/11/21/arrest-of-orchard-park-doctor/"}],"summary":"A doctor who works at an Orchard Park pain management clinic has been arrested and charged by criminal complaint with obtaining controlled substances through fraud and identity theft.  The prescriptions were for opioids including hydromorphone HCL, fentanyl citrate, and morphine ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-11-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"487e2a7bcf130ba777b97f4195b4c2029871f55d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D10D32E3-4C1C-4CD1-AB9D-0D45D5740DE7"},"incident_date":"2013-11-11","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7ab62575bb2","org_name":"Federal Bureau of Investigation (FBI)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/NYPD-Detective-Admits-Hiring-Hackers-to-Breach-Email-Accounts-of-Officers-398968.shtml"}],"summary":"NYPD officer hired external actors to compromise numerous personal e-mail accounts. Using those compromised accounts he was able to acquire login credentials to the National Crime Information Center.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be208bf0b9bdb6160693474ff3a98562111983e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C87E58D-AF2E-4299-AB0D-8DBFA2EF280E"},"incident_date":"2013-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"0ef9b71bc5d9","org_name":"bitcash.bz","org_type":"financial","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/11/bitcashcz-bitcoin-exchange-hacked-money.html"}],"summary":"Czech Republic-based bitcoin exchange Bitcash.cz has been hacked and up to 4,000 customers wallets have been emptied.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PS","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f983fef0b47a710b09d8f807a0e8d760821c3aa2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75C1D47E-20B5-4D2B-81E1-A3037608F23C"},"incident_date":"2013-11-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"93d4361dc57a","org_name":"linkinpark.co.il","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Linkin-Park-s-Official-Israeli-Fan-Website-Hacked-and-Defaced-398860.shtml"}],"summary":"User-supported music fan site based in Israel defaced with pro-Palestinian message.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-11-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5620d66fa2cedd155c38738775aa12a234e5382","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05667A65-7F93-470C-BE44-B07DECBC8A48"},"incident_date":"2013-11-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac511ee7deb3","org_name":"L.A. Gay & Lesbian Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/LAGLC%20Individual%20Notice_0.pdf"}],"summary":"The L.A. Gay & Lesbian Center recently learned that the security of certain of our information systems was compromised by a criminal cyber attack apparently designed to collect social security numbers, credit card numbers and other financial information. Between November 22, 2013","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9001f82a7977a359e460b9d97fc599d9dadca78c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03A6168E-7A55-4000-8033-169112A744EA"},"incident_date":"2013-11-07","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"378cd21b8b0f","org_name":"Singapore Prime Minister's Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/singapore-prime-ministers-website-hacked-anonymous"}],"summary":"Singapore Prime Minister's Office website hacked by Anonymous. \"It's great to be Singaporean today,\" read a mocking headline in a section of www.pmo.gov.sg next to the group's trademark Guy Fawkes mask, a symbol of anti-establishment defiance worldwide. The hacker also warned of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c01272e267a0b053cd134427a677e1adda6e87d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28162EA9-2E4D-4DD1-8CDD-8DD51F3AABF9"},"incident_date":"2013-11-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"83a11d615e51","org_name":"New Zealand Courier's","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ddosinfo.com/ddos-news/new-zealand-couriers-struck-down-by-ddos-attack/"}],"summary":"New Zealand Courier's website was hit by DDoS attack and site went down for a few hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f82a5ca528dc98220d5888c0f44d63941277989","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07CB4C1F-8487-4B19-8B7F-8EAC43DF6762"},"incident_date":"2013-11-06","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3c2929268e62","org_name":"Swansea Police Department","org_type":"government","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tauntongazette.com/news/x2132756948/Swansea-police-pay-750-ransom-after-computer-virus-strikes"}],"summary":"A computer virus that encrypts files and then demands that victims pay a ransom to decrypt those items recently hit the Swansea Police Department. The department paid $750 for two Bitcoins  an online currency  to decrypt several images and word documents in its computer system, S","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30969809f4affd2bb66e570c086e9a3ef8efe1ad","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A03C5C1-1A21-4A28-9DAA-2BFC404137E8"},"incident_date":"2013-11-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec498a24d8e4","org_name":"Phoebe Putney Hospital","org_type":"healthcare","ransomware":null,"records_affected":6777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.walb.com/story/24410297/phoebe-computer-stolen-patient-info-compromise;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ga-phoebe-putney-hospital-notifies-6777-patients-about-stolen-computer/"}],"summary":"Lost device puts customer information at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2879fdcab9a8e51168fd0023d8761db4fe571b6a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BC06D9F-21C1-4725-AE20-B27355CAEB72"},"incident_date":"2013-11-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f614ed14c324","org_name":"FOX News Network, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2013/11/5/5069842/fox-news-website-defaced;"}],"summary":"foxnews.com displayed odd images. Appeared to be defaced, but was actually a prototype web site with odd, but legitimate former articles. Error was responsible for actual homepage being replaced w/ the prototype.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2013-11-05","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d08be4efd9ec834419de40c71c2a17ecbc9fee6","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2013-09-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Samples%20Notices_0.pdf"},"notes":null,"org_country":"US","org_id":"044380ce652e","org_name":"DaVita","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The laptop was stolen, and its encryption technology had been unintentionally deactivated.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43194"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Samples%20Notices_0.pdf"}],"summary":"A laptop containing DaVita patient information was stolen from an employee’s vehicle after its encryption technology had been unintentionally deactivated.","supporting_quote":"We regret to inform you that on September 6, 2013 a laptop was stolen from a teammate’s (employee’s) vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c783a43d750ef06fde40be786820ee3efa2cdd70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F220A4DA-92B1-4948-B1FD-5E7161A3680F"},"incident_date":"2013-11-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234942%20(1).pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/md-walgreens-employee-prosecuted-for-misusing-customers-credit-card-numbers/"}],"summary":"On November 27, they reported to the the Maryland Attorney Generals office that a pharmacy employee had been accessing misusing customers credit card numbers. Eight Maryland residents were affected. Walgreens learned of the breach on November 4, terminated the employee, and refer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ccb4bbc76befef6c7a2aab14d20fcf6dcd045eb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61715C8E-E3CA-4705-A458-F37A5945AEFD"},"incident_date":"2013-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ac2c71b82f2","org_name":"Next Day Blinds Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234492.pdf"}],"summary":"Actor break-in stole contents of a safe. Not disclosed what the contents were (document, computer, etc)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d809d4ad34f53f919af47dc2d59099ac084773d5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D3EBFAE-DF94-43F5-B1BC-378AB4A9E7D8"},"incident_date":"2013-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"634e1994163d","org_name":"Demand Media, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://barracudalabs.com/2013/11/yesterday-on-cracked-com-malware/"}],"summary":"website cracked.com was hosting a drive-by-download that resulted in malware being installed on vulnerable systems that visited the website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc3ab41b0e5155828bcaa24f131690e888205830","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"310AB416-F667-44AB-9652-6DBBA153416F"},"incident_date":"2013-11-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dccd954aac5","org_name":"Coulee Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/required-hipaa-breach-notification-or-political-dirty-trick/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cmccares.org/patient-privacy-notice44"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.grandcoulee.com/story/2014/01/08/opinion/appalled-at-hospitals-letter-on-breach/3467.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.grandcoulee.com/story/2014/01/15/news/doctor-building-a-tool-for-cmc-didnt-breach-privacy/3491.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.grandcoulee.com/story/2014/01/15/news/hospital-commission-forces-switch-in-attorneys/3488.html"}],"summary":"On January 4, Coulee Medical Center in Grand Coulee, Washington, posted this notice on its web site:  This notice is posted pursuant to federal Health Insurance Portability and Accountability Act of 1996 breach notification regulations found at 45 CFR Parts 160 and 164 and the He","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6ce033a120f998d513a997b52265a90af529fd9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E72AA7E-0456-4962-8D98-4930275C2163"},"incident_date":"2013-11-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/drowning-in-breach-reports-today/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234935%20(1).pdf"}],"summary":"This breach impacted one group life insurance customer in Georgia during their open enrollment. Aetna uses a vendor to support the enrollment process. On November 4, 2013, the vendor loaded information related to life insurance beneficiaries incorrectly, which may have resulted i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e13108b046e64963d0cc81db1d9be82776c31052","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E835AE3-BD03-44DF-83F5-36530C57611E"},"incident_date":"2013-11-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"767d03041f09","org_name":"Health Dimension","org_type":"retail_ecommerce","ransomware":null,"records_affected":5370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhs-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Health Dimensions in Michigan reported that 5,370 patients were notified of an incident on November 2nd involving Theft,Network Server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6db6435986ed6098c910eb9240bb7e33091bf90","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E66679F4-4DDD-4773-8692-6E720B3D554C"},"incident_date":"2013-11-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97b1456bf342","org_name":"Extra Life","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.escapistmagazine.com/news/view/129263-Extra-Life-Charity-Site-Hit-By-DDoS-Attack-UPDATED"}],"summary":"The Extra Life website has been brought down by a DDoS attack, meaning that donations to the game-based charity event for kids cannot be taken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d9a7a2b67ed18322c8555cee2a811dc4d2e51f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95C29D92-7FC4-4E33-82EB-B8801AA5C0C4"},"incident_date":"2013-11-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc7e4e40b77","org_name":"Colorado Health & Wellness, Inc.","org_type":"healthcare","ransomware":null,"records_affected":651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2013-Breaches-Matrix.htm"}],"summary":"A former doctor took patient information after ending his practice at Colorado Health & Wellness, Inc. PHI & PII affected","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"SY","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1afc0253c044b2391a1036e561fb868846b3ff8d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30642A68-C320-4006-B7D5-A97B477CD284"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16354c89b5b1","org_name":"Vice Magazine","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://grahamcluley.com/2013/11/vice-hacked-syrian-electronic-army/"}],"summary":"SEA compromises Vice Magazine in response to article on a member of their group. Article was replaced with crafted defacement.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8db56def08d20d2cff7efa86eeb14aafcda540a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F48A37A-66F5-4796-BC10-52A96550CCBE"},"incident_date":"2013-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0e1a5cf854e","org_name":"VIBCO Vibrators","org_type":"manufacturing","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.providencejournal.com/breaking-news/content/20140117-r.i.-manufacturer-vibco-vibrators-nearly-back-to-normal-after-costly-computer-hacking.ece"}],"summary":"R.I. manufacturer VIBCO Vibrators nearly back to normal after costly computer hacking","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"RS","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"369d95d00d84033fce6470ed9a8cca98963c1bbb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"129360E6-DFA5-46EB-9A20-19556828B716"},"incident_date":"2013-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52bd65b75217","org_name":"Vevo LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/vevo-website-hacked-by-teslateam-via.html"}],"summary":"SQLi used to hack media webiste. Data posted onto pastebin by hacking group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea6580e787633bfaaba235414bc8e199337bd1f4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18D56C18-7198-4502-8FCE-7F7CABC69458"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0782ad0275f0","org_name":"Vantiv Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cuna.org/Stay-Informed/News-Now/CU-System/Data-Breach-At-Card-Processor-Impacts-CU-In-Idaho/"}],"summary":"Vantiv's database was hacked and information of customer belonging to Horizon FCU was stolen and used in fraudulent transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e43024bd1f2ca79bb67f8863ee99b5ded3cef04","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E07E13F-FA63-49CB-ACA3-B216B112805C"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"53cfc2128a51","org_name":"UA Customs Service","org_type":"government","ransomware":null,"records_affected":64,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Ukraine-s-State-Customs-Service-Targeted-by-Anonymous-Hackers-400518.shtml"}],"summary":"Members of the Anonymous movement claim to have breached the servers hosting customs.gov.ua, the domain used in the Ukraine by the countrys State Customs Service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89af43fbe294ec0dbdc2144f4ebf6ff671d25c56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B00CB6F-B9B3-40E6-A390-FDA9C49D49A7"},"incident_date":"2013-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4adcaf1fb9c4","org_name":"Texas Wellness Incentives and Navigation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/university-of-florida-and-texas-hhsc-notify-texas-win-project-medicaid-patients-of-breach/"}],"summary":"The University of Florida and the Texas Health and Human Services Commission (HHSC) are partners for the Texas Wellness Incentives and Navigation (WIN) Project for Medicaid patients.  In a newly disclosed breach, the University of Florida, acting as a partner of the HHSC, sent le","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"326446f9e820c04ac251dcd6e4cd69618292ad16","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"780C1AFD-048E-494A-BFD7-AB992A91C31B"},"incident_date":"2013-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"a98298ce9d6a","org_name":"Syria Customs Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Leak-Data-Stolen-from-Syrian-Customs-Website-396729.shtml"}],"summary":"Anonymous hacks into Syrian Customs Office and posts nonpublic information to pastebin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca5c1ac8c23d00cee4aff32f22791ac66d130a5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F022EA97-4464-4F76-9691-D431AFFF5464"},"incident_date":"2013-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83be5a07f2d8","org_name":"State of Florida Department of Economic Opportunity","org_type":"government","ransomware":null,"records_affected":45,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/news/article/343599/19/Security-breach-for-people-getting-unemployment-benefits"}],"summary":"There is another problem with the Department of Economic Opportunity's expensive computer system that is affecting people getting their unemployment benefits.  The latest glitch has the department sending out a letter to businesses explaining that it mistakenly released \"social s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc502a14ed1251428e53349e5bfe5f87e9242a24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B8C31B2-FCC0-4F6C-8B82-2411BBC09A1D"},"incident_date":"2013-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"916b76317333","org_name":"Siam Commercial Bank PCL","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bangkokpost.com/news/local/378695/stolen-money-sent-to-ukraine-after-atm-accounts-skimmed"}],"summary":"People that used ATMs owned by Siam Commercial Bank (and 4 others) reported money sent from their accounts to the Ukraine. Investigations found skimming devices and pinhole cameras.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"345934337cf7839c462dfa319d1cf79a85809f26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBD51494-1957-49A6-830A-5C5B3EC92E18"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d927e7556135","org_name":"Sachem School district","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.longisland.com/news/11-08-13/sachem-students-personal-information-leaked-to-the-web.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://sachem.patch.com/groups/schools/p/sachem-school-districts-internal-information-leaks-to-message-board"}],"summary":"Undefined internal School District data was posted to a public forum and then erased after parents complained.  Unknown everything except discovery method, assuming personal information data type.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c30934eb493751e39bc3f98e1cca04311e7f5066","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D975F56-EFE9-4BBD-A2D5-E66A87992A87"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PS","org_id":"ea268d12d601","org_name":"Palestinian Broadcasting Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Palestinian-Broadcasting-Corporation-Hacked-and-Defaced-398833.shtml"}],"summary":"Palestinian Broadcasting Corporation suffered web defacement at hands of unaffliated external hacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c68a9e5d064a5d7b30af436b4f5dda1ef1ca4f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7FC6A19-3D3E-4198-BB76-FB55C21152D9"},"incident_date":"2013-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"931d07220ec0","org_name":"North Bend Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://theworldlink.com/news/local/crime-and-courts/former-north-bend-medical-center-employee-pleads-guilty-to-identity/article_8b7b3046-eafa-50d4-82e5-ba1f68be8b4e.html"}],"summary":"medical employee changed records, forged records, and committed identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"UA","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc414d3be608d26b955ab41e97ac85f7dec49089","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04C7A582-954B-486C-A8B9-49A244142485"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EE","org_id":"664ea8576016","org_name":"NATO Cooperative Cyber Defence Centre of Excellence","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Ukraine-Launches-DDOS-Attack-on-NATO-s-CCDCOE-Website-398063.shtml"}],"summary":"Anonymous Ukraine has disrupted the official website of NATOs Cooperative Cyber Defence Centre of Excellence (CCDCOE). The hackers kept the website offline for close to two hours in response to NATO hacking a number of Ukrainian government websites. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"MX","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b608bb5d5b724589cd7a6cb950b3b56676ef42d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"333BA6BD-3191-46F4-99F4-82F5ADF5C6D1"},"incident_date":"2013-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11eb94c9c337","org_name":"MIssissippi Department of Public Safety","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.knoe.com/story/26331823/2-ex-state-workers-plead-guilty-to-id-theft-charge;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtok.com/home/headlines/2-public-safety-employees-arrested-247560671.html#.Uw-BYns3IcM.facebook"}],"summary":"2 state employees are charged with identity theft. Using access to driver's license bureau, they sold authentic birth certificates and Social Security cards to receive Mississippi driver's licenses and state IDs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe303a6c385e94c5a760941e869e495691d5caff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED6EF0E6-404A-4B43-9E8E-701BC11F30C3"},"incident_date":"2013-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1fc01b43db95","org_name":"Le Bonheur Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wreg.com/2015/04/10/e-r-employee-indicted-for-identity-theft-and-fraud/"}],"summary":"Employee used patient information to obtain controlled substances","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b09b34cd28fc61046eca733b32df632f2c6e573a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DB4D353-45BB-43C8-95CD-7EC40748428C"},"incident_date":"2013-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"cf04cd98944a","org_name":"Kasikornbank PCL","org_type":"financial","ransomware":null,"records_affected":117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bangkokpost.com/news/local/378695/stolen-money-sent-to-ukraine-after-atm-accounts-skimmed"}],"summary":"People that used ATMs owned by Kasikornbank (and 4 others) reported money sent from their accounts to the Ukraine. Investigations found skimming devices.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"153fabe09cd4544baec9fa5f1ec0dffad8b5c33c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8521A83E-5F69-4E01-8FBB-E01098FB8587"},"incident_date":"2013-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a69fb5c7410","org_name":"Jonathan M. Wainwright Memorial VA Medical Center","org_type":"other","ransomware":null,"records_affected":1519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/12/26/wash-memorial-va-endures1519-patient-health-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/jonathan-m-wainwright-memorial-va-medical-center-in-walla-walla-wa-notifies-patients-after-e-mail-gaffe/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailysunnews.com/news/2013/dec/17/walla-walla-va-issues-security-breach-alert/"}],"summary":"The Jonathan M. Wainwright Memorial VA Medical Center in Walla Walla is offering free credit monitoring for up to 1,519 veterans whose personal information, including social security numbers, was inadvertently emailed to an external education partner on Nov. 1. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed34c647702e34417f66a67f749e7de7fb4da52d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F0595F7-5FE0-48E1-90EC-B7F33E0C369F"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"20696b2bdd6b","org_name":"Japan’s Ministry of Agriculture, Forestry and Fisheries","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/OpKillingBay-Hackers-Expose-Details-of-Japanese-Tuna-Exports-Program-400499.shtml"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd84e086146eb721c48ea7b210775fb69098b287","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7EDC6D7-537E-4513-874C-3B6CBB2B3F7A"},"incident_date":"2013-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c324e812a3d","org_name":"Huerfano County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/news/ci_24584315/huerfano-county-victim-146-000-theft-through-computer"}],"summary":"County bank accounts compromised and fraudulent transaction of 146,000 USD conducted. Phishing e-mail was vector for malware that captured banking details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efe6ac4d8c3de4a2c3997812ce0b7e85ecb9d3ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e7a45930-eead-11e7-b683-c1703914e4a4"},"incident_date":"2013-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b07e4dfb1c08","org_name":"Horizon Blue Cross Blue Shield of New Jersey","org_type":"financial","ransomware":null,"records_affected":690000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.bna.com/horizon-healthcare-pay-n57982084089/"}],"summary":"New Jersey-based insurance provider Horizon Healthcare Services Inc. agreed to pay the state $1.1 million to settle allegations that the theft of two laptops compromised the privacy of some 690,000 policyholders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8271758fc78124ee44af52f94ee283893e98d721","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEDBEF2D-F59B-4098-ADC1-EF69F2FF96C0"},"incident_date":"2013-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebf939e37bd9","org_name":"Horizon Blue Cross Blue Shield","org_type":"financial","ransomware":null,"records_affected":839711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2013/12/07/horizon-policyholders-warned-of-possible-identity-theft-from-stolen-laptops/"}],"summary":"Stolen laptop leads to potential disclosure of customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c08167b513c6e14311e76e984a463bf6d33decf9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91E28C4B-6CA0-4792-997A-229ACA087322"},"incident_date":"2013-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d2edfd38027","org_name":"Healthsource of Ohio","org_type":"healthcare","ransomware":null,"records_affected":8845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/healthsource-of-ohio-data-leak-exposed-8800-patients-information/"}],"summary":"File on web server available to people searching the Internet had patient data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PH","motive":"ideology","name":"Anonymous Phillippines","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deb1a7e05bc5ca5df32aa3a4df8741ce53c00b85","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9D5C6BB-ECA2-4B0F-9728-A7A713DCAC8D"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"fb867e64cf2e","org_name":"Government of the Phillippines","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Philippines-Hacks-and-Disrupts-Tens-of-Government-Websites-396743.shtml"}],"summary":"Anonymous Philippines Hacks and Disrupts Tens of Government Websites. Defacement and denial of service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymousphillippines"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83b3daf4367e73a162d979cfc1e6ad9689e7156d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA0CC73D-46CD-45AB-A593-1810B83970C1"},"incident_date":"2013-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd7f17502f18","org_name":"Gingerbread Shed Corporation","org_type":"technology_saas","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/about-50k-transactions-other-data-compromised-in-three-month-breach/article/346703/"}],"summary":"actor gained access and maintained for 3 months, getting over 50,000 personal information, credit cards and username/password combinations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6915a00f99c7cc8991f343cfce2fd0fbccadb0d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B19F3599-2F1C-41F3-9EFE-7454062C2F3E"},"incident_date":"2013-11-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45892b158c0e","org_name":"El Agave","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/mn-el-agave-mexican-restaurant-hacked-over-200-customers-report-card-fraud/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.keyc.com/story/25064394/fairmont-police-secret-service-investigating-credit-card-fraud;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wjon.com/restaurant-hack-leads-to-credit-card-fraud/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fairmontsentinel.com/page/content.detail/id/528010/Restaurant-works-to-rebuild-trus---.html;"}],"summary":"Restaurant POS system compromised. Malware installed that captured payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f1bf5444431e8ab3f33ed437e0846651f3a1cc2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B39F5CAD-C7C9-44E9-BE0B-36B1675B0F45"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dee0a1bfcdea","org_name":"Combat Sports","org_type":"manufacturing","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-235361.pdf"}],"summary":"Unauthorized party gained access to Customers' Credit Card data stored unencrypted on a server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c9b360005694e5e115a49fb3110ab09239c4799","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADFB981E-6178-49EB-830E-B8C87C6A02F0"},"incident_date":"2013-11-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"4b803aa059a1","org_name":"CN China Chamber of International Commerce","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Leak-Data-Allegedly-Stolen-from-Chinese-Chamber-of-Commerce-Website-396936.shtml"}],"summary":"anon group \"Raptor Swag\" hacking Chinese, \"China Chamber of International Commerce (CCOIC)  Zhejiang Chamber of Commerce (ccpitzj.gov.cn)\" through SQLinjection. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e905b702ddbf5640e7794c5eaae9fb64348a14a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"192AE6B9-535F-4760-839E-BFC39BBD0FB8"},"incident_date":"2013-11-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46de3a50b6f3","org_name":"Bojangle's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wate.com/story/24127633/newport-fast-food-restaurant-hacked-credit-card-info-stolen"}],"summary":"Restaurant has POS system breached via wifi keylogger installed to capture payment card data as it was processed through the reader.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1eb2817f654e76bae3bedb95efb5638ca18ff42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9920659-57AD-4037-9D5C-93813A98FBC1"},"incident_date":"2013-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TH","org_id":"86b7ea62d667","org_name":"Bangkok Bank PCL","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bangkokpost.com/news/local/378695/stolen-money-sent-to-ukraine-after-atm-accounts-skimmed"}],"summary":"People that used ATMs owned by Bangkok Bank (and 4 others) reported money sent from their accounts to the Ukraine. Investigations found skimming devices and pinhole cameras.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"ID","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02dbb022bf82fd050b13def4191fcaff164508e5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7F306C0-2442-43C9-9704-6C93B34F3D6E"},"incident_date":"2013-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"cd2eb2f25aa3","org_name":"Australian Secret Intelligence Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/federal-politics/political-news/asis-website-attacked-by-indonesian-hackers-20131111-2xbuc.html#ixzz2kK5iKk2w"}],"summary":"DDoS attack launched against Australian intelligence agency in response to surveillance activities. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf8707f0de63dd738e370c1b564d4531625dfe37","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0CC2F4B-6A10-4078-832D-0AEFA9BEAA20"},"incident_date":"2013-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"20d0ef5b5173","org_name":"Amberley Park Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/victoria/medical-centre-in-narre-warren-south-breached-privacy-laws-by-keeping-files-in-shed-20140715-zt7qw.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/389686,medical-records-discovered-in-garden-shed-after-robbery.aspx?utm_source=feed&utm_medium=rss&utm_campaign=editors_picks"}],"summary":"A medical centre that kept sensitive health records of nearly 1000 patients in a garden shed on a disused property in Melbourne's south-east has been reprimanded for breaching privacy laws.  Boxes of records containing the personal details of patients were discovered at the Narre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b057f9b45bb6fbedc6c939a7e05a543b6117c1a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51D65ABE-59D3-44D3-98B0-1890BAC1DCB4"},"incident_date":"2013-10-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2ff4e6f1accf","org_name":"Rent-A-Center","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wpvi/story?section=news/local&id=9308831"}],"summary":"Rent-A-Center employee tossed some records in the dumpster, city sanitation officer noticed them, called police and employee came out and put them in a recycling container.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c210eb80e38ee6316d4bf0e7644c96d7f34b0384","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14B8EE97-0996-49FF-B9A0-CFA61FBD050E"},"incident_date":"2013-10-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d44e2180ccc","org_name":"Reimbursement Technologies, Inc.","org_type":"other","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access exposes 2300 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96c700b004484287c0685acfcb54523aa51a4f87","impact_type":"data_theft","incident_date":"2013-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Master%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"f935da7c70d7","org_name":"Harbor Freight Tools USA, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43161"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Master%20Notification_2.pdf"}],"summary":"Harbor Freight Tools reported that cyber-criminals attacked its payment processing system and may have accessed card transaction data.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81098b7005aa64ac4e4110f9d033522dbdeeca30","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C159758E-77F7-4A87-B2DE-1CB09916410E"},"incident_date":"2013-10-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"9d8e54e9c625","org_name":"Eleonora Pimentel Fonseca","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Sites-of-3-Italian-Educational-Institutions-Hosted-on-Government-Domains-Hacked-395763.shtml"}],"summary":"Defacement, several sites, main 3 cited are educational, coding this up as three victims on one shared infrastructure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d66c84303177576249e8412bb87441b508ad92cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B543B7D-BD5D-4597-BC8A-1C15F8EADDA5"},"incident_date":"2013-10-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"be873bee72be","org_name":"Road Safety Authority","org_type":"government","ransomware":null,"records_affected":721,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thejournal.ie/driving-licence-breach-1172604-Nov2013/"}],"summary":"More than 700 motorists renewing or applying for a driving licence have been hit with a data protection breach, where comments and contact details could be seen by other users of a website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"250f54083b968694a09813b6026c7c0a6553404c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0810D9B6-5B6A-48AB-BF15-893EA4A5E01C"},"incident_date":"2013-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7c5f6b3e86c","org_name":"Tennova Cardiology","org_type":"other","ransomware":null,"records_affected":2777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbir.com/story/news/local/2013/12/20/laptop-containing-some-tennova-patient-info-was-stolen/4142715/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/laptop-containing-some-tennova-patient-info-stolen-from-contractors-car/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wate.com/story/24272593/2777-knoxville-cardiology-patients-data-was-on-stolen-laptop"}],"summary":"Some patients referred to Tennova Cardiology by Summitt Medical Center are being warned that their personal information may have been stolen.  According to a press release from Tennova, a laptop belonging to an independent, third-party transcription contractor was stolen from a v","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f6fe9b7a11dec170a1f3f6227a74f6fb1ded7c9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06E3B2D5-82F5-4285-A1D2-6D71E6D833D6"},"incident_date":"2013-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82e874db75ea","org_name":"Greater Dallas Orthopaedics, PLLC","org_type":"healthcare","ransomware":null,"records_affected":5840,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer leaves 5840 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"805c777634d931ac2f33d9c39c311b526967648e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CFE5AA8-E1E8-426A-B7FB-604E36B913FA"},"incident_date":"2013-10-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20-%20Consumer%20Notice%20Sample_1.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab0a52541c05","org_name":"DecisionDesk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/California%20-%20Consumer%20Notice%20Sample_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43461"}],"summary":"DecisionDesk uses the services of a third party hosting services provider, MongoHQ, to host the databases that maintain information submitted through out services. MongoHQ has informed us that a person (or persons) accessed its hosting systems without authorization and further ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abe591ee7184ae245d587bd3486cbb81b396b507","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5B5E6BB-BE82-46D9-809F-51D22AD0A2B0"},"incident_date":"2013-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec215e13c7c3","org_name":"Comprehensive Psychological Services LLC","org_type":"healthcare","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/psychological-assessments-provider-notifies-patients-after-laptop-with-phi-stolen-in-office-burglary/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/12/19/comprehensive-psychological-services-has-3500-patient-breach/"}],"summary":"Comprehensive Psychological Services LLC of South Carolina recently reported a data breach in which it alerted 3,500 patients that a laptop with protected health information (PHI) was stolen from the practices office on October 28, according to PHIPrivacy.net.  The organization s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3ca7d1c34172b7a684fb81fed2d39023b104f11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6759345F-E638-4432-A6EC-6F5CF59C6445"},"incident_date":"2013-10-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1bcb3b9070f8","org_name":"St Mary's Medical Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wv-woman-says-st-marys-didnt-protect-her-medical-records/"}],"summary":"woman is suing St. Mary's Medical Center after she claims it allowed people to access her private health information that should not have had access. Claims  testing result were altered  to indicate that she tested positive for STDs and then published the falsified results to mul","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6cb490cfdac71f54c0cd97075fefae15c333916","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"506BBE2B-7DEC-453C-B963-17F189894719"},"incident_date":"2013-10-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"90ce5ea3645b","org_name":"Quebec Institute of Public Health","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.torontosun.com/2013/10/25/que-boy-12-pleads-guilty-to-hacking-government-websites"}],"summary":" A 12-year-old Quebec boy is responsible for hacking several government and police websites during the student uprising in spring 2012, creating computer havoc and causing $60,000 damage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea1f6dfb23edbaf473bdab770b248dc973a7d2f1","impact_type":"unknown","incident_date":"2013-08-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter%20and%20ReferenceGuide_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e3337596d4da","org_name":"International SOS Assistance, Inc","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43074"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccd499268066f78c1c841f1c6867aaac9101e21c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"344CB5A9-CE7D-4461-A2A7-5E08E52B443A"},"incident_date":"2013-10-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08d82406d989","org_name":"EZYield","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/EZYield%20ltrt%20Consumer%20re%20Security%20Breach.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ez-yield-20131206.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e210026dc1950331d8828c7c4e75855f12bc8e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CE4D1F7-FB16-43CE-8FE8-2D50B6C9C63C"},"incident_date":"2013-10-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"518f7ab1d207","org_name":"Wset Incorporated","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wset.com/story/23770605/warning-crypto-locker-computer-virus-going-around"}],"summary":"A nasty virus called crypto locker is going around, and it can cripple your computer. The virus, also known as ransomware, has caused a lot of damage - including our computers here at ABC 13 Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-23","discovered_date":"2013-09-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dde12df84ecb43fea478d66a24e91bccc5fd5a8","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-05-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Radiant%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"79ab2ae4e8bf","org_name":"The Fisherman's Restaurant","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43063"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Radiant%20Final_0.pdf"}],"summary":"Radiant Systems mistakenly transmitted personal information about The Fisherman's Restaurant employees to another Radiant customer.","supporting_quote":null,"technology_involved":["point of sale technology","back office technology"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Radiant Systems, Inc."},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"e02cae47ae4b","name":"Radiant Systems, Inc"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2d2567af7e1afd061175f6fe8d5123408e16fa9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D491B74-A709-4605-9CE3-8ED6C5059E7F"},"incident_date":"2013-10-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb9c47480263","org_name":"Anthem Blue Cross","org_type":"financial","ransomware":null,"records_affected":24500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Provider%20Notice%20CA_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/anthem-blue-cross-acknowledges-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/money/la-fi-mo-anthem-doctors-breach-20131125,0,4528975.story"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43327"}],"summary":"We are sending you this letter to notify you that your Tax Identification Number (TIN), along with your name and business address, were erroneously displayed on a PDF document posted to the Anthem website, www.anthem.com/ca. The PDF documents were posted to Anthem.com for just ov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"ID","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66d0226f11614c478d31c08a7f03994b2d218241","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"923FF789-2811-4D97-AA48-6CAB9572F6AC"},"incident_date":"2013-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cf0ecf343ac","org_name":"U.S. Department of State","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/us-state-dept-hacked-by-dbuzz/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.usatoday.com/story/cybertruth/2013/10/23/department-of-state-webpages-defaced/3170277/"}],"summary":"State Department website defaced by Dbuzz (unaffiliated hacker).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"578a7460d4229e9ed3f5fe7b1876239411496d0b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"318F9CD9-60B1-438F-979C-32FFCC82D26E"},"incident_date":"2013-10-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"ac802ffae89f","org_name":"Russian Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Target-Russia-for-Detaining-Greenpeace-Activists-393931.shtml"}],"summary":"Hackers of the Anonymous movement have launched a distributed denial-of-service (DDOS) attack against government.ru, the online portal of the Government of Russia. The attack comes in protest against the arrests of Greenpeace activists by Russian authorities","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa9fe8571ef22d8a54be261994416fad6ad07a8b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45DEA936-FAD9-42F0-A55B-627BD04711C8"},"incident_date":"2013-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"751e5dd440fe","org_name":"Auburn University","org_type":"education","ransomware":null,"records_affected":13698,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/auburn-university-college-of-business-hacked-notifications-going-out/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Auburn%20Univ%20ltrt%20Consumer%20re%20security%20Breach.pdf"}],"summary":"On November 20, 2013, Auburn University became aware of a compromised server within the College of Business network. Auburn immediately patched the vulnerability and launched an internal investigation to determine the scope of the attack. When it became clear that this incident c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2013-10-21","discovered_date":"2013-10-14","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d592e3756fb03a01fe0491471ecb69a10b904007","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-10-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AHMC%20Press%20Release_10-21%20revised_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"8dedc1ee0345","org_name":"AHMC Healthcare","org_type":"healthcare","ransomware":null,"records_affected":729000,"reviewed":false,"root_cause":"A thief broke into an office and stole two laptops containing patient information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43054"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AHMC%20Press%20Release_10-21%20revised_0.pdf"}],"summary":"Two laptops containing patient information were stolen from an AHMC Healthcare office; the organization reported no evidence that the information had been accessed or used.","supporting_quote":"AHMC Healthcare Inc. said today that protected health information for approximately 729,000 patients has been compromised following the theft of two laptops from a secure office.","technology_involved":["laptops"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2013-10-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf8244522e970e84725f411e27baf6c8c6977edc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3A2FC89-2132-46B4-BBD9-6E2A53D18D29"},"incident_date":"2013-10-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"199350374e79","org_name":"Service Coordination Inc.","org_type":"healthcare","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbaltv.com/money/data-breach-affects-9700-at-md-nonprofit-serving-disabled/25030708;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/business-associate-of-maryland-developmental-disabilities-administration-hacked-in-october/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/2014/03/17/4000908/md-nonprofit-serving-disabled.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.servicecoordinationinc.org/news;"},{"fetched_at":null,"title":null,"type":"press","url":"http://washington.cbslocal.com/2015/03/23/md-man-gets-6-month-sentence-for-stealing-ids-of-11000-disabled-people/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.servicecoordinationinc.org/news"}],"summary":"A Maryland man was sentenced Monday to six months in federal prison for stealing the Social Security numbers and medical information of more than 11,000 intellectually and developmentally disabled people from the computers of his former employer, a state-licensed provider of case","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2013-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49ee5ad84d9c3ad7a89e66bdca4b9e23142ea4c4","impact_type":"data_theft","incident_date":"2013-06-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_2.pdf"},"notes":null,"org_country":"US","org_id":"c25468d710f7","org_name":"Ouidad","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43013"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_2.pdf"}],"summary":"Attackers accessed Ouidad’s customer database and obtained or viewed customer account and transaction information.","supporting_quote":null,"technology_involved":["customer database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba5c9a3c4e4d87d8d6917a72f03f4cd8ef5b2046","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B714B01E-3D33-4DA8-9E38-43DFBC60D316"},"incident_date":"2013-10-18","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76de0ced7794","org_name":"Michigan State University","org_type":"education","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/michigan-state-university-admits-security-breach.html"}],"summary":"University employees' credentials stolen and direct deposit information changed. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b8626f1f14ed66ba52cd02e878ded6c528a7985","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DC_Notification_form_1013_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42999"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43299"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0b44568d2f06b8927d971d800061a6b6f03727d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F68C845-448A-410F-B8A2-CAC8B085787B"},"incident_date":"2013-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c98b5f50ade3","org_name":"Wyoming Department Of Health","org_type":"government","ransomware":null,"records_affected":11935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.health.wyo.gov/news.aspx?NewsID=677"}],"summary":"The Wyoming Department Of Health reported that 11,935 had PHI involved in an October 16, 2013 incident involving Unauthorized Access/Disclosure,Network Server. I was able to locate their notice on their website that explained that this was an exposure incident affecting the Speci","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dcf87f5c93f2e532b57ac4ece0c7c6463bcc13b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1901EC7-4F4A-4770-B0DD-FBC0613E4BB2"},"incident_date":"2013-10-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"351daf541001","org_name":"South Carolina Health Insurance Pool","org_type":"financial","ransomware":null,"records_affected":3432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wistv.com/story/24323194/laptop-with-data-of-schip-customers-stolen"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/8d7b3a42e82242899bd1ed1016fc4892/SC--Insurance-Data-Breach"}],"summary":" A laptop stolen from an auditor's car contained the personal information of more than 3,400 members of the South Carolina Health Insurance Pool.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a734161a179434664595fbef65868d86c42159dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FF0E9E9-CB7F-40AE-8D82-1A05911A867F"},"incident_date":"2013-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e49cce9f26b7","org_name":"News Corp Australia","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/it-pro/security-it/news-corps-australian-newsletter-database-exposed-online-leaking-personal-information-20131016-hv259.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theaustralian.com.au/news/news-corp-australia-statement/story-e6frg6n6-1226741272700"}],"summary":"narcissistic vulnerability pimp finds flaw in web application that exposes records, now it's a breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"064a8c186e23f80a04c58ed46fe8105036740539","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5C36E6B-E3E2-4327-A934-4BBDCAEB11D5"},"incident_date":"2013-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c50b66e68d4b","org_name":"National Security Agency (NSA)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://venturebeat.com/2013/10/25/nsa-website-down/"},{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/insider/2013/10/26/nsa-gov-hours-nobody-knows-ddos-attack-suspected/?awesm=tnw.to_g0jBI&utm_campaign=social%20media&utm_medium=Spreadus&utm_source=Twitter"},{"fetched_at":null,"title":null,"type":"press","url":"http://grahamcluley.com/2013/10/nsas-website-goes-offline-human-screw-ddos-attack/?utm_source=rss&utm_medium=rss&utm_campaign=nsas-website-goes-offline-human-screw-ddos-attack"}],"summary":"The website of the NSA was down for a few hours with speculation that it might have been the victim of DDos Attack. The agency stated that it was an internal error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6604e41325b599942f36d9db3797b764f150e8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38F0DE7D-3D7A-4040-A380-F8906ECF6E7B"},"incident_date":"2013-10-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"293e36359b64","org_name":"Granite State College","org_type":"education","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/granite-state-college-20131114.pdf"}],"summary":"Faculty listed was accidentally send to a compromised staff account and then forwarded to a gmail.com email address. No information on nature of error or how staff account was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b144805c3affefef8c3e219d40dde9be53db7b91","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63781729-A919-4F31-AA16-07769E5379C4"},"incident_date":"2013-10-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"721af6704c0a","org_name":"Children's Healthcare of Atlanta","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://omnibus.healthcareinfosecurity.com/hospital-insider-breach-leads-to-lawsuit-a-6193;http://ef67fc04ce9b132c2b32-8aedd782b7d22cfe0d1146da69a52436.r14.cf1.rackcdn.com/hospital-insider-breach-leads-to-lawsuit-eresource-1-a-6193.pdf"}],"summary":"Hospital Insider Breach Leads to Lawsuit Case Calls Attention to Need to Detect, Mitigate Threats  A lawsuit filed against a former employee at an Atlanta pediatric healthcare system calls attention to the need to detect and mitigate insider threats, including those related to de","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2013-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c4808d8564a08ed4a239d053cd56b10f3b5a067","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C93BE6D-D108-4A08-9CBB-36BED43FC6C4"},"incident_date":"2013-10-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0c987753544","org_name":"Children's Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/atlanta/news/2013/10/28/childrens-healthcare-says-exec-stole.html"}],"summary":"Executive announced resignation and started emailing documents and data to their personal email address.  PHI, contacts, IP, etc. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0367243d8c4560f5a28f0d9baa48500e5b050a2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"a08abb40-b69c-11e8-b56a-011002460f8b"},"incident_date":"2013-10-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"041b3b7967a8","org_name":"UK Home Office","org_type":"government","ransomware":null,"records_affected":1598,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.careappointments.co.uk/care-news/england/item/44437-government-loses-legal-challenge-over-extent-of-data-breach-involving-1-600-immig"}],"summary":"Misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77c01d1f702d8c7ace56504f4f24a2e258aed1d8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"907CD7AF-31D2-4609-87B2-3A8E0A90CE34"},"incident_date":"2013-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"2f64cbae1f25","org_name":"Isaraeli Job Search Portal","org_type":"technology_saas","ransomware":null,"records_affected":3349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/iranian-hackers-hack-israeli-job-site/"}],"summary":"An Iranian hacker going with the handle of Dr.3v1l from Black_Devils B0ys hacking group has breached to an Israeli based job search portal, as a result login account information of over 3349 Israeli citizens have been leaked and dumped online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc13aedcd1535a0b587786b784dbb7398e001c82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06D577CD-5519-45E2-BF14-8560BFBEBDDF"},"incident_date":"2013-10-15","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"153e001d55b5","org_name":"Home Office (Govt. of the United Kingdom)","org_type":"government","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2522676/Personal-details-1-600-illegal-immigrants-published-Home-Office-website.html#ixzz2nK3t1tGy"}],"summary":"PII disclosed on government website for ~ 1600 people due to publishing error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a73be9fc4ef116b60bb8bc89500f62848c081142","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1964948-F9C4-499C-9E4A-758D4BE58203"},"incident_date":"2013-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"3331d9b473e5","org_name":"Hathway Cable & Datacom Ltd","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Pakistani-Group-Hacks-Indian-Telecoms-Company-Hathway-391187.shtml"}],"summary":"Pakistani hackers break into Indian owned Telecommunications company Hathway.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc77a6989cdd3f0fd3cf550ae1c99587420ea6e1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"127B2747-C648-44E6-A1E9-F6B922660619"},"incident_date":"2013-10-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ca780e6bba7","org_name":"Cracker Barrel Old Country Store, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-235004.pdf"}],"summary":"Laptop theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"493f22dc51611d525585e46258e206874a709685","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB01A2BD-5F3B-4A5E-93D2-14AD3C368986"},"incident_date":"2013-10-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a3ac73bba35","org_name":"City of Milwaukee","org_type":"government","ransomware":null,"records_affected":11427,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wisn.com/news/south-east-wisconsin/milwaukee/city-employees-personal-information-stolen/-/10148890/23001338/-/1u1veo/-/index.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wisn.com/news/south-east-wisconsin/milwaukee/milwaukee-city-employee-information-breached/-/10148890/22998098/-/k71klj/-/index.html"}],"summary":"A flash drive containing the medical records and PII of City of 8,427 Milwaukee city employees (including mayor) along with 3,000 family members was stolen from a purse of a contractor medical company called Dynacare.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-10-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5415ae1bb17cdc58fda628dce27e3d3cd6885e60","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ECBC18B-2288-4E96-B37C-F3FEC0300697"},"incident_date":"2013-10-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c871aa7ee7fb","org_name":"Boxcar Hosting","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.earthempires.com/forum/alliance-talk/boxcar-data-breach--rd-with-proof-27022"}],"summary":"Browser based multiplayer gaming hoster is compromised via SQLi by some of the gamers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0263b71274100962ce661c3271788b71e2c6e356","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC18C7D0-E10A-4F1F-A242-D95572D5AF8C"},"incident_date":"2013-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"874ae7ab2efa","org_name":"Pirate Party of Germany","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Germany-s-Pirate-Party-Hit-by-Another-DDOS-Attack-391174.shtml"}],"summary":"The website of Germanys Pirate Party, an organization that militates for the freedom of the Internet, has been disrupted once again due to a distributed denial-of-service (DDOS) attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fff8236defa69fa8a2d72d7f555af2b0b35529a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD5A9CDF-9ADB-4553-9897-38CF877ADBA6"},"incident_date":"2013-10-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b37f7df0c99c","org_name":"Github.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tripwire.com/state-of-security/top-security-stories/github-downed-ddos-attacks/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+tripwire-state-of-security+%28The+State+of+Security+%7C+Tripwire%2C+Inc.%29"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/GitHub-Down-Due-to-DDOS-Attack-10-14-2013-390902.shtml"}],"summary":"GitHub is once again unavailable due to a distributed denial-of-service (DDOS) attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c67e4b777e5211cb724e5817710edb42209a500a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E177AEAF-D221-48A6-8534-3F69AF39F91B"},"incident_date":"2013-10-13","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"52bf0b077f14","org_name":"South Central Ambulance Service Ltd","org_type":"healthcare","ransomware":null,"records_affected":2826,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-27659784"}],"summary":"The personal data of thousands of ambulance service staff has been accidentally published online, it has been revealed.  The data breach by South Central Ambulance Service (SCAS) included publishing the age, sexuality and religion of almost 3,000 staff members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd599ff73b9324ba1debffcaf611baa0144ab69d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24D1E12B-922B-4E20-8480-D53AA89DC99E"},"incident_date":"2013-10-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"43c4ee6fd86b","org_name":"PutLocker.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/File-Hosting-Service-PutLocker-com-Hit-by-DDOS-Attack-390906.shtml"}],"summary":"PutLocker.com, the UK-based file hosting service, was hit by a distributed denial-of-service (DDOS) attack that led to the website becoming unavailable for some users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fae98401780679056795863ddaec1e897c4ceb70","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0385F25B-DDEF-4838-AAA4-8539F6462DBE"},"incident_date":"2013-10-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12eaa276ab4d","org_name":"Xerox Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cruxialcio.com/xerox-restores-food-stamp-system-after-weekend-outage-2178;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2013/10/15/walmart-xerox_n_4099207.html"}],"summary":"EBT access went down in 17 states after a failure in a system check. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddbd268fc6f7e82068c2958af532e1555f38421f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A875A1BB-E04B-4406-BEC6-127C82B16F33"},"incident_date":"2013-10-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ed7dc4f14e3","org_name":"State of New York","org_type":"government","ransomware":null,"records_affected":17743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://polhudson.lohudblogs.com/2013/07/15/state-worker-sent-17743-medicaid-records-to-personal-account/"}],"summary":"A state employee was placed on leave after emailing thousands of private Medicaid records to his personal email account, state Medicaid Inspector General James Cox announced today.  The security breach happened on Oct. 12 of last year, when the employee -- who worked for Cox's of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ab4d24aa51a04e3713aaba1b486e07cffacab23","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"913B30B6-F12A-44BC-8143-4DEA3FFF1BAD"},"incident_date":"2013-10-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48676d4d8c31","org_name":"Northside Hospital, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4879,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Lost laptop exposes 4879 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeaf27e885b2fc34e34c6b4371336d0acdb5001b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6764B054-3FD9-4A61-9671-BAC9809656DF"},"incident_date":"2013-10-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca5a0b08d3ab","org_name":"Clarity Media Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/clarity-media-20131107.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/clarity-media-group-acknowledges-security-breach.html"}],"summary":"A laptop was stolen from the car of a Clarity Media Group, Inc., subsidiary employee's car. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0477bcbb3bb8af4f232ae74a1d0767adf0338f10","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDE2256A-44F1-43E1-814C-A00DD351A14F"},"incident_date":"2013-10-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8dedc1ee0345","org_name":"AHMC Healthcare Inc.","org_type":"healthcare","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/AHMC%20Press%20Release_10-21%20revised_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/lanow/la-me-ln-hospital-thefts-patient-files-20131021,0,3475716.story#axzz2iQG7vsxH"}],"summary":"2 Laptops stolen from locked and video monitored office contained 700,000 patients data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"993be9c34b4286d51c34b71da01ec8b397430861","impact_type":"unknown","incident_date":"2013-03-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Public%20Assistance-English_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"cdfba8e936ca","org_name":"Monterey County Department of Social Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42947"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79d65f9b1279d81a2f95eb0d7b5498e39a710ab8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29E22B08-80B1-4562-8E1E-1C91F1D63871"},"incident_date":"2013-10-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"3c492664e491","org_name":"Republic of Turkey Ministry of National Education","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.webroot.com/blog/2013/10/10/compromised-turkish-government-web-site-leads-malware/"}],"summary":"Turkish government website is compromised as used to host a fake plugin banner.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9d06ffc93471aac0a8803ec2726b689a9a7f2a7","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Final%20Version%20of%20Notice%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ad3810a85872","org_name":"KEARNY MESA INFINITI","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42932"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d2c1cee5660e26bfdd2cdd48512c0f0e2d41aa2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A913838-E369-4878-8682-30E4FC0BB7D8"},"incident_date":"2013-10-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"be8325bbf745","org_name":"Bel-Air village in Makati City","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Chinese-Group-Hacks-Philippines-Site-in-Protest-Against-Manila-Hostage-Incident-390129.shtml"}],"summary":"A Chinese hacker group called Sky-Eye has defaced the website of the Bel-Air village in Makati City, the Philippines ((barangaybelair.ph). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adcbc658e8393ddccaae24f29689c1c32efe70b0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39A45826-1DA7-4945-A121-5F464C437EF6"},"incident_date":"2013-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d88d4d825433","org_name":"Rogers Communications Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://toronto.ctvnews.ca/software-glitch-to-blame-for-massive-rogers-outage-1.1491536"}],"summary":"Rogers Communications says it has fixed a network software problem that temporarily shut down text and phone service to about two-thirds of its 10 million cellphone customers.  Read more: http://www.ctvnews.ca/sci-tech/software-glitch-to-blame-for-massive-rogers-outage-1.1491536#","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9345df38ef9c34e744daf09abb5f050ecd84b10c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C610DE07-6E41-487C-ABF4-BFE8757E8833"},"incident_date":"2013-10-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac0e1d0bbb36","org_name":"City of Mansfield, OH","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/syrian-hacker-dr-sha6h-hacks-and-defaces-city-of-mansfield-oh-website-for-free-syria/"}],"summary":"Famous Syrian Hacker Dr.SHA6H has hacked and defaced the official website of U.S. City of Mansfield, OH earlier today in support of a free Syria. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":"KDMS Team","variety":"activist"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64f1873412d8e6ab16e88c3c823738868adb7229","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8456B1DC-AAE2-4F12-A9A0-64F193F16D6A"},"incident_date":"2013-10-08","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f81b6856206","org_name":"Network Solutions","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Avira-Confirms-Network-Solutions-Has-Been-Hacked-389422.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/10/hijacking-of-av-firms-websites-linked-to-hack-on-network-solutions/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com/article/741153/Network_Solutions_Investigating_DNS_Hijack?source=rss_security&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+cio%2Ffeed%2Fdrilldowntopic%2F3089+%28CIO.com+-+Security%29;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/anonymous-hacks-whatsapp-avira-avg/"}],"summary":"DNS redirection part of Networks Solutions breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"kdmsteam"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e310025bedb71dc4dc072d35f5e59e7c03053d7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EAF2C87A-5530-43C0-8C7F-C48C240AB00D"},"incident_date":"2013-10-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a52bba3eb447","org_name":"National American University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/sensitive-student-data-improperly-disposed-during-university-relocation/article/324778/"}],"summary":"The personal financial information of students of National American University (NAU) in Rapid City, S.D., may have been compromised after thousands of records were found in a dumpster near the school's old campus. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0834454cfdc125b3f73e7bb23f4cb89994f85841","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3232B2A1-935E-4FCC-9AF6-58CAA9D7A656"},"incident_date":"2013-10-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a48caa859f5","org_name":"Standard Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample.Breach%20Notification%20letter.11.1.13_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43176"}],"summary":"Website hosted by insurance company partner erroneously published employee information in such a way that other employees could view their personal information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"AF","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"184ebb7414b730e9304ac5d37f05e1a4f0db0a02","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CA20A93-9B5B-47DB-843F-9376FF4A81FA"},"incident_date":"2013-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AG","org_id":"822bcd54f00d","org_name":"Caribbean islands of Antigua and Barbuda","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/suriname-antigua-and-barbuda-and-saint-lucia-high-profile-sites-hacked-by-1337.html"}],"summary":"If the domain registrar server or NIC of a country was hacked recently, theres a decent chance it is hacked by Pakistani Hacker 1337. The infamous hacker 1337 hit domain registrar server again and hijacked high profiles domains of Caribbean islands of Antigua and Barbuda, Surinam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b829e36da045b732e6104ba07855115cb0ceb9d6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A11225F-4AEF-44DA-BE9A-BCBE362867FF"},"incident_date":"2013-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VN","org_id":"9ad0d1fe871f","org_name":"ASPX Vietnam","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/aspx-vietnam-official-website-hacked-anon-cop.html"}],"summary":"The official ASPX Vietnam website has been hacked and defaced by a Pakistani hacker with the handle Anon Cop. The hacker is a member of Pak Mad Hunters hacking group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd72b159a8c8a98d019876ae7daf5787b2d32b23","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74FFAE2B-10AD-4540-A98E-22E9152F4307"},"incident_date":"2013-10-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"baed917ade75","org_name":"Citibank","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234913.pdf"}],"summary":"a CITI employee inadvertently sent an email to two CITI customers which included the name and ss# of a third CITI customer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":"TeamBerserk","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7d7660be39c62f4142c850edfef61ccb5455952","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4310E87-4B91-4D51-A35C-D9151FD47325"},"incident_date":"2013-10-05","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ef2de91ba3bf","org_name":"The West Australian Newspaper","org_type":"technology_saas","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/TeamBerserk-Hacks-The-West-Australian-and-Loretto-Telecom-388615.shtml;http://www.ehackingnews.com/2013/10/loretto-telecom-west-australian-and.html;"}],"summary":"A Hacker group named TeamBerserk has claimed to have hacked into Loretto Telecom, The West Australian Newspaper and Moundville Telephone Company websites and leaked data.  Hackers claimed to have exploited a SQL Injection vulnerability in The Western Australian website and gained","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"teamberserk"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d42f8ac20cdb7bbe5824558afe53b3eb4b832057","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76D71BC3-C796-485C-A93A-7A811902B3B1"},"incident_date":"2013-10-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30900e1acfe7","org_name":"Nordstrom, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/10/nordstrom-finds-cash-register-skimmers/"}],"summary":"department store chain Nordstrom said it found a half-dozen of these skimmers affixed to registers at a store in Florida.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e2b77b4d0aac48770e853c28b5959308e261216","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D6229B5-D8F4-4B6B-91FF-BBF8A9B7061D"},"incident_date":"2013-10-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f6a05cfd54f","org_name":"Leaseweb","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/10/worlds-largest-web-hosting-company_5.html"}],"summary":"LeaseWeb, one of the World's largest hosting provider has been defaced by Palestinian hackers, named as KDMS Team. LeaseWeb was also hosting provider for one of the biggest file-sharing website Megaupload in the past. Later Megaupload Founder, Kim Dotcom claimed that Leaseweb had","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-10-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"642ebb257314015125883b40984b21e286a23c77","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70915971-1474-41AB-937A-C062EB7D558D"},"incident_date":"2013-10-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5443a4cd5fd1","org_name":"City of Wichita, KS","org_type":"government","ransomware":null,"records_affected":29000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/City-of-Wichita-Website-Hacked-Data-Leaked-388779.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com//not-in-kansas-anymore-thousands-affected-by-wichita-website-hack/article/315305/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+SCMagazineNews+%28SC+Magazine+News%29"}],"summary":"A band of cyber thieves hacked into the city of Wichita's website and stole the personal information. Social Security numbers, taxpayer identification numbers and banking information is among the data that was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AF","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e4a8b21901001665bddcddf7a287e868cce39ab","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69F9B082-81A8-4223-B246-852824CF0437"},"incident_date":"2013-10-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"ffce74bf5dc0","org_name":"Syrian Investment Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Investment-Agency-Website-Hacked-and-Defaced-388401.shtml"}],"summary":"Hackers of the Afghan Cyber Army have breached and defaced the official website of the Syrian Investment Agency (sia.gov.sy). The attackers have added their defacement page to a subfolder of the site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9307614efa0504b0d0c2aff804ce20c04f7b86a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52959184-5495-45B2-9621-2A096DE29555"},"incident_date":"2013-10-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df3097e3543a","org_name":"Superior HealthPlan","org_type":"financial","ransomware":null,"records_affected":6284,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/"}],"summary":"On October 4, 2013, some Superior CHIP ID cards were accidently sent to the wrong address. It may have been received by another person.   This was caused by an error in our computer system. The members name and CHIP ID number were included on the ID card that was sent to the wron","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb94d832482594ed92e2ee37d6b225415d86411","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18391ED2-480F-4988-8D9E-BB56967DE6DC"},"incident_date":"2013-10-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4baf23a339be","org_name":"Seton Healthcare","org_type":"healthcare","ransomware":null,"records_affected":5500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/seton-healthcare-family-notifies-5500-patients-of-breach-involving-stolen-laptop/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.seton.net/about_seton/data_theft_and_identity_theft_resource2.asp"}],"summary":"During the morning of Oct. 4, Seton discovered that a laptop computer had been stolen from the Seton McCarthy Clinic. Seton immediately notified the Austin Police Department. The laptop apparently was stolen between 5:30 p.m. Thursday, Oct. 3, and 9 a.m. Friday, Oct. 4, from the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb5a6f261df55c7442cfa8de8f60bdf2e92eed55","impact_type":"unknown","incident_date":"2013-09-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/ca%20ag%20crl%20client%20ssn_001_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42875"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"PS","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28cc5249e1efeeada6fd185a250ba59a58dfbe0c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6A36FF5-D328-4D41-B778-7CDFD77C1D5D"},"incident_date":"2013-10-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57c815c64ba4","org_name":"Council of Country Code Administrators","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/12-nic-of-cocca-council-of-country-code-administrators-registrar-hacked-by-1337.html"}],"summary":"CoCCA  Council of Country Code Administrators Registrar Service has been hacked by pro hacker 1337 . All NIC domain registrar website under CoCCA are been also hacked. This is the biggest ever cyber attack on Domain Registrars.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c1aaf44a68d7d6ea194b16092c221ae5dbebf3c","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9CA6BDE-1485-4545-8209-AED01AB68CF0"},"incident_date":"2013-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HN","org_id":"9a2784bc6f35","org_name":"United Nations in Honduras","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hacker-Defaces-Website-of-United-Nations-Honduras-388089.shtml"}],"summary":"The website of the United Nations in Honduras, un.hn, has been hacked and defaced by Ch4FeR, apparently a member of the Anonymous movement, Pinoy Hack News reports.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33a21d49593b09f8631d8d8a74007dd4f5d11d7e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED52E7F2-8E2D-4CDF-A205-1F3F63233C5D"},"incident_date":"2013-10-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"47846477f7a4","org_name":"Mercy Health Services","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234945.pdf"}],"summary":"Mercy Health Services (MHS) was recently notified of a potential breach of Protected Health Information (PHI) involving a patient of Urology Specialists of Maryland at Mercy Health Services, located at 301 St. Paul Place, POB 802.  On October 3, 2013, a staff member faxed medical","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9f352594f7ade2b8d894c3bffcd85923dda52a6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DF93522-4F76-46A2-A2A1-EC205D89C78C"},"incident_date":"2013-10-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94a9c2093bff","org_name":"Ironshore Management Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234968.pdf"}],"summary":"Laptop theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd3f02fae8e382b813df8f7d0bd971720d4f30ad","impact_type":"unknown","incident_date":"2013-09-11","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20Customer%20Notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a303efb5c38a","org_name":"Adobe Systems Incorporated","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42872"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98e55551ac35b69ffab8d4bd61d22e495cb69a79","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38AE7484-EF7F-41F3-822A-43F7E8FCBFD7"},"incident_date":"2013-10-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55c0f2e189a5","org_name":"USI Affinity","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%202_0.pdf"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%201_0.pdf"}],"summary":"System compromised with malware allowing actor to view username and password. Customer information not confirmed compromised, but considered at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-10-02","discovered_date":"2013-09-10","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20662a01ea0e828aa6aac86b5d5f465e9f7918cb","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-09-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"5b515724dd5a","org_name":"UCSF Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42856"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter%20Sample_0.pdf"}],"summary":"A UCSF employee’s laptop containing files with patient personal and health information was stolen from a vehicle.","supporting_quote":"On September 10, 2013, UCSF learned that an unencrypted laptop was stolen from the locked vehicle of a UCSF Liver Transplant employee on September 9, 2013.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c97b130cd0bb0b5af81d61a1723e1334c747349","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B2C9D3E-D8B5-44E9-A31B-5993BF1791D7"},"incident_date":"2013-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"179a785aeaaa","org_name":"IN Punjab Public Works","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/public-works-department-india-website-hacked-h4x0r-hussy.html"}],"summary":"H4x0r HuSsY, famous for hacking Indian govt sites hit again. This time The official website of Public Works Department, Punjab with 10 other Indian Govt sites hacked by H4x0r HuSsY.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa6175342aaaf395ae40d93c49d8e4b02e4f6ebd","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A3BFF3F-C180-4D59-963E-F4F0CA77125F"},"incident_date":"2013-10-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f2ede48586ce","org_name":"Baseball Canada","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Baseball-Canada-Website-Hacked-by-AnonGhost-387767.shtml"}],"summary":"Hackers of AnonGhost have managed to breach and deface Baseball Canada (baseball.ca), an official website that provides information on the Canadian national team and players.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41cf42b8fa17173f22792ea0a01336478bc00d14","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0854C805-E9B9-4B60-AEAF-8C2B8C2111BA"},"incident_date":"2013-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f41bbff0d8c","org_name":"Washington State University","org_type":"education","ransomware":null,"records_affected":310,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/two-hard-drives-stolen-from-washington-state-university-office/article/320133/"}],"summary":"Hundreds of employees, former employees and students of Washington State University are being notified that their personal information may have been compromised after two possibly unencrypted external hard drives were stolen from an on-campus office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9a73335c59fa6b1f2a7bba1cd5a366d0aa7760a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3609E986-4A78-4A45-B458-EC89AB288930"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec2d71ec2a59","org_name":"Valve Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mirror.co.uk/news/technology-science/technology/half-life-3-confirmed-valve-security-2334759"}],"summary":"Production of Half-Life 3 has been confirmed after Valve's database briefly became open to the public.  Valve's Jira database - which the teams use to track bugs - exposed itself for a short period of time, allowing fans to see what was happening in the system.  Users could see v","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d83337247b379a8512c00e537ef2019ff25a09b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6EC2C8B-C4E5-4DD4-8768-8A8A80D4BEA4"},"incident_date":"2013-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"12de6456c834","org_name":"University of Falcon","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/10/anonymous-venezuela-hacks-venezuelan.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Venezuelan-Military-and-Government-Websites-Hacked-by-Anonymous-391564.shtml"}],"summary":"Anonymous Venezuela defaces several websites. This is modeling the educational site for the University of Falcon.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5706f10282385556d358972bf1ffc51fe0a25de1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"211BCA1C-6701-4416-BA9B-7796DD726D16"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"d4572d213faf","org_name":"Turkish Government","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkish-Hackers-Deface-Over-450-Websites-to-Celebrate-Republic-Day-395909.shtml"}],"summary":"Hackers of the TurkHack Team have breached and defaced more than 450 websites in celebration of Republic Day, the Turkish public holiday that commemorates the proclamation of the republic in 1923. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5825e6beea9ebca3e8efb0c9d28f3ba33656ad56","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69513EB9-04A9-4C04-81C1-BDB0D5B2ECBC"},"incident_date":"2013-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ccd5b109fe37","org_name":"Total Systems Heating and Cooling Inc","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansas.com/2014/01/26/3249851/malware-threatening-small-businesses.html"}],"summary":"Total Systems Heating and Cooling Inc gets cryptolocker infection","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e16646588af89c1cce83a84459ad8904161cc727","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6AB35E4-64F4-413A-AE1E-A87F22DCFAD4"},"incident_date":"2013-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41e40bf9c011","org_name":"The Cheescake Factory","org_type":"other","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whec.com/news/stories/S3505545.shtml"}],"summary":"Waitress used handheld skimmer to steal credit card information from customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e18d1f779e25606116cc0945d49e48a7767bb1f2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB25FFEC-7426-48AE-8693-A453DD55E6FA"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4806acf26a2a","org_name":"TD Bank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/td-bank-20131017.pdf"}],"summary":"printing error mailed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bed951b937c5162ed1001936bfcdf0b56ddac71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71654763-C66E-40A3-BAE3-3C7C756ADCF3"},"incident_date":"2013-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JM","org_id":"067bc8b109b9","org_name":"Tax Administration Jamaica","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jamaicaobserver.com/latestnews/-Computer-technician-in-billion-dollar-tax-theft-returns-to-court-today"}],"summary":"Christopher Moore, the former Tax Administration Jamaica employee, who reportedly caused the Government to lose in excess of $1 billion in tax revenues, will again appear in the Corporate Area Resident Magistrates Court today.  Allegations are that, between October and December 2","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"511f8cf55e9f85f772dce97bfcc8a8e662fac1a5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D9658BF-2960-47C9-989B-83804B8AE25D"},"incident_date":"2013-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd776c8fc8df","org_name":"Suddenly Single Parents Inc.","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/news/local/hundreds-risk-identify-theft-after-charity-hit-thi/nbJhG/"}],"summary":"Hundreds at risk for ID theft after info was taken from charity","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6941fee91f317098acf1b6535e923e617534512f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"898B00FF-D2E3-449B-BF17-9D64369A6FE7"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c45719d122f5","org_name":"South Western Ambulance Service","org_type":"other","ransomware":null,"records_affected":45000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/uk-unencrypted-data-of-45000-patients-shared-by-south-west-ambulance-bosses-despite-no-justifiable-legal-reason-to-do-so/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gloucestershireecho.co.uk/Unencrypted-data-45-000-patients-shared-south/story-24527885-detail/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/uk-south-western-ambulance-service-nhs-trust-signs-undertaking-after-breach/"}],"summary":"Ambulance bosses have been criticised after the unencrypted data of more than 45,000 patients was shared with NHS chiefs despite there being no justifiable legal reason to do so.  South Western Ambulance Service sent seven discs of descriptive patient data relating to 45,431 peop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"855a0140e4a509480f0ad401e9e5162cc4dd19d3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02275CD0-F49C-4C4F-9071-C93C30F36856"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"bb17659b75b6","org_name":"RU The Central Bank of the Russian Federation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Russia-s-Central-Bank-and-Other-Financial-Institutions-Hit-by-DDOS-Attacks-392528.shtml"}],"summary":"The websites of several major Russian financial institutions have been disrupted earlier this month with distributed denial-of-service (DDOS) attacks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62731708319edd75e3cfc1dd111e87748d1d207e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B5C7282-2CFD-419D-82C5-9AD31F17BFB5"},"incident_date":"2013-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b3a00bb1f74b","org_name":"Royal Veterinary College","org_type":"education","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.v3.co.uk/v3-uk/news/2300878/ico-slams-royal-veterinary-college-for-lack-of-byod-policies-after-data-loss"}],"summary":"Employee lost camera with pictures of 6 passports of prospective job applicants.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ec106900d08d190bb7144b5420934590e87d7b9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0856BC5C-86E1-4E4E-ACB8-8A90391B982C"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"96017204716b","org_name":"Royal Inland Hospital","org_type":"healthcare","ransomware":null,"records_affected":1628,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/health/patients+privacy+breached+when+medical+records+were+donated+along+with+filing+cabinet/10094645/story.html?__federated=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kamloopsthisweek.com/1628-patients-at-kamloops-hospital-had-privacy-breached/"}],"summary":"Royal Inland Hospital has advised 1,628 patients their privacy has been violated. Nancy Serwo, acting administrator at the hospital, said two boxes of records were returned to the hospital on June 16 after they were discovered in a filing cabinet the hospital had donated elsewher","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e87b660a101e6f971e4ddf9c38e21b071f593e61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16B3D6D6-5477-439C-9A7F-2D672C077C42"},"incident_date":"2013-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547d1d573418","org_name":"Riverside Health System","org_type":"healthcare","ransomware":null,"records_affected":919,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/riverside-health-system-notifies-919-patients-after-employee-improperly-accessed-their-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/virginia-hospital-employee-accesses-records-for-four-years-gets-fired/article/327485/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.riversideonline.com/about_riverside/news/pr122913.cfm"}],"summary":"An employee with Riverside Health System in Newport News, Virginia has been fired for inappropriately accessing the medical records of nearly 1,000 patients over the span of four years.  How many victims? 919.   What type of personal information? Social Security numbers and summa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5fa6f61e9afa2e1b1457fbe2a9c716686b7ed3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B3287E2-BD21-4D7D-B52A-2A3B2A231618"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0f8c08bc467","org_name":"Riot Games, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.warcry.com/news/view/128685-Hacker-Leaks-League-of-Legends-Collectible-Card-Game"}],"summary":"Unknown hacker gained access to internal screenshots of unreleased game, used compromised twitter account of victim president to release images.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-10-01","discovered_date":"2013-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b09a7feffe4997453b6bcca08212b9880f36db1","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Cal%20ex%20A_0.pdf"},"notes":null,"org_country":"US","org_id":"b3c4299c6e36","org_name":"R.T. Jones Capital Equities Management","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Cal%20ex%20A_0.pdf"}],"summary":"An attack on the web hosting facility for R.T. Jones's Artesys website may have allowed unauthorized access to a database containing personal and financial information.","supporting_quote":null,"technology_involved":["Artesys website","web hosting facility","database"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"923cfc788f483496dc50e7e935f7efac6ec261d6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CD59DFB-F68A-41CB-A5BA-4AD35BB1176B"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"QA","org_id":"dc6d6745ba8c","org_name":"Qatar Domains Registry","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Hacks-Qatar-High-Profile-Domains-Defaced-392663.shtml"}],"summary":"The Syrian Electronic Army is back with another high-profile attack. This time, the pro-Assad group has hacked the Qatar Domains Registry (registry.qa) and altered the DNS records of several major domains.  The list of impacted websites is fairly long. It includes the .qa domains","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b891435f1edfa965c726095a08af7d9c239c55dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34017AC1-8429-4B69-802B-D86DEC5A0542"},"incident_date":"2013-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"d30308ebe86a","org_name":"PureVPN","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/359578,vpn-provider-hacked-fake-emails-scare-customers.aspx"}],"summary":"Customers of Hong Kong-based virtual private network (VPN) provider PureVPN received a major scare over the weekend after a fake email was sent out to them, saying their accounts would be closed and the information handed over to unspecified authorities.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99c8e12afa0cf4b92d7ad76d483f9dbb3b991667","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4224F4DF-5F87-496F-B7A3-272E337C7BC8"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41d8c1b884d3","org_name":"Pueblo Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chieftain.com/home/1927985-120/woman-erjavec-pcc-information"}],"summary":"personal information found in box of office supplies at garage sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f20687a2b3e58f610d502a422e4952e2817e0eaa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A6B1E0B-D66B-4425-ACC9-3C5CAC8FD164"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"a867e63f2709","org_name":"PL Poland Ministry of Economy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/10/16/huge-data-leak-from-ministry-of-economy-of-poland-by-anonymous/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+(Cyber+War+News)"}],"summary":"Anonymous hacked into Polands Ministry of Economy and released hundreds of Megs of documents and images. unclear on methods, assets, etc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f62f737cf1e1a499ab3a5d11f27f4def6d57797","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA2AEEBE-0BAD-4907-9CD7-E681E454666E"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"d94896c1e37d","org_name":"Permanent TSB Group Holdings PLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.limerickpost.ie/2013/10/24/new-bank-card-skimmers-discovered-in-limerick/"}],"summary":"A major investigation is continuing into attempts to fraudulently obtain thousands of euro from unsuspecting ATM customers after the discovery of a number of sophisticated skimming devices in at least four locations in the city.  AIB in Adare and Raheen as well as PTSB banks in S","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5457f927b6f0f21fee0d98b1e72a0c9a4e2106d6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4AC7314-3438-4051-A497-AD23B921FC4C"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7dfb78280c42","org_name":"People's Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/peoples-trust-company-hacked-bank-arranges-for-credit-alert-flags-on-customers-accounts-for-6-years/"}],"summary":"External web site hacked, PI probably disclosed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65ec652bde3220249aea9b8245c6163346a153b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"700990E5-25F8-48DF-A176-5B6CCD5142FE"},"incident_date":"2013-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"baaef8e6fcfd","org_name":"Paul G. Klein, DPM","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/"}],"summary":"Laptop stolen from undisclosed location contained 2,500 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc1ecf6da48ac250793bc4435119e70a6f8b0c7a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E2065F8-0D5A-4B07-859E-45A9C98EFC2D"},"incident_date":"2013-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abdacac73134","org_name":"North Dakota University System","org_type":"education","ransomware":null,"records_affected":290798,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ndus.edu/data/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/north-dakota-university-system-server-breach-data-access-not-evident-but-possible/"}],"summary":"Core Technology Services, the information technology arm of the North Dakota University System, has discovered and shut down suspicious access to one of the university system's servers. An entity operating outside the United States apparently used the server as a launching pad to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"206d251dd442981c7626f67990d64fc79056b258","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62D7029D-C38F-4FB0-B039-06FC2D02B811"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CR","org_id":"d79c3eac9631","org_name":"NIC Costa Rica","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Google-Yahoo-Amazon-Domains-from-Costa-Rica-Hijacked-390789.shtml"}],"summary":"Multiple sites are defaced due to DNS poisoning for registrar.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afd5296cc86aa8a1a017bcaf04568e8e49078918","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27C6A161-4279-4363-B9F1-0E07DD916A9C"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"9454e377d7d9","org_name":"NeoGaf","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.neogaf.com/forum/announcement.php?f=2&a=67"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Video-Game-Forum-NeoGAF-Hacked-User-Passwords-Reset-392448.shtml"}],"summary":"NeoGAF, a popular video game forum that has over 114,000 members, has been hacked. The sites administrators have initialized a password reset procedure for all users since the attackers might have stolen some information.  We've just had an admin account compromised briefly by an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AZ","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6b357c23197eb2b9ce8cd683afecd658b4868bf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71F02F6A-59F7-4BC5-B8DD-4D2B7C6D83D0"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AM","org_id":"f28c7c79440c","org_name":"National Security Service of the Republic of Armenia","org_type":"government","ransomware":null,"records_affected":1191,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/azerbaijan-hackers-hack-armenian-sites/"}],"summary":"A group of Azerbaijani hackers from Azerbaijan Hacker Team has hacked several Armenian websites including the website of Armenian National Security Service. As a result of hack, the hackers have claimed to leak top secret documents of The National Security Service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68be7ddb3345ed67d5862635ee6e9408d538c4e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"434E52F3-74AA-4087-9DD4-E98C9160D84B"},"incident_date":"2013-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"9f3f0e7d6790","org_name":"National Electoral Commission of Argentina","org_type":"government","ransomware":null,"records_affected":5900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyinternational.org/blog/ignoring-repeated-warnings-argentina-biometrics-database-leaks-personal-data"}],"summary":"Multiple external \"concerned citizens\" were able to download data (photos of voters) from the voter registration site. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"707287cfe61a733bad365c9b170ac0f8ffde9435","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EB516E7-63C7-4225-AC43-FF4BE2A9A29A"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MA","org_id":"26e2ec224bf4","org_name":"Moroccan Department of Water","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Target-Moroccan-Government-After-Arrest-of-Kissing-Teens-392217.shtml"}],"summary":"Anonymous reacted to human rights issue in Morocco by targeting Moroccan Department of Water, posting credentials and other internal data publicly.  Unknown most everything.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a98c4ae86e4a9f25725e7e0e64a737287939b14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F7845B4-1BA2-4C0D-A235-D623A1A70222"},"incident_date":"2013-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"20373d76bfc9","org_name":"MongoHQ","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://security.mongohq.com/notice;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.csoonline.com/malwarecybercrime/2814/mongohq-suffers-security-breach"}],"summary":"MongoHQ compromised when attackers gained unauthorized access to an internal support application by stealing an employees credentials (hinted that it was in \"personal\" account)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e3ec5362bbf6f890d42a1f14c2781244b9f5d8f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E8970A5-C141-4639-87A0-D8DCB29DF2CB"},"incident_date":"2013-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5dd6396a2e96","org_name":"Massachusetts Bay Transportation Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bostonherald.com/news_opinion/local_coverage/2014/04/alleged_200g_scam_mirrors_08_mit_report"}],"summary":"Monthly rail pass mag strip information is replicated on single use cards that are doctored to look like monthly passes. They are sold at half price and defrauded MBTA of approximately 200,000 USD.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00ec6f0439c06b114a8481f451e97c68ae3f5d42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0241D98-D659-40BB-AD6D-86DF6651FAF3"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74b5f91271c0","org_name":"Long Island Railroad","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.longisland.com/news/11-01-13/4-arrested-for-stealing-credit-card-info-at-lirr-stations.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/update-four-arrested-for-lirr-ticket-vending-machine-skimmers/;http://www.longisland.com/news/10-19-13/scammers-put-small-cameras-on-lirr-ticket-machines-to-steal-credit-card-information.html"}],"summary":"several skimmers placed on Long Island Rail Road ticketing systems, cameras were used to capture user entry.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51aecf24bacdf37fb0dc1a75269c4640944749c8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A403748-E7D8-4321-98F8-64C8936DDBEE"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LV","org_id":"bc132b601c11","org_name":"Latvia State Employment Agency","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hacker-Breaches-Systems-of-Latvia-s-State-Employment-Agency-388813.shtml"}],"summary":"An Anonymous hacker that uses the online moniker W1n5t0n claims to have breached the systems of Latvias State Employment Agency (nva.gov.lv). From the agencys systems, the hacker has leaked the details of over 3,000 users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49952419c47013dbb35d494f01a613b4046c7e6f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74A2CBA5-6A89-43FD-BD97-89B551353DD0"},"incident_date":"2013-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"fa77b0992868","org_name":"Inputs.io","org_type":"technology_saas","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techienews.co.uk/972801/secure-bitcoin-wallet-inputs-io-hacked-unable-pay-user-balances/"}],"summary":"Inputs.io, a \"high-security\" bitcoin web wallet and a Bitcoin Foundation silver member, has been hacked with total of 4100 BTC siphoned off. The secure web wallet has revealed that it is not in a position to pay all user balances.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84cbd7f5962fd27cbc03f6a17c45bdfcebd312e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"704DE8F6-B287-4FB5-A4AE-1C368C15D84D"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"a780624efa8e","org_name":"IN Board of Higher Secondary Education Delhi, India","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsinfo.com/2013/09/bhse-delhi-gets-hacked-by-anonymous-kashmir/"}],"summary":"Hackers of Anonymous Kashmir have breached and defaced the official website of the Board of Higher Secondary Education Delhi, India (bhsdelhi.com).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fbc56656b6a7eb9d2bb50b9a22e53ab4c0bc8a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D07A45A8-DF58-4B83-92B0-0AEF5310C75D"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GR","org_id":"11c5c411d066","org_name":"Greece Ministry of Foreign Affairs","org_type":"government","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Greek-Foreign-Ministry-Admits-Anonymous-Hacked-Email-Systems-391132.shtml"}],"summary":"The activist group Anonymous hacked into the data of the Greek Foreign Ministry in order to gain access to material exchanged via email. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47bc9559ae51449b27d3a08a970078fa8ad2f3af","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A88430C7-0177-44C4-8CE3-E42DDA9DC032"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e17649139560","org_name":"Federal Election Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/blogs/blog-briefing-room/news/193332-report-fec-system-hacked-during-shutdown;http://www.publicintegrity.org/2013/12/17/13996/how-washington-starves-its-election-watchdog"}],"summary":"Chinese hackers infiltrated the Federal Election Commission computer system during the government shutdown in October","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a357affe7eedceacb35da865dab95ef46388106e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1B68E58-7B29-4336-AA3C-B044BC7CFD78"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LU","org_id":"a3c88b1c80bd","org_name":"European Investment Bank","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Ukraine-Launches-OpIndependence-Attacks-European-Investment-Bank-395790.shtml"}],"summary":"Article mentions a defacement spree and a DDoS. This is modeling the DDoS only. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdc3adf9ec88b1f3e99950b6e4dec9e9b7c5a9e8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7D0E28A-86DD-4B83-B989-DF3C56781725"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PS","org_id":"e0f94d45f1ca","org_name":"ESET","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/ESET-Confirms-That-Sites-of-Palestinian-and-Israeli-Distributors-Were-Hacked-387556.shtml"}],"summary":"A few hours ago, AnonGhost hackers reported defacing the eset.ps, nod32.ps, antivirus.ps and comsecure.co.il domains. For each of the domains, the hackers changed the index.php page with one of their own.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"855e60f59484aa57994dc40d748a665ff2a66f24","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D51CECA4-55BC-4694-9CD5-3C6A1491729B"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f88411158949","org_name":"El Paso Community College","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kdbc.com/news/epcc-leaves-1000-personal-student-files-exposed"}],"summary":"school left hundreds (article rounds to 1,000) records (documents) in unsecured (and unspecified) locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af8a08732ee37f5cb46becf365211b2f58527cbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A5E4055-B2CE-4BED-809E-71AA637FEE15"},"incident_date":"2013-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76c20612ecd5","org_name":"Department of Vermont Health Access","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.benningtonbanner.com/ci_24741364/vt-health-official-reports-2nd-security-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.burlingtonfreepress.com/article/20131217/NEWS03/312170012/Vermont-Health-Connect-has-second-privacy-incident?nclick_check=1"}],"summary":"The state official overseeing Vermont's new online insurance marketplace says there has been a second \"privacy incident\" after there was a mix-up of information involving two people with the same first and last names. Department of Vermont Health Access Commissioner Mark Larson s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92db1782d4c17ff0299d3bf73322d22650c2a9fe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6979BD9C-BA30-459A-A206-657BCF156D56"},"incident_date":"2013-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2423ff001908","org_name":"Denver Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedenverchannel.com/news/local-news/student-information-for-eagleton-castro-and-munroe-elemetnary-schools-stolen-from-workers-car"}],"summary":"stolen thumb drive from car containing \"hundreds\" of records of elementary students.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"IR","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caee9f45eb4d1ef6bc123ee4abdcfd674712f807","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"940871CB-1E79-4B18-BEE6-676D1473840E"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"86ef9843ee5b","org_name":"cvideo.co.il","org_type":"other","ransomware":null,"records_affected":3349,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/iranian-hackers-hack-israeli-job-site/"}],"summary":"Israel-based job search portal CVideo has been hacked by an Iranian hacker of the Black_Devils B0ys group. The details of over 3,300 users have been published online as a result of the breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09b8d90ece0f062374a4279d8fade6c3d64639eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"763BEE2B-47B7-4DB3-BA30-3E742C52B38E"},"incident_date":"2013-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fcb7f3a376f4","org_name":"Cumberland County Schools","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digtriad.com/news/article/301523/57/NC-School-Officials-Upgrade-Security-After-Online-Threat"}],"summary":"Student hacks into school social media site using stolen credentials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c8e5ddaab41a813edf203dacbbbf52350900bcb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36902E10-A550-42D5-8AA1-2FEA1AF97705"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01244839b8b3","org_name":"Crown Castle International Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/crown-castle-acknowledges-data-breach.html"}],"summary":"External actors compromised mail server and viewed an e-mail with employee names, SSN, and salary information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22ce2b0d93adca9d0350bdff7dffc8adc4496843","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1B2B440-A7D5-457C-B94D-3D9ABE18B516"},"incident_date":"2013-10-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b00861793fd","org_name":"Buffer","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/socialmedia/2013/10/26/social-sharing-service-buffer-hacked-pauses-shares-temporarily/;http://agbeat.com/business-marketing/buffer-gets-hacked-company-handles-impeccably/;http://open.bufferapp.com/buffer-has-been-hacked-here-is-whats-going-on/?utm_content=bufferfebab&utm_source=buffer&utm_medium=twitter&utm_campaign=Buffer#update8;http://news.softpedia.com/news/MongoHQ-Hacked-the-Incident-Is-Connected-to-the-Buffer-Breach-395417.shtml"}],"summary":"Because of MongoHQ breach, attacker gained access through mongohq into buffer's database, grabbed the auth tokens for facebook and twitter, then began to spam about a weight loss site through compromised facebook and twitter accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"ID","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f9b2a35a9ddde5010154f648a64e05d7dbd4303","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEDF80C0-133B-4D18-8120-1BD8B17E5901"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16a82a85f466","org_name":"Arts Block","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.recorder.com/news/business/9100304-95/arts-block-website-suffers-hack-attacks"}],"summary":"random defacement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bc4ece72114b26e4329811820a8faf496b20d53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E32E06A-1C07-4CBE-BBB9-8760B815B293"},"incident_date":"2013-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d8a31718485","org_name":"Armistead Caregiver Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vnews.com/news/townbytown/norwich/10019489-95/caregiver-charged-with-identity-theft"}],"summary":"A 33-year-old Enfield woman has pleaded not guilty to allegedly using the credit card of an elderly woman whom she was supposed to be assisting.  Lydia G. Hunter was working for Armistead Caregiver Services and was providing assistance to a 76-year-old Norwich woman when the elde","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82455f8aa073c10d57ab67e1c6a61d16fdee59da","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99542D62-ECCB-4E06-AFEC-A69DE029A3CB"},"incident_date":"2013-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"5ed8ee5e7cc3","org_name":"Argentina web hosting","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/argentina-web-hosting-server-hacked-x0x0-hacker.html"}],"summary":"Mass defacement of websites via hosting provider","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43a32ea1d6002a4fdf7d82213b02579b8755dafc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20E19E01-36E4-41A2-BF64-0CCA3575D139"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"ceaad1eff5fd","org_name":"Allied Irish Banks, p.l.c.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.limerickpost.ie/2013/10/24/new-bank-card-skimmers-discovered-in-limerick/"}],"summary":"A major investigation is continuing into attempts to fraudulently obtain thousands of euro from unsuspecting ATM customers after the discovery of a number of sophisticated skimming devices in at least four locations in the city.  AIB in Adare and Raheen as well as PTSB banks in S","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87c667ebe6a6c60039ec58b3418d0ba905b515fd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"230092F0-C4CC-422B-B3AA-92AD5AFB53C8"},"incident_date":"2013-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dec9f3b2a153","org_name":"Alabamas ABC 33/40","org_type":"technology_saas","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wset.com/story/23770605/warning-crypto-locker-computer-virus-going-around"}],"summary":"INCIDENT 2: A nasty virus called crypto locker is going around, and it can cripple your computer. It hit our sister station, ABC 33-40 in Birmingham, Alabama. The station's Director of Engineering says they received specific instructions to pay up.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24cf2e4b4741e2757d6f6989716b300f8b8292f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9215CDCE-EC81-4757-A7DF-37B07F8586DC"},"incident_date":"2013-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d5931278876","org_name":"7-ELEVEN, INC.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://yorktown-somers.patch.com/groups/police-and-fire/p/yorktown-police-atm-skimmer-detected-at-convenience-store"}],"summary":"ATM skimmer at 7-11 convenience store","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb038fa4dca891fe0c3198ecc174fca558646a4e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E0F604B-FEDC-4591-8134-C912C827CAE4"},"incident_date":"2013-09-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JO","org_id":"4b481d94af8b","org_name":"JO Prime Minister of Jordan","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Jordan-s-Prime-Minister-Hacked-by-Anonymous-387136.shtml"}],"summary":"Anonymous hackers have breached and defaced the official website of Jordans Prime Ministry (pm.gov.jo). The hack is a form of protest against increasing prices.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3be312e088a8c8fdad576d82f93bb28551fcbf38","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCB88461-5249-46C3-BD5F-8424A55B2164"},"incident_date":"2013-10-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3224215150d","org_name":"Global News Enterprises, LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Hacks-GlobalPost-for-the-Second-Time-388065.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/09/us-news-agency-globalposts-twitter-and.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99986d521870fdf59af2e37c70172af42d9c60f5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86F23C46-5030-4656-8964-2BA4660C5A58"},"incident_date":"2013-09-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EC","org_id":"924dcb846178","org_name":"EC Ecuador Province of Azuay","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Deface-Ecuador-Government-Site-in-Protest-Against-the-Killing-of-Condors-387162.shtml"}],"summary":"Hackers from Ecuador have breached and defaced the official website of the government of the province of Azuay (azuay.gob.ec). The hacktivists are protesting against the killing of Andean condors, a protected species in Ecuador.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f536d583832d420279fff03f6da289846b36288d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7C94E15-C4D5-4E8B-BC5F-25FD0CF0B2BC"},"incident_date":"2013-09-29","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c082f1bf99e7","org_name":"Cottage Health Systems","org_type":"retail_ecommerce","ransomware":null,"records_affected":32000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.noozhawk.com/article/cottage_health_system_notifies_patients_of_data_security_incident_20131211"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/data-breach-at-cottage-health-system-affects-32-500.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.noozhawk.com/article/cottage_health_notifying_patients_of_potential_information_breach_20151202"}],"summary":"On Dec. 2, Cottage discovered that a third-party vendor appeared to have removed electronic security protections from one of its servers, without informing Cottage, resulting in the exposure of certain information stored on the server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"103011e72e177c66fe953463fb55d4b7b188ed70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92536270-C6A6-406D-9716-E1680B58EC2F"},"incident_date":"2013-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e3532453e94f","org_name":"Wychwood Brewery","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworlduk.com/news/security/3481429/hackers-steal-customer-information-from-marstons-brewery/"}],"summary":"Database at Marstons' brewery was breached, unknown how or who but assuming external.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-09-27","discovered_date":"2013-09-16","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edd2abad9e4af8615330c97310d997e0328bf3cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-09-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/541-116-13%20Letter%20to%20Patient_0.pdf"},"notes":null,"org_country":"US","org_id":"10dadf24b00a","org_name":"Santa Clara Valley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42788"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/541-116-13%20Letter%20to%20Patient_0.pdf"}],"summary":"A stolen, unencrypted Audiology Department laptop was believed to contain patients’ personal and medical information.","supporting_quote":"On September 16, 2013, staff discovered that a laptop had been stolen from the Audiology Department over the weekend.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-09-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fa5890b9d0612be7ca972b6c13ec99d82b53932","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99D69E39-E343-4D62-AF46-EE619FB6FD37"},"incident_date":"2013-09-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9c720450e35","org_name":"City of Lexington, KY","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkish-Hacker-Says-He-Hacked-Lexington-Website-386958.shtml"}],"summary":"Maxney, a hacker of the Turkish Ajan group, claims to have breached the official website of Lexington (lexingtonky.gov), the second largest city in Kentucky, also known as the Horse Capital of the World, publishing a 1.5 Mb archive file that contains information apparently taken ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d229cf5849850b7c4c7132eacb0644470c016ee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7731A968-CF5A-4690-8914-3C987F0D0614"},"incident_date":"2013-09-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77637180636a","org_name":"UHS-Pruitt","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/two-laptops-with-phi-stolen-from-uhs-pruitt-employees-cars-in-a-two-week-period/"}],"summary":"UHS-PRUITT CORPORATION NOTIFIES RESIDENTS OF BREACH OF UNSECURED PERSONAL INFORMATION  UHS-Pruitt Corporation (UHS-Pruitt) has provided notice to current and former residents of Heritage Healthcare of Ashburn, UniHealth Post-Acute Care Augusta Hills, Heritage Healthcare of Fitzge","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"130f791bbb683f65647b114ab583703b1b45a8ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ECFBC01-F1C1-496B-ADD9-D030C71C03ED"},"incident_date":"2013-09-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f07c0aa8428e","org_name":"Stormont-Vail HealthCare","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.cjonline.com/news/local/2013-11-16/patient-mistakenly-receives-anothers-medical-records"}],"summary":"Topeka resident Lori Stein says people need to know just how easy it is for their medical data to be shared with others without their authorization.  On Sept. 26, went to an endocrinologist at Cotton-ONeil Diabetes and Endocrinology Center, which is part of the Stormont-Vail Heal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f360ee5fcee17cc093aa389074ecd61cde6c1b34","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDDF5FC8-A6D3-4872-BF5C-2053173F9DF9"},"incident_date":"2013-09-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"709ccf45eabb","org_name":"New York University Asian/Pacific/American Institute","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Asian-Pacific-American-Institute-at-NYU-Hacked-and-Defaced-386571.shtml"}],"summary":"An Iranian hacker that uses the online moniker le4derofh4ck (Leader of Hack) has breached the systems of the New York University. As a result of the breach, he has managed to deface the official site of the Asian/Pacific/American Institute at New York University (apa.nyu.edu).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0283bc141ca97c132f4c73793613152a7d585f29","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F59CBE0A-1EEB-4FA9-85EC-EFD55EF0CF9D"},"incident_date":"2013-09-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California, San Francisco","org_type":"education","ransomware":null,"records_affected":8294,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ucsf-notifying-8294-gastroenterology-patients-whose-pii-and-phi-were-on-laptop-stolen-from-doctors-car/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/ucsf-acknowledges-second-breach-in-two-months.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43352"}],"summary":"UC San Francisco is alerting some individuals to the theft of a physicians personal laptop computer that contained personal and health information. While the physician believed the laptop was encrypted, this could not be confirmed. As a result, the individuals involved are being ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ad8879bf7eb3cd47261ddc0a9bc829434291f9b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF85545D-F3A4-4372-A724-890DD0C4C3BF"},"incident_date":"2013-09-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"e961ee2d22d9","org_name":"Kaiser Permante","org_type":"other","ransomware":null,"records_affected":49000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/kaiser-foundation-hospital-orange-county-anaheim-medical-center-notifying-patients-of-breach/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/2013-09078%20Patient%20Notification%20Letter_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/kaiser-permanente-acknowledges-security-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/money/la-fi-mo-kaiser-privacy-breach-20131209,0,4000091.story#axzz2n5dVjCvD"}],"summary":"Lost flash drive contained medical records for 49000 patients. The drive was not encrypted nor password protected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f467ec7b2d5f15e9b2a500dd58da78756a6d99e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"030C8356-8DE6-46BC-94B6-F4BD8535CEE6"},"incident_date":"2013-09-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9c2f82eeef4","org_name":"Eureka Internal Medicine","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/PDF%20version%20of%20proposed%20breach%20notification%20for%20client%20approval%20%2800778853%29_0.PDF"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-44320"}],"summary":"cleaning contractor throws patient information away in the regular trash rather than properly disposing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c751a8d0378c473812432828c53a5bcf4afac26","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"257B610C-BDB3-4B3E-8CC8-2F3C99A49E2D"},"incident_date":"2013-09-24","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a666edbbe8c","org_name":"University of Connecticut","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/almost-3-years-after-malware-compromise-u-conn-notifies-some-of-those-affected/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uconn-discloses-data-breach-at-school-of-engineering-that-began-in-2013/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notif%20Ltr%201_0.pdf?;"},{"fetched_at":null,"title":null,"type":"press","url":"http://today.uconn.edu/2015/07/uconn-responds-to-data-breach-at-school-of-engineering/"}],"summary":"hackers apparently originating in China gained access to servers at UConn's School of Engineering. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17caf88641f11e89e2e9824318a2532c746fbddf","impact_type":"unknown","incident_date":"2013-09-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20%2892312rv%292_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"7a1d1e21c37a","org_name":"Unique Vintage","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42752"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9788a3234dfc91784f35df3cf56523cc7660928d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F776AECE-05BE-4F94-A756-1141F31953B8"},"incident_date":"2013-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"293a86e68b94","org_name":"TRICARE","org_type":"government","ransomware":null,"records_affected":1150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.shaw.af.mil/shared/media/document/AFD-131008-003.pdf"}],"summary":"two laptops and two printers stolen form unnamed area which contained 1,150 last names, ss#'s, and result of color vision test.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6113b7092a42100381614a8ecf20f1cce3aac693","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02558E0B-13F5-4CA7-91AB-F0DCF7222A8D"},"incident_date":"2013-09-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"63a0d5a31a3e","org_name":"Region of Peel","org_type":"other","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.peelregion.ca/news/archiveitem.asp?year=2013&month=9&day=7&file=201397.xml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bramptonguardian.com/news-story/4144697-region-employee-who-lost-private-information-breached-protocol/"}],"summary":"An SD card that was not encrypted was inside a bag that was stolen from an employee's car. The card contained the name, address, birth date/age, marital status and assessment information of clients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e9695b343dc8cfd556bdacb1ab88127cfa4ee4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDBC800E-B984-4BE5-AE31-99EA975F67A5"},"incident_date":"2013-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4afe15c9a3cd","org_name":"Yusen Logistics (Americas) Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/YLA%20Generic%20Notification_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43080"}],"summary":"a password-protected, unencrypted laptop computer issued to a YLA employee was stolen from the employees vehicle. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18933bdc1bbb809959176b59d0efb108a95e33fb","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Windhaven%20Investments%20Sample%20Notice_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eb9875040e60","org_name":"Windhaven Investment Management, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42740"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a58840b19c5d66ee7fbdeee333e90735abe75b8e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E5A06A3-4488-4057-A382-BE231CB96EB7"},"incident_date":"2013-09-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d06c0923859b","org_name":"translate.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Translate-com-Hacked-and-Defaced-by-Xploiters-Crew-385345.shtml"}],"summary":"Pakistani hackers of the Xploiters Crew have breached and defaced Translate.com, a fairly popular free online tool that provides translations between 75 languages","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cabd7bf4d71e9718c3f6630b84fea81148395791","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11B2250A-6352-4367-AE83-6583940A0B62"},"incident_date":"2013-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e27b5c611877","org_name":"Stephen T Imrie MD","org_type":"healthcare","ransomware":null,"records_affected":8900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/orthopedic-surgeons-laptop-stolen-in-home-burglary-8900-patients-notified-of-data-theft/"}],"summary":"San Jose-based orthopedic surgeon Stephen T. Imrie, M.D. is notifying 8,900 patients that a password-protected laptop stolen from his home on September 23 held their protected health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"076753f2455db89ecba0dddb8d0d141c262043b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DE6C6B9-260C-4F42-B870-0D30BB87962A"},"incident_date":"2013-09-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"60f93ec2e8b3","org_name":"HLTV.org","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/HLTV-org-Disrupted-by-DDOS-Attack-385258.shtml"}],"summary":"HLTV.org, said to be the worlds biggest Half-Life TV provider, was disrupted a few hours ago by a major distributed denial-of-service attack. The attack appears to have lasted for around 2-3 hours.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33c06f445361922e6e90fc22d617abc738ff73e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12E745DE-AC54-4DE0-9D67-5D5D16616B3A"},"incident_date":"2013-09-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0041a1532e5","org_name":"Care One Senior Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/crime-and-courts/new-york-resident-charged-with-fraud-identity-theft-1.1128580"}],"summary":"A former payroll specialist at the CareOne senior care facility on Bridge Plaza North has been arrested on fraud and identity theft charges after allegedly using the company's employee database to obtain fraudulent debit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bbe5f23002b02c962a98661c47fe8116e637f18","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"993E6FD7-C6F4-46BF-84D8-84880922F26E"},"incident_date":"2013-09-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RW","org_id":"e2a9c66e56e0","org_name":"RW NIC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/ibm-microsoft-rwanda-hacked-by-the-hackers-army.html"}],"summary":"The hacking group with the handle The Hackers Army has hijacked the Rwanda top level domains that includes Microsoft, Ibm, American Express, Aol, Bbc, Coca Cola, Coke, Discovery Channel, Fanta, Fedex, Mastercard, Nec, Nike, Norton, Orange, Philips, Qubee, Register and Rolls-royce","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"JO","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c96323afa3d13d584ac2cefbd2bbbaf2f7438164","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"063F033E-D5F0-4A4D-8EE6-4B9A9908812A"},"incident_date":"2013-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PS","org_id":"72d5a23f6a7e","org_name":"PS Palestine Ministry of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/palestine-justice-ministry-hacked/"}],"summary":"A Jordanian hacker going with the handle of Evil-Jo has hacked and defaced the official website of Palestine Ministry of Justice.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f4372da25e7967f884a5734e0d9b696ae6af904","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26B6C8E9-0F82-4AFD-9100-F4C7D6847772"},"incident_date":"2013-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"5c2a7daf49e6","org_name":"Kenya Domain Registrar","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/google-kenya-google-burundi-hacked-by-1337.html"}],"summary":"attackers broke into registrar, hijacked domains of google in kenya and berundi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b037c6b1fcb5514c6a256be34af809581bb023db","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2C36AC1-97B2-445F-B517-F4B620F7488C"},"incident_date":"2013-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"0e9f335c7c68","org_name":"Google Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/google-kenya-google-burundi-hacked-by-1337.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/h4x0r-hussy-hacks-google-video-costa-rica/"}],"summary":"dns hijacking of google sites in Kenya and Berundi (google ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcbe6a57f265ebe79b1e390d866fdd51ac05db3e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F76C6970-044D-4555-A8C2-916C34E73A95"},"incident_date":"2013-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"602d6a225054","org_name":"FENADEPOL","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Brazilian-Federal-Police-Organization-Hacked-and-Deface-385057.shtml"}],"summary":"website of FENADEPOL (fenadepol.org.br), Brazils National Federation of Federal Chief Police Officers was defaced","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfbbc81b4160251bdc62b37747fdecbcfb68414f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E9FE939-9B53-4C5C-A326-05FCEBA529EC"},"incident_date":"2013-09-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"de8a70680da1","org_name":"BD NGO Affairs Bureau","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Bangladesh-NGO-Affairs-Bureau-Other-Government-Sites-Defaced-by-Indian-Hacker-385020.shtml"}],"summary":"Indian hacktivist Yamraaj has breached and defaced the official websites of four Bangladesh government organizations. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d146eed939bda299bfcb1b9f4aee2e7ff1afa0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6EB18CB5-763F-47BF-8418-94ADBA1A22F6"},"incident_date":"2013-09-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"3dcb598ebcc5","org_name":"Triple-S Salud, Inc.","org_type":"other","ransomware":null,"records_affected":13330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/triple-s-salud-fined-6-8m-for-hipaa-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/robert-siciliano/insurance-company-fined-b_b_5083390.html"}],"summary":"Error that caused health insurance claim numbers to be printed with the address on mailing leads to over 13000 medical records being at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5b7cc8f7864debc7046093c70fae5d7c26cf973","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92C68DDD-E6B5-4B0E-B66C-B374662D922B"},"incident_date":"2013-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b372df6b7c0","org_name":"Tri Lakes Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1489,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrnotifications.hhs.gov/iframe?utf8=%E2%9C%93&state_id=&start_breach_date=&end_breach_date=&business_associates_present=&search_box=Tri-Lakes+Medical+Center&commit=Apply+Filters"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhs-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking/IT Incident","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86c4994eedcf44c643900d227b1748fcec15daa6","impact_type":"data_theft","imported_from":null,"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"d4d2793e6c5b","org_name":"BEL USA LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42735"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification%20Sample_0.pdf"}],"summary":"BEL USA LLC reported that unauthorized third parties accessed its website server and obtained customers’ personal and payment-card information.","supporting_quote":null,"technology_involved":["website server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14b348d59f37713d412f1cb2729eb5386878e7b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BC30E91-8766-46EB-AA82-F83F7374113E"},"incident_date":"2013-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"b35ba6f6d099","org_name":"BD Prime Ministers Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/bangladeshi-pm-office-website-hacked/"}],"summary":"Famous Indian hacker going with the handle of Yamraaj has hacked and defaced one of the official website of Bangladeshi Prime Minister Office dealing with the NGO Affairs Bureau (NGOAB) along with three other high profile Bangladeshi government websites. There were three other si","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"846b07ebf2834fbe96f41a37f75491c847e7b0e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9787C039-181F-4A8A-A08B-8E3E37D0B01E"},"incident_date":"2013-09-19","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"fd7e07c7a098","org_name":"Higher Education Commission of Pakistan","org_type":"education","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/ashiyane-digital-security-team-hacks-higher-education-commision.html"}],"summary":"SQLi dumping db contents and PI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c23d07bf4154fc95ef1ce68167384d5df1c2a304","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA31F6DD-D8FA-4DD8-A398-B3182076D323"},"incident_date":"2013-09-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2c381a7e6930","org_name":"GB National Health Service UK","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/national-health-service-nhs-uk-websites-hacked-by-h4x0r-hussy.html;http://www.itproportal.com/2013/09/20/two-nhs-websites-breached-and-defaced-pakistani-hacker/"}],"summary":"simple defacement, seemingly random and for fun by pakistan group: One site is designed to enable book lending between south west, Wessex and Thames Valley hospitals. The other is for users to get information about health education books available in libraries across the south we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"207e3d84e144c01045cac685224aa9d435798120","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Master%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b4559e7c2906","org_name":"PLS Financial Services, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42722"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7509d078b9f373c4bc51736415199046a10bce25","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10D8A632-1904-4020-BB83-AF9B25B3B500"},"incident_date":"2013-09-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d89d66a666c","org_name":"North Country Hospital and Health Center","org_type":"healthcare","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"North Country Hospital and Health Center, Inc reports theft of laptop containing 550 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d72c1165e8c9d7645e20feed91be5e5766d5f6ee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11598E83-2398-418A-973E-2CFDF98EFE01"},"incident_date":"2013-09-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1cac9eae8d05","org_name":"Move Your Money UK","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Move-Your-Money-UK-Hit-by-DDOS-Attack-384095.shtml"}],"summary":"Move Your Money UK is a not-for-profit organization that aims at building a better banking system by providing people with information to help them better decide what financial institutions they want to support. On the morning it went live it was hit by DDoS attack.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84e832c4f5dbecb44251eda7aee301c4a62e2a19","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5e272a70-c59a-11e7-8053-ff1e84d2b694"},"incident_date":"2013-09-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6210ae29bf8","org_name":"Centerville Clinics Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/legal-regulatory-issues/former-centerville-clinics-admin-gets-prison-time-for-computer-hacking.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bankinfosecurity.com/former-systems-administrator-gets-prison-time-a-10299;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bleepingcomputer.com/news/security/sysadmin-hacks-former-employer-and-buys-ipad-tablets-from-staples/"}],"summary":"A Houston man has been sentenced to 27 months in prison for damaging 13 servers and committing wire fraud on Fredericktown, Penn.-based Centerville Clinics' computers in 2013, according to the Department of Justice.  Centerville Clinics hired Brandon A. Coughlin, 29, as an in-hou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd6dfaa19ea265da5f41d40346125ac9fc644e75","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B127C554-D119-4C43-BE11-409654C73DEF"},"incident_date":"2013-09-18","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"564fbfa2add0","org_name":"Boone Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":125,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/missouri-hospital-fires-physicians-assistant-for-accessing-patient-information/article/317590/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.komu.com/news/employee-abuses-access-to-boone-hospital-patient-information/"}],"summary":"An employee of a staff physician inappropriately used credentials to access personal health information on the hospital network. Hospital officials confirmed that information was accessed on Sept. 18, a couple of days after a patient called to report that she believed an employee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cec43700e3e60a4c1fae2d0885091b722b7e3f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6ACE3048-8684-48C7-97A2-D7A9FDC6351F"},"incident_date":"2013-09-18","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46885561664a","org_name":"Allina Health System","org_type":"healthcare","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.twincities.com/health/ci_24388042/allina-fires-employee-over-privacy-breach-3-800"}],"summary":"Allina Health System is notifying more than 3,800 patients about a data-privacy breach by a medical assistant at a clinic in Inver Grove Heights.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24ce20ee836825a024f4ca2e4c5b2f096e17cca5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FF73909-38CE-4EB1-8E7E-0718ADFE7536"},"incident_date":"2013-09-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c91f54803693","org_name":"U.S. Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox2now.com/2013/09/24/two-arrested-at-atm-for-installing-skimming-device/"}],"summary":"ATM skimming incident, suspects images and  license information captured on surveillance camera. Arrested later at another ATM location.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1bdeb82800915d1fd5977820973dac0ab7e31dc9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBFDED0F-F224-4051-A110-DE30183B7B5F"},"incident_date":"2013-09-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac511ee7deb3","org_name":"L.A. Gay & Lesbian Center","org_type":"nonprofit","ransomware":null,"records_affected":59000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The L.A. Gay & Lesbian Center hack resulted in notification of 59,000.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-09-17","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae22e92a2acf738266cfce019e5908d5cb6dab17","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20to%20BCCCA%20customers_0.pdf"},"notes":null,"org_country":"US","org_id":"d02ae7b65ed9","org_name":"Buckeye Check Cashing of California LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42716"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notice%20of%20Breach%20to%20BCCCA%20customers_0.pdf"}],"summary":"Buckeye Check Cashing of California LLC reported that a laptop containing customer information may have been stolen from a vehicle, with no reason to believe the data was accessed.","supporting_quote":"On June 27, 2013, a laptop that may have contained your personal information was stolen from a locked vehicle in a smash-and-grab type of theft.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7abb35f1b96dac1601e156afc8eaf9d91c419dca","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"655C9DE6-6377-4942-96F2-C8CCFEC0BE7E"},"incident_date":"2013-09-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"399b00478a4b","org_name":"Santa Clara Valley Health and Hospital System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/541-116-13%20Letter%20to%20Patient_0.pdf"}],"summary":"On September 16, 2013, staff discovered that a laptop had been stolen from the Audiology Department. The laptop was used for hearing screenings and was not encrypted. Patient Information Disclosed included Patient name, medical record number, date of birth, age, gender, date of s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6867a95b74a492a036ec8e9d13926ac3652e986","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"316EEA1D-E1B4-4A55-87A5-305AE93DB584"},"incident_date":"2013-09-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9612b8ace15","org_name":"RailWorks, Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234503.pdf"}],"summary":"On or about September 16, 2013, a RailWorks corporate employee separated from the company. It is possible that, between December 2012 and September 2013, the employee in question may have had access to employee personal information, including name, social security number, financi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b129a71a20f1178d1d8db4d3cc981bf352df19b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB70CA0F-2184-403C-8F6B-CAAF6E102140"},"incident_date":"2013-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"a6ce0225bc56","org_name":"Pakistan International Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/pakistan-international-airline-pia-website-hacked.html"}],"summary":"The official website subdomain of Pakistan International Airlines has been hacked and defaced by Ch3rn0by1 hacker from P4K M4D HUNT3RS hacking group. It seems that hacker just randomly selected and defaced the website. It was not a targeted attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa93df07f8f2f262702515f3676c1e80fc6641e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02DEA9F3-5F14-4983-832B-62858B8AC982"},"incident_date":"2013-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12cede7fdb13","org_name":"Group Health Cooperative","org_type":"financial","ransomware":null,"records_affected":1015,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/"}],"summary":"An undisclosed event involving paper documents exposes 1,015 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb5c969aa0369afe6a5901548e5c0d0a75484cd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84E84913-DC97-4C5A-AF92-11641BFDBA3A"},"incident_date":"2013-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30dda34b0726","org_name":"Dermatology Associates of Tallahassee","org_type":"healthcare","ransomware":null,"records_affected":915,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/updates-to-hhss-breach-tool-2/"}],"summary":"915 records exposed by unknown means.  Dermatology Associates of Tallahassee has learned that the personal information, including name, address, social security number, and date of birth, of 916 patients has been compromised. As part of a swift response, the practice sent written","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CL","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2864407cb3fd0926cd01bc570a62a1143b2d832d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50BCC245-20B2-4B4F-8DE6-C00AB1924AE5"},"incident_date":"2013-09-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CL","org_id":"cf2048b338d3","org_name":"CL Chile Ministry of Agriculture","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Post-Adult-Video-on-Website-of-Chile-s-Ministry-of-Agriculture-383659.shtml"}],"summary":"Hackers of Anonymous Chile have published an adult video on the official website of Chiles Ministry of Agriculture (minagri.gob.cl ). Besides the video, the attackers have also published links to advertise their Facebook and Twitter accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5725b4e5dd3955d8e57b2d572c268c7272f5ebb1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52F2FBDD-1570-436C-A8EE-AC02EFEA4CC1"},"incident_date":"2013-09-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43774c8354ab","org_name":"Council for Accelerated Programs","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234886.pdf"}],"summary":"an unspecified theft occurred at the offices of the Council for Accelerated Programs in Greenwood, CO occurred.  Whatever the item stolen might have been it had credit card information on it from a registration for a conference by someone. It appears that data was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"AR","motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27203845b96b490459455740938375ab39c1f7d9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7A11D85-2614-499A-8E56-4AD5805D02FC"},"incident_date":"2013-09-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"5c8da31019bd","org_name":"Argentinian Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Argentinian-Government-Websites-Hacked-in-Protest-Against-Politicians-383372.shtml"}],"summary":"A hacker that uses the online moniker Libero, a member of the Argentinian hacktivist group Team Hacker Argentino, has breached and defaced several websites hosted on .gov.ar domains.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad6b81eac4738267745c7a2b327de663e87585b3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9780B3FA-9145-4D60-AEF6-3A696970B742"},"incident_date":"2013-09-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"249d5e38d59e","org_name":"California Employee Development Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/CUBS%20-%20Potential%20Privacy%20Breach%20Letter_0.pdf?"}],"summary":"This letter is to notify you that some of your confidential information may have been released by the Employment Development Department (EDD) in a notice mailed to an employer for whom you did not work. Our analysis of records shows that between September 14, 2013, and October 9,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0d6da96aff97e8cff187a2bc05d1069a25aef46","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"820EE987-E10F-4BB0-A543-EFD6C0746F4C"},"incident_date":"2013-09-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"badb18ad8587","org_name":"Washington University","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234645.pdf"}],"summary":"On September 13, 2013, our client, Washington University, learned that an unencrypted laptop computer issued to a Washington University employee had been stolen from the Washington, DC office of the Danforth Center for Religion and Politics the night before.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37e8bcba972aed7753701d8ae82ff85334de4333","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0EB454FD-934F-4569-9559-DD4CF8556169"},"incident_date":"2013-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AM","org_id":"ceb53466501a","org_name":"United Nations - Armenia/Slovenia- website","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Websites-of-UN-in-Armenia-and-Slovenian-Avira-Distributor-Hacked-382708.shtml"}],"summary":"The official website of the United Nations in Armenia (un.am), and the website of a Slovenia-based Avira distributor (avira.si) have been hacked by Dr.SHA6H. The hacker has defaced both websites to protest against the conflict in Syria, HackRead informs. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36664f54f0e43f5ae3bf750e95291671d4d91f53","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2D05217-F2DD-4CB5-83B1-FB831EBA230B"},"incident_date":"2013-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"c2c16293a1bc","org_name":"Turkish National Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Turkish-National-Police-Disrupted-by-RedHack-381246.shtml"}],"summary":"DDos attack against the official website of the Turkish National Police (egm.gov.tr) by RedHack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8639ad8e1abf6e02828433c30f59eb08c318030a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA6824E2-521B-4607-B443-2AAD977B2690"},"incident_date":"2013-09-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0abbd5b0659b","org_name":"NHC HealthCare, Mauldin","org_type":"healthcare","ransomware":null,"records_affected":4204,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Improper disposal exposes 4204 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f05268cfd8eb439cb47d87dfe4f31db5030832a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFBB72C1-1EE2-47F4-856A-4C3C65F0673A"},"incident_date":"2013-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"761d8eb01520","org_name":"Executive Accounting Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/executive-accounting-20131004.pdf"}],"summary":"Company is notified by several financial institutions that certain customer accounts had been compromised.  They determined an unauthorized person gained access to their servers on September 13, 2013, and accessed information about their clients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aca8fc1ad86505e6cba22463726686dd601498cd","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"394D68D6-F30D-4B30-8BB8-39DB78674F2A"},"incident_date":"2013-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"63253f562c5f","org_name":"Avira antivirus","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/avira-un-hacked-by-dr-sha6h"}],"summary":"web site defacement: \"A profile Syrian hacker going with the handle of Dr.SHA6H has hacked the official website of German based Avira antivirus software company\"  http://zone-h.org/mirror/id/20761402","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d4b455d2f5f1e6a90c7bc45cdbb32bbcf3f8c59","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7A11807-6EE6-47AB-88BD-0C56682BABEC"},"incident_date":"2013-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a5cc1eb889e","org_name":"State of New Jersey","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/new-jersey-suffers-yet-another-state-datacenter-failure-7000020654/"}],"summary":"For the third time in the last seven weeks a problem with the states datacenter brought down services offered to state residents. This time it was a power failure at 5 AM that was unresolved for four hours. But even after power was restored, the state was unable to completely res","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bc9f092c997370044da438d482bc314e2209341","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2DF80E7-5388-4B1F-A2F7-C2061BC32744"},"incident_date":"2013-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"55e933993462","org_name":"MacTalk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/MacTalk-Hacked-Defaced-with-Pro-Syria-Message-382514.shtml"}],"summary":"A hacker that uses the online moniker SeCuR!TY DR@G0N has hacked MacTalk (mactalk.com.au), Australias main Apple community. The website has been defaced to display a pro-Syria message.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e544fae84b896c2e7a3b7ce079084ae56003910","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D84BBE8-32E0-4712-9B7F-F9446F7B4DD5"},"incident_date":"2013-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BH","org_id":"55fe3b1e4589","org_name":"Indian Passport and Visa Application Center in Manama, Bahrain","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Site-of-Indian-Passport-and-Visa-Application-Center-in-Bahrain-Hacked-by-ZHC-382370.shtml"}],"summary":"The ZCompany Hacking Crew (ZHC) is back with another pro-Kashmir attack. A few hours ago, they hacked the website of the Indian Passport and Visa Application Center in Manama, Bahrain, owned by Octic International (octicinternational.com).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5c7ccb70e3de1900f729d84e3400840707a77bb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0A94EA0-91C9-4212-B3F7-58527D6EC63F"},"incident_date":"2013-09-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cca6ffc731cd","org_name":"City of Durham, NC","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/City-of-Durham-Website-Hacked-Attacker-Threatens-to-Kill-Obama-382695.shtml"}],"summary":"City of Durham, NC website defaced (actually only a subdomain responsible for the city's GIS Interactive map. Only worthy of mention due to fact that hackers made threatening remarks about killing the president.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"502f62e53a2dc4930943be5e43f3afc6241facf8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFCF4B50-AE28-421B-BB0A-222D562EBD0D"},"incident_date":"2013-09-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"57eb56f1d350","org_name":"Barclays Bank PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.getbucks.co.uk/news/local-news/bucks-cctv-captures-suspects-removing-6116124"}],"summary":"ATM Skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47819b936142df6fbabd9144e098cfe2c7d33a93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"482BF0E7-F54F-4B2F-AF96-56992AD9DF69"},"incident_date":"2013-09-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86490f348246","org_name":"TSYS","org_type":"manufacturing","ransomware":null,"records_affected":5276,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ledger-enquirer.com/2013/09/27/2713097/tsys-says-names-addresses-birth.html"}],"summary":"Global credit-card and payment processor TSYS said Friday that the personal data of more than 5,200 of its current and former employees was stolen earlier this month by an employee of a third-party administrator of its health-care plans.  Read more here: http://www.ledger-enquire","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"BZ","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1a0e54a58aef22d171190f60ce24cb2cc7d9964","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CCF7609-3913-4B72-B848-52C6D22BC432"},"incident_date":"2013-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a3b0f491f9a","org_name":"National Aeronautics and Space Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/nasa-websites-hacked-spying-us-syria-attack.html"}],"summary":"NASA official subdomains hacked by Brazilian hacker named BMPoC for NSA spying on Brazilians and US strike on Syria.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6aeac2effadfc0fe629fe3b88dd8bca74ab7bd7","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-05-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Member%20Notification%20Letter%20Sample%20FINAL%202013_07496_9.10.2013_0.pdf"},"notes":null,"org_country":"US","org_id":"505d85b3913c","org_name":"Kaiser Foundation Health Plan, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42658"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notification%20Letter%20Sample%20FINAL%202013_07496_9.10.2013_0.pdf"}],"summary":"Kaiser Permanente reported that an electronic file containing health information was provided to a recipient, who said it had not been viewed and had been deleted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbb3280503f21d80abfe1500a8718d2a0fb342b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9D71FA3-5EB1-492A-91E7-8570C97B16BC"},"incident_date":"2013-09-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IS","org_id":"fb8f84b8d1e2","org_name":"Israel websites","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/opisraelreload-anonghost-hacks-400-israeli-websites/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+Delicious%2Fvzriskteam%2Fagenda+%28Delicious%2Fvzriskteam%2Fagenda+%28test%29%29"}],"summary":"The online hackavist going with the handle of AnonGhost along with TeamR00t have claimed to hack and deface around 400 Israeli websites with claim of leaking credit card details of Israeli citizens under the banner of #OpIsraelReload.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93db6e67e720b01d3e636e5fd658b6f1b3f3e4a4","impact_type":"unknown","incident_date":"2013-07-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/930L81%20Paymast%27r%20Services%20Ad%20MetaBank_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"426d70f97c17","org_name":"FSV Payment Systems","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42650"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c13173ac05682ae5530be2ddd2c0bb4735eef625","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01718628-20DC-42F7-9F87-64DA539F6336"},"incident_date":"2013-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"a53861134cfe","org_name":"Syrian Arab News Agency","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Arab-News-Agency-Disrupted-by-Cyberattack-382945.shtml"}],"summary":"Activist purporting to be Anonymous have launched attacks against the Syrian Arab News Agency website resulting in outage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9258fbd0a5340a14291abd4431346b8110c7609","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2B3B10A-B081-4168-97F6-48B6F6C76DDA"},"incident_date":"2013-09-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"0be2a6660409","org_name":"NZ New Zealand Earthquake Commission","org_type":"government","ransomware":null,"records_affected":260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.voxy.co.nz/business/earthquake-commission-investigating-privacy-breach/5/167874"}],"summary":"Insurance claims sent to wrong recipients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f566d9197eea7583946b23e1c0f02a87eeee0e6c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC5B6046-D7C2-48C9-83F5-3F8AA2034CE2"},"incident_date":"2013-09-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4265439cb005","org_name":"mu-43.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mu-43.com/showthread.php?t=52412"}],"summary":"\"sister site\" hacked, potentially exposing username/pw for mu-43.com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cee359542374ac84f25df33b30525bd998ac0e6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFBED92D-948F-4784-8A3C-CCFAC7C0382B"},"incident_date":"2013-09-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44ea6e82d4af","org_name":"University of California San Francisco Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Patient%20Notification%20Letter%20Sample_0.pdf"}],"summary":"on September 10, 2013, UCSF learned that an unencrypted laptop was stolen from the locked vehicle of a UCSF Liver Transplant employee on September 9, 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"BZ","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"140a00bdc2d99d0442480e658a541eaf6c46bded","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0736F42D-1973-4484-9690-0B454B42907E"},"incident_date":"2013-09-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"c3e15e6f410a","org_name":"Turkey Ministry of Food, Agriculture and Livestock","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Two-Websites-of-Turkey-s-Ministry-of-Food-Agriculture-and-Livestock-Hacked-381525.shtml"}],"summary":"A couple of websites of Turkeys Ministry of Food, Agriculture and Livestock have been breached and defaced by a hacker group called Black Angels. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a44ed8bfd7e487551b4ad9440c475de47ecaa29a","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Outdoor%20Network%20Notification%20V1%20D_data%20audit%20proof_090613_0.pdf"},"notes":null,"org_country":"US","org_id":"a7463ab7715e","org_name":"Outdoor Network LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42624"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Outdoor%20Network%20Notification%20V1%20D_data%20audit%20proof_090613_0.pdf"}],"summary":"Outdoor Network reported that malware was inserted into the shopping cart portions of its websites and may have collected customers’ personal and credit card information.","supporting_quote":null,"technology_involved":["shopping cart web application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b12f4ebda26f192c214e48afcb0caa2f81d53d4d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A23E99A3-00BB-4E76-8D0A-5FE517C7F766"},"incident_date":"2013-09-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1fc90cc1d7e6","org_name":"Baltimore Gas and Electric Company","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-232170.pdf"}],"summary":"Briefcase stolen from vehicle had paper records of customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a093c4f4cb0cfb238f39e5d4fd500ef0ef0dd50","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFD33FD9-D2A2-4EA7-A4EC-A8BF16BDB5C6"},"incident_date":"2013-09-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99d5577cf06a","org_name":"United States College Hockey Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://townhall.com/tipsheet/christinerousselle/2013/09/09/college-hockey-fan-forum-hacked-by-syria-n1695076?utm_medium=referral&utm_source=t.co"}],"summary":"Sports forum site hacked and defaced, purportedly by the Syrian Electronic Army.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"258b759a527d9287119b9d6ad0904cc42b3e061c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEB9898E-967D-4C3F-A421-B1266C1D145E"},"incident_date":"2013-09-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"859f360ac080","org_name":"State of Washington, Public Disclosure Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansascity.com/2013/09/17/4488848/officials-say-pdc-was-hacked-earlier.html"}],"summary":"FBI saw some of WA PDC usernames and passwords on a reputed hacker's website, PDC also told by WA tech services group they had malware days later, unclear if related, but assuming so.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"NZ","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"918e498d61ce7dfff6a234a7298c47cd1fc79c90","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"775D9F9B-7FD4-44CD-8246-13A693EF6D74"},"incident_date":"2013-09-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"99cd8a18093e","org_name":"Hutt Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/10563747/Hospital-patient-takes-peek-at-info-of-others"}],"summary":"A breach of privacy by a patient in Hutt Hospital's emergency department has been referred to police.  Hutt Valley District Health Board chief executive Graham Dyer has confirmed that on September 8 a patient was able to view information about other patients on an unattended comp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"194929b6ee8716467ee9292b286d7c25fbd6b9b1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"284A0C4E-5696-4CEF-84FB-1D7FB4040650"},"incident_date":"2013-09-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2880bba5ca5","org_name":"Society of Information Risk Analysts","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.societyinforisk.org/content/security-event-society-information-risk-analysts"}],"summary":"A secondary domain hosted by Bluehost was defaced by an opportunistic attack.  We are consolidating the secondary domains in our primary provider and all domains will be pointing to our web site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-09-06","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"644d1c7d29a37ebe5575549fb941e6255263e41d","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20version%20of%20breach%20notification%20in%20PDF%20format%20%2800751822%29_0.PDF"},"notes":null,"org_country":"US","org_id":"3a92472e1a5d","org_name":"Hankyu Chung, M.D.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42619"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20version%20of%20breach%20notification%20in%20PDF%20format%20%2800751822%29_0.PDF"}],"summary":"A laptop containing patient names, dates of birth, and medical records was stolen during a burglary at Hankyu Chung, M.D.'s office.","supporting_quote":"Among the items stolen were two laptops.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e0db0af469da2d23d3645b9b2e0c7f2584bc541","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C79E1D46-CCA7-49E5-AC79-32DC9DF8265D"},"incident_date":"2013-09-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"935342ee4b7e","org_name":"DaVita HealthCare Partners Inc","org_type":"healthcare","ransomware":null,"records_affected":11500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Samples%20Notices_0.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/unencrypted-laptop-stolen-11000-dialysis-patients-impacted/article/319921/"}],"summary":"We regret to inform you that on September 6, 2013 a laptop was stolen from a teammates (employees) vehicle. Although DaVita m aintains a company-wide program and policy requiring encryption of laptop computers , we discovered that the encryption technology on this particular devi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b7ddd833df9680ff21d3037e8f5cd9a299d46fb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B12868F2-F26C-4294-BA8A-6D4FC26CE61F"},"incident_date":"2013-09-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecd25ff99dc1","org_name":"CSX Corp","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/csx-transportation-20131003.pdf"}],"summary":"CSX employee sent email to his personal email and to his spouse's email with an attachment in the form of a spreadsheet with employee PII. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40ce97ddbd03c5d3282906d2f8fed90f3f5ba5ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8E9007E-D18C-4659-ADD0-EE8023619C28"},"incident_date":"2013-09-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f99dd620a792","org_name":"Atlius University","org_type":"education","ransomware":null,"records_affected":198,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/university-employee-fired-for-inadvertently-emailing-student-data/article/313152/#"}],"summary":"An employee at San Francisco-based Atlius University was fired after an email containing personal data on nearly 200 enrollees was inadvertently sent to a student.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"VN","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"529c95b2d2ddb015030a40cfd807214f2a589fc4","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BF5DEE8-F4E4-4D9D-9BAE-D21A49E3AA13"},"incident_date":"2013-09-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VN","org_id":"268c89d87034","org_name":"Ha Dinh Primary School","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.vietnamnet.vn/fms/education/84156/hanoi--200-students-off-school-because-of-hacker.html"}],"summary":"Hacker sends fake communication to school students and parents telling them that school has been cancelled in order to damage the reputation of a rival company selling a similar product to what the hacker's employer sells.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdb17ffed183433ba226511f6d0c9a60788c3ba3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CED869CC-55C0-416B-BFC3-CB9AB9E7880B"},"incident_date":"2013-09-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d4041c1a0cc9","org_name":"Public Storage","org_type":"other","ransomware":null,"records_affected":745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231917.pdf;"}],"summary":"Customer while viewing his lease of a storage unit online, was able to view other customers' leases as well. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4e6a45764d6db85386a2743ddeb2fe65695322e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDDD39A9-C08E-443B-A7CE-A4536B914D43"},"incident_date":"2013-09-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"5263170d285d","org_name":"AUTOMOBILES CITROEN","org_type":"manufacturing","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/citroen-breached-500-logins-leaked/"}],"summary":"Hacker \"Keo\" from the Phenomenal Crew claims to have breached the Citroen website and gained administrator access.  Information that appears to be user names, plain text user passwords and encrypted administrator passwords, has been posted to Pastebin and ZeroBin sites.  No publi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b76f41221de7ead3c8116c31ae8e178e7163133","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45FA6480-A276-4D6B-B26F-8202923C4BAF"},"incident_date":"2013-09-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"874fbefa8558","org_name":"Western Union Co/The","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234670.pdf"}],"summary":"vulnerability on western union's web site enabled fraudulent transactions","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"952ed218f8d9d52a29954d9f41dbbc00d8d00be8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F00F7177-BAFF-45C5-8C45-F97EE635EF3D"},"incident_date":"2013-09-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"90b7a1894eb0","org_name":"United Natural Foods, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/united-natural-foods-warehouse-with-retired-laptops-and-hard-drives-burglarized/"}],"summary":"United Natural Foods warehouse with retired laptops and hard drives burglarized","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50fa7ff5e71c1047804764a7359cb6370030c32e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3CD8E4E-294D-4920-AA1B-F2472A6FB87D"},"incident_date":"2013-09-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86df3f547b88","org_name":"MFS Service Center, Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/MFS%20Service%20Center%20Security%20Breach%20Letter%20to%20Consumer.pdf"}],"summary":"employee mistakenly emailed file of personal info to non-authorized partners.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"844aa3b38e4e452a7d45f99352d492c031dd0272","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"399D2176-4FB2-4F50-9624-BBBC13667CA6"},"incident_date":"2013-09-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7399f84c718","org_name":"Genesis Rehabilitation Service","org_type":"healthcare","ransomware":null,"records_affected":33,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Genesis%20Rehab%20Srvc%20ltrt%20Consumer%20re%20Security%20Breach.pdf"}],"summary":"Lost USB device","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23a8a3865924106b9835997318aecb2c579d5144","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E7643E8-C303-4F09-86AA-EC0AC340FDD9"},"incident_date":"2013-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"493a5a5f690e","org_name":"Daffodil University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/bangladesh-daffodil-uni-hacked"}],"summary":"Two hackers going with the handle of ExpirED BraiN and IceCream from 3xp1r3 Cyber Army have hacked and defaced the official website of Bangladeshs largest Information Technology Daffodil University. The hackers also rooted the university server, as a result 84 of its sub-domains ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"BR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc26e48a5ab3426a312c544050a8c1f52818f959","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C67B1DAC-8103-4D14-AAEB-E9A8A3303ACD"},"incident_date":"2013-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"ca31f740bfae","org_name":"Brazilian Air Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Brazilian-Air-Force-Website-Hacked-and-Defaced-by-Anonymous-380015.shtml"}],"summary":"Hackers of Anonymous Brazil have breached and defaced the official website of the Brazilian Air Force (fab.mil.br).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32d87c91599d0fada30eebf7ee1a37f5a69bdf59","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55E05305-1FF8-439E-B123-B73FA241B8EB"},"incident_date":"2013-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0a35be28588","org_name":"App Developer Magazine","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/App-Developer-Magazine-Website-Hacked-and-Defaced-380200.shtml"}],"summary":"App Developer Magazine hacked The website of App Developer Magazine (appdevelopermagazine.com), the US-based monthly publication dedicated to app developers and app entrepreneurs, has been hacked. The attack has been spotted by experts from IT security firm Bitdefender.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac5fe095f2ddc7ea87b0082d500017b4deec9591","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75ED2FC1-E22E-45EE-99DC-BDB2BAE24883"},"incident_date":"2013-09-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"208ee748f491","org_name":"Abu Dhabi International Montessori Nursery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/abu-dhabi-montessori-website-hacked-by-iranian-hacker.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29"}],"summary":"Abu Dhabi International Montessori Nursery website has been hacked and defaced by Iranian Hacker OmiDeR.Using the tag HackeD By OmiDeR, the hacker wrote My Love Iran. Persian Gulf for ever on the home page.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb9a00a2956634bd535f0785b883b87b738b2a8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6814290-D370-49F1-BAB4-9AF3AC1693CD"},"incident_date":"2013-09-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"16a20a0603db","org_name":"Meghna Petroleum Limited","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Bangladesh-s-Meghna-Petroleum-Limited-Hacked-and-Defaced-379838.shtml"}],"summary":"An Indian hacker that uses the online moniker Yamraaj has hacked the official website of Meghna Petroleum Limited, a subsidiary of the Bangladesh Petroleum Corporation (BPC) thats in charge of storing, distributing and marketing petroleum products in Bangladesh.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6d8622100ff40b75f5c05af47bcaf5ca9246758","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/InterContinental%20Mark%20Hopkins%20-%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"82780c16166a","org_name":"Inter-Continental Hotels Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42596"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/InterContinental%20Mark%20Hopkins%20-%20Notification%20Letter_0.pdf"}],"summary":"Inter-Continental Hotels Corporation reported that a security incident at the InterContinental Mark Hopkins may have exposed payment card and other personal information to unauthorized persons.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"BR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b3b8da71fec7d22950ebb23e3d291ef6f6d0cb0","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EC936CB-CEB8-4A33-8C0E-87B94C453064"},"incident_date":"2013-09-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"801ed9704366","org_name":"Ho Yeow Sun","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Singaporean-Singer-and-Co-Founder-of-City-Harvest-Church-Sun-Ho-Hacked-379815.shtml"}],"summary":"A hacker that goes by the name of The Messiah has targeted the official website of Ho Yeow Sun (Sun Ho), the famous Singaporean pop music singer, and co-founder of the pentecostal megachurch City Harvest Church.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d105ebd51a9e9db02426b7bcefd0b02a2bc17ef9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4E72A70-3A9A-4FDE-8134-7CC9CB2667DC"},"incident_date":"2013-09-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"211d3e8babc2","org_name":"furrag.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://forum.furrag.com/index.php/topic,1352.msg10230.html"}],"summary":"Site is hacked using an unknown vulnerability that seems to be common to several websites. Likely an unlatch vulnerability in the CMS.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4da2beb7c56e0e76a55a1ed3e2bdeb23ba14a4f8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D7731C6-7FDD-4547-B2A7-FD763ED607A7"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"866e43a861d4","org_name":"zimbra.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zimbra.com/forums/announcements/64159-forum-downtime.html"}],"summary":"phpBB site hacked, defaced and account information on the system may have been compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23de6bc5a9fb54155e454b0f4392399a3daf7018","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"726BDC39-2F87-4F58-BC6E-797C5C0087CC"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fca2d6974f4c","org_name":"wirednewyork.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wirednewyork.com/forum/showthread.php?t=37477"}],"summary":"A few days ago, I noticed a new member registered with a red user ID (administrator), and soon after, another one. I contacted Edward, and he had found out about a hack in the VBulletin software that runs WNY. The accounts were deleted, and it appears no harm was done.  However, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af7dbd1d50601ffbcd167e3da63466ca13213b3a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29B9958E-DBCC-4D7D-A5BC-0D058991F219"},"incident_date":"2013-09-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"adf8a719599d","org_name":"Washington Network Group","org_type":"professional_services","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nopaste.me/raw/8134450545229094c806f8.txt"}],"summary":"Actor calling him/herself \"nairb\" used SQLi to steal and dump personal info and pwds of members of the Washington Network Group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ecae1720cf53d883ee952ba7f037f66dd691aea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B84741E3-0406-4DD4-A3B4-C9DDFAD52B2E"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"4bae21dd3b97","org_name":"Vodafone Group PLC","org_type":"technology_saas","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-24063621"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.10tv.com/content/stories/apexchange/2013/09/12/eu-germany-vodafone-data-theft.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/2013-09-12/vodafone-germany-hacker-accesses-2-million-clients-banking-data.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telecompaper.com/news/vodafone-germany-admits-to-another-data-breach--971750"}],"summary":"An intruder hacked into a Vodafone Group Plc (VOD) server in Germany , gaining access to 2 million customers personal details and banking information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IR","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e46329e75d328698af21a87969c041f4ae72849e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B6326827-A9EC-4C0B-AC12-550DD1C2E9B5"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1bafa83e15f","org_name":"US House of Representatives","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/iranian-hackers-claim-breach-of-u.s.-house-of-representatives.html"}],"summary":"  Members of the Iranian Digital Boys Underground Team recently published data that they claim was stolen via a spear phishing attack on the U.S. House of Representatives.  On Pastebin, the group published five database entries for people who the hackers say are House employees a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59170c2eb99071f10f575d29ff58a951391b0afa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CA00F7C-CFF5-445E-B637-067CB85CEB10"},"incident_date":"2013-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"659e7a31ea69","org_name":"URM Stores, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spokesman.com/stories/2013/nov/26/yokes-rosauers-urge-customers-to-not-use-cards/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.yakimaherald.com/news/yhr/saturday/1711260-8/security-breach-leads-rosauers-to-temporarily-restrict-creditdebit;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spokesman.com/stories/2014/jan/31/urm-probe-into-card-data-breach-wrapping-up/"}],"summary":"Grocery wholesaler and payment processor suffers data breach that leads to compromises in 67 of their partner stores.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"392a1f680938abad67b00fc367ddc4c7c9725cff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC2BB2B4-25EF-4E11-84B5-7BF913B84178"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"178c25753ffb","org_name":"Twenty-First Century Fox Inc","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hollywood.com/news/brief/55033072/damian-lewis-blames-hackers-for-homeland-leak"}],"summary":"First episode of Homeland was leaked out to the internet, approximately one month before the 9/29 airdate.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43a57a171cc7442dd7f5eda58d7801958f06bce8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D0D7538-266F-4E02-80D7-59C1428845D3"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"0ebc7cc8c635","org_name":"Turkish Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/RedHack-Leaks-Documents-Exposing-Officers-Who-Allegedly-Killed-Turkish-Protester-382248.shtml"}],"summary":"RedHack Leaks Documents Exposing Officers Who Allegedly Killed Turkish Protester","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a00e2bee0a6c4070eb3dc14e710ef625083fdfef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18179CBF-B099-49A4-BD8D-BFF42648F228"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TN","org_id":"b8e40ec9bb47","org_name":"Tunisian Ministry of Interior","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.alarabiya.net/en/News/middle-east/2013/10/04/Tunisian-ministry-suspends-4-employees-following-leak.html"}],"summary":"Government employee leaked classified documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe8932a3e02d626dcb726caa5a446155fe292d4c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDE8CC2F-FA75-465F-8464-39094B343705"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"526f4153b7fc","org_name":"Seterus","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-232167.pdf"}],"summary":"Contractor misuse incident involving sending himself sensitive information via a public email account. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"548be35764d1322c23b9fa41b7fc62fb4bcb4a00","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3EBC9871-A432-40E7-83CB-7585678BA68E"},"incident_date":"2013-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0db404260f90","org_name":"Scottish Emergency Rider Volunteer Service","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.stv.tv/scotland/238977-scottish-emergency-rider-volunteer-service-begs-for-return-of-stolen-laptop/"}],"summary":"Stolen laptop contains business critical financial information and funding applications, no backups were performed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a91f80ca4a1116da5ab8be114869addb273ac123","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3192A62-3452-4EBD-989F-2CD99A72777C"},"incident_date":"2013-09-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d03d522db16e","org_name":"Santander UK PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-london-24077094"}],"summary":"Social engineering by \"a bogus maintenance engineer\" tried to connect a physical device onto a bank computer.  Sounds like employees were suspicious and alerted authorities. Twelve men arrested in \"plot\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae7b2f420086350622a2ffe6a05c4b113ef6e9d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AC6E49D-73F4-493A-A71A-10A2B6915B69"},"incident_date":"2013-09-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"81c5e3c646d6","org_name":"Radio Telef_s ireann","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/rte-beefs-up-security-after-hackers-hit-staff-emails-29255508.html"}],"summary":"RTE has beefed up its internal email security system after hackers broke into the account of a member of staff and attempted to \"phish\" the accounts of other employees  An RTE spokesman confirmed that the broadcaster had now implemented a more secure \"alpha-numeric\" password syst","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8039192d02c17379000a13519d56c66d79853dff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E11793F2-AA3E-4666-A96D-FE3FBB22BC0A"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"f5517dc11fc2","org_name":"Pemex","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Mexico-s-House-of-Representatives-Attacked-by-Anonymous-Hackers-379826.shtml"}],"summary":"Anonymous hacktivists have temporarily disrupted the official website of Mexicos House of Representatives (diputados.gob.mx).   The attack was announced around 14 hours ago by the hackers. Currently, the website of the House of Representatives appears to be working properly.  In ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"NZ","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b800fcc6942ea058bc26020d84e74e2bd241f83","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04490A97-BE49-4880-A1BE-63069237ABD6"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"a194098c73d8","org_name":"NZ Government of New Zealand","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Publishes-Encrypted-Files-Containing-NZ-Government-Data-Video-384772.shtml"}],"summary":"Anonymous publishes five encrypted files that purportedly contain classified information. Activist group is threatening to publish the encryption keys.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PS","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59251829bad5d68bb8cc64530ee758aec41768ed","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68D73719-7364-4090-BB03-4BCE378F6DD2"},"incident_date":"2013-09-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"154a38bb441b","org_name":"NetCologne","org_type":"technology_saas","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/palestine-elite-force-hackers-hit-german-isp-netcologne.html"}],"summary":"  Hacker Cold z3ro of the Palestine Elite Force hacker group recently claimed to have breached the Cologne, Germany-based telecom provider NetCologne, and published user information on Pastebin.  Above the data dump, the hacker wrote, \"Hacked by C0ld z3ro & LulzSecRoot from Pales","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8efafd997f79f7a794e75a5ff375e55a99fe100b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3D27C6F-6678-4550-A2B6-9DB6CA4C4EA7"},"incident_date":"2013-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e49af119b171","org_name":"National Healthcare Corp - Oak Ridge","org_type":"healthcare","ransomware":null,"records_affected":4268,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oakridger.com/article/20130918/NEWS/130919949/1001/NEWS"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/09/19/nhc-healthcare-oak-ridge-loses-unencrypted-backup-tape/"}],"summary":"Officials at NHC Oak Ridge, 300 Laboratory Road, have reported a possible breach of patient information due to a missing backup tape that wasnt encrypted. The information on this tape included patient names, Social Security numbers, birth dates, home addresses and medical informa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b7d47826663ef8c0240a9c6f8bf3f7f3c8b065c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E88E995-3D24-4944-AFDC-431F1BA9A52F"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"3f7ff828f57a","org_name":"MX Mexican House of Representatives","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Mexico-s-House-of-Representatives-Attacked-by-Anonymous-Hackers-379826.shtml"}],"summary":"Anonymous hacktivists have temporarily disrupted the official website of Mexicos House of Representatives (diputados.gob.mx).   In addition, the hacktivists claim to have breached the systems of Pemex, the Mexican state-owned petroleum company.  The attackers have leaked email ad","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eee1775e87e4b69afcf94f588d7a4e3ac78ce1a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B1E4EFC-6790-4F40-8546-C4EC696BF177"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b854b0aad338","org_name":"Mobile Gas Station Temple City","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/kabc/story?section=news/local/los_angeles&id=9257937"}],"summary":"Customers are being warned about credit and debit card skimmers at a gas station in Temple City. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7084c05e1353f13fadc90184eb369c5287c4abf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2076FFE1-BAA2-4484-B54B-44D3BE0F34C7"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3acbed88b2c7","org_name":"Lima Radiological Associates","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.limaohio.com/news/news/153530342/Local-radiologist-charged-with-HIPPA-violation"}],"summary":"The State Medical Board of Ohio has charged a local radiologist for violating the federal Heath Insurance Portability and Accountability Act otherwise referred to as HIPPA.   According to a consent agreement between the medical board and Dr. Aimee Hawley, during testimony she adm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15a62db239aa487e2e1d9c1996be12b92c116bc1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F04D20B9-0557-4745-8788-CA8839D35DF4"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"706a4af96800","org_name":"Kiwibank","org_type":"financial","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11138757"}],"summary":"Post office accidentally provided customer banking information to member of the public.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"090af03dfb3c34871b231bde2729b67b65108210","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A735D018-8809-4BEB-B20E-47F0AA7C7714"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"30877a46ad5f","org_name":"Innovation Punjab","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/innovation-punjab-website-hacked-by-pakistan-haxor-crew.html"}],"summary":"Today, Innovation Punjab Blog gets hacked and defaced by Hasnain Haxor from the hacker group Pakistan Haxor Crew.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaf7c08255b0ed702ec455c216375842cbdb4b62","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CB8115D-7F96-414A-988F-FF14A0C22F4E"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"431d6a251ae5","org_name":"iMesh","org_type":"technology_saas","ransomware":null,"records_affected":51000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/51-million-imesh-file-sharing-accounts-for-sale-dark-web/"}],"summary":"Hacker puts 51 million file sharing accounts for sale on dark web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d505029aed5b8ff2a1a245b52b3a863dc3c41da7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADE833CC-2E5F-44B9-9FBE-961BA1E5A19C"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"94bbda1849b6","org_name":"Hootsuite Media, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Hacks-Large-Number-of-FOX-Twitter-Accounts-via-HootSuite-381970.shtml"}],"summary":"Hootsuite account is compromised via unknown methods.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3671886ebbe0dcf05385a09d452f6760282c252","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b1e15d40-a15c-11e8-a73d-8bf9996ed0ad"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16b2037b6909","org_name":"DuPont","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thegazette.com/subject/news/public-safety/iowa-man-charged-with-stealing-trade-secrets-from-dupont-20180628;"},{"fetched_at":null,"title":null,"type":"press","url":"https://wcfcourier.com/news/local/crime-and-courts/st-ansgar-man-charged-with-theft-of-trade-secrets/article_13a0f0bf-093e-51b5-9545-cf1c40b8fba5.html"}],"summary":"A man from Northern Iowa is accused of stealing trade secrets from DuPont","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9618ab39c30647efdc8ddf10faefeaa8e402432f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A26AC2B-55E7-41F7-99F7-06F6CB870301"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7462f1da9545","org_name":"Denny's Corp","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azfamily.com/news/Job-applications-with-personal-information-found-in-dumpster-224333401.html"}],"summary":"Job applications containing PII discovered in restaurant dumpster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbd788dcf2fb7a09a43090f7d320689b4c30e6a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73BC5EF5-559F-40BF-ABB7-E3D573043CFF"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c192502784f9","org_name":"D.R. Horton, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kxan.com/news/local/austin/piles-of-private-documents-found-dumped-in-public-bins"}],"summary":"Homebuilder IT administrator disposed of customer documents in school recycling dumpster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"726b9bc6194ab6b863b0ccbcca32ba3bbef683a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6B52EFC-20A7-4203-905F-8336135B349E"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63203b716ca7","org_name":"Chesterfield County School District","org_type":"education","ransomware":null,"records_affected":130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wric.com/story/23341992/8news-investigates-students"}],"summary":"Parents of children at Hopkins Road and Salem Church Road Elementary Schools say their kids came home with sensitive data belonging to other students and they now want to know who has access to their kid's private data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d98bf1406ae58c79e5204d28ee57ca70fe09d7b5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7C1F49D-6144-468E-911B-2CD2FD94E1E8"},"incident_date":"2013-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"9e35be699d8d","org_name":"BtC International Trading (Shanghai) Co., Ltd.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/10/worlds-3rd-largest-chinese-bitcoin.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/10/17/bitcoin_exchange_ddos_flood/"}],"summary":"Chinese Bitcoin trader hit with a ferocious denial-of-service attack last month when the volume of inbound traffic to the site peaked at 100Gbps.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8123feecad510e9fd081b9e667f6b7dd3560f4d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"511C2AD1-FFE8-4BEC-9DFC-23D0B1FBBA75"},"incident_date":"2013-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"8ad1ab6660f0","org_name":"BD International Crimes Tribunal-1","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedailystar.net/beta2/news/part-of-verdict-leaked/"}],"summary":"Janitor is blackmailed into gathering documents from a court.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56cd84926c8e98f31ea8fd30875aa5bde76444a9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4227DEE1-4174-42FB-9469-577376AA1254"},"incident_date":"2013-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4bdf226618f","org_name":"Back Country Hospital","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcax.com/story/23671159/dispute-over-hospital-laptop-puts-patient-privacy-at-risk"}],"summary":"Ex-employee who worked in a small hospital IT department has a laptop which contains more than 3,000 patient documents.  (Very Bizarre write up)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4be04e36ed727eaa4254664b8b4d1c2407c062b0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBAB13A7-0C26-4794-ADE3-A25F84FEE40D"},"incident_date":"2013-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2f5375e676b8","org_name":"Amcal Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canberratimes.com.au/act-news/pharmacy-sorry-after-records-found-at-recycling-centre-20130911-2tky6.html"}],"summary":"Pharmacy accidentally dumped hundreds of private medical records, including cancelled and out-of-date prescriptions, at a recycling depot. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cdfd2c3022cad943586c8f8293517e0a23b745a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FDFCBC8-D017-41DE-A7D6-3F7975E550B9"},"incident_date":"2013-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c20436165d90","org_name":"Alberta Health System","org_type":"healthcare","ransomware":null,"records_affected":620000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/laptop-stolen-with-health-information-of-620-000-albertans-1.2507161"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/settlement-reached-in-lawsuit-after-laptop-stolen-from-edmonton-medicentre/"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22797e5887018467d288ab80cadde6125888f40f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85CF4254-7AB9-47CD-AE21-CA317AE8DE6D"},"incident_date":"2013-08-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e233c4c07386","org_name":"Marthas Vineyard Savings Bank","org_type":"financial","ransomware":null,"records_affected":90,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boston.cbslocal.com/2013/09/05/100k-stolen-from-marthas-vineyard-bank-customers-through-atm-scam/"}],"summary":"Skimming devices at two Marthas Vineyard Savings Bank automatic teller machines were allegedly used to steal thousands of dollars. Police say $100,000 was stolen from 90 customers using fake ATM cards on Broadway in New York, Chicago and Indianapolis, over the Labor Day weekend. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4569a1bd8c7bee22f053b625d8f31a7e9f6aea1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DED5DA9B-CAE8-4685-A8DA-D868E75F2F34"},"incident_date":"2013-08-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62523f00fe48","org_name":"Hudson Valley Community College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/HVCC%20ltrt%20Consumer%20re%20Security%20Breach.pdf"}],"summary":"Laptop stolen from home of administrator of associate degree program established for Verizon associates that are union. Modeling from the college point of view as the administrator is a school employee, not Verizon.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4ae14b2aac09ba2109032e0c2ee2d9d39dfd0fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63DF75F3-C4A4-494A-A65B-29BA8ED136D0"},"incident_date":"2013-08-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"942e7811d674","org_name":"Rotech Healthcare Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/rotech-healthcare-20131024.pdf"}],"summary":"Employee took data on removable media as they left the job, org thinks it was \"inadvertent\" but employee returned the media wiped clean and org is offering credit monitoring.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5ef16afe1e04df328b8be03be14b8baf04cf24c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"542C0D70-9E7B-4FF4-8EE2-128800B5FE49"},"incident_date":"2013-08-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fd67d429ece9","org_name":"HSBC Holdings plc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/finance/personalfinance/10280250/HSBC-customers-hit-by-IT-glitch.html"}],"summary":"HSBC suffers outage due to internal issue. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d80509691d31d4afc9827438195891fa6d141fc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9169382D-5278-474D-A478-CE584542FE03"},"incident_date":"2013-08-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"d14e6a4c21b9","org_name":"Tahir News","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tahrirnews.com/news/view.aspx?cdate=30082013&id=ad3ff413-30f7-473e-936c-07d61f1954d3"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/09/social-media-accounts-sms-service-of.html"}],"summary":"Activists hack a newspaper and publish false articles.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3aebac11b5265dfe1f8870066516bf5547c6a0d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C871F6C7-79D0-407F-9725-12D2966044FE"},"incident_date":"2013-08-28","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b2e9ad4871e","org_name":"Virginia Polytechnic Institute and State University","org_type":"education","ransomware":null,"records_affected":145000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsadvance.com/news/local/article_fa8a3304-25d9-11e3-9201-0019bb30f31a.html"}],"summary":"Human error allowed unauthorized access to database that stored job applicants' PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04567ab807f500b547595258eddad2edb2e8b7ba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00EB741C-0DFD-453E-9AC2-B00E512897DA"},"incident_date":"2013-08-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2a20176f57fd","org_name":"St. Mary's Janesville Hospital","org_type":"healthcare","ransomware":null,"records_affected":631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wrex.com/story/23579400/2013/10/01/laptop-stolen-from-st-marys-janesville-hospital"}],"summary":"A Janesville Hospital warns patients after one of its laptops is stolen from an employee's car over the summer.  It happened August 27th.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f417add8f25e55668e17beb5518a492c9bcf104","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A363A54B-FB03-4CDD-AC92-D5BF6D5593D1"},"incident_date":"2013-08-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"5b0111a5f0c3","org_name":"International SOS","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businesstravelnews.com/Worldwide-Travel/Travel-Security-Firm-International-SOS-Victimized-By-Cyber-Attack/?a=trans"}],"summary":"an unauthorized access in the U.S. to one of International SOS (a traveler tracking provider) systems, which hosts traveler information related to one of the information technology products they sell.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c25ab9acd30263f001c6b56f8b920f6d0f240515","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40CA2C03-41FC-493C-8E34-86DD8E4B0926"},"incident_date":"2013-08-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b19f5f83e47","org_name":"DigitalOcean","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Cloud-Hosting-Company-DigitalOcean-Hit-by-DDOS-Attack-378713.shtml"}],"summary":"DigitalOcean, the simple and fast cloud hosting service provider, announced it had been hit by a distributed denial-of-service (DDOS) attack that disrupted the companys website and control panel.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c421ce0a2b5ba312ed489af1718272778ae6220","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27CDDCC5-13B5-4D14-9EB1-6447DCA80226"},"incident_date":"2013-08-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dad0d5b4b600","org_name":"Auntie Anne's Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234642%20(1).pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234642%20(2).pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234642%20(3).pdf;"}],"summary":"Laptop stolen from locked vehicle contained employee PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"887dd5c8a0194ae1bad3169a0565f7f0b1b43c4c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"107ACAE3-1E1A-4C48-9BE0-11BC237563DC"},"incident_date":"2013-08-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6bbb04c23d5","org_name":"Sarah Benjamin, DPM - Littleton Podiatry","org_type":"healthcare","ransomware":null,"records_affected":3512,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Sarah Benjamin, DPM - Littleton Podiatry reports the theft of a laptop containing 3,512 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-08-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8301cbb362dfd9a401219feb7e325f1ad5ddc6c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"c3bafbdc955f","org_name":"Midwest Supplies, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42564"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_0.pdf"}],"summary":"Midwest Supplies reported that an outside party breached its website, potentially exposing customers’ contact and credit card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71e529903954f388412a7c0f3b30137954a2747a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59CA466B-70E9-4F28-A6D8-4102BBE87197"},"incident_date":"2013-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/setback-sutter-after-1b-ehr-system%20crashes"}],"summary":"Electronic health record system suffered outage. Some records were not available for approximately 1 day.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b47066dbe6bb1b35f15c32816392bf02dfde0ec","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1196B00-9ACB-4389-BC03-3413D6E40062"},"incident_date":"2013-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"819bd82325ca","org_name":"China Internet Network Information Center","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=15461#"}],"summary":"The China Internet Network Information Center (CNNIC), which maintains the registry for the .cn, China's country code top-level domain, has notified the public that two massive DDoS attacks have been aimed against the national Domain Name Service early on Sunday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dbf6e022e2d35b24679ddf9e97eb52e123f8fbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1060534A-9D75-4BF1-B1CF-79AD4271FCCB"},"incident_date":"2013-08-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f5156e25ba66","org_name":"British Columbia Institute of Technology","org_type":"education","ransomware":null,"records_affected":134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.linknewspaper.ca/privacy-breach-exposes-student-info/"}],"summary":"employee sent out basic personal information about 134 students to 22 other (non-authorized) students via email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e1f9b9c6baac20d611c268a7566fbb943108ed8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA270E32-B596-4E6C-8978-FE481388D876"},"incident_date":"2013-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"9a35945451e2","org_name":"AXA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/opgabon-anonymous-hacks-axa-insurance-group/"}],"summary":"The online hackavists from Anonymous group are taking #OpGabon to a new level as they have hacked and defaced the official website of a French global investment, retirement, and insurance group AXA (axa-gabon.com) against its support for Gabonese President Ali Bongo.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44c0d30e221bdd73ce880771a1487bbc624aecf0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F214347D-8CA9-49AF-88C6-4CCCBF358DC9"},"incident_date":"2013-08-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0b0accefa2b","org_name":"NBC Sports","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/nbc-sports-group-20131014.pdf"}],"summary":"Laptops stolen from a locked vehicle contained SSN, Driver License Number and DOB.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec2dba5db589ac81f3a373daa557e3568807ab7b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B99B9E8B-1DEB-4564-9A08-5CEE7DAAA022"},"incident_date":"2013-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"a6609695fc17","org_name":"Federally Administered Tribal Areas of Pakistan Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/08/fata-gov-pk-hacked-by-phc.html"}],"summary":"Today, a Pakistani hacker with the handle Hasnain Haxor from Pakistan Haxors Crew hacked and defaced the website of Federally Administered Tribal Areas (FATA) of Pakistan Government. The hacker also defaced all of its sub domains.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cd43051551eee17951abf614a08a1f6524a3034","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20B07E27-B806-42B9-9685-A6298FFDA78B"},"incident_date":"2013-08-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"fd496597a4c6","org_name":"Aberdeen Hospital in New Glasgow, N.S","org_type":"healthcare","ransomware":null,"records_affected":39,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://atlantic.ctvnews.ca/disciplinary-action-taken-over-privacy-breach-at-new-glasgow-hospital-1.1553949"}],"summary":"Disciplinary action is being taken after an unauthorized job shadow at the Aberdeen Hospital in New Glasgow, N.S. resulted in a significant privacy breach for dozens of patients. A health-care professional at the hospital brought an outside health-care professional to the workpla","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a41947f0160e9bd6af3318bd9e899641d3d3a5d9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42399D64-D8F3-4B5C-AE5E-1CC531298735"},"incident_date":"2013-08-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f8e54f7d1380","org_name":"Aberdeen Hospital","org_type":"healthcare","ransomware":null,"records_affected":39,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thechronicleherald.ca/novascotia/1169271-health-record-privacy-breach-probed;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/nova-scotia/patient-privacy-breach-at-aberdeen-hospital-revealed-1.2433435"}],"summary":"Unauthorized access to patient data on screens occurred when a medical professional visited the health authority under the guise of \"job shadowing\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4eb8bd0c8103f294bfad004666db19b2d8a15564","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3BF3356F-BD0C-48D2-AE78-3A6FC8D72D3E"},"incident_date":"2013-08-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"d94398b5fc86","org_name":"National Maternity Hospital, Holles Street","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishhealth.com/article.html?id=22525"}],"summary":"Details of a personal medical procedure leaked to the media","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40bed647985e501fb5b3f6d862372357a931a19d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"436FB605-5944-43AC-A581-6BFB91676FDD"},"incident_date":"2013-08-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8895fcf1e28","org_name":"California Board of Barbering and Cosmetology","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/BBC_Sample_Letter_0.pdf?"}],"summary":"on August 23, 2013 the boards Fairfield office was burglarized in a desktop computer was stolen. The burglary was reported to local law enforcement authorities. Through an investigation it was determined that the computer may have contained a document with personal information of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3e90d033967f667f1b99a0b7c29914d8bcfe874","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Celerant-C2013068451%20CA%20Customer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42547"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42562"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42745"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Celerant-C2013068451%20CA%20Customer%20Letter_0.pdf"}],"summary":"American Express reported that a payment processor experienced unauthorized access to its processing system and that some Cardmember account information may have been accessed.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e4105473fd767dec7ef4cb65d64e49dce24aeba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ADF930A-E35D-400E-B4FC-96A85EF2AED9"},"incident_date":"2013-08-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3445f4ac31c7","org_name":"Access Counseling, LLC","org_type":"healthcare","ransomware":null,"records_affected":566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Access Counseling reports stolen laptop containing 566 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e38b6be987b5721a08f313c79cdaeac5a63f087a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"200716E9-F531-4538-B5CE-D1A304BF9BD0"},"incident_date":"2013-08-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af1151552ddc","org_name":"University of Mississippi Medical Center","org_type":"education","ransomware":null,"records_affected":2281,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hattiesburgamerican.com/article/20130822/NEWS01/130822021/UMC-accidentally-leaks-students-personal-information"}],"summary":"The University of Mississippi Medical Center mistakenly gave out social security numbers, grade point averages and other personal information for most of its student body this week, violating state and federal privacy laws.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c3d9ab56da1e7afea2da7ff5ad130da5bb16fcf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4092E913-316A-4806-B9B7-A80316342B4E"},"incident_date":"2013-08-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"40970ff8e13a","org_name":"Texas Health Presbyterian Dallas Hospital","org_type":"healthcare","ransomware":null,"records_affected":949,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Texas Health Presbyterian Dallas Hospital reports desktop computer containing 949 patient records was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9db18e483a566af6e59443b757d165301dc7aec4","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%2082113_0.pdf"},"notes":null,"org_country":"US","org_id":"704e55d2fb71","org_name":"Shore Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42546"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%2082113_0.pdf"}],"summary":"Shore Mortgage reported that a vendor’s servers containing Shore information were accessed during a computer intrusion.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8856db7eeea86431fee74f8ef4a11bc1d2ee719e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE2DAAED-C60C-48DD-80C3-4BFC0C07FA04"},"incident_date":"2013-08-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"f946b1e9a6b8","org_name":"Pizza Hut","org_type":"other","ransomware":null,"records_affected":7062,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/22/fast-food-giant-pizza-hut-spain-and-malta-hacked-data-leaked-site-redirected/"}],"summary":"activist Turkish Ajan hacker group pulled data from pizza hut in spain, personal information and credentials, released publicly, no details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03100cb7fc9d438b4524c3284dd9b949aa9f8348","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16618345-9E76-4D8E-9674-BF1E07C3C56F"},"incident_date":"2013-08-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"951c4f5419e7","org_name":"NASDAQ OMX Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.wsj.com/moneybeat/2013/08/22/nasdaq-halts-all-nasdaq-listed-securities-due-to-trading-issue/?mod=WSJ_LatestHeadlines;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/08/30/nasdaq_software_trading_outage/"}],"summary":"Nasdaq suffers outage due to software glitch. Received 26-times normal load from another exchange firm. Error in code worsened situation by not triggering built-in redundancy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2013-08-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90c1a7d075d60216e54340b42a832ffa12d13d52","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55EB654A-15C6-454D-800F-0D0081E8F565"},"incident_date":"2013-08-21","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"259e02cc35d0","org_name":"ShareThis, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Hijacks-GoDaddy-Account-Email-Addresses-of-ShareThis-com-377622.shtml"}],"summary":"The latest victim of the Syrian Electronic Army is ShareThis.com, the popular sharing platform. ShareThis is only the latest in a long line of Internet companies targeted by the hacktivists. The hackers gained access to the GoDaddy account of ShareThis.com and altered the nameser","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c70e44c9fbffdb2847a063349a72c0f29d436d63","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"560825F4-4321-44F9-9473-8E9E33C09E58"},"incident_date":"2013-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24e5e12aa845","org_name":"Goldman Sachs Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://money.cnn.com/2013/08/21/investing/goldman-sachs-trading-glitch/index.html"}],"summary":"Technical error in system casues Goldman Sachs to issue incorrect equity options orders","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39abfd2e2cc32033e0c371ab1c18b92ba83e114d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41515784-6985-4F96-951A-89FFF232E225"},"incident_date":"2013-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bb255912099d","org_name":"English Defence League","org_type":"nonprofit","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/08/22/edl_website_hack_zhc/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gizmodo.co.uk/2013/08/the-english-defence-league-gets-ko-by-anonymous/"}],"summary":"ideologic group \"ZCompany Hacking Crew (ZHC)\" defaced (page produced error message) the website of \"English Defence League\", ended up publishing 40 mobile phone numbers (presumably of EDL people). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"983acb96a3c900119b36aaaec7ca349e40a34849","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADEFBEAC-A258-4270-A2D3-310C5EE5F0B1"},"incident_date":"2013-08-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d72a7d7b21c6","org_name":"California Department of Public Health","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notification%20Letter%20Madera%20County%20WIC_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42780"}],"summary":"A contracted Madera County WIC employee mistakenly gave WIC paper records about a patient to another participant. Upon discovering the mistake, the participant immediately notified the Madera County WIC office and returned the records. The information was limited to  name and med","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"620c268445bf66047216d3c36e3702ffe8c1f572","impact_type":"unknown","incident_date":"2013-07-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CEN%20Breach%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42518"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21dc284e6f58c5f4faa35851c93c5ededfb614ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"661CF4C9-B10F-4C3E-BEDE-5FD1768865E8"},"incident_date":"2013-08-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12e4984b41a6","org_name":"Hope Community Resources","org_type":"healthcare","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.alaskadispatch.com/article/20130820/email-accident-violates-privacy-thousands-hope-community-clients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/hope-community-resources-acknowledges-data-breach.html"}],"summary":"Hope Community Resources (HCR) of Alaska inadvertantly attached personal information of its 3,700 clients to an email that was sent to state workers and others who assist the disabled.  The information disclosed included names, birthdays, guardians, addresses and other identifyin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"179fe6cda1e10d35c46334bbb490af4b2e16985b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C108305E-4753-4279-A5AA-BB5F11C0F9B8"},"incident_date":"2013-08-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfc672bc7e5b","org_name":"Amazon.com, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/amazon-com-sites-experiences-outage-aws-ec2-unaffected-7000019586/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-23839901"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com/article/738737/Packet_Loss_Problem_in_Amazon_39_s_Cloud_Wobbles_Airbnb_Vine"}],"summary":"The retail giant's website suffered an outage mid-afternoon on the U.S. east coast for an unspecified, unknown reason. The company's cloud infrastructure was mostly unaffected, however.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2a2ef4d298055db22def3ee68cbdaf640da0346","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2310321-714D-402D-8F61-6E7419CE8E5F"},"incident_date":"2013-08-18","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dfc27115f496","org_name":"Mole Valley District Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.com/david-miranda-partner-glenn-greenwald-detained-anonymous-fires-back-hacking-uk-website-oplastresort"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hacks-UK-Government-Site-in-Response-to-Detention-of-David-Miranda-376466.shtml"}],"summary":"Anonymous hacks and defaces a UK government website in protest of David Miranda being detained","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fb827cd1a1740789e105d98c670277a0b2ce3a0","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04762B87-8100-4D71-9270-ED44B84170EB"},"incident_date":"2013-08-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"4b3bb5eff836","org_name":"Kenya National Registration Bureau","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Kenya-s-National-Registration-Bureau-Hacked-by-Indonesian-Hacker-Team-376525.shtml"}],"summary":"Kenya’s National Registration Bureau Hacked by Indonesian Hacker Team","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f17fb515b4768982a0c4700feb6889840f4b6dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2C1FF97-AC11-493C-BB37-BC8CDC981A63"},"incident_date":"2013-08-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4fdb99ee2bc9","org_name":"Sault Area Hospital","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sootoday.com/content/news/details.asp?c=63269"}],"summary":"Applicants received unsolicited emails, texts and telemarketing calls, that are the result of a mishap involving the Sault Area Hospital (SAH) website's online job application system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PS","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ece774bb43460bee80bcffa7c269fac7f111009","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90778723-9EEB-42D3-A3C1-1E45360B926C"},"incident_date":"2013-08-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e9f335c7c68","org_name":"Google Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/hackers-target-deface-google-palestine-site-7000019859/"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/news-stories/digital-privacy/Privacy-Breach-Still-Unexplained-For-Google-Talk-Hangouts"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/information-technology/2013/09/google-talk-creates-awkward-moments-with-misdirected-messages/"},{"fetched_at":null,"title":null,"type":"press","url":"http://legalinsurrection.com/2013/08/why-is-google-silent-on-its-outage/"},{"fetched_at":null,"title":null,"type":"press","url":"http://venturebeat.com/2013/08/16/3-minute-outage-costs-google-545000-in-revenue/"}],"summary":"DNS hijack leads users of google.ps to site that appears to be a defaced Google page. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"091246e24a3dbac36d3bc312511616ac51c9a00d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DADA826-2FC2-464A-90FF-044196D51B5F"},"incident_date":"2013-08-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"eaa97e5672ae","org_name":"DigiD Dutch Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Dutch-Government-Identity-Management-Platform-DigiD-Disrupted-by-DDOS-Attack-376189.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nrc.nl/nieuws/2013/08/16/digid-deels-plat-door-ddos-aanval/"}],"summary":"Dutch Government Identity Management Platform DigiD Disrupted by DDOS Attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"127a71230d04af5970f64004c8a91bbbeedb39ab","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7960115E-AA39-4E89-817F-AD749CAB0718"},"incident_date":"2013-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"f50555a23420","org_name":"Mahanagar Telephone Nigam Limited","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.timesofindia.indiatimes.com/2013-08-17/india/41420475_1_mtnl-mahanagar-telephone-nigam-ltd-hackers"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Indian-Telecoms-Firm-MTNL-Defaced-by-Pakistani-Hacker-376251.shtml"}],"summary":"Hacker MrCreepy gains access to Mahanagar Telephone Nigam Limited (MTNL), an Indian state-owned telecommunications company and defaces it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3bea27e98d0308837c17eb0baf77de37ef5363d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C92AFAFF-F3B5-4B25-B625-AC6083F481D3"},"incident_date":"2013-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/ddos-attacks-strike-three-banks-a-6006"}],"summary":"JPMorgan Chase (JPM) and Citigroup (C) both said they suffered system issues on Thursday as a group of cyber criminals was said to launch a new round of attacks against U.S. banks. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f01d96f4985ad20647a9025e16c8b31c0bbd8bd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDE7E11D-2016-4340-A6E1-C7F75B41D0A8"},"incident_date":"2013-08-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ce3767e5de8","org_name":"Gordon Auto Body Parts","org_type":"retail_ecommerce","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxphilly.com/story/23408756/fox-29-investigates-sensitive-employee-information-dumped-on-street"}],"summary":"Two trash bags dumped in persons back yard filled with paper documents in folders containing PII for over 400 employee's of a local company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf70006826a3b2e77e4630c22c84cd03b3fe9dd0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0FC507B-1AA3-4F3E-81F6-229D5D50C902"},"incident_date":"2013-08-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19771fea32c3","org_name":"Citigroup Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/ddos-attacks-strike-three-banks-a-6006"}],"summary":"JPMorgan Chase (JPM) and Citigroup (C) both said they suffered system issues on Thursday as a group of cyber criminals was said to launch a new round of attacks against U.S. banks. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-08-14","discovered_date":null,"entry_asset":"vpn_or_edge_device","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22cdc7cc2bd8ae4fb0cfa7586071e057a78a6ff3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11BB0DBF-F2BB-46AC-9C06-237F51D05874"},"incident_date":"2013-08-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb4900ab0772","org_name":"Outbrain Inc.","org_type":"nonprofit","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.outbrain.com/blog/2013/08/additional-details-on-outbrain-phishing-attack.html"}],"summary":"On August, 14th, Outbrain’s widget configuration tools were compromised by a phishing attack performed by the Syrian Electronic Army.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd992f756bed3adc74264b6a2b91ebc3fc5ba13b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCA43278-6D87-4ABF-A918-3FA416F7551C"},"incident_date":"2013-08-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/microsoft-outlook-com-problems-still-not-fully-resolved-7000019509/"}],"summary":"Outlook.com had a 2+ day outage which has resulted in some users not being able to get access their e-mail for the better part of this past week. This incident was a result of a failure in a caching service that interfaces with devices using Exchange ActiveSync, including most sm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d48d8259c466560ea1e1616be7cc9eec7396813","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCA6DD82-4861-4490-BF10-511DF3CAAC97"},"incident_date":"2013-08-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"9db74160d721","org_name":"Egyption Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Several-Egyptian-Government-Sites-Disrupted-by-Hackers-as-Violence-Continues-375441.shtml"}],"summary":"Several Egyptian Government Sites Disrupted by Hackers as Violence Continues","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f48759ab4edb6cd98592884bd2e8090a11b9bb6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F45152E-A12F-42C2-82D1-290AE906895F"},"incident_date":"2013-08-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b071a91cc0a","org_name":"Legal Aid Society of San Mateo County","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/breach_notification_100813_1.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42946"}],"summary":"Burglary results in stolen laptops with customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96bb58b79ab0c03665baa7cedb0860cf6edca6b9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7BA487A-437F-4ED1-B47C-D3B01881AEC8"},"incident_date":"2013-08-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"5754d14cc975","org_name":"Embassy Of Israel In India","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/08/israel-embassy-in-india-hacked-by.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Embassy-of-India-in-Israel-Hacked-by-AnonGhost-374760.shtml"}],"summary":"AnonGhost hacks and defaces Israeli Embassy in India website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4b4bca4d09abefab2656ba49f5b26d604a96f98","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30039C13-1611-4212-9AFD-C787E7D3929E"},"incident_date":"2013-08-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af87eccd15d4","org_name":"Rothman Institute","org_type":"healthcare","ransomware":null,"records_affected":2350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressofatlanticcity.com/news/breaking/internal-data-breach-results-in-free-credit-monitoring-offered-to/article_eff8513e-3018-11e3-bad4-001a4bcf887a.html"}],"summary":"A medical office employee removed patient information from office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"204962039642004575a79c099c511ec1316b234d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"255EEE3E-27C7-4CD7-A439-88ABC7DF488E"},"incident_date":"2013-08-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60779bd4749b","org_name":"Republic Services Inc","org_type":"other","ransomware":null,"records_affected":82106,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Republic%20Services%20Security%20Breach%20ltrt%20consumer.pdf;http://doj.nh.gov/consumer/security-breaches/documents/republic-services-20130826.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/republic-services-20130826.pdf"}],"summary":"stolen laptop, 82160 records on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df5b756dacace348e7856801cf1af9c886858665","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"258027CB-0B44-4574-B1FF-0D985A5A6E96"},"incident_date":"2013-08-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"927474b5ddf5","org_name":"Td Bank Usa, NA","org_type":"financial","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/220613991_Secret_Service_investigating_alleged_debit_card_skimming_in_Montvale_and_other_towns.html"}],"summary":"ATM skimming incident leads to capture of payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90b095761835fb566bb6a451e0134483708b7362","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19BA97EC-A4F1-4453-9067-F04B7532A57E"},"incident_date":"2013-08-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf761f2003e8","org_name":"Hospice of the Chesapeake","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalgazette.com/news/for_the_record/hospice-of-the-chesapeake-investigates-potential-patient-information-leak/article_f51b998e-8b19-551b-ac5c-e3ca9978fdb9.html"}],"summary":"Employee mailed sensitive information home. That information may have been viewed by a third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2298fd61c5dc7721ce81fec2f4ff09dd44a9161c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C360C78-68FA-483D-B354-1A74E994F692"},"incident_date":"2013-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7db8e72c081","org_name":"US Department of Agriculture","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2013/08/18/us/computer-system-failed-at-meatpacking-plants-but-shipping-continued.html?_r=1&adxnnl=1&pagewanted=all&adxnnlx=1378738897-RUR+BYoG/AiEu+295Kgqxw"}],"summary":"A troubled new computer system used by inspectors at the nations 6,500 meatpacking and processing plants shut down for two days this month, putting at risk millions of pounds of beef, poultry, pork and lamb that had left the plants before workers could collect samples to check fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6612878d36dfdce322b11028c690b2813719423","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D7CFAB8-D5F1-4FA2-B2B1-588682489120"},"incident_date":"2013-08-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d256e51a6f77","org_name":"UNIVERSITY HOSPITALS OF CLEVELAND","org_type":"healthcare","ransomware":null,"records_affected":7100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/cleveland-hospitals-unencrypted-hard-drive-stolen-thousands-affected/article/319537/"}],"summary":"Cleveland hospital's unencrypted hard drive stolen, thousands affected","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01e8e3d3ef132ca526d513cd2175a15d959c23c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A6CEA6E-2096-477A-B4F9-EE32F03C4607"},"incident_date":"2013-08-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc6322bb68c2","org_name":"Temple City Gas Station","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbclosangeles.com/news/local/Temple-City-Gas-Station-Credit-Card-Scam-224896672.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sgvtribune.com/general-news/20130920/credit-card-skimming-devices-found-at-temple-city-gas-station"}],"summary":"Gas pump skimming device found, installed on the inside of the pump. \"there at least a week\" said authorities (aug 8th found)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f436d5ca77eefde65c47485da1bce4b1c6ecaa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26072BA7-9333-4E36-8E7C-B61619BA31F9"},"incident_date":"2013-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"0c292455eeee","org_name":"Rajiv Gandhi University of health sciences","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackersblog.com/sensei-hacked-rajiv-gandhi-university-of-health-sciences/#axzz2fkMn2yM4;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/rajiv-gandhi-university-health-sciences-hacked-database-leaked-pakistani-leets.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29"}],"summary":"Web defacement.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"360afbd98a57cf5bda4c3c9bc62f89ea012a6cc5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"090B8365-ABFC-4357-8972-C8B5F7F4CB36"},"incident_date":"2013-08-08","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"571135d27c58","org_name":"CaroMont Health","org_type":"healthcare","ransomware":null,"records_affected":1310,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/10/07/caromont-health-alerts-1310-patients-of-data-breach"}],"summary":"CaroMont Health announced Friday that it learned of an internal health data breach that involved an employee sending an unsecure email with 1,310 patients protected health information (PHI) on August 8 during a routine security audit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54f1416ee5d6e63e216ee30158e9f29cc8dcc645","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F095199-EA09-4919-8EFA-AC68A9C8EF7F"},"incident_date":"2013-08-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff2d400a600d","org_name":"Carol L. Patrick, Ph.D.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/09/27/ohio-psychologist-alerts-patients-of-data-breach/"}],"summary":"A Lima, Ohio clinical psychologist is in the process of notifying clients that their office was robbed on August 8 and, as a result of the theft, their identities may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bf745988e27295f6a59ae1a702ac42b7b32ff53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA650B9E-D168-4249-A95B-118DCD1A6FE0"},"incident_date":"2013-08-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63b50662604a","org_name":"Valley National Bancorp","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/220613991_Secret_Service_investigating_alleged_debit_card_skimming_in_Montvale_and_other_towns.html"}],"summary":"ATM skimming leads to loss of payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-07","discovered_date":"2013-07-12","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49a782b54528dccb4d6e07ff37253390b3d4b028","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/602490607_1_%28BHDOCS%29_0.PDF"},"notes":null,"org_country":"US","org_id":"d10f4467902f","org_name":"Smartphone Experts","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42417"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/602490607_1_%28BHDOCS%29_0.PDF"}],"summary":"Smartphone Experts reported that a hacker accessed the computer system it used to process payments for website purchases.","supporting_quote":null,"technology_involved":["payment processing system"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"464aac609cbb37fc9e51b00384ee2cf99f876a2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF2A877C-A878-444E-8287-766A3B55153F"},"incident_date":"2013-08-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd4a036f519e","org_name":"Schuylkill Health System","org_type":"healthcare","ransomware":null,"records_affected":2810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Schuylkill Health System reports theft of a laptop containing 2,810 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cfafc94daa860b00de5e536b27887343ca39346","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0175FDC-433D-47DA-BE7F-D6FEF7094E72"},"incident_date":"2013-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"523e1df09d4b","org_name":"Clark & Anderson, P.A.","org_type":"government","ransomware":null,"records_affected":2906,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231323.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/1210"}],"summary":"Stolen hard drive from personal vehicle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76b9a5cded7ffed2e1e565085767c751a549452f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36241C66-BE55-4CAA-8787-E8053E644F99"},"incident_date":"2013-08-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b2da328be5ad","org_name":"Comprehensive Podiatry LLC","org_type":"healthcare","ransomware":null,"records_affected":1360,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Comprehensive Podiatry LLC reports theft of laptop.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2bfcac4126d122858869cfb966d3c6d3c9a256a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFE1752D-7095-4F6F-935D-EDA52466648B"},"incident_date":"2013-08-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"543daba243ad","org_name":"Vitreo-Retinal Medical Group, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42390"}],"summary":"Theft of laptop exposes 1837 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b94e4d22e5f5ac0c3ab4299784079ecb85db5b3","impact_type":"both","incident_date":null,"initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"5ae4c6125fb4","org_name":"US Airways","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42383"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_FINAL_0.pdf"}],"summary":"Unauthorized users accessed US Airways Dividend Miles accounts using usernames and passwords, potentially accessing personal and financial information and improperly taking mileage from some accounts.","supporting_quote":"We recently discovered that a small number of Dividend Miles accounts were accessed by unauthorized users who had obtained usernames and passwords for the compromised accounts through means as yet unknown to us.","technology_involved":["Dividend Miles"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d876e2eee4743d4a9f12dd113fc3550a6b669eba","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40F49503-39E0-435E-92C3-86871EBC7637"},"incident_date":"2013-08-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0093c53534f3","org_name":"Californi Department of Motor Vehicles","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/03/sources-credit-card-breach-at-california-dmv/"}],"summary":"The California Department of Motor Vehicles appears to have suffered a wide-ranging credit card data breach involving online payments for DMV-related services, according to banks in California and elsewhere that received alerts this week about compromised cards that all had been ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"347a14f2757a571d8fdc86b1aaad156740816c96","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86868FE3-423B-4432-B5B3-D93C9372677B"},"incident_date":"2013-08-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"4b988d230bec","org_name":"Bank of Tokyo - Mitsubishi UFJ, Ltd.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Bank%20of%20Tokyo%20Security%20Breach%20Letter%20to%20consumer.pdf"}],"summary":"Partner accidentally emailed spreadsheet containing personal info of the bank's clients. No abuse of the exposed data is suspected, however the data was reviewed by the recipient (another client of the partner).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a435e411e7416ca4bd4b4bbff254dc08ab91b0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C154EE94-C77F-4B13-9B8D-FBEC71D4EAC1"},"incident_date":"2013-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo! Inc","org_type":"technology_saas","ransomware":null,"records_affected":1000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/"}],"summary":"Second Yahoo mega-breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d18fab5e066a122ae84101568b2e8dab82835cde","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53E07328-6A11-418A-9077-8EA3787FFF42"},"incident_date":"2013-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f611e559f4bc","org_name":"Washington Inventory Company","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kshb.com/dpp/news/local_news/hundreds-at-risk-of-identity-theft-after-personal-records-dumped-in-public-recycling-bin"}],"summary":"company in kansas disposed of box of customer/employee records in a dumpster, while the dumpster was a private dumpster on their own facility. External parties had easy access to the dumpster and it was in fact found by an external party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ec4be6814f3462ab1e6088c9f27fdb86cc3297e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8685970E-B7B8-49EE-B3E8-8448941345AD"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"977e317bf266","org_name":"Union of Municipalities of Turkey","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Union-of-Municipalities-of-Turkey-Hacked-by-RedHack-Website-Taken-Offline-377833.shtml"}],"summary":"RedHack (activist group) hacked the official website of the Union of Municipalities of Turkey (tbb.gov.tr) and leaked the usernames and the passwords of the sites members.  The passwords are hashed before being stored in the websites database, but RedHack has cracked and publishe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5d138c089fb8115c3058e61e3bf3a4933fa5216","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54A417C9-C7CA-4114-BB7D-BED0D5331F0F"},"incident_date":"2013-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0395411bdf97","org_name":"Sylvan Learning Center","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koin.com/2013/08/05/boxes-with-personal-info-found-in-trash/"}],"summary":"Seven large boxes filled with personal information of clients from the Sylvan Learning Center, including names, birth dates, Social Security numbers and credit card information, were found in a Dumpster in Beaverton. The employees said they placed the files in the Dumpster to dis","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"faaa9bf732c5fe84a2034802cd9cf8415c785cc7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60EC6B21-02E7-4FF9-AC82-B320DECAF131"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca3d0c952e26","org_name":"Substance Abuse and Mental Health Services Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.weeklystandard.com/blogs/hhs-run-website-hacked-now-selling-nfl-jerseys-ugg-boots-armani-fragrances_759213.html"}],"summary":"HHS agency website compromised and served up pages selling various items.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1211ac1087baa9d8a3a3cc42e46009f1e814532e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE59D8AA-8EB1-4165-8C63-2F02B3E76AED"},"incident_date":"2013-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55e3e23d1519","org_name":"Spectrum Health","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.slate.com/articles/technology/future_tense/2014/01/doctors_on_social_media_share_embarrassing_photos_details_of_patients.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wzzm13.com/story/local/2013/08/29/1609120/"}],"summary":"Several employees at Spectrum Health have been terminated over a picture posted on Facebook.  A source tells WZZM 13 News that an off-duty employee was in the emergency room when he saw an attractive female. He took a picture of her back side and posted it on Facebook. His messag","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df973acaf98ade81f2eaf0ab0ec8f27d89356afb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D858868-FEFF-4AB7-94E2-DCD9C5EFAFD4"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"8f4df2fe2dc2","org_name":"Southern Primary Health Organisation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/9104793/Patient-details-on-stolen-laptops"}],"summary":"Patients' privacy may have been breached after the Southern Primary Health Organisation clinic in Invercargill was broken into.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72480b5c298b36ef5f9b98e5cf2a99fb0cfd39d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1A92F45-D1FD-428F-972E-31F992E0045E"},"incident_date":"2013-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d2c2fb8b121","org_name":"Punuru J.M. Reddy, MD Inc.","org_type":"healthcare","ransomware":null,"records_affected":1179,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/al-patient-data-exposed-on-the-internet-due-to-subcontractors-error/"}],"summary":"Partner copies and stores patient information on public-facing website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c46aceebbc28f13544c650c544a2889cc754bbc5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35F0979F-4678-4AA2-BD49-B931E4D1BE6D"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"fd16232255f1","org_name":"Pirate Party Germany","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Pirate-Party-of-Germany-Targeted-with-DDOS-Attack-378080.shtml"}],"summary":"DDOS against Germany's Pirate Party, a political party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1e2d2fd6e53bd3bf4c19397b32668765ab9fe7d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D1369B1-7B06-458A-A044-6175F1CA162F"},"incident_date":"2013-08-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"675525f2a2ba","org_name":"PEUGEOT CITROEN AUTOMOBILE SA","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/technology/2014/mar/17/citroen-adobe-coldfusion-hacked-backdoor"}],"summary":"Citroen had one of its German websites hacked to include a backdoor, which is a method of bypassing normal authentication systems, and which may have allowed the attackers to make off with whatever data was sitting on sites server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d995a9d4cafdf2384edd564aab6b835564145136","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CBAF006-47BE-4F37-B14A-3D7B1642A7EA"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9b15cec3fde","org_name":"Parkwood Hospital","org_type":"healthcare","ransomware":null,"records_affected":2216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://london.ctvnews.ca/laptop-theft-puts-parkwood-hospital-patient-data-at-risk-1.1501833"}],"summary":"Share:   Text:                              (0)  The personal information of more than 2,000 patients at Parkwood Hospital could be in the wrong hands after a laptop was stolen.  St. Josephs says the laptop containing the sensitive information was stolen from the back of the vehi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bf6c0331c7eaf1c7a71785615be36f8876a76c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61B5EB1D-E684-4456-9E7C-43FD6C6BDD05"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aafa29a603d6","org_name":"North Texas Comprehensive Spine and Pain Center","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kten.com/story/23141653/disk-drive-with-patient-records-disappears-in-sherman,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/19/north-texas-spine-specialist-reports-patient-data-breach/"}],"summary":"The North Texas Comprehensive Spine and Pain Center told 3,000 patients last week of a recent data breach in which it lost a computer drive containing patient medical records back in June.  According to kten.com, the compromised data included names, Social Security number, birthd","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afdb9cc97ccda655bca4e54958382cda32cbf2c9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"467CDE63-B36C-4CD3-8166-2A74D2B54038"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5b55a1598984","org_name":"Neath Care","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2014/03/home-care-agency-warned-after-vulnerable-people-s-details-left-in-the-street/"}],"summary":"A Welsh home care provider has been found in breach of the Data Protection Act after the files of 10 vulnerable and elderly people were found on a street in Neath Port Talbot. The news follows an investigation by the Information Commissioners Office (ICO) into the data loss by Ne","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13c8ddff67ce4dc7f1a88ba2e807793559456a26","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8C80BED-793C-4E33-A0F8-462F8B1B3882"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8469aa29c37","org_name":"Mount Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/"}],"summary":"Loss of portable device exposes 610 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3e0fba5974bda36158a7d2581828560da96ce0f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF6D0180-DF65-4534-8C5D-9A1BC935A367"},"incident_date":"2013-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"8e4a4666f388","org_name":"Metrobank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunstar.com.ph/pampanga/local-news/2013/08/05/atm-skimming-device-found-metrobank-296275"}],"summary":"A device which police calls as a skimming device, used to copy passwords and other information of ATM card holders, was found on Sunday at a Metrobank branch at the Devera Hotel along Don Juico Avenue in Barangay Malabanias, Angeles City.  Michael Sta. Maria, a security guard, fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f3c25a6ace27b23842d072f6415d78c241c4d3c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDED8721-3BA2-42A5-94AD-64101F797F6C"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ee46a051c5e5","org_name":"Mass Event","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/1600-websites-hacked-by-turkhackteam/"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/pakistani-hackers-hit-indian-cyber-space-by-hacking-20-thousand-website.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29;"},{"fetched_at":null,"title":null,"type":"press","url":"http://tny.cz/d35b9cc6"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/628-websites-hacked-by-indonesian-hackers/"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/tht-defaces-750-websites-for-opnowar/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+Delicious%2Fvzriskteam%2Fagenda+%28Delicious%2Fvzriskteam%2Fagenda+%28test%29%29"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Two-Pakistani-Hacker-Groups-Deface-Same-Pakistan-Government-Websites-384649.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/anonghost-hacks-75-israeli-websites/"}],"summary":"Turkish hackers from Turk Hack Team have hacked and defaced more then 1600 websites against alleged killings of Uyghur Muslims in China. All sites were left with deface pages along with different deface messages, protesting against the Chinese government for conducting massacre a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bf08e74045698346fd4cef6c17dedfd0b6b08a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FFAFFAD-6545-4B89-9ECC-FA86557A46BF"},"incident_date":"2013-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32983921e3a4","org_name":"Loyola University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysuburbanlife.com/2013/09/16/loyola-medical-center-employee-charged-with-identity-theft/alf4swh/"},{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.cbslocal.com/2013/09/11/police-loyola-nurse-stole-patients-id-charged-thousands-in-clothing/"}],"summary":"a 50-year-old resident of Riverside reported that after she was treated at the medical center in Maywood, her identity was stolen. The resident told police she tried to by allergy medication in July and found out she was on a no-buy list.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9b29a8b8685c6a1e004513dfeee4719431287a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAFF127F-1AFF-4623-A6EE-1EE364654A9A"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f05f336340f6","org_name":"Hospice Care Foundation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpax.com/news/non-profit-warns-of-possible-security-breach-after-missoula-break-in/"}],"summary":"Stolen laptop from physical break-in at Missoula Hospice Care Foundation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eb017e768b61143a60381edc1a0ee3ae7ccf0d5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A9B0D29-6655-4DBD-A2DB-B0DF577F382D"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79439bc55650","org_name":"Hope Family Health Services","org_type":"healthcare","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/viewart/20131008/GALLATIN01/310080095/Stolen-Westmoreland-clinic-laptop-contained-personal-data-thousands-patients;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/10/09/hope-family-health-reports-8000-patient-data-breach/"}],"summary":"Laptop stolen from employee's home contained approximately 8,000 PII records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f40f552e0dc18055cb06d714003891d2aa2f9148","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E42B2F1-0CED-4050-B512-F99E5819226C"},"incident_date":"2013-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a22170857670","org_name":"Heartland Regional Health Authority","org_type":"healthcare","ransomware":null,"records_affected":833,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.westcentralonline.com/index.php?option=com_content&task=view&id=12064&Itemid=33"}],"summary":"Employee views 883 patients' medical records without justification.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e3ce342abfbc0a6f7b23d1cd32da92b95940f0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2391D7D-F567-4088-A999-E9AEBB19E310"},"incident_date":"2013-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"562a0821257a","org_name":"Heartland Health Region","org_type":"healthcare","ransomware":null,"records_affected":883,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://leaderonline.ca/patient-records-accessed-in-second-major-privacy-breach-for-heartland/"}],"summary":"he confidential records of around 900 patients were inappropriately accessed by a former employee of Heartland Health Region, administrators revealed last week.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11e3fcc51b9b3577f5311892c7caac678e6f4d64","impact_type":"unknown","incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Health%20Net%20notification%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4ef8516d0cd7","org_name":"Health Net, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42369"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a92d6184eea881e676cc271465847fa555ded11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FA49C60-8FD6-4A0A-850B-8AE6F28840C9"},"incident_date":"2013-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"581af63f62c4","org_name":"Golden Town Buffet Hibachi & Sushi","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wnyt.com/article/stories/S3120146.shtml?cat=300;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesunion.com/local/article/Police-investigating-identity-theft-from-4707649.php"}],"summary":"Restaurant had employees arrested for credit theft, one had a skimming device when arrested.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6147b133db810e0c85a09c4a8a409ca5988a9bb2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"370160F6-3DC7-4F39-B5AA-998A185D3E57"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GA","org_id":"784ec06ce7aa","org_name":"gabonactu.com","org_type":"technology_saas","ransomware":null,"records_affected":171,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/OpGabon-Anonymous-Hackers-Leak-Data-from-Gabonese-News-Website-376930.shtml"}],"summary":"some anon group (OpGabon) hacked a media site, grabing 171 personal information about users and 1 sys admin credential","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ca88dd140a07383002593fe03fa49ab166c3273","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A7AB444-991E-4F47-8A9F-0AFDA2FD33AA"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"6cf9a04af1fd","org_name":"Eramet Comilog Manganese","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/World-s-Second-Largest-Producer-of-High-Grade-Manganese-Ore-Targeted-by-Hackers-376535.shtml"}],"summary":"World’s Second Largest Producer of High-Grade Manganese Ore Targeted by Hackers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"355e359d0002f838ae433bf2cb3c8dd5d1bcb963","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDB26086-FF98-48E7-94E3-D1931C66B951"},"incident_date":"2013-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f33d7f509ed7","org_name":"Eastern Illinois University","org_type":"education","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://castle.eiu.edu/media/viewstory.php?action=183"}],"summary":"EIU Notifies Applicants of Possible Security Breach Involving Personal Data discovered malware with backdoor, unknown if data was exfiltrated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e72bf64ad0efd8f9b9abd3eaae2f008246ccefdb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF28B82F-1AE1-430B-A4CC-DB77711275C4"},"incident_date":"2013-08-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8cab6d7fe64a","org_name":"Daily Mail","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/08/06/daily_mail_data_breach/"}],"summary":"Middle England will be shocked to discover that the Daily Mail's website, the world's most read online newspaper, has only gone and admitted to a shameful data security cock-up.  The publication - which is known for displaying loads of pictures of tits and ass online normally alo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5884b6360db504d1c0c9ecc5b5d99151999ddb70","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA01C325-5B5F-4E18-A6F0-3FF65C631C34"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"b4f20a585eaa","org_name":"Cook Islands Ministry of Transport","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7f09d510eed8aa4b409239563b196f9630747b7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D288EC71-8ECA-4362-A59E-7FB08AE5AB55"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"ffbafc3977e6","org_name":"Cook Islands Ministry of Internal Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4292b1393390387b01170cfbf97f5852c09408b0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EA6047E-EAD1-4B07-9833-537415BF0E54"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"1bb3e79e7a8b","org_name":"Cook Islands Ministry of Foreign Affairs","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb1263a4310e8d437fe7ec02ea2058e0b47702f4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C74500E-D2BB-46D7-A3FD-B17E0E496DDA"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"a8231d4457ce","org_name":"Cook Islands Ministry of Cultural Development","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2af6ce094239ee7e0eac64822ae597894245c0ea","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B23ACB59-5773-4F6A-89F8-F48D78BE51E4"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"496f6108fb8a","org_name":"Cook Islands Ministry of Agriculture","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0895833596a3f4b2b9f301b8852f37e27d4180ff","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77A12489-5D68-42FF-8473-908F5A37EC39"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"30605e9ae3f0","org_name":"Cook Islands Investment Corporation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"344f0c4cc6a1a1e4acfedb82f3c575c89a1dc1b1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7EF051F-4F7A-444A-A595-0899B4B0B550"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CK","org_id":"d039fc76cf62","org_name":"Cook Islands Business Trade Investment Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/08/25/8-cook-islands-government-sites-breached-and-left-defaced/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"Hackers using the handles HeRoTurk and Ajanlar.org today have posted to pastebin a small list of 8 websites that have been breached and left with a new file named, x.htm. The websites that have been defaced are all government websites and appear to be on shared hosting in the coo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17c816bce1136d852eb6d7143325eabb2917ce4c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"898115D7-58A2-4752-B1B1-523652B17AB1"},"incident_date":"2013-08-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b334bc97db21","org_name":"Colorado Department of Transportation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.9news.com/news/local/article/351615/222/Hacked-CDOT-sign-sends-message-about-security-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telluridenews.com/articles/2013/08/22/news/doc52154157b3afe254343018.txt"}],"summary":"Someone accessed the control panel of a roadside traffic sign changing the message to \"Snowden is a hero\".  Control panel was unlocked, and password was inside the control panel.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4773b79ebbba659501dfa2f7881d5deaf28a7b0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8261D708-D1CA-4E23-A810-84209DA73562"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"4acb97ce4ed7","org_name":"chuggerpumps.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.homebrewtalk.com/f14/chuggerpump-com-security-breach-432561/"}],"summary":"online website compromised, personal information and encrypted CC's  at chuggerpump.com  (beer making supplies I think)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0dd68f3d319e34f876ec0c942ed080b8451662a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50DCBA06-B693-47DD-A586-C72457BE1AB2"},"incident_date":"2013-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad3593eeb44c","org_name":"California State University","org_type":"education","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.sacbee.com/crime/archives/2013/10/csus-employees-warned-of-potential-identity-theft-after-computer-system-hac.html"}],"summary":"Unknown hack, customers notified.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd4368191a3dcf615455077d89bf599bb9218910","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B970282-2EC7-40BB-8689-2723519C5F28"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3b06ab873a4","org_name":"Brookdale Main Street","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/story/news/local/sumner/hendersonville/2016/02/01/woman-indicted-theft-elderly-resident/79642060/"}],"summary":"Physical misuse of patient payment card by assisted living facility staff member","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb9d8975c61cad2bcc66b5163685bb600571800c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"858B9C8F-6844-4ABC-AB06-8FE1738E81C8"},"incident_date":"2013-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/home-care-client-gets-another-patient-s-personal-information-1.1385804"}],"summary":"Home care client gets another patient's personal information  Alberta Health Services is investigating a privacy breach after an Edmonton home care patient received another persons health information in his file.  John Grierson regularly gets a health report delivered to his hous","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4db9947a0054c15107f123b3263206f43f82dd83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A93DF8A2-853C-4EA7-BFB3-9D3CF5BE5E54"},"incident_date":"2013-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"486c4f5c64eb","org_name":"Accident Compensation Corporation","org_type":"financial","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/politics/9196448/ACC-privacy-breach-probed"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/crime/9037847/ACC-staffer-faces-inquiry-after-clients-records-stolen;"},{"fetched_at":null,"title":null,"type":"press","url":"http://tvnz.co.nz/national-news/acc-boss-absolutely-committed-client-privacy-5535737;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.radionz.co.nz/news/national/216965/acc-admits-another-privacy-breach"}],"summary":"ACC has completed an investigation following the burglary of a staff member's home that resulted in a privacy breach. The home of a Christchurch ACC case manager was broken into on August 3 and among the things taken was a notebook containing the details of ACC clients. The noteb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"518ffba9664d982377605fa7f4668f90fec1114a","impact_type":"unknown","incident_date":"2013-07-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/7--6-13%20Breach%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0ced6548719","org_name":"South Central Los Angeles Regional Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42366"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-07-31","discovered_date":"2013-07-10","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12cae5375c060fb59a7de7f0cb9c1881147cf2da","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-10","initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/8012%20Oracle%20Notice%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"4d65847107aa","org_name":"Oracle Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42364"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/8012%20Oracle%20Notice%20Final_0.pdf"}],"summary":"Information about Oracle employees was inadvertently included in a report viewed by an employee at another Fidelity client firm.","supporting_quote":null,"technology_involved":["password-protected application"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Fidelity Investments"},"updated_at":"2026-10-10","veris_action":"error","derived":{"vendors":[{"id":"c19f7f24bb4b","name":"Fidelity Investments"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f213c1f9b865818cfd0b51a89eb8335893255a5b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"237527EB-3C11-4303-BB49-D8D93C24093D"},"incident_date":"2013-07-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4264af971908","org_name":"University of North Carolina at Chapel Hill","org_type":"education","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://its.unc.edu/2013/12/10/data-breach-faq/#1"},{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wtvd/story?section=news/local&id=9360276"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/12/unc-data-breach.html"}],"summary":"On November 11, 2013, an information technology manager in the Division of Finance and Administration at The University of North Carolina at Chapel Hill discovered that some Division of Facilities Services files inadvertently became accessible on the Internet. These files contain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be526790747892ce7798a6982277e7d3b23c9c9d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D7360C4-1BF4-4C40-BAB5-E5CA6F605EF6"},"incident_date":"2013-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4043fcc12c9e","org_name":"Exelixis","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Multistate_Breach_Notification_Letter_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42478"}],"summary":"Theft of company equipment led to potential loss of customer data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-07-30","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"179ffa069265508fda619821f4b369447ad20980","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-06-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Incident%2013-0613%20Breach%20Notice%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42360"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Incident%2013-0613%20Breach%20Notice%20Final_0.pdf"}],"summary":"California Correctional Health Care Services reported that dental records were missing from a staff member’s possession while off the premises of a correctional institution.","supporting_quote":"On June 19, 2013, dental records were reported missing from a California Correctional Health Care Services (CCHCS) staff member’s possession while off the premises of a correctional institution.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31675b43bb674abcc653e70ce52d970700f59473","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9DDAE29-88E1-4D93-BE06-218412F28646"},"incident_date":"2013-07-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54806094d1a4","org_name":"St. Anthony's Nursing Home","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/laptop-and-flash-drive-stolen-from-doctors-car/article/310247/#"}],"summary":"laptop and flash drive containing patient information was stolen from Dr's car. Laptop was password protected but not encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18f79304246ea1fb9b1b83850e6221a2462c9fbe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9B38721-017F-421A-A3AE-434D371DF89E"},"incident_date":"2013-07-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"600635629a96","org_name":"Region Ten Community Services Board","org_type":"government","ransomware":null,"records_affected":10228,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Region Ten Community Services Board reports hacking incident exposes 10,228 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e891a93ae532bc6969f12d4e68fda02a0bad6b6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CABA6364-5D25-4A7C-8569-520EFB85E49A"},"incident_date":"2013-07-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6dc8dd729391","org_name":"The New Teacher Project","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/the-new-teacher-project-notifies-employees-after-laptop-stolen-from-office/"}],"summary":"A laptop with unencrypted names, dates of birth, Social Security numbers, and employee ID numbers of current and former employees was stolen from the Brooklyn, New York office of The New Teacher Project the weekend of July 27-28.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44baae060671a16dbdd736b6967428b25f6477ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E9E464A-FD84-4D74-BAD9-2456C8D646F7"},"incident_date":"2013-07-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d292387f51d","org_name":"Sears, Roebuck and Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.cbslocal.com/2013/08/01/man-finds-sensitive-employee-data-in-file-cabinet-he-bought-from-sears/"}],"summary":"Sears improperly disposes of employee records. Sold at liquidation sale.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa7396186cd285bfb04f03f41cf062d3c93f9cc4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B88408C8-8E82-4B8E-9D00-3C82BC379B45"},"incident_date":"2013-07-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec18e066721e","org_name":"Paymast'r Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/unauthorized-third-party-compromises-payroll-card-company-data/article/311431/"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/930L81%20Paymast%27r%20Services%20Ad%20MetaBank_0.pdf"}],"summary":"A Florida based payroll card company (Paymast'r Services) reported that an unauthorized party gained access to a website managed by them given the hacker access to SS#'s, DL#'s and paycard numbers among other confidential data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f812f51cfb2660f0393e9db9f55b05fcb0517996","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E0569B6-C0E0-4FC8-82BD-E59B782277A5"},"incident_date":"2013-07-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5cb47e6dd1f8","org_name":"Centinela State Prison, State of CA - Dept of Corrections and Rehabilitation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/CEN%20Breach%20Letter_0.pdf?"}],"summary":"A file containing personal info of employee placed in server directory accessible to all employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e9d6947a3663df28b64cc9502507af6d490eb2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F0BE4D0-E7D2-46B7-86BD-2C2C8889EBD0"},"incident_date":"2013-07-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf99bce35c9a","org_name":"Argotec","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Argotec%20Services%20Inc%20Security%20Breach%20ltrt%20consumer.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/argotec-20130812.pdf"}],"summary":"Argotech notified employees they had a breach and they suspected data was compromised but had no evidence of it.  Unknown attacker, Unknown actions.  Update: they apparently lost a \"safe\" containing back up tapes with employee data on it, missing since incident date.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2013-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91fc6876c1bca8b52c7dea95de73745c676ed8f0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DAB2EBF-F831-4AE4-992F-D64D8C54ADB7"},"incident_date":"2013-07-25","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17173d1f29b9","org_name":"Saint Louis University","org_type":"education","ransomware":null,"records_affected":3020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kmov.com/news/local/Health-information-of-3000-people-may-have-been-released-in-SLU-security-breach-226785021.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/health-information-of-3000-people-may-have-been-released-in-slu-security-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Health-Information-of-3-000-People-Exposed-After-SLU-Employees-Fall-for-Phishing-389849.shtml"}],"summary":"The Saint Louis University (SLU) is notifying 3,000 people that their protected health information might have been compromised after some of the institutions employees fell victim to a sophisticated phishing scam.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-07-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e1e04872362146e6aa2918c546d9e910d783758","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21E1B7E1-A38A-4284-9A05-CAE129C2402C"},"incident_date":"2013-07-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8aa5ab394f19","org_name":"Department of Energy","org_type":"government","ransomware":null,"records_affected":104179,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/attacks/department-of-energy-confirms-data-breac/240147877,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infoworld.com/t/hacking/data-breach-exposes-energy-departments-continuing-story-of-negligence-212246,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/attacks/energy-department-updates-breach-count-s/240160706,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/attacks/doe-breach-count-now-exceeds-100000/240162952;http://energy.gov/sites/prod/files/2013/12/f5/IG-0900.pdf"}],"summary":"The U.S. Department of Energy has admitted that unidentified malicious hackers successfully breached 14 of its servers and 20 of its workstations two weeks ago, making off with personal information belonging to several hundred employees. The department's assurances that \"no class","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa0db25fda24e0a14f1915462038d2f4313de2f3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13EF2063-9638-4E31-82B6-1937A431BD30"},"incident_date":"2013-07-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7826277b5996","org_name":"Ferris State University","org_type":"education","ransomware":null,"records_affected":62000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ferris.edu/notice/Aug-15-2013/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/2013/08/16/3566471/ferris-state-u-reports-data-security.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/several-thousand-students-and-staffers-affected-in-ferris-state-breach/article/307759/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mlive.com/news/grand-rapids/index.ssf/2013/10/ferris_state_spent_380000_inve.html"}],"summary":"an unauthorized person evaded our network security and gained access to a computer we use to operate our website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa15fc2e3cfa5769727e8d68eb1f0a7114f4a69d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3AAE5222-BB76-4DC7-B959-D3964AA9FA3D"},"incident_date":"2013-07-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9bd0ec250c2","org_name":"Alabama Title Loans, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://local15tv.com/news/features/reality-check/stories/what-happens-your-personal-information-you-give-business-23.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://local15tv.com/shared/news/features/top-stories/stories/wpmi_dumpster-diving-investigation-continues-1210.shtml"}],"summary":"News reporter found numerous instances of PII and financial information in title company's unsecured trash located outside of the facility.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fb25a1777ac40fdcc466c5b5b1895bd7c256fff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6EB3091-AADE-4387-B6D7-182649C6224F"},"incident_date":"2013-07-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9c4ae4e6947","org_name":"Summit Community Care Clinic","org_type":"healthcare","ransomware":null,"records_affected":921,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/some-breaches-are-not-as-bad-as-hhss-breach-tool-might-suggest/"}],"summary":"On July 22, 2013, a staff member of Summit Community Care Clinic sent an e-mail to patients inviting them to a Patient Advisory Committee. In addressing the e-mail, the staff person mistakenly placed recipients e-mail addresses in the To section of the e-mail as opposed to the Bc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bd71a1911147aa1e12408c8d7959f4e706fe668","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9AB3FEB-29F3-4526-8249-FA551B028486"},"incident_date":"2013-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a89ed73f729b","org_name":"R T Jones Capital Equities Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-232161.pdf"}],"summary":"Unknown hacker attacks company website and exfiltrates customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"074dfd9d009d28bd7071ea041338c362524d5399","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7E1CCE9E-E502-4D79-BCC5-300D89D0EF83"},"incident_date":"2013-07-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ce0d46d9e99","org_name":"Olson & White Orthodontics","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hispanicbusiness.com/2013/8/30/patients_at_florissant_orthodontist_told_of.htm"}],"summary":"A Florissant orthodontist's office has informed 10,000 people that their personal information could be compromised because of a break-in and burglary at its offices in July.  The patients' personal information included names, addresses, X-rays, photos and diagnostic findings. The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dbe9bbcee129001ed92422e283b6a3d35d43f8f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6993575E-08F7-493A-9220-240004A394B5"},"incident_date":"2013-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"821ed54509b9","org_name":"City of Victoria","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nanaimodailynews.com/news/banking-information-for-city-of-nanaimo-customers-safe-from-big-security-breach-1.572774"}],"summary":"Cold Fusion vulnerability used to compromise pre-payment site and acquire payment card information from citizens.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-07-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caec530de5e89c117ab52068355c56cb46a5d583","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41CBE7EA-47AD-4FBD-9CC8-5B75FF89E2AB"},"incident_date":"2013-07-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"acf11f6d1e14","org_name":"Black Tree Gaming Limited","org_type":"other","ransomware":null,"records_affected":5915013,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/nexus-mods-data-breach-confirmed-6-million-accounts-compromised-499084.shtml;http://www.nexusmods.com/games/news/12670/?;http://www.nexusmods.com/games/news/12675/?;"}],"summary":"Nexus Mods Data Breach Confirmed, 6 Million Accounts Compromised Early December 2015 Nexus Mods data breach report confirmed Jan 18, 2016 22:13 GMT    By Catalin Cimpanu  A database of six million Nexus Mods user accounts has been added to the Have I Been Pwned? online service, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d87e20fed64a6487e709db886b51625ee7d5cb2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64FD2691-3210-4E17-B848-40ACAC25858D"},"incident_date":"2013-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6cedda2c12a","org_name":"NASDAQ.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canberratimes.com.au/it-pro/security-it/nasdaq-forum-website-hacked-passwords-compromised-20130718-hv11d.html"}],"summary":"Hackers were able to steal passwords from a NASDAQ Community forum. It is likely that only passwordsand non-financial inforimation was stolen. NASDAQ alerted users to the issue and took the website offline to upgrade its security.   There is concern that the hackers will use the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f6585359855e54e2d33f4efc41e767531277c95","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE451C3D-B9F5-44D9-91D4-06964E77851B"},"incident_date":"2013-07-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50c2a6d6c5ff","org_name":"The Brookdale Hospital and Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of a portable electronic device exposes 2700 records. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce785f2a96eb7a9626a887803d46762425813e58","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DCECA876-CB5A-44C7-9181-F457C218718E"},"incident_date":"2013-07-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af41518828b1","org_name":"Caledonia Home Health and Hospice","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/caledonia-home-health-care-admits-security-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/NCHC%20Breach%20Notification%20Letter.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/breach-notification-hipaa-privacy-security-46481-1.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/13/caledonia-home-health-and-hospice-reports-data-breach/,"}],"summary":"The organization has sent notifications to patients that a nurse’s Netbook computer was stolen from her home on July 20 and has not been recovered. The computer included a home health program called Palmwyse that contained protected information including Social Security numbers, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a2131606d232f600779a3837dc668ed82cddb5c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E9EAE80-C555-4005-A5BB-7D54F6205EC2"},"incident_date":"2013-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bda67bee6c19","org_name":"University of Texas Health Science Center at Houston","org_type":"healthcare","ransomware":null,"records_affected":596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.utphysicians.com/21756/uthealth-informs-patients-incident-related-patient-information/"}],"summary":"UT Physicians, the medical group practice of The University of Texas Health Science Center at Houston (UTHealth) Medical School, announces that an unencrypted laptop computer containing some patient information was discovered missing on Aug. 2 from a locked closet in a UT Physici","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f77c8ed958e744fc12f14bdef6d63fbcba35749f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7695885-EC98-4C67-A253-A8B943AF2C13"},"incident_date":"2013-07-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b37d860ce022","org_name":"Sacramento Regional Transit","org_type":"transportation_logistics","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news10.net/news/article/253086/2/Sacramento-Regional-Transit-employee-suspected-in-ID-theft-of-30-co-workers"}],"summary":"Sacramento Regional Transit employee suspected in ID theft of 30 co-workers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e3acd26680094104a7f6c9b8f06f74d84f13e94","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC711FC9-3609-40D5-B76D-562CBF2BBBDF"},"incident_date":"2013-07-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a05e21126a6","org_name":"GitHub","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/GitHub-Disrupted-by-DDOS-Attack-7-19-2013-369523.shtml"}],"summary":"GitHub suffered outages due to DDoS attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d37f9e36831f9773caa9350cf6a3c9d91eb45dd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CE146C3-4D5A-4B43-AE3F-8A0E89AD9CD7"},"incident_date":"2013-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3547771afd7","org_name":"GEO Care, LLC","org_type":"other","ransomware":null,"records_affected":710,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer leaves 710 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-07-18","discovered_date":"2013-06-01","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6f8c7236456ccef5db1414fefaa5a3c68ccbe42","impact_type":"data_theft","incident_date":"2011-08-01","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Letter%20-%20San%20Jose%20Medical%20Supply_0.pdf"},"notes":null,"org_country":"US","org_id":"c261ea2e81fe","org_name":"San Jose Medical Supply Company","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Former employees, officers and/or agents disclosed customers’ information without authorization.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42264"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Letter%20-%20San%20Jose%20Medical%20Supply_0.pdf"}],"summary":"Former San Jose Medical Supply Company employees, officers and/or agents disclosed customers’ personal and health information without authorization.","supporting_quote":"The individuals responsible for the security incident in 2011 were former employees, officers and/or agents of San Jose Medical.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74ffd737b94056f4fab6ed5a0416d553238eaed1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74E7A9CC-AFCB-41A9-8A8D-47C205846CF6"},"incident_date":"2013-07-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"012951167d56","org_name":"Petrochem Insulation Inc","org_type":"other","ransomware":null,"records_affected":629,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Petrochem%20Invdividual%20Notice%20Letter-SAMPLE_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42828"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2801b513148f7c758404e63c5205f1190accd31d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0EE9BF5D-5421-49DE-AB8E-8D069DAA7226"},"incident_date":"2013-07-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-13579_3-57594770-37/apple-developer-site-targeted-in-security-attack-still-down/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.guardian.co.uk/technology/2013/jul/22/apple-developer-site-hacked"}],"summary":"Apple's website for developers was accessed by unauthorized parties.  Registered developer names, mailing addresses, and email addresses may have been accessed on Thursday, July 18.  Encrypted customer information was not affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2013-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc8a0908c806523ffe91b8a60777ff9c6a488ce2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A323F49-4F8B-45AA-A4A9-058A193649F7"},"incident_date":"2013-07-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41eb1cef61d5","org_name":"Edgewood Partners Insurance Center","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://www.databreaches.net/failure-to-encrypt-results-in-epic-breach/;https://oag.ca.gov/ecrime/databreach/reports/sb24-42623"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42623"}],"summary":"Theft of laptops results in exposing PII, medical, and financial data to potential disclosure. Laptop was not encrypted, but was password protected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-07-16","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"603658ee5f9a18d9517dcb5ab91126b0428c4b76","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/OnCore%20Notification%20Letter%20to%20Employees%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"8f14a413ab7d","org_name":"OnCore Manufacturing Services","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42237"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/OnCore%20Notification%20Letter%20to%20Employees%20Final_0.pdf"}],"summary":"A stolen OnCore employee laptop contained payroll reports with personal information and reports on 401(k) remittances.","supporting_quote":"On July 5, 2013, a Company laptop of an Oncore employee was stolen from the employee’s home along with all other valuable contents in their home.","technology_involved":["company laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d74475a1dfffa61d8902d4906301dd05264b38ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6EB866F3-D876-4704-BFD6-4AE4CB467C43"},"incident_date":"2013-07-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GA","org_id":"e4cd29a28486","org_name":"Gabonese Republic Office of the President","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Disrupt-Website-of-Gabon-s-President-368407.shtml"}],"summary":"Anonymous Hackers Disrupt Website of Gabons President","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6d15fb9221e9485380a663b4aa4935b950e49bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E2D6B73-B352-4E19-94A9-F8F5E8F078FC"},"incident_date":"2013-07-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.seacoastonline.com/articles/20130911-NEWS-130919942"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc40.net/story/23181818/skimming-device-found-at-north-cape-may-bank-of-america"}],"summary":"Unidentified individual places skimming device on Bank of America ATM located in Portsmouth, ME.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3072183ba3de96cc7c3d56ac0bad369ea1d63c26","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1B3EC78-014F-4927-A6E4-28F8154A707D"},"incident_date":"2013-07-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a671466533e7","org_name":"National Health Service","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eveningtimes.co.uk/news/patients-records-found-at-bus-stop-146982n.23063478"}],"summary":" The folder with patients' personal details was discovered in July 2013 by a member of the public who handed it to a nearby hospital","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8e1f1c312c2207fffba1857c8fa478241a14cfe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63FCD635-13DD-46EF-A14F-A2684D1BFEF3"},"incident_date":"2013-07-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b397fb36270b","org_name":"Fairfax County Public Schools","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://inthecapital.streetwise.co/2013/07/30/health-records-for-2000-fairfax-students-stolen-in-car-break-in/"}],"summary":"laptop was taken on July 15 when an unidentified person broke into a school nurse's car. The laptop was health department -issued and was swiped from the vehicle along with a briefcase with paper student records as well. While the school nurse was technically allowed to keep the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5eae23b99a8dc51210e93f746ed5ee14d2ea2578","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80D91EE2-8F49-44FB-800C-92A3405FFC07"},"incident_date":"2013-07-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05a7e90fddc7","org_name":"Clark Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsandtribune.com/local/x596955023/Hospital-patient-information-compromised"}],"summary":"Partner misdelivered health records for approximately 1000 patients. Information did not include specific diagnosis, but included PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efc6fe9b4c4c6daadade401d1cd8787c037b67f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18DF47BA-2F55-4E20-BEF2-287EBB6B89F6"},"incident_date":"2013-07-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9fd5f287bd99","org_name":"Advocate Medical Group","org_type":"healthcare","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyherald.com/article/20130823/news/708239619/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42549"}],"summary":"Four computers containing personal data for some 4 million Advocate Medical Group patients were stolen last month from one of the company's Park Ridge administrative offices, hospital officials announced Friday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80aa8bdf17ea2a20af46803955e7890eb0051b9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C7A1489-329E-406D-8AEE-469641E80054"},"incident_date":"2013-07-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d112cf295804","org_name":"University of Virginia","org_type":"education","ransomware":null,"records_affected":18700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.roanoke.com/news/2084624-12/privacy-of-18700-uva-student-social-security-numbers.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/news/uva-breach-insurer-s-mail-vendor-failed-to-check-labels/article_9284714e-f01d-11e2-9f75-001a4bcf6878.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/news/uva-breach-insurer-s-mail-vendor-failed-to-check-labels/article_9284714e-f01d-11e2-9f75-001a4bcf6878.html?mode=jqm"}],"summary":"A mailing error by a third-party mailing vendor used by Aetna Health Care resulted in the Social Security numbers of students being exposed in open-enrollment brochures.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"063da26ef77fc9c625cd09ee80965c85b702e5ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF663828-844F-4CD4-8B09-CB1EF5F4A3DB"},"incident_date":"2013-07-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e06da32e14f6","org_name":"OMNI Community Credit Union,","org_type":"financial","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.woodtv.com/news/local/kalamazoo-and-battle-creek/atm-skimming-suspect-caught-on-tape"}],"summary":"ATM skimming suspect caught on tape","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-07-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c87d919691eddb32141ce9ffa1b3ffd887b3f400","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F68EF982-454F-46D2-8545-85FE1E908CD7"},"incident_date":"2013-07-14","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c934727abc90","org_name":"CANONICAL GROUP LTD","org_type":"professional_services","ransomware":null,"records_affected":1820000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.net-security.org/secworld.php?id=15327"}],"summary":"Actor uses combination of hacking, social engineering, and malware to gain access to Ubuntu forums,steal user information, and finally deface the site..","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f41a99baa8c31e389f0d3cff52407b573926b4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA7E518C-90D9-48D4-97F7-3BEA723FF3DE"},"incident_date":"2013-08-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a36996a8e97a","org_name":"Wells Fargo","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://identitytheftsolutiontips.com/former-verona-fire-captain-pleads-not-guilty-to-identity-theft-computer-crime"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.smdailyjournal.com/articles/lnews/2013-11-07/pair-take-deal-for-elder-theft-identity-theft/1776425112930.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/thieves-hit-13-wells-fargo-mortgage-offices-in-5-states-to-steal-ids/;http://hamptonroads.com/node/741862;http://hamptonroads.com/2015/01/new-york-man-gets-over-14-years-id-theft-scheme"},{"fetched_at":null,"title":null,"type":"press","url":"http://articles.sun-sentinel.com/2013-11-08/news/fl-lauderhill-identity-theft-20131108_1_surveillance-video-withdrawals-lauderhill-police"}],"summary":"former fire captain accessed the account of a Wells Fargo customer and issued himself an ATM card in that persons name, then made three withdrawals of $800 each from the account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f238aa5c6cb266eb7499d15bda64de158ed7511","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-07-12","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Hacking%20incident%20Aug%20%2713%20letter%20to%20clients_0.pdf"},"notes":null,"org_country":"US","org_id":"0f28e60ef5c6","org_name":"Income and Capital Growth Strategies, Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/california-financial-services-firm-hacked.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42435"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Hacking%20incident%20Aug%20%2713%20letter%20to%20clients_0.pdf"}],"summary":"Income and Capital Growth Strategies, Inc reported unauthorized network access that may have exposed clients’ personal and bank account information, but said it did not know how the breach occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e26a9aabb4ecd73353f486505e1693fbc8a07f41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EAD743E4-8819-41B2-9494-8EBE30DD05DD"},"incident_date":"2013-08-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50c46523e246","org_name":"Fidelity Investments Institutional Services Company, Inc","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231592.pdf"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Internal employee accidentally faxed sensitive personal information to the wrong number/recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a593a86dfdc2fefbd29df9ee411cc145e7b8794","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF9AF856-2BE9-4CA3-B8E5-EEA16CE41DE9"},"incident_date":"2013-07-09","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bd47ee7f517","org_name":"Anoka County Human Services","org_type":"government","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://minnesota.cbslocal.com/2014/03/27/fired-govt-worker-charged-with-accessing-info-on-800-day-care-providers/"}],"summary":"A human services worker, fired for identity theft, has been charged with burglary and theft after returning to her former workplace, stealing office equipment and accessing the private information of almost 800 daycare providers, according to the Anoka County Attorneys office.  O","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75c5c75f4fa763f544773ee37a19389ee3d877d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9E619FF-742B-4735-979F-6CA1C98AD415"},"incident_date":"2013-07-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef4248be77cb","org_name":"Ruby Tuesday","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ruby-tuesday-20130723.pdf"}],"summary":"Misdelivery of employee PII via erroneous attachment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2be8c1e59e00bbc0d04fdce50eccd824c22eb4a0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7EE9769-5AB5-412D-BAC5-1F1CE06B6F89"},"incident_date":"2013-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c834893032d","org_name":"Good Samaritan Hospital","org_type":"healthcare","ransomware":null,"records_affected":3833,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Good Samaritan hospital has laptop stolen containing data on 3,833 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f999dde2b0740d4d2580050638f14f65ed4b7f0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F99B184-3F80-471F-B0AA-08ABF748F399"},"incident_date":"2013-07-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"00ec5d0e3c11","org_name":"Royal Jubilee Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/health/Victoria+doctor+under+fire+over+alleged+breach+privacy/8709571/story.html"}],"summary":"A Victoria urologist is under investigation by health authorities over allegations he photographed an unconscious, morbidly obese male patient and sent the picture to a friend.  Dr. John Kinahan is being investigated by the Vancouver Island Heath Authority — and a third-party law","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab78403ca72428f8928a525691b4924d288d9347","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D67E0E81-8937-45E6-AA55-0D138CE1A470"},"incident_date":"2013-07-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de01d96410f1","org_name":"InterContinental Hotels Group PLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/san-francisco-intercontinental-hotel-admits-security-breach.html"}],"summary":"On July 4, 2013 the InterContinental Mark Hopkins Hotel in San Francisco was burglarized.  Thieves removed a hard drive from a office computer, and even though they left it behind, information contained may have been accessed.  The hard drive contained guests names, address, e-ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d405342a7ab5f706548dfd02183db59630eeaba5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1D087DB-53E7-493E-8F69-04CD7E8669FD"},"incident_date":"2013-07-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"febb6fa49c6d","org_name":"Fifth Third Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theindychannel.com/news/call-6-investigators/new-skimmers-found-on-atms-at-indianapolis-banks"}],"summary":"Two ATMs at branch location were found to have skimmers attached. News report eludes to these potentially having Bluetooth capability, data loss is possible even with the confiscation of the card readers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46968904134f9b60a4732381283784eefdf7360f","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification_Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"2d8cb4ce80b4","org_name":"Bureau of Automotive Repair","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42143"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10ceef744955a7efdb9aa9123cdd6b91db80f12e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CBF8E6C-CB74-42DD-838D-C52E420556F2"},"incident_date":"2013-07-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee7d88cb94f9","org_name":"BriovaRx","org_type":"other","ransomware":null,"records_affected":1067,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"BriovaRx reports unauthorized access/disclosure of 1,067 patient records via email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7a4c889047e9e1b90239332d98dbfe66d7183b2","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RECOVERED%20-%20FBI%20-%20C2013068348_CA%20AG_Customer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42142"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42165"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42277"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RECOVERED%20-%20FBI%20-%20C2013068348_CA%20AG_Customer%20Letter_0.pdf"}],"summary":"American Express said card information, including account numbers, names, expiration dates, and Social Security numbers, was recovered during a law enforcement and/or company investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58e704c0eeb01bf9ba2e683c3a1aab7ea4552687","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DF05980-BACC-445A-BCB5-15336E0F7675"},"incident_date":"2013-07-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11327e026206","org_name":"US Department of Labor","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/errors-by-both-sentry-life-insurance-and-the-department-of-labor-expose-401k-participants-information-online/"}],"summary":"On July 2, Sentry discovered that some plans Form 5500 submissions to DOL contained an attachment with the individuals names, Social Security numbers, and in some cases, 401k account balances. To make matters worse, it seems the DOL uploaded the plans 5500 Forms to its EFAST2 web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac21a31b3e3533ed5d8400fec937e7de93409384","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D99F43D2-4023-481D-8811-6E93518D4639"},"incident_date":"2013-07-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fff23f2f60a3","org_name":"Sentry Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-230910.pdf"}],"summary":"On July 2, Sentry discovered that some plans Form 5500 submissions to DOL contained an attachment with the individuals names, Social Security numbers, and in some cases, 401k account balances.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"278be73a06f3be63e4f5c97df2e903c9cbd92e1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"915FF4DA-B461-4FD6-8847-CEF74A5B9944"},"incident_date":"2013-07-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1041c77ec532","org_name":"Page High School","org_type":"education","ransomware":null,"records_affected":456,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/north-carolina-high-school-acknowledges-data-breach.html"}],"summary":"North Carolina's Guildford County Schools (GCS) recently announced that an employee had mistakenly e-mailed a PDF file containing about 456 Page High School students' personal information to a student's guardian on July 2, 2013 (h/t DataBreaches.net).  The file included students'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0963f020efdef0abb38900b69580e60639125a18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBA801BD-D555-4B20-B675-4C088AF6922F"},"incident_date":"2013-07-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae51f99c9482","org_name":"Guildford County Schools, Page High School","org_type":"education","ransomware":null,"records_affected":456,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gcsnc.com/education/components/whatsnew/default.php?sectiondetailid=306641&id=52454&viewType=detail,"},{"fetched_at":null,"title":null,"type":"press","url":"http://wfdd.org/post/guilford-co-school-employee-accidentally-releases-student-data"}],"summary":"A Guildford County Schools employee accidentally emailed a PDF file that contained Page High School student personal information.  Student names, addresses, phone numbers, course enrollments, grades, school district identification numbers, and other transcript data were in the PD","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PH","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52a9cbd8129108fdc120a1782b4061d4b4405886","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DA05D63-B723-4C95-B7F6-E00BC3CF881A"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"7d3c4a6498d3","org_name":"PC World Philippines","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/PC-World-Philippines-Hacked-by-quot-4ntipatika-quot-of-Pinoy-Vendetta-367955.shtml"}],"summary":"The hacker 4ntipatika, one of the founders of the Philippines hacker group Pinoy Vendetta, has breached the Philippines website of tech publication PC World (pcworld.com.ph), Pinoy Hack News reports.   When users visit the site, a popup window is displayed with the message Securi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"450b1d09d6e3763c52b5d1f2561292b61fad36c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0939703-F027-4685-B8D0-81CB23E1A3D2"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3dfa5cf6b091","org_name":"Washington DC Travel Website","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Washington-DC-s-Official-Travel-Website-Hacked-Since-July-396320.shtml"}],"summary":"Washington DC Official travel website hacked and defaced in July. Still not addressed as of 11/01/13. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"Lauri Love","variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8735d25df2d40599719013edcdcabe104d7372c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FFBD5F9-1DD3-4E11-B487-0B15FC3398F8"},"incident_date":"2013-07-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"786916dbe381","org_name":"US Missile Defense Agency","org_type":"professional_services","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/10/database-hacking-spree-on-us-army-nasa-and-others-cost-gov-millions/;http://uk.reuters.com/article/2013/10/28/us-usa-crime-hacking-idUKBRE99R0LP20131028;http://news.softpedia.com/news/British-Man-Arrested-and-Charged-for-Hacking-US-Government-Networks-394934.shtml;http://www.justice.gov/usao/vae/news/2013/10/20131028lovenr.html"}],"summary":"Federal prosecutors have accused a UK man of hacking thousands of computer systems, many of them belonging to the US government, and stealing massive quantities of data that resulted in millions of dollars in damages to victims.  Lauri Love, 28, was arrested on Friday at his resi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"laurilove"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cb77ca5063dc065861cb7fc6fd275a0c4c0c993","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5794CE7-0B8A-47BD-8B2E-6057154698E5"},"incident_date":"2013-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b01b5d8b9f6a","org_name":"US Department of the Air Force","org_type":"government","ransomware":null,"records_affected":525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard.net/stories/2013/08/23/hill-employee-personal-info-improperly-transmitted"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/US-Air-Force-Culture-and-Language-Center-Site-Taken-Down-After-Being-Hacked-365261.shtml"}],"summary":"More than 500 Hill Air Force Base employees had sensitive personal information compromised after another base employee improperly transmitted the information to an unprotected email address.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76ae8efe8a1320c204bf89ea6ba820c7cbfb6060","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8251F40-CBDF-45A0-8A88-DDE184638972"},"incident_date":"2013-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecdbdc133c96","org_name":"University of Arizona","org_type":"education","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://azstarnet.com/news/local/crime/thousands-at-risk-of-id-theft-in-latest-ua-hacking/article_caec99cb-110e-53f7-9d80-831be45be854.html"}],"summary":"More than 9,000 former law students and applicants at the University of Arizona are at risk of identity theft after UAs latest computer security breach. UA has systems in place to protect private data. In this case, the data was stored in error on a server that hosted the public ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"484f97db7f38088889cfc03f0c4e887c5640d265","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81D76501-3E03-4553-B86C-4A8E5534E800"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b19a59d1a0ba","org_name":"Tango.me","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.imore.com/tango-chat-service-hacked-syrian-electronic-army"}],"summary":"Syrian Electronic Army hacks into Tango chat server. Steals data and brags about it online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d25a0435e3fc5982a750d2cc2382b2d7831d8914","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE5E579C-B178-41DA-B54C-FF21FB3CA8B9"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"85931d8c1073","org_name":"Spain People's Party","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Breach-Systems-of-Spain-s-People-s-Party-Leak-Documents-367400.shtml"}],"summary":"  Anonymous hackers have defaced the official website of Spains Peoples Party (Partido Popular), the countrys governing party.  In addition to defacing the website  which has been restored , the hacktivists have also leaked 5 gigabytes of documents that allegedly represent the pa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbbe596ab16709b9452f24db08e01e15ff9ac480","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"691B7CAD-0356-4A88-B264-087FC3C2B71F"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2c67b4cade2","org_name":"Sierra View District Hospital","org_type":"healthcare","ransomware":null,"records_affected":1009,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Sierra View District Hospital reports unauthorized access to electronic medical records of 1,009 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d9e2f3b1dabfd283e78ab1181da9d65a8cb0cd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59E0A533-C878-4729-8A5D-4889EBD2ECEB"},"incident_date":"2013-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"983531ca46be","org_name":"Samaritan Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazettetimes.com/news/local/samaritan-investigates-after-medical-records-found-in-trash/article_f32cac1a-f0d5-11e2-934c-0019bb2963f4.html"}],"summary":"Samaritan Health Services is performing an internal investigation into a possible privacy breach after a woman on Tuesday found a stack of unshredded medical documents in an outside trash can behind medical offices on Samaritan Drive.  We take patient privacy very seriously, and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed73c10af3c5a8339ea4a13299f62168405c7054","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F02199C1-5508-41DC-AAEE-74D46B554826"},"incident_date":"2013-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a261470d9798","org_name":"Sacremento Regional Transit","org_type":"transportation_logistics","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news10.net/news/local/article/255694/2/RT-employee-charged-with-stealing-identities-of-23-co-workers"}],"summary":"An employee of the Transit Authority who worked in HR stole identity of employee's to obtain fraudulent loans. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc4858b7ddc18eabf33fb928bfeeb8b8a78ce843","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B22DC12-FD70-411E-B642-36433B48507F"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ceadf8564a6d","org_name":"Rivermark Community Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/finance/index.ssf/2013/08/visa_alert_of_possible_data_br.html"}],"summary":"Rivermark Community Credit Union officials say they are reissuing debit and credit cards of fewer than 1,000 members after receiving notice from Visa of a possible data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f76317539e64465eaa1832135df87cbf1167c81","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D125F15C-5736-498E-BD30-AA1D28F196E7"},"incident_date":"2013-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ce48c7e27a7","org_name":"Retinal Consultants Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/stolen-laptop-compromises-patients-of-california-medical-group/article/306292/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.retinalmd.com/en/wp-content/uploads/2013/08/Retinal-Consultants-HIPAA-Notification.pdf;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"The California-based Retinal Consultants Medical Group website says it offers patients uncompromising care, but a compromise of data is exactly what patients got after a laptop containing sensitive client information was stolen.  How many victims? Unknown.  What type of personal ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c29f4e1a4d09482979b8498c491fb6f5f11b8f2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5C7B730-005E-4519-B82D-BFDEA80DE536"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abc69fdc2c0d","org_name":"PayJunction","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Pay%20Junction%20%20ltrt%20Consumer%20re%20Security%20Breach.pdf"}],"summary":"Limited information provided in disclosure document. PayJunction suffered compromise of a database that stored customer PII and banking data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43d325875c1eb0b0a02c47da6de5853b66ffae2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4AF9895-A338-4A0B-8D19-D0DFBF617E57"},"incident_date":"2013-07-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7df8fac0af7b","org_name":"Osprey Packs","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Osprey%20Packs%20Services%20Security%20Breach%20ltrt%20consumer.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/osprey-packs-acknowledges-security-breach.html"}],"summary":"web site hacked, customer notified org of fraud on CC, org found malware and evidence of priv escelation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fffe5b716f7edc2b1b95a95b7a1cbd564fde66d2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22ACFD88-05AF-4AE0-95E7-D074A9A37797"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f803d9dc9c","org_name":"Nova SouthEast Univesity","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tx-nova-southeastern-university-law-students-data-hacked-in-2013/"}],"summary":"A data security incident that involved potential access to a server that contained former law students' personal information, including names, dates of birth, postal and email addresses, telephone numbers, NSU identification numbers, and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f7e7e5c5cb4e330cb7b897997ac3ed45cac61dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0326CC0-8A8C-4AB1-9CA7-8DFABDC434C0"},"incident_date":"2013-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53dd66944572","org_name":"Neiman Marcus Group LTD Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/01/hackers-steal-card-data-from-neiman-marcus/"}],"summary":"hackers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a978b4b4a28487670a5034e73426084ab6d620b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C619A632-EAB6-4A96-BE8A-ECEC463CA34B"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3fd04b794ff","org_name":"Montana Department of Public Health and Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://billingsgazette.com/news/state-and-regional/montana/montana-health-department-computer-hacked/article_06676c30-4cb8-597b-b5af-748eefe28aa8.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/unauthorized-access-gained-to-montana-dphhs-server-for-nearly-a-year/article/349887/"}],"summary":"The Montana Department of Public Health and Human Services (DPHHS) is notifying clients and employees that unauthorized access was gained to a server that stored their personal data, including Social Security numbers and payroll information.  How many victims? Not yet determined,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6a38ec445bae55447332c0784abf4aeb2bc5dc2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D41BF5C-AD11-494E-A94D-C5F41A3A2413"},"incident_date":"2013-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a234b76ecbfb","org_name":"Minnesota National Guard","org_type":"government","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://charlotte.cbslocal.com/2013/12/12/guardsman-accused-of-army-identity-theft/"}],"summary":"National Guardsman stole identities of his unit to create fake identification for his militia. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"054ecc1d15df07a4fd346673ed6430ed6899f9a8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A11E71E-0803-459C-A5EA-D5B1DD24A98F"},"incident_date":"2013-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d50bac95d9de","org_name":"Lowe's Cos Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/lowes-acknowledges-third-party-data-breach.html;http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-240470.pdf"}],"summary":"third party backed up lowe's driver personal data to unsecured internet-accessible server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbcfe1850cadb2924b5ce0d1bc07470e888fc9be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7B86EB6-E663-4F82-BE19-1033EFDF2920"},"incident_date":"2013-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"4ab6f45fcb5c","org_name":"IL Ministry Of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.biometricupdate.com/201307/leaks-show-security-flaws-in-israeli-biometric-database-project"}],"summary":"Documents were mistakenly disclosed regarding Israeli biometric database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d62edad864928abe7a4bf0a020c67838fd39f1b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3E01ED1-EB6E-4E3F-A5AB-F2A18C79C531"},"incident_date":"2013-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"469d526f9b94","org_name":"ICS Collection Service","org_type":"other","ransomware":null,"records_affected":1344,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ics-collection-service-inc-press-release-on-data-breach-affecting-university-of-chicago-physicians-group-patients/"}],"summary":"Debt collection agency exposes personal and medical information on public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af4a5ddd81bce6747174005a14a6672311869d87","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40B43F8D-6D91-443F-A615-218794E60EFE"},"incident_date":"2013-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"530322004f26","org_name":"Hill Air Force Base","org_type":"government","ransomware":null,"records_affected":525,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard.net/stories/2013/08/23/hill-employee-personal-info-improperly-transmitted#.Uhd6YBJro0g.twitter"}],"summary":"More than 500 Hill Air Force Base employees had sensitive personal information compromised after another base employee improperly transmitted the information to an unprotected email address.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b257c0640c4a6402df351c7c364f29a3540251b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33822412-26B2-4EAD-BDA7-422ECCB38778"},"incident_date":"2013-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a341ee77828","org_name":"Franklin Police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.williamsonherald.com/home?id=84195"}],"summary":"Police employee misuses access to look up information on police chief's family member.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"737c3a2a389d2c05fb5f4286c5d6f0d81b7671a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4727DA5-04BA-4C0B-A345-81D652327301"},"incident_date":"2013-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa1a1da8d285","org_name":"City of Baltimore","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.youtube.com/watch?v=wwrqLitM_4M"}],"summary":"Unrelated person finds a box of records set out for the trash has sensitive information on city workers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03c437a2145f21e18bacaaf7987e7a413c72b325","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB2699B4-6F81-489D-B29A-FC61AC5AA66F"},"incident_date":"2013-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e5346747018","org_name":"BoomerangTags.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/boomerang-tags-20140425.pdf"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Individual%20Breach%20Notification%20Letter_0.pdf"}],"summary":"We recently learned that unauthorized individuals or entities installed malicious software on the computer server we use to host our Website. We believe the malware compromised the payment card data of visitors that made payment card purchases through th e Website between July 4,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef54783d0c695f3a02a89001cb79b572473edc89","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F91FA5AC-CDE1-4167-80EA-2C8891EBD7D6"},"incident_date":"2013-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8ec62dc98684","org_name":"Betsi Cadwaladr University Health Board","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2014/data-breach-at-welsh-health-board-after-patient-details-sent-to-wrong-address-09072014"}],"summary":"The Information Commissioners Office (ICO) has found Betsi Cadwaladr University Health Board in breach of the Data Protection Act after sensitive information was sent to the wrong address.  The information was disclosed when eight letters about patients were sent to one of the pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99403454e809f251172114bdce3574d92afeae5c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2AD93204-3F4A-47DF-9003-EEB6E7A045E8"},"incident_date":"2013-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"fbf850b7ac52","org_name":"Allied Bank Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Pakistani-Financial-Institution-Allied-Bank-Limited-Hacked-368788.shtml"}],"summary":"The website of Allied Bank Limited (abl.com), a commercial bank in Pakistan, has been breached and defaced by a couple of Pakistani hackers called Xploiter & Dr.Freak.  This is not the first bank targeted by the two. According to The Hackers Post, theyve also claimed to have brea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81bb9d5bbb5cc41b49ac924538d921eab18bfc4f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFC5936D-D569-4026-B816-2DEC518540FC"},"incident_date":"2013-07-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9aa8bf1d9d46","org_name":"Alliance HealthCare Services Inc","org_type":"healthcare","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/alliance-health-reports-30-month-health-data-exposure-8317/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.alliancehealth.com/statement-regarding-data-security/"}],"summary":"patient databases had been misconfigured and left accessible via the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b94b193cc940acd4bb1f04bd92e5bc0da78ba856","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B067072C-F6AF-48F2-B30A-B4B172798477"},"incident_date":"2013-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e97ea9168119","org_name":"AAMI","org_type":"financial","ransomware":null,"records_affected":117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theage.com.au/it-pro/business-it/aami-customers-use-privacy-breach-in-their-favour-20130820-hv1fz.html"}],"summary":"Employee sends email to group of people using To field instead of BCC field. Group of people that had complaints with victim organization become aware of each other and band together to increase pressure and pursue class action claim.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6daa418422995beded3ad57f80c562527a87c11","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF9A00B8-FC47-4B2B-A9A9-FB3B88EB439A"},"incident_date":"2013-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36af96b76cd1","org_name":"Ouidad Products LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Customer%20Notification_2.pdf"}],"summary":"We only recently were alerted that our Company was the victim of an illegal data security attack by sophisticated criminals between the dates of June 30 and July 4, 2013. Based on our ongoing review, we believe that the attackers gained access to the Ouidad customer database, com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01d105273890ea6642500b8cdb029759ab2e3e54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67FD854A-06FA-4E9A-A945-ABF557001FA1"},"incident_date":"2013-06-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ed111245ff8","org_name":"Medical University of South Carolina","org_type":"healthcare","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalscene.com/article/20130905/SJ01/130909814/1059/SJ01/musc-patient-credit-cards-hacked;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.postandcourier.com/article/20130905/PC16/130909692/1177/cyber-attack-threatens-financial-information-for-7000-musc-customers;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.live5news.com/story/23348064/financial-data-hack-affects-7000-customers-musc-says;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/medical-university-of-south-carolina-notifies-patients-of-breach-at-credit-card-processing-vendor/"}],"summary":"MUSC says it has had its financial records hacked and credit card information for some 7,000 people has been compromised, according to area reports.  At some point between June 30 and August 21, the records of Blackhawk Consulting Group were compromised and hackers got the credit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02aa415039cea4089645d1e54b99a4801638c843","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9726D419-7446-4CF8-A9D9-52403B2EE3C8"},"incident_date":"2013-06-28","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b377a9b2c50","org_name":"SunTrust","org_type":"financial","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailypress.com/news/southside/dp-virginia-beach-bank-id-theft-0802,0,811946.story"}],"summary":"3 people walked into separate Suntrust branches and made fraudulent withdrawls using stolen banking information. It is not known how they acquired the banking information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08bf9c4a01350ac28ef77d514b1f1e74041b61a6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B6BFC37-D7A7-42EC-A173-F2E950422EB0"},"incident_date":"2013-06-28","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c201c882ec03","org_name":"Stamford Univeristy Institute of Allied Medical Professions","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stamfordadvocate.com/default/article/School-receptionist-charged-with-stealing-student-4852960.php"}],"summary":"School receptionist stole personal information and used said info to open fraudulent lines of credit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8bacb0dd767b383b81d1dd74fa3c706987b336b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DE4D114-AE14-4016-8495-8E432B1FB6D7"},"incident_date":"2013-06-28","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b2e1f50ed888","org_name":"South Shore Home Federal Savings and Loan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.portsmouth-dailytimes.com/news/home_top-news/2858404/South-Shore-woman-pleads-guilty-to-embezzlement"}],"summary":"female pleaded guilty to bank embezzlement and aggravated identity theft charges on Dec. 10.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed29167ec992d542c132a41629bc59d722229ab2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01444861-9D3E-4207-839D-F3B7D1AB4A89"},"incident_date":"2013-06-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eee77fbfd286","org_name":"Rose Medical Center","org_type":"healthcare","ransomware":null,"records_affected":606,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/"}],"summary":"Improper disposal of paper records exposes 606 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49a69f1e1c8079138fbc558e3380abbdad310e1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"016E5701-2427-494B-BD06-F9CE8E909F61"},"incident_date":"2013-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"835f0359d4b2","org_name":"Aptean","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231928.pdf"}],"summary":"Company that processes association donations is breached resulting in payment card data loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51d35a583d05f973218fdf7725f58df737778464","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8F699D5-74A8-4FC7-9C79-259A2DE4602E"},"incident_date":"2013-06-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44ac33e18e51","org_name":"Buckeye Title Loans of California LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notice%20of%20Breach%20to%20BTLCA%20customers_0.pdf"}],"summary":"Laptop theft from personal vehicle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c6d92deab8c16bf85c65e5d2e223fb7cc8793e7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF11D5A8-2F44-4E7E-9934-3572BF33B0E4"},"incident_date":"2013-06-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c615db54610","org_name":"James A. Fosnaugh, M.D.","org_type":"healthcare","ransomware":null,"records_affected":2125,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of a portable electronic devices exposes 2125 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85fa503c3813ebbab90b82f808a2dc0ffc42f3f5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E9436E1-5B60-4268-8C6A-4E04B7B3F046"},"incident_date":"2013-06-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"acb888199ef9","org_name":"Islington Council","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/uk-islington-council-hit-with-monetary-penalty-after-2375-residents-personal-details-published-online/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/London-Council-Fined-by-ICO-for-Exposing-Personal-Details-of-2-000-People-377730.shtml"}],"summary":"According to the ICO, the Islington Council inadvertently released the details of 2,000 residents in freedom of information documents.  The data, published on the What Do They Know website on June 26 and June 27, was contained in three spreadsheets. The files have been publicly a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c64d2f21fe0935904da66d6810779187485a5d98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CCFDF1C-8B08-4967-8DDA-12BAAB0988DF"},"incident_date":"2013-06-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d7d787386318","org_name":"Butera's Restaurant","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/long-island-couple-accused-of-stealing-identity-to-buy-fast-food;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wantagh.patch.com/groups/police-and-fire/p/id-theft-and-drug-bust-in-seaford"}],"summary":"A Long Island couple are facing criminal charges early Sunday after they allegedly stole a womans credit card information and then bought more than $1,000 in fast food, Nassau County police said.  Detectives said Heanue was working as a hostess at Buteras Restaurant located at 39","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"720ba671986874af2c491968d28ced63580d0a83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"973575F9-F725-4B3F-B497-AE648836756E"},"incident_date":"2013-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"4f6270cdfcc3","org_name":"Republic of South Korea","org_type":"government","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/south-korea-govt-site-hacking-sees-massive-data-breach-7000017507/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/s-korea-govt-sites-shut-down-from-apparent-cyberattack-7000017243/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/asia/article/1268547/websites-north-and-south-korea-hacked-war-anniversary"}],"summary":"South Korean presidential site hacked and according to anonymous (small A) source, 100,000 PII records are at risk. No details regarding techniques used in attack have been provided to date. Website was defaced and made to look as if Anonymous was responsible, but this has been d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3e881f2c75a2e5ca45e0c4469314b54b526c8b3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF26AF8E-FBC2-4DEB-BDB7-BEBB8F69423A"},"incident_date":"2013-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZW","org_id":"7265c70c7a85","org_name":"Zimbabwe Ministry of Defense","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Africa-Attacks-Swaziland-Government-Zimbabwe-Ministry-of-Defence-363029.shtml"}],"summary":"Anonymous Africa Attacks Swaziland Government, Zimbabwe Ministry of Defence","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d7cb95cf914a7c80342bf41c83c2aa677190a8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D514675-F60D-422F-BD9E-26BB452C8074"},"incident_date":"2013-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f0d0db74e82","org_name":"Swimsuitesforall","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/swimsuitsforall-acknowledges-security-breach.html;http://ago.vermont.gov/assets/files/Consumer/Security_Breach/swimsuitsforall%20Security%20Breach%20ltrt%20consumer.pdf"}],"summary":"SwimSuitsforAll Acknowledges Security Breach  Customers' names, addresses, credit or debit card numbers, and credit or debit card expiration dates may have been accessed. Plus size swimwear retailer SwimSuitsforAll recently began notifying customers that the computer system used ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b4d05c2bd848f27bcb1157cd923a4499ce68a9b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"773E41A6-87D6-458C-81DB-2D807BFA1775"},"incident_date":"2013-06-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"404432458a1d","org_name":"Hylant Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibj.com/employee-defection-sparks-battle-between-insurance-brokerages/PARAMS/article/47199"}],"summary":"A legal battle has broken out between two insurance brokerages, with Hylant Group alleging Huntington Insurance hired one its former employees who then lured away two of its clients.  Toledo,Ohio-based Hylant, which has offices in Carmel, alleges former employee Nicholas Iaonnacc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"030f558ad85613d9f6674e58c206a951815ca2e5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B9EE1982-F35E-4236-A9E4-0474926B76E1"},"incident_date":"2013-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SZ","org_id":"885cbb955a81","org_name":"Government of Swaziland","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Africa-Attacks-Swaziland-Government-Zimbabwe-Ministry-of-Defence-363029.shtml"}],"summary":"Anonymous Africa Attacks Swaziland Government, Zimbabwe Ministry of Defence","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-06-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25e4dbf6df9f8fc842190b9897c637e3f080cf95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6288B64-12BE-4048-BB17-F90B391E0E02"},"incident_date":"2013-06-22","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"983da3c1c711","org_name":"Vishal Kaushal & Company","org_type":"professional_services","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/09/22-years-old-chartered-accountant.html"}],"summary":"Intern accesses e-taxation accounts of popular Indian cricketers and a professor. After hacking these accounts, He accessed the details of their income, tax amount paid, PAN card number with an intention to know how much these rich and famous people were filing their IT returns a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcd4831b378fc27294acbfbf25f0ade34cb55905","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B97EBF3-5545-404B-8B0C-64942FC21453"},"incident_date":"2013-06-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c5f48f11b2f3","org_name":"South Walkerville Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://subscriber.hoovers.com/H/company360/overview.html?companyId=206333630"}],"summary":"A Windsor obstetrician is warning her patients of a possible privacy breach four months after a computer full of sensitive information was stolen from her office.  In a public notice that appeared in The Star on Wednesday, Dr. Shobhana Patel said a break-in this summer resulted i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dffbfd7c2e6aad1e6767796fb4785e9145d2d1c4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"111FED48-FD37-4576-ACA5-3A25F2203185"},"incident_date":"2013-06-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e14869525adb","org_name":"RBS Citizens Financial Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wickedlocal.com/wellesley/news/x1580222223/Wellesley-bank-targeted-by-fraud"}],"summary":"Bank branch was victim of an ATM skimming attack. Not much information provided in news article.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d6ad10710e16086c15299626253b41942314c6b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBC156D3-9481-4E80-8A80-B77FD64F1F5A"},"incident_date":"2013-06-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3faa8ef14b77","org_name":"Southwest Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/ap/ap/transportation/southwest-grounds-flights-due-to-computer-glitch/nYR3p/"}],"summary":"Computer failure results in grounded flights, ultimately leading to over 50 cancellations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20fc7fb667d7048b866d6c01650bfef87026aff2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8E728B9-81B8-41F7-BE19-453170AEA514"},"incident_date":"2013-06-21","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79072c01084a","org_name":"Marshall Heath","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wvrecord.com/news/273986-woman-sues-marshall-health-for-data-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wv-woman-sues-marshall-health-for-privacy-breach/?utm_medium=twitter&utm_source=louky_anon"}],"summary":"A woman is suing Marshall Health after she claims an unauthorized employee (who was in a relationship with the patients father) accessed her daughter's medical record multiple times.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bd57eb1a4398128c92ba267f50a8f7d095897d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B5FC438-CAA2-44A7-A91D-EC91AC13B7F3"},"incident_date":"2013-06-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c8d9d3e28054","org_name":"Baylor All Saints Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-breaches-reported-by-baylor/"}],"summary":"Billing department employee accessed and sold patient information from 6/20/13 to 1/23/14. Victim notified by law enforcement on 2/7/2014.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f843ff7da05c102be28a2abec38f4115b81abf3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39D6AB90-81BC-42FF-82D9-10CDA2453F6E"},"incident_date":"2013-06-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e77e2fd0e97","org_name":"Brentwood Primary Care Clinic","org_type":"healthcare","ransomware":null,"records_affected":261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55766"}],"summary":"A dishonest intern was caught using a cell phone to illegally photograph patient Social Security numbers and names.  The photos were then sent to another person; presumably for fraudulent activity.  The office intern was charged with fraudulent use of personal identification info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eba31006e7a4c2ebb7ad80fa1915adcfbcb4f8cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF657D9B-40C8-485A-84C1-ACD8645F6AA1"},"incident_date":"2013-06-19","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"751e5dd440fe","org_name":"Auburn University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/auburn-university-20130802.pdf"}],"summary":" Auburn University erroneously uploaded spreadsheets containing PII to a publicly-accessible server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53076d4f358d01550312740089eb493bf4a6c9e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"763CEDCF-28F5-454B-B322-E280F013DED9"},"incident_date":"2013-06-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://bulk.resource.org/irs.gov/eo/doc/irs.gov.20130701.pdf"}],"summary":"Public.Resource.org received 990-T forms with sensitive information during a request for information from the IRS.  The IRS acknowledged the mistake and Public.Resource.org became curious about where else the information could be found.  Public.Resource.org found multiple inciden","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc9984f41f15793745b00f683e9f563690f33046","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"119A1FD7-869F-453B-9828-0ABEBB147EE8"},"incident_date":"2013-06-18","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f257fdc63a9","org_name":"Chicago Public Schools","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.suntimes.com/news/metro/24065183-418/city-cps-students-health-data-accidentally-posted-online.html"}],"summary":"Data collected about some 2,000 students who participate in a free vision examination program provided by the city was incorrectly configured and was available on the Internet but only 14 people viewed the information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"312125e002169932e935129a7d10063762cc720c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C5CB6A9-535F-4399-A09D-6B764B7699E1"},"incident_date":"2013-06-17","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7344a9f4a5c4","org_name":"Hancock Physician Network","org_type":"healthcare","ransomware":null,"records_affected":1396,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hancockobgyn.com/"}],"summary":"Hancock OB/GYN employee accessed 1,396 patient records out of non work-related \"curiosity\".  The unauthorized access took place between November 9, 2011 and June 17, 2013.  Information accessed included: patient's name, date of service, medical record number and information regar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13bff5aabbb784bb794734b735062acf770e720e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3CA5031-5FE6-4DCA-A6BF-E05774268B44"},"incident_date":"2013-06-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a939b4501b3","org_name":"Foundations Recovery Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/FRN%20Breach%20Notice%20Letter%20%28CA%29%20%28SSN%29_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42082"}],"summary":"On Saturday, June 15 th, one of our employees informed us that she had been the victim of a burglary during the early morning hours on June 15 th at approximately 2:45 a.m. and that her company laptop had been stolen. The laptop contained certain aspects of patient information wh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc2ffbfb66394b5d333167d858e2a49d30ce959e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0B5D215-865B-493D-BDAD-912026950E70"},"incident_date":"2013-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"619d7a857b2c","org_name":"Ektron, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ektron-20130903.pdf"}],"summary":"Third party gained unauthorized access to personally identifiable information for 22 current and past employees of Ektron, Inc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48ea3a742e2e85a31c6a2af74b156631dbe31edf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A302069-BFCD-4644-93CF-DBECB63B7FCA"},"incident_date":"2013-06-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a7522c81e34","org_name":"Lincoln County Health and Human Services","org_type":"other","ransomware":null,"records_affected":959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access to printed documents result in the exposure of 959 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc42bcca8dac252219218275c3a2f52c79e02801","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BF29C0A-0498-44AF-9408-417885841E53"},"incident_date":"2013-06-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"127440aa222a","org_name":"Crystal & Company","org_type":"financial","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231434.pdf"}],"summary":"Laptop containing personal info on 10 clients was stolen from an employee's car.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21d57b1e18171144d9f21811d2c648a941ebe427","impact_type":"unknown","incident_date":"2013-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Mbr%20notification%20letter%2031May13_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c425499af752","org_name":"Yolo Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41970"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"826000789ea1dc879487b332f67431ebfdba0fb9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"439821D4-898A-4207-9A36-F27DF214D41C"},"incident_date":"2013-06-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83b4b5ee7770","org_name":"Young Family Medicine","org_type":"healthcare","ransomware":null,"records_affected":2045,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Stolen laptop.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4300e2be990639ea7671723a7bda9099db82863","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69E287CA-638D-45CB-8AD1-1F57893DEE9C"},"incident_date":"2013-06-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe0c4dae1958","org_name":"Cypress Surgery Center","org_type":"healthcare","ransomware":null,"records_affected":317,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansas.com/news/local/article27985777.html"}],"summary":"A woman who was fired from a Wichita surgery center was found guilty of computer crime for a mass transfer of e-mails with information about 317 patients.  After a six-day trial in Sedgwick County court, a jury found April Galvan, 54, guilty Monday on all seven counts of computer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"607e87d27614c414e508c1cad344b2809199433b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"275618DE-D729-4683-98EB-92484D89D53D"},"incident_date":"2013-06-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fefe3193bb7a","org_name":"THE UNIVERSITY OF ARIZONA MEDICAL CENTER","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gvnews.com/news/local/woman-reports-id-theft-after-hospital-posts-personal-information/article_6198335c-38ef-11e3-baba-001a4bcf887a.html"}],"summary":"A woman was the victim of identity theft four months after a hospital employee posted a workplace photo on Facebook that included a computer screen displaying her personal information.  An official at the University of Arizona Medical Center-South Campus acknowledged that the eme","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9464280fd75b8b7134f19576a556def00ce3a05","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06EA73EE-C9A1-4E53-84FA-021CD45F1591"},"incident_date":"2013-06-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04cf34a0b054","org_name":"Retinal Consultant Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/retinal-consultants-medical-group-admits-security-breach.html;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/00071883_0.PDF?"}],"summary":"California's Retinal Consultants Medical Group recently began notifying patients that a laptop computer, a component of a diagnostic imaging machine, was stolen from the medical group's offices on June 5 or 6, 2013 (h/t PHIprivacy.net).  The laptop contained patients' names, birt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9181490728cd40755aa09913cb8207e8ee85c0fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56115EC3-BD0A-4C0B-A50E-497DA7DC917E"},"incident_date":"2013-06-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b83a71938d35","org_name":"Moseslaketalk.com","org_type":"technology_saas","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ifiberone.com/news/grantcounty/moseslake/former-moses-lake-website-owner-pleaded-guilty-to-identity-theft/article_0df6bc30-2d43-11e3-ba42-0019bb30f31a.html"}],"summary":"A Moses Lake businesswoman pleaded guilty to using clients' credit cards to buy items and pay bills.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-06","discovered_date":"2013-05-23","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df6c92b7b323846c57d898d4537666f478269c96","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"fbd2e766dfd8","org_name":"Sutter Health East Bay Region","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41933"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter_0.pdf"}],"summary":"Sutter Health East Bay Region notified people that their personal information was recovered during a law enforcement investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e59ab79f2831c98677be771c120c76d5ff5d4f91","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/EEtemplate_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"1996f17e4011","org_name":"ADP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41924"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"048ee221a921824cac3abc0cd2d14fc6085f511f","impact_type":"unknown","incident_date":"2013-05-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA%20notification%2060413_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41920"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-06-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad070daea440661bf24d12703fba7cfc8d62688c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFF07078-8624-4EB6-A3CD-D7F003778CE3"},"incident_date":"2013-06-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"cf3c7c712768","org_name":"linhcrystal.com","org_type":"technology_saas","ransomware":null,"records_affected":71000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bdbcybernews.blogspot.com/2013/06/linh-crystal-breached-7000-account.html"}],"summary":"SQLi used to compromise a forum site. 71,000 credentials were posted to public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83a22992d30a1cafdb24d3a49fd5e313f37d6082","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E61A58E8-D8F3-453C-B897-30A9D7C8A4D4"},"incident_date":"2013-06-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de2eb38f44aa","org_name":"Community Support Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1167,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of email results in exposure of 1167 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1179108248d21085abda03acf4f30a59d6b6aafc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB6CFEE1-6C7E-480C-8C16-2CB08A1854E8"},"incident_date":"2013-06-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2622c7e42566","org_name":"Citi Prepaid Services","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Cardholder%20Letter%20Sample_CA_062713_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42105"}],"summary":"A code change in the prepaid cardholder website impacted the security features that authenticate cardholder logins.  Anyone who logged into the prepaid cardholder website between June 2 and June 13 was affected.  The issue was remediated and it does not appear that unauthorized c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a98c96a4d7742a2a4e90448a988386f43655baaf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D42A2C10-41AA-46E5-A0B5-337FBE858F1D"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f17b60e751b8","org_name":"Wheaton Franciscan Services","org_type":"healthcare","ransomware":null,"records_affected":848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lacrossetribune.com/news/local/state-and-regional/ex-wis-payroll-worker-accused-in-m-embezzlement/article_54723926-5bb2-11e3-9c1e-001a4bcf887a.html"}],"summary":"A former payroll specialist at Wheaton Franciscan Services is accused of embezzling more than $1 million to support her gambling, according to a complaint released Monday.  Janice Nieman, 49, of Milwaukee is charged with four felonies  three counts of theft over $10,000 and one c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01b9228b3638b8fde51ce5d85ec6ed6b5e04b151","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5903A726-34D2-40C3-9A18-A6B34FB09491"},"incident_date":"2013-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f1eb59dc25d","org_name":"Wedgewood Legacy Medical","org_type":"healthcare","ransomware":null,"records_affected":2125,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/01/nebraska-doctor%E2%80%99s-office-notifies-2125-patients-of-breach/"}],"summary":"Doctor lost chip off of a thumb drive that contained 2125 PII records, but not medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aac76045aa81b1714145990c3af9eab0a1af22ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"691D5B38-0D0B-4C60-A320-BC6C6CAFA9AD"},"incident_date":"2013-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"107adfe17477","org_name":"US Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.isssource.com/feds-bust-2-in-skimming-device-scam/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/news/adminpage/4903282-74/according-affidavit-fraud#axzz2iToPjXta"}],"summary":"Two Romanian nationals were arrested during an operation to retrieve skimming hardware from stamp kiosk in USPS Office. They had stolen payment card information from the same location in June.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a337cabe24de999ed55efbdaa46e7391bea04c34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17CA38AD-5C56-49BD-BDC0-38684DE5287E"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c799c8e8d2da","org_name":"UK Essex Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/uk-england-essex-27150681"}],"summary":"Police officer misuses access to police records for personal matters.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e04de64ceecbaf6ab685ddc327efc12cf50dd2e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20F94842-3D93-42B2-9694-17A5C86CCBC9"},"incident_date":"2013-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"f0737b5d10ca","org_name":"Tokyo Electric Power Company","org_type":"energy_utilities","ransomware":null,"records_affected":22,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2013/06/15/national/tepco-employee-loses-info-on-22-claiming-nuclear-compensation-redress/#.Ub9aF__720g"}],"summary":"Tepco revealed that one of its employees has lost documents that include the personal information of 22 individuals who have applied for compensation related to the nuclear crisis, adding this was not the first such incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7f735f8d57085864bbbe991585a0923168cbe1a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"391ECA99-5DC5-4C59-AAF3-92B29A419747"},"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"e04e5c4cebc0","org_name":"Redenet","org_type":"education","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/06/redenetedubr-university-of-neoliberal.html"}],"summary":"Hacked by Activists and user login information posted online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d8ac44b283a100f6d4a3d8e1cb95b18651f80dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93850817-A5C3-42EA-BE44-4DCCD70EDE08"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d303e54bb889","org_name":"Northwestern Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.slate.com/articles/technology/future_tense/2014/01/doctors_on_social_media_share_embarrassing_photos_details_of_patients.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.cbslocal.com/2013/08/21/woman-sues-northwestern-after-doctor-posted-drunk-photos/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2013/08/19/60379.htm"}],"summary":" An emergency department physician allegedly took photos of a 23 year old model in which she appears anxious and disheveled. Hes accused of having posted the unbecoming shots on Facebook and Instagram.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e65fd6e08ae94f4d1516f76a2ab94eada518b6f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C8E5C20-25E9-4765-B08D-DC0B907AD2C2"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"d46fc132eb83","org_name":"Northland Regional Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nz-council-breached-workers-privacy/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/northern-advocate/news/article.cfm?c_id=1503450&objectid=11340706"}],"summary":"The Northland Regional Council breached the Privacy Act when staff accessed text messages sent by the victim of a brutal bleach attack, the Privacy Commissioner has found.  Former council employee Mike Nager was driving to Whangarei in June last year to give evidence in court aga","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f36a619b26eb1e4e5e2b745926a03954e977e8c2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F06A42D-C0E7-471A-B408-53E1A9588A8A"},"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef2977124440","org_name":"National Security Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gizmodo.co.uk/2013/06/anonymous-goes-tit-for-tat-and-leaks-a-trove-of-nsa-documents/?goback=%2Egde_4636751_member_247847402"}],"summary":"anonymous posted internal docs from NSA, unknown everything else.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d4b97ce8cd7c5ae9681465a21ce28c10c3823a8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92B76FCA-F438-4AF4-BC51-4826CBE36437"},"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"dda2161ac96c","org_name":"National Iranian Oil Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.farsnews.com/newstext.aspx?nn=13920401001119"}],"summary":"The National Iranian Oil Company and the Oil Ministry were offline for an undisclosed amount of time. The cause was self-reported as a network issue.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0ddc7bd80befc767f2ab872654fdb7215d776b3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B65CFD00-A308-4EB4-9CF6-D29EB69364A3"},"incident_date":"2013-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"630ea16dfb3a","org_name":"Kroll Background America, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/"}],"summary":"Kroll Background - An identity theft service that sells Social Security numbers, birth records, credit and background reports on millions of Americans has infiltrated computers at some of Americas largest consumer and business data aggregators, according to a seven-month investig","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af8257003e4cea715334a3c2e56cd66dd421feef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BB1A8C5-9115-46D9-9138-A28EDEA1150E"},"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fbf1544a0a0","org_name":"Interactive Data","org_type":"technology_saas","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/28/interactive-data-hacked-data-leaked-by-teamberserk/"}],"summary":"Website breach leads to 32 user accounts posted on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6453e80c752b92a228d130f7f27f6052a3e4e0ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45F3C8A1-CEB5-433B-8807-D3BDF784A2FA"},"incident_date":"2013-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5edf7e56a37","org_name":"Hankyu Chung, M.D (Healthcare practice)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20version%20of%20breach%20notification%20in%20PDF%20format%20%2800751822%29_0.PDF"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/burglar-snatches-laptop-with-patient-medical-records-from-san-jose-internists-office/"}],"summary":"Burglar snatches laptop with patient medical records from San Jose internists office. The burglar was able to gain access to the offices by entering the building complex through an unlocked door and using the crawl space above the office to gain access to it. The burglary was dis","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c87a30ec6b17f2ebfdc56f9e3de328974eed947","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F768E82D-C98C-4997-84B3-E93B512658F1"},"incident_date":"2013-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3defeec27dc6","org_name":"GREAT ORMOND STREET HOSPITAL FOR CHILDREN NHS FOUNDATION TRUST","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itpro.co.uk/data-protection/21074/ico-flags-temporary-staff-data-protection-risk-following-gosh-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/Temporary-workers-still-require-adequate-data-protection-training;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/healthcare-network/2011/may/04/biggest-threat-nhs-data-security-staff?guni=Data:in%20body%20link;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computing.co.uk/ctg/news/2308575/ico-warns-firms-to-train-temps-in-data-protection-following-great-ormond-street-breaches;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/%7E/media/documents/library/Data_Protection/Notices/GOSH-undertaking.pdf"}],"summary":"The Information Commissioner's Office (ICO) has warned organisations that even temporary workers need data protection training in order to properly prevent against a breach. Its warning comes following four data breaches at the Great Ormond Street Hospital for Children NHS Founda","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b62e7e16b5ff11b45d20d042bad93f483a44d31","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03003650-9E97-4AF9-AEB6-90AF0409AB2D"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb278cf9d4d0","org_name":"Flowers Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dothanfirst.com/story/d/story/flowers-hospital-personal-identity-stolen-dothan-a/32968/yMq8-j68U0Oq2YJ3KhpOtw"}],"summary":"Employee in Hospital Lab was stealing patient data to file fraudulent tax returns.  Unknown amount of records stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f1729785d3c54d8d6116db6ef8c0522a9655f70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE5377FE-C6B2-4073-9F57-C5EDC4FC6A1A"},"incident_date":"2013-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook Inc","org_type":"technology_saas","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gizmocrave.com/15627-facebook-security-breach-actually-happened/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/06/21/net-us-facebook-security-idUSBRE95K18Y20130621;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/notes/facebook-security/important-message-from-facebooks-white-hat-program/10151437074840766/"}],"summary":"Facebook Inc has inadvertently exposed 6 million users' phone numbers and email addresses to unauthorized viewers over the past year, the world's largest social networking company disclosed late Friday.  Facebook blamed the data leaks, which began in 2012, on a technical glitch i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f5566a17aab3e3ead37f05c9353ce64a4141f34","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03F46DCA-9817-4F4D-8E37-D33761B02651"},"incident_date":"2013-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ff0e4ecbcf5","org_name":"Creative Banner Assemblies","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/creative-banner-assemblies-acknowledges-security-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/creative-banner-20130813.pdf"}],"summary":"Website compromised and malware installed that captured payment card data out of temporary files. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials","medical"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28fd2841d1a8ab8b58d7b9c30b322304e26ee10d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE78D048-8CB7-4A1A-907B-135A3CD82B58"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ca60bdbabb0","org_name":"Cedars-Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/15/kim-kardashians-patient-data-breached-at-cedars-sinai/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/07/14/entertainment-us-usa-hospital-privacy-idUSBRE96D00520130714,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2013/07/14/workers-fired-kim-kardashian_n_3592841.html,"}],"summary":"Perhaps some recent news about reality television show star Kim Kardashian can be viewed as beneficial to the public in that it could help spread the word on patient privacy problems across the country. Kardashian was among the patient whose records were accessed inappropriately ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2970f2684a7d94cde1f939c00fc67da4194bd934","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8599C7AD-C7C3-4223-8EEA-83A28FB8A9DF"},"incident_date":"2013-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20of%20Notice%20CCHCS%20to%20CalAG%208.16.2013_0.pdf?"}],"summary":"Insider lost documents containing health info.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"faacc2d3225afa641b2b15fa583a38a6bd3590cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC4D678A-6245-4AA6-B0E5-954329EDE22C"},"incident_date":"2013-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3eee3f663ba6","org_name":"Alberta Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":247,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://calgary.ctvnews.ca/audit-uncovers-breach-of-patient-records-by-former-ach-employee-1.2043439"}],"summary":"A former employee at Alberta Children's Hospital inappropriately accessed the personal health information of 247 patients and officials are in the process of notifying the families of those affected. Officials say the breaches were first noticed during an audit of the Netcare pat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"320e1a8513e5872747baceaab6f3393810dbdcee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2A4D9DD-3420-4CD4-B6F9-CDD19959EA49"},"incident_date":"2013-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8db98e84c84d","org_name":"Advantage Health Solutions","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox59.com/2013/07/01/clients-discover-security-breach-on-insurance-carriers-patient-portal/#axzz2bIoB7DTa"}],"summary":"Programming error allowed health care clients to view other clients' records. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-05-31","discovered_date":"2013-03-06","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0710a3bdbf0d6dbd2793c22ec06bfa467e5704a","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-06-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RentPath%20Notice%205.31.13_0.pdf"},"notes":null,"org_country":"US","org_id":"8291818e3aed","org_name":"RentPath","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41894"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RentPath%20Notice%205.31.13_0.pdf"}],"summary":"RentPath reported that stolen computer storage devices may have exposed personal information, including Social Security numbers and limited financial information.","supporting_quote":"We recently experienced the theft of over fifty pieces of computer hardware from our facilities.","technology_involved":["computer storage devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5184e14e8a1be591718ff3e4ed3da85579f64054","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAEFA519-053C-4E00-A427-5058A9FDCEDF"},"incident_date":"2013-05-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f72d583621b8","org_name":"Hospital for Special Surgery","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234891.pdf"}],"summary":"The DA alerted the company that one of their employee's credit cards had been used for fraudulent transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34e8f07052d18005f4d9d7438939c56e0585f03d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75AC9981-8FD3-419C-B0C8-F57E92A70EA1"},"incident_date":"2013-05-31","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65237ef5b956","org_name":"Florida Department of Education","org_type":"government","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gainesville.com/article/20130624/ARTICLES/130629827,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abcactionnews.com/dpp/news/dept-of-education-personal-info-breach-for-47k-teacher-prep-participants,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cr80news.com/2013/06/26/security-mishap-exposes-florida-teachers-personal-information-on-google"}],"summary":"The information of 47,000 Florida teachers was publicly accessible for 14 days after a data transfer at Florida State University.  The information was from teachers participating in state prep programs.  The Department of Education used Florida State University as the contractor ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83633ed189e7bdde4acd1307796fec4774f45d7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A68DB0CD-7AA3-4FCB-A238-D393B71A1282"},"incident_date":"2013-05-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8885fce2d69","org_name":"Tri - State Surgical Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-230937.pdf"}],"summary":"Without the victim's knowledge or consent, and in violation of our office policies, a physician formerly associated with our practice requested that one of our administrative staff provide him with the names and contact information of our patients, presumably for purposes of noti","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25a4f35c57664d2aaa30b37d17b4cd06e88f5730","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EC6F10D-41D5-4060-907F-4459EE236E5A"},"incident_date":"2013-05-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f2e2958ca30","org_name":"Sterne, Agee and Leach","org_type":"financial","ransomware":null,"records_affected":140000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/missing-laptop-impacts-brokerage-firm-a-7021"}],"summary":"Sterne, Agee and Leach, which provides investment banking and brokerage services, says that between May 29 and May 30, a laptop issued to an employee went missing. The laptop was password protected, but was not encrypted,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e852dad9155b8cb947355e204f99046b6ee53026","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"927CDE03-7EC4-4B45-A767-F74AE6168600"},"incident_date":"2013-05-30","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cdefab7e0509","org_name":"Compound Semiconductor","org_type":"manufacturing","ransomware":null,"records_affected":4610,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/30/compoundsemiconductor-net-breached-by-st0rmyw0rm-credentials-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Compound-Semiconductor-Hacked-in-Support-for-Julian-Assange-357064.shtml"}],"summary":"4500 records including usernames and clear-text passwords stolen via SQLi and posted on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23929332e0798fd27b924ccb37c6346d1e2a368c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BE6E921-7C6E-4079-A754-A91D21DE7F69"},"incident_date":"2013-05-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2cc6582cb6fd","org_name":"Albany International Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/30/albany-international-airport-new-york-hacked-data-leaked-by-ag3nt47/"}],"summary":"Regional airport website hacked and administrators names and hashed passwords disclosed on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-05-29","discovered_date":"2013-05-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e26017807e65aae30399877de085e980f964b8b3","impact_type":"data_theft","incident_date":"2013-05-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Target%20Marketing%20Breach%20Notice%20Letter%20Consumer_0.pdf"},"notes":null,"org_country":"US","org_id":"3f7fe6f95c32","org_name":"Target Marketing","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41887"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Target%20Marketing%20Breach%20Notice%20Letter%20Consumer_0.pdf"}],"summary":"An unauthorized third party accessed Target Marketing’s online e-commerce platform and obtained personal and payment card information.","supporting_quote":null,"technology_involved":["online e-commerce platform"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db8797b4813f00adc14c6c9deff0ab20f2015738","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D840431D-E9DE-4818-B999-8BE3C1874B4E"},"incident_date":"2013-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ce8ff73f25e","org_name":"Samaritan Regional Health System","org_type":"healthcare","ransomware":null,"records_affected":2203,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"2203 records disclosed via paper documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6f2d9d42a093cc1fc888a7aed0507159525c424","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B68AEBD4-EB32-4168-AECC-559CEBF5FB42"},"incident_date":"2013-05-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70f54bda9c93","org_name":"Drupal.org","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.crn.com/news/security/240155793/drupal-org-gets-hit-with-data-breach-resets-passwords.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/05/drupal-org-resets-login-credentials-after-hack-exposes-password-data/"}],"summary":"A hacker or hackers exploited a vulnerability in a third-party software and used it to access accounts on drupal.org. The hackers were able to upload files to the association.drupal.org and compromised Drupal's serer. Accounts on groups.drupal.org may have also been exposed. User","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2013-0632"],"data_types":["personal"],"disclosed_date":"2013-05-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"246f3755bb8669de9a5fd6faf259aee306355855","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF6E39F8-ACDC-4D3D-8FAC-7E8FCF6F90F7"},"incident_date":"2013-05-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13319e390f9f","org_name":"National White Collar Crime Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/10/data-broker-hackers-also-compromised-nw3c/"}],"summary":"The same miscreants responsible for breaking into the networks of Americas top consumer and business data brokers appear to have also infiltrated and stolen huge amounts of data from the National White Collar Crime Center (NW3C), a congressionally-funded non-profit organization t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2013-0632","kev_added":"2022-03-03","name":"Adobe ColdFusion Authentication Bypass Vulnerability","days_listed_before_incident":-3201,"product":"Adobe ColdFusion"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-28","discovered_date":"2013-04-15","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6817f7649b251c37bc7bd33905fec780171ebe42","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Godiva%20CA%20Online%20System_0.pdf"},"notes":null,"org_country":"US","org_id":"9c0eab5e65f5","org_name":"Godiva Chocolatier, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee apparently lost a flash drive containing employment data.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41881"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Godiva%20CA%20Online%20System_0.pdf"}],"summary":"Godiva reported that a lost flash drive containing employment data was accessed, with no evidence that others copied or misused the information.","supporting_quote":"It is believed that this employee lost the flash drive on or around Lexington Avenue in New York City.","technology_involved":["flash drive"],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-05-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c289642d888599306aaeee0a01275fd27d562059","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1BC6CF9-BE56-4CCC-BD69-48CCE7EDDF74"},"incident_date":"2013-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d23af6a1ae1","org_name":"City of Lansing","org_type":"government","ransomware":null,"records_affected":8951,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mlive.com/lansing-news/index.ssf/2013/05/lansing_city_website_hacked_by.html"}],"summary":"Website defacement and dump of server contents onto public site by activist group. Hacking methods not disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":"@Ag3nt47","variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-05-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58c61695271b60f605554dae4792793e2b6102ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6CAC907-FC8C-473A-9290-3D71ED2760A6"},"incident_date":"2013-05-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4fbd7e013670","org_name":"Monsanto Co","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworm.net/2013/05/monsanto-uk-hacked-again-by-ag3nt47.html"}],"summary":"Monsanto Uk (http://www.monsanto.co.uk/) hacked by Ag3nt47, database leaked.  Monstano is Agricultural company and helps farmers around the world to Improve the yield  sustainably so they can be successful, produce healthier foods, better animal feeds and more fiber, while also r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"ag3nt47"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-05-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44d9d60b416bdc5edef380fcfe22c0502e86476d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F719A1A-9376-402E-BB9C-4F1E71B68851"},"incident_date":"2013-05-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"8f5a9287a45b","org_name":"Isuzu France","org_type":"manufacturing","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/27/isuzu-france-hacked-data-leaked-by-pentester_1996/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.heypasteit.com/clip/0TMT"}],"summary":"Isuzu.fr site compromised via SQL injection. Attacker posted DB contents to public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c73699eb18572af3689d9911571ba73dd3c06e8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC5A7915-DCD6-4565-8E8E-90DED57EDF9D"},"incident_date":"2013-05-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43e7a8254582","org_name":"South Florida Neurology Associates, P.A.","org_type":"healthcare","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Laptop theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fad16b1a947b68f4d871a0c4ee316c4043ac366e","impact_type":"unknown","incident_date":"2013-03-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Vendini%20Patron%20Letter%205-22-13_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6915be16ae85","org_name":"Vendini, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41854"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ee415539bed19fdfd24db0a7cf0543a1ef09e49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30E608BB-84B5-44BC-A6FD-817C7E93F58C"},"incident_date":"2013-05-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a6d9f8b3759","org_name":"Seattle Cancer Care Alliance","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.seattlecca.org/article/SCCA-Unencrypted-Notebook-Stolen.cfm"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec8fce01649ded1b311c2a2391628a4a0a7f25f9","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter_0413_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41862"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41861"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3d29eb944ebea991363c216ba7e1405aab618a7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4568990-DA66-4236-ACDC-F63753B4A556"},"incident_date":"2013-05-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Patient%20Notification%20Letter_0.pdf?"}],"summary":"Patients who visited Sutter Health's Alta Bates Summit Medical Center, Sutter Delta Medical Center, or Eden Medical Center may have had their names, Social Security numbers, dates of birth, gender, addresses, zip codes, home phone numbers, marital status, names of employers, and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b529d95c47cee4d496ac11fc98fca1e32ca68b1a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03A13012-9A09-4160-B446-3771EA3E76FB"},"incident_date":"2013-05-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"bfa36891f655","org_name":"Groupon Taiwan","org_type":"professional_services","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/asia/2013/05/28/groupon-taiwan-resets-user-passwords-after-hack-but-credit-card-details-not-leaked/;http://www.groupon.com.tw/docloader.php?id=publicannounce;http://www.inside.com.tw/2013/05/28/groupon-taiwan-was-under-attack-on-5-19-2013"}],"summary":"Someone hacked into Groupon Taiwan and stole user names and encrypted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0dcbde247d3c9ec7df00447ca7615c43016bc80f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6C62E0F-F738-4166-B97B-C91D6286894F"},"incident_date":"2013-05-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ee49d7a79f7","org_name":"Union Security Insurance Company","org_type":"financial","ransomware":null,"records_affected":1127,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv"}],"summary":"Improper disposal - email.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f85551afaa18432cb0952b0ef3986d03dfba053","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE9E04CC-E30D-4B55-B534-311CCCB157CC"},"incident_date":"2013-05-17","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0de8def7ea0d","org_name":"Sight and Sun Eyeworks","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/florida-optometrist-reports-data-breach-affecting-9000-patients.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://sightandsun-gulfbreeze.com/wp-content/uploads/2013/06/Notice-SSEW_GB.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pnj.com/article/20130618/NEWS05/306180015/Info-on-9-000-patients-allegedly-taken-from-Gulf-Breeze-eye-office"}],"summary":"Florida's Sight and Sun Eyeworks Gulf Breeze recently began notifying 9,000 patients that their personal information had been accessed inappropriately (h/t HealthITSecurity).  In a statement on its Web site [PDF file], Sight and Sun stated that patients' names, addresses, Social ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f91ffab38bfc2f09e9787ac8fb3751d48ca1b0e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A0E2D60-5CD7-4E88-B364-19351B7538D2"},"incident_date":"2013-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"637937f40775","org_name":"Gulf Breeze Family Eyecare (Sight and Sun Eyeworks Gulf Breeze)","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/breach-notification-hipaa-privacy-security-46299-1.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/21/north-lincoln-community-health-reports-data-breach/"}],"summary":"Sight and Sun learned of a patient privacy breach on May 17.  Patient names, Social Security numbers, addresses, medical record numbers, and other personal information may have been exposed.  An employee accessed and copied patients' electronic medical records without legitimate ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"017a913fc503729e72f48c7e6828c24e01257d39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2306876C-FE5F-41F6-91A4-D4E913A7FE63"},"incident_date":"2013-05-17","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"757536b54f24","org_name":"Financial Times Ltd.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ft.com/cms/s/0/7a091972-bef3-11e2-a9d4-00144feab7de.html#axzz2VBOgifWv"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.business-standard.com/article/pti-stories/uk-s-financial-times-becomes-latest-syrian-hack-victim-113051701009_1.html"}],"summary":"Financial Times hit with phishing attack and hacked by Syrian Electronic Army","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4838947488a09fa4eb2ba715b4e6a0f10d7a0af1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"925AF669-7910-4E5A-A2FA-17B445E34804"},"incident_date":"2013-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"df8f41be6aa7","org_name":"Work and Income New Zealand","org_type":"government","ransomware":null,"records_affected":34,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://home.nzcity.co.nz/news/article.aspx?id=167023&fm=newsmain%2Cnrhl"}],"summary":"Government employee erroneously e-mails client information to unauthorized parties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e24fd7ae27d12fe52a714c146067bf2b26e7f90","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"577E9020-87C0-4B2A-AB03-BC1D2371AE37"},"incident_date":"2013-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e968a60b3123","org_name":"Kaiser Permanente Medical Care Program","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Member%20Notification%20Letter%20Sample%20FINAL%202013_07496_9.10.2013_0.pdf"}],"summary":"An electronic file with information pertaining to a pilot Wellness Screening competition at the East End Complex was accidentally emailed by a Kaiser Permanente employee to a member of the pilot planning team on May 16, 2013. The personal information in the file, which was collec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d60e35234a79f2f9557ea770465d951baa7ea1a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A7C47C0-E7C9-4FA7-A511-05E8F9552B1A"},"incident_date":"2013-05-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39c298c8444b","org_name":"Goldner Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/goldner-associates-20130531.pdf"}],"summary":"Hackers accessed an ecommerce company's hosting platform, exposing credit card data of customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b983a2830f91bd4a747ed6b5428a6c8d3cdfbcb5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E041C396-D7BE-48B6-BF6F-942A68141E31"},"incident_date":"2013-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00a98e0c1c8b","org_name":"Edgewood Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/edgewood-centre-20130520.pdf"}],"summary":"Email was misdelivered to a distribution list.  The attachment contained a spreadsheet with employee names, SSN, bank account numbers and the amounts of transfers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-05-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be3ef394ca57ff8b977fecd0b8cda93ab99e6752","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9662993-D156-4229-A2A5-F72874B4E9EF"},"incident_date":"2013-05-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b72a5a5e728","org_name":"CNA Foundation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234902.pdf"}],"summary":"A partner agency had an employee misuse access to CNA customer data to open bank accounts in the customers names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a50a23954926133f7958cdf3d91c488375a434c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A46474E1-4CB3-4DD4-8F49-A7C11EF593D7"},"incident_date":"2013-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f7fe6f95c32","org_name":"Target Marketing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Target%20Marketing%20Breach%20Notice%20Letter%20Consumer_0.pdf?"}],"summary":"The Target Marketing website was accessed by unauthorized parties on May 14.  People who used debit or credit cards on the online e-commerce platform may have had their names, email addresses, payment card numbers, expiration dates, and CVV codes accessed.UPDATE (05/29/2013): Shu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-05-14","discovered_date":"2013-05-16","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26ba77f930cd3237f53c9c43bf3df1b0f1634b63","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-05-14","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CardHolder_Notice_PRINT_0.pdf"},"notes":null,"org_country":"US","org_id":"549edca7e4cd","org_name":"Shumsky Promotional Agency","org_type":"professional_services","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":"A vulnerability in the e-commerce platform was patched the day after unauthorized access.","schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/shumsky-20130529.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/shumsky-hacked.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41885"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CardHolder_Notice_PRINT_0.pdf"}],"summary":"An unauthorized third party accessed Shumsky cardholder records through its e-commerce platform.","supporting_quote":"On May 16, 2013, Shumsky was notified by its e-commerce platform provider that o n May 14, 2013, an unauthorized third party accessed the e -commerce platform and accessed nearly 1,400 of Shumsky cardholder records.","technology_involved":["e-commerce platform"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"308144b8d8d234f943a33cfcc06a027750b53743","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"371113FF-AE00-4232-A3BF-5CE2548693F9"},"incident_date":"2013-05-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ed5e6dc16b0","org_name":"e-dreamz","org_type":"technology_saas","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsoctv.com/news/news/local/hospital-says-credit-card-information-2k-patients-/nXsCT/"}],"summary":"e-dreamz hacked, customers of their hosting product have non-public information exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84854841f265d36cea4b02bfe75f034fcb4d5517","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E00EAE6F-697D-47AF-B165-90BB14A27123"},"incident_date":"2013-05-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8218cd5fbc2d","org_name":"DENT Neurological Institute","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buffalonews.com/apps/pbcs.dll/article?AID=/20130514/CITYANDREGION/130519516/1003"}],"summary":"DENT Neurological Institute accidentally emailed the private information of more than 10,000 patients.  No sensitive medical files or Social Security numbers were involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7927412a1ac9f9ed7d21e0815f0234b4f05f6f86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C17975B-91A1-4A2A-8389-AD34AA31802A"},"incident_date":"2013-05-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e26b97d14dc2","org_name":"City of Akron","org_type":"government","ransomware":null,"records_affected":47452,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsnet5.com/dpp/news/local_news/akron_canton_news/city-of-akron-files-police-report-after-turkish-group-hacks-website"}],"summary":"The City of Akron's website and internal systems were hacked by a foreign group.  Files with 47,452 entries were posted online.  Names, Social Security numbers, account numbers, credit card numbers, credit card expiration dates, addresses, and other information were in the files.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"786746ad0455b8f317b1b9a70b98a7172a267a0e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8780A8F-79FD-425F-B1AA-E0DDEED5435D"},"incident_date":"2013-05-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe5457ea5df","org_name":"1st Source Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cyberinsecure.com/credit-cards-data-stolen-in-1st-source-bank-intrusion/"}],"summary":"Hackers broke into South Bend, Ind.-based 1st Source Bank system from the outside and compromised a server containing debit card data. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"431966e8b98a97879e0635e90f81509128f1dadd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85D3326D-3EB1-4ADE-A0B4-61D3AC8F8D65"},"incident_date":"2013-05-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"362fc00d79d5","org_name":"Texas Health Harris Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":277000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sdbmagazine.com/Shred-It-Records-Improper-Handling-Hospital.aspx#.Uf_Cl64Ltfc.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.star-telegram.com/2013/07/11/4997021/fort-worths-harris-hospital-says.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.texashealth.org/workfiles/HMFW/Microfiche_Incident.pdf"}],"summary":"The Texas Health Harris Methodist Hospital Fort Worth, Arlington, Texas, has begun notifying patients about a potential exposure of confidential information resulting from what it alleges is improper handling of microfiche by Shred-It, the vendor contracted by the hospital to han","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b07ea713c70c2217ac24be26b3ac8035a30e859","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14D69FDB-E830-4829-B698-503BDDB3FEF4"},"incident_date":"2013-05-11","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ac935c605c99","org_name":"Back in Motion Physiotherapy","org_type":"healthcare","ransomware":true,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.goldcoast.com.au/article/2013/05/15/451894_crime-and-court-news.html"}],"summary":"Ransomware prevents access to small business medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-10","discovered_date":"2013-04-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93d0a584683b4e6c6a44d80d32236c1f9ecc8303","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Letter%20Version%201_proof_PHH_0.pdf"},"notes":null,"org_country":"US","org_id":"217844b755e1","org_name":"PHH Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41751"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Letter%20Version%201_proof_PHH_0.pdf"}],"summary":"PHH Corporation reported that a temporary worker may have accessed personal information in employee and applicant personnel records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"360cad2edd06e14effba807137e1a4139d8b6fca","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B772729-918E-401B-8402-1D01D90A1C2A"},"incident_date":"2013-05-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"febb6fa49c6d","org_name":"Fifth Third Bancorp","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wane.com/dpp/news/local/bank-customers-information-stolen"}],"summary":"ATM Skimming","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e2a2246573f2bf57e5e25862bc714b9fbada3d5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB2BBDDF-6210-4936-B90F-868B71DE45BA"},"incident_date":"2013-05-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38cb90a009ec","org_name":"Aflac Incorporated","org_type":"financial","ransomware":null,"records_affected":678,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Laptop theft leads to disclosure of over 600 medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48daa58c84fbc90ae4412af40c64d0a997cca080","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F9599A3-90A3-4E24-8190-2BC8D714C3BB"},"incident_date":"2013-05-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ff8ccd890f7","org_name":"Name.com","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9239050/Name.com_forces_customers_to_reset_passwords_following_security_breach"}],"summary":"Hackers accessed Name.com servers and may have obtained usernames, email addresses, passwords, and credit card account information.  Customer passwords and credit card information were encrypted.  Customers were notified of the breach and received an email asking them to reset th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d01ba488db21d50c316ffd646557fcaca1a0e03b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3DA3039-A650-46FE-B936-F07BBCE3C381"},"incident_date":"2013-05-08","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a44a6f85faa6","org_name":"Michaels Stores, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/04/3-million-customer-credit-debit-cards-stolen-in-michaels-aaron-brothers-breaches/"}],"summary":"actor installs malware on Michael's point of sale machines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a6bbb61ed18a6a5a34aadc68c5d285e57592085","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26809755-DC05-4910-8E7E-26DAD3622576"},"incident_date":"2013-05-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3117089d73c4","org_name":"MassMutual Financial Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20notification%2060413_0.pdf?"}],"summary":"The 401(k) retirement plan information of certain clients was inadvertently exposed when a MassMutual account manager sent an email on May 8.  Names, Social Security numbers, investment elections, and account balances were included in the email.  A third party provider received t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7582a680b0050a621da68192f6d3e15799c050f6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C7BFA0C-9C15-40F0-AE86-24921AF963DB"},"incident_date":"2013-05-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e56b2e1bba9a","org_name":"EyeCare Associates of the San Ramon Valley","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://sanramon.patch.com/groups/police-and-fire/p/laptop-stolen-from-eye-doctor"}],"summary":"The burglar broke into the offices of EyeCare Associates of the San Ramon Valley and took the laptop, which held eye photos and names of 611 patients. There was a lock on the laptop, but that was broken.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9779848bcc742dd3f08458692df5df4140a85b42","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Equity%20Trst%205_8_13Security%20Breach%20NoticeBOTH%20_0.pdf"},"notes":null,"org_country":"US","org_id":"8bca820d0189","org_name":"Equity Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41731"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Equity%20Trst%205_8_13Security%20Breach%20NoticeBOTH%20_0.pdf"}],"summary":"An unauthorized third party obtained viewing access to customer information on part of Equity Trust Company’s computer network, with no evidence that information was acquired, copied, or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82ffb9d78d54c6d6abbece5f4942c933d95e3022","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDFCC4F1-7AB1-4BD1-9264-86C3DB6B1DC8"},"incident_date":"2013-05-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1de3eb7cb4fe","org_name":"California Department of State Hospitals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-41863"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41863"}],"summary":"An employee roster containing confidential personal information was posted to their website by mistake.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e5e9df2437a007e99a6015d83ce7208f5305f3b","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-03-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/State%20Notification%20Packet_0.PDF"},"notes":null,"org_country":"US","org_id":"e4b178692f94","org_name":"Tomren Wealth Management","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41702"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/State%20Notification%20Packet_0.PDF"}],"summary":"An unauthorized third party accessed a server containing personal and financial information, but the firm could not determine whether personal information was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a67539ebd5b5864a0cbd45f2eb84df4e43125b89","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34B43110-E96B-401F-B91A-E46C80D9DA96"},"incident_date":"2013-05-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75315cea5813","org_name":"Independence Care System","org_type":"professional_services","ransomware":null,"records_affected":2435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12891"}],"summary":"On May 7, 2013, Independence Care System, a managed long-term care plan serving senior adults and people with disabilities in New York City, discovered that, during a burglary at the home of a staff member, an ICS laptop containing information regarding 2,435 members was stolen. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b67d9b9d5f2993270ac7833913a72990903a7e23","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62FA19AF-54A9-41F5-833E-A09F6A0266F2"},"incident_date":"2013-05-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dd15687fe9e","org_name":"Department of Family and Support Services (DFSS)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/08/theft-at-dfss-in-chicago-could-lead-to-health-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/08/theft-at-dfss-in-chicago-could-lead-to-health-data-breach/#.UYrB5JVjSyk.twitter"}],"summary":"Nearly $41,000 in computer equipment was reported stolen from the Department of Family Support Services on May 7.  The Division on Domestic Violence and a satellite senior center share the building where the theft occurred.  The types of information that may have been on the devi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e353bf2299c9459c88b912edb29db87dcc83effb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BB7EDFC-50BD-4419-9D32-733F8DBCFDC8"},"incident_date":"2013-05-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"13d30698f6ba","org_name":"CenturyLink Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gigaom.com/2013/05/07/where-are-your-five-nines-now-centurylinks-nationwide-outage-affects-thousands/"}],"summary":"Issue with core routers caused major network outage for Century Link.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a27d72dedf68871f29783c4d252727e4035220b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FA5ACA4-4951-4E63-954D-CF3DB0F4016D"},"incident_date":"2013-05-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d72a7d7b21c6","org_name":"California Department of Public Health","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cdph.ca.gov/Pages/PH13-017.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://sanfrancisco.cbslocal.com/2013/05/07/2000-california-birth-records-found-in-unsecure-location/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41737"}],"summary":"A reel containing images of 2,000 State of California Birth Records from May through September of 1974 was found in a publicly accessible location.  Names, Social Security numbers, addresses, and certain types of medical information were in the birth record images.  People in San","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d8bdbaf00d3cf18c0b38962e3bdafabec3df3f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCB8E208-2BE1-4302-8263-D42DA3735325"},"incident_date":"2013-05-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6160898b5bb","org_name":"Genesis Health System","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://qctimes.com/news/local/subcontractor-s-web-security-lapse-leads-genesis-to-alert-former/article_302cc84f-d809-596d-acc5-dca77eeb2cdc.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://globegazette.com/news/iowa/former-patients-alerted-about-id-problem/article_ba69afec-0177-11e3-b35d-0019bb2963f4.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcrg.com/news/local/Firm-Alerts-Former-Davenport-Hospital-Patients-About-Possible-Data-Leak-218995031.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcrg.com/news/local/Firm-Alerts-Former-Davenport-Hospital-Patients-About-Possible-Data-Leak-218995031.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.modernhealthcare.com/article/20130812/INFO/308129983"}],"summary":"A Davenport-based company is alerting nearly 1,200 former hospital patients about a security lapse that exposed their names and birthdates to identity theft.  Genesis Health System has issued the warning. Genesis said a medical transcription firm didn’t establish a firewall to pr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58e42e58f1f80e2d62026203d34e83e794391bcc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5275537-7576-4BDE-B905-C155DF3344BE"},"incident_date":"2013-05-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6f20d0335de","org_name":"Cogent Healthcare","org_type":"healthcare","ransomware":null,"records_affected":32000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/12/cogent-healthcare-contractor-m2comsys-breaches-patient-data/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/firewall-error-by-m2comsys-exposed-32000-patients-information/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthit.com/story/32000-patient-records-exposed-contractors-unsecured-website/2013-08-12?utm_source=twitter&utm_medium=social&utm_content=1117873,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/FINAL%20Cogent%20Corporate%20Material%20-%20Patient%20Notification%20Template_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42430"}],"summary":"Cogent Healthcare announced late last week that M2ComSys, the organization’s transcription contractor, had exposed 32,000 patients’ data across 48 states. M2ComSys, according to the Tennessean, left physician notes available to the public from May 5 to June 24 because it didn’t a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c6ec117bbb29c9d5db1d7112b4bceacdafca338","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40C5B658-567A-43FB-867C-EC8D99EA9534"},"incident_date":"2013-05-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ad83d4685bb","org_name":"Dent Neurologic Group, LLP","org_type":"healthcare","ransomware":null,"records_affected":10200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/dent-neurologic-institute-informs-patients-of-data-breach;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"While human error is unavoidable from time to time, what healthcare organizations do to minimize the impact of those mistakes with health data goes under the microscope when breaches occur. DENT Neurologic Institute of Amherst, NY recently experienced a data breach and hasnt expl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-05-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0df45db976489ce416c22ba47906907e852eb864","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3ACED45-8843-40DA-B0C2-91F16D95FAEE"},"incident_date":"2013-05-03","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"481d93447f41","org_name":"theonion.com","org_type":"technology_saas","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-22435872"}],"summary":"Syrian Electronic Army uses Social Engineering to gain passwords to systems and then uses the passwords to post unauthorized twitter messages. Also posted content of staff email to their own Twitter feed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81199ddbb5b5b5503ce93f2003a1eec6346030e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A417236-25F9-4EB4-9791-B7D1BDF9A0E8"},"incident_date":"2013-05-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e02cae47ae4b","org_name":"Radiant Systems","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Radiant%20Final_0.pdf"}],"summary":"On September 23, 2013, Radiant learned that certain personal information concerning employees of The Fishermans Restaurant had been erroneous ly transmitted over a period of time to another Radiant Systems restaurant customer. These data transmissions took place from approximatel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf05c70132ff55ec22ad5483e25f5f0f77349f4b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AB94484-AC0A-487B-8910-69D73926B8F4"},"incident_date":"2013-05-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"07df858372aa","org_name":"Huntington's Disease Society of America","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/huntingtons-disease-20130722.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/huntingtons-disease-society-admits-security-breach.html"}],"summary":"The Huntington's Disease Society of America (HDSA) recently began notifying some of its employees, donors, board members and vendors that their personal information may have been exposed when an HDSA financial executive's webmail account was hacked on or about May 3, 2013 (h/t Da","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5dc870b780f0e45a16356aec14d563eb253ab2b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7838473-2BCD-4166-8614-F881764FF2EE"},"incident_date":"2013-05-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f1ed1fd594f3","org_name":"City of Oshawa","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mississauga.com/news-story/4169409-former-employee-sues-oshawa-following-social-media-leaks/"}],"summary":"internal employee leaks confidential information to facebook resulting in law suit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4185a6ba172efe5ea4a9f19437744df98820c63","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4F94598-26A8-4790-88A1-AFEB90B9C502"},"incident_date":"2013-05-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e75d9da39f5","org_name":"Lone Star Circle of Care","org_type":"healthcare","ransomware":null,"records_affected":8700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lscctx.org/security/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.statesman.com/news/news/data-breach-at-lone-star-circle-of-care-affects-87/nkFyY/"}],"summary":"Patient personal data lost due to theft of a laptop from an employee's car.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e51407675764ea483556f20f68bf119725504fa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C791A9B-32B0-4715-979A-404603CF498B"},"incident_date":"2013-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"f0465874f2a6","org_name":"Yahoo Japan Corp","org_type":"technology_saas","ransomware":null,"records_affected":22000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/05/17/us-yahoojapan-idUSBRE94G0P620130517"}],"summary":"Yahoo Japan Corp said on Friday night it suspected that up to 22 million of its user IDs may have been \"leaked\" and it detected an unauthorized attempt to access the administrative system of its web portal Yahoo Japan, the Kyodo news agency reported.  The leaked information does ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ff285ea0b0387a358fab270b8e7f73a604a0460","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FE778A5-DEBE-4D59-BF2C-EB6E21D6D3AA"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4941eb3e8005","org_name":"Walmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.sun-sentinel.com/2013-06-12/news/fl-greenacres-walmart-fraud-20130611_1_credit-card-personal-identification-information-customer"}],"summary":"Nayeliz Soto told police she knew it was wrong to use credit card numbers stolen from customers to make more than $6,000 in purchases at the Greenacres Walmart where she worked.  But she wanted to help co-worker Nadia Saint Jean feed her children, according to Greenacres police. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70d33ef40bbc00092fe3150da600db9ab51a72bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15C7DDC7-14DE-4A02-9B8C-CBDAD1F42512"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6f40d379f70","org_name":"US National Security Agency (NSA)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/09/24/usa-courts-leak-factbox-idINDEE98N00220130924"}],"summary":"\"U.S. officials said in June 2013 they had filed sealed criminal charges against former NSA contractor Edward Snowden for unauthorized leaks and theft of government property.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aeac219969ef0e3510e09ff284fed9df47ad4d5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC8630B0-A779-437E-8048-7AFF80220BCD"},"incident_date":"2013-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6510437c7f0d","org_name":"University of South Florida Health","org_type":"healthcare","ransomware":null,"records_affected":140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wusfnews.wusf.usf.edu/post/usf-health-investigating-patient-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/tampabay/news/2013/09/09/usf-patient-information-breach-probed.html"}],"summary":"A custodial employee of USF Health was found to have in there possession, personal information of 140 patients including: names, dates of birth and social security numbers. The records were found in the employees car during a traffic stop.  USF has not received any indication tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b854c24a750bbcd916d727a7637e95b77cc44bfd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFAA881C-1365-4E73-94F2-EEDF88378AAF"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64c4d3713258","org_name":"University Medical Center of Princeton","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nj-woman-sues-hospital-claims-hiv-status-was-revealed-in-security-breach/"}],"summary":"Woman sues hospital, claims HIV status was revealed in security breach - University Medical Center of Princeton.  She said in the lawsuit that she was hospitalized at PHS in May of 2013, which was when the hospital created medical records for her, listing her HIV-positive status.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe03f4801d5bb64ad90f68e889258ea1fa4e5e37","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCA71192-885B-4E77-BD5B-C38709896E70"},"incident_date":"2013-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c88ff8bd60a0","org_name":"Treasure Island","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chicago.cbslocal.com/2013/05/03/feds-probe-supermarket-customer-id-theft-incidents/"}],"summary":"Super market identified as CPP, over 50 victims of CC theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc691d2ff4594414841bb1df7cad86119201911b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8EBCDB1-EA35-41F5-A2AC-2CA907B21734"},"incident_date":"2013-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d7232057e74","org_name":"Town of Brookhaven","org_type":"government","ransomware":null,"records_affected":78,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/long-island/towns/brookhaven-data-breach-was-clerical-error-officials-say-1.5426405"}],"summary":"A law enforcement employee made a clerical error that caused the Social Security numbers of 78 ambulance workers and beneficiaries to be available on the town website for five days.  The information was accidentally attached to a resolution.  A very similar error had occurred bef","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"997058ee7a94d42ee5cfdd21b9a0ee2a73284022","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1E9078F-3B98-4FE4-B4B0-5ED9EEE8642D"},"incident_date":"2013-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5ff7ca2c0301","org_name":"Royal Free Hospital","org_type":"healthcare","ransomware":null,"records_affected":78,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hamhigh.co.uk/news/royal_free_hospital_in_clear_after_losing_medical_records_of_78_pregnant_women_1_2796643"}],"summary":"A midwife lost an appointments diary in May which contained details of visits by 78 women to antenatal clinics between January and May this year.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"499fe7677a2e1f1a900f5ead10723e9000c4038a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F58E9169-AC07-400E-AB0E-DB784C6CAE59"},"incident_date":"2013-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea1895ad14dd","org_name":"Parametric Technology Corporation","org_type":"technology_saas","ransomware":null,"records_affected":1753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/30/parametric-technology-corporation-breached-1753-account-credentials-leaked/"}],"summary":"Website hacked using SQL injection; database contents dumped on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a77c19d2751405bebd8a31b2a6a937213a81b6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCC5E334-EB82-49FE-BD56-85C22D426BC8"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2b7f5456c603","org_name":"Oromocto High School","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/story/2013/05/10/nb-carr-privacy-breach-637.html;http://www.cbc.ca/news/canada/new-brunswick/story/2013/08/22/nb-carr-privacy-breach-student.html"}],"summary":"Student received grade information before it was released by school, political staffer leaked the information.5","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1da5070f378f54d76766a85cf74758e752ead52a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"354150F4-050C-429D-827F-A365D4A01BB6"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ffc7df3a1295","org_name":"NZ Defense Force","org_type":"government","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/dominion-post/news/9244711/Veterans-sensitive-information-stolen"}],"summary":" A former New Zealand Defence Force staffer has pleaded guilty to stealing sensitive information about veterans and is to ask to be discharged without conviction.  Jacqueline Mateara, 46, admitted the charge of accessing a computer system to dishonestly obtain a spreadsheet which","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Guccifer","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41d17bb2a2be84a3e9c09f30f9ff1258c062c4fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17F5875C-2B48-4284-966B-573691B20F3F"},"incident_date":"2013-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4f43b622580","org_name":"National Intelligence Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesmokinggun.com/buster/guccifer-hacks-obama-intelligence-official-567983"}],"summary":"After detours targeting Sex and the City author Candace Bushnell and journalist Carl Bernstein, the hacker Guccifer has returned to his bread and butter criminality, breaking into the e-mail account of an Obama administration official who heads the National Intelligence Council. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"guccifer"}},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"585fcb79741a33fad3556e20bfad234f30a5d19f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C624093E-78DE-4CF8-A31E-B87DE0354806"},"incident_date":"2013-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"c4b445708743","org_name":"National Farmers Union Mutual Insurance Society Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2339351/Animal-activists-claim-hacked-NFU-insurance-company-steal-financial-data-badger-cull-supporters.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://earthfirstnews.wordpress.com/2013/06/11/friends-of-badgers-hack-into-nfu-mutual/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/06/14/badger_cull_hacktivism/"}],"summary":"Animal rights activists claim to have breached the computer systems of a bank which provides funding to a group that has advocated a badger hunt. No evidence of actual breach has been provided thus far.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"585f346fe534e91de84a64d38a71e9ca5a2645bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"109CF61D-8B84-4C30-8D0F-AF5951C08459"},"incident_date":"2013-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"371bdf8862ea","org_name":"EX ARMY UK","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theintelligencer.com/local_news/article_a717e6fc-cf90-11e2-a095-001a4bcf887a.html"}],"summary":"Website of UK company that sells used military vehicles compromised via SQL injection and sensitive data posted to public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fc72245ddb3ae31e99b308b828d9f9efb14b07d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DF9ABA9-D347-41F9-9135-1CF8AA0FF697"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70bee7ac140a","org_name":"Emerald Garden","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nursing-assistant-sentenced-to-3-years-for-selling-patient-ids/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/courts/criminal/bay-area-nursing-assistant-gets-three-years-for-selling-patient-ids/2149804"}],"summary":"inside misuse, stealing records, tried to sell to undercover detective.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a99b5b6d8bcd70c8ce8b40ada6d562ddc5faa28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF5B2AA4-7CAA-4A22-9AB2-CC955F0F9913"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1c7dcde0bc48","org_name":"Becton, Dickinson and Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconindia.com/news/general/Indian-National-Admits-Stealing-Trade-Secrets-in-US-nid-167198-cid-1.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/bd-mahwah-man-took-vystra-trade-secrets-1.588982?page=all"}],"summary":"Internal actor copied trade secrets before quitting and planning on moving back to India. DLP discovered the data transfer and suspect was arrested on June 20, 2013. Hard drives seized were found to store trade secrets from 2 organizations. The first victim company was modeled in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1e11c2deea0a4672c5bdd162e6250245ef136e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"e07cba20-9404-11e7-967f-a9fa27eb51b9"},"incident_date":"2013-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globalnews.ca/news/3328360/former-ahs-supervisor-convicted-of-inappropriately-accessing-health-information/"}],"summary":"A former supervisor of health information management with Alberta Health Services was slapped with a $5,000 fine on Tuesday after being convicted of 13 counts of accessing health information in contravention of the Health Information Act.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5f02271fa3453ae75430a613dbbc6741690253a","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-04-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notification_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"27f396e3c02f","org_name":"Quayside Publishing Group","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42124"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Quayside%20Publishing%20Consumer%20Notice.pdf"}],"summary":"We have established that malicious software planted by an outside source may have been able to access your credit card information, name, and address during your recent transaction with us at with one of our ecommerce sites: Qbookshop.com, Qbookshop.net, Motorbooks.com or WalterF","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62cd9999458e4c588493d7b29988760a2d1c76fb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16CCB166-E40A-4203-8431-246893E53654"},"incident_date":"2013-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d167d30126c","org_name":"Maricopa Community Colleges","org_type":"education","ransomware":null,"records_affected":2490000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azcentral.com/community/phoenix/articles/20131127arizona-college-students-data-breach.html?nclick_check=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc15.com/news/let-joe-know/millions-of-maricopa-county-community-college-students-staff-notified-of-security-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/maricopa-colleges-waited-7-months-to-notify-2-4-million-students-of-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/phoenix/news/2013/11/27/mcccd-notifies-25m-about-exposed.html?page=all;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpho.com/story/24769619/mcccd-it-employees-district-knew-about-security-concerns;"}],"summary":"The Maricopa County Community College District waited seven months to notify 2.4 million current and former students and employees that their academic or personal data were compromised in an April security breach.  The districts governing board has already approved several millio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5885c7e65afb2b93254865dbfe65a7c6c994f656","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FF88B2F-BB6D-4C92-B1D9-BA99EC5ECA3C"},"incident_date":"2013-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1640ec91d8b","org_name":"Automatic Data Processing (ADP)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/mckesson-20130809.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/US%20Airways%20ltrt%20employees%20re%20breach%20.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/news/houston-texas/houston/article/Payroll-company-error-prompts-security-breach-4611194.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/fedex-20110624.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://posttrib.suntimes.com/news/porter/22190511-418/valpo-ambulance-users-could-have-had-personal-information-stolen.html;"}],"summary":"On August 9, McKesson notified the New Hampshire Attorney Generals Office that it was sending out notifications to some of their employees that their names, Social Security numbers, and gross wages may have been embedded in PDF tax statement files of other employees prepared by A","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abc35b25984c8f1a29579f139fa3c519e67c89d5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EACD464C-74B2-4796-84F7-8AA5DF44BC34"},"incident_date":"2013-04-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2187556ed737","org_name":"Mineralogy","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://finance.ninemsn.com.au/newsbusiness/aap/8649996/sensitive-documents-stolen-from-clive-palmer"}],"summary":"The office of the mining magnate Clive Palmer was broken into and sensitive business documents were stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1cebdcbae0ee4a978e7033ba45f01abdda8d9b0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BC8D4E8-8DCE-4C32-A6B3-12C65C56C049"},"incident_date":"2013-04-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"763d6efb199b","org_name":"Millimaki Eggert, LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Millimaki%20Eggert%20CA%20Sample%20Notice%20Letters_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42109"}],"summary":"The April 27 office burglary of two password-protected laptops resulted in the exposure of sensitive client information.  Names, Social Security numbers, and addresses may have been involved.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c4c5faa3c55de7e9d402532d9f21330dfdcb6ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00D61A42-0F72-467C-994E-48348F080945"},"incident_date":"2013-04-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"080fdf964966","org_name":"Sutter Physician Services","org_type":"professional_services","ransomware":null,"records_affected":2582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/B3245_V3_PMID_SMF_0.PDF"}],"summary":"A former employee reportedly emailed patient information to a personal account without authorization, leading to a Sutter Health data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"454a5924ed944c58006a3a932293f2776dcecc7b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A62898A7-8145-44CD-A655-662C8FFE23F5"},"incident_date":"2013-04-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8fb591819149","org_name":"IHC Health Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in the exposure of 857 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8eb5e142ad8fc581ada7e8478073f97d7aa19ef1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F256B91D-A8E9-49D5-9B18-B7A0DF5E1152"},"incident_date":"2013-04-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b7e5296034e","org_name":"Federal Communications Commission","org_type":"government","ransomware":null,"records_affected":127000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10news.com/news/privacy-on-the-line/security-lapse-exposes-some-lifeline-phone-customers-to-id-theft-risk05242013?goback=%2Egde_36573_member_244316565,"},{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/scripps-reporters-accused-of-hacking-in-disclosing-lifeline-data-breach/"}],"summary":"Around 44,000 application forms and 127,000 supporting documents for Lifeline were posted online.  Lifeline is a federal program that provides discount internet and phone service for low-income Americans.  Information such as name, Social Security number, scans of food-stamp card","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"LulzSec","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2013-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"960946c48d00073fcc242be03f3f0717732b374e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B40E3D3B-9A91-475D-B79A-940D6F3C0533"},"incident_date":"2013-04-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"c3350ed534ca","org_name":"docomo","org_type":"professional_services","ransomware":null,"records_affected":2208,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/04/28/ntt-docomo-releases-notice-its-been-breached-apologizes-for-the-credentials-leaked/;http://www.esecurityplanet.com/hackers/lulzsec-hackers-hit-ntt-docomo.html;http://www.esecurityplanet.com/hackers/lulzsec-hackers-take-down-ntt-docomo-usa.html"}],"summary":"After publishing customer information taken from NTT DoCoMo on Friday, members of LulzSec today announced that they had knocked NTT DoCoMo's U.S. Web site online (h/t Cyber War News).  \"TANGODOWN - http://docomo-usa.com #lulzsec #antisec #StopCISPA We are lulzsec. The most wanted","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"lulzsec"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13bb2b19c6c15f946c57d0e3eba914c5069e2d6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1D14E38-6896-4EDB-BA54-636C9E9E39EE"},"incident_date":"2013-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0f8e9dde879","org_name":"Jacksonville Spine Center","org_type":"healthcare","ransomware":null,"records_affected":5200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Approximately 5200 records were disclosed in paper-based security incident. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e0c87bb19b0f2c632301d7d643f36ba74199a69","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEFA7E95-8E63-4C89-8DA3-22CCAE8FD13D"},"incident_date":"2013-04-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d143a7926b2","org_name":"NYC Bike Share","org_type":"other","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gothamist.com/2013/07/23/citi_bike_glitch_exposes_personal_i.php"}],"summary":"NYC Bike Share discovered that customer credit card numbers, names, and addresses had been posted on a publicly accessible page of its website.  The glitch was corrected after being active between April 15 and late May.  Customers who initially entered their information incorrect","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b9d0d6900bc6d8b68755bc6341ec1b3ae6f20c8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F2A8478-9005-4E43-B1A2-5A06EE510169"},"incident_date":"2013-04-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09ec7010e501","org_name":"Colonial Properties Trust","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/colonial-properties-acknowledges-data-breach.html"}],"summary":"Malware infection on network led to potential disclosure of PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0168a39350bf603dd49791e3b08cb7e03873738a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5480B27-82B6-475C-A1BD-F8DD7C696AA2"},"incident_date":"2013-05-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A Patient was sent a letter stating \"You are eligible to participate because you are currently applying for service connection for PTSD.\". The letter was sent to his fathers house and arrived unsealed.  Resolution: notification letter sent - research will now seal their own envel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"493dfcdc4a31640e467a2bb6f656cf2e14acb8a3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFAC49C9-FA91-4AE4-97E4-3D7BCC54306A"},"incident_date":"2013-04-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/fifas-sepp-blatters-twitter-accounts-hacked.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://deadspin.com/someone-hacked-fifa-president-sepp-blatters-twitter-ac-477112105;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/sport/football/article-2313048/Sepp-Blatters-Twitter-account-hacked.html"}],"summary":"FIFA's and FIFA president's Twitter accounts were compromised. Tweets were posted by Syrian Electronic Army regarding bribery, and falsely announcing the presidents resignation. To the dismay of many football fans, the resignation tweet was untrue.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"096750edee5a21c5d0fb53c1bcd28a74fcc7529a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54CBBA16-B80E-4D43-9237-E2147DC57AB0"},"incident_date":"2013-04-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b85cced1d67","org_name":"Northwestern Mutual","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227161.pdf"}],"summary":"Briefcase is stolen from a vehicle, exposing paper documents with client information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2084af368e62bbd4416ad7bb9813f31f8e27a15b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1602A8DA-DB8E-4AD5-9ECE-B10A7FBA87BA"},"incident_date":"2013-04-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"db75f549d4ea","org_name":"London Marathon","org_type":"other","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-london-17820700"}],"summary":"The home and email addresses of the 38,000 entrants to the London Marathon were accidentally published on the organisers' website, the BBC has discovered.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bae3f2841942ac69419d170e12aea85a08125fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88222599-3725-418D-A8AF-614573754FE4"},"incident_date":"2013-04-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"63c06f7943fe","org_name":"Interior Health Authority","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kamloopsnews.ca/article/20130423/KAMLOOPS0101/130429948/-1/kamloops01/iha-investigating-confidentiality-breach"}],"summary":"Patient medical information was erroneously send to wrong number via fax transmission","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f31957facada6587da73bbc1ead4d5478ea46e7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD5A8A6F-AF37-41F0-93D5-C657B92F9767"},"incident_date":"2013-04-18","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NG","org_id":"c7a092dd2e29","org_name":"Nigerian Entertainment TOday","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bellanaija.com/2013/04/19/thenetng-online-gets-hacked-hackers-demand-ransom-alternate-website-up/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thenet.ng/2013/04/how-cyber-criminals-hacked-net-website/"}],"summary":"External actors gain access to domain hosting account and hijacked DNS resolution to thenet.ng. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acc0b2a5c90e0aab570918c00fc03edb25fef186","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9ECDBD95-C260-4858-B182-D45F39E72E1D"},"incident_date":"2013-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f105b5459d7","org_name":"North Lincoln Community Health Center Clinic","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/21/north-lincoln-community-health-reports-data-breach/"}],"summary":"An April 17 burglary resulted in the possible exposure of patient information.  Someone entered locked rooms and cabinets in order to take money.  No records or electronic devices were taken; however the room where client medical charts were stored was accessed.  Social Security ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e3fb794b8493146150fda6c31ea1d40bba6f87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCA95D08-86CC-4510-9CD6-965801977DA7"},"incident_date":"2013-04-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2e374a82600","org_name":"Fayetteville VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1093,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldsun.com/news/blog/state/x265261342/AP-NC-veterans-personal-data-left-in-recycle-bin"}],"summary":"Medical center employee erroneously placed medical information in recycling bin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44ae1346e7986de73b364a7f8c329a32b3d26b9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25E6A9D0-8CEB-4369-A38C-EB381FA2BEB6"},"incident_date":"2013-04-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1093,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/veterans-patient-information-found-in-recycle-bin/article/299254/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wtvd/story?section=news/local&id=9139985"}],"summary":"On April 17, the sensitive data belonging to patients of the hospital's optical shop was improperly disposed and found in a recycle bin. According to a release by the hospital, officials believe the documents were there for more than a three-month period.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cb79ee000ce8fa0022760aef582cb66676e45a1","impact_type":"unknown","incident_date":"2013-04-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Beachbody%20Notice%20Template_0.pdf"},"notes":null,"org_country":"US","org_id":"362afe7f222e","org_name":"Beachbody","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Beachbody%20Notice%20Template_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Beachbody%20email%20pre-notice%20and%20FAQ_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41882"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Beachbody%20Notice%20Template_0.pdf"}],"summary":"Beachbody sent a consumer notification letter about an incident and offered credit monitoring, but the provided text does not describe what happened or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f11e46ca7e04910c58ec65bfd3db9ca98b00371","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"338BA78D-EF7B-4E6C-8085-2EFD4165285B"},"incident_date":"2013-04-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4bc086e3ed56","org_name":"WestCoast Children's Clinic","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/OAG%20PHI%20BREACH%20SAMPLE%20NOTICE_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41576"}],"summary":"One copy of XX’s confidential psychological assessment report containing [patient’s] name; date of birth; current placement history; developmental and psychological treatment history; limited family history; educational history; current psychological concerns; testing data, inter","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eb4292ebb82d917cb59d7057d747dae15f4a1ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BF522B4-8C30-4714-BEB2-F2B237C333BC"},"incident_date":"2013-04-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83bca2b484f4","org_name":"Ephrata Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/ephrata-community-hospital-admits-security-breach.html"}],"summary":"An employee inappropriately accessed patient information.  The incident or incidents were discovered on April 16. Patient clinical and other medical information may have been exposed. No Social Security numbers were exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd778e3c2e3533b55d6753b7babe8940a5c62b57","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"105E4B67-AC51-439D-9FEC-C0AC85F7DFA8"},"incident_date":"2013-04-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"3bb7e76df89c","org_name":"Eastern Health Authority","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12470"}],"summary":"On April 16, 2013, a briefcase was stolen from another employee’s vehicle and the briefcase contained information on two patients. The briefcase has since been recovered and the patient information remained intact.  The two patients were advised of the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42b7f4ad6aa91fbe49c85c05f75ea6e816d823d1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9F26902-E705-42FB-92A0-6FD4EA07A705"},"incident_date":"2013-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AZ","org_id":"3fe8ae79483b","org_name":"Ministry of Communications and Information Technologies of the Republic of Azerbaijan","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/anonymous-hackers-hit-azerbaijan.html"}],"summary":"Members of Anonymous recently released 1.5GB of data stolen from the Ministry of Communications and Information Technologies of the Republic of Azerbaijan (h/t Cyber War News). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-04-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de962268ef5296c4894a3128d8a513014aa3aa3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0AA6AD6A-7EB2-4BB5-B9A1-319F0C00B3F9"},"incident_date":"2013-04-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae4a6210f801","org_name":"Linode","org_type":"technology_saas","ransomware":null,"records_affected":5500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://blog.linode.com/2013/04/16/security-incident-update/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/revenge-hack-put-5-5-million-domain-names-allegedly-at-risk-7000015107/"}],"summary":"Hackers exploited an Adobe vulnerability and used it to access Linode Manager web servers.  One of Linode's web servers, parts of their source code, and their database were accessed.  No other components of the Linode infrastructure were accessed by the hackers.  Encrypted custom","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0072495aa2f497dea3a8ea4f971480d63cd75c73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3BE8624-95EA-4FED-85B0-9AFAD5A13594"},"incident_date":"2013-04-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffdbdd1a7986","org_name":"SynerMed","org_type":"healthcare","ransomware":null,"records_affected":1566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Member%20Notice_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41928"}],"summary":"The theft of an employee's laptop resulted in the exposure of patient information.  The theft occurred on the night of April 14 or the early morning of April 15 when a thief broke into the employee's automobile.  The laptop was password-protected and reported missing on the morni","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8a6028ce97d5d437b2e4dfd84aee34d08a2867e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8162BB7-35C8-4FA1-BF5A-09F7FC0C5011"},"incident_date":"2013-04-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba98fd65410a","org_name":"Inland Empire Health Plan","org_type":"financial","ransomware":null,"records_affected":1566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailybulletin.com/news/ci_23455452/iehp-reveals-theft-laptop-members-records,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pe.com/local-news/topics/topics-health-care-headlines/20130613-health-care-laptop-with-patient-data-was-stolen.ece"}],"summary":"The Inland Empire Health Plan announced a potential privacy breach of personal health information for 1,566 of its members after an unencrypted laptop was stolen.  The equipment was stolen April 14 from a car owned by an employee of SynerMed, a Los Angeles-based company that mana","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bff0166234032026685c0b3db05557c2315705d6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39CF36D5-7DCC-4823-BA14-33D584BE742B"},"incident_date":"2013-04-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fef0fd4900b","org_name":"City of Norwood","org_type":"government","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"A laptop that contained protected health information was lost between the dates of April 4 and April 19.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16d52829d94421e95b3b96be8b5a084b3b138757","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECBC8BE2-848C-4AD9-9721-003C9ABEFEFE"},"incident_date":"2013-04-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d169ba1e09de","org_name":"Health Resources of Arkansas","org_type":"healthcare","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthresourcesofarkansas.com/assets/files/breach-of-conf-notice.pdf"}],"summary":"On April 14, 2013 staff members discovered that their location had been burglarized.  Names, Social Security numbers, addresses, dates of birth, diagnosis information, types of treatments, classes attended, court information, services provided, or insurance information of persons","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6491572907808bf7ec0bfbeffd80bd4b348fc6d2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3C7B2AF-4859-4CB4-A3E5-52C1BA60845B"},"incident_date":"2013-04-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f42a8f5b55d7","org_name":"Kathleen Whisman, M.D.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/california-physician-notifying-patients-of-breach-involving-old-patient-data/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/11/21/calif-ag-releases-breach-notification-letter-from-1999-incident/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification_2.pdf"}],"summary":"The California Attorney Generals Office released yesterday a copy of a data breach notification letter sent by California physician Kathleen E. Whisman to patients after the San Ramon, Calif. Police Department alerted her on April 11, 2013 that her patients data was part of an id","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-11","discovered_date":"2013-02-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2706db1faf56fada589253ef858fe298dd333fc8","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-02-27","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Version%20%28SENT%204-11-13%29_0.pdf"},"notes":null,"org_country":"US","org_id":"016c1f6ff93c","org_name":"Chapman University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41041"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Version%20%28SENT%204-11-13%29_0.pdf"}],"summary":"Chapman University notified individuals that personal information in electronic documents could have been viewed by authenticated users of its system, with no evidence of unauthorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-04-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1286a3380d23355e2f36a3d6bfd34b6aec3d7ae7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"064F5887-C2DA-4139-B3AA-D55906F8C30A"},"incident_date":"2013-04-10","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7be5939e0c7","org_name":"LexisNexis","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/"}],"summary":"An identity theft service that sells Social Security numbers, birth records, credit and background reports on millions of Americans has infiltrated computers at some of Americas largest consumer and business data aggregators, according to a seven-month investigation by KrebsOnSec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d063e61eaa3dc57590b57de5c39ed083c515e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99FB91D1-6C55-41E0-9054-0D709958DB0E"},"incident_date":"2013-04-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b43f39f5d12","org_name":"Indiana University Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://iuhealth.org/newsroom/detail/notice-to-iu-health-arnett-patients-regarding-missing-laptop/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jconline.com/article/20130510/NEWS03/305100032/IU-Health-Arnett-laptop-stolen?gcheck=1"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/indiana-university-hospital-laptop-stolen-contains-data-on-10k-patients/article/293088/"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69321655833b4f16e4f3b42a38aee104fb499e40","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEA236C9-2DDA-4B38-A42A-05722E99AB17"},"incident_date":"2013-04-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"906e85aa4b72","org_name":"Sedgwick Claims Management Services, Inc.","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sedgwick-claims-20130506.pdf"}],"summary":"We are writing to notify you that the name, so cial security number, and employee ID of a New Hampshire resident, who is a claimant in a case managed by our client Sedgwick Claims Management Services, Inc. (\"Sedgwick\"), may have been accessed or acqu ired, on or about April 8, 20","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"707bc7687edb83dfdc0f2b204c3bf1364d9e9b2f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BBE094F-0362-4176-81E9-8BA6DCC306AC"},"incident_date":"2013-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"6032d02bc34c","org_name":"Jpost","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securitybistro.com/blog/?p=6834"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jpost.com/Defense/Anonymous-targets-Israel-JPostcom-repels-hackers-308989"}],"summary":"Anonymous DDoS Attack Against Israel Leverages Botnet Network","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"812ab0a89102c99b853cd1d603cbe762c7d0160b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFB73B02-30B8-475E-BD42-706476387A03"},"incident_date":"2013-04-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"1f4574d6bdb2","org_name":"Israeli Government websites","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securitybistro.com/blog/?p=6834"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jpost.com/Defense/Anonymous-targets-Israel-JPostcom-repels-hackers-308989"}],"summary":"Anonymous DDoS Attack Against Israel Leverages Botnet Network","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"410032479852e710f4a65131bf54f8aa9eb1010a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35429189-3B9E-4E96-B158-FE290907B437"},"incident_date":"2013-04-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c175b17ae04","org_name":"Indiana Family and Social Services Administration","org_type":"government","ransomware":null,"records_affected":187533,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/indiana-agency-notifies-188000-breach-a-5893,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=13017,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mondaq.com/unitedstates/x/251472/Healthcare/The+Parade+Of+PHI+Security+Breaches+With+A+New+Large+Breach+Indiana+Family+And+Social+Services+Administration+Marches+Again"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalgazette.net/article/20130701/NEWS07/130709958"}],"summary":"The Indiana Family and Social Services Administration is notifying almost 188,000 clients that their personal information may have been inadvertently disclosed in mailings to other clients, apparently as a result of a computer programming error by a business associate. The inform","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c412145abb5e467a8596439764e58eb42617e47f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C2F1D6F-4D5D-433E-A384-7089B1F60F81"},"incident_date":"2013-04-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d53bb1c7d94","org_name":"University of Massachusetts - Amherst","org_type":"education","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/boston/blog/mass_roundup/2013/06/umass-warns-of-potential-patient-data.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fosters.com/apps/pbcs.dll/article?AID=/20130609/GJLIFESTYLES/130609504/-1/FOSLIFESTYLES,"},{"fetched_at":null,"title":null,"type":"press","url":"http://bostonherald.com/news_opinion/local_coverage/2013/06/umass_center_warns_of_possible_data_breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.berkshireeagle.com/ci_23391897/umass-center-warns-possible-data-breach"}],"summary":"The information of almost 1,700 clients of the Center for Language, Speech, and Hearing may have been exposed.  A computer workstation was found to be infected by a malicious software program.  Client Social Security numbers, addresses, names of health insurers, and primary healt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"065ae5c18356edae6882dac64cbf7496bc3447cf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"b0e25e30-e37a-11e7-bf7a-0771e1cc9602"},"incident_date":"2013-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4b3c32d2d6","org_name":"Children’s Medical Center of Dallas","org_type":"healthcare","ransomware":null,"records_affected":2462,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/childrens-medical-center-issued-3.2m-ocr-hipaa-penalty"}],"summary":"In this case, an unencrypted laptop was stolen between April 4 and April 9, 2013. That device reportedly contained the ePHI of 2,462 individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17d588a4d551b990dbe35664e47495a3339a2123","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Form%20Individual%20Notification%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"01d4a67b8da4","org_name":"Computer Sciences Corporation","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40959"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cc9f1fb99f100be0a10321ce8ab9174be61e5c0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47F2F904-BA6C-4825-B7C7-8B295F55D215"},"incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5b85a55d7c2","org_name":"William Jennings Bryan Dorn VA Hospital","org_type":"healthcare","ransomware":null,"records_affected":7405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/laptop-stolen-from-sc-medical-center-contains-data-on-7k-veterans/article/287907/"}],"summary":"A Department of Veterans Affairs (VA) laptop containing the sensitive data of several thousand patients was stolen in South Carolina. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d206e4ca5275e13fef7ef8f6f489841bde775a70","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D18D25B-83D3-4A86-97C3-F3A5364FD528"},"incident_date":"2013-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72b9e85d1854","org_name":"Wawa","org_type":"retail_ecommerce","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://6abc.com/archive/9063401/"}],"summary":"Gas station attendant uses hand-held credit card skimmer to steal customer credit card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91a984278a99b661a3b64c4318084501178b222e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90BAF7ED-0379-4976-A80B-084A19E18D3D"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d9fe4731b9e","org_name":"Vendni","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/michigan/royaloak/stagecrafters-ticketing-website-hacked"}],"summary":"Credit Card processing firm Vendini's servers hacked and PII and Credit Card info stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d35be17128630b8b647a0f8b475604ee750daca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A26F47AD-1504-4F01-8396-662C27564DDB"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"76535074a5e8","org_name":"Ulster Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishmirror.ie/news/irish-news/crime/bank-card-skimming-devices-left-2369654"}],"summary":"Hundreds of customers have had money stolen from their bank accounts by a skimming card gang.  Officials from AIB, Bank of Ireland and Ulster Bank have contacted customers in Co Donegal after what they believe was an elaborate swindle.  Gardai believe skimming devices were put on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b08418ea2c834181276037e194b192fe777c992f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B8A0F36-987D-44B9-B540-72DF2FF76EE0"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"ba092a882bef","org_name":"TSB Bank Limited","org_type":"financial","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newstalkzb.co.nz/auckland/news/nbnat/2129625426-computer-glitch--privacy-breach-at-tsb-bank"}],"summary":"Mailing error results in banking customers receiving other customers' banking and tax information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba84444a9f8ceb48f853730d21bc1a472c731db7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56987653-DBEC-4BC7-BBB4-32752D2AF123"},"incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3aeac51e379f","org_name":"Torbay Hospital","org_type":"healthcare","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-devon-22096023"}],"summary":"A woman who found two courier bags containing patients' medical records on a busy road in Devon has said she was \"absolutely horrified\".  Jo Bell, from Dawlish, spotted the bags on the A379 near Powderham Castle, near Exeter, on Wednesday afternoon.  She said they appeared to hav","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7bbc403aaad4e81cb9abcfbacba1909ca00c46c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E21195C5-BF6A-42DF-80A7-5A1CA0AC2F13"},"incident_date":"2013-04-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9cf74ba663c","org_name":"Terracom Wireless LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":170000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsnet5.com/news/local-news/special-reports/privacy-on-the-line-security-lapse-exposes-some-lifeline-phone-customers-to-id-theft-risk;http://www.newsnet5.com/news/national/phone-company-declines-to-notify-all-customers-after-privacy-breach"}],"summary":"Company hires a contractor to process applications. That contractor publishes all the personal information of applicants to a public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"560703d7fc7e6489f79c0bb97c30e85fddffbcea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"712A4955-8DDC-45C5-8419-150849676057"},"incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98abb88c58ff","org_name":"Proliance Surgeons, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://proliancesurgeons.adhostclient.com/images/PDF/websitenotice.pdf"}],"summary":"On April, 1, 2013, a laptop and ten patient files were stolen during a car break - in. The patient files were subsequently recovered.  However, information regarding some patients of Orthopedic Physician Associates , a division of Proliance Surgeons, may have been compromised by ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1debfbdff1b83a5b00beac38589e9f0228508e83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E401CCA7-6F0F-46F1-BB75-783D8D036B0C"},"incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7efe7cd78199","org_name":"Orthopedic Physician Associates","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://proliancesurgeons.adhostclient.com/images/PDF/websitenotice.pdf"}],"summary":"An employee's car was the target of an April 1 break-in.  A company laptop and 10 patient files were taken during the car theft.  The paper files were recovered, but the laptop also contained patient information.  Names, Social Security numbers, addresses, telephone numbers, heal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd3fb1ef706b1f352bf5dd5f32b8ede26c524d1b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90FAA09A-AB57-4ED0-98AB-1CF135933175"},"incident_date":"2013-04-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"537307c5ec90","org_name":"NTT Resonant Inc.","org_type":"technology_saas","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/news/2013/040413-japanese-web-portals-hacked-up-268387.html?source=nww_rss"}],"summary":"Japanese web portal suffers data breach of customer information. Brute force was the cited method used in the article.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3235e30926fefbf8cffe88ab8165f6238373cd75","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43D2BBC3-962A-4D18-96E6-85BE8B24BC49"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KP","org_id":"699c65511497","org_name":"North Korea","org_type":"government","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytelegraph.com.au/technology/anonymous-stole-15000-passwords-from-north-korean-website/story-fn7bsi21-1226612478083;http://www.news.com.au/technology/anonymous-stole-15000-passwords-from-north-korean-website/story-e6frfro0-1226612478083"}],"summary":"Anonymous 'stole 15,000 passwords' from North Korean website  Anonymous: We've hacked 15,000 passwords  Hacker group threatens all-out cyber war  'We gonna wipe your badass dictatorship' HACKER group Anyonmous claims it has stolen 15,000 passwords from one of North Korea's top we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00a13a10cb052658a5737b6d269e85d19aeb1c3a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ACC8472A-48C5-4672-B01A-F7C9FB5F1B55"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"5c65c537c1cc","org_name":"NewSea Sims","org_type":"technology_saas","ransomware":null,"records_affected":108337,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Over-100-000-Account-Credentials-Leaked-from-Sims-Custom-Content-Provider-347300.shtml;http://anon.blog.org.mx/?p=127;http://www.net-security.org/secworld.php?id=14788"}],"summary":"hacker using the handle Game Over has leaked data that comes from a website that produces custom content for The Sims.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c7110d21942ea36c88b0b31200b7540908a6331","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DD09DCC-5ACA-4F00-B1E7-E120BA3523C9"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5cfb4a0804f4","org_name":"Murphy USA","org_type":"other","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/inquiry-unearths-card-skimming-fraud-identity-theft-at-gas-station-pumps/article/3884681"}],"summary":"two men arrested for stealing between $400,000 and $1,000,000 in cash via the installation of gas pump skimmers in Oklahoma.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b310ba983b0cf92f3160beaee470432934efc2d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FA37503-0808-4A1C-941E-4F54FFBA42FD"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"77b95ed614b3","org_name":"Ministry of Justice","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/bay-of-plenty-times/news/article.cfm?c_id=1503343&objectid=11096074"}],"summary":"Confidential legal aid details of a Bay man accused of breaching community work were mistakenly sent to a woman in a major privacy breach.  The Katikati man's name, address and what his case was about were contained in a letter sent to a Tauranga mother who had applied for legal ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d115300c951401df7fef1d5674977861eb1e2bb","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Security%20Emails%20FINAL_0.pdf"},"notes":null,"org_country":"US","org_id":"430e2ceb34ea","org_name":"LivingSocial","org_type":"retail_ecommerce","ransomware":null,"records_affected":50000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://allthingsd.com/20130426/livingsocial-hacked-more-than-50-million-customer-names-emails-birthdates-and-encrypted-passwords-accessed/?goback=.gde_36573_member_236065788,"},{"fetched_at":null,"title":null,"type":"press","url":"http://allthingsd.com/20130426/livingsocial-hacked-more-than-50-million-customer-names-emails-birthdates-and-encrypted-passwords-accessed/?goback=.gde_36573_member_236065788,"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41617"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Consumer%20Notice%20Security%20Emails%20FINAL_0.pdf"}],"summary":"LivingSocial reported unauthorized access to customer data, including names, email addresses, some dates of birth, and hashed and salted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"BD","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55a59809a69bf6c64ca6842abf9819df1fc5f5b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D961EBE-0F9A-4FDE-A92D-CD70E607D54F"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KE","org_id":"5c2a7daf49e6","org_name":"Kenya Domain Registrar","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/hacker-tiger-mte-hits-google-kenya-bing-kenya-linkedin-kenya.html"}],"summary":"Hacker breaches DNS and redirects several websites to defaced versions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0b8559b6eb1ff1739eb9951b4ddeb23c88ea68b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A88D412-5474-47B4-8037-A468A03F6546"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"f64142e7222a","org_name":"Ireland Revenue","org_type":"government","ransomware":null,"records_affected":182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10879018"}],"summary":"Inland Revenue says it wrongly sent emails to 47 people because its computer software scrambled the \"to\" and \"from\" address lines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"843955a15e5677fca5db8fd144c088451054cba4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52185E76-1C0A-4B78-999D-1654E3D58477"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5444cb87b88f","org_name":"Gomez Gasoline and Automotive","org_type":"retail_ecommerce","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.santacruzsentinel.com/ci_23134535/credit-card-fraud-reported-at-watsonville-gas-station"}],"summary":"More than 50 reports of credit card fraud have been traced to people who were customers at Gomez Gasoline and Automotive.  Police suspect that a credit-card skimming device was placed on one or more gas pumps.  The skimming devices have been spotted at other gas stations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"308b9e4487085aae22fd99b06ee3f259c2c7109b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B658D29E-E064-411B-94B6-08CF0115C874"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"1e04f4ed3205","org_name":"Gigabyte Technology","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/turkish-ajan-hacker-group-hits-gigabyte-technology.html"}],"summary":"Hacker Maxney of the Turkish Ajan Hacker Group recently breached and defaced four subdomains of the Web site for Taiwan's Gigabyte Technology.  According to E Hacking News, the hacker also published a database containing employees' full names, plain text passwords and e-mail addr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0aa5a7be79bcecb4237e022923a9dbfa280f6405","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6a231700-8ea6-11e8-a076-fd59426460e5"},"incident_date":"2013-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d2117839902a","org_name":"Fox Creek Healthcare Centre","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://globalnews.ca/news/4318044/alberta-nurse-privacy-breach-fox-creek/"}],"summary":"in 2016, two people requested audit logs of accesses to their health information Alberta’s electronic health record. After seeing the logs, the complainants alleged Badger improperly accessed their information and both said they weren’t even patients at the health facility she wo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"831768cbb61d181e78c8b3bf8d9d6736fd811869","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FEB644A-AA8F-471C-8B6B-86D671F73EA2"},"incident_date":"2013-04-13","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71f8c0b7adc6","org_name":"E-Sports Entertainment Association","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/wiredenterprise/2013/11/e-sports/"},{"fetched_at":null,"title":null,"type":"press","url":"http://nj.gov/oag/newsreleases13/E-Sports_Complaint_Consent-Judgment.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2013/07/esea-2/"}],"summary":"Employee of gaming software company infected 14,000 customer computers with malware that tracked activity and mined bitcoins.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0027a883491a414416985b3c9a35799152788496","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8235E11E-7FC3-4BAE-8410-DEC1D9A342A0"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"39370d70eabc","org_name":"Dubai International Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":53,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/portugal-cyber-army-hightech-brazil-hackteam-hit-dubai-airport-hong-kong-police.html"}],"summary":"Hackers deface webpage for Dubai International Airport","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9eb29cec9ed92790205fd362fc0d7e69956f02fe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C996F659-8F78-4407-AC39-F07305D0219E"},"incident_date":"2013-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39267b621f8c","org_name":"County of Rogers","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://claremoreprogress.com/local/x738617329/Juvenile-records-found-unsecured-in-old-courthouse"}],"summary":"Juvenile records were discovered by a county employee unsecured. Records were likely unprotected for over 3 months.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14db304c21088dd693048ca523ed86867dad791b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E272F0C-4346-46A2-8D7C-E69F5C6D72C4"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"2da0c9d3d64d","org_name":"CN Hong Kong Police Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/portugal-cyber-army-hightech-brazil-hackteam-hit-dubai-airport-hong-kong-police.html"}],"summary":"Hackers breach website of Hong Kong police force and publish non-public data, deface we page.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"304f0c877da5f3bf225924c59cbb1ae0545e67ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD4B88C2-21A8-4861-B30B-F091504A94AF"},"incident_date":"2013-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"f20c1d600a4c","org_name":"Clive Palmer Political Campaign","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunshinecoastdaily.com.au/news/its-clive-gate-palmers-office-broken-laptop-taken/1847293/"}],"summary":"Stolen laptop from political campaign office contained sensitive financial data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef071fb3a37d4830b86898b1941bb08f4b272abd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"877E0A0D-4CEF-47A6-BE65-1A302EF9E47D"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e03da1379796","org_name":"Cascade Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.seattletimes.com/today/2013/04/hackers-steal-more-than-1-million-from-leavenworth-hospital/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wenatcheeworld.com/news/2013/apr/26/cybertheft-heists-1-million-from-leavenworth/"}],"summary":"The Chelan County treasurer says hackers stole more than $1 million from an electronic bank account held by a Leavenworth hospital.  Treasurer David Griffiths’ office noticed Monday that three unauthorized transaction files had been logged the previous Friday, April 19.  The Wena","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"070b38163ad5958bed9e7dc55660f025552f5d05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1007604E-EADA-47AE-83AE-6BAF638720AE"},"incident_date":"2013-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"339a9a873251","org_name":"CA Department of Education","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://sfbay.ca/2013/04/14/star-test-prank-earns-backlash-against-students/"}],"summary":"During a high school standardized test, a student took pictures of the answer sheet and posted them on the Internet. The answer sheet was bubbled in to spell \"YOLO\".  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"145709f198ed46e4c0a6ce0594a4a8ecbc24c35e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A824838-820B-4C39-AE8A-77F6A98F7EBE"},"incident_date":"2013-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fca58ed7e09","org_name":"BON SECOURS COMMUNITY HOSPITAL","org_type":"healthcare","ransomware":null,"records_affected":697,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/terminated-employee-continued-to-access-bon-secours-patients-billing-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentucky.bonsecours.com/assets/pdfs/BonSecoursSubNotice95142.pdf"}],"summary":"In early April, 2014, during an audit of our billing data base, Athena, we identified suspicious access that prompted an investigation. Our investigation revealed that a user ID and password assigned to a former employee had been used to access information in the Athena system be","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4bc7c897129b4a68a1c48dcc1ec4a219a3cb263","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5EDD4CBA-56E2-4818-BFEA-3DB28334A278"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"8913c61b9cbf","org_name":"Bank of Ireland","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishmirror.ie/news/irish-news/crime/bank-card-skimming-devices-left-2369654"}],"summary":"Hundreds of customers have had money stolen from their bank accounts by a skimming card gang.  Officials from AIB, Bank of Ireland and Ulster Bank have contacted customers in Co Donegal after what they believe was an elaborate swindle.  Gardai believe skimming devices were put on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"000cc29b7e0828f778fc4828d0536c2a6ad2a468","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB2C54F8-08C0-49D4-9659-614CC5CCFC88"},"incident_date":"2013-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"afa19ed690e3","org_name":"Allied Irish Banks PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishmirror.ie/news/irish-news/crime/bank-card-skimming-devices-left-2369654"}],"summary":"Hundreds of customers have had money stolen from their bank accounts by a skimming card gang.  Officials from AIB, Bank of Ireland and Ulster Bank have contacted customers in Co Donegal after what they believe was an elaborate swindle.  Gardai believe skimming devices were put on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f7168a666dd26a8ecfabad33991cbf67ba18ff7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22F581A5-8F2C-4518-802F-1ADB5B550002"},"incident_date":"2013-03-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59727625fc8b","org_name":"Upstate University Hospital","org_type":"healthcare","ransomware":null,"records_affected":283,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnycentral.com/news/story.aspx?id=890363"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/upstate-university-hospital-notifies-283-patients-of-potential-data-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/29/upstate-university-hospital-alerts-patients-of-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://centralny.ynn.com/content/top_stories/659878/hospital-device-containing-patient-information-stolen/"}],"summary":"The hospital has notified 283 patients by mail that a laptop computer containing some personal medical information was stolen from the hospital on or about March 30 or 31. The information on the computer may have included the patient's name, date of birth, hospital medical record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9d0d55d8d1bb480281842fab39c80457afae8d6","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/BK%20Redaction%20Fully%20Remediated%20Consumer%20Notice%20%282%29_0.pdf"},"notes":null,"org_country":"US","org_id":"558a1b9ca1ed","org_name":"Citi","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Limitations in the electronic method or an imperfect manual process used to conceal personal information left it potentially readable in publicly available court filings.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40908"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/BK%20Redaction%20Fully%20Remediated%20Consumer%20Notice%20%282%29_0.pdf"}],"summary":"Citi disclosed that personal information in bankruptcy court filings could have been exposed because concealment was imperfect, though it was not aware of any actual access or misuse.","supporting_quote":"Citi discovered that, because of limitations in the electronic methodology or an imperfect manual process used to conceal such personal information, the information could be exposed and read by a person who accessed court records.","technology_involved":["electronic court records"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2491e15952e7354ce993aa4137b93c8aa7979529","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ED41059-C1EF-4010-84C5-E1F64804CC84"},"incident_date":"2013-03-27","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c02d88974842","org_name":"Dun & Bradstreet Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/California%20Individual%20Notification_0.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43100"}],"summary":"Dun & Bradstreet - An identity theft service that sells Social Security numbers, birth records, credit and background reports on millions of Americans has infiltrated computers at some of Americas largest consumer and business data aggregators, according to a seven-month investig","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-26","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c0c9667134a210b998b054b48f097ff624d611e","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2118287_0.pdf"},"notes":null,"org_country":"US","org_id":"ffcbaa1a6998","org_name":"The Finish Line, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40837"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2118287_0.pdf"}],"summary":"A Finish Line employee’s stolen laptop contained a file with a customer’s Social Security number, name, and employment-related information.","supporting_quote":"On January 11, 2013, the laptop of a Finish Line employee was stolen from the employee’s secured personal vehicle.","technology_involved":["laptop"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4435149d01fcaa6e50eb22ca5da269b51224adc0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"680D4015-17B4-4576-8295-BCBF7D3735FE"},"incident_date":"2013-03-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1336f2c7664","org_name":"OptiNose US Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2013%2004%2023%20OptiNose%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"An unencrypted laptop was stolen from an employee's car.  It may have contained names, Social Security numbers, and personal information related to people who worked at OptiNose.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-25","discovered_date":"2013-06-11","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2b73078dcd2191c82e0bd97230391d84344c2ba","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"bb8ff5240a7b","org_name":"San Francisco State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42524"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/san-francisco-state-university-admits-security-breach.html."},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Breach%20Notification_1.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification_1.pdf"}],"summary":"San Francisco State University's College of Extended Learning reported unauthorized use of a server, with personal records potentially accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6e0d8d77fe2f14708b81ec2eec8ebd02aa621db","impact_type":"data_theft","incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Recovered%20Data_Active%20CM%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40835"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40876"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40923"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40981"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41610"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Recovered%20Data_Active%20CM%20Letter_0.pdf"}],"summary":"American Express reported that card account information, including card numbers, names, and expiration dates, had been recovered during an investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c54122e5ec3a6b818a33cf0c15bad5b61a208b57","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F11B2F0-24F4-4713-933B-C0605CB85682"},"incident_date":"2013-03-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b40faae457a","org_name":"VUDU","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.egmnow.com/digitalnoob/hard-drives-stolen-from-vudu-offices/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/vudu-acknowledges-security-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vudu.com/password_faq.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thewrap.com/media/article/vudu-tells-customers-burglary-has-compromised-their-personal-information-84936,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57578766-83/vudu-resets-user-passwords-after-hard-drives-lost-in-office-burglary/,"}],"summary":"A March 24, 2013 VUDU office theft resulted in the exposure of customer information.  Hard drives with customer names, addresses, email addresses, account activity, dates of birth, and encrypted passwords were stolen.  Customers who used their VUDU passwords for other sites shoul","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-22","discovered_date":"2013-01-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc90bdf2743f6402e79bae578979e4bd6a2ed359","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-08-20","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/TLO%20Consumer%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"a08774e5914b","org_name":"TLO, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40808"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/TLO%20Consumer%20Notice_0.pdf"}],"summary":"TLO reported that an individual accessed personal information through what the company believed was a fraudulent account.","supporting_quote":"The individual accessed a limited set of information which may have included information about you, including your name, Social Security number and/or driver’s license number, through what we now believe was a fraudulent account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-03-22","discovered_date":null,"entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e40e719d692b2929db8a54fe95961e13f211048c","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-03-04","initial_access":"phishing","initial_access_attack_id":"T1566","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20OCS%20Employee%20Breach%20Notice%20Letter%20%2811%20March%202013%29%20v1_0.pdf"},"notes":null,"org_country":"US","org_id":"6d20606d3002","org_name":"OCS America, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A malicious phishing attack may have affected a computer containing the information.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40804"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20OCS%20Employee%20Breach%20Notice%20Letter%20%2811%20March%202013%29%20v1_0.pdf"}],"summary":"OCS America reported that a phishing attack may have affected a computer containing personal information.","supporting_quote":"On March 4, 2013 , OCS America, Inc. discovered that one of its computers may hav e been affected by a malicious phishing attack.","technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc46690f1fe5463ff9f624271e46219fd435193b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92DD9A11-CA42-4EA1-A974-8C378BC3CEC5"},"incident_date":"2013-03-22","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"557a5cfb49f9","org_name":"Best Buy Co., Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2013/06/26/58833.htm"}],"summary":"Best Buy employees allegedly posted compromising pictures of a customer who provided her mobile phone for service.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd853c15ae5ba6a33427ee44c9c43a18abb1f700","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BBF5EEC-1472-48EA-B932-3732D0200B17"},"incident_date":"2013-03-21","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e24908ca337e","org_name":"Allen County","org_type":"government","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.limaohio.com/news/local_news/article_01fb7dc0-96e0-11e2-97b9-001a4bcf6878.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.limaohio.com/news/local_news/article_86bf5860-98bb-11e2-80a1-0019bb30f31a.html"}],"summary":"An administrative error caused the Social Security numbers and other personal information of Allen County employees to be available online for less than an hour.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"533d71fae880146c90c059174ad7e4908c128199","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6AB47FA2-1149-49A5-901F-ADA2E70CF6F6"},"incident_date":"2013-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"37c9e82a9a4c","org_name":"YTN","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mcafee.com/mcafee-labs/dissecting-operation-troy-cyberespionage-in-south-korea"}],"summary":"Operation Troy Incident 5: South Korea was hit by a major cyberattack on March 20, 2013, at 2:00 pm local time. This cyberattack caused a significant amount of damage to the affected organizations by wiping the hard drives of tens of thousands of computers. Analysis of this attac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b09c04bf454d14a6efc6076d4c782dd908ce2d15","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94B97AA1-D77A-4304-AF99-A62C9EAA4B74"},"incident_date":"2013-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"f4cbef72341e","org_name":"Shinhan Financial Group Co., Ltd.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mcafee.com/mcafee-labs/dissecting-operation-troy-cyberespionage-in-south-korea"}],"summary":"Operation Troy Incident 3: South Korea was hit by a major cyberattack on March 20, 2013, at 2:00 pm local time. This cyberattack caused a significant amount of damage to the affected organizations by wiping the hard drives of tens of thousands of computers. Analysis of this attac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bde604c81d3dbe67472baa3187184578dd622448","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B9B7E20-D0DF-4C19-B17B-802EA2769A99"},"incident_date":"2013-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"b3c5ad0b146b","org_name":"NongHyup Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mcafee.com/mcafee-labs/dissecting-operation-troy-cyberespionage-in-south-korea"}],"summary":"Operation Troy Incident 1: South Korea was hit by a major cyberattack on March 20, 2013, at 2:00 pm local time. This cyberattack caused a significant amount of damage to the affected organizations by wiping the hard drives of tens of thousands of computers. Analysis of this attac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94829d3b7f9b8362ddbb4a045106952ce79a4508","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A2CA492-6266-4285-8CCA-9866FB287D1C"},"incident_date":"2013-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"a3965e0b1907","org_name":"Korean Broadcasting System","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mcafee.com/mcafee-labs/dissecting-operation-troy-cyberespionage-in-south-korea"}],"summary":"Operation Troy Incident 4: South Korea was hit by a major cyberattack on March 20, 2013, at 2:00 pm local time. This cyberattack caused a significant amount of damage to the affected organizations by wiping the hard drives of tens of thousands of computers. Analysis of this attac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KP","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77ca4a0f445124ab6390eda38e504aba3379a132","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D973F45-F24E-4574-B9E5-B6EBF9A50EAD"},"incident_date":"2013-03-20","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"00dcba9331a4","org_name":"Jeju Bank Co., Ltd.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mcafee.com/mcafee-labs/dissecting-operation-troy-cyberespionage-in-south-korea"}],"summary":"Operation Troy Incident 2: South Korea was hit by a major cyberattack on March 20, 2013, at 2:00 pm local time. This cyberattack caused a significant amount of damage to the affected organizations by wiping the hard drives of tens of thousands of computers. Analysis of this attac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"768eeb37efd282f75221097a2d0ad969724cb514","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"027B8E6E-6D20-4091-9AB7-E91FDC916F3C"},"incident_date":"2013-03-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"364c1c812b43","org_name":"Delta Dental of Pennsylvania","org_type":"financial","ransomware":null,"records_affected":14829,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The March 20 loss of paper records may have exposed the information of patients. ZDI lost the records of their associate Delta Dental of Pennsylvania.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a9f3c78db2e4f447da68788514f314e823626c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE26923F-2BAF-4360-861F-A4120F296B87"},"incident_date":"2013-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8213deb21429","org_name":"Wood County Hospital","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Police-Fire/2013/05/09/Police-probe-theft-of-radiology-films.html"}],"summary":"The March theft of radiology films resulted in the exposure of patient information.  The films were most likely stolen from the Hospital's storage room in order to be stripped of their silver.  The films contained patient names, medical record numbers, dates of exams, and in some","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04e7e4e2a7a351fc70aed041447d0aba054582be","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28526970-7023-42AC-A134-4CD1FCC51AB0"},"incident_date":"2013-03-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8af627a50031","org_name":"Tooele County","org_type":"government","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksl.com/?nid=148&sid=24572239,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sltrib.com/sltrib/news/56074611-78/county-brozovich-tooele-data.html.csp"}],"summary":"A former employee received a CD with the names and Social Security numbers of around 200 current and former employees when he requested his personnel file.  The disc may have held the information of employees who signed up for a specific dental insurance plan in 1996 and workers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"grudge","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd94d47f6b4d6830596c0e90cd0cf48c4714d554","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A5F0ED6-CE6E-495A-9D5B-A6E6EC27B0D0"},"incident_date":"2013-03-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d2eb42e6692a","org_name":"Spamhaus","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/09/27/london_schoolboy_arrested_for_biggest_ddos_attack_in_history/"}],"summary":"A British police investigation into the massive DDoS attack against internet watchdog Spamhaus (purportedly the largest DDoS attack ever seen) has led to the arrest of a 16-year-old London schoolboy who, it is claimed, is part of an international gang of cyber-crooks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"daff5c8e876bca2c468618b68bd1610f4924f9c0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFED75CE-BDDE-4A34-9C8B-576FC8A4301B"},"incident_date":"2013-03-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"deeda69e9655","org_name":"Fannie Mae","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226405.pdf"}],"summary":"Data on Fannie Mae loans was on a thumbdrive that was stolen from a FedEx delivery cart.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d3a263ae059b7d566c59d49da974028396cfadd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E49D4D7-1214-45EC-9F2E-2B04060CDD8B"},"incident_date":"2013-03-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f02bd4b2e6ab","org_name":"Child and Family Services of New Hampshire","org_type":"government","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/child-family-services-nh-20130422.pdf"}],"summary":"On March 19, 2013, CFS learned that 23 client files were stolen from a secure area in CFS's main office some time between 3/15 and 3/18/13.  The information in the files contained names, addresses, DOB, Medicaid Number and health information/notes.  The files did not contain SSNs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f542fd806d4be56127a18f7b46f833c9891d75bc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51D09252-4375-4705-BFEC-DA55AE9FF782"},"incident_date":"2013-03-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae64267b1937","org_name":"Cenpatico Behavioral Health of Arizona","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yumasun.com/news/drive-86835-patients-laptop.html"}],"summary":"A burglar swiped a laptop and hard drive containing sensitive medical and personal data for hundreds of mental health patients from Yuma and across the state.  Alicia Z. Aguirre is the general counsel for Yuma's Arizona Counseling and Treatment Services, a contracted provider wit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ca4d7cabd40bebfe06385309d84ae957356d47f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC05377E-9FCB-410C-976E-A8B3FB199C2A"},"incident_date":"2013-03-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67e406b25189","org_name":"Arizona Counseling and Treatment Services (ACTS)","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/17/arizona-behavioral-health-patients-experience-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.willcoxrangenews.com/news/article_ffb12002-b28b-11e2-82f9-0019bb2963f4.html"}],"summary":"More than 500 behavioral and mental health patients have had their data compromised as a result of a thief taking an Arizona Counseling and Treatment Services (ACTS) employee’s laptop and hard drive with their data on it.  While there were names, dates of birth and treatment plan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ca5ff654657b5716b3e60ed6697c9eb0ddd964d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27D24DAC-E968-49E0-9A03-917583C5DD2C"},"incident_date":"2013-03-17","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15c8f0a61177","org_name":"Monterey County California","org_type":"government","ransomware":null,"records_affected":145000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.montereyherald.com/news/ci_24284986/computer-security-breech-exposes-information-thousands-monterey-residents"}],"summary":"Monterey County computer hack exposes information of 145,000 residents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ee591847af77a491bdee03c1085b29f66e95fca","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C48C8B46-10FD-41D1-8578-8FBD5265C1E8"},"incident_date":"2013-03-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7940ba924394","org_name":"Affinity Health Plan, Inc.","org_type":"financial","ransomware":null,"records_affected":409262,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.affinityplan.org/uploadedFiles/Affinity_Home/Who_We_Are/PressRelease_040510.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/3151;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/affinity-health-plan-notifies-over-409000-of-breach/"}],"summary":"On March 17, 2010, Affinity received information that an office copier it had previously leased and since returned to the leasing company may contain personal information on its hard drive. Affinity, which is in the process of obtaining the machine, has not had an opportunity to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2787577713e2f8e5d9623c3c1c08c615345c6e85","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04916A4B-3FD1-4C7B-91F5-4162E69A82DA"},"incident_date":"2013-03-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1568dce752e","org_name":"Thomas L. Davis, Jr. DDS","org_type":"healthcare","ransomware":null,"records_affected":3269,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer exposes 3269 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c9f6cffcd4b91f0b29302da5b6e73f7c4b16007","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81C07FED-1FF8-417E-821E-F8480C353789"},"incident_date":"2013-03-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e0d82a8fb72","org_name":"Laboratory Corporation of America","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227421.pdf"}],"summary":"A computer tagged for disposal was stolen before it could be sanitized.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b31b477593840ca2e387b3ddb406cdc4eed2cb0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1892F486-AB2C-4067-9DAC-1AFA5DF9193D"},"incident_date":"2013-03-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"506fe76713d9","org_name":"Community Hospitals of Indiana","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/17/community-health-sends-patients-data-breach-notifications/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wishtv.com/dpp/news/crime/medical-worker-stole-patient-identities"}],"summary":"Hospital employee steals patient data for identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88bd0d57d11438e349a7dcd2cf7c0c106b2c7fc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90A4C498-04F3-4415-AB6B-D5ECAB12DE6C"},"incident_date":"2013-03-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbed5398a15a","org_name":"Community Health Med-Check","org_type":"healthcare","ransomware":null,"records_affected":180,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wishtv.com/dpp/news/crime/medical-worker-stole-patient-identities"}],"summary":"Greenwood police was the agency that alerted Community Health that they had an employee who was stealing patients' identities.   \"A former patient had stated that they had reason to believe that someone had taken their identity,\" said Jean Putnam, Vice President at Community Heal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d358d1bf11712781f5f510ba678a29683484c0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BB117D1-E49C-4190-8346-9CBF00F1450E"},"incident_date":"2013-03-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"036557bd8a41","org_name":"Columbia University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-230863.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-those-hidden-fields-in-excel-spreadsheets-columbia-university-medical-center-notifies-students-of-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/columbia-university-medical-center-admits-data-breach.html"}],"summary":"Columbia University Medical Center inadvertently exposed the Social Security numbers of 407 medical students in an Excel spreadsheet emailed to faculty, students, and staff.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3bf7b34a2568f879a87f965c33dd69064470b2f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC5B111D-5F53-40CE-A2DD-14D647E86109"},"incident_date":"2013-03-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"058a21833323","org_name":"Schnuck Markets Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/judge-caps-schnuckss-liability-to-payment-processing-partners-in-breach-case/article/393010/"}],"summary":"A lawsuit was filed against Schnucks Markets Inc. after customers learned that Schnucks failed to warn customers about a data breach within two weeks.  On March 15, Schnucks learned that a portion of their loyalty cards were affected, but waited until March 30 to send a press rel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e77fe5b376e42ef27c6286456f1f5ccee7098f25","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B741F99A-80A0-4434-A8F4-26E98E6297ED"},"incident_date":"2013-03-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72434f4895af","org_name":"Kirkwood Community College","org_type":"education","ransomware":null,"records_affected":125000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/kirkwood-community-college-hacked.html"}],"summary":"Hackers accessed Kirkwood Community College's website and applicant database system on March 13.  Anyone who applied to a Kirkwood Campus may have had their names, Social Security numbers, dates of birth, race, and contact information exposed.  People who applied to take Kirkwood","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1490dc83015b97fdd9f869a65c7fcdfe2dfe4db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCFFA6B5-D4C5-470A-9C0A-8BA2F3DDC63C"},"incident_date":"2013-03-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"69596161903a","org_name":"Certified General Accountants Association of B.C.","org_type":"nonprofit","ransomware":null,"records_affected":4600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bc.ctvnews.ca/private-info-of-4-600-b-c-students-leaked-1.782799"}],"summary":"Company accidentally emails spreadsheet with non-public data to large number of customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e8355713bd10cd8f72a614edc1c28a7f4581a71","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B59CE439-FCD8-41CB-BD43-FE7618416472"},"incident_date":"2013-03-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NO","org_id":"7457b744f977","org_name":"Statoil ASA","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsinenglish.no/2014/08/28/statoil-held-off-hacker-attack/"}],"summary":"Attackers used strategic web compromise to plant malware on a site that Statoil employees then visited resulting in compromise of their network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09046738b4a13355f19f8f3c168df9eff93d0620","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1978001-597A-4CD4-B3BF-979AA577BE00"},"incident_date":"2013-03-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c969b8aab2e0","org_name":"Lawrence Melrose Medical Electronic Record, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/03/18/lawrence-melrose-medical-electronic-record-reports-breach/#.UUc1-e5QZXA.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/03/20/lawrence-melrose-medical-electronic-record-breach-update/"}],"summary":"An employee of Lawrence Melrose accessed patient information for reasons unrelated to their work.  It is unclear what type of patient information was exposed and how many patients were affected.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1547f9874b0558848de2667383ee3d150bc1a531","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9281EA6E-9A68-4074-8F31-9FE98076972E"},"incident_date":"2013-03-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"fbb2121ef8bb","org_name":"JP Morgan Chase","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/03/13/jpmorgan_chase_ddos_attack/"}],"summary":"Visitors to chase.com were shown a \"website temporarily down\" message on the front page, although the bank's mobile apps were said to be working.  Iran and a group of Islamic activists called the Izz ad-Din al-Qassam Cyber Fighters have been linked to internet attacks on major Am","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dd686eec93f94e357b2b3bd17e7f6d0e9c94d17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10C7DEA9-39EB-40FD-A3B1-121B3AFA3777"},"incident_date":"2013-03-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b999309303f9","org_name":"Louisiana State University System","org_type":"professional_services","ransomware":null,"records_affected":8330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lsuhscshreveport.edu/Uploads/Public/Documents/billingissuesiemens.pdf"}],"summary":"Computer error resulted in patients being mailed bills for other customers exposing patient health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bf32c078f6129a5fdb87d799ac520297c2ba1bb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E42CDC4C-BB59-4A17-B2BB-3D37D08A527E"},"incident_date":"2013-03-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9870a71b3d04","org_name":"Seattle & King County Public Health Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/wp-content/uploads/2013DowntownPHBreachEN.pdf"}],"summary":"Document disposal error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"717772836943655cedf568f8a5e3ff2074aeae5d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5543276-B10F-4A06-9CAD-A9B1B4E4F84B"},"incident_date":"2013-03-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7ffc2a7e815","org_name":"Public Health - Seattle and King County","org_type":"government","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"A custodian improperly disposed of client medical information on March 7.  The records were from the Refugee Screening, WIC, and Needle Exchange programs.  Patient names, dates of birth, phone numbers, addresses, medical record numbers, appointment dates, and medical condition or","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fc8e1a75b0964be2977706150d95dc7a70b51f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF78612E-F93F-401F-B08D-6F30C0357B8C"},"incident_date":"2013-03-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c08601e96d81","org_name":"King County Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://pinboard.in/cached/dfeef7fe1ef1/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kingcounty.gov/healthservices/health/locations/%7e/media/health/publichealth/documents/locations/2013DowntownPHBreachEN.ashx"}],"summary":"Possible unintended exposure of health information: Downtown Public Health Center, March 2013  This posting is to inform you that, on March 7, 2013, a substitute custodian employed by the building owner at Downtown Public Health Center disposed of some clients' protected health i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41a67e69104529b48e58d54b32cb004ce715a423","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9852EA2C-B515-4F89-ABC4-C88EAB90003E"},"incident_date":"2013-03-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6bb34bf48d7","org_name":"Sports Rehabilitation Consultants","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer exposes 1200 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"397acaa535b5a4725e35cfaa53a6086bfeb71b61","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BC69DFA-EF1D-42FA-BF0A-5B029D62DBBA"},"incident_date":"2013-03-06","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d969711bbba","org_name":"Dead River Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/dead-river-company-20130410.pdf"}],"summary":"Form grabbing malware infects organization's devices used by customer service representatives. Payment card information belonging to the victim's customers is at risk. In addition, over 200 PII records of employees are at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d8c056239d218d466253bfc1558f7d21cd650a9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE0E8BA2-7D15-4C62-AC49-6405DA49EA81"},"incident_date":"2013-03-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d877f93c42f","org_name":"Integrity Oncology","org_type":"healthcare","ransomware":null,"records_affected":539,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Integrity Oncology's business associate North Atlantic Telecom discovered a breach incident on March 5. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82bec1b22cc8726c92f8c0c7961805841df306b7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDC7769C-5DDB-4E08-8FAA-B53DA4D1D7ED"},"incident_date":"2013-03-05","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ffaf7371819","org_name":"DataPak Services Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2013%2010%2002%20Datapak%20ltrt%20Consumer%20re%20Security%20Breach.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-43227"}],"summary":"DataPak which is a payment processor for e-commerce websites had found malware placed on some of their systems which might have resulted in the breach of some client payment card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19446957ec86eb7ed5f089ed6ae808de6abc866d","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/03.04.2013%20Individual%20Notice%20Letter_0.PDF"},"notes":null,"org_country":"US","org_id":"0c20434d9e3b","org_name":"The Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-39061"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/03.04.2013%20Individual%20Notice%20Letter_0.PDF"}],"summary":"A Prudential associate inadvertently emailed a document containing personal and salary information to another Unisys employee.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-03-04","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a527d4f09e88d229249926c38b9ee732d2ac095","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MT-March%202013_0.pdf"},"notes":null,"org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-39056"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MT-March%202013_0.pdf"}],"summary":"Two backup tapes containing personal information went missing while intended for courier between TD Bank locations.","supporting_quote":"The tapes have been missing since then, and we have been unable to locate them despite our continued efforts.","technology_involved":["backup tapes"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f5656471ce4282176767935871709c0ab41c609","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7105FAE-7DC9-487E-AF64-A4420B9E874D"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8579c3f20f48","org_name":"Xcel Energy Inc","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/xcel-energy-20090325.pdf"}],"summary":"Xcel E~nergyhas determined that, approximately two weeks ago, a memper of its team responsible for proccssing employee access to Xcel Energy facilities sent an e-mail and spreadsheet attachment to another team member. The spreadsheet contained the name and Social Security number ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e2f23436cad609ed49520728a87b2c6336dda42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FFDDAD8-1FC8-4675-8598-EE972F0EC66A"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"edd1a40f9c2f","org_name":"Westpac Banking Corp","org_type":"other","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/manawatu-standard/news/8502907/Westpac-tight-lipped-over-privacy-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/manawatu-standard/news/9363345/Bank-remains-tight-lipped-about-privacy-incident;http://www.stuff.co.nz/manawatu-standard/news/8785751/Bank-silent-over-privacy-breach"}],"summary":"Non-employee left branch with three pieces of paper listing 25 customers' term deposit account numbers, start dates, maturity dates, interest rates and balances.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed8b4dcd24acabacf3236978f33d1c6fe27b2e6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB57F5D7-6568-4E9D-9680-9558A21FECC7"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"f0b4d38a11aa","org_name":"West Coast District Health Board New Zealand","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10879341"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10877713"}],"summary":"Hospital staff view medical information about a celebrity patient for whom they were not providing care.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bd83f590f346ddfd99b7addbc30bcc6aeca9c17","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B203B70-1BB5-4D26-BB8A-2DE1D9C39781"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ecc1fd60d86","org_name":"Tradebe Environmental Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/tradebe-20130402.pdf"}],"summary":"Laptop stolen from employee's vehicle puts current and former employee data at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a1fec36b51d450ded63ec5952e4296409dc32c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBE6B6FF-33DA-4933-BFA6-E7A37CA98331"},"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bbeab6d36db","org_name":"Teavana/Starbucks","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/04/sources-tea-leaves-say-breach-at-teavana/"}],"summary":"Multiple sources in law enforcement and the financial community are warning about a possible credit and debit card breach at Teavana, a nationwide tea products retailer. Seattle-based coffee giant Starbucks, which acquired Teavana late last year, declined to confirm a breach at T","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"437f056a9cdd3b9887a2a10d4fb8e7c32a418b80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27900849-8C10-4655-92D8-5F565DEDE63C"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f1e76d5e8a7","org_name":"Saint Francis Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newson6.com/story/21476118/tulsa-medical-records-turn-up-on-ponca-city-newspaper-loading-dock"}],"summary":"Imagine finding a stack of someone's medical records, with all their personal and private information. That's what happened to a stack of records from Tulsa's Saint Francis Hospital. The records showed up in Ponca City, and it might have gone unnoticed, except for where they were","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"864d3ab10ee2cc66a9a4200c1d6ecfdaeb17a286","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79E684D0-8CFF-4BE1-8787-BD87F9776672"},"incident_date":"2013-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1f1078afa36","org_name":"Rollins, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Rollins%20Ad_1.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40891"}],"summary":"We are writing to inform you of an incident that came to our attention on March 12, which may have involved the unintentional exposure of your Social Security number (SSN). This occurred as a result of a system mistake involving the recent Rollins TODAY mailing. This distribution","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69a6145a8972b1bb4b65317ce6222fc33367ab69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBE2415A-B4A7-4666-84B8-53072B8FB25B"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb78f578b122","org_name":"Orthopedics and Adult Reconstructive Surgery","org_type":"healthcare","ransomware":null,"records_affected":22000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"AssuranceMD lost a portable electronic device of their associate Orthopedics and Adult Reconstructive Surgery.  The breach occurred between March 1 and March 15.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d21e0df0d7761ba7adf3e9aa67da90a025013195","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAEA6B40-98AB-465B-80E9-A9DD4C2B69F2"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e3e157a1a110","org_name":"Nursing and Midwifery Council","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.annualcreditreport.co.uk/tagged/data-loss"}],"summary":"The Information Commissioner’s Office (ICO) has fined the Nursing and Midwifery Council £150,000 after it lost three unencrypted DVDs.  It is alleged that the DVDs contained evidence and personal information from two vulnerable children.  Deputy commissioner and director of data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44078197c978a93f4723c61c4ee94790d049ad86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D6B836D-FA53-433F-BBD7-C2CE3C3C2061"},"incident_date":"2013-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corporation","org_type":"technology_saas","ransomware":null,"records_affected":2898,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itproportal.com/2013/03/20/thousands-have-data-exposed-in-microsoft-security-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/technology/la-fi-tn-microsoft-hack-azure-20130222,0,6681241.story;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news.com.au/technology/microsoft-xbox-azure-services-taken-offline/story-e6frfro0-1226584080719;"},{"fetched_at":null,"title":null,"type":"press","url":"http://readwrite.com/2013/02/22/microsofts-rotten-friday-hack-revealed-as-azure-halo-go-down;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehacknews.org/2013/02/microsofts-azure-service-hit-by-expired.html"}],"summary":"Microsoft error on xbox website posted personal information for almost 3000 users (error.config error perhaps?)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc3e9bf459144cb138ed47c3a445a227e18975c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF551307-9B76-4F7F-B6C3-A47BA2F913F5"},"incident_date":"2013-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea0ddcaa8b65","org_name":"ManagedMed Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/managedmed-reports-patient-scheduling-data-breach-to-california/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/071714SampleNotice_0.pdf"}],"summary":"ManagedMed Inc. (A Psychological Corporation), based in Los Angeles, recently notified the California Attorney Generals Office of a breach involving patient scheduling information.  According to their July 17th letter to patients, submitted to the state on July 25, some patient s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3508ed230839f50675ef0f5656037cfec408a34d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15C4E47D-4FBF-4B00-B406-C7F18B3BE4FD"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7346c125e2d","org_name":"Live, Love and Dance Studio","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://6abc.com/archive/9015141/"}],"summary":"The owner of a Delaware dance studio has been charged with using a customer's credit card information to pay for a trip to California.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73d5295ad8d827d0af39acb4e0b7e439fe565558","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C18B9E6-2469-4CD5-9D81-DB26D8067450"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"acf944ac21fc","org_name":"Leeds Rhinos","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://asia.eurosport.com/rugby-league/laptop-theft-hits-rhinos-plans_sto3695090/story.shtml"}],"summary":" The Super League champions have appealed for the return of a laptop containing vital data which was stolen during a break-in at the Halifax home of the club's conditioning coach Richard Hunwick on Tuesday night.  Theives stole the keys to Hunwick's car, a VW Golf, and a rucksack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df2220c9769831c6053e49cbd6e6c761a4ed817a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"267E26E0-55BF-4174-8183-2033E271BA26"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76337dbc9f29","org_name":"Kmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mondaq.com/unitedstates/x/236106/Data+Protection+Privacy/Data+Breach+at+Gunpoint"},{"fetched_at":null,"title":null,"type":"press","url":"http://finance.yahoo.com/news/9-crazy-data-breaches-110048414.html"}],"summary":"Last month, a person held a Kmart employee in Little Rock, Arkansas at gun point and ordered him to open the store's safe. The perpetrator ran off with the safe's contents, including almost $6,000 and the day's backup disk.  The next problem for Kmart (or maybe the first problem)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53591ea212f76847a6d4c9e4e3ce69526f45a4c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1558B53A-E668-41E2-9D2C-05AED897A49C"},"incident_date":"2013-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a15fe0cc4edb","org_name":"King County Sheriff's Department","org_type":"government","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.komonews.com/news/local/Stolen-sheriffs-office-laptop-puts-thousand-at-risk-of-identity-theft-212860341.html"}],"summary":"Thousands of people are now vulnerable to identity theft, and it's all because of a stolen laptop.  The information, which includes Social Security and drivers license numbers, was on a King County sheriff's office computer that was stolen from a detective.  The laptop and a pers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"629f54208b92f503078d27810110860051fcaad9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA602E9A-8D68-4857-A80E-F03A2A22CF04"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"fbad1084ff2f","org_name":"Jakarta Body Shops","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thejakartapost.com/news/2013/05/31/four-arrested-body-shop-customer-data-phishing.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaa6eacd42c0c5173cadaffb3422dc525cf460cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C722F3E0-1B45-4343-B535-29CC41E4347C"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc7a640dc47d","org_name":"Expedia","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.geekwire.com/2016/former-expedia-it-worker-accused-of-insider-trading-stealing-information-from-executives/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/former-expedia-employee-hacked-bosses-net-350000-get-rich-quick-scheme-1595131"}],"summary":"A former IT technician working for travel website Expedia pleaded guilty in a US federal court this week (5 December) for hacking into the emails of senior company executives and using stolen information to illegally profit from an insider trading scheme.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"442c046662b0b21be651f3ecc71b3c744f0d142a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF522F48-B2B4-4A94-A6B2-9656CD4C0DAA"},"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74111f815c62","org_name":"Denton High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Student-Arrested-for-Hacking-into-Denton-High-School-s-Systems-374869.shtml"}],"summary":"18-year-old Marshall Williams, a student of the Denton High School in Denton, Texas, has been arrested and charged with hacking into the school’s systems on two separate occasions.   According to Fox 4, Williams hacked into the high school’s secure Wi-Fi network – which stores te","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9404dc6ca1197f5f5154440215d3b650a17a22e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31373B41-D7FE-459E-8DA3-8F4C7FFA8A88"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"713ad79fe9ad","org_name":"Comfort Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kokomoperspective.com/kp/state-settles-with-former-dentist-accused-of-dumping-patient-files/article_3a5dbbfc-9831-11e4-b5ee-2fb4d5ff867a.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kokomotribune.com/news/former-kokomo-dentist-agrees-to-fine-for-violating-hipaa/article_004c3b6c-983d-11e4-bc24-a7d64f554f14.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.natlawreview.com/article/indiana-attorney-general-enforces-hipaa-first-time-another-lesson-small-business"}],"summary":"According to news reports, over 60 boxes containing years of dental records pertaining to over 5,600 patients, and including very sensitive personal information, were found in a dumpster. Apparently, the dentist hired a third party vendor to dispose of the records; that vendor li","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3133fab3dba8a9b518c0cb153b2c73993ea66dc2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E330336F-48D4-48FB-9E0A-EDDC407907DF"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a638ec779bf4","org_name":"Clinton Health Access Initiative","org_type":"nonprofit","ransomware":null,"records_affected":107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227149.pdf"}],"summary":"Accidental email of W-2 forms of 107 employees to an unintended recipient.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1be19f493f58d1939b56df1da5d8297de565cf4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBE08DA6-2DB8-4FC1-819A-C4691B346EAD"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19787b1c985b","org_name":"City of New York Fire Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2013/09/17/61228.htm"}],"summary":"FDNY lieutenant uses his access to take pictures of patients and post them on twitter.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c21681d4ca69466d46a35f012209503ad75b5e2e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E65802C-5C49-4AA2-B423-85D3069CD5FD"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"afb684d62ee2","org_name":"City of Bognor Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bognor.co.uk/news/top-stories/latest/former-bognor-police-officer-fined-for-breaching-data-protection-act-1-5499982"}],"summary":"Police officer misused organizational assets to get information on people outside of an active investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e19816c7e050189ddd95d8413d0b6ae0afa804c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D764FAAC-4787-4B0A-AD12-6EE22BE493B1"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"725911998306","org_name":"Citibank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/local/man-discovers-atm-card-skimmer-access-door-union-c/nWtFY/"}],"summary":"UNION CITY, Calif. A man uncovered an identity theft scam at a Union City bank as he was trying to use the access door to get to an ATM.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0261f0bda99714b23915115e1113fb0cf0f16eec","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6812692F-A5FF-4E72-85C9-B24605EDD0B3"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"238f3c433ab0","org_name":"Champlain College Incorporated","org_type":"education","ransomware":null,"records_affected":14217,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vtdigger.org/2013/06/03/champlain-college-offers-hotline-security-monitoring-in-wake-of-dat/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.burlingtonfreepress.com/article/20130603/NEWS02/306030008/Champlain-discloses-possible-security-breach?nclick_check=1"}],"summary":"Unencrypted hard drive containing personal data for thousands of students was left unsecured for a period of time.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be9bb969146439df01fd974c8ca464d938d1fa8a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75594E3F-8272-4834-A7AE-DF39635F8B3D"},"incident_date":"2013-03-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96e79fa6c32f","org_name":"Calvert Internal Medicine","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.asia/payroll-information-breach-leads-roundup-a-5831"}],"summary":"Disabling of PC firewall leads to malware infection and potential loss of payroll data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5b2a4018232bbfff053d56c32a71741447f399f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C5745F1-E3B9-4BFA-B42E-7EC063B9D367"},"incident_date":"2013-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b80cac934e6","org_name":"California Department of Developmental Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cironline.org/reports/calif-agencies-often-fail-protect-confidential-information-data-shows-4621"}],"summary":"Stacks of patient and billing records were left in an unsecured and abandoned office in March of 2012. Credit card and Social Security numbers may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fbf70e1dfdee6da2ead6b791cad1155ae1f9980","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2492958-BAE0-4C7A-8427-950388227024"},"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a673a62d0713","org_name":"BEL Incorporated","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Bel%20USA%20Security%20Breach%20ltrt%20consumer.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/promotional-travel-mug-seller-notifies-customers-of-breach/"}],"summary":"Travel mug retailer suffers breach, customer payment card information is compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab0fb3f9da83765404932773f543d276ff31d88b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E94F7029-B978-4B6E-BB88-FB3ADC82856C"},"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"362afe7f222e","org_name":"Beachbody","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/beachbody-20130523.pdf"}],"summary":"Customers notified organization that they found fraudulent purchases on credit cards used for online purchases at their website.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8ab1c6962155a45d9eb7049ca84d8171f99ad88","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90D22FAC-5CC9-4CDD-AAEF-1C9D4200640D"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bba68f2b95b9","org_name":"Baymont Inn Suites","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox10tv.com/news/mpd-hotel-clerk-stole-23-credit-card-numbers;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/live/2013/05/serving_time_for_theft_from_on.html"}],"summary":"Motel clerk would pocket money from cash paying customers and use credit cards from other customers to pay for those rooms. Modeling as employee Misuse, not a data breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6809af6e1795f4a2f090b28da654c030ca380d15","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C181F5AC-3DC4-4E85-926A-D2C04E00BDA4"},"incident_date":"2013-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e2a8477a9944","org_name":"AOL Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesmokinggun.com/buster/hacking/john-doerr-hacked-by-guccifer-098742"}],"summary":"Personal Email a/c hacked by Hacker Guccifer and contents related to work accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dab4644494169d0f112cafb4b82595ddf86bf2b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB8E2FD0-C3CB-42D6-AAD0-DF27BE133915"},"incident_date":"2013-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"3f2994211672","org_name":"Abtran Group Ltd","org_type":"other","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishexaminer.com/breakingnews/ireland/property-tax-security-breach-was-discovered-quickly-594236.html"}],"summary":"Employee was unnecessarily taking Credit Card numbers of a small number of customers (11). Employee was suspended, and affected customers were notified, but none suffered any loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc86a8e027c5327ab42d635b0e86e32763e57e54","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA450A28-961D-448C-AA02-A0AFC8005A6B"},"incident_date":"2013-02-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b043545a6ed","org_name":"Insurance Co. of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56452"}],"summary":"Confidential medical records were found under a freeway by a concerned citizen. A local news team investigation traced the documents back to the insurance claims processor ICW. ICW reported that the issue occurred on February 28 when a bin with files broke open on the way to a di","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20a4ab0a94b1d432f082fa03ca5f44ade2cce962","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DE25B18-6D77-423F-87CF-163326E9FA0E"},"incident_date":"2013-02-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6952d9bb02c2","org_name":"Valley Mental Health","org_type":"healthcare","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The February 27 theft of a computer resulted in the exposure of patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"feaadf3fcf26aa8f60d18a739f30bc4d5e10fa2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE3C830C-3D7E-4071-8BBD-70FF13BBE1D8"},"incident_date":"2013-02-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"dde0540af11d","org_name":"Koch Industries","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesmokinggun.com/file/koch-industries-attack;http://www.thesmokinggun.com/documents/koch-industries-ddos-attack-875410;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesmokinggun.com/buster/koch-industries-attack-plea-78312"}],"summary":"Anonymous DDOS on Koch Industries, for their financial support of Wisconsin governor. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01497d64450361a5d1f6eee8d4a5983bf6cb34b4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A611E67-327E-422E-BB05-914A18BA6A8F"},"incident_date":"2013-02-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a34099514648","org_name":"Florida Association Management","org_type":"other","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/computer-theft-hoa-management-company-puts-residen/nWc8P/"}],"summary":"HOA Management company suffers a burglary that results in a server being stolen. Server contains homeowners' names and bank account information. Discovered when owner could not log into server remotely.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75d65f08f9356c7c44d3c3587b81bd49a52e8142","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B52E024-3A05-4D52-822A-B5FA409677E3"},"incident_date":"2013-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e42dfdf4572","org_name":"Hospice Palliative Care of Alamance Caswell / LifePath Home Health","org_type":"healthcare","ransomware":null,"records_affected":5370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digtriad.com/news/local/article/278611/57/Hospice-Patient-Info-At-Risk-After-Laptop-Thefts,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthit.com/story/stolen-laptop-incidents-put-info-13000-patients-risk/2013-04-09"}],"summary":"A local health provider is warning patients and their families about a possible breach of personal information after a recent break-in at one of its facilities.  Staff at Hospice Palliative Care of Alamance Caswell and LifePath Home Health notified around 5,370 current and past p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a844483857e9d88396e8457689442bd8023f1df","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0CD6047-6A4A-4F33-8931-04E140929D64"},"incident_date":"2013-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc105d6e7c4a","org_name":"Hospice Palliative Care of Alamance-Caswell","org_type":"healthcare","ransomware":null,"records_affected":5300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberenvoy.com/content/hospice-palliative-care-alamance-caswell-lifepath-home-health"}],"summary":"The February 24 burglary of three laptops resulted in the exposure of patient information.  The laptops were stolen from the hospital in addition to needles, syringes, and miscellaneous items.  The unencrypted laptops contained emails that had sensitive patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"355b41b5f6ab0649a5edf6cda2928c06bac22c13","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1880B5F0-28B5-466F-9C98-58F96EFA2FEF"},"incident_date":"2013-02-22","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b1229828ba3","org_name":"New Hampshire Department of Health and Human Services (DHHS)","org_type":"government","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/xerox-20130617.pdf"}],"summary":"On February 22, 2013, we inadvertently published the names and SSNs of 13 deceased individuals on a website maintained for the New Hampshire Department of Health and Human Services (DHHS).  We were informed of this matter by DHHS on March 20, 2013, and immediately took the websit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38b813d21a09202ffdc7dd084d7d644f414cf51e","impact_type":"unknown","incident_date":"2012-12-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/WalgreenPatient%20letter.PROOF__1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"f0d8fa16d7c5","org_name":"Crescent Health Inc. - A Walgreen Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38976"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5750a9412979c6321269cfb8ada0db03f0860fc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B09C77DC-3C1E-41E8-A235-CB4A705849BC"},"incident_date":"2013-02-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4b178692f94","org_name":"Tomren Wealth Management","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/tomren-wealth-management-suffers-security-breach.html"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/State%20Notification%20Packet_0.PDF"}],"summary":"Malware designed to send spam discovered on server that also contained clients' personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08def7589bc1c7b00dd875eab6cc827d03262e07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F992D62-10F1-45AB-AF87-2F6511B73956"},"incident_date":"2013-02-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"deaa8f0c0ee1","org_name":"Guidance Center of Westchester, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1416,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"On February 22, 2013, the Guidance Center of Westchester discovered that a central processing unit (CPU) had been removed form a staff member's office.  The CPU was removed on February 21 and contained, names, Social Security numbers, dates of birth, dates of admittance to the Ce","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0cce762d51748bf47eef04491eeb46559702dfe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FC9F790-3509-4B97-8BE7-05BFB2F08542"},"incident_date":"2013-02-21","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e22d11d99a9","org_name":"Central Pacific Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.khon2.com/2013/09/11/man-arrested-in-atm-skimming-scheme/"}],"summary":"two men installed skimming devices on an ATM in Hawaii and then stole money from another ATM of the same bank after obtaining the account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e938ab0e0846a41189509ff377238b5b6b4e7ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B060248C-7F76-45D6-AAB1-BC4D87E8BDA1"},"incident_date":"2013-02-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5b173b73958","org_name":"Arizona Oncology","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Laptop theft results in exposure of 501 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fd6da8336846b7d4d71f0cc52766783e7af340f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBA27971-8390-48F1-86B4-59F9F28F129A"},"incident_date":"2013-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61b2b44220f7","org_name":"Brandywine Senior Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-225397.pdf"}],"summary":"Employee PII and banking information breached from assisted living corporate payroll system. Changes were made to direct deposits information, but the intrusion was discovered before any payrolls were processed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c77ccb3c4e4e6544443e06b54515932da961c09","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41D3BB37-FE85-4BD9-99D4-D3D79F80824F"},"incident_date":"2013-02-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"789c787a816e","org_name":"Eighth Day Sound","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227134.pdf"}],"summary":"Laptop stolen from vehicle exposes SSN, name, DOB, passport, and credit card data.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PK","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e994c7f7ddcde2b5fc66e4f7e3e76d814c0e22f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CFCCD57-0E84-496C-B758-69CE93F21048"},"incident_date":"2013-02-19","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"018597dfa6ae","org_name":"BSNL","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.livemint.com/Industry/ZoQivrvfFjfOJV74NGaW8K/Did-Pakistans-ISI-penetrate-BSNLs-systems.html"}],"summary":"Pakistan's Inter-Services Intelligence called Indian owned BSNL and posed as a major from the Indian Army.  They then followed up this call with an email to the staffer at BSNL to obtain critical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"238173b21960a6786ac0854f0904d9b04355ee63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31F5693C-B409-448B-AA0E-716ECD09FD90"},"incident_date":"2013-02-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"efc6f6e66962","org_name":"Texas Tech University Health Sciences Center","org_type":"education","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/texas-tech-data-breach-could-affect-700-patients.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/texas-tech-university-health-sciences-center-admits-data-breach.html"}],"summary":"Texas Tech University Health Sciences Center has announced a data breach that could affect approximately 700 patients, according to an eSecurity Planet report.  The error occurred on Feb. 18 while processing billing statements for around 700 patients. Their billing statements wer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7b3b446cf7dc1a2211ccf916b40518d49a67b72","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FE4677E-51D4-4DB3-90EE-0C1D18A8D3A9"},"incident_date":"2013-02-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"246f4f530243","org_name":"Mortonhall","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.stv.tv/scotland/214592-laptop-with-mortonhall-parents-personal-details-stolen-from-sands-lothian/"}],"summary":"A laptop containing information about the Mortonhall ashes scandal has been stolen.  The offices of charity Sands Lothian were broken into over the weekend. Among the items taken was the computer holding details of the charity's communication with the City of Edinburgh Council ab","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc4a375c916a128c7575934c423a192ba79769ec","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D35B9AFF-8047-4B75-9A87-49A8D53E4DC3"},"incident_date":"2013-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50676ef5810f","org_name":"JEA","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/prolexic-exposes-utility-customer-hit-massive-ddos-attack"}],"summary":"DDos on victim","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":"Cameron Lacroix","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9a1f5235f2dd118606e6199ed4efd0b8bde68d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8320814-9DC4-4F9F-A848-144AB8ABF8B9"},"incident_date":"2013-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2168fa59100f","org_name":"Zendesk","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://upennsocialbook.wordpress.com/2013/02/22/another-privacy-breach-your-safety-is-our-highest-priority/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/2029028/zendesk-security-breach-affects-twitter-tumblr-and-pinterest-users.html;http://arstechnica.com/security/2014/07/feds-unmask-mystery-hacker-who-hamburgled-burger-king-twitter-account/"}],"summary":"Customer service turned into customer disservice on Thursday, when a security breach at Zendesk spilled over to affect Twitter, Tumblr, and Pinterest users.  Zendesk, which supplies customer service software for the three companies, said on its blog that hackers downloaded the em","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"cameronlacroix"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"058014611bcdb7fbec50e727112c6ef51527a286","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1FAAC3C-DA87-4C6D-9057-C7BABC00527B"},"incident_date":"2013-03-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Release of Information (ROI) released a CD with Patient B's information, medical records, SSN, etc. to Patient A The label had the correct patient's information but the contents of the CD had Veteran B's information. This was sent to the National Guard and they are in the process","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29fe0de8885aa37f08af51cfe88104fa9642510d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B065EF2-A696-4FA2-B877-DE79D4E6430C"},"incident_date":"2013-02-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"40f76af742fd","org_name":"Central Hudson Gas & Electric","org_type":"energy_utilities","ransomware":null,"records_affected":111000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227155.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55972"}],"summary":"Hacking exposed 110K records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10c302820bd8bb425f8e191632c2715fcbfab1f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A75C9170-FE54-45CA-AAFA-8ED934B8FDD3"},"incident_date":"2013-02-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cec51e59c208","org_name":"Sonoma Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":1350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.sonomaportal.com/2013/05/24/hospital-discloses-privacy-breach/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42171"}],"summary":"Sonoma Valley Hospital announced today that it has notified a group of patients of a Health Insurance Portability and Accountability Act (HIPAA) privacy breach that involved the hospital inadvertently posting limited patient information on the hospital’s website.  According to Ri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22ed6b05f9b431fe00c3407d2d139ed83ce9aac8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15C4D1B4-A828-4D28-B8FA-74B5CA2910B3"},"incident_date":"2013-02-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b2995249cf9","org_name":"OrthoCare Medical Equipment LLC","org_type":"other","ransomware":null,"records_affected":93,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/orthocare-20130325.pdf"}],"summary":"A binder containing patient data was stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd1230633f0f0f57886e9e0ee80b2d3c5b005a3e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09330487-EDE8-4767-BBF8-9020A08FE4DF"},"incident_date":"2013-02-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"789e6520d1e4","org_name":"HomeCare of Mid-Missouri, Inc.","org_type":"healthcare","ransomware":null,"records_affected":4027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"theft of a laptop leaves 4027 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d1aff24b7f46008708715b16b72d37fd9fd4fc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D5E384A-4547-4E1B-BB77-37BC7FE33395"},"incident_date":"2013-02-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"121a78a4d8c0","org_name":"Froedtert Health","org_type":"healthcare","ransomware":null,"records_affected":43000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spamfighter.com/News-18210-Froedtert-Hospital-Declares-Computer-Security-Hack.htm,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachwatch.org/devil-in-the-details-data-breach-notification-letter/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.todaystmj4.com/news/local/191609761.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.froedterthealth.org/computer-security-incident,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.todaystmj4.com/news/local/191181111.html"}],"summary":"A computer virus was discovered on an employee's work computer account on December 14, 2012.  One of the files on the employee's computer contained patient names, addresses, telephone numbers, dates of birth, medical record numbers, names of health insurers, diagnoses, and other ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-02-13","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95ef8e9ef074b0f8efb4556f081971d6492d36c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"222E1498-6916-44A8-AA29-EF9E16BD55D2"},"incident_date":"2013-02-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f81831380b9","org_name":"PR Newswire","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/10/hackers-hit-pr-newswire-data-shows-up-alongside-recently-stolen-adobe-code/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/10/breach-at-pr-newswire-tied-to-adobe-hack/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.holdsecurity.com/#!news2013/c13i1"}],"summary":"Discovery of PR Newswire data on malicious server tied to Abode source code breach. Cold Fusion vulnerability is likely initial vector.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58163af9419140bf608d2220b684f8118bf5b962","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F56D02A-E8D5-4172-A3CF-01D51CEDA865"},"incident_date":"2013-02-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75c04b9656b7","org_name":"Ace Homecare LLC","org_type":"healthcare","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tbo.com/news/crime/tampa-teenager-charged-in-fraudulent-visa-card-scheme-b82494525z1"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baynews9.com/content/news/baynews9/news/article.html/content/news/articles/bn9/2013/5/21/detectives_armwood_h.html"}],"summary":"external actor uses physical access to unattended workstation to gather patient data and create fradulent credit cards","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfc9f3c7fff3d591f2237345dac182edec615cf7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40EBE1F8-46F1-4FF1-8D46-3CDDA82A827B"},"incident_date":"2013-02-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"addc7a5c6da6","org_name":"Wm. Jennings Bryan Dorn VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":7405,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/wm.-jennings-bryan-dorn-va-medical-center-admits-security-breach.html"}],"summary":"South Carolina's Wm. Jennings Bryan Dorn VA Medical Center recently sent letters to 7,405 patients warning them that an uprotected laptop was found to be missing on February 11, 2013. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9524e4d1997e8add6babc2c20b7e04b1fa2d894f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3741ECED-644C-4F42-AB6A-339D0D80E89B"},"incident_date":"2013-02-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a851629c89f","org_name":"West Georgia Ambulance","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Lost laptop exposes 500 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35857185ec9ae53f8c62d9684365226a7fea5cee","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F96BC88F-9A1A-48C1-9A4D-4F055A89A1A5"},"incident_date":"2013-02-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e0f1a6b5c21","org_name":"Madera Superior Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://madera.courts.ca.gov/"}],"summary":"Madera Superior Court website hacked and defaced by 04hazmi.  Sourced from insider interview.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1feeab37a8bf589d7c087842b5f3d2a034ffd11","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A47FDF07-69C7-4E91-98BC-28EAB4CE1480"},"incident_date":"2013-02-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"504d90f27100","org_name":"University of Minnesota","org_type":"education","ransomware":null,"records_affected":294,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.mprnews.org/oncampus/2014/01/u-law-prof-calls-data-theft-a-disaster-but-doubts-data-is-being-used/"}],"summary":"The theft of research data from a prominent University of Minnesota law professor has put almost 300 people at risk of identity theft, university officials said today. Professor Barry Feld said the February 2013 theft of a laptop, hard drive and scanner from under his secretarys ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-02-08","discovered_date":"2012-12-13","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5e482d0889302b050a7f6f544e61d2deed43c42","impact_type":"data_theft","incident_date":"2012-10-18","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Talk%20Fusion%20-%20Form%20of%20consumer%20notification%2021113_0.pdf"},"notes":null,"org_country":"US","org_id":"de39e15535e4","org_name":"Talk Fusion","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38863"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Talk%20Fusion%20-%20Form%20of%20consumer%20notification%2021113_0.pdf"}],"summary":"Talk Fusion reported that an intrusion into its customer databases compromised personal information, including names and Social Security numbers, and possibly payment card details.","supporting_quote":null,"technology_involved":["customer databases"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdfe6c9ff83a18a4ba899c50e88423d864e92afe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B801317A-04C0-46B2-A373-91AF94C249D8"},"incident_date":"2013-02-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6f9d302c390","org_name":"Mercedes-Benz of Walnut Creek","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/MB%20sample%20letter%20proof%20v2_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38981"}],"summary":"On Friday, February 8, 2013, around 7:00 am we discovered a forcible break-in at Mercedes-Benz of Walnut Creek’s dealership. Between the close of business on Thursday, February 7th and the morning of Friday, February 8th, a thief or thieves pried open a locked exterior door to th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b46463df2883311d32db0da00acf929f66af4486","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A9B6680-14B8-4097-8599-671631F76E2B"},"incident_date":"2013-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cbd4bf787a2","org_name":"University of Texas MD Anderson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":29021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15d9e8978fce66dc15a7b00b708f96ab2df0cad0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C527430-39D2-4E60-A5DA-176C28205623"},"incident_date":"2013-02-07","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2454e016fcbd","org_name":"Los Angeles Times","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/02/exploit-sat-on-la-times-website-for-6-weeks/"}],"summary":"The Los Angeles Times learned that a segment of its website housed malicious code for six weeks.  The subdomain OffersandDeals.latimes.com redirected visitors to a malicious website.  The website then used code to receive compensation for web traffic.  The compromise appears to h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c89e32f448780e51f3799f06560392b507805c0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C91349A-1EA2-4905-97A2-DC9444A6C366"},"incident_date":"2013-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9eb38d17361","org_name":"Lee Miller Rehab Associates","org_type":"healthcare","ransomware":null,"records_affected":10480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"466989825ff814fadd3b9dedb3d7ec4a53a13c24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E077CB24-85A5-4F89-80DB-EB19B7A07B95"},"incident_date":"2013-02-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"feb8b3b53b28","org_name":"Christ Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2013/08/20/60422.htm"}],"summary":" A hospital fired a worker after she reported that her co-workers mocked a patient who had a dildo so far up his rectum that it had to be surgically removed, the woman claims in court.      \"Around this same time, one of the hospital employees, with access to the patient's Protec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a53081ae7d4b367c147ee1b7043335af14a578ef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BEEEB63F-AE9F-4A2C-B817-0867F8494E94"},"incident_date":"2013-02-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c82818edd3d0","org_name":"American HomePatient Inc.","org_type":"healthcare","ransomware":null,"records_affected":1103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42214b3564bef0074c50ec329a65b45b3764c3e6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AF5AA87-3F90-4F1E-A387-4AFB8DF69857"},"incident_date":"2013-02-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b23bd4c4bfe7","org_name":"1st Response Medical Transport Corp.","org_type":"healthcare","ransomware":null,"records_affected":552,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5195e7970cc147ce319867614412cd52ba330922","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1260F763-CC95-4A3E-AA6F-F74AC699AB47"},"incident_date":"2013-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc9996a96bf1","org_name":"ThuyssenKrupp OnLine Metals, LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/thyssenkrupp-onlinemetals-20130502.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/ThyssenKrupp%20OnlineMetal%20LLC%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"An intruder gained access to their website (www.onlinemetals.com) between 2/5/2013 and 3/10/2013 by exploiting a vulnerability in a vendor product.  This may have compromised names, credit/debit card numbers and card verification numbers of customers, plus mailing address, email ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df629a727873cc6203735698e382b1fcaa7591b4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B26E013-8A3A-4AF9-AB99-E1572169E305"},"incident_date":"2013-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6bb9994a570","org_name":"Lancaster General Medical Group","org_type":"professional_services","ransomware":null,"records_affected":527,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lancastergeneralhealth.org/LGH/News-Home/News-Room/News-Releases/2013/Document-with-patient-information-stolen-from-Croo.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://lancasteronline.com/news/agitated-patient-steals-medical-record-containing-personal-data-lancaster-general/article_60a03ccc-372d-5825-b486-3359e4fc5eae.html?mode=jqm"}],"summary":"A patient at Crooked Oak Family Medicine has stolen a document listing personal information about 527 other patients, the practice's owner, Lancaster General Medical Group, said Thursday.  According to LGMG, the document, which was stolen Feb. 5, does not show patients' Social Se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-02-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25bed97e81981ec73a3ba7fabee911b666f83e3c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DFDDC7A-B269-4680-893E-8BC849B30D94"},"incident_date":"2013-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee3df5788817","org_name":"Federal Reserve Bank","org_type":"financial","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3424445/anonymous-posts-personal-data-of-4000-bankers-online/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/2013-08-23/fed-evaluating-breach-of-employee-data-with-law-enforcement.html"}],"summary":"Personal information on some 4,000 people in the banking industry, including bank officers, was posted online Sunday by the hacker collective Anonymous.  The list was initially posted to the website for the Alabama Criminal Justice Information Center (ACJIC), then apparently take","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c0aef214293504ef332efdb883072b371023b3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C58AF059-829B-4B32-A347-B1F4ED355C5C"},"incident_date":"2013-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/timber-blinds-20130306.pdf"}],"summary":"Experian identified that its client, Timber Blinds, had certain Experian consumer information accessed without proper authorization.  The consumer information consists of information typically found in a consumer report.  Such information includes your name and address and one or","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12ad81ae1aa711ad2b6376f5e01fa03e9290976f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65F565DF-46B1-4DE1-BF3C-719B89296F58"},"incident_date":"2013-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a253b90dc53d","org_name":"eReplacementParts.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ereplacementparts-com-20130926.pdf"}],"summary":"An unauthorized party accessed their email server.  Since some customers emailed their credit cards to the company, they may have been compromised.  They were unaware there was any credit card data on this server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a3ea17ff2224d8cbcdd846a45edf4e07d5ce022","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D80547BC-D6D7-4913-ADD4-2721618135BC"},"incident_date":"2013-02-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e05edfafdc09","org_name":"Washington State Department of Social and Health Services","org_type":"government","ransomware":null,"records_affected":652,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dshs.wa.gov/mediareleases/2013/pr13011.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.king5.com/news/local/Laptop-containing-DSHS-clients-confidential-information-stolen-200642441.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/washington-state-dept.-of-social-and-health-services-suffers-security-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewstribune.com/2013/03/29/2535903/dshs-contractors-laptop-stolen.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://dshs.wa.gov/mediareleases/2013/pr13011.shtml"}],"summary":"Stolen Laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"091ff852eaa7b2425f79699c1d5e6f9847c928a9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B426009-CF27-4807-9EC5-420035CFA0C3"},"incident_date":"2013-02-04","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9340dba0460","org_name":"NetSeer","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/netseer-suffers-hack-triggers-google-malware-warnings-7000010776/"}],"summary":"If you visited ZDNet earlier today and were warned by Google that you were entering a site with known malware, you weren't alone.   Internet advertising network NetSeer suffered a hack to its front-end Web site today that rippled across the Web sites of its advertising partners. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22ec80471aee2baad58f1027b765456ca3e79696","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F6F10A3-228D-4D28-BAF9-8618C65DF44D"},"incident_date":"2013-02-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"021bf26af99b","org_name":"UnityPoint Health","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessrecord.com/Content/Default/-All-Latest-News/Article/UnityPoint-Health-reports-health-data-breach/-3/248/60268"}],"summary":"Personal information of approximately 1,800 hospital patients from across UnityPoint Health's operating regions may be at risk from the security breach in the system, which was discovered Aug. 8 during the course of regular audit, the health system said in a press release.      U","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"609112dd3cdaab2a57d4b44708c3f0b821ca0d9b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64926F12-E053-4905-833E-CF2A22E1AAFD"},"incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0602d4b0d63c","org_name":"United States Federal Reserve","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.veracode.com/blog/2013/02/stolen-data-headers-from-the-federal-reserve-hack/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/finance/economics/9853843/Federal-Reserve-admits-personal-information-stolen-by-hackers.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.guardian.co.uk/business/2013/feb/06/federal-reserve-anonymous"}],"summary":"The hacking group known as Anonymous claimed responsibility for a hack of the Alabama Criminal Justice Center and indicated that they had access to US Federal Reserve servers. Some internal documents were also exposed.  The hack attack was a response to the US Federal Reserve's r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0101601c5165a1b812fa937d75f99f115f0c0b37","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FB40B5D-E711-4DB9-996B-AE3D542C2552"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"47c69d920894","org_name":"State of North Carolina","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Form%20Individual%20Notification%20Letter_0.pdf?"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226408.pdf"}],"summary":"CSC is a contractor for the State of North Carolina. In the course of performing services for the State, we put information from the Medicare Exclusion Database on a thumb drive. This information included your name, Social Security Number (SSN), federal tax Employer Identificatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd06f678b99cd6d3447f00394f14e828688a67af","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BEF42051-EE6A-4BE3-8E8D-C2D7D69BEF41"},"incident_date":"2013-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d31b83bc03e","org_name":"St. Mary's Bank","org_type":"financial","ransomware":null,"records_affected":115775,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/St-Mary-s-Bank-Warns-115-775-New-Hampshire-Residents-After-Malware-Incident-369711.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nhbr.com/July-26-2013/Security-breach-hits-St-Marys-Bank-customers/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/st-marys-bank-20130712.pdf,"}],"summary":"Last week, New Hampshire-based St. Mary’s Bank, a credit union regulated by the New Hampshire Banking Department, started alerting customers after a piece of malware was discovered on several of the organization’s computers.  A total of 115,775 New Hampshire residents are being n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1d02e7e86aac6dca534ccca1eb0fbbb1b92bf0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC1CA5E6-4FA4-428D-9BDD-7AECBC7FBEAA"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7cd3e6f47470","org_name":"South West Essex Primary Care Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2014/pharmacist-who-unlawfully-spied-on-family-and-friends-medical-records-prosecuted-13112014;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krollontrack.co.uk/company/press-room/legal-technologies-news/pharmacist-punished-by-ico-after-stealing-medical-records324.aspx"}],"summary":"A pharmacist who worked for South West Essex Primary Care Trust has been prosecuted by the Information Commissioners Office (ICO) after unlawfully accessing the medical records of family members, work colleagues and local health professionals.   Appearing at Barkingside Magistrat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c5a48261e01fdfa9b1b08d06a5a5633f7fb8213","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B00F5B7-58BC-413F-B8A2-F94417D26E32"},"incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2c67b4cade2","org_name":"Sierra View District Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.recorderonline.com/svdh-computers-possibly-compromised/article_32f89567-dacf-5d38-944a-79950d3ff5d8.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://technews.tmcnet.com/news/2013/02/16/6928185.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.recorderonline.com/articles/svdh-56010-hospital-view.html"}],"summary":"A possible security breach within Sierra View District Hospitals network system was identified late Wednesday after the hospitals Information Technology Department observed unusual activity on the network. At this time we have no indication that patient information has been compr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1c4397793d957ef76b0e2052e229ba77274460f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F56CD4C-CF8D-475F-8795-ECE404B2CEC0"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"903f7ae5c7eb","org_name":"Sentience Psychological Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wildabouttrial.com/laptop-stolen-from-home-of-key-witness-in-jodi-arias-trial/"}],"summary":"Just when the Jodi Arias trial couldn’t get any more scandalous, a key witness reported that her home was burglarized and her laptop was stolen.  Dr. Janeen Demarte is a clinical psychologist who evaluated Arias and she is expected to testify as an expert witness for the prosecut","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa9f4b38b22ab1e71d76d899b638af498f7d31c2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D353F8F0-5919-42C8-8DB0-7FBCAB183FA1"},"incident_date":"2013-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d88343dd389","org_name":"Roy's Holdings, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/roys-restaurants-hit-by-security-breach.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42164"}],"summary":"Malware infected an employee's desktop computer.  Roy's restaurants in Ko'Olina, Waikiki, Kaanapali, Poipu, and Waikoloa were affected.  Anyone who used a debit or credit card at those locations between February, 1, 2013 and February 25, 2013 may have had their payment card infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f6a051eb0a4b5fe079718ef91abdbb671486454","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42C73370-097F-4026-9DDD-4C21330FB62F"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4e906396b85d","org_name":"Prince Edward Island Department of Innovation and Advanced Learning","org_type":"healthcare","ransomware":null,"records_affected":1600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cupwire.ca/2013/02/26/pei-government-mistake-leads-to-breach-of-student-privacy/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://upeicadre.tumblr.com/post/44061337784/provincial-government-mistake-leads-to-breach-of;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/news-stories/identity-protection/Canadian-College-Student-Records-Breached-Again"}],"summary":"A mechanical error at the Prince Edward Island Department of Innovation and Advanced Learning has led to the public display of an undisclosed amount of students social insurance numbers.  A statement released Feb. 25 indicated that over the weekend, staff at the department were p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b476d77cea839017a62e330140d8abfd868a3a83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CDA1F61-B3A1-422F-8D15-3EDCA70824EA"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec99d3cc6717","org_name":"Polk County School District","org_type":"education","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/article/20130220/NEWS/130229907/1134?Title=Nearly-200-Students-Warned-of-ID-Theft-Risk-After-Tax-Form-Mishap-By-School-District&tc=ar"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/article/20130220/NEWS/130229907"}],"summary":"The Social Security numbers of nearly 200 students who paid tuition for education programs could be compromised, according to a letter sent out recently by the Polk County School District.  Pennie Zuercher, director of financial reporting for the district, said that between 150 a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"768353408353d9a5c0154e3976f9005e15f411f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"383C2ED2-E985-400A-9D3B-D1409482906A"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"298c918659a8","org_name":"Peoples Bank of Commerce","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/peoples-bank-20130501.pdf"}],"summary":"On February 2, 2013, a backup tape containing customer information was stolen from a secured vehicle in Roseville, MN belonging to a Peoples Bank of Commerce employee.  The investigation revealed that the stolen backup tape contained customer names, addresses, SSNs, account numbe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19bfcf959cc4f3ac6cc0ff1bcb48e848ee9cef79","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EED4AA11-7607-4FDC-AC66-328DA0AFFEA5"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfd0b67c193f","org_name":"North Los Angeles County Regional Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hometownstation.com/santa-clarita-news/stolen-laptop-contained-medical-info-disabled-consumers-33430"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38752"}],"summary":"A laptop computer stolen out of an employee's vehicle held the medical and certain personal information about developmentally disabled consumers of the North Los Angeles County Regional Center, according to an agency notification published Friday.  The agency is a nonprofit servi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"780baeba72e57b3c734b99076b9fc4a04344c6ae","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D99E3CEB-218E-46A7-B88A-7DD4B5CC2A21"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1c294960cec","org_name":"New Mexico Medical Board","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/news/national/nm-abortion-complaint-highlights-privacy-concerns-article-1.1257650"}],"summary":"New York woman's intimate personal details made public in New Mexico abortion clinic probe The case raises questions about whether anti-abortion groups' aggressive tactics to halt abortions encroach on patient privacy  ALBUQUERQUE, N.M.  A woman from New York came to New Mexico t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6380aae0b9a017c93d0cda7f032afde6d6a942a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7A8B5A5-7919-4925-B524-C0CE847DDC85"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bcd3617437be","org_name":"Netflix","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com/article/681426/Netflix_Fires_Call_Center_Worker_for_Stealing_Data,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/netflix-20110420.pdf"}],"summary":"Internal actor working at Netflix Call Center accessed credit card information of customers without authorization.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f22dd9906e2754373588e942b77c929f586b728e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B20CCBE3-EF6E-440E-8EA7-A0F45A9BBFEF"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8469aa29c37","org_name":"Mount Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/former-mount-sinai-medical-center-employee-convicted-in-patient-id-theft-for-tax-refund-fraud-scheme/;"}],"summary":"Oliver Gayle of Miami has been convicted in an tax refund scheme involving the theft of patient information from Mount Sinai Medical Center. Gayle, who was employed as a temp, had a previous felony conviction on RICO/racketeering charges  prior to his employment at the medical ce","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adc631236c65cbec733472e8b1eb2f7db6fc5c48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2376784A-4D9D-4C69-8B6E-8E2CAB429BF9"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9eda0c77886","org_name":"Merit Health Northwest Mississippi","org_type":"healthcare","ransomware":null,"records_affected":810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressregister.com/article_25c5ba2e-4cf8-11e5-8e64-f32bb07d6ee0.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/hipaa-breach-hospital-after-worker-swiped-patient-data"}],"summary":"Merit Health notifies patients of security breach  Merit Health system based in Jackson, Miss., only learned of the breach after local law enforcement notified them that one of their employees at Merit Health Northwest Mississippi was under investigation for identity theft, accor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"AU","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c388f08622f13ce044a41d7a41b5fd3339ff5c41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA97E31E-4558-435D-81F5-6B40EE5D28EB"},"incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b85f9b1c1cd8","org_name":"Mayer Brown LLP","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2014/02/16/us/eavesdropping-ensnared-american-law-firm.html?_r=0"}],"summary":"Australian Signals Directorate intercepted and monitored private talks between a law firm and the country of Indonesia regarding a trade dispute between Indonesia and the US. Australia then offered to share the intel with the United States. Unclear if US accepted the offer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"388c1993949ae7f9325110f01dddd4ec2da9e258","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"545A64F6-DC89-4B2F-B327-DA614EF9AE3C"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/3-4-13%20MassMutual%20CA%20Client%20Notification%20Letter_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-39104"}],"summary":"An error at Convey Compliance Systems, Inc. resulted in 1099 forms being mailed to incorrect addresses.  The 1099 forms contained names, Social Security numbers, tax identification numbers, and addresses.  The financial information of some Massachusetts Mutual Life Insurance Comp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"791bf3c1d74439c1e5ae0e06abc8c5f34243ea07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6B88926-C69C-4E8D-9F43-D7CDDA425B80"},"incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3559207306f5","org_name":"Market Square Restaurant","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunjournal.com/news/1328099"}],"summary":"Restaurant identified as CPP in payment card breach. No details provided in public disclosure as to how breach occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08989a9c1c366213edf2bce8505913ab376883c9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05F8D52D-BF42-43F2-A689-BE48AF81584E"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"d92d943bfdc3","org_name":"Israel's Atomic Energy Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.presstv.ir/detail/2013/02/26/290964/israeli-aec-official-laptop-stolen/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.israelnationalnews.com/News/News.aspx/165610"}],"summary":"The laptop computer of head of Israel’s Atomic Energy Commission (AEC) Shaul Horev has been stolen from his house, Israeli sources say.   Police say the laptop may have contained top-secret information. According to Ynet, Horev is in charge of Israel's nuclear policy.  Horev’s wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a9910e62e677d77a51a2d581374b53ca68a6464","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C50C0C8-95DB-4637-BCA8-987070133213"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25135a5dd607","org_name":"Grigoriy Mashkevich, M.D.","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.techdirt.com/articles/20130627/18004323644/woman-sues-plastic-surgeon-23-million-because-he-put-beforeafter-pictures-her-web.shtml"}],"summary":" bunch of folks have sent in variations on the following story involving Catherine Manizone, who had a nose job done a few years ago by plastic surgeon Grigoriy Mashkevich, but who is now suing him for $23 million. You might think that the lawsuit is about the nose job gone wrong","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"SG","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d621adb1ff8c33d9969908fc039d34b0c1e61079","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8D4C215-17BC-4518-A64F-4767BF656D32"},"incident_date":"2013-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"9e6365654fd1","org_name":"Fuji Xerox Co., Ltd.","org_type":"manufacturing","ransomware":null,"records_affected":647,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/sg/stanchart-client-data-stolen-in-singapore-via-fuji-xerox-server-7000024007/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Standard-Chartered-Bank-Statements-Found-on-Anonymous-Hacker-s-Laptop-406791.shtml"}],"summary":"Monthly statements belonging to 647 private banking clients (Standard Chartered Bank) were stolen via the bank's outsourced printing services provider (Fuji Xerox). The bank pointed out based on its investigations to date, the theft did not occur through its IT and data security ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f23c9e083f355840d9b3802076feb12bbb79a1ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22D583BE-04B4-4DAC-8A1F-1ACC3EAF6EDE"},"incident_date":"2013-02-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dedf7454dd1b","org_name":"Forbes Inc.","org_type":"technology_saas","ransomware":null,"records_affected":1071963,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/02/Forbes-Hacked-Syrian-Electronic-Army.html#"}],"summary":"Forbes hacked by Syrian Electronic Army. Customer details posted to web, and false headlines posted to website","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bf8d0bffafd750135d64e2cfe54e1d4d3637637","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62525E18-B3A1-40CE-AFB7-BF556616F349"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa0fa2248e42","org_name":"First National Bank of Southern California","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/sample%20final%20letter_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-39026"}],"summary":"A back-up tape that contained First National Bank of Southern California client information was stolen on February 1, 2013 from a data service provider.  Social Security numbers, taxpayer identification numbers, account balances, and account numbers were exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efec80fb42dad0aaee6bdc60bae3a3bd26c85636","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"614A97FB-B1D5-4CDD-8713-7006874E379B"},"incident_date":"2013-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5a561b30a5a8","org_name":"Financial Transactions and Reports Analysis Centre","org_type":"government","ransomware":null,"records_affected":777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestarphoenix.com/news/data+stolen+from/8006032/story.html"}],"summary":"The federal agency charged with preventing the flow of money to organized crime and terrorists had an encrypted laptop, hard copy reports and an unencrypted USB memory stick stolen in October, exposing the personal information of patrons to two Alberta casinos, including how much","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cb87e1327777d9b858c37e5b944f3ac71580f87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71D6CD5B-0FFB-4AB4-8194-17675FC4B27A"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"561abb6d66ba","org_name":"Dr. Kenneth Kiser","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcyb.com/news/Local-medical-records-found-in-Alabama-dumpster/18427904"}],"summary":"A resident in Florence, Alabama made a surprising discovery inside a dumpster dozens of medical records had been tossed out with the trash.  Police traced those records back to a doctor's office in Norton, Virginia.  \"It's concerning because there are phone numbers, birth dates, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78dc5343d2e0c0bb487025ad3dd4921485f733e3","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84615547-6F31-4023-8DE0-7B4D913DEC09"},"incident_date":"2013-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f3376d5e510","org_name":"City of Madison, WI","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://host.madison.com/daily-cardinal/news/city-website-shut-down-for-weekend-due-to-security-breach/article_301ffc1a-7428-11e2-8c7f-0019bb2963f4.html"}],"summary":"City website hacked to place 3rd party web ads.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"488bd5a2b19bc56a46e7bfc5232b88bb77177320","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97494439-6F2A-4B96-AF04-5746F5067DCD"},"incident_date":"2013-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"016c1f6ff93c","org_name":"Chapman University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Version%20%28SENT%204-11-13%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226407.pdf"}],"summary":"On February 27, 2013 Chapman University officials learned that certain electronic documents containing personal information could have been viewed by authenticated users of the Chapman University system. These documents were never available to the general public, and only authent","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"599237f6f41ad84db08d861933862df67ab11f14","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C1A9547-5B92-4D1B-8464-C27F2DDDEFB3"},"incident_date":"2013-02-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"592a6a0e6043","org_name":"California Department of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/State%20Notification%20Packet_0.PDF?"}],"summary":"Spamware detected on a host containing PII, but no evidence of PII leakage was found.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"695cfa4cf08ddeae08c4bf7f139fa68e1b674eb9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3DA37E3-2BE3-4861-AF13-EE14A4763893"},"incident_date":"2013-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"bc848c9d9cc6","org_name":"Bank of America","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://greenwich.patch.com/groups/politics-and-elections/p/romanian-national-gets-18months-in-jail-for-atm-skimming-scheme"}],"summary":"ATM skimming operation was conducted in CT by Romanian-based criminal group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"def2867079a2d23d7dbb0dc5e38e1adecb038ef9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B6B11328-10E5-46F1-ABFE-7BD4BD18118A"},"incident_date":"2013-02-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"OM","org_id":"4ab35ecc71c9","org_name":"Bank Muscat","org_type":"financial","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/03/01/bank_muscat_atm_mega_fraud/"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/11/feds-say-thieves-in-atm-heist-nabbed-after-stuffing-800000-in-suitcase/;http://news.softpedia.com/news/8-People-Arrested-in-Spain-for-Role-in-45M-33M-Cybercriminal-Scheme-412696.shtml"}],"summary":"12 Bank Muscat prepaid Travel Cards were compromised on February 20, 2013. The gross value of transactions on these cards, which were compromised outside of Oman, was RO 15 million.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a0d734b67d8e850ef8cb10546ce22ef70e055d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01a87160-9c81-11e7-8eb8-67f320c42447"},"incident_date":"2013-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5d85801c97e6","org_name":"Aviva","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.insurancetimes.co.uk/police-probe-after-aviva-claims-details-stolen-by-staff/1407060.article"}],"summary":"Police probe after Aviva claims details stolen by staff","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"ID","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49f6cab0085ea5d73a17bce3d8b8904f44baab1f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7BF2AE4-0FBB-4428-9B60-FF27096A20ED"},"incident_date":"2013-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ID","org_id":"64e8ebf71af5","org_name":"Indonesia Federal Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarzone.com/anonymous-defaced-indonesia-government-websites"}],"summary":"Anonymous defaced Indonesia government websites  Submitted by siavash on Thu, 01/31/2013 - 15:22    The coordinated cyber attack is seen as retaliation for the arrest of 22-year-old Wildan Yani Ashari, who hacked the presidents website earlier in January.  Anonymous Indonesia and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34e59759977d23b293dc5ffbad53adb9be40ad4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45ADAE86-407F-4322-AC50-BBCC7ADC2A4A"},"incident_date":"2013-01-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc383d1ac114","org_name":"Fayetteville Veterans Affairs Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1093,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/57002"}],"summary":"Optical shop consultation reports were placed in a publicly accessible recycling bin over a period of three months rather than properly disposed.  The documents contained names, Social Security numbers, addresses, dates of birth, and prescriptions.  The issue was discovered on Ap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6efa06028b13b4c3ec00face0ca958423174a2b5","impact_type":"unknown","incident_date":"2012-12-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Template%20Breach%20Notice%20Letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4329043fb9c4","org_name":"Stethoscope.com LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38760"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"341b48de16b8fef4797499841447db56f375e235","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDAD70AE-3C86-4D6C-AE21-8AE8DEFCC35B"},"incident_date":"2013-01-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8d4b6dfd1ba","org_name":"Zalicus","org_type":"manufacturing","ransomware":null,"records_affected":48,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/zalicus-20130201.pdf"}],"summary":"Tax forms mailed to incorrect individuals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddd75ced02bb5165b01cb9ae5d790cf3441b67d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B97C14D-A6C3-4DC1-BADF-0B57FE9B2A27"},"incident_date":"2013-01-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70e7897e67c5","org_name":"Stanley Black & Decker, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20notice_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/L2Employees%20re%20stolen%20laptop%5B1%5D_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Stanley%20Black%26Decker%204_16_13update_1.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41080"}],"summary":"The theft of an employee's laptop resulted in the exposure of information from employees and people who received checks from Stanley Black & Decker.  Names, and the account numbers and routing numbers associated with direct deposits may have been exposed. The laptop was stolen fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-28","discovered_date":"2012-12-03","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7fe102a63477f07015bfaa3dd2fe6c1ca76fb26","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"8781a746ae79","org_name":"RR Donnelley","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38746"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_1.pdf"}],"summary":"A desktop computer containing personal information entrusted to RR Donnelley was stolen, with no indication that the information was accessed or misused.","supporting_quote":"According to RR Donnelley, a print and mailing vendor that UnitedHealthcare uses, sometime between the second half of September and the end of November, 2012, an unencrypted desktop computer was stolen from one of its facilities.","technology_involved":["desktop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1dd6f672595b61ef997f62498f62fe4b679988e6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DFC803E-1147-4DD4-8F86-BB55F052D51A"},"incident_date":"2013-01-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4c4c47fed1e9","org_name":"University of Guelph","org_type":"education","ransomware":null,"records_affected":19000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.nationalpost.com/2013/02/15/university-of-guelph-will-cover-cost-of-identity-theft-protection-after-15-computers-with-student-info-stolen/?__federated=1"}],"summary":"The University of Guelph will cover the cost of identity theft protection for students after the theft of campus computer equipment which may have contained private personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22e2b121cb33cf5165eeb8705d374a373f63356b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78ee4940-6c82-11e7-8419-7d473c8dcba3"},"incident_date":"2013-01-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dfd4cdc1253","org_name":"Navarro Security Group","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2017/07/10/when-sysadmins-attack-again-former-worker-gets-seven-years/"}],"summary":"Jonathan Lee Eubanks, a 29-year-old Florida man, has been sentenced to seven years in federal prison after he used a remote access Trojan (RAT) to rain down cyber fire and brimstone on his former employer.  His crimes: rerouting visitors to his former employer’s website to a riva","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca975469ef0dfe34bc0acc091d9e30baabea8a72","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"553E7277-4C8B-4210-A3C0-8FE8FEEE5B65"},"incident_date":"2013-01-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ecea832e23f","org_name":"U.S. Sentencing Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.salon.com/2013/01/28/anonymous_hacks_doj_website_for_aaron_swartz/"}],"summary":"U.S. Sentencing Commission site hacked in protest of Aaron Swartz ruling.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d925e5d3f0631544211075520dbb32529e823db1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B8A6B7F-EAD5-42D9-8D72-93008EFBBCE1"},"incident_date":"2013-01-26","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19c6a5a5bd6d","org_name":"Federal Sentencing Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://gma.yahoo.com/blogs/abc-blogs/anonymous-hijacks-federal-website-threatens-doj-document-dump-174943824--abc-news-politics.html"}],"summary":"Anonymous Hijacks Federal Website Over Aaron Swartz Suicide  Activists from the hacker collective known as Anonymous assumed control over the homepage of a federal judicial agency this morning.  In a manifesto left on the defaced page, the group demanded reform to the American ju","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"DarkWeb Goons (BreShiE aka @irBreShiE)","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ada3ca5cd3983df507d0cf73582d938ab19c3a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB38D5E3-0EC2-4C20-8E59-D2D1D1FCFBE5"},"incident_date":"2013-01-25","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6d36e1a80adf","org_name":"The Public Whip","org_type":"nonprofit","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/01/25/the-public-whip-hacked-90000-credentials-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/2013/02/07/16-31-january-2013-cyber-attacks-timeline/"}],"summary":"SQLi attack compromising 80K records with full credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"darkwebgoons"}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-01-25","discovered_date":"2013-01-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e50eda275991dd271034ed17731e5d550bf04c2","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multi-state%20notification%20letter%20-%20Crafts%20Americana%20-%20letterhead_0.PDF"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"8209b0a6bf08","org_name":"Crafts Americana Group, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A file containing personal and credit card information was accessible to outsiders without authorization on the organization’s internet servers.","schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Multi-state%20notification%20letter%20-%20Crafts%20Americana%20-%20letterhead_0.PDF?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38867"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multi-state%20notification%20letter%20-%20Crafts%20Americana%20-%20letterhead_0.PDF"}],"summary":"Crafts Americana Group reported that a file containing personal and credit card information was potentially accessible to outsiders without authorization.","supporting_quote":"On January 25, 2013, we discovered that a file on our internet servers containing your name, address, phone, and credit card number had been potentially accessible to outsiders without authorization for several weeks.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"554eac1dee4f00b56ca7bddba647e55492452f6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-24","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Equity%20Trst%205_8_13Security%20Breach%20NoticeBOTH%20_0.pdf"},"notes":null,"org_country":"US","org_id":"8bca820d0189","org_name":"Equity Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.trustetc.com/company/security/faqs.html/html."},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-41731"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/equity-trust-company-hacked-from-overseas-ip-addresses/"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Equity%20Trst%205_8_13Security%20Breach%20NoticeBOTH%20_0.pdf"}],"summary":"An unauthorized third party gained viewing access to some Equity Trust customer information, but the company found no evidence that information was acquired, copied, or removed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2012-4969"],"data_types":[],"disclosed_date":"2013-01-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16a6ab65989aabce8d564658d0823662565e05a5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9717E026-FEC8-4748-84EA-99F233391812"},"incident_date":"2013-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"838e901381e9","org_name":"Interdisciplinary Center Herzliya","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://community.websense.com/blogs/securitylabs/archive/2013/03/12/israeli-website-for-international-institute-for-counter-terrorism-waterhole-serving-cve-2012-4969.aspx"}],"summary":"SRAELI WEBSITE FOR INTERNATIONAL INSTITUTE FOR COUNTER-TERRORISM WATERHOLE ATTACK SERVING CVE-2012-4969  Websense Security Labs and the Websense ThreatSeeker Intelligence Cloud have detected that the government-related websites ict.org.il and herzliyaconference.org have been invo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2012-4969","kev_added":"2022-06-08","name":"Microsoft Internet Explorer Use-After-Free Vulnerability","days_listed_before_incident":-3423,"product":"Microsoft Internet Explorer"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-22","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2116c8210499a804bbdcc52273518a44910df372","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notice%20to%20Participants_0.pdf"},"notes":null,"org_country":"US","org_id":"340798fb8406","org_name":"NECA/IBEW Family Medical Care Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"The correspondence mailing inadvertently included a member’s Social Security number on the envelope.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38699"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20to%20Participants_0.pdf"}],"summary":"The plan reported that correspondence sent to members inadvertently included their Social Security numbers on envelopes.","supporting_quote":"Recent c orrespondence sent to you near the end of 2012 containing the NECA/IBEW Family Medical Care Plan’s (FMCP) generic Summary of Benefits Coverage and the Su mmary of Material Modifications disclosure documents inadvertently included your Social Security number on the envelope.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e3a6be229c5610b1746c25a6069c4dd7fb047f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F176622-7F44-4A0C-BC90-09E2D88E25DD"},"incident_date":"2013-01-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5679148ac60b","org_name":"Granger Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/03/25/utah-health-clinic-sends-patient-data-breach-notifications/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sltrib.com/sltrib/news/56048214-78/records-clinic-medical-breach.html.csp"}],"summary":"The Granger Medical Clinic, a West Valley City, Utah-based clinic, fears there has been a potential patient data breach after 2,600 medical appointment records from 2012 that were supposed to be shredded went missing on Jan. 22. The clinic sent out patient notification letters on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"293188fb1202275bcdb2bf9f3bff44860381687a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A122E8F-BF98-470E-B61D-44EA0A9B7F38"},"incident_date":"2013-01-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bca61fddb6c9","org_name":"Center for Pain Management, LLC","org_type":"healthcare","ransomware":null,"records_affected":5822,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Laptop Theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa5b60f3dc5263436a68a990942a6ef2cfd7555b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2DC9EB1-5724-4A14-8B17-E57B8590EB4D"},"incident_date":"2013-01-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b5799d0e3d2d","org_name":"Basildon and Thurrock University Hospitals","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pulsetoday.co.uk/about-pulse/weblinks/medico-legal/cqc-inspector-leaves-confidential-patient-information-on-hospital-ward/20003571.article#.Ud76tm1CqB0"}],"summary":"A CQC inspector left planning notes containing confidential patient information on the public ward of a hospital they were inspecting, a Pulse investigation has revealed.  Freedom of Information request shows Basildon and Thurrock University Hospitals declared a breach of patient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56cd889e1d5134dd6b32625c1ad19f54fb3aebdc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFC67214-FAF5-40A6-84D7-71F4B56EF4C5"},"incident_date":"2013-01-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6d4fc909807","org_name":"Eli Lilly & Co","org_type":"manufacturing","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.twobirds.com/en/news/articles/2013/china/eli-lilly-v-huang-shanghai-court-issues-interlocutory-injunction-against-breach-of-trade-secret"}],"summary":"On 19 January 2013, Huang downloaded 21 confidential documents from the company server without authorization. Despite Eli Lillys repeated requests, Huang declined to delete any of those documents but elected to resign.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38550bcd2ea30f0f1a7dde501572d6134a6f7516","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3082A6B-46F9-43FB-8786-320EB4B3AC6D"},"incident_date":"2013-01-18","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6992e8a7dbc","org_name":"Wyndham Vacation Ownership","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/wyndham-vacation-ownership-acknowledges-data-breach.html"}],"summary":"The Orlando Police Department notified Wyndham Vacation Ownership that a Wyndham employee had been arrested for participating in fraudulent credit card purchases.  The dishonest employee was fired the next day and may have obtained customer credit card numbers.  Wyndham learned o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2013-01-18","discovered_date":"2013-01-10","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c4847f69acdaa0f514b358484f1344fe1f18e69","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALLCLEAR_CHILD_0.pdf"},"notes":null,"org_country":"US","org_id":"df6cdb597f8b","org_name":"Stanford School of Medicine and Lucile Packard Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38696"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALLCLEAR_CHILD_0.pdf"}],"summary":"A physician's laptop containing limited patient and research information was stolen from a car; the organization said it was not aware of inappropriate access to the information.","supporting_quote":"The theft occurred Wednesday evening, January 9, 2013 when the physician’s car was broken into and the incident was immediately reported to the local police department.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f5cee5a81660c8cb684e1bb9604043fbb6eab0d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1B8E5FA-FADA-414F-9559-39988B2CBBE8"},"incident_date":"2013-01-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"990914aed6f0","org_name":"North Carolina Department of State Treasury","org_type":"government","ransomware":null,"records_affected":26000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.newsobserver.com/business/26000-nc-retirees-warned-of-security-breach"}],"summary":"Incident advised beneficiaries that as many as 26,000 envelopes mailed in January partially or fully exposed the recipients' Social Security numbers, although the actual number affected is believed to be much smaller.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cc74d25c80437c77ff027787fc5702f2d220204","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Notifications%20for%20Compromised%20Merchants%20for%20Dec2012_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38694"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db5498330f65b5f507f913c89e814e7a2a616550","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C523FCC-16A6-4511-BF60-A9DEE1E085C2"},"incident_date":"2013-01-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1914a1a1aab1","org_name":"Antioch Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20to%20employees%20regarding%20Benefits%20Breach%20for%20Antioch%20Unified%20School%20District.%20%20Mailed%20%201.22.13_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38802"}],"summary":"A document with sensitive Worker's Compensation claim information was accidentally sent out with an email to a limited number of Antioch Unified School District employees.  Social Security numbers and other information related to current and former employees that reported injurie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"883ac6857e0370f93ce33468471eba1a93d05f1a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEE01DE8-1255-4C66-B25D-4ECE8BCF75C7"},"incident_date":"2013-01-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aaf5b6e85491","org_name":"Westerville Dental Center","org_type":"healthcare","ransomware":null,"records_affected":850,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4749be3880d154eb9c25f9214395d93df3ce571","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"798B2B6C-0917-4F61-8C34-F52E8E2F68CB"},"incident_date":"2013-01-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7edd047af888","org_name":"Washington County EMS","org_type":"healthcare","ransomware":null,"records_affected":1435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e668ebcc3f82fb266b73deb77129d79678ffc6f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"741B1F9B-A50B-4DBC-B86E-17FD676D7710"},"incident_date":"2013-01-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab1a922aee6f","org_name":"University of Michigan Health System","org_type":"healthcare","ransomware":null,"records_affected":3999,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ea449bd344796601e2500c90cf2ca7f29d7d3a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CAB8519-1C4F-4D42-B7A0-1E004D3744D7"},"incident_date":"2013-01-29","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"HHS/OCR complaint from a VA employee/Veteran alleging impermissible access to her health record by 10 co-workers not involved in her care.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef661f3506ae7846dcd39f2aa32b8bcc5242727f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C5D14A2-CB54-4655-9681-CC38A56AB24C"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca32108d73a0","org_name":"St. Mark's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2988,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aa36b51d164dff3095eae6d9ad977600f104a15","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F2E29D3-8DF5-4C4C-8A0F-19B734BB8896"},"incident_date":"2013-01-17","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13ec7a4f2878","org_name":"Sprouts Farmers Market","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://sprouts.com/securityalertfaqs,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpho.com/story/21311165/sprouts-farmers-market-reports-security-breach-at-az-ca-stores,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sprouts-C2013027013%20CA%20AG%20Letter_Customer%20Letter_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.creditcardmachines.net/789sprouts-farmers-market-hit-credit-card-terminal-breach-customers-alerted-potential-fraud/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpho.com/story/21311165/sprouts-farmers-market-reports-security-breach-at-az-ca-stores"}],"summary":"POS Malware exposes customer payment card data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee2b343015cdc2c93ba2de1c27652b5add91546f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4197F856-A0FC-4913-86A2-F56DA43B96F2"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03be561fbf4c","org_name":"South Shore Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6db56824b74eb6a73f330d5b17801cf24b4b951","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1931A09-8B59-477D-AC27-52A2478D5C90"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a6f717915ad","org_name":"OHP PHSP, Inc.","org_type":"financial","ransomware":null,"records_affected":28187,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf680ad03deb205a0cdb9c6a1019d1eddd51eb46","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02C9CE96-A87D-4B46-A2C3-2E823F0A84FF"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca04bab7b4e7","org_name":"Group Health Incorporated","org_type":"financial","ransomware":null,"records_affected":1771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb36f34bf2a4160f4cd9955fa2c332be0d2256b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"703D5187-7D5D-4471-A541-630C9554634B"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09d6feaca202","org_name":"Harbor Medical Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":4343,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de7816dd48ca9c64b112cc51149f890c1950e287","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E85BC744-D3F6-4123-9DE0-70C02A92BD04"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18a356a8f41a","org_name":"Child & Family Psychological Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bc0e17ae7ff014c4f7ebd67337a8db50dc0462e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C8A2E5F-2A3E-4D25-ACDB-4B133E3A385B"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/DHCS_PrivacyIncident_0.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21a64db932cb","org_name":"California Department of Healthcare Services","org_type":"government","ransomware":null,"records_affected":2643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37139"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11e5dabe082f2c16d22b89de0d531f1a210930b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A434748-67B6-4336-A175-16FA0144AB5A"},"incident_date":"2013-01-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32265a30c4b7","org_name":"Cabinet for Health & Family Services, Department of Medicaid Services","org_type":"government","ransomware":null,"records_affected":1090,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c34293e1bf980be039b1d727503f982406182f07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E736688E-D817-4E43-B238-FC8E92938962"},"incident_date":"2013-01-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b0477e0c15a","org_name":"Schneider Electric, USA Inc.","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-38843"}],"summary":"SSN accidentally displayed in the address field of a utility customer mailing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17fec81adf6938736f3dc6a1eb755d1e981fe3e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36773F70-51BD-4707-8268-BD9184957C92"},"incident_date":"2013-01-16","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5294fd83783a","org_name":"Schneider-Electric","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Employee%20Letter%20Signed_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38843"}],"summary":"A vendor's mailing error resulted in the exposure of employee Social Security numbers.  Call for Candidacy letters were mailed sometime around January 16 that had Social Security numbers, names, and addresses visible through the address window of the letter.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"839548cb5f19d731115b2075bf471d68b4c5d8da","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"668D4C0E-4CDC-4709-BEDA-76A4479465B9"},"incident_date":"2013-01-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5dbead2480fd","org_name":"Celerant","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/payment-processing-services-provider-reportedly-breached-in-january-details-scarce/;"}],"summary":"Processor lost data, somehow and at some point, but never released details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"169294781d39e55716e66d13598691ecd8b3ee37","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9412E56E-A7D5-4F91-B679-8CCA29AF9379"},"incident_date":"2013-01-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e5b67f604e5","org_name":"Works Bakery Cafe","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmtw.com/news/maine/Works-Bakery-warns-of-data-breach/-/8792012/18386376/-/bu3f0s/-/index.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.worksbakerycafe.com/images/includes/WorksBakeryCafe.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pressherald.com/news/The-Works-Bakery-Cafe-in-Portland-warns-customers-of-data-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wmtw.com/news/maine/Works-Bakery-warns-of-data-breach/-/8792012/18386376/-/bu3f0s/-/index.html"}],"summary":"In a statement posted on the company’s website, Works’ founder Richard French writes, “I regret to inform you that, despite stringent security and precautions, we believe that The Works Bakery Cafe has fallen victim to cybercrime, a rapidly escalating crime against business. On o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4d7f56ee2f0d71198de2161896cd9d6eb6a0ecf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB26CE3E-5E45-4015-9F32-400FFD649EFB"},"incident_date":"2013-01-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9ae7543ce96c","org_name":"Mercy Health Systems","org_type":"healthcare","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-230930.pdf"}],"summary":"According to an August 13 letter signed by Chante Tindal, Compliance Generalist: on January 14, MHSs  transcription contractor, Allscripts, reported a missing unencrypted hard drive containing patient information. MHS says this was reported to them on February 14, and it is not c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de09fb56d35b9dd062e2b52b5d0dc34d3c1dd61c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2A8003D-884D-43FE-A487-77B819EE6760"},"incident_date":"2013-01-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d5346d94979","org_name":"Erlanger Health System","org_type":"healthcare","ransomware":null,"records_affected":87,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdef.com/news/story/Security-Breach-at-Erlanger-Health-System-has/dF_wE2QwdUKWmNoq2KnHDw.cspx"}],"summary":"Erlanger Health System sent notes to 87 families and apologized for an incident that left the patient records of children exposed.  The records contained names, Social Security numbers, phone numbers, and dianosis information.  Erlanger has not been made aware of the records bein","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"619bcf38faaa02329228812fb5a96b97dfc7f100","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31209D67-E1A2-49A2-8C79-C4E43C77D165"},"incident_date":"2013-01-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"73d19f536f53","org_name":"San Bernardino Department of Behavioral Health","org_type":"government","ransomware":null,"records_affected":683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sbcounty.gov/dbh/announcments/2013/Breach.pdf"}],"summary":"On January 12, 2013, a listing of DBH client information was stolen from the vehicle of a County of San Bernardino, Human Services (HS) employee.  The HS employee’s vehicle was broken into on January 12, 2013, and amongst the items stolen from the vehicle was the list of DBH clie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1cecd70c3ba54eb56036e3b18676371c5b3ff68","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA08EEA1-BB39-41E2-815A-2E6888F593FF"},"incident_date":"2013-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"other","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/18/ark-va-experiences-1100-patient-health-data-breach/"}],"summary":"According to enquirerherald.com, close to 1,100 VA patients records were found in a consulting optical shops recycle bin. From Jan. 11 and April 16, patients names, Social Security numbers, dates of birth, addresses and prescriptions were left exposed in this bin and the records ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed7b1373dc37ea7e25788815d92d3078c13d69a9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4E6DE1E-C994-48BB-B8E2-F0AC94DFD6A7"},"incident_date":"2013-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8d0ba0dce49","org_name":"Utah Department of Health","org_type":"government","ransomware":null,"records_affected":6332,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/utah-health-department-reports-another-data-breach/article/feed/488026,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sltrib.com/sltrib/news/56089160-78/health-monitoring-credit-state.html.csp,"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.securityweek.com/utah-data-breach-victims-get-additional-coverage,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/breach-notification-hipaa-privacy-security-utah-medicaid-45574-1.html,"}],"summary":"Loss of a USB stick puts 6,332 records at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eccd333f6337737bea11effcbb123ed3250e820a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66099CB7-F369-45C3-A960-BB41E4989C21"},"incident_date":"2013-01-14","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran A was sent a hemocult slide test with Veteran B's information on a label from a VA employee. Veteran A called to report that the label did not contain their information but had another Veteran's information on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9efb597fe257d9a090f23ad841efef186072e54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87F2D016-E2DB-43C6-8BF1-F07B6EC646B0"},"incident_date":"2013-01-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"021c62bc8de0","org_name":"Finish Line","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227154.pdf"}],"summary":"A laptop stolen from the firm's Chief Accounting Officer's vehicle results in SSNs, name, DOB and other employment details being at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-01-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a5ae9714b5eb62899c60fcf44dcee69c33af207","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-12-30","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/EJ%20PHAIR%20BREWING%20CO%20and%20ALE%20HOUS-C2012116470%20CA%20AG%20Letter_customer%20notice_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express Travel Related Services Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38599"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38813"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38941"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/EJ%20PHAIR%20BREWING%20CO%20and%20ALE%20HOUS-C2012116470%20CA%20AG%20Letter_customer%20notice_0.pdf"}],"summary":"American Express reported that a merchant experienced unauthorized access to data files containing cardmember account and card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f37a36a142b4017347f054647007dad4851d498e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09C0F425-997C-4AC2-9580-7726250C8A2C"},"incident_date":"2013-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdaf5e415aad","org_name":"Massachusetts Technical Institute","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/mit-website-hacked-by-anonymous-on-anniversary-of-aaron-swartz-suicide-7000025041/"}],"summary":"On the anniversary of young hacker and digital activist Aaron Swartz's death, Anonymous has re-engaged its Operation Last resort to hack MIT's website, taking over the server for its Cogeneration project. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9a1eb1fdce8a970acadf81c1726fe286dffd0f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAE5A879-361E-48A4-993F-6218143A24A4"},"incident_date":"2013-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"8f029518cc7f","org_name":"Argentinian National Rehabilitation Service","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Argentina-s-National-Rehabilitation-Service-and-Other-Government-Sites-Hacked-415584.shtml"}],"summary":"he Syrian hacker known as Dr.Sha6h is desperately trying to convince the US and other countries to intervene in Syria, which is why he continues to hack high-profile websites to spread his message.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd21497e7b5867bd66697dd36c248f05037618b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54D682E2-479C-4644-A504-872166386DC9"},"incident_date":"2013-01-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f373cbfbfd92","org_name":"United Home Care Services","org_type":"healthcare","ransomware":null,"records_affected":13617,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12171,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/united-homecare-services-informs-patients-of-data-breach/"}],"summary":"According to a spokesperson, on January 8, the billing manager took a laptop home with her, with permission. But on the way home, she stopped off to visit an ill friend for 10 minutes, leaving the laptop on the front seat of her locked car. In that short timeframe, someone smashe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08155295b4d625c67a4927bbc2212971b1829d17","impact_type":"unknown","incident_date":"2012-11-04","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Calvin%20Schuster%20Breach%20Notice%20_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"0c3b768fee19","org_name":"Calvin Schuster, M.D.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37745"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c3367103c727793a27f76dcb9bedf401ddffef47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9B2ADD3-4334-4817-9426-2813417DFBD0"},"incident_date":"2013-01-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85f13ccbdf69","org_name":"Anthem Blue Cross Blue Shield","org_type":"financial","ransomware":null,"records_affected":2206,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/anthem-blue-cross-blue-shield-20130314.pdf"}],"summary":"An employee at Connextions, a call center vendor for Anthem's Medicare business customer service, confessed to the Social Security Administration investigators that she had taken SSNs, including those from members of Anthem.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-01-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e055672f7b0df79e371b975ca3ef12c7926aaaa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08C51D8E-5E88-4895-B3D7-064410737213"},"incident_date":"2013-01-05","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e26ad1d55fd","org_name":"Hidalgo County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Alleged-Anonymous-Hacker-Arrested-by-the-FBI-for-Breaching-Hidalgo-County-Site-383549.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/fbi-arrests-hacker-who-may-have-ties-to-anonymous/article/312259/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/fbi-arrests-hacker-who-may-have-ties-to-anonymous/article/312259/"}],"summary":"A man believed to be connected to the Anonymous hacktivist movement was arrested by the FBI last week. Fidel Salinas Jr. is accused of hacking into the website of the Hidalgo County in Texas. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c46012d676abf6830b176b6f0e09cbcb9be75196","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D47663BE-4424-4D50-A476-8974A1F972FB"},"incident_date":"2013-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"b13d3eac90f3","org_name":"Pakistan Science Foundation","org_type":"government","ransomware":null,"records_affected":85,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/pakistan-science-foundation-hacked-85-login-accounts-leaked-by-vandathegod/"}],"summary":"Pakistan Science Foundation Hacked, 85 login Accounts leaked by @VandaTheGod.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11543e41b029ee8714ebfe154e23ad9ad2651ef4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7FAF7D3-7E29-4414-ACCC-09444D4F271C"},"incident_date":"2013-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"89e4ae9d0383","org_name":"Emirates NBD PJSC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gulfnews.com/business/banking/customers-feel-pinch-of-bank-card-glitch-1.1274090"}],"summary":"Payment processing systems in Dubai suffered an interruption outage with an undisclosed root cause","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"226e71ce326550e71f728f035919d3672f6cde7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DCBAD63E-8F63-44BF-8658-A5E56B0FE9CF"},"incident_date":"2013-01-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"VA employee recently passed away. Audit log was run to acknowledge any unauthorized access. Three VA employees inappropriately accessed the electronic \nrecord of this non-Veteran Employee.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebb82a7f4759847a6917022e31a29d7f8d27fa01","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39431F73-F3B5-4B8C-853F-0F14FF825FC4"},"incident_date":"2013-01-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0528f17b5849","org_name":"Women's Health Enterprise","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://familyhealthenterprisecenter.org/wp-content/uploads/2013/02/Press_Release.pdf"}],"summary":"2 laptops were stolen from medical office, 3000 unencrypted records potentially disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d0ee9675b3cff67d26598c2de9286ed53eaf6f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38D31619-7B10-4BDF-88A9-EBB800981CAF"},"incident_date":"2013-01-02","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"352e0b5bf7ed","org_name":"ICG America","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/ICG%20Master%20Notifcation%20Letter%20Final_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/ICG-America-Hacked-Credit-Card-Details-Possibly-Stolen-386129.shtml?utm_source=ForumSoftpedia&utm_medium=ForumSoftpedia&utm_campaign=ForumSoftpedia"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-42754"}],"summary":"ICG America, which operates several e-commerce sites suffered a breach in their payment processing environment resulting in installation of malicious code designed to capture payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"920fdc38b96226bf0fbae5677f2f9fcd9b34769b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C1FA580-5E26-47BB-8267-8E8290F6B116"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"a165f8dcd951","org_name":"Zushi","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2013/11/08/national/stalking-victim-info-leak-laid-to-tax-man/#.UoE_OKU2lBU"}],"summary":"leaked address gets stalker the information he needs to kill","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52d6184a294f2f5715c67913a85e00db9cea0d43","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"425BD921-2091-4A73-8887-47948C26146F"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"316342b28be6","org_name":"Ziggo B.V.","org_type":"technology_saas","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techn4all.com/technology-gadgets-mobile-phones/ziggo-employee-loses-laptop-with-unencrypted-customer-data/"}],"summary":"Ziggo employee loses laptop with unencrypted customer data. It was an unencrypted laptop with data from 40,000 customers lost, such as the name, email address, the last four digits of the number of the bank account and the subject of the clients had contact with the customer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93e0233c584a2ddcb1c89e42e975fe8b7542be1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1077349A-787F-4B3B-8C30-4CB2A68F291F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"718d9ddf2359","org_name":"Zaxby's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hospitalitytechnology.edgl.com/news/Zaxby-s-IDs-Data-Security-Breach84214,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northfulton.com/Articles-CRIME-c-2013-01-22-197070.114126-sub24323.114126-Security-breach-at-dozens-of-Zaxbys-stores.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://resource.onlinetech.com/zaxbys-breach-pci-data-breach-caused-by-compromised-hard-drives/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zaxbys.com/zaxbys_news/newz_releases/newz_item/13-01-11/ZAXBY_S_LOCATIONS_IDENTIFY_DATA_SECURITY_BREACH.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"https://dataprivacyinformation.com/index_2.html"}],"summary":"Over 108 Zaxby's restaurants experienced a breach related to customer credit and debit cards.  A number of people experienced credit card fraud and an investigation led to Zaxby's as a common point of purchase.  Suspicious files were found on Zaxby's system during the subsequent ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"BD","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4194a29fcc80ec82807915e2ff489e7dae02523a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD2E42E4-CF30-4212-AC7A-4B989454B7F2"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZM","org_id":"002efc131572","org_name":"Zabian Anti-Corruption Commision","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/10/zambian-anti-corruption-commission-and.html"}],"summary":"The Bangladesh Grey Hat hackers group hacked into Zambian Anti-Corruption commission website(acc.gov.zm) and AB Bank Zambia website(abbank.co.zm). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd29f44a487654038654e265772aa3f1a944d633","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CEE3FDA7-2820-4BD4-B512-5CCFC118E838"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"2a8baa527ded","org_name":"YTO Express","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globaltimes.cn/content/819571.shtml#.UmhBMxZKs20;"},{"fetched_at":null,"title":null,"type":"press","url":"http://english.peopledaily.com.cn/90882/8433406.html"}],"summary":"Chinese express delivery company has suffered numerous breaches of customer data by their employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"928c3e8a02e11cf9cb2bf2579bbc2bc09553c9a2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2ED0508-2E06-4FF2-985C-5386BC1B682C"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f735208eea2","org_name":"Young Women's Christian Association Retirement Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ywca-retirement-20071113.pdf"}],"summary":"An office burglary results in a stolen desktop computer containing participant's personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a93bc887ed7fd1155d962d7676edc437c8d39be1","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Yolo%20Skim%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"c425499af752","org_name":"Yolo Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/sacramento/news/2013/06/17/yolo-federal-credit-union-cards-customer.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Yolo%20Skim%20Notice_0.pdf"}],"summary":"Yolo Federal Credit Union notified members that their ATM/Visa debit card information may have been compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd8053cbd9b6b725c3438c2309d23e4fe5e7e7a3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70F0CBCD-CDE8-4196-ACD7-DB199AC313E7"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f64e6b2edd73","org_name":"Workers' Compensation Board of Nova Scotia","org_type":"government","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-halifax-doctor-reprimanded-for-snooping-in-case-files-of-injured-workers/;http://thechronicleherald.ca/metro/1328526-halifax-doctor-reprimanded-for-snooping-in-case-files-of-injured-workers"}],"summary":"Doctor accessed records of patients he was not authorized to.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4d15ee9bf44c01d2436ac77049fed1842ba110c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5D485DE-8E5F-4638-9E60-C624BE329357"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"912791fff7e8","org_name":"Womens Active Museum on War and Peace","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ajw.asahi.com/article/behind_news/social_affairs/AJ201311100027"}],"summary":"Anti-nuclear citizens groups around Japan were left reeling from a blizzard of e-mail traffic--more than 2.53 million messages--that had all the hallmarks of a coordinated cyber-attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fcf39993cc9679643489e65073dc757ebd118f5a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFA8D343-87D3-4BF2-AFF5-432D6F390FDE"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b00c65b7857f","org_name":"WESTERN HEALTH AND SOCIAL CARE TRUST","org_type":"healthcare","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-northern-ireland-foyle-west-22290855"}],"summary":"n investigation has been launched into how confidential medical records were found in a garden in Londonderry. The Western Health Trust has confirmed that the documents contained \"sensitive personal information\" and said it had reported the breach to the Information Commissioner'","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c79edf5ec46725d3b647d148c504ec5fac6d3a4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F34934C9-D28B-44E2-BBB7-B89B764B7C47"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b39b389c46b5","org_name":"West Yorkshire Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yorkshireeveningpost.co.uk/news/latest-news/top-stories/west-yorkshire-police-cops-rapped-for-snooping-1-6052026"}],"summary":"POLICE have launched more than 140 investigations into their own staff snooping on the forces confidential database.  Figures obtained by the YEP have revealed a total of 141 probes have been carried out by West Yorkshire Police into breaches of confidentiality involving computer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bf1a36a8eff06522c4cdfd3670d011b6fd11b36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52087F21-575F-4D08-BBDF-E360ABFA0BBF"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8906f76a0ecb","org_name":"West Kendall Baptist Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/25/baptist-health-south-patient-data-thief-sentenced-to-jail/"}],"summary":"An employee of West Kendall Baptist Hospital sold patient information to a man who used the information to file fraudulent tax returns.  Patients may have had their names, Social Security numbers, and dates of birth exposed.  The man who purchased and used the information was sen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4562c4aa952d4cd48d5c0e73271613b076c0954","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA69DBBA-EDF2-425F-9BC3-BD52A1A7198A"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"acd639402b24","org_name":"West Coast District Health Board","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10891644"}],"summary":"The West Coast District Health Board has apologised after it posted two pages of a woman's private medical records to the wrong person.  The papers were mistakenly sent to Ashburton woman Jen Branje, who was living in Westport when she had surgery at Grey Base Hospital last year.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11dad1107a4bb9aefecb18063c9ccbbb1818af78","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5EF3509-5E5F-4C02-99B1-695B62190253"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e0e0302f08c","org_name":"Wendy's International, Inc.","org_type":"other","ransomware":null,"records_affected":1092,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/wendys-20071221.pdf"}],"summary":"On December 3, 2007, we were notified by an employee of a car burglary at an employee's residence on December 1, 2007, which resulted in the theft of a company-issued laptop.  The information included the name, email, SSN, employee identification number and salary information of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e050f7f86df9f5937bf101732b967d53ace6afc5","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A5CD07E-9F8B-41CB-AA34-36ADDDE414FC"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a36996a8e97a","org_name":"Wells Fargo & Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mercurynews.com/san-mateo-county-times/ci_23879449/wells-fargo-teller-stole-119-000-from-elderly"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.smdailyjournal.com/articles/lnews/2013-08-17/daly-city-bank-teller-boyfriend-charged-with-stealing-from-elderly-client/1773736.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://mynewsla.com/crime/2016/03/18/man-pleads-guilty-to-bank-fraud-aggravated-identity-theft/"},{"fetched_at":null,"title":null,"type":"press","url":"http://rapsinews.com/judicial_news/20131002/269042519.html"}],"summary":"Bank teller uses customer information to transfer money and go on spending spree.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6495e73f2cc4700513f77b9cfbbd0b949dd81264","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7EBD2E6-F90A-4890-A07F-6B9B30BD1313"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"b0f44c8f4426","org_name":"websolutions.it","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Rex-Mundi-Hackers-Blackmail-Italian-Hosting-Service-Websolutions-it-366685.shtml"}],"summary":"Rex Mundi Hackers Blackmail Italian Hosting Service Websolutions.it","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b398c735b4630e0d528d75e45b357127dc39b70e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DCB616A-0771-48E0-BCDF-2E12A65B1D62"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72b9e85d1854","org_name":"Wawa","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phillyburbs.com/news/local/burlington_county_times_news/skimming-device-found-at-burl-twp-wawa/article_0f424291-e389-5d5c-8db9-980dbb049673.html"}],"summary":"Customers who shopped at a Wawa on Salem Road in Burlington, New Jersey noticed fraudulent purchases on their credit cards.  Investigators were able to trace the fraud to four people and arrest them. The four men were charged with credit card theft, credit card fraud, identity th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9948b3c96fb6a51297a799db0a4ace71c99a5e0f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDF039D8-3281-4934-B43D-4D2DE32E8F6A"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33aa37cae22e","org_name":"Washington University Investment Management Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/stlouis/news/2014/05/02/former-washington-university-investment-manager.html"}],"summary":"Banking manager accesses and downloads data after his dismissal from the company. Attempted to advance his access by cracking passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f28cf8fd7847387af132a91f8a839030540df411","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB559E7A-0137-4B2C-A3BB-72D5C27F71C8"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"badb18ad8587","org_name":"Washington University","org_type":"education","ransomware":null,"records_affected":1105,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stltoday.com/news/local/metro/laptop-stolen-from-washington-university-doctor-in-argentina-contained-patient/article_1008d54d-62a8-52f2-b71d-851ef86d0a5d.html"}],"summary":"A laptop stolen from a local surgeon traveling in Argentina contained the personal information of about 1,100 patients, the Washington University medical school announced today.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cea0156f21318fe108b37bac436b1a2f26fa5fbe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81387C67-42B7-4E2E-A01B-60255981839C"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23e363df291d","org_name":"Washington State Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.seattlepi.com/local/politics/article/Challenger-Podlodowski-discovers-loophole-in-9213802.php"}],"summary":"Voter data accessible via the back-end pathway ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5035a6160196c06d49c4130d899020f3673072d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6ACA9BA4-7FDB-450D-8C48-F213FCC3914D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bdd01493a51","org_name":"Washington High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Invite-Users-of-Iowa-High-School-Website-to-KKK-Appreciation-Day-409866.shtml"}],"summary":"Unidentified hackers have breached the website of the Washington High School in Cedar Rapids, Iowa (washington.cr.k12.ia.us). Theyve defaced several pages with racist messages.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c97b2642f50e574081b92d6e9dc4c238f2b1c61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A2DBA6B-6926-47B1-9FBE-A48E154DB67D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34be23a50ad1","org_name":"Wards Nursery & Garden Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.todaysgardencenter.com/article/24985/tips-to-protect-your-computers-from-hackers,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.berkshireeagle.com/ci_19784608"}],"summary":"Ward's Nursery & Garden Center may be one of the businesses at the center of a security breach resulting in fraudulent purchases this month made with dozens of locals' credit and debit cards.  Gregory Ward, co-owner of the South Main Street store, said his company was contacted b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae9dca2b3bfe17ad532f8f418515cc5a904aab7f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FD04AA6-04CF-4735-86FF-61A62C0D5452"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6a6f57185c2","org_name":"Walz and Associates Law Firm","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55798"}],"summary":"A concerned citizen found hundreds of documents in a recycling center and notified a local news team.  The documents included criminal histories, depositions, medical records, personal phone numbers, and addresses.  Most were from the 1990's.  Most or all of the information did n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19548ef31f69ab7cd02775d30c8683216c773398","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"960B63F6-5725-49F7-A108-62AE3CAC902B"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547664b03f2e","org_name":"Wallboard Supply Company","org_type":"other","ransomware":null,"records_affected":63,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/wallboard-supply-20130211.pdf"}],"summary":"Payroll system is hacked, exposing employee data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3d6177ab7790a53f3c30bac62a06c3d68adf6ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99C4097A-EE89-4CF0-A62F-7813707740D0"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.indystar.com/article/20130726/NEWS/307260079/Walgreens-must-pay-woman-1-44-million-over-HIPAA-violation"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.lawyers.com/2013/08/salgreens-shared-medical-record/"}],"summary":"Employee misuses access to pharmacy records to snoop on private medical records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a73d7b47f228750e241df466b1c1ed31c441cc63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D2BC18A-806E-49C8-96A0-F22D7579F93E"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6d384423449","org_name":"WakeMed","org_type":"healthcare","ransomware":null,"records_affected":158,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/attorney-wakemed-violated-patients-privacy-released-sensitive-information/15154432/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/wakemed-exposed-patients-phi-in-bankruptcy-claims-uploaded-to-pacer-attorney/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsobserver.com/news/business/article102800432.html"}],"summary":"Medical facility included full SSN in claims against patients who had filed for bankruptcy ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8a957b93d1ec1bec885befd167a83b5c33b20b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D57A9B8-9261-4909-A210-609152CA1829"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"01b1ca486d2a","org_name":"Wagga Base Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theherald.com.au/story/1620997/confidential-hospital-records-found-on-roadside/"}],"summary":"Thirty Wagga Base Hospital patients have had their privacy severely compromised after their medical histories were literally thrown to the kerb.  Ayb Brown was walking his dog in Estella on Tuesday when he found a confidential piece of paper lying on the side of the road.  When h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"VE","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c434ad2c0536058efd6c25098025c24f2d78ef8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF240540-E83B-4B7E-B3F9-C264B7D3BEEB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"cf9e1cb377ad","org_name":"VZ Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Deface-Venezuelan-Government-Websites-405222.shtml"}],"summary":"Anonymous hackers from Venezuela and Argentina have breached and defaced a large number of Venezuelan government websites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"522bee09a5c42421033ab8550aee28c8578adb11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C6826E8-15C3-4B87-BEE9-24AB2CACFBB4"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IS","org_id":"4bae21dd3b97","org_name":"Vodafone","org_type":"technology_saas","ransomware":null,"records_affected":77000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/11/30/official-vodafone-iceland-hacked-and-defaced-with-77000-accounts-leaked/#.UpliZJmm088.twitter"}],"summary":"Vodafone Iceland has been hacked and 77,000 customer records spaffed across the internet. The Icelandic National Broadcasting Service ruv.is reports that the hack became apparent on Saturday. By Sunday Vodafone Iceland had 'fessed up to the breach but denied other reports that pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AU","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b86a7d369e02ea46745647da3d2b2ab76ef348f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB97BF7F-0C86-4614-9DCE-FAF32A1BE721"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"eb3d1fc687c2","org_name":"Visionstream PTY Limited","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.brisbanetimes.com.au/national/internal-rivals-stole-leaked-bid-details-20131024-2w4gh.html"}],"summary":"Corrupt managers and staff from two Leighton Holdings subsidiaries stole and leaked secret tender information in an attempt to win a $240 million contract in the latest scandal to hit the trouble-plagued company. Confidential company documents reveal that top managers and staff f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35a34fdaba2507f8905c95d1a100f654d6292c03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"039CB0B2-F6CD-4B72-9A0A-AD0E7A7D7F20"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"738e4bd85758","org_name":"Virginia Department of Human Resources Management","org_type":"government","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyprogress.com/opinion/editorials/leaks-show-fragility-of-our-privacy/article_4a3aec3a-1a64-11e3-a3cc-001a4bcf6878.html"}],"summary":"The Virginia Department of Human Resource Management announced that personal information on 13,000 state employees was mistakenly released. The information included Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69d8b062f2837d92fd66fbb24b8ee96c8370c777","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7de1f140-8122-11e7-abf2-119fe288b6e8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"125a3dcede21","org_name":"Victory Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.statesman.com/news/local/data-breach-austin-patient-info-could-have-leaked-online-early-2013-local-clinic-says/ruyuS2pjpXFwKU6hfNJZOO/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a6c4614ebbdcd3637e91136ab17afdb19622c81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C9B35EA-B0A8-4D2D-A757-52355005BEBC"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c8c918987e30","org_name":"Victoria Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldsun.com.au/news/law-order/victoria-police-investigating-leak-of-highly-senstive-documents-to-bikies/story-fni0fee2-1226635915966?nk=c984176e333ea089d89eff6d719492e3"}],"summary":"Police officer provides classified information on informants and undercover officers to biker gang.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9cb2f96d8cb573d7b17c5dad2f227be58055a870","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"045FF4EE-B45F-4520-B24A-2058CDE39116"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"8caf313cfd80","org_name":"Viber","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/07/exclusive-viber-support-page-hacked-by.html"}],"summary":" Viber is the latest App developer organization who fall victim to the Syrian Electronic Army's hacking attack.  Today, the Syrian Electronic Army(SEA) hacked into Viber Support Page and left the site defaced.  Hackers also leaked list of name, Phone numbers and email address bel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc4afc85e78ae1ffbc01043fa5a5460aaba223d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B30F6284-CE6F-40B5-878F-10A6C5A97596"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"7964e5decef9","org_name":"Vestergaard Frantsen","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cipd.co.uk/pm/peoplemanagement/b/weblog/archive/2013/05/30/protecting-confidential-information-retrospectively.aspx"}],"summary":"Employee leaves company to join a competing startup. Leaves with trade secrets in his possession, which were leveraged to manufacture product.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b905153211ace5874bc5befcc46221d908ea4e20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94ADD73A-C834-4CA6-A412-59100E88C9EA"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95c0db5db205","org_name":"Verizon Communications Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theverge.com/2013/10/21/4861686/verizon-glitch-appears-to-have-exposed-texting-data-from-any-number"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227413.pdf"}],"summary":"Forced browsing allows unauthorized viewing of Verizon Wireless customers' texting data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6307b353ea3662a374e3e0e014c62a8d996e786e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2463B53-39F4-4CE7-A78A-8937B9E5CAB9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38fb52d85c76","org_name":"Variable Annuity Life Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Variable%20Annuity%20Life%20Insurance%20Co%20Security%20Breach%20Notice%20to%20consumer.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Variable%20Annuity%20Life%20Insurance%20Co%20Security%20Breach%20Notice%20to%20consumer%201.pdf"}],"summary":"Unauthorized person sets up a bogus account on valic.com to access information of customer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6358ba34054cd75b35571f6aaabf6464df6bc806","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16d4e500-d3c1-11e8-9659-2bc8d207b0aa"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"dd6fc8f9e1a4","org_name":"Vancouver Island Health Authority","org_type":"healthcare","ransomware":null,"records_affected":74,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.cbc.ca/news/canada/british-columbia/island-health-privacy-breach-1.4473934"}],"summary":"nurse who accessed the private medical records of 74 Vancouver Island Health Authority patients without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60e44cf49ffbdda262bd00a1a0cecfd3fe952ea1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BEEEE32-5467-441C-9AB9-C94FD54A108E"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cbcf05e8145","org_name":"VA Medical Center","org_type":"government","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.armytimes.com/article/20130614/BENEFITS06/306140042/Veterans-personal-data-left-recycle-bin"}],"summary":"The Veterans Affairs hospital in Fayetteville says documents containing the personal information of nearly 1,100 veterans were found in a recycling bin two months ago.  The Fayetteville VA Medical Center announced Friday its notifying the 1,093 affected veterans whose consultatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8165bea6a611245e4d147772ee63647a4d5a11d7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E7C7477-939B-431C-BFF0-274868332326"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"107adfe17477","org_name":"US Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phillyburbs.com/00redesign/news/local/abington-postal-workers-charged-with-id-theft/article_f0cb6a84-9e47-594f-b833-40d74686b6a4.html"}],"summary":"According to police, Rashaad Schell, 23, and Daryl Matthews, 24, were employees of the post office at 1925 Keith Road when they stole credit card numbers by using a smart phone set to video record. The phone was left on the counter, and when the customer handed a card over to be ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"816c689a6f1de81052a0712780f52217a3225e4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31C2BE00-2FEC-439B-9791-6090EE764BF4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fca8657f5de","org_name":"US Navy","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gawker.com/navy-accidentally-emails-reporter-its-plans-to-deny-his-1496453333"}],"summary":"Robin Patterson, the Navy's public liaison, oversees the sea service's responses to Freedom of Information Act requests from reporters and private citizens seeking Navy records and data. But part of an email leaked today on social media suggests Patterson took one reporter's requ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f567f66654690f9645272e31a37cedeef25045ac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96935139-5B04-44FA-907F-158D81BB8BD0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ad5687dbbb2","org_name":"US Marine Corps","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Defaces-US-Marine-Corps-Website-to-Send-Them-a-Message-379692.shtml"}],"summary":"Syrian Electronic Army defaced marines.com, the official website of the Marine Corps Recruiting Command. Interestingly, the Syrian Electronic Army is trying to convince US Marines that the Syrian army should be considered an ally, not an enemy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac960f635328f6ee638f0b8ef1ec607f6ea9fbd1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3D61205-A72D-4648-B429-ED20E0EDAB82"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c1325936428","org_name":"US Federal Bureau of Investigation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.minnpost.com/global-post/2013/08/anonymous-sorry-fbi-you-dont-scare-us"}],"summary":"something bad happened, maybe, according to one source.  Some anon group is mentioned in passing in an article as dumping data months ago.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IR","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cba229f5aa933533f1bc1f0c3696542b4c206f4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F28CC43B-D221-4851-8471-3FAFB24B3736"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c9e50ae0c3a","org_name":"US Department of the Navy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9242784/Iran_accused_of_hacking_into_U.S._Navy_computers?source=rss_security&utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+computerworld%2Fs%2Ffeed%2Ftopic%2F82+%28Computerworld+Cybercrime+and+Hacking+News%29"}],"summary":"Hackers backed by Iran have penetrated an unclassified U.S. Navy network","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"ID","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a42c230d7626b3b58eb042132ebfa07d2c1b696","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85A28014-E44C-4E57-8C4F-E23CEA5D3706"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8c496a35002","org_name":"US Department of State","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Indonesian-Hacks-and-Defaces-USEmbassy-gov-Blog-393438.shtml"}],"summary":"The official blog of USEmbassy.gov  a portal for US embassies, consulates and diplomatic missions  has been hacked and defaced by an Indonesian hacker using the online moniker Dbuzz.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"486fb3e45a284a6d7975d268602fc09da1c6b4fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE98C5E9-DA17-45FB-A231-559CEB223AD3"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f610d07e02e","org_name":"US Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.heritage.org/2013/11/02/exclusive-healthcare-gov-users-warn-of-security-risk-breach-of-privacy/"}],"summary":"Users who registered on healthcare.gov received a downloadable confirmation form with another users' information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b832580831026b0106f61c9d6ba9321ac6c599d2","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A163682C-1CFE-4C05-A0D9-D3B07B256053"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b2f6a03bde0","org_name":"US Barack Obama","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Barack-Obama-s-Campaign-Website-Hacked-Apparently-by-the-Syrian-Electronic-Army-394744.shtml"}],"summary":"On Sunday, visitors of donate.barackobama.com  US President Barack Obamas campaign donations page  were redirected to a page on the website of the Syrian Electronic Army (SEA) that read Hacked by SEA. According to The Blaze, the impacted subdomain is an old one. The US president ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"924fcc5f9deb8a2a1afc6ab8e4e49a8079a3a689","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBF69CD9-C00D-495F-A22B-D2EF127A0A20"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5313fd481de","org_name":"University Urology, P.C.","org_type":"healthcare","ransomware":null,"records_affected":1144,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/04/14/university-urology-of-tenn-releases-data-breach-statement/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.urologypc.net/hippa.pdf"}],"summary":"University Urology, P.C. of Knoxville, Tenn. released a statement on April 11 that detailed how 1,144 patients data had been exposed in 2013 and early 2014.  Though the information was limited to patient names and addresses, University Urology said in statement posted on its webs","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ce889132e37fc95f5ee9afb4b3ed19c4e9d8587","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61325611-F90F-4B16-92BB-C6F3A8705846"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa8ca03b935f","org_name":"University of Washington Medicine","org_type":"education","ransomware":null,"records_affected":76183,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b8509383819a03d603edc71d6deba24a1a55272","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FC1902D-38C8-41E9-9931-67BCDADF1683"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d99954b864db","org_name":"University of South Florida","org_type":"education","ransomware":null,"records_affected":140,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/tampabay/news/2013/09/09/usf-patient-information-breach-probed.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://wusfnews.wusf.usf.edu/post/usf-health-investigating-patient-data-breach"}],"summary":"The University of South Florida is investigating a protected health information data breach by an employee. The person responsible for the data breach is no longer a university employee, said Anne Baier, spokeswoman for USF Health. How the personal information involving patients ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a83fb39ad767cd09a8a8e128bf2d62adc79e2b6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"139A583F-2887-43A5-ACBA-C58633191BA1"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d45d97d0859","org_name":"University of South Carolina","org_type":"education","ransomware":null,"records_affected":6300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/university-of-south-carolina-acknowledges-security-breach.html"}],"summary":"The April theft of a faculty laptop resulted in the exposure of current and former student information.  The laptop was stolen from a locked room in the Department of Physics and Astronomy.  It contained a file with the names, emails, and Social Security numbers of up to 6,300 Un","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"600174a2272c7728dabd0a9fd2b76c9b2d9e8732","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E9EF3F3-73EB-4681-B67A-5FA421181C5A"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c366b8443f4","org_name":"University of Rochester Medical Center","org_type":"healthcare","ransomware":null,"records_affected":537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/06/university-of-rochester-medical-center-reports-data-breach/"}],"summary":"The loss of an unencrypted flash drive exposed sensitive patient information.  The flash drive contained name, date of birth, weight, gender, telephone number, URMC internal medical record number, orthopaedic physician name, date of service, diagnosis, diagnostic study, procedure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be3ec63e07ef9b2e4fd78d7a129bc0d0ce4fe35a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1119792-19A0-4A9D-A934-09534D243421"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6f847aa765e","org_name":"UNIVERSITY OF PITTSBURGH MEDICAL CENTER","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/university-of-pittsburgh-medical-center-acknowledges-privacy-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtae.com/news/upmc-alerts-patients-about-data-theft/33042164"}],"summary":"Internal misuse. Employee was viewing patient records for no legitimate reason.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec0a4de60cbf65d599b60e9102709463d3271470","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"184D40EE-81E7-4293-93A7-D61EB90E4370"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4d65a3459d93","org_name":"University of Pennsylvania Health System","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.philly.com/2014-01-01/news/45741913_1_pennsylvania-health-system-patients-hipaa;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/01/03/misprinted-bills-expose-penn-patient-information/"}],"summary":"The University of Pennsylvania Health System revealed Monday that some patients' privacy was accidentally breached because of misprinted bills.  One of Penn's billing vendors, RevSpring of Wixom, Mich., had a malfunction in its printing operation. As a result, some patients recei","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7639a2edc54f7f1671a0f0322bc598dd7bd6f69","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06CDBA93-88CE-4B7A-A4A3-C9418E2766A6"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b01e40299bc","org_name":"University of New Haven","org_type":"education","ransomware":null,"records_affected":242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234933.pdf"}],"summary":"University employee accidentally emailed confidential student information to another university employee who would not normally have that type of information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"184d7e00edf862b8cecd39009e262f8721e954ba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9BB8983-26C6-4EA3-BFDE-14EF0E005493"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af1151552ddc","org_name":"University of Mississippi Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareinfosecurity.com/stolen-laptops-lead-breach-roundup-a-5635;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/university-of-mississippi-medical-center-to-pay-2-75m-to-settle-hipaa-charges/"}],"summary":"The University of Mississippi Medical Center in Jackson reports that an unencrypted laptop shared by several clinicians was stolen from a patient-care area.  The medical center is not disclosing the number of patients affected. \"In this case, due to insufficient contact informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d1dd6087bd4933b5c3810c2fc259d5bcaf2a76e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97F65345-B05E-4BCB-9C31-10C648307E96"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d53bb1c7d94","org_name":"University of Massachusetts Amherst","org_type":"education","ransomware":null,"records_affected":1670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f7621918596682e580426c5ef140c576d8b2c5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C015DF1D-8A4A-44CD-9CCF-E9DD9C1B6262"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b581f3c5e20","org_name":"University of Iowa","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.press-citizen.com/article/20131212/NEWS01/312120032/Phishing-scam-UI-results-stolen-personal-info-money?gcheck=1"}],"summary":"University of Iowa employees victim of phishing attack that led to fraudulent transactions in the form of changing their direct deposit information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03dce61576f6039f8ebd2eb045004a6d28491c17","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"796A324D-4A8A-43B0-9765-3D56D0365B92"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce7f5f7f6e2f","org_name":"University of Florida","org_type":"healthcare","ransomware":null,"records_affected":5682,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.ufl.edu/2013/05/29/potential-identity-theft-2/"}],"summary":"An employee working at a University of Florida medical practice who had ties to an identity theft ring may have compromised patient personal and health information.  UF is notifying 5,682 patients and parents of patients at the UF Pediatric Primary Care Clinic at Tower Square, no","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df6097075ba7c1aad8e52df65dc778c0f699dd92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA62F4DA-A37B-4CD7-B5AD-ED628C0BF80D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9d770bb3a02","org_name":"University of Delaware","org_type":"education","ransomware":null,"records_affected":74000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.delawareonline.com/article/20130730/NEWS03/130730007/UD-employees-information-compromised-cyber-attack"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.udel.edu/udaily/2014/jul/resources073013.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/07/30/personal-data-on-72000-staff-taken-in-university-of-delaware-hack/"}],"summary":"Personal data on 74,000 staff taken in University of Delaware hack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd2960662fa429d40784f1f7c1480c108e079023","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D888BB5-1D4B-4621-AE44-114722BA8AFD"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a3cf64f3b49","org_name":"University of Connecticut Health Center","org_type":"healthcare","ransomware":null,"records_affected":1382,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227152.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/university-ct-health-center-20130307.pdf"}],"summary":"An employee was found to be inappropriately accessing the medical records of 1,382 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5260db3139be47bb66bb877ed29b5e3f33576c31","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54D04554-CA98-417C-9D15-C750D77838CC"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"bf390fa71a81","org_name":"University Hospital of North Staffordshire","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisisstaffordshire.co.uk/Hospital-worker-breaks-confidential-records/story-18922822-detail/story.html#axzz2SpWSwQNr"}],"summary":"Disgruntled employee accesses medical records of 3 patients for next of kin information. Writes letters pretending to be a nurse expressing concerns over the surgeon who operated on their relatives. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adfadb20e6aec1f44d204f1aa4a0bb00c2975734","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ABD421E-3F49-4D2F-BCCD-3FBAD9E050EC"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0189af7e255","org_name":"United States Post Office","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/news/crime/article/Calif-postal-worker-sentenced-in-mail-theft-4538950.php"}],"summary":"A San Francisco Bay area postal worker accused of stealing thousands of pieces of mail to obtain credit cards has been sentenced to 18 months in jail.  Attorneys tell the San Mateo County Times (http://bit.ly/ZdKHGG) that 39-year-old Romeo Natan has credit for about 10 months in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b3a13e75adcdf29a572bf8b9fa9c31b5b17b39a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87E44006-239E-4462-BEA8-884834BB8088"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0e61d082e77","org_name":"United States Department of Energy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=14353,"},{"fetched_at":null,"title":null,"type":"press","url":"http://freebeacon.com/cyber-breach/"}],"summary":"Notifications sent out to employees and contractors of the U.S. Department of Energy have confirmed that it and its networks have been the latest victim of \"sophishicated hackers\" in search of confidential information.  The breach was confirmed for the Washington Free Beacon by u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b621b36666bac52e6b3a9b3c568745efb778ed3a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE0F975F-3853-420A-AA59-33CAFF7EC099"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f84ce450c32","org_name":"United States Congress","org_type":"government","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Allegedly-Hacks-US-Congress-Email-Addresses-and-Passwords-Leaked-369234.shtml"}],"summary":"Anonymous hackers have leaked what they claim to be email addresses and passwords of members of the US Congress and their staff.  There are around 1,800 records comprising mail.house.gov and senate.gov email addresses and clear text passphrases.  “For the purposes of being far to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b34f4b1da35c790c7ef19723f8a2d90558392c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"101AA2D1-56A5-4F55-8EC3-438EB9062565"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EC","org_id":"a50b8279d8e5","org_name":"United Nations Development Program in Ecuador","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-United-Nations-Development-Program-in-Ecuador-Hacked-and-Defaced-413394.shtml"}],"summary":"Turkish hackers of the group called Ayyildiz Tim have breached and defaced the official website of the United Nations Development Program in Ecuador (undp.org.ec).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8203f72c72d069bf4c78596d0f49b00ab9fe2e3f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"106E8369-75D3-49D3-A059-1EDA77F2F4B1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0788c31eb7f2","org_name":"United Kingdom Court of Appeals","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lawgazette.co.uk/news/solicitors-warned-following-breach-confidentiality"}],"summary":"Lawyer discloses contents of draft judgement that was subject to embargo before the judgement is formally handed down.  The disclosure included his client, the family, the police, and the media.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa3063329babf8cd007e660f3c753981e3e84b8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C947AFD-A17E-4DE9-8B4C-BCEF6F38A7C5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ade4144853a","org_name":"Undead Labs","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Undead-Labs-Takes-Forum-Offline-Following-Hack-Attack-405416.shtml"}],"summary":"Last week, video game development studio Undead Labs took its forum offline after it was breached by a hacker from Saudi Arabia. Undead Labs published a statement about the forum being down on November 30 and said they were working on technical problems. However, they havent ment","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d50ab4d737b76ecc440b148821cba869d3946f55","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCF69CF3-96A8-4E7C-B017-D4F3C7FFB7AD"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AM","org_id":"1d60dd5e2756","org_name":"UN in armena","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/avira-un-hacked-by-dr-sha6h"}],"summary":"Web defacement: A profile Syrian hacker going with the handle of Dr.SHA6H has hacked the official website of United Nation (UN) in Armenia.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93e50135efe9193143798d0c34b6a59a5467ad42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2266E747-216F-4D3A-AF68-DC55864A1843"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0161a98f5f50","org_name":"UK Council for Graduate Education","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ukcge.ac.uk/main.php?main=news&news=ukcge-website-hacked"}],"summary":"This morning the UKCGE website was hacked and a number of email addresses and passwords have been published online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15738021f4a0f355ebcb05f482b672c02edfe68f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01E748E8-23CA-43BB-9413-9D357C53997B"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff508232c156","org_name":"UConn Health Center","org_type":"healthcare","ransomware":null,"records_affected":164,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldonline.com/2013/12/11/5495494/uconn-employee-breached-privacy.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/12/12/uconn-health-center-investigating-second-2013-data-breach/"}],"summary":"An employee of the UConn Health Center inappropriately accessed personal information in the medical records of 164 patients, the university said Wednesday. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af76e2210137c187a16444fe17c19bc593c6e15f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4570A114-D2A9-4F50-8634-BD89469468F1"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"57286e64df0a","org_name":"Ubisoft Entertainment SA","org_type":"technology_saas","ransomware":null,"records_affected":58000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hotforsecurity.com/blog/ubisoft-breached-sensitive-account-data-leaked-6538.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/news/2013/041013-ubisoft-takes-download-service-offline-268566.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.v3.co.uk/v3-uk/news/2279013/ubisoft-warns-customers-following-account-hack"}],"summary":"Game publisher Ubisoft was breached and unauthorized parties accessed customers’ usernames, e-mail addresses and hashed passwords. Ubisoft urges all account owners to change their passwords at once.  The French firm emailed its customers, informing them that “credentials were sto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f411c4441d83c5b6b8d7987c3bdd4d041fb84081","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EE3E7C3-D166-4A38-AC1C-50BAA3187F9C"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UA","org_id":"3fc0d20ee4cd","org_name":"UA Government of Ukraine","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Ukrainian-Government-Websites-Apparently-Hacked-by-NATO-396784.shtml"}],"summary":"While the Ukrainian government sites appear to have been seized by NATO, the more likely scenario is that some hackers defaced them and instead of the usual we hacked you message, they decided to add a more interesting defacement page.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"281066b6c3585b11883f5790fac546a0dcbcbc3a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99EE2A4B-209D-4F8C-BFB8-BB8977E7E162"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29d7803ce88e","org_name":"U.S. Department of Labor","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/watering-hole-attack-claims-us-department-of-labor-website/#.UYF8qxMs_qs.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/u.s.-department-of-labor-web-site-hacked-serves-malware.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/attacks-breaches/us-department-of-labor-website-discovere/240153967"}],"summary":"The Department of Labor's website was found to have been infected with malware that spreads to visitors using the web browser Internet Explorer.  Microsoft had already released a patch to address the Internet Explorer vulnerability and the malware targets users who have not taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"018762c98aba3a48c55cb8bb91907fdfffee6218","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCDDED71-3904-4355-BF09-F1C5F35E26B8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbc8203739cf","org_name":"U.S. Army Corps of Engineers' National Inventory of Dams","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/32223/us-national-inventory-of-dams-database-breached/"}],"summary":"Users of the National Inventory of Dams received notification that their information was reset after a hack may have compromised usernames and passwords.  Hackers obtained non-public information of around 8,100 major dams in the United States by breaching the database.  The infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e314e9be52058007ad900394a317647f2e41f5c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7C15329-AAE6-48E7-BE23-5B6502736ECC"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"technology_saas","ransomware":null,"records_affected":250000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bits.blogs.nytimes.com/2013/02/01/twitter-hacked-data-for-250000-users-stolen/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/technology/twitter/9843864/Twitter-hackers-may-have-stolen-passwords-of-250000-users.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dallasnews.com/business/technology/headlines/20130201-twitter-says-security-breach-may-have-exposed-250000-users-data.ece,"},{"fetched_at":null,"title":null,"type":"press","url":"http://socialtimes.com/twitter-discloses-massive-data-breach_b118030"}],"summary":"Online attackers were able to access the usernames, email addresses, session tokens, and encrypted passwords of 250,000 users.  Twitter notified affected users and told them to create a new password.  Anyone who used the same password and username or email combination for other s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82d22df3990a42062751c26fe4b354900787b275","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"730234EF-6BA8-4FA1-8872-3878C38E6CCB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"50fdfaa6eb4b","org_name":"Turkey's Supreme Election Committee","org_type":"other","ransomware":null,"records_affected":54000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Russian-Hackers-Reportedly-Stole-Personal-Details-of-54-Million-Turkish-Citizens-409633.shtml"}],"summary":"The Hurriyet Daily News reports that the general manager of a research company called KONDA has revealed that the ID numbers, addresses and fathers names of 54 million voters have been stolen from political parties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"345cf035e227550a6bdedb8f960527d173049cd8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EEE44D4E-6796-4618-9EBC-ABA00963CFA5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e841204951c8","org_name":"Tumblr","org_type":"technology_saas","ransomware":null,"records_affected":65469298,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.neowin.net/news/tumblr-claimed-that-a-data-breach-affected-a-set-of-users-turns-out-to-be-over-60m"}],"summary":"65 million emails and encrypted/salted passwords disclosed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f05077c825587fc5a2886f7ce86b8238e5a47737","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42f07490-c497-11e7-9a8b-47d1b690bc01"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2031363e0918","org_name":"Tryon Elementary School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wyff4.com/article/guidance-counselor-steals-students-info-in-dollar400k-medicaid-scam/9990187"}],"summary":"Misuse of PII used for ID theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96ab44c0a8a4fa64dab352b517b48f4593441923","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51CDFE37-0D00-4013-B012-6AAA88CE2055"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"60415616697e","org_name":"Truecaller","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconindia.com/news/technology/TrueCaller-Database-Hacked-Millions-Of-Contacts-Stolen-nid-150861-cid-2.html;"}],"summary":"Bangalore: Hackers claiming to represent the Syrian Electronic Army have reportedly hacked database of Truecaller, worlds largest collaborative telephone directory. According to the initial reports, the hackers were able to take data from seven databases which include the main on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d970f6cf674f1adc961dea7b399bcf25ada7a3f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF4FF984-6ED4-43F7-8BBC-110058CF26D1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0a6c3c9b7261","org_name":"Trillium Health Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mississauga.com/news-story/6736024-electronic-peeping-tom-a-privacy-breach-says-mississauga-woman-suing-trillium-health-partners/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kimberleybulletin.com/national/384116091.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ca-personal-health-data-breach-triggers-trillium-hospital-class-action/"}],"summary":" statement of claim alleges Lyon was \"an electronic Peeping Tom\" who accessed personal patient information for her own enjoyment","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f128e49da4e86354687bd590bd66596800009d9c","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ED4375F-3BB5-44C0-BC9D-B31FAB898ADD"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"0c655afcbcfe","org_name":"TR Government of Turkey","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/RedHack-Hackers-Post-Apology-on-PMs-Behalf-on-Website-of-Political-Party-403383.shtml"}],"summary":"Just as the 14 individuals suspected of being involved with RedHack and Anonymous were presented before the Ankara Courthouse, RedHack hackers were busy breaching the official website of Turkeys Justice and Development Party (APK). On the Parliament section of akparti.org.tr, the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6d5a203d43c3571cfd3abd5e3d0b509a6c15a0a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C0F20CF-CF69-4858-A9BA-D67A8CE979EB"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd23eb6e536e","org_name":"Townhall Enterprises","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/news/local/crime/article49933585.html"}],"summary":"Medicaid fraud indictment links suspect to Charlotte consultant - Townhall Enterprises  A North Carolina man has been indicted on charges he used phony invoices to bilk millions of dollars out of Medicaid  in some case three times the amounts his co-conspirators thought he was ge","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcdc6733161cc3851fc1e374e2ae130186ae6fd6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4BE1D4B-8E10-4EBF-BB05-F95F8D06DCC9"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e2197cee8f1","org_name":"Town of North Franklin","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.observer-reporter.com/article/20130918/NEWS01/130919256#.Ujx_Cbx6MVV"}],"summary":"City records were stolen from township building. Exact date of theft is not known at this time.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ea8ec2a27afe823ab79b34fd4fab7fe2aad4e25","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"201F17BF-D8C6-4AF5-AB0A-66EA492EAFB1"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a45b83d7e2f5","org_name":"Total System Services Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.datacenterknowledge.com/archives/2013/01/28/data-center-outage-cited-in-visa-downtime-across-canada"}],"summary":"Power outage in data center causes VISA users in Canada to be unable to use their cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"801ceec2109fec8df52ec8b6dfe79c00cd744a0d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B8C3EB3-20D1-4D68-87B1-0C3B27F6CCFD"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c602881aa38c","org_name":"Torrance Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-hospital-patient-privacy-20130905,0,7915045.story#axzz2jK0iMBoV"}],"summary":"Several instances of mobile phone photos taken in hospital operating rooms against policy and without consent of patients. This is one of two.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8392beafcf856abfd7ba60b36556e54eaa0b988","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C33DBEE-838F-4C84-B7DF-2DB2BB5EB8E9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ec96b491fd5","org_name":"Tom Sawyer Software","org_type":"other","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Tom-Sawyer-Software-Allegedly-Hacked-Details-of-60-000-Accounts-Leaked-388901.shtml"}],"summary":"http://news.softpedia.com/news/Tom-Sawyer-Software-Allegedly-Hacked-Details-of-60-000-Accounts-Leaked-388901.shtml","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1434f9c7543f60d6f9f582ba8a591c8523f19d9b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A5D8DD7-F411-4580-A9FF-023CFA93AFD4"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d070f9e9fbef","org_name":"Tinder","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://qz.com/107739/tinders-privacy-breach-lasted-much-longer-than-the-company-claimed/"}],"summary":"Mobile dating app Tinder appears to have exposed the physical location of its users for much longer than a “few hours,” as the company’s chief executive claimed. New evidence suggests the privacy breach dated back at least two weeks. +  Quartz reported yesterday that the data fil","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fb6ff6eaa8557b2c0acbeaf15323441ad7b05f7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD2CE1E7-A1E9-498B-B165-D1C5C0DE9F5F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c196d18ef1a9","org_name":"Time Magazine","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/syrian-electronic-army-hacks-time-over-person-of-the-year-poll/article/323304/"}],"summary":"The Syrian Electronic Army (SEA) stamped its avian emblem on the Twitter account belonging to Time on Friday. Syrian Electronic Army Was Here via @Official_SEA16.. Next time write a better words about the Syrian president #SEA, the hacktivist collective tweeted from the Time Twit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abc00d65e931b0d3872eb1c7c4ec80f8f11e68e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72CCF9E4-758A-4CE6-9F4E-BF2AB07C30D1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f963ad163a16","org_name":"Thunder Bay Regional Health Sciences Centre","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclejournal.com/content/news/local/2013/05/28/hospital-apologizes-data-breach"}],"summary":"Thunder Bay Regional Health Sciences Centre has confirmed a privacy breach involving diagnostic images, but are providing few details as to who was involved. Hospital CEO Andree Robichaud and chief of staff Dr. Gordon Porter said Monday that the MRI scans of about 500 people were","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b137e70a8ebb2a2a57e02e98188b4794c6a4583","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D26B425-B329-48B8-A83E-388DD8F4EFCA"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"95e9bf4fa416","org_name":"THE SOUTH AFRICAN NATIONAL ROADS AGENCY LTD","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.einpresswire.com/article/186614538/sanral-responsible-for-data-breach"}],"summary":"Improperly configured web app left PII data exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4eb70d36b25026c73464080b2715252c7737b6f0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D23554A-CCEE-46DC-B55C-4016427FE1C8"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b2cbcfed0393","org_name":"The Royal Oldham Hospital","org_type":"healthcare","ransomware":null,"records_affected":41,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-manchester-22003216"}],"summary":"Two Greater Manchester hospitals are investigating after confidential information about their patients was found by members of the public. Information about 16 child patients at the Royal Oldham Hospital was found more than 40 miles away on a street in Liverpool. The Pennine Acut","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02434261fa662cb631971d575aa10d65c04d7bb1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6FB5EE4-92C2-4657-9D7E-490216D439B9"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03c0c2b07095","org_name":"The Pennsylvania State University","org_type":"education","ransomware":null,"records_affected":808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.psu.edu/story/142097/2013/02/08/malware-opens-door-possible-information-exposure"}],"summary":"malware found on peecee with SSN's on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20620eb725749b51f3383290fa493e781f8dd3f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7AAFA9E-2A8A-4EFD-99EC-0980296EECFC"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"fab5665d48b1","org_name":"The Medical Council","org_type":"government","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.3news.co.nz/nznews/another-email-blunder-leaks-docs-data-2013040711#axzz3U1BbUfif"}],"summary":"Potentially sensitive information about doctors has been added to the raft of email privacy blunders  many from government departments  during the past year. The Medical Council has apologised to about 2900 doctors after an attachment containing their payment information to the c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09bc9b06cf7915bd1aca13b76d3ff65c0b7f3356","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1209234C-90B8-4FD2-BC6E-1B9D61A33B6F"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"146fff9d7c80","org_name":"The Long Island Rail Road Company","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/long-island/police-find-hidden-video-cameras-on-lirr-ticket-machines-1.6282549"}],"summary":" Police are investigating an apparent credit and debit card scam involving tiny video cameras hidden on Long Island Rail Road ticket vending machines.  The Metropolitan Transportation Authority Police Department first learned of the scam after a customer found one of the small vi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c159bf861f14a2a02fa8ab3757a5553ed960b086","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1A0648D-5A62-439D-A02D-C63CAE034DF0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e87e111d12db","org_name":"THE GREEN MOUNTAIN CLUB INC","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Green%20Mountain%20Club%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"Website breached and customer data (including credit card numbers) stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56660e4d12fcaafa5e1b347422c273cfc569466b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBE592EC-F40C-49B8-88B0-EB032938B981"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7416444399c7","org_name":"The Boeing Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.fas.org/irp/ops/ci/chung071609.pdf"}],"summary":"Insider provides Boeing trade secrets to Chinese government for 30 years.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aa93a12ee2d72b4ee4687d1096ab6996007fcbe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CAB3086-4F4A-408F-B2C5-B71035FA0EE9"},"incident_date":"2013-01-08","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51174b828d11","org_name":"Texas Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/data-breach-asc?title=Texas+Department+of+Health"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytribune.net/news/article_960984e0-5959-11e2-84e9-001a4bcf887a.html"}],"summary":"A dishonest employee was arrested on suspicion of misusing client information to apply for credit cards.  The dishonest employee was able to pose as different clients seeking immunizations and other services.  She was charged with fraudulent use or possession of identifying infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d78363346374744401845fce4addd65de57522b8","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5211605-01AD-454E-A7CE-BC36192988BF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5b34ded5644","org_name":"Texas Board of Professional Land Surveying","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/texas-board-of-professional-land-surveying-hacked.html"}],"summary":"Hacker DasTn of The Outlaws recently defaced the Web site for the Texas Board of Professional Land Surveying (h/t Softpedia).  The unusually chatty defacement page states, \"HaCK3d By The Outlaws. Tunisien Hack3r Was Found. Das.Tn, Hamzawi hakers, Raed Yak, Hacker Amazigh, Firas F","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0de1321f5fafaa620222c98fa99a4086c80e1ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D86222E6-44D7-4526-A783-A0D0E2177D22"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13b05b8adb82","org_name":"TerraCom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc2news.com/dpp/news/national/lifeline-phone-applications-raise-specter-of-forgery-at-carriers-terracom-and-yourtel-america"}],"summary":"Theyre among at least 50 people who had applications submitted in their names, without their knowledge, for Lifeline, a Scripps News investigation finds.  TerraCom and its affiliate, YourTel America Inc., together provide Lifeline phone service in 21 states. Their issues reflect ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ff3a5d833392cdc9a3bfd567ec86dfcb54c8146","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B77C36B5-D30A-42A1-86D0-CCC42E57A698"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c81494a7037","org_name":"Tennesee Bureau of Treasury","org_type":"financial","ransomware":null,"records_affected":6300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tennessean.com/article/20131214/NEWS03/312140086/Teachers-personal-info-may-been-stolen"}],"summary":"6,300 Metro Schools teachers may have been stolen by a former Tennessee Department of Treasury employee, though state officials believe those details were not sent elsewhere.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ea1ca741d5b39c1552c694bb510f3c8c0698532","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0C80531-1132-4679-BE50-355987376E9A"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://westhampton-hamptonbays.patch.com/groups/police-and-fire/p/more-td-bank-customers-report-identity-theft"}],"summary":"Payment card loss suffered by bank branch, likely due to ATM skimmer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e8c268591e18d114f95b4c8bcc4e8083bdf4946","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2230A9E0-AC36-4A4A-954A-563A76EF62A9"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7e2d41c1bb","org_name":"Tampa General Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/health/medical-records-breach-at-tampa-general-usf-exposes-womans-secrets/2129083"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abcactionnews.com/dpp/news/region_tampa/patients-at-tampa-general-hospital-face-the-possibility-of-having-their-identities-stolen"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/16/tampa-general-hospital-investigating-another-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/courts/criminal/haley-tampa-general-hospital-employees-accused-of-selling-patient-ids/2129886"}],"summary":"Hospital employee misuses access to medical records to snoop on family member.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8ee6e74f9e78f0670ef976f063ef3ebd1c11cfd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56B02E4F-F21F-4BB3-9842-211F4E6499DE"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52e662a7846f","org_name":"Talawanda School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oxfordpress.com/news/news/local/personal-documents-found-in-desk-could-put-former-/nZfJW/"}],"summary":"School sold equipment, person bought desk and found documents with PI, told LE and school, school responded by offering credit monitoring for previous students.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ba7f1e715fcd080e6fa2de8c3ea53188be2d72b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F099EF4-7EB4-4D1A-A07D-6FF5A1CB0F69"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"1279fdc00f93","org_name":"Take Care","org_type":"healthcare","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thelocal.se/20131030/massive-data-breach-national-security-risk"}],"summary":"Some type of vulnerability or error (going with error) exposed 3 million medical records for swedish residents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6913b070f13651ca6118fe9ddd8fe068f77aea1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89AEB1DE-B96F-43EF-A81B-DB894720C173"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TJ","org_id":"bfff7decffb1","org_name":"Tajikistan Domain registrar","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Google-Yahoo-Amazon-and-Twitter-Domains-Impacted-by-Tajikistan-Registrar-Hack-414220.shtml"}],"summary":"The systems of Tajikistans domain registrar (domain.tj) have been hacked. The attacker, an Iranian hacker who uses the online moniker Mr.XHat, has taken the opportunity to deface a number of high-profile domains such as Twitter, Amazon and Google.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63a52ee1b4fae94b79549475bea959ebad5bb0c9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50403DDC-1C7C-491B-8E51-9E2A43C2D382"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"eb14b49fabc7","org_name":"Taiwan Government e-Procurement System","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.alienvault.com/open-threat-exchange/blog/latest-internet-explorer-0day-used-against-taiwan-users"}],"summary":"We have identified a version of the exploit hosted on a subdomain of Taiwan's Government e-Procurement System. When users visit the main webpage a Javascript code will redirect them to the exploit page if it is the first time the visit the page: - See more at: http://www.alienvau","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb9d3559bc0c30301cff025fae827b79aa7e95c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"354CE591-BBF4-4FD3-B19A-5FD379BA953E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"c8647142fbef","org_name":"Taiwan Air Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chinapost.com.tw/taiwan/national/national-news/2014/04/29/406476/Ex-Air-Force.htm"}],"summary":"Taiwan Air Force Major was bribed by chinese national to share classified information about their \"early warning\" aircraft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"BD","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"889d628d8644e407811a992cf1b84d6cc6bfef5f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"77E8E0F3-81BE-4C33-A6C9-62FAC0A92B0A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"5d45180bd84a","org_name":"SY Ministry of Electricity","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/syrian-ministry-of-electricity-website-hacked-by-bghh/"}],"summary":"A hacker going with the handle of Albaze Ever from Bangladesh Grey Hat Hackers has hacked and defaced the official website of Syrian Arab Republics Ministry of Electricity just two days ago.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1adb06a6e7c324cd607664fc42c5446207279ff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DD52A14-23DB-4BAE-80EE-A537AF3A5233"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"a3aef1bc026c","org_name":"Swisscom AG","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.swissinfo.ch/eng/swisscom-considers-legal-action-over-stolen-data/37590340"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/09/18/swisscom-datatheft-idUSL5N0HE1BP20130918;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lightreading.com/document.asp?doc_id=705715&f_src=lightreading_gnews&init_gateway=true;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lasvegassun.com/news/2013/sep/21/eu-switzerland-data-breach/"}],"summary":"Newspaper published personal details about customers of the ISP, obtained  from a unknown 3rd party who stole 4 data disks containing the said records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15f14b545d7037fede56ed3aeef46c5cb9cfe43b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70eeb780-1498-11ec-92c0-8d3c636e1e37"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab3d54589faf","org_name":"Sunrise Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.sun-sentinel.com/local/broward/sunrise/fl-ne-krege-arrest-paperwork-20191226-auxcyxbpobcspptxbxm4gemxsa-story.html"}],"summary":"Sunrise police officer leaked various information to press and wife","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c6f06b78bc35ca4fa4cde49e6d730a89d805ffb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5103667-1976-4E82-91C4-08A5C898C5F5"},"incident_date":"2013-01-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd8f57865469","org_name":"Sunrise Atelier, Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://appadvice.com/appnn/2013/11/sunrise-calendar-users-are-being-alerted-about-a-security-breach"}],"summary":"another victim of mongoHQ breach, saying that calendar information and (guessing) that API authentication tokens were possibly compromised","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8e355df935d98101b5c116db2c95751244b4741","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D9AEB260-AA96-42DD-9A26-07ECFF4025A2"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"70ab16fdde49","org_name":"Sun TV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/sun-tv-website-hacked-by-pakistan-hacker.html"}],"summary":"Yet another Indian mass media company has been targeted by a hacker of the Pakistan Haxors Crew. This time, the victim is Sun TV Network, a Chennai-based mass media organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3916ff31e339725c949f5c9903d9708b59144d4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8D0B60F-DE53-4902-AA9F-C17E80F9543B"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17b9be1df0b1","org_name":"State of Alabama","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/tax/2013/txdv13124.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/montgomery/2013/08/woman_who_stole_the_identities.html"}],"summary":"Internal actor used access to state employee system to file false tax returns","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3c8f40b915e63dfb71db91029078915d9a19d85","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD7846D5-1EAF-4B17-8386-48031D9DC80E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39be97317ff3","org_name":"State Farm Insurance","org_type":"financial","ransomware":null,"records_affected":687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231521.pdf"}],"summary":"Call center employee embezzled credit card info from customers calling in to make bill payments. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b425471d69f04355710b59f8f20f166ac104fc12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7670CBB-3B42-4024-BDF6-1BED5F9F986A"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76562eced474","org_name":"Starbucks Corp","org_type":"other","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/news/Surrey+jailed+debit+card+scam/9098307/story.html"}],"summary":"Physical Tampering on various point of sale (assuming PED) at retail stores, starbucks mentioned by name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c84b9c57c457ab738f94443013181659be4139c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6742637-7EDE-4D09-B80D-ED87EB62DD55"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1b2d57b4c7a","org_name":"Stanford University","org_type":"education","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cr80news.com/2013/07/29/stanford-university-struggles-to-secure-its-networks-hacked-for-a-second-time"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cr80news.com/2013/07/29/stanford-university-struggles-to-secure-its-networks-hacked-for-a-second-time,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/local/stanford-computer-system-target-cyberattack/nY3s6/"}],"summary":"The marks the second time Stanford University has been breached in less than three months. In May, a hacker known as “Agent 47” penetrated the campus information technology infrastructure and stole names, email address, photos and other data for more than 1,400 users and then pos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfda9e7c789c2682018e3a6363e7da82eb95f8a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10D2B2B0-9B00-49A9-8A41-76B0C6739A50"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"141f2788e771","org_name":"Standard Charted Bank Korea","org_type":"financial","ransomware":null,"records_affected":130000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.arirang.co.kr/News/News_View.asp?nseq=154392;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreatimes.co.kr/www/news/biz/2013/12/488_147800.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreatimes.co.kr/www/news/biz/2014/09/488_164938.html"}],"summary":"Standard Charted (SC) Bank Korea and Citibank Korea are under fire for the leakage of about 130,000 customers' personal data by their employees, the largest information leak in Korean history, raising concerns over online security at banks.  The prosecution has already arrested t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67b59a1ab781b6b9e77bfb3d33151ecfb538ae83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDCE3B70-8288-4182-B6A6-708D8FE680F5"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a4b9cbed7f02","org_name":"St. Joseph's Hospital","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sasklifestyles.com/article/20130628/ESTLIFESTYLES0101/130629920/-1/estlifestyles/breach-of-privacy-at-st-josephs"}],"summary":"Hospital employee accesses 7 patient records against policy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52126a1ef7d65b3f93a2a76374df4028b5f68ad1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8700F0F-3A91-4091-94D1-30E294F0BD25"},"incident_date":"2013-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"017bdfb36cd5","org_name":"St. Joseph License Office","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infozine.com/news/stories/op/storiesView/sid/55112/"}],"summary":"External actor procured identification documents for illegal aliens to be used to acquire Missouri licenses. Also solicited internal actor to accept identification documents for a fee.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36f68a403707578183e98caa55c8446d859c9264","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B83E65B-B656-40D4-9A68-223B80A0BE22"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"794135e34902","org_name":"Southern Illinois University","org_type":"healthcare","ransomware":null,"records_affected":1891,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/12/11/laptop-containing-patient-information-stolen-from-siu/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wics.com/news/top-stories/stories/vid_14620.shtml"}],"summary":"A laptop containing personal information of 1,891 SIU HealthCare patients is presumed stolen. The computer, which belonged to a former SIU orthopedic surgeon, was discovered missing from a locked office on October 15. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b63102323ab00c0b9d462e9f6db0dbf5fd47ff2a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12FA148B-4F30-4432-A143-A0108EE26316"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9665a5bd1315","org_name":"South Miami Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/therapist-pleads-guilty-in-fraud-case-a-5918"}],"summary":"A Miami respiratory therapist has pleaded guilty to identity theft and fraud charges related to a breach involving more than 800 patient records.  See Also: Looking for Anomalies: Try Machine Data  Betty Cole, who worked at South Miami Hospital, pleaded guilty in district court f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fddcda950542e91d1e76b00ce59fb0649b3b791","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42EE6884-DE89-41C3-A844-9C325089CC0A"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbadef99134d","org_name":"South Florida State Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.sun-sentinel.com/2013-06-11/news/fl-id-theft-psych-hospital-20130611_1_hospital-worker-patients-identities"}],"summary":"A dishonest employee and his cousin pleaded not guilty to charges of conspiracy to commit identity theft, conspiracy to disclose individuals' health information, access device fraud, wrongful disclosure of health information, and aggravated identity theft.  The men are accused of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d92001ca3afdf821f1b753949fcfd6f88bddb23f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D695E58B-E5E0-4ABF-8037-F7E6BE9A66EB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"ec94bbfc2961","org_name":"Sony Music","org_type":"technology_saas","ransomware":null,"records_affected":41000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/07/13/sony-italy-hacked-over-40k-personal-details-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkish-Hackers-Claim-to-Have-Breached-Sony-Italy-40-000-Accounts-Leaked-367890.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"https://twitter.com/Maxn3y/status/355778057426046976"}],"summary":"Turkish Ajan hacker group breaches Sony Italy web site and releases customer data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc775cb1b1fa5d7cc2d549a66665626b86b41383","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58EBCAF2-6BA7-4883-88E0-E45702110B85"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c82ed598799","org_name":"SodaHead.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.upi.com/Top_News/US/2013/10/14/Hacker-sentenced-to-5-months-in-prison/UPI-31181381785297/?spt=rln&or=2;"},{"fetched_at":null,"title":null,"type":"press","url":"http://skinnymojo.com/the_blog/ky-man-sodahead-hacking/"}],"summary":"Man edited posts in social networking website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70a11fc7cc69bcb621fbc03b8342d4f36650975b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8A9F5AF-34CE-416A-A8E0-0ACF819AFB69"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc7a898fd756","org_name":"Several Unnamed LEA","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/kfsn/story?section=news/local&id=9335428"}],"summary":"During a raid on a chop shop sensitive law enforcement documents were discovered.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e475547bc7875412ea7febedd6bae4ef4ad16089","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B016120-E3EA-4AF3-992C-5028ADB49C24"},"incident_date":"2013-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3dcc10c9902a","org_name":"Seventh-day Adventist Church","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.adventist.org/all-news/news/go/2014-04-08/new-details-released-in-cyber-attack-that-defrauded-adventist-church-of-half-a-million-us-dollars/"}],"summary":"Actors used email accounts of leaders to instruct \"financial personnel\" at the headquarters to initiate [fraudulent] money transfers/transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7610425a2e67181f65d6cd2c3e486c9514e8edf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5820EB16-C04D-49BA-A842-F455A11E1B95"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27fe7dc76bc1","org_name":"Sentara Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wtkr.com/2013/01/02/sentara-taking-action-to-protect-patients-after-security-breach/"}],"summary":"Sentara Healthcare System is taking action to protect its patients after someone stole a contractor’s laptop in California.  “Fortunately, the amount of information was limited to patients’ names, medications and date of births. There was no financial information involved, no soc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0eca46ac01de1c504cedd692b91213cb55392db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1765E78-B49B-4B20-BA7F-39F6BD14AE9A"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"be02a3a2b247","org_name":"Sebastian Enterprises, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2013/10/hacker-stole-100000-from-users-of.html"}],"summary":"SQLi against California ISP leads to disclosure of e-mail addresses and credentials.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b29032d35959f5cb1c394bc87ed2def929f2a01","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72181D76-C66F-4F87-85F7-FF93F482E1F7"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"04442bf0bfe2","org_name":"SeaWorld Entertainment Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.orlandosentinel.com/2013-12-28/news/os-seaworld-orlando-aquatica-arrest-20131228_1_skimmer-stolen-credit-card-number-aquatica-water-park"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/man-arrested-alleged-skimming-operation-aquatica-w/ncWwM/"}],"summary":"guests at Aquatica had their credit card information stolen in an illegal operation that involved employees at the water park","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"370cb00cd53a3e094f669c9f051ef1150bd834b1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0868834-E6B8-4B04-B870-488BDCCBADDB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc30dd8fd06","org_name":"Scribd","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/up-to-1-million-scribd-user-passwords-may-have-been-compromised-7000013595/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/technology/technolog/scribd-hack-exposes-thousands-users-1B9239618"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/scribd-hacked.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/04/05/scribd_security_snafu/"}],"summary":"\"Earlier this week, Scribd's operations team discovered and blocked suspicious activity on Scribd's network that appears to have been a deliberate attempt to access the email addresses and passwords of registered Scribd users,\" Scribd said on its support page on Wednesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82e34981f6fbc1ebc482b3944c4562c76742f4b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59A75079-9339-4704-869A-798DEF88273D"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"84f26183515b","org_name":"Scottish Borders Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.selkirkweekendadvertiser.co.uk/news/local-news/incredible-sbc-data-breach-resident-claims-1-3222212"}],"summary":"Incredible SBC data breach resident claims  A Selkirk man has described his shock at receiving confidential documents from Scottish Borders Council belonging to another Borderer.  The resident, who wished to remain anonymous, submitted a request to the council for information the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b44963d6ebcbaa51331a8a6eb46100f61551098","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4B41244-7B89-4829-B16F-A362CD791445"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56d5ecb89788","org_name":"Schoenbar Middle School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56654"}],"summary":"A ring of middle school students were able to gain access to and control of more than 300 computers by phishing for teacher administrative codes.  At least 18 students were involved.  The breach happened when students used software to imitate a legitimate software update on their","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb075bebe26768f0b60e2a364617043167bc21f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D8F4359-D96E-4389-BB70-8E7DF55FFBF2"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"01a82158e54b","org_name":"Schneck Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/17/schneck-medical-center-exposes-patient-information/"}],"summary":"A Schneck Medical Center employee gave a presentation that was later placed online.  People who searched through the files from the presentation could find the names of 3,000 Schneck Medical Center patients.  The presentation was removed from online and Google removed all cached ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3500a361427b4aefd2514b46a14b792f2c3b55a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"942E1B8C-3B61-4109-B188-FE17D9F966AF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbd2d77126c2","org_name":"Savannah River Site","org_type":"other","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/atlanta/morning_call/2013/03/data-breach-affects-1200-workers-at.html"}],"summary":"A security breach allowed access to the personal records of at least 12,000 SRS workers.  The breach does not appear to be the result of a cyber attack.  Workers may have had financial information exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8298a58a89efcf767f877bc7fdccc9dec1bbbf7e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6527D1DA-32C7-4B10-8582-6A4F8C261173"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"6bd14a032ef6","org_name":"Saudi Binladen Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bitdefender.com/security/hackers-leak-israel-army-data-to-avenge-hezbollah-death.html"}],"summary":"Activists hacked an Al Qaeda supporting organization to release private information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f87718dd788c8f2179f939762019bbcc711d1bfc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E213CE3C-DDD0-4ED3-9F29-EF8567C7165E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ede88cf5e5ea","org_name":"Saskatchewan Institute of Applied Science and Technology","org_type":"education","ransomware":null,"records_affected":58,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/health/story/2013/02/14/sk-west-nile-patients-1302.html?cmp=rss;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/saskatchewan-health-ministry-acknowledges-security-breach.html"}],"summary":"The Saskatchewan Health Ministry is writing to 58 West Nile virus patients about a potential breach of their private health information.  It happened during a health management class in 2005 and 2006 at the Saskatchewan Institute of Applied Science and Technology.  Up to 140 stud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"624baf85911a758f952dbad63ae46b6bd386cbc1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00E3DF41-F36C-4D4A-A95A-CF5E3163459A"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7737b5d65c70","org_name":"Sands Lothians","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thirdsector.co.uk/crematorium-investigation-documents-stolen-scottish-charity/governance/article/1171562"}],"summary":"stolen laptop with personal information from victim grounds","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71f2d1d0195973100f36e18adb6bfc80aea8e656","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46AEC14C-73A5-4994-88A5-AB058CA0D034"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d02e4986207d","org_name":"Samaritan Family Medicine Resident Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazettetimes.com/news/local/samaritan-investigates-after-medical-records-found-in-trash/article_f32cac1a-f0d5-11e2-934c-0019bb2963f4.html"}],"summary":"Samaritan Health Services is performing an internal investigation into a possible privacy breach after a woman on Tuesday found a stack of unshredded medical documents in an outside trash can behind medical offices on Samaritan Drive.  We take patient privacy very seriously, and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3823215bb3f9d64b1dbf634ccea044d30216c722","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2196AFA6-2C93-4C52-BCFF-0E8B3A5939A3"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65790a473924","org_name":"Salem State University","org_type":"education","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://salem.patch.com/articles/25-000-affected-by-ssu-data-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/salem-state-university-suffers-security-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcvb.com/news/local/boston-north/25-000-potentially-affected-by-data-breach-at-Salem-State-University/-/11984708/19350934/-/7gav8o/-/index.html?absolute=true,"},{"fetched_at":null,"title":null,"type":"press","url":"http://boston.cbslocal.com/2013/03/17/salem-state-university-says-25k-people-affected-by-data-breach/"}],"summary":"A server was found to be infected with a virus.  The University computer contained information related to paychecks distributed by the University.  Current and former employees who may have been students or staff may have been affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02e91703164488fca3af6d8e971db10210c5fedc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCC41BF5-CD3B-40E1-9B57-5DDA49627AD1"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"08575d7c9d88","org_name":"Sainsbury's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/money/2013/sep/28/identity-theft-fears-faulty-laptop-resold"}],"summary":"Customer returns faulty laptop and receives new one. Sainsbury's sells the faulty laptop on Ebay, apparently without wiping the hard drive (which was supposed to have been done by a 3rd party contractor). The laptop is purchased, and the buyer contacts the original owner to let t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d75928045757ef1c945f531f336c115aea82df5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B13B665-8EBD-4E6C-A5E1-754498ED5205"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51861388c30c","org_name":"Sacred Art Tattoo","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxdetroit.com/story/21975732/sacred-art-tattoo-in-flat-rock-admits-tossing-sensitive-documents"}],"summary":"Tattoo parlor disposes of customer records in dumpster. Documents were discovered by third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b52b2190df426b9243d6c6b1c952181b82d674f0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DD1EDAE-7751-4E4A-8419-575443A635D5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"f142b94d70ce","org_name":"Ruhr-Universit_t Bochum","org_type":"education","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thelocal.de/20130212/47909"}],"summary":"Student and staff email accounts were compromised via undisclosed method. 16 confirmed unauthorized accesses, resulting in changing passwords for 50K users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d54e1785781903e160942b7a688db8f0d190d490","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"548F08D7-96B2-4BC9-9A3F-591C986C228B"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2af90821e985","org_name":"Royal Oldham Hospital","org_type":"healthcare","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.capitalfm.com/manchester/on-air/news-travel/local-news/data-loss-greater-manchester-hospitals/"}],"summary":"Data about 16 child patients at the Royal Oldham Hospital was found more than 40 miles away in Liverpool.  The Pennine Acute Hospitals NHS Trust said any loss of data was unacceptable.  A spokesman told Capital: \"We take incidents involving patient data very seriously.  \"We have ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95e67741217887d69f8a9e9c7355e11fb9a44593","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"564A32C5-205A-417A-9755-096F02BC546E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a25593f2fa4a","org_name":"Royal Canadian Mounted Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ca-mounties-accused-of-privacy-breach-in-handing-over-medical-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/health/Mounties+accused+privacy+breach+handing+over+medical/8728035/story.html"}],"summary":"The RCMP is accused of violating the privacy of several of its members by handing over their personal medical records in a dispute with a B.C. psychologist.  The Mounted Police Professional Association of Canada filed a complaint today asking the federal privacy commissioner to i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79f0e8435a742516ed1837d93ca5f12107d39e47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAA68B75-8A43-47EA-9609-DDB67C1CF852"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2e7463b2e8ca","org_name":"Royal Borough of Windsor & Maidenhead","org_type":"government","ransomware":null,"records_affected":257,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.localberkshire.co.uk/news/windsor/articles/2013/12/09/95793-information-security-analyst-raps-royal-borough-over-missing-laptops/"}],"summary":"EVERY single person that lives in the Royal Borough should be worried after council security breaches were revealed, a security specialist has warned. The warning comes from mobile information security specialist, David Rogers, who has been running Copper Horse Security in Windso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80901f71e840054c9878fbf940435045f7612a05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12EA2011-A15B-4AF3-8AD4-82E3FBF345B2"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"7d91009b0225","org_name":"Rouge Valley Health System","org_type":"healthcare","ransomware":null,"records_affected":8300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/gta/2014/06/03/major_privacy_breach_involving_thousands_of_new_mums_uncovered_at_rouge_valley_hospital.html"}],"summary":"two employees at hospital sold patient info to outside company, which then contacted these former patients to sell them Registered Education Savings Plans.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5cc58aff84f96e397e505b73866e081c0663849","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B93A9BC-8178-418B-83E6-6FDF0413CF0A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cee48a23239d","org_name":"Rothamsted Research","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/06/02/rothamsted-research-hacked-full-databases-and-credentials-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/xmd2rzg8"}],"summary":"Rothamsted Research hacked by an activist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf00d84d78c7aad31ef0ece54b67789c3f63a096","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7F2ACF0-4EB7-47B7-8E0D-4EF82198B57D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a633c96cb356","org_name":"Rogerson Kratos","org_type":"manufacturing","ransomware":null,"records_affected":32,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://labusinessjournal.com/news/2016/jan/06/glendale-man-convicted-stealing-trade-secrets/"}],"summary":"Insider espionage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43076ff7742d2709d3d215f3ae0c19f42f76b4b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54119DE6-083F-442E-8BD2-BE6A9435E8AA"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"177c93f4ff34","org_name":"Rocky Mountain Spine Clinic","org_type":"healthcare","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedenverchannel.com/news/local-news/rocky-mountain-spine-clinic-reports-breach-of-privacy-rules;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sacbee.com/2013/07/31/5613547/denver-area-clinic-reports-breach.html"}],"summary":"A Denver-area spine clinic says it has fired an employee in its billing department who improperly emailed some patients' protected information to her personal account, but it doesn't appear anyone's personal information is at risk.  Rocky Mountain Spine Clinic in Lone Tree said W","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"AU","motive":"financial","name":"Shane Duffy","variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3971bcfa133d84c5639c6eaa7bdcd22412e62b3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FB2677D-93C9-4452-92C7-FEA2233B7254"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0f8c08bc467","org_name":"Riot Games, Inc.","org_type":"professional_services","ransomware":null,"records_affected":24500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://web.archive.org/web/20140322061000/http://www.dailydot.com/esports/league-of-legends-hacker-arrest/;https://web.archive.org/web/20150204062054/http://www.dailydot.com/esports/jason-shane-duffy-league-of-legends-hacks/;http://www.escapistmagazine.com/news/view/136262-Hacker-Made-1-000-A-Day-from-Stolen-League-of-Legends-Accounts"}],"summary":"A 21-year-old Australian man was arrested for hacking into and then selling access to the database of League of Legends' developer, Riot Games.  Police say the man used a Dutch Internet service provider to hack the American company and then put the information on a Panamanian web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"shaneduffy"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e2a97681049a689da3aa2d02178602d5b7c9076","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F43E6DAB-D9B5-4B7C-9283-D5A81C52474B"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a78f88ef6568","org_name":"Residents Property Tax and Rent Refund Circuit Breaker Program","org_type":"government","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.boston.com/news/local/maine/2013/08/16/gardiner-woman-pleads-guilty-theft/TboBYybtWi9TCFqGpdOpQJ/story.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kjonline.com/news/Gardiner-pleads-guilty-to-identity-theft-fraud-charges.html"}],"summary":"A Gardiner woman has pleaded guilty to stealing the identities of people she was supposed to help get property tax relief.  Federal prosecutors say 43-year-old Joann Rittall pleaded guilty Thursday to identity theft and fraud charges which led to $240,000 in tax refunds to which ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba81c50517ce1216a33acdc78addbf4d644b1f6b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D81ACBD8-7769-4CBF-A316-8A9A225EA32A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e045290286e","org_name":"Reputations.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.stormpath.com/blog/reputationcom-loses-user-passwords-emails-and-addresses?buffer_share=5bbc4"}],"summary":"Reputation.com experienced a hack that exposed customer names, email addresses, mailing addresses, date of birth, and employment information. Additionally, some customers had their encrypted passwords stolen.  Reputation.com immediately reset all customer passwords after learning","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88085afeb2a92a560b142338825ab57728f0b8a9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A30F8B72-8F8B-4953-A852-5C2D3B2780B7"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e51aeaec978","org_name":"RentPath, Inc. (Primedia)","org_type":"technology_saas","ransomware":null,"records_affected":56000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/RentPath%20Notice%205.31.13_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/RentPath%20Notice%207.1.13_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/rentpath-security-breach-may-have-exposed-56000-social-security-numbers.html"}],"summary":"An independent contractor with access to Primedia's network operations group was found to have stolen hardware.  The issue was discovered on June 20, 2012.  Applicants, employees, and former employees may have had several different types of personal information stolen. Approximat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af77a61c4042070b94ab94bf660a11baa2ba7f8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A67046EA-6245-47D4-8AEF-AD18832C1DDE"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8a0223aebee0","org_name":"RentCanada","org_type":"technology_saas","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://winnipeg.ctvnews.ca/woman-finds-her-private-information-from-rental-application-posted-online-1.1599730"}],"summary":"PII posted online on rental advertising guide site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb79e8ced77afbb01e4d6981fd63f9d169b8b063","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8CC475D-02CE-4B13-BE83-DD90DCBACFEF"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc5f28a0d409","org_name":"Regional Medical Center Bayonet Point","org_type":"healthcare","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abcactionnews.com/dpp/news/local_news/investigations/regional-medical-center-bayonet-point-hospital-sends-records-of-multiple-patients-without-permission,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/19/regional-medical-center-bayonet-point-sends-breach-letters/"}],"summary":"Requests from patients for medical records are a routine task for hospitals.  “I went to the hospital and was given a form to fill out for medical records,” said Micki Thoms.  Thoms asked for her records after undergoing surgery at Regional Medical Center Bayonet Point in Hudson,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70eb2e183b903fdfb4ec9697e68961c029e94a8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07093C37-7967-460C-9497-24CD42A55E73"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68e00abc1060","org_name":"Randor Township School Disctrict","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mainlinemedianews.com/articles/2013/12/13/main_line_suburban_life/news/doc52ab1e17ced8d552734307.txt?viewmode=fullstory"}],"summary":"Middle school student accesses file that contained personal information of employees. During a data transfer process a folder was left \"open\" that made the file accessible to anyone on the school network.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30f9c8f55f71f62be540a2ea9d9c39eec9aa279e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34BEB0C5-EBF1-45C5-8EB2-FCFEA3598180"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4da9aa3135f9","org_name":"random load companies","org_type":"financial","ransomware":null,"records_affected":335,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/opa/pr/alabama-loan-company-employee-pleads-guilty-stealing-identities-used-file-false-income-tax"}],"summary":"loan companies used to steal data to file fake W2's.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22021b9d089779f362f66b6cb88652c129f289a7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47B12092-D159-46ED-90C6-A8E0631B774E"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"955bddab9d07","org_name":"Raley's Supermarkets","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.raleys.com/www/feature/media.jsp?featureid=3165605,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.raleys.com/www/feature/media.jsp?featureid=3015764,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/attacks-breaches/raleys-family-of-fine-stores-targeted-in/240156182,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mercurynews.com/breaking-news/ci_23408877/raleys-warns-customers-cyber-attack-possible-security-breach"}],"summary":"The Raley's supermarket chain warned customers Thursday that part of the company's computer network may have been targeted in a cyber attack.  The company stated in a news release that it could not confirm if any unauthorized access had been made to payment card data, but that an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60611933e409c48b1a82fb243c37021ab46b8313","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DD5345A-323F-4EAE-9F33-49BFE62CD1EE"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4f796fd1d58","org_name":"Raleigh Orthopaedic Clinic","org_type":"healthcare","ransomware":null,"records_affected":17300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsobserver.com/2013/05/06/2875900/raleigh-clinic-says-x-rays-were.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bna.com/nc-clinic-pays-n57982070223/"}],"summary":"Patients who had X-rays at Raleigh Orthopaedic Clinic before 2008 are being urged to keep an eye on their bank statements and credit reports after 17,300 sets of X-rays vanished.  A company the practice hired in January to convert X-ray films to electronic files never returned th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c41f48dc87efe713a2b1e415f5e2d54d14cdc218","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D89EFB3-49BF-4D67-8057-48139F5B4216"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d9306028c92","org_name":"RaceWay Gas","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxdfw.com/story/22177581/identity-theft-ring-in-nyc"},{"fetched_at":null,"title":null,"type":"press","url":"http://crimeblog.dallasnews.com/2013/05/ny-officials-id-theft-ring-stole-from-victims-who-used-credit-cards-at-mesquite-gas-station.html/"}],"summary":"Gas pump skimmers used to steal credit cards from customers at RaceWay gas station in Mesquite Texas.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be71fd9f31b79b06392c34188745c1ea357bb80c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1B32920-7D99-48A9-B7FF-193F62B1B83E"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"327b424817c6","org_name":"QVC, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/QVC%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"We learned on April 3, 2013 that an unknown person gained access to your account on our website by using your e-mail address and PIN. The unknown person then attempted to order an item from QVC using your stored credit card information. The credit card that you associated with yo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9d166030a312d08595d76c8d180d828c53e92ca","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F0E5538-576C-4C52-8ED0-5F18A1A8C18C"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PY","org_id":"4f5a5abb8a56","org_name":"PY National Police of Paraguay","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Paraguay-s-National-Police-Hacked-and-Defaced-393322.shtml"}],"summary":"The official website of the National Police of Paraguay (policianacional.gov.py) has been hacked and defaced by a hacker who uses the online moniker TuNoVaTo.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71b4e9af2e6f7d379b7cc1c12ca4a1a6f100ef26","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B75B593-C66A-4AB0-BE57-D18B1346503D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"3c846f62e45d","org_name":"Puthiyathalaimurai","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/puthiyathalaimurai-website-hacked-by.html"}],"summary":"A pakistani hacker by name \"H4$N4!N H4XOR\" belonging  to \"Pakistan Haxors Crew\" who hacked the JayaTV website and AIADMAK site before has now hacked the Puthiyathalaimurai website again and left the following message. - See more at: http://www.ehackingnews.com/2013/11/puthiyathal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc52dc3b0c7a8615a82af72d89e2cdc5a6519f10","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E534AA6A-263F-49C2-849F-A4E8AAC47A08"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"140d57be84b7","org_name":"Publishers Circulation Fulfillment","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/217868681_East_Orange_man_charged_with_identity_theft_of_records_from_Rockleigh_business.html"}],"summary":"Internal actor used system access to steal personal and financial information belonging to fellow employees. He used this information to reset PIN numbers, access the accounts and commit fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6853bd7d86905cccd8940d496798b05d6667455","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"198CF7AB-7EC8-482E-A970-CAE03A252836"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ad04964078f","org_name":"PUBLIC EMPLOYEES RETIREMENT SYSTEM, CALIFORNIA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.sacbee.com/the_state_worker/2013/02/calpers-employee-arrested-on-suspicion-of-identity-theft.html"}],"summary":"Woman uses her position to steal identify information of customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f31d3e0efbb297e81e9aac0a5ba976885caa097d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B8309A3-83FD-40EC-A5B9-8B5031332352"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ddce695dde5b","org_name":"Prince Edward Island School Systems","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/2983"}],"summary":"Six P.E.I. students disciplined for hacking high school attendance files   Read more: http://atlantic.ctvnews.ca/six-p-e-i-students-disciplined-for-hacking-high-school-attendance-files-1.1230154#ixzz3IxvJmKuO  SUMMERSIDE, P.E.I. -- Six students at a high school in P.E.I. have bee","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de4fb0d5e7cf4196597c2ec790170a554c8e4386","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"633EE011-3DB1-43D3-B7A2-74C87FAA038C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"5ec2aa98021f","org_name":"Preventine Life Care Pvt Ltd","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dnaindia.com/mumbai/report-firm-slapped-rs-30-lakh-fine-for-data-theft-1956820"}],"summary":"Two employees steal proprietary information to assist them in launching a competitive company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04a3b0aa83ac45f51d45bc02ea30d745dc0c2235","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76C61146-5134-4671-87BF-67FA1DD6099C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"772d58557ca4","org_name":"Pret A","org_type":"other","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theepochtimes.com/n3/247781-two-former-pret-a-manger-staff-charged-with-identity-theft/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/two-former-pret-a-manager-employees-charged-with-identity-theft.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nypost.com/p/news/local/couple_pleads_employees_guilty_credit_IC34yEVYIMWpw6INbl5gBJ"}],"summary":"Two former Pret A Manger staff allegedly skimmed customers’ credit card details to forge cards with their own names on them, according to the Manhattan District Attorney’s Office.   McCollum is a former kitchen employee at the 23rd Street Pret A Manger in Chelsea. Over several mo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed1da7db4a42df1c6cdcd46a15f6464eea85b7e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3D0D1C3-09F4-49FF-907C-4F76EDAC8DF1"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"47223d94ef67","org_name":"Presbyterian Anesthesia Associates","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/15/more-details-from-presbyterian-anesthesia-associates-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/2013/05/13/4039763/presbyterian-anesthesia-reports.html"}],"summary":" The credit card information of nearly 10,000 people may have been accessed in a data breach at a Charlotte medical practice.  Presbyterian Anesthesia Associates has disclosed that a hacker broke through a security flaw of the practice’s website to gain access to a database of pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ce96abd8139bc3fb9ad543980b4f126ab0e42ed","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2D16B0A-B78F-4B2E-BB90-41DF35433775"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6213528880da","org_name":"Police Department of Littleton, Massachusetts","org_type":"government","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lowellsun.com/local/ci_22471781/littleton-police-chief-answers-data-breach"}],"summary":"A police activity log for the period of January 7 through January 13 was published on the Littleton department's website. Someone forgot to remove personal details from the log and the sensitive information was available online for 10 days.  Names, Social Security numbers, dates ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd937e28503e68eddf6ebbec0943c93795fdfbd2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C086A850-3521-4B9F-BE9A-1AD76D28E87B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f29a6ae00063","org_name":"PocketGPSWorld.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pocketgpsworld.com/Important-Customer-Security-Announcement-1615.php"}],"summary":"E-mail database of GPS review forum compromised via unknown method.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eca104232fa55ad4fcf899d77b589304dda675cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A5568FE-BBAD-4091-82D2-852811B80789"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3df07dd382e0","org_name":"Plateau","org_type":"technology_saas","ransomware":null,"records_affected":7500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/new-mexico-isp-plateau-hacked.html"}],"summary":"Members of TeamBerserk accessed the user database for New Mexico-based ISP Plateau, and published more than 7,500 users' e-mail addresses and plain text passwords online (h/t The Hackers Blog).  It's not clear if this is a new breach -- the statement, \"All the e-mails have been d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71746717e4989f109d40ca7c8c4e072e461fd6cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A66E618D-6A57-4788-A33C-9EA526359530"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"40cff5c90782","org_name":"Piscitelli Law Firm","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/lawyer_is_suspended_for_accessing_and_deleting_some_law_firm_emails_after_f/?utm_source=maestro&utm_medium=email&utm_campaign=tech_monthly"}],"summary":"Lawyer uses logins post-dismissal to delete emails.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70934c18d9f845ec0eb11b051fe5aecd7a54fc83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4C2C85B-3810-47A7-814A-D4D80EA2612E"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"874ae7ab2efa","org_name":"Pirate Party of Germany","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Pirate-Party-of-Germany-Targeted-with-DDOS-Attack-378080.shtml?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+Delicious%2Fvzriskteam%2Fagenda+%28Delicious%2Fvzriskteam%2Fagenda+%28test%29%29"}],"summary":"Pirate Party of Germany site hit with DDos Attack.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63ecde8fe8fb3a66b5aa1cc0dd28882649413364","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD4D41E4-5D35-43C4-8F34-972809F45B0B"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78431676e87b","org_name":"Pipeline Data Inc. (SecurePay)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/03/thieves-jam-up-smuckers-card-processor/"}],"summary":"actor uses hacking and malware to steal credit card information from SecurePay","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91674cffaf321a033723f6ef20fd650174aad8af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"017FED55-76C0-4659-A4E1-ECDA5187A92A"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab8284cfd69b","org_name":"Pierce County Housing Authority","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.king5.com/news/local/Private-information-of-Section-8-waitlist-applicants-accidentally-posted-online-223054931.html"}],"summary":"Housing authority suffers data breach revealing PII for people on wait list for housing. Spreadsheet was published to public-facing website. Discovered by resident who found her own information after an internet search on her name.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"779f76583af38092fe4da69871caf5da576b4e3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55D20C99-F5E9-4BFB-8721-8F7B652C010A"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"74cd345c8a92","org_name":"Philippine Navy","org_type":"government","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Philippine-Navy-Hacked-User-Credentials-Leaked-369795.shtml"}],"summary":"An Anonymous hacker that uses the online moniker Pr3-H4ck3r claims to have breached the official website of the Philippine Navy (navy.mil.ph).  As a result of the breach, around 50 email addresses, usernames and password, including administrator credentials, have been leaked onli","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db6cac6b1725e05d86dbec18d560abca316b4d11","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6C30497-82CE-4136-88BA-9050FB0CCA6F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"217844b755e1","org_name":"PHH Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/phh-corporation-20130510.pdf"}],"summary":"A temporary worker was indicted in connection with identity fraud for another organization.  Because this worker had access to personal information of some of the company's current/former employees, they performed an investigation.  The worker accessed (in the course of their job","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c363ba7f21d6148851714f71f93d50c099dc93ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F68F89E-0A20-420D-B08B-369C03F880B4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43b42e3ff58b","org_name":"PetSmart, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/crime-law/sheriff-petsmart-worker-provided-thieves-targets/nZ52b/"}],"summary":"PetSmart worker provided thieves with targets ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24929c5468ea99e44150f3388bf97ef849b542dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D984F5F0-D6BA-4704-B487-EB226109F9A7"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82e0d1c2c675","org_name":"petfinder.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/Petfinder/posts/10202595104662993"}],"summary":"error in petfinder.com API allowed unauthenticated access to partner org data (info about org and pets they care for).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"PE","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b004c9632c88bf6c9c3f916bca0d9693a21612f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DCF2BB1A-9B02-469E-B417-2F4B7F9BD8FA"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"c5b42e6bfeaf","org_name":"Peruvian Association of Authors and Composers","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Peru-Attacks-Peruvian-Association-of-Authors-and-Composers-392009.shtml"}],"summary":"Anonymous Peru attacks Peruvian Association of Authors and Composers (APDAYC). They launched a distributed denial-of-service (DDOS) attack against the organizations website. The site, APDAYC.org.pe, was down for over three hours due to the attack launched by the hackers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a8b46bcfd34094fc7808c2ba5757fefc13e5831","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B55A8B9E-6589-4263-AF9B-E65EB61107D9"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1533f2db008a","org_name":"Pentagon","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itproportal.com/2013/04/15/pentagon-data-breach-sees-half-million-guantanamo-emails-leaked/"}],"summary":"Lawyers working with Guantanamo Bay detainees had to pause their work after being told to stop using the Pentagon's computer system.  An unspecified issue left over 500,000 emails unsafe to access or deleted from a Pentagon common drive. The breach left defense files unsecured an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d46cec76186c9cd09aa40947e0fe1961c59fb54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"24C49BD1-B4B7-46BC-82EC-3CB535791601"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MY","org_id":"310ffdc5defd","org_name":"Penang State Tourism Development & Culture","org_type":"government","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Malaysia-s-Penang-Bridge-Marathon-2013-Allegedly-Hacked-389015.shtml"}],"summary":"Malaysian government run marathon site breached and registrant data posted to public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PE","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f6b6c41c4be62e551c0f269b44c7dcf3e14762f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C23D2412-10EE-46DE-9082-DEC6E89AB330"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"b827816365f9","org_name":"PE Peruvian National Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Peru-s-President-Hacked-and-Defaced-by-LulzSec-Peru-401074.shtml"}],"summary":"Hackers of LulzSec Peru have breached and defaced the official website of Perus President (presidencia.gob.pe). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PE","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"845c844a2e671223f2559fe4b4a239eb629cd504","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C091AA76-173B-4C0A-9B1B-CE18767B8A96"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PE","org_id":"b253302c175f","org_name":"PE Office of the President of Peru","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Peru-s-President-Hacked-and-Defaced-by-LulzSec-Peru-401074.shtml"}],"summary":"Hackers of LulzSec Peru have breached and defaced the official website of Perus President (presidencia.gob.pe). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"584f21fc25b986db76076f1e67f0665d7876833e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E22C279-BB2C-422B-82F1-7B8D8EB6961D"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"26b6f43e6028","org_name":"Pathways","org_type":"healthcare","ransomware":null,"records_affected":65,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nz-pathways-mops-up-privacy-breach/"}],"summary":"An organisation that works with mental health patients is trying to mop up the mess it created by a somewhat old-fashioned privacy breach.  It lost documents containing the names, addresses and clinical details of 65 of its clients, when a staff member left their bag on a Welling","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e959d9bac979f710d2381427b5b15bec9af3f4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7779CCC9-8151-4155-901E-DA69EFE2830B"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfff70b7f643","org_name":"Palm Garden Nursing Home","org_type":"healthcare","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/news/local/article/318579/8/Woman-accused-of-nursing-home-ID-theft"}],"summary":"Nursing assistant stole identification information from 13 people at a nursing home where she worked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8bad9fbc4e4d1f47f2121924be194203e0fda1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"712C726D-887B-4E98-9299-FE409EB68087"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12a3df862552","org_name":"Palm Beach County Health Department","org_type":"government","ransomware":null,"records_affected":2800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/13/palm-beach-county-health-weathers-latest-health-data-breach/"}],"summary":"A senior desk clerk was arrested for obtaining and releasing patient information for identity theft purposes.  The dishonest employee took home client lists with names, Social Security numbers, and dates of birth.  Patients born between 1991 and 1996 may have had their personal i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f75c7b64e07f9ea5cf8b9826772f044cbda20b40","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA243FE2-D42E-4F89-95A7-32C94BAB1997"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f898b4400bf9","org_name":"Pacific Grove Police Department","org_type":"government","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.montereyherald.com/localnews/ci_24601060/former-pacific-grove-police-commander-accused-by-attorney"}],"summary":"Former Pacific Grove police commander accused by attorney in ex-wife's identity theft case Ex-wife's attorney says John Nyunt 'was involved'  By JULIA REYNOLDS  Herald Staff Writer POSTED:   11/25/2013 08:35:14 PM PST0 COMMENTS| UPDATED:   11 MONTHS AGO  RELATED STORIES Jul 15: W","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed522a448f880b5504e1b7f650be788d72b8c570","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F4C4FB1-CEFF-4CD6-B840-3593FCC649FF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"07bd5a99e897","org_name":"OVH","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/French-Web-Hosting-Company-OVH-Admits-Being-Hacked-370166.shtml"}],"summary":"France-based web hosting company OVH has been hacked. As a result of the incident, customers are being advised to change their passwords.  “A few days ago, we discovered that the security of our internal network at our offices in Roubaix had been compromised. After internal inves","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4818bcda6de2e4ee6894a7453da59b2873ba1b76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D15AF63-ACB9-49F8-8047-A4B3D123D2FF"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f6ac333923","org_name":"Orlando Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/21/former-mid-florida-urological-employee-accused-of-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/medical-assistant-accused-using-patients-records-c/nWS2T/"}],"summary":"Medical assistant uses stolen credential to access patient records and commit insurance fraud. Modeling from organization she accessed, not her place of employment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60eaf96d35e8a3cb34aaf97311a7a74740864fc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56F76EC7-9976-49C7-9E95-E0A53FB78963"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ab3ac00f296","org_name":"Oregon Health & Science University","org_type":"education","ransomware":null,"records_affected":3044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mhealthnews.com/news/latest-hospital-data-breach-involves-cloud-services;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/ohsu-pays-nearly-3-million-over-two-data-breaches-in-2013/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ohsu.edu/xd/about/news_events/news/2013/03-25-ohsu-contacting-surgery.cfm;"}],"summary":"So far, healthcare data breaches have primarily involved lost or stolen smartphones, laptops, tablets or thumb drives. A recent transgression at the Oregon Health & Science University, however, has added a new area of concern: Unsecured cloud platforms.  OHSU officials recently n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3dbdbef17f8ad386487c14fec1b282b78a1cd0f4","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F583BFC3-BE26-498D-9E2F-E5E4DAE75593"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d08fbc8bc7f2","org_name":"OpenX","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.openx.org/08/important-update-for-openx-source-2-8-10-users/"}],"summary":"OpenX takes security seriously. Recently we became aware of a security issue with OpenX Source v. 2.8.10 (the open source ad serving product) whereby the binary distribution of v. 2.8.10 was compromised, and two of the files were replaced with two new modified files that containe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c335927fbdce585bcf588295e07ce7b676b0529","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D985B4E5-C665-4162-B1F1-A5CC8ED0C3B8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"583c1f0054a6","org_name":"openSUSE","org_type":"other","ransomware":null,"records_affected":79500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2014/01/openSUSE-Forum-Hacked-by-Pakistani-hacker.html"}],"summary":"Pakistani hacker 'H4x0r HuSsY' has successfully compromised the official Forum of 'openSUSE', a Linux distro developed, sponsored & supported by SUSE.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05e4665bdf78f1f799d913788d381a280ab1f580","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E9676F6-6D70-43B3-987F-974675F5037A"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ea03f11c181b","org_name":"OpenSpending","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://openspending.org/blog/2013/01/09/privacy.html"}],"summary":"A freelance data specialist from our community recently got in touch to let us know that he had used OpenSpending to identify a number of privacy breaches in an individual dataset presented in OpenSpending.  This was due to inconsistent redaction of sensitive data by the local au","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a08cdb3330d06090d486032cdc17293f8f6b3930","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C11DD34-8E5A-449D-9B23-94D36184C8F3"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f81ee3cffe63","org_name":"Olive Garden Restaurant","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.montgomeryadvertiser.com/article/20130903/NEWS/130903015/Two-accused-stealing-credit-card-numbers-from-Prattville-restaurant-patrons?nclick_check=1"}],"summary":" The indictment charges that Strother was an employee at Olive Garden and that Willis gave him a credit card skimming device to read and store credit and debit account numbers of cards used for payment.  Strother used the device to swipe customers credit and debit cards and then ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04e525c21096f2278d678d376b6bc5296a5f6458","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3A120B3-3B73-41E0-88AF-67E56CDA1DA9"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db3577a16c14","org_name":"Oklahoma Behavioral Health Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/02d13d019f9a48ba9cb3be220efaf4a1/OK--Medicaid-Fraud-Oklahoma"}],"summary":"An Oklahoma behavioral health rehabilitation specialist has been charged with three counts of Medicaid fraud and one count of identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f1e850181abb7aebfd7415e14315aba8e1f30cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55955697-FA0D-4465-8A2B-A31A37D0981E"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c4085b6dd83","org_name":"Office of Dr. Sandra Bujanda-Wagner","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kdvr.com/2013/01/08/patients-personal-information-found-in-dumpster-outside-dentists-office/"}],"summary":"Employees accidentally threw out hundreds of patient records.  The dental records were found by someone looking through a dumpster and the incident was reported to a local news team.  Names, Social Security numbers, dates of birth and addresses were exposed. Employees from Bujand","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c85e8f16771d211b8ef8f7deaca53e9319206ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4295B4DC-50A9-4545-A602-3F8B1728A806"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"4d3563b8c7d9","org_name":"Odense Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cphpost.dk/politics/df-politician-faces-police-charges-leaking-information"}],"summary":"DF politician faces police charges for leaking information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efc95f8eebd3417ba6bec34022636ef94552504d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBAE9BEF-1B66-49AC-90D7-95FA3815369A"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d20606d3002","org_name":"OCS America, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20OCS%20Employee%20Breach%20Notice%20Letter%20%2811%20March%202013%29%20v1_0.pdf?"}],"summary":"A phishing attack affected an OCS America computer on March 4, 2013.  The computer contained names, Social Security numbers, addresses, telephone numbers, dates of birth, job titles, and salary information.  It appears that only one computer was affected. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bdbe2ecfdb8414fc57f80e0dc09f7f8679dff21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CA68F32-422B-4A64-A93B-62EB0141C584"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fab1735e0ad7","org_name":"Oakland Community College","org_type":"education","ransomware":null,"records_affected":129,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theoaklandpress.com/general-news/20130424/glitch-publishes-private-info-of-more-than-100-oakland-community-college-students?viewmode=fullstory"}],"summary":"129 student's information published on public web site due to a self-defined \"computer glitch\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b00c2995e5b0dae965954720d6684ef37e0e762d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4434C0AC-FF96-45D1-9175-EFC37255ED06"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"a6696b002e63","org_name":"NZ New Zealand Trasport Agency (Motor Vehicle Register)","org_type":"government","ransomware":null,"records_affected":5684,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/business/9194703/Motorists-privacy-breached"}],"summary":"Thousands of motorists have had personal details sold to third parties, despite explicitly asking for privacy, more than two years after the law was changed to protect their information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05e409e8219f4df70ec428063a40f5dc57983b19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5B4D2A7-6823-4AFC-8E25-C2E7C5E0DCC4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"74dfc06b2907","org_name":"NZ Immigration","org_type":"government","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tvnz.co.nz/national-news/immigration-nz-caught-up-in-privacy-breach-5392902"}],"summary":"Two hundred people working with Immigration New Zealand are the latest victims of a government department privacy breach.  Immigration New Zealand managers sent two emails revealing the names and email addresses of lawyers and advisers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6bed586573c47e9c7d2df2f7a0f859a4f095411","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EBC8224-2E90-49BB-ACB4-EE627CADCB45"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"1bebe51ca311","org_name":"Numbericable","org_type":"technology_saas","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rtl.be/info/belgique/societe/1018036/numericable-refuse-de-ceder-au-chantage-de-hackers-les-donnees-de-6-000-futurs-clients-bientot-publiques-"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Leaks-Details-of-6-000-Numericable-Customers-After-Firm-Refuses-to-Pay-368799.shtml;avid=1mg1wjz2ijl2i144m824h6ukpy"}],"summary":"Hackers Leak Details of 6,000 Numericable Customers After Firm Refuses to Pay Up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d3667e91e2d42df5d2dc87fa3b82c7a6efdd8d8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF4D61A1-D066-45C2-8ABA-A596083AB230"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67f3384d8a3e","org_name":"Novartis AG","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/novartis-20130805.pdf"}],"summary":"Novartis loses flash drive containing data on at least one person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09de4bace4811177a5dc4ceb3bae1cdece67c4c0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B950D87-8407-4842-B772-2955411A13B2"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8dce21368b8","org_name":"notebookreview.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://forum.notebookreview.com/msi/announcement-urgent-alert-security-breach.html"}],"summary":"exploit in vBulletin software showed evidence of compromise, \"Weve thoroughly reviewed our logs and identified that hash-encrypted stores of user names and passwords may have been accessible to the criminal hackers responsible for the breach. There is the potential that a skilled","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c2fc6830a8476a9d44cf39b3241ba8b5b04c2cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B20F138-5489-4D36-A41A-1D9DB5895A52"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5aa6d6458a34","org_name":"Northern Inyo Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.inyoregister.com/node/5176"}],"summary":"Local law enforcement has opened an investigation into the theft of medical records from Northern Inyo Hospital in a case that has shaken community members and NIH itself. This past summer, hospital officials noticed that an employee in the records department had illegally obtain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IT","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56d1c2a8d634373de48d07f95ed23cd57e140177","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"071DFC80-B4F5-4566-92C6-2C6CB9B826E4"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7f602d2fc793","org_name":"North Wales Transportation Committee","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-North-Wales-Transport-Committee-Taith-Hacked-by-Pakistani-409655.shtml"}],"summary":"The attacker has defaced the Taith websites main page with a protest message against the intention of some UK officials to ban Muslim girls and young women from wearing veils (hijab) in public places.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e7cc4b8bd53f24fac7945b30aacaf482fe75a21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3518A94-7FDC-4828-88F5-46EEFEEF04FD"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc6199c1bc6f","org_name":"North Jersey Developmental Center","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/Employees_at_Totowa_mental_health_facility_admit_stealing_patient_information_to_file_fake_tax_returns.html"}],"summary":"Employees at Totowa mental health facility admit stealing patient information to file fake tax returns - See more at: http://www.northjersey.com/news/Employees_at_Totowa_mental_health_facility_admit_stealing_patient_information_to_file_fake_tax_returns.html#sthash.f40riRmb.dpuf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d827ccd801cf152a8a78aaf3a0e2e8062d79213","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97297F17-4C51-4915-8D18-3A04FCB9F798"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5cfa1279181","org_name":"North Georgia Tech","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsgcradio.com/north-georgia-tech-students-asked-to-be-alert-after-possible-security-breach/"}],"summary":"FBI notified North Georgia Tech of probable breach of one of their databases, in article, victim talked of database in past tense, assuming they just took it down rather than investigate.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"acd90d2a7e612f2fa10499db044f240dae3cffc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCD74A0A-418E-4FFB-8F12-4364B62A3232"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36cc78a020a2","org_name":"North Carolina Department of Health & Human Services","org_type":"government","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/ef9a03c517bf45559b73bf79907a6304/NC--DHHS-Data-Breach"}],"summary":"mispublishing error exposed patient names, addresses, payment date, dollar amount and the name of the facility making the payment.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ccbbc507cca3d67e4c4f337a8a30a9118ccdae69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D126B515-4B12-4B69-AF74-811ED4D40C24"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"111156320110","org_name":"North Carolina Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/lost-unencrypted-usb-thumb-drive-impacts-more-than-50k-medicaid-providers/article/284000/;http://www.wral.com/medicaid-contractor-loses-provider-s-personal-information/12201020/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wral.com/dhhs-mailed-nearly-49-000-medicaid-cards-to-wrong-people/13269236/"}],"summary":"A government contractor in charge of building North Carolina's Medicaid billing system lost a USB thumb drive containing the personal information of thousands of Medicaid providers nationwide.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47e323abb9acf38416b11fb051951b32fbdacf9e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07CAE06A-4817-4E89-A6D7-F4B9508426D6"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac2e2e1e1f9e","org_name":"NJ Lenders Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/bergen/index.ssf/2013/05/police_arrest_11_alleged_members_of_paterson-based_identity_theft_ring.html"}],"summary":"Insider steal customer identity and opens lines of credit at stores.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a75895a3f5c99576f6f92979931a544e375f6c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB48B420-B3E5-401C-8991-2239242A171A"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NG","org_id":"95c8b29b7d9a","org_name":"Nigerian Federal Ministry of Aviation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://premiumtimesng.com/news/146851-update-aviation-ministry-declares-war-on-staff-who-allegedly-leaked-info-on-stella-oduahs-n255m-cars.html"}],"summary":"internal staff leaked internal documents detailing purchase of expensive armored vehicles. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"648104ab79e1af7218c302e098fbc4b0366be889","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"629D43E9-4C80-40BF-A02F-67216D82B070"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LK","org_id":"5ad94ff3216f","org_name":"nic.lk","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/01/sri-lankan-nic-siteniclk-hacked-via-sql.html"}],"summary":"The hackers exploited a critical SQL injection vulnerability in Sri Lankan NIC website(nic.lk) that allows hackers to hijack top level Sri Lankan domains. Hackers compromised data from the database and dumped data. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd90a497e4edc1750f1136954eda939cf0c4dae5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D155EC67-33EE-46B1-B3BA-9EC429D86A9B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"2478101b6331","org_name":"Nexon North America","org_type":"technology_saas","ransomware":null,"records_affected":24000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vancouver.24hrs.ca/Entertainment/2011/11/26/19023511.html"}],"summary":" South Koreas communications regulator said on Saturday that personal information of more than 13 million subscribers of a popular online game of Nexon Korea Corp, a leading game developer in the country, had been leaked in a hacking attack.  The Korea Communications Commission (","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a2fbd9263ecbb709e4f80856e403ecd3dd6af06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32BD7ABE-B704-4E51-B79C-BE5FE3E3F8F1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4c54e241cb3d","org_name":"Newcastle NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chroniclelive.co.uk/news/north-east-news/newcastle-nurse-sacked-after-snooping-8581684"}],"summary":"A nurse who was caught snooping on medical records before talking about it on social media has been sacked.  Joyce Jennings worked as a registered nurse at the Newcastle NHS Foundation Trust, when she accessed records she wasnt privy to.  Jennings, who brought her 30 years experi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e319d9e9acb72a6dc75da227094495388af9707e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D84BBD3A-FCC6-4328-BDA2-3C91EAD57452"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fea8c508e940","org_name":"Newcastle Citizen's Advice Bureau","org_type":"nonprofit","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krollontrack.co.uk/company/press-room/legal-technologies-news/newcastle-citizen-advice-bureau-investigated-after-data-breach476.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-tyne-24152040"}],"summary":"Roughly 1,300 files, including names, addresses, debt history and criminal records were inadvertently made available online and the ICO is examining the issue as a potential breach of the Data Protection Act.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a7ce65103516ae64fade85b6a081f5436d5604e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E80C538-83F1-4E0E-891E-0E3929C6D275"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"9623a54cecc9","org_name":"New Zealand Ministry of Justice","org_type":"government","ransomware":null,"records_affected":60000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.radionz.co.nz/news/political/132378/%27significant-holes%27-in-justice-ministry-website"},{"fetched_at":null,"title":null,"type":"press","url":"http://techday.com/it-brief/news/security-flaw-left-63000-govt-documents-vulnerable/161280/"}],"summary":"The Labour Party says a second person has come forward alerting it to what it calls significant holes in the Ministry of Justice's website. The ministry shut down parts of the website on Tuesday after Labour MP Clare Curran said she was approached by a whistleblower who had acces","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee82b5cab7731f37e0b9540040d3b13b22c2f535","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C439CD1D-C3A0-49CA-97D3-5305C01B71F0"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"c571e1c68b65","org_name":"New Zealand Ministry of Health","org_type":"government","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tvnz.co.nz/national-news/yet-another-privacy-breach-govt-department-5391914"}],"summary":"A mechanical error with a printer meant two letters, with two identification cards, had been placed in one envelope. 19 people affected","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a097edef287fb91f4ad34a185c42dceab9bf5c26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05BF1789-4192-42A8-9BF7-108F2C791DFC"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5677c9e26ab","org_name":"New York University - Dental School","org_type":"education","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nypost.com/2014/05/11/nyu-dental-school-workers-busted-in-identity-theft-operation/"}],"summary":"Dental School employees used hand held skimmers, got over 350 cards and racked up over $100,000.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3abb08f1d005cfddc118b1620f9a7c4bf570ef8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0199FEF0-3636-4F0F-8A7B-6082E2774DB5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee3f21c5ee4c","org_name":"New York Times","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cnn.com/2013/01/31/tech/china-nyt-hacking/index.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?partner=rss&emc=rss&_r=0,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/cn/new-york-times-breached-by-chinese-hackers-over-four-months-7000010604/,http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?hp&_r=1&"}],"summary":"The New York Times' computer system was hacked after Chinese government officials warned the Times about consequences for investigating the wealth of government family members.  The Times began monitoring its system closely on October 24 and noticed unusual activity on October 25","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RO","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d6cee784f1fda9137aefca611de847974ea5434","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C2BEB71-FC08-46B7-813D-C34250B1D84F"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"831aa50d98c3","org_name":"New York Metropolitan Transportation Authority","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://online.wsj.com/article/AP80bc8267bc4040d892de523a79f9f9f5.html?dsk=y"}],"summary":"Authorities say 4 charged in MTA skim scam","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ead325bd10f2c17ac6f40319a8a886597312f684","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09C5D3D1-EBDC-4B78-A8D8-168A80FB4BE6"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abb31b794adf","org_name":"New York City Police Department","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.yahoo.com/nyc-cases-show-crooked-cops-abuse-fbi-database-162152158.html"}],"summary":"Authorities say Edwin Vargas logged onto a federal criminal and terrorist database and ran names for reasons that had nothing to do with his duties as a New York Police Department detective. Instead, he was accused in May of looking up personal information on two fellow officers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RS","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e9b71154bbb426fff0ba4b2c06df05d1ddb3dab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7017B4D-5DBE-4763-AD4D-293737EB6BAE"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b86db27599d0","org_name":"NBC Universal, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/e-online-website-hacked-by-tesla-team.html"}],"summary":"TeslaTeam, one of the infamous hacker group from Serbia, claimed to have hacked into one of the most famous celebrity fashion sites E!NEWS. - See more at: http://www.ehackingnews.com/2013/11/e-online-website-hacked-by-tesla-team.html#sthash.EMPrxxpr.dpuf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eddb2d6960cb9d833957b68ef28f957c0c724a51","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB0C42CB-3080-4E10-9169-DDDB3CC7E977"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abbf7e2dc7b0","org_name":"NBC.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cyberenvoy.com/content/nbccom"}],"summary":"NBC's website was attacked by malware in the form of a Citadel Trojan.  The purpose of the attack was most likely to steal usernames, passwords, and other personal information.  NBC is unclear on how the malware entered their system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84946927823d151b201682ac081e85daec249b38","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A77FDCCF-E6CB-4D64-A2E6-F191C938DB4D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecb33193c832","org_name":"Navy Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cutimes.com/2013/08/15/feds-charge-five-in-navy-federal-fraud-id-theft-ri"}],"summary":"From January to March, 2013, the ring of five conspirators allegedly obtained the personal information – Social Security numbers, date of birth and credit union account information – from lease applications filled out by NFCU members at the North Shore Garden Apartments in Norfol","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"KR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b37bf90885ff39098b86b6fa831794f2a4d06223","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D119E1A4-0872-4A32-A6A5-1F32E5F5DE4A"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"b7f1da8b9494","org_name":"Naver","org_type":"technology_saas","ransomware":null,"records_affected":25000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/naver-south-korea-hacked-breached/"}],"summary":"Hacker breaks into 25 million accounts at a South Korean web portal. Once in, the hacker sent spam messages.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a94cdf7ee59b046643ce099a48491f8a6da81f2f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1738847-66E8-4A29-AFB8-E19D0B445B30"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0c537a1bd68c","org_name":"NatWest","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northdevonjournal.co.uk/8203-Jail-bank-employee-targeted-pensioner-steal/story-28636661-detail/story.html"}],"summary":"court has heard that the cash was taken in 250 withdrawals made by NatWest  Read more at http://www.northdevonjournal.co.uk/8203-jail-bank-employee-targeted-pensioner-steal/story-28636661-detail/story.html#J6D1xTmfCelHGDFO.99","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22cf4f8e0ef1604dff09f1b1191eb3024034a05b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FFBCE24-5DEF-4D93-A37F-43C7757113E8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecbe9a44f413","org_name":"Natural Provisions, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mondaq.com/unitedstates/x/267184/Consumer+Law/Vermont+Grocery+Store+Agrees+To+Settlement+With+Attorney+General+For+Alleged+Violation+Of+State+Data+Breach+Response+Laws"}],"summary":"Natural Provisions, Inc., a Vermont health foods grocery chain, agreed to pay $30,000 to settle claims brought by the Vermont attorney general that it failed to notify consumers and the attorney general within the statutory period required by Vermont's Security Breach Notice Act ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f2bff98abddb6f20622f089714b24c5175f249c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FDD9070-B156-4411-A85B-EC03C1700CB1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"70ed64e1e009","org_name":"National Institute of Aerospace","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nvonews.com/2013/03/21/nasa-security-breach-suggests-us-vs-china-space-war-involves-espionage/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spacenews.com/wolf-warns-of-security-breach-at-second-nasa-center,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.federalnewsradio.com/490/3255952/FBI-arrests-NASA-contractor-about-to-leave-US-for-China,"},{"fetched_at":null,"title":null,"type":"press","url":"http://articles.washingtonpost.com/2013-03-21/local/37889335_1_nasa-facilities-nasa-administrator-charles-bolden-work-visa"}],"summary":"A Chinese national who worked as a contractor for the National Institute of Aerospace had access to NASA's Langley Research Center.  He was caught boarding a plane with two external hard drives, two laptops, a memory stick, and an SIM card on March 16.  He originally did not reve","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c39d29db51e4b7f1daf3aebcc1802d14faef35fe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5AEAF0CE-7E92-4019-B7EF-AE1FB97B0028"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d030016de1f","org_name":"National Highway Traffic Safety Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wheels.blogs.nytimes.com/2013/08/06/someone-hacked-n-h-t-s-a-s-servers/?_r=3"}],"summary":"As it turns out, even highway safety regulators are vulnerable to the ravaging hand of cybercriminals. The National Highway Traffic Safety Administration had some of its servers hacked last week, the agency confirmed on Tuesday.  The 10 servers involved are used for reports from ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebd00b06df8fd8133edc57e27dc8dac167d75d15","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8D5A222-6138-4997-A50D-127DC7A4963D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"2019ab539056","org_name":"National Armed Forces of the Bolivarian Republic of Venezuela","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Venezuelan-Military-and-Government-Websites-Hacked-by-Anonymous-391564.shtml"}],"summary":"Anonymous Venezuela defaces multiple sites. This is modeling Venezuelan government sites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IT","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e23d7a236502e44488cdd09859a57af59c4a4703","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDEE5CAA-7420-4AA1-9983-C3C45543D294"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a3b0f491f9a","org_name":"National Aeronautics and Space Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/italian-hackers-team-hacks-8-nasa-domains/"}],"summary":"A newly emerging hacking group going with the handle of M4STR 1T4L!4N H@CKRS T4M (Master Italian Hackers Team) has hacked and defaced 8 official National Aeronautics and Space Administration (NASA) domains.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"790e8c7b969290c886f880ceb186fc89eab8e62b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D4D9E3C-FF07-481B-ADBC-53168E29FEAE"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NA","org_id":"8ad1858e5857","org_name":"Namibia Wildlife and Resorts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.namibian.com.na/indexx.php?archive_id=107248&page_type=archive_story_detail&page=944"}],"summary":"THE Namibia Wildlife and Resorts has been plagued by fraud and maladministration, costing the company millions of dollars. Sources within the company told The Namibian that the NWR board of directors and the audit and finance committee, ignored complaints and reports of the wides","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91c3e31eed93afae7be1e100e12b88caf8189bff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC6B711E-C74C-4808-A1D9-6026901B5B66"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b4a7a19cd483","org_name":"Muscogee County Sheriff Office","org_type":"government","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ledger-enquirer.com/2013/10/25/2762763/sheriffs-deputy-who-email-co-workers.html"}],"summary":"Deputy erroneously e-mailed PII regarding a group of female officers to all of them.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eca346a5b6f900e02d07e0763c0715c01fcce21","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B6DB9DA9-BDF5-4490-9FA0-ABC0C1D9D4A2"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6607cdfc681f","org_name":"Mt. Sinai Medical Center of Florida, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/former-mount-sinai-medical-center-employee-convicted-in-patient-id-theft-for-tax-refund-fraud-scheme/"}],"summary":"Hospital employee stole patient information for purposes of ID fraud. Arrested after attempting to pass a fraudulent check with over 100 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3f5a56800aef6cedd3250b353816f03cedcd367","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BABAA95E-B2F1-46B0-B392-DC2D2AE84E9A"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d957cd113e2e","org_name":"Mounted Police Professional Association of Canada","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theprovince.com/health/Mounties+accused+privacy+breach+handing+over+medical/8728035/story.html"}],"summary":"The RCMP is accused of violating the privacy of several of its members by handing over their personal medical records in a dispute with a B.C. psychologist.  The Mounted Police Professional Association of Canada filed a complaint today asking the federal privacy commissioner to i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d364b8449be9d8837a5d4a70e29e108bffd3bb5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C6B4CD2-0072-40B8-9BAF-DCE6F6D5E4CF"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"071335f6d375","org_name":"Morgan Road Middle School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/no-ones-to-blame-i-beg-to-disagree/"}],"summary":"An unencrypted flash drive was stolen from a teacher's car.  It contained student Social Security numbers and other information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"056a6973eb9ddfa1e50f58c7463fad6d1e2d61da","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C5C2C0E-B4D9-4828-85F6-497ADBD9476E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"461ec0112ed7","org_name":"Morgan County Health Center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lakenewsonline.com/article/20150706/NEWS/150709405"}],"summary":"mutli-year embezzlement ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9603069b6e49f77b60cf9a19ebb3afe456bbe0f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCC742FB-A2A4-4E18-8A1F-3591D7CDC048"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d620922ba5d9","org_name":"Montfort Hospital","org_type":"healthcare","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/montfort-hospital-suffers-security-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ottawacitizen.com/technology/Patient+information+compromised+Montfort/8420487/story.html"}],"summary":"Canada's Montfort Hospital recently announced that that an unencrypted USB drive containing more than 25,000 patients' health information was recently lost. The drive contained patients' names, summary data on the type of service provided, the date of service, and the health serv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5e05fae3dc1abb80e4e923991ea995eb5ada679","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AC69917-4A01-4165-8034-07915326562F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"daf7cfa6a0cd","org_name":"Montclaire Board of Education","org_type":"education","ransomware":null,"records_affected":14,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://montclair.patch.com/groups/schools/p/montclair-mayor-calls-possible-motivation-to-leak-tests-abhorrenthttp://montclair.patch.com/groups/schools/p/security-breach-compromises-common-core-assessments"}],"summary":"14 student assessments were posted to public website (www.gobookee.com). News reports indicate that the threat actor is external.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"584a3efb3929df526e8f79436de3c399df015aed","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D3FE3C1-F2B8-4E3C-B90B-623333B4432F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42a5e360bca7","org_name":"Montana State University","org_type":"education","ransomware":null,"records_affected":4585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bozemandailychronicle.com/news/montana_state_university/article_72cd3c0c-e107-11e2-871d-001a4bcf887a.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://missoulian.com/news/state-and-regional/msu-employee-social-security-numbers-at-risk/article_c562f154-e1b7-11e2-96dc-001a4bcf887a.html?comment_form=true"}],"summary":"Human Resources desktop was compromised via malware. Desktop contained PII on more than 4500 current and former employees; the presence of PII was against policy. There is no evidence that the malware or other actions exfiltrated the information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddd26629459aca76b387cd5ca8ca684797993a09","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95A64A23-11CC-4D68-A504-6DCAC9E284E4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"f95ca0ac007a","org_name":"MO HealthNet","org_type":"other","ransomware":null,"records_affected":1357,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.riverfronttimes.com/dailyrft/2013/08/mo_healthnet_social_security_privacy.php"}],"summary":"mismailing of citizen information, 1,357 people affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"771d6c1f4c831d203c98b9421c9a65fec42819d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B20EFBC7-4930-4C33-88E4-9CC820699D5F"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d6cc508cee7","org_name":"MNsure","org_type":"government","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/business/223564521.html"}],"summary":"a MNsure (Minnesota health exchange) employee accidentally sent an email to an insurance broker which contained PII on 2,400 customers via an excel spreadsheet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aeb17c2b5d716bab17c4a7c5440737fcf275acb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36DE5823-44C3-40D0-90ED-A397E7137A4D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b51b8851507","org_name":"MN Department of Public Safety","org_type":"government","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/local/224004771.html"}],"summary":"insiders at dept of public safety misused privileges to view local TV personalities information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a571f8d29a0b5f6bd584f6fd3366ccf9c461a97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C35BCE7-23C7-464B-B6A9-995EE9964F8C"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8783972a9949","org_name":"Missouri Credit Union","org_type":"financial","ransomware":null,"records_affected":39000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://legalnewsline.com/news/243829-missouri-ag-warns-consumers-after-information-release-at-credit-union;"},{"fetched_at":null,"title":null,"type":"press","url":"http://ago.mo.gov/newsreleases/2013/AG_Koster_advises_consumers_accidental_release_customer_information_MO_Credit_Union/"}],"summary":"Erroneous publication of PII on public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d8ef081415a36fc7cbdfa77e0484da2221f015c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97912E73-E5EB-4E3A-A100-4B732402843E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ee5aee5dee0","org_name":"Minnesota Department of Natural Resources","org_type":"government","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://minnesota.cbslocal.com/2013/01/18/minn-lawmaker-seeks-probe-of-data-breach-at-dnr/"}],"summary":"A state representative has asked Minnesotas legislative auditor to investigate a data privacy breach at the Department of Natural Resources. The DNR announced earlier this week that an employee accessed the drivers or motor vehicle records of about 5,000 Minnesotans without autho","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d63d6d89003d3565078d42741c6e1257f89cb896","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC7BC5D2-90D2-4328-8B27-CA04625EEF7F"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"77b95ed614b3","org_name":"Ministry of Justice","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/technology-28936396;http://news.sky.com/story/1324935/govt-fined-over-lost-prisoner-data-hard-drive"}],"summary":"Hard disk containing records of prisoners as well as victims stored in unencrypted format was lost.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2da3d904d8df55be30080ced26440001124b5b5d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FA4790C-ECA8-497C-AFE3-4E01EDCE0E14"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"937d9fbf7f0d","org_name":"Ministry for the Environment","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10874338"}],"summary":".gov sent an email to 150 people and didn't bcc them exposing email addresses to others.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e262387779eae7742f094a3f05251e8553f84aca","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9740B0EF-4711-4383-9D02-5EE7E01C5931"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3bafbdc955f","org_name":"Midwest Supplies, LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notice_0.pdf?"}],"summary":"Despite our best efforts, the security of our website was breached by an outside party. Your credit card information might have been improperly viewed including your name, address, email address, telephone number, credit card number, expiration date and security code.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a070ed8845f0a4b13963dd40772710407c9ebe1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF95E9A6-203E-4A52-A19A-BF442E208C08"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/02/23/microsoft-malware-attack/?goback=%252Egde_4636751_member_217297567"}],"summary":"Microsoft security discovered that a number of employee devices were affected by malware.  The employees had visited unsafe websites and downloaded material. It is unclear if the employee devices spread the infection to other areas of Microsoft's network, but Microsoft found no e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"TR","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c4494687071746538803daa4e8bd0b1a5281cb5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFE5146C-DC6C-4FA7-B1FE-01070807677F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"c14f1cd32740","org_name":"Micro-Star International Co.","org_type":"manufacturing","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/05/04/official-msi-taiwan-hacked-50000-accounts-other-data-leaked-sites-defaced/"}],"summary":"External activist steals data and defaces website for MSI","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62ad73ac2c2b00b3654842da970f63f67e6436a3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4009C5CD-AF9B-4B57-9CEA-DE4CBE0D6961"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd6396caf50d","org_name":"Michigan Department of Community Health","org_type":"government","ransomware":null,"records_affected":49000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/breach-notification-hipaa-privacy-security-46359-1.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Michigan-Department-of-Community-Health-Hacked-50-000-People-Notified-366196.shtml"}],"summary":"The Michigan Department of Community Health has notified more than 49,000 individuals that a server of the Michigan Cancer Consortium holding their names, birth dates, Social Security numbers, cancer screening test results and testing dates was hacked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b14fc418246c730015407faf9e47e05ba589e0f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F54132F-054E-426B-9273-55CAA5DBF1F8"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"44a6e7158e16","org_name":"MIC Electronics Ltd","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/in/india-engineers-arrested-for-selling-source-codes-7000020695/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://newindianexpress.com/cities/hyderabad/Two-techies-held-for-stealing-patented-code-vital-information/2013/09/13/article1782240.ece"}],"summary":"Competitor conspires with internal employee to steal source code for purposes of competitive advantage.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38173634d8a4b3f55e11c7e2efc586b4cd41d879","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DFFFAB9-6D1B-4FD4-BA5B-4D24FBBDA780"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d142b98c766","org_name":"Miami Dolphins Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Miami-Dolphins-Cheerleaders-Hacked-Visitors-Led-to-Adult-Site-395437.shtml"}],"summary":"The official website of the Miami Dolphin cheerleaders (Dolphinscheerleaders.com) was hacked on Monday. Users who visited the site from their mobile devices were redirected to an adult website. It took the websites administrators until early Tuesday to address the issue. At the t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afbfccaf1802f6a9ccc424af010fb268ddd99b6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09F58977-1E6A-495B-B602-DE780BB234E6"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c17fb2941504","org_name":"Metro East health care","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox2now.com/2013/11/22/list-of-social-security-numbers-mistakenly-mailed-to-workers/"}],"summary":"Hundreds of Metro East health care workers recently learned they may be at greater risk for identity theft.  A nurse says a long list of social security numbers were mistakenly mailed to workers.  Current and former workers received the mailing last week.  What people assumed was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c55dee89ce85d4f24341b9a4aadeebb818c43e97","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E55C0548-0B37-4F45-AA6B-825F6DDD8775"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00eaf5a2cc1b","org_name":"Members 1st Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc27.com/story/24073581/ex-bank-employee-charged-with-id-theft-forgery"}],"summary":"Ex-bank employee charged with ID theft, forgery Posted: Nov 26, 2013 10:25 AM CST Updated: Nov 26, 2013 10:25 AM CST By Myles SnyderCONNECT    HARRISBURG, Pa. (WHTM) - A former bank employee is facing felony charges after she used a client's information to secure fraudulent loans","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1cdac739db473f1ba590452182ff58738d1c72b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AED3A509-72E7-47BC-8082-8C030EC3D2F9"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fabc5edce44d","org_name":"Medtronic, Inc","org_type":"manufacturing","ransomware":null,"records_affected":2764,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/05/medtronic-loses-training-records-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.twincities.com/business/ci_23776734/medtronic-says-box-containing-patient-records-has-gone"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/business/263994741.html#1vBG5MhqwcRm89uI.97"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/article/Hackers-break-into-networks-of-3-big-medical-5217780.php"}],"summary":"Medtronic misplaces a box of paper records containing patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e1a8ff7ca19f0e47d5dcd940d2d36fb6ee701e6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4420BB21-8ACD-4BC4-9FAD-BF124B5F6409"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3117c4b39bd","org_name":"MedStar Good Samaritan Nursing Center","org_type":"healthcare","ransomware":null,"records_affected":318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/node/55616"}],"summary":"A paper file was stolen from the car of a dental assistant who was treating residents at the MedStar Good Samaritan Nursing Center.  The file contained names, dates of birth, medical and dental evaluation information, medical and dental providers' names and license numbers, and t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11a3ce81fc04875843b401ea2104eb26ea3f437f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DE89A34-9D37-494F-9F72-AD2C48A044E4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"887bb25bcfc2","org_name":"Medical Management Health and Rehab LLC","org_type":"healthcare","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.macon.com/2015/01/22/3544774_former-macon-nursing-home-worker.html?rh=1"}],"summary":"A former nursing home worker was sentenced to five years on probation Thursday after she pleaded guilty in an identity fraud scheme involving stolen patient information.  Raquel Hogan, who formerly worked as a certified nursing assistant at Medical Management Health and Rehab LLC","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a4aee843c5289bcef29e433d62de91288d57a57","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4370E75-52D7-4F24-89FD-F7ADB6A86882"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf84c9989cad","org_name":"Medical College of Wisconsin","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.denverpost.com/nationworld/ci_22930310/man-accused-stealing-cancer-data-pass-off-his"}],"summary":"When three vials of a possible cancer-fighting compound disappeared recently from a professor's desk at the Medical College of Wisconsin, suspicion quickly fell on a research assistant who had been working in the scientist's lab.  Security video showed Hua Jun Zhao, who studied i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c9e82d7610f6ab9be6d16b08e7dcaf231c62476","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9640202-1386-4706-B8DA-CA5323283B4C"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"354cd8826f5b","org_name":"MED-EL Corporation","org_type":"other","ransomware":null,"records_affected":609,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;jsessionid=A05B99CFA51B9087CB3489A683C74110.ajp13w"}],"summary":"Email error exposes 609 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f651e6d7acdd6b04bafee414365015b368167f48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"146EA182-27DF-4B4D-8F06-9F1EB3B94B2B"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30af204093c6","org_name":"McHenry County College","org_type":"education","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mchenrycountyblog.com/2013/09/11/closing-in-on-the-number-involved-in-mchenry-county-college-security-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://mchenrycountyblog.com/2013/09/05/triton-morton-and-prairie-state-community-colleges-got-mcc-student-employee-personal-infor/"}],"summary":"the data is vague but it appears that a software vendor called Ellucian who does work for McHenry County Community College sent an undisclosed number of student social security numbers and other PII to three other community colleges.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"SA","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fbf259a111998658850f2c5dd1c04af4c3e8f52","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E1ABF53-342F-435D-AFCF-0B1AC625A1D6"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e2c67f1d269","org_name":"McGowan Institute for Regenerative Medicine","org_type":"healthcare","ransomware":null,"records_affected":847,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/06/02/mcgowan-institute-for-regenerative-medicine-hacked-accounts-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebay.net/1236745"}],"summary":"McGowan Institute for Regenerative Medicine hacked and authentication data posted publicly.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c72f4daf4e39cc03ba18745b611228721ad47a78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E410F7DE-BDDC-48F0-8205-4BE2B077ED04"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee4898e993f9","org_name":"Marion County Sheriff's Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocala.com/article/20151105/ARTICLES/151109864?tc=ar"}],"summary":"Misuse of access by police deputy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9cd0267d049c73f73fd7a5254de65183c07d23c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1FCFB45-4675-4A34-9769-791F411C86D8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ce148ee098e","org_name":"Mapco","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csdecisions.com/2013/05/06/mapco-suffers-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxal.com/story/22264224/mapco-hacking-may-be-linked-to-calhoun-co-identity-thefts"}],"summary":"Customers who made purchases between March 19-25, April 14-15, or April 20-21 may have had their credit or debit card information compromised.  Tennessee and six other Southern states may have been affected by the breach. It is not clear if the payment card information was taken ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7366a5b3ce34ba9d09167f4a91c222b5f9363cf0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D0B6C62-0C39-4A24-AD3C-E15A73DAA126"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f325ce03eebb","org_name":"Maine Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1920,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"email misdelivery","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"328676b1dbceb9f4c0157d7682baa798ac4bb3b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E90A577-C799-416F-AE62-EED86C77F9E2"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"242ca57a1576","org_name":"Made in Oregon Shops","org_type":"retail_ecommerce","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koin.com/news/oregon/security-breach-at-madeinoregon"}],"summary":"Online retailer website compromised via undisclosed method. Payment card information is at-risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9a63943d09fcd540c2db25561e301634e7d06c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C10BBB7-8D71-4CA9-BCF2-64EAA4F6E035"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"053330a31248","org_name":"Macy's","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56546"}],"summary":"A man guessed or accessed the Social Security numbers of Macy's customers in order to exploit a Macy's policy for the purpose of making fraudulent purchases.  He then created ID cards that paired his picture with the customer information.  A Macy's policy allowed him to charge pu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18da9528d27ebd01f295bddc27e0b84bee8b6189","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E8FAF73-96B6-41AB-AA5D-2B631004CD06"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"824077714e87","org_name":"Lyons & Lyons","org_type":"professional_services","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theridgefieldpress.com/17841/hacker-breaks-into-local-accounting-firm/"}],"summary":"Hacker breaks into local accounting firm  A hacker stole data from a Fairfield County accounting firm in a breach that may have impacted as many as 900 customers, authorities say.  Lyons & Lyons, a certified public accountant firm in Ridgefield and Fairfield, is currently working","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc450c0d3b12227377fb568ef00d5126b9e057ca","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8CAC014-7426-4C8D-BCC1-A1C7650DB25D"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d4264b75b12","org_name":"Lutheran Social Services of South Central Pennsylvania","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wgal.com/news/susquehanna-valley/york-adams/malware-program-found-in-seniorliving-centers-computer/-/9704248/20055360/-/iv5rf0z/-/index.html"}],"summary":"Thousands of current and former senior-living residents' personal information could be in jeopardy after a hacker's malware program was found on a computer. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c0fbffd94205fd8bd8a56e42b1e54a1af7950c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3507BCE-CF57-47D8-BD36-C6BC9E2841A8"},"incident_date":"2013-01-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"266f90ea7aea","org_name":"Lucile Packard Children's Hospital at Stanford","org_type":"healthcare","ransomware":null,"records_affected":57000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://med.stanford.edu/ism/2013/january/lpch.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11468,"},{"fetched_at":null,"title":null,"type":"press","url":"http://ht.ly/h6Glb"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/breach-at-lucile-packard-childrens-hospital-potentially-affects-12900-patients.html"}],"summary":"Lucile Packard Children's Hospital at Stanford and the Stanford University School of Medicine are notifying patients by mail that a password-protected laptop computer containing limited medical information on pediatric patients was stolen from a physician's car away from campus o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8cdf646dcef0f7d2fc0947feac27e588981ba2f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17B58717-3C26-45DC-989D-2AD077D252DF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8e81bde529e","org_name":"Lubbock Cardiology Clinic","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/lubbock-cardiology-clinic-security-breach-in-electronic-health-records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://lubbockonline.com/filed-online/2014-04-10/lubbock-cardiology-clinic-advertises-security-breach-electronic-health"}],"summary":"The Lubbock Cardiology Clinic bought an advertisement on the A-J Media website to announce a security breach in its Electronic Health Record system.  The advertisement reads, To the patients of Lubbock Cardiology Clinic, it is with regret that I must inform you of an unauthorized","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d008ef68b57842afc31e35ad924bf8517e5b3ae","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5E6353D-D953-425E-B7A4-8905758F8592"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42aff6237c6f","org_name":"Los Angeles Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/local/la-me-lausd-ipads-20130925,0,906924.story"}],"summary":"Students in high school district discover workaround for circumventing security controls on issued iPads.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2413122a2567c954c26194ae912763c91ccb518b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE7169DB-4BB5-43F3-86B6-8211F4E6D74E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d69287de1f06","org_name":"Long Beach Memorial Medical Center","org_type":"other","ransomware":null,"records_affected":2864,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.presstelegram.com/general-news/20130711/patient-data-may-have-been-breached-at-long-beach-hospital"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/12/long-beach-memorial-medical-center-announces-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/breach-notification-hipaa-privacy-security-46399-1.html"}],"summary":"Employee misuse led to disclosure of 2864 medical records ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72c1ee57d4e76263b71b3c11dd200aae47d2fe3d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A0AFF85-7326-46F2-8F08-D241748C0874"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0151ed9666c6","org_name":"London Underground","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.islingtongazette.co.uk/news/health_2_4371/man_who_stole_islington_tube_passengers_credit_card_details_is_jailed_1_2345916"}],"summary":"On April 10 a plain clothes British Transport Police (BTP) officer found a skimming device – used to read bank card details – on a ticket machine at the station on Highbury Corner. In this case, a green card reader was placed over the original reader to record passengers’ card de","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8dd3f4ad9db83d0e720c35a917a68c69a9724e6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CF2D256-81C0-4C26-AFDA-1D9550797E4C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"89d3f0b88397","org_name":"London Probation Trust","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/news/uk/crime/privacy-breach-officer-let-off-with-150-fine-8764423.html"}],"summary":"  A former probation officer who handed details of a domestic abuse victim to her alleged abuser has been fined just £150.  Victoria Idowu, who has since lost her job, was handed the fine after pleading guilty to breaching the Data Protection Act by handing over the confidential ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6af7e594cfedd5c8830c822c1057ff776c7bc6e1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0D77692-A647-4577-B2A8-45E4763F7897"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"21bf941f1fa5","org_name":"Lloyd's Register","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gcaptain.com/canadian-police-charge-man-with-attempting-to-leak-classified-shipbuilding-data-to-china/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thespec.com/news-story/4251254-hamilton-engineer-charged-with-leaking-secrets-moonlighted-as-toronto-landlord/"}],"summary":"Canadian police have arrested a man and charged him with trying to leak classified information related to the countrys national shipbuilding strategy to the Chinese government. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9b0d38db01c220b86a84dcfbc52b1daebc5d687","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE05981F-8374-4A4A-87E6-D72B179FD4E9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10f9d3e30809","org_name":"Lincolnshire","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newssun.suntimes.com/news/21767281-418/restaurant-manager-pleads-not-guilty-to-stealing-customers-ids.html"}],"summary":"Insider stealing identity and credit information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f857293d09ce366fc9b0bb07b346faa60b143210","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"468207DE-22E6-4343-80D1-BCC45A243130"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61a908539869","org_name":"Lincoln Credit Center","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/LCC%20-%20Client%20Notification%20Letter_0.pdf"}],"summary":"At Lincoln Credit Center we take your account security very seriously. We have learned that some personal information related to your account may have been compromised at a physical location.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cde7ee85d3b104c112567c2ac2a1850f043b7b8d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51A44E29-75F4-4779-B2D3-DB5C7A336A42"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"5b1d5a17c72f","org_name":"LifeLabs","org_type":"healthcare","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.ca/2013/06/24/kamloops-lifelabs-patient-information-breach_n_3493162.html"}],"summary":"The personal information of about 16,000 patients of a medical-lab service in Kamloops, B.C., has gone missing, says the company's president.  LifeLabs president Sue Paish said Monday a computer was sent to their main office in Burnaby for servicing in January, but when it was re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad834ffadc23570b086de6ee67c7419e9f545428","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30A3B892-01E7-480E-ABA5-3DCA29D89D7F"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c577f5937cd7","org_name":"Life Flight","org_type":"transportation_logistics","ransomware":null,"records_affected":842,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.deseretnews.com/article/865579041/Life-Flight-informs-patients-of-possible-confidential-information-breach.html"}],"summary":"Patients flown by Life Flight helicopters during at least three months of 2004 were advised Friday that their personal information may have been compromised.  The information, collected from patients in April, May and June of that year, was inadvertently put on an employee websit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ef59da46a9c2bb3dd4d9cde81c05933c077ae53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46817CA2-963D-435E-9AFC-17AC7031F796"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15d8d577fc69","org_name":"LewisGale Regional Health System","org_type":"healthcare","ransomware":null,"records_affected":440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdbj7.com/news/local/lewisgale-regional-health-system-dealing-with-data-breach/25289888;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wdbj7.com/blob/view/-/25290570/data/1/-/2ugmwlz/-/Letter-informing-LewisGale-patient-about-data-breach.pdf"}],"summary":"WDBJ7 learned Wednesday that patient information from the hospital's billing department may have been compromised. The Secret Service tells WDBJ7 this is a multi-state investigation.  A LewisGale spokesperson says approximately 40 local patients are affected. The billing company ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"072cd514be02b4023d5da0499c125ccfb09835f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2BECA049-709F-4D3E-A674-2081859DD3CD"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f85e082e8e99","org_name":"Leicestershire Partnership NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisisleicestershire.co.uk/Children-s-health-details-sent-wrong-parents/story-19144883-detail/story.html#axzz2UryGFoOQ"}],"summary":"More than 150 letters containing results from a school programme measuring children's heights and weights were sent to the wrong addresses a fortnight ago. The issue came to light when a head teacher contacted Leicestershire County Council and a parent Leicestershire Partnership ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da8bbc2cdcf840db74449f73dfe044e3ace38d86","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"45B6F726-179D-4DBE-BF03-95FFB16FC7FB"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10d3e1779ab7","org_name":"Lee D. Pollan, DMD, PC","org_type":"healthcare","ransomware":null,"records_affected":19178,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"In January 2013, Lee D. Pollan, DMD, PC notified NYS that a missing, and probably stolen, laptop contained unencrypted PHI on 13,806  former patients. That incident was reported to HHS as affecting 19,178 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf33c97cc8762478382fdc1a425f13e12c0b7393","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32CCFDB6-070E-4D94-BFBA-530A9C92ED2D"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"870a6974863a","org_name":"LEAM DRILLING SYSTEMS","org_type":"other","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.baselinemag.com/security/drilling-company-survives-a-cryptolocker-attack.html"}],"summary":"LEAM Drilling - cryptolocker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92eb7ef3c29ecedaa8c73ed92ec8db24093daded","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EB3D634-1853-4EFC-BC59-FFD8B8C2EA0A"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"55d83e1839dc","org_name":"Leading Edge Physiotherapy","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stalbertgazette.com/article/20130914/SAG0801/309149981/-1/sag0801/discharged-patient-records-stolen-from-physio-clinic"}],"summary":"Robbery at health clinic. In addition to cash and other items stolen, an unencrypted external hard drive containing scanned files of discharged patient records from 2003 and 2008 went missing from a locked safe. Registration information such as name, address, date of birth, as we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a01f43970e6c402759d6d8e16000f5f6177d13ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F84DB994-BC30-4495-A3F4-ED956AD2C4FB"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c969b8aab2e0","org_name":"Lawrence Melrose Medical Electronic Record Inc","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/hospitals-ehr-company-sees-hipaa-breach"}],"summary":"Lawrence Melrose Medical Electronic Record Inc., in Melrose, Mass. will notify the Office for Civil Rights of a data breach after an employee improperly accessed the electronic medical records of some 200 patients across six different medical practices.According to Rick Pozniak, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1486","T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27b1556f6a7186f381cdd2dae933c60c17b82271","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5AE7FC6-CA6F-42E0-A095-1B6A945FF2E5"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d9a4ca694648","org_name":"Law Firm in British Columbia","org_type":"professional_services","ransomware":true,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lawsociety.bc.ca/docs/practice/resources/Cryptolocker-ransomware.pdf"}],"summary":"Incident 2: Law firm in British Columbia hit by cryptolocker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c28663b3894f6d07032aca4f24f62419374c20de","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E2ABF42-0795-4592-908F-A496F31B6916"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56a3d0bc9df3","org_name":"Lakewood Church","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dallasnews.com/news/state/headlines/20140311-600000-stolen-from-safe-of-joel-osteen-s-houston-megachurch-police-say.ece;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2014/03/11/safe-broken-into-at-osteen-megachurch-in-houston-thieves-takes-cash-checks/"}],"summary":"Authorities are investigating after $600,000 in checks and cash was stolen from a safe at Pastor Joel Osteens Houston megachurch, which has one of the largest congregations in the country.   Police spokesman Kese Smith said Tuesday $200,000 in cash and $400,000 in checks were sto","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80b472e8057d6a5765e89f5b090245f37ebbc613","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27A3A8D1-1F83-4E46-9873-CAEBF67951EF"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8545f9ca4f6d","org_name":"Lakeshore Mental Health Institute","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/01/lakeshore-mental-health-institute-leaves-patient-data-exposed/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbir.com/news/article/272594/2/Lakeshore-discovery-reveals-potential-identity-theft-danger"}],"summary":"Patient records were found on the floor at an abandoned hospital building named Waterside.  The woman who discovered them was a former Lakeshore employee and she alerted a local news station.  Names, Social Security information, case numbers, dates of birth, and other patient inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b53dd49b014ad69d0b27d87c3cf8a87fd0a2f199","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D1C911C-798F-42F2-921C-56DABB7F31FE"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4e3f15e797f6","org_name":"Lakeland","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerweekly.com/news/2240201664/Lakeland-warns-customers-of-potential-data-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krollontrack.co.uk/company/press-room/data-recovery-news/lakeland-hit-by-data-breach705.aspx"}],"summary":"Retailer Lakeland is warning customers of a potential data breach after a “sophisticated and sustained attack” last weekend that exploited a recently-identified Java flaw.  The company has found that two encrypted databases were accessed, but so far it has been unable to find any","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d9f0d8e68e2ba8c30750015982d92ab3fd66af0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F7FBF08-8CE3-4C08-A274-E62C7A07ED80"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a3c631ee5f8","org_name":"LabMD, Inc.","org_type":"healthcare","ransomware":null,"records_affected":9300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dwt.com/FTC-Files-Complaint-Against-Lab-Over-Failed-Health-Information-Security-09-19-2013/"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/310"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktiv.com/story/23290647/ftc-medical-labs-lax-security-led-to-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/08/medical-lab-allegedly-exposed-customer-info-on-p2p-claims-it-was-the-victim/"}],"summary":"personal information of approximately 9,300 consumers made available to a peer-to-peer (P2P) file-sharing network after a billing department manager installed P2P software on a workstation for personal use.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5bb39849c3897ec742f5ab2fea5ecdbf4b03970","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A3651A5-BA02-48C3-8E5B-13CA97AC8C9E"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5bab9bf2f00d","org_name":"L-3 Communications Holdings, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.washingtonpost.com/2013-03-25/world/38006926_1_development-of-military-technologies-information-and-technologies-chinese-citizen"}],"summary":"Measured in millimeters, the tiny device was designed to allow drones, missiles and rockets to hit targets without satellite guidance. An advanced version was being developed secretly for the U.S. military by a small company and L-3 Communications, a major defense contractor.  On","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"KR","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd631b1469088818875ec61ecf24fd6c42187bef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBDAC09D-9A29-49CC-A114-44E6CF0723AA"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"c2633c1631f9","org_name":"KT Corp","org_type":"technology_saas","ransomware":null,"records_affected":12000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2014/03/07/kt_data_breach_12_million_customers/"}],"summary":"KT Corp hacked in some way and 12 million people affected","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"744b9f91c965fb4b72fd35d828a324ab4e9f6263","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A72029AC-45B6-4A41-9D90-CDCE18C118B5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e34740adcde5","org_name":"Kork and Keg","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedepauw.com/news/depauw-students-get-identities-stolen-1.2993689"}],"summary":"Fraudulent activity on the accounts of DePauw University students was linked to Kork and Keg.  It is not clear how the store's payment system was compromised; however it was a common link among those who had their accounts breached.  Kork and Keg did not make a statement.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"TR","motive":"ideology","name":"ReZk2LL team","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"77d431dd7a99f6b889c979ab3d4d46c46355ad2b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68BAA8CC-1A51-4047-B894-15738235F95B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"51ef3ea00a96","org_name":"Kochi Metro Rail Corporation","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://perry4law.org/cecsrdi/?p=726&goback=%2Egde_36573_member_232165139"}],"summary":"Kochi Metro Rail Corporations Website Cracked And Compromised  Of late, cracking and websites defacement has increased in India. Not very late the website of CBI was hacked and it took many months for the CBI to investigate the case. Surprisingly, it took more than 20 days for CB","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"rezk2llteam"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9fadfaee41fa106cfe72b6ada46d8e62b75bbb1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BEEB4E82-AD12-42A3-8FE6-A1F4EAF9D4B3"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f8fde366e0c","org_name":"Kinoptic","org_type":"technology_saas","ransomware":null,"records_affected":198000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/paging-kinoptic-developer-to-aisle-4-to-clean-up-your-mess/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://mackeeper.com/blog/post/197-the-danger-of-apps-that-die"}],"summary":"failed app has unsecure database with no one to contact","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e604ae1fd74812d127dd740f1991cf02f0659201","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82611633-5560-428B-80AB-7CB3AB98B52D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb342f50f330","org_name":"Kims Medical Supplies","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/July/13-crm-814.html"}],"summary":"The owner of a Los Angeles-area durable medical equipment (DME) supply company has pleaded guilty to conspiring to defraud Medicare and Medi-Cal of more than $650,000.  Acting Assistant Attorney General Mythili Raman of the Justice Departments Criminal Division; U.S. Attorney And","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34e6191109000d27c8969632b5dea45715d2970b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B399329C-3D5E-48B9-8FAF-D7E73F069C8B"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9df175a74f1b","org_name":"Kichlerlightinglights.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/03/the-long-tail-of-coldfusion-fail/"}],"summary":"Another victim of the cold fusion authentication bypass","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KH","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c8bf0e31f9fb913bcdeac6612f25527ce48d3cb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2C8E510-5FE4-4F1C-80E4-59021655E492"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KH","org_id":"0b2da9e2168d","org_name":"KH Cambodian Anti-Corruption Unit","org_type":"government","ransomware":null,"records_affected":146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Leak-Data-Stolen-from-Cambodia-s-Anti-Corruption-Unit-384631.shtml"}],"summary":"Anonymous Cambodia has claimed theyve breached the website of the countrys Anti-Corruption Unit (ACU.gov.kh). The hacktivists have leaked names, usernames and passwords (in clear text) of 146 administrators. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ecfae0340bf7e363703b4d74bc35f22506ec519","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1171F1CA-6752-4994-A444-EA09D05C8375"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fe8666ab591","org_name":"Kelly Plaza Dental Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickondetroit.com/news/Dental-patients-info-dumped-outside-building-on-Detroit-s-east-side/-/1719418/19486266/-/7xnf7tz/-/index.html"}],"summary":"Personal patient information from a dental office on Detroit's east side has been dumped out in the open. A tip call lead Local 4 to go find the pages of patient data that is sitting inside a dumpster outside the Kelly Plaza Dental Center, which is on Kelly Road near Whittier Str","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7670e36e3e80e8e08f5920ecb5f9704fe0e92406","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20E75B76-4BD2-4869-A754-A10325DABD06"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad3810a85872","org_name":"Kearny Mesa Infiniti","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Final%20Version%20of%20Notice%20Letter_0.pdf"}],"summary":"California's Kearny Mesa Infiniti recently began informing an undisclosed number of customers that their names, birthdates, addresses, phone numbers, Social Security numbers and driver's license information may have been improperly accessed by a former employee.  According to the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d69e973e88bb755c647b98f2ed6e4d816c6af21","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"302E60A7-6307-40A1-849E-C5FEA03B5C98"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e45fcc700512","org_name":"Kaye Edmonton Clinic","org_type":"education","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.edmontonjournal.com/Charge+laid+after+alleged+health+information+breach+Edmonton+Clinic/10998133/story.html#__federated=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/individual-convicted-of-an-offence-under-the-health-information-act/"}],"summary":"On Feb. 5, Denise Tourneur pleaded guilty to illegitimately accessing the health information of seven individuals on 44 separate occasions at the Kaye Edmonton Clinic where she worked.  The situation stemmed from a breach discovered by Alberta Health Services and reported to the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4dc0a8e01621948b975e4694a9792ab715e8da3","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FB12721-5D68-498E-A85B-06C521F337C2"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"4d65c1f8c5a2","org_name":"Karmei Hesed","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.israelnationalnews.com/News/Flash.aspx/281692#.UqKmDqU2lBU"}],"summary":"Muslim hackers attacked this morning (Sunday) the Israeli website \"Karmei Hesed:, a charity which obtains and distributes second-hand appliances and furniture to needy families. Speaking with Arutz Sheva, the charity's director, Leo Weingarten, stated that it was the first time t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"164512ee244ffeacfd31e1561bf6a827ef1f3d22","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A875C73C-566B-4D37-9616-7465710B64C9"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globalpost.com/dispatch/news/thomson-reuters/130920/lawsuit-accuses-jpmorgan-exposing-social-security-numbers"}],"summary":"JPMorgan twice sent mailing with customer PII visible on outside of letter.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01b5c10b22d9c6e3369c3a1b0fa19ee88c8abcc6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65CCDBC1-9715-4A08-B6FC-B28DEC1E332F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"fd86e17717b1","org_name":"Jos A Bank Clothiers Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stardem.com/news/crime/article_c3f5f831-6d9d-5ab3-a410-bd77474c1e9c.html"}],"summary":"Retail store employees misused corporate assets to complete fraudulent refunds to their bank cards using fictitious names. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9a4962f03dc67df71f27452226f0363c70f15f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B265D69-D744-4C2F-8F74-302B7F99FEC7"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a69fb5c7410","org_name":"Jonathan M. Wainwright Memorial VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1519,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailysunnews.com/news/2013/dec/17/walla-walla-va-issues-security-breach-alert/"}],"summary":"he Jonathan M. Wainwright Memorial VA Medical Center in Walla Walla is offering free credit monitoring for up to 1,519 veterans whose personal information, including social security numbers, was inadvertently emailed to an external education partner on Nov. 1.   #VA places the hi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a833e3a6e1b7a76d2da368d27d36ee7eb8acb5bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E8BF375-1468-4079-AF75-ED43DFEE63B4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5be5ac1b426","org_name":"Johns Hopkins Medical","org_type":"healthcare","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.baltimoresun.com/2013-03-25/news/bs-md-identity-theft-fraud-20130325_1_theft-scheme-baltimore-county-man-woodlawn-man"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/20/johns-hopkins-investigating-patient-privacy-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baltimoresun.com/news/maryland/crime/blog/bs-md-ci-hopkins-doctor-investigation-20130218,0,3650212.story"}],"summary":"A federal judge on Monday sentenced a Baltimore County man to 11 years in prison and ordered him to pay close to $200,000 in restitution to victims of a wire fraud and identity theft scheme that victimized Johns Hopkins doctors, among some 250 others, the U.S. Justice Department ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37ca151406fb5e6fbe3e06a0b375afbe9a83f454","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F76B3EDB-4602-4E86-801A-5506E6DF3FBC"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0a0152d1d3f","org_name":"JOHNS HOPKINS","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/johns-hopkins-doctor-found-dead-amid-claims-he-secretly-taped-patients/2013/02/19/10dd022a-7aa0-11e2-a044-676856536b40_story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/johns-hopkins-settles-privacy-breach-lawsuit-for-190m/"}],"summary":"Back in February 2013, we learned of a horrific privacy breach in which a gynecologist had been secretly recording his female patients.  His conduct had been reported to the hospital by a female co-worker and he was fired. The files were found in his home after he committed suici","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a5a370fe25a482cfc07acc6c4055ae10182fc3e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55156380-8A97-48B8-B9C7-FCE80CE7B9CA"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"d1251eed2c8b","org_name":"Jaya TV","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Pakistani-Hackers-Deface-Website-of-Indian-Television-Channel-Jaya-TV-396352.shtml"}],"summary":"Pakistani hackers of the Pakistani Haxors Crew (PHC) have breached and defaced a number of websites of Jaya TV, one of the largest Tamil language television channels based in Chennai, India. Islam Zindabad , Long Live Muslims , Pakistan Zindabad. We Are PHC ( PAKISTAN HAXORS CREW","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38cbae3c40da58cee9a5ba34988bcb50f2e0db92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDFFA132-EBE2-47C6-BC07-0FDC162AFE84"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8051eb38ac5","org_name":"Jawbone","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techhive.com/article/2027938/jawbone-says-hackers-stole-mytalk-user-information.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/technology/technolog/jawbone-customer-info-swiped-data-breach-1C8365571,"},{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/02/13/jawbone-hack/"}],"summary":"Hackers were able to access Jawbone's MyTALK customer accounts for several hours.  Names, email addresses, and encrypted passwords were exposed.  Any customers who were affected received an email warning them to reset their passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb70eb7be95b1f8df1270ac5b263f06ab1652af2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5B4F1AD-158C-4B81-9A3F-6D5D4D33EEE0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"237060dd8f84","org_name":"Japanese Ministry of Foreign Affairs","org_type":"government","ransomware":null,"records_affected":20,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csoonline.com/article/728343/japan-foreign-ministry-says-pc-leaked-docs-to-external-server"}],"summary":"Japan's foreign ministry said that a computer was compromised and documents were probably copied to an external server.  The Ministry of Foreign Affairs said that about 20 documents are feared to have been stolen, though none of them were confidential. The ministry said it was ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d389cd5c113385532b828ce84d486e27f121922","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84601628-7889-488B-BA30-6ED38CEC56DB"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"770a7702718e","org_name":"Janna Benkelman LPC, LLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedenverchannel.com/news/local-news/denver-counselors-laptop-reported-stolen-contains-protected-health-information"}],"summary":"Denver counselor's laptop reported stolen; contains protected health information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d5b74561fe1362027f655cc02c3513392972dda","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5FE37BAC-5036-416D-A448-778C5618333A"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c811336c51c0","org_name":"Jackson Health System","org_type":"healthcare","ransomware":null,"records_affected":1407,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/28/new-patient-data-breach-reported-at-jackson-health-system/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/2013/05/24/3415013/boxes-of-medical-records-missing.html"}],"summary":"Jackson lost more than 1,400 patients’ data in January 2013 and have sent those patients notification letters.  The Jackson Health Information Management department was in the middle of scanning paper health records into the EHR system when it inadvertently lost them. The organiz","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0742a1423798ff208b1bcf7cd61da76e45a201dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"539FBB94-9BEA-4D75-B97A-B3B06AD08F57"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"1333987933c5","org_name":"Irish Bank Resolution Corporation","org_type":"financial","ransomware":null,"records_affected":77,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://businessetc.thejournal.ie/ibrc-employees-data-breach-1051450-Aug2013/"}],"summary":"Firm handling bank resolution, sent out 77 mailings with checks and personal data to the wrong people (all former employees).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2af619d06d385334dfdadb43cddc6bc8edb4b6a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16402C78-C1B6-43C8-A871-42F199DEFE49"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"60bdc2c8780a","org_name":"Irish Amateur Boxing Association High Performance Team","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/laptop-with-olympics-plans-stolen-from-car-of-boxing-coach-28960094.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.herald.ie/entertainment/around-town/katies-plans-for-rio-glory-on-stolen-laptop-28964540.html"}],"summary":"BOXING coach Billy Walsh has spoken of losing a laptop containing details of Team Ireland's plans for the next Olympics in Brazil.The laptop had been on the back seat of Mr Walsh's car outside his home in Wexford town when opportunist thieves struck and swiped it.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce5d50fc722276f39e02606a2c578d58a36ad266","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"238E92FB-0C5F-4BA9-93E7-0A6BABEFBDD1"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"295e67665987","org_name":"Iowa Department of Human Services","org_type":"government","ransomware":null,"records_affected":7300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/27/iowa-dhs-informs-patients-of-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://qctimes.com/news/state-and-regional/iowa/confidential-records-missing-at-iowa-mental-health-facility/article_bef1296c-d3de-5d1e-857b-62e3d1a7e0ab.html"}],"summary":"Former patients of the Mental health Institute in Independence and state employees may have had their confidential information exposed.  A backup tape was found to have been missing as of April 30.  Officials of Iowa Department of Human Services believe the tape was accidentally ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"521e09d5a5a8c16a7f364726ce9bbb7dc77ce5af","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FF224CC-CD4A-46D0-83AD-CF423CF57950"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9f6ea2d1a003","org_name":"Investment Industry Regulatory Organization of Canada","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.iiroc.ca/Documents/2013/d8d465f9-0a37-4325-8732-1b12cbd2ddb8_en.pdf"}],"summary":"The Investment Industry Regulatory Organization of Canada (IIROC) deeply regrets the accidental loss of a portable device that contained personal information relating to clients of a number of investment firms. IIROC has taken several measures to notify the firms and their client","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9e5bb5b31c29d2bb40f2c78fa24855bc9b485fc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DAFCAAD-FDF3-49E1-AF7F-97FC0D60AAE3"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://philadelphia.cbslocal.com/2013/03/28/former-philadelphia-irs-worker-sentenced-for-stealing-her-landlords-identity/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/northern-kentucky-irs-financial-technician-sentenced-to-28-months-for-stealing-identities-and-committing-mail-fraud/"}],"summary":"A former IRS worker at the Philadelphia Service Center who admitted to using her position to steal her former landlords identity appeared before a Federal Court judge for sentencing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a2b145bcba43b0a92351e1136386bde6985261d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"595042FB-3E33-48B5-B46B-4BCB38F99432"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a7fa28da7fb","org_name":"Integral Development Company","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cybercrimereview.com/2013/11/exiting-cto-who-copied-source-code-and.html"}],"summary":"CTO exfiltrates source code on his way out the door, he \"copied the source code to multiple places and uploaded some of the data to his personal Google Docs account.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12364a3ea6c8ecfafc91043d865d7367822f4e65","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60D3C546-28D3-45C9-9F03-939E7882731E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3963a6c888af","org_name":"Institutional Shareholder Services","org_type":"professional_services","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sec.gov/news/press/2013/2013-92.htm"}],"summary":"An employee of Institutional Shareholder Services (ISS) shared nonpublic voting data in exchange for $15,000 in concert tickets and $20,000 in meals.  From 2007 through early 2012 an ISS employee provided nonpublic information on how over 100 ISS clients were voting on proxy ball","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12341c92f41af4ce71355e28e1010ea2aa50f487","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFDA2281-8053-4315-B613-330EB09A4BEE"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66a3a2f33f00","org_name":"Instant Refund Tax Service","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/August/13-tax-938.html"}],"summary":"The government alleged that IRTS, which Franklin wholly owns, operated as a franchisee of Instant Tax Service, a large national tax-preparation franchisor operated by ITS Financial LLC, based in Dayton, Ohio.  The government complaint in the case alleged that Franklin owned and o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0fa4edaa7a41099a925bf4cc300ae94929797fb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"170FDC69-F953-4790-8E34-C08CA0742368"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"419d6d5048fe","org_name":"Inspira Medical Center VIneland","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/12/26/laptop-stolen-from-inspira-medical-center-vineland/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedailyjournal.com/article/20131226/NEWS01/312250049/Police-Computer-patient-info-stolen?nclick_check=1"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/cumberland/index.ssf/2013/12/computer_stolen_from_inspira_medical_center_vineland_police_say.html"}],"summary":"Police are investigating the theft of a computer, according to reports, that took place from the radiology department in the regional medical center.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb315dbc093b405a11b9fd5e5881ba690ca93382","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78AC5FBA-2C18-4E10-B690-A2EF54C825B1"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5895f62d562c","org_name":"Inova Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Inova%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/inova-health-system-20130307.pdf"}],"summary":"On February 8, 2013, we learned that a setting was inadvertently left open following application maintenance, which resulted in a human resources file folder becoming accessible to the Internet.  The file folder was part of the Lawson eProfile application and contained W-2 forms ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30e8c63a810341af75643653103fe3733d9db3b6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48CC4F0A-8023-4B10-9772-7930FB609DF0"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bea79b8eb3d7","org_name":"Injury Rehab Specialists of Lou., PLLC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pioneernews.net/content/former-medical-office-manager-sentenced-fraud-id-theft"}],"summary":"Office manager uses information to fraudulently order hydrocordone","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9790ba046eed2750d3670a48987cfdbb3c8bd0b5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0135EF1-A970-49C0-90C7-D3A9A349EA52"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a2282694eb3","org_name":"Information Handling Services, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2013/03/20/ihs-janes-says-stolen-cbrn-information-was-public-domain/"}],"summary":"Hackers breached the servers of IHS and may have been able to access credit card, customer, and nuclear information.  IHS does not believe that confidential information was compromised.  However, the hacker group claimed to have obtained the records of 8,500 customers. The hacker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dc50fc8bd863c72b30bd5627e4cba94b433d39f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C3E443C-20A1-442C-A0BC-1C2BA1213423"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc7c2ff05c97","org_name":"Indiana University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.idsnews.com/news/story.aspx?id=85147"}],"summary":"Last semester the President’s Challenge website tracked IU employees’ nutrition and exercise progress throughout their participation in the Healthy IU fitness competition.  On Jan. 19, those same IU employees received an email from President’s Challenge officials delivering some ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85459f3561583cd5fecada905aef22c726182e80","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1FD2267C-B52B-4B48-80B6-D49C4F5590B8"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"37465c27e841","org_name":"Indian BioResource Information Network","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/09/indian-bioresource-information-network-hacked-by-h4x0r-hussy.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29"}],"summary":"Hacker defaced Indian Bio Technology site in protest of Indian hacking of Pakistani sites. The site was defaced.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e2b66fee717d4d2ccd101a78c64fb5b3d3fcd99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D9563C2-D148-43B0-B769-E7458AC80BDF"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"049e69011d3d","org_name":"Incyte Corporation","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2015/09/11/1-billion-claim-over-a-cancer-drug.htm"}],"summary":"A biopharmaceutical company claims in court that a startup stole trade secrets by luring away a top scientist to \"bet the company\" on a new cancer drug - and then sell itself for $1.25 billion.      Incyte Corporation sued Flexus Biosciences, its CEO Terry Rosen and its president","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"SY","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6baec7738cdc51c220a51ad62c3c0bf887101ee7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EE78B92-D2A6-46A9-9694-8140DF15FF49"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"27326a22d783","org_name":"IN State of Kerala","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Government-Websites-of-Indian-State-of-Kerala-Hacked-by-Syrian-407174.shtml"}],"summary":"The Syrian hacker known as Dr. SHA6H has breached and defaced a number of government websites of the Indian state of Kerala. The attack took place on Saturday. A total of 11 websites have been targeted, E Hacking News informs. The list of impacted sites includes the ones of the K","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3a670a68f87e6e590692bb2f441984eda6938b6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"71A8EA27-19F1-4DBD-892D-8BEC0690E98F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"e6ee8c2b3ad9","org_name":"IN State Bank of Patiala","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/12/state-bank-patiala-hacked.html"}],"summary":"A Pakistani hacker with the online handle \" Kai-H4xOrR\" from PAKISTAN HAXORS CREW(PHC), has hacked into the State Bank of Patiala(SBP) sub-domain and managed to deface the website. - See more at: http://www.ehackingnews.com/2013/12/state-bank-patiala-hacked.html#sthash.5e0PXkb0.d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dea0b64e195e8f84e3c3a78c36f14ebf1c6113ad","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06D9796B-8E23-48C8-8C28-0C67544BFF7A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"b2de4bbee4ad","org_name":"IN software solutions company","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hotforsecurity.com/blog/hackers-break-it-website-to-steal-e-mail-passwords-via-copy-for-payment-scam-6926.html"}],"summary":"web site breached and served up malware, used in phishing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c09d717c011f9d6d953611f1a24c812cdc77c54","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"990C6BDF-56B8-47F9-8338-04589FDB4139"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"0176b348d9b7","org_name":"IN Regional Bench Jaipur","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-India-s-Armed-Forces-Tribunal-Hacked-by-Pakistanis-402947.shtml"}],"summary":"A member of the Pakistani Haxors Crew has breached and defaced the official website of the Armed Forced Tribunal of India, the Regional Bench Jaipur (aftjaipur.gov.in).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"680e4022f17e96fbee127ad202fb69881470b034","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E628248-F9D0-4696-B17E-B67C9F9CECAE"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"2cf5ae518456","org_name":"IN Rajasthan Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/12/rajasthan-government-websites-hacked.html#sthash.n72f0esu.dpuf"}],"summary":"More than 30 India's state 'Rajasthan' Government websites has been hacked and defaced by a Pakistani hacker named as \"H4x0r HuSsY\". The motivation of the hack is appeared to be increasing defacement notification in Zone-h.  The hacker claims he is the \"person with the highest nu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6fd2676824d2f0520e892fd0521508ad80f82ab","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB0BB69D-C5D0-4D41-9C34-2DD03A472931"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c17eac05999e","org_name":"IN Central Bank of India","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/central-bank-of-india-hacked-by.html"}],"summary":"A section of the Central Bank of Indias official website (centralbankofindia.co.in) has been defaced by hackers of the Pakistan Cyber Army and Team MaDLeeTs groups.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"446e1ba79fb96fee6fe95e96831aaa4cdf5fd395","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA0652B9-9999-4097-B26B-9578CA60C581"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"13769c765f33","org_name":"Ilm Ki Dunya","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/08/ilmkidunya-hacked-by-the-hackers-army.html"}],"summary":"Ilm Ki Dunya  a famous Pakistani educational news website hacked and defaced by two hackers with the handle THA RUDE and THA Disaster from the group The Hackers Army.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3e344d56cc0b0a7f1b05873877ca8e6c6589eee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93BB7DF5-CBDB-447D-8C04-C80184707FA4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b66daaba8661","org_name":"Illinois Department of Healthcare and Family Services","org_type":"government","ransomware":null,"records_affected":3100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wls/story?section=news/local&id=9163529"}],"summary":"The Michigan Department of Community Health has fallen victim to hackers. The state has sent out letters warning residents that computers hosting the Michigan Cancer Consortium website were accessed by hackers, breaching the files of nearly 50,000 people  including the files of W","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c82bf22fff02eff9538913ff1c6c140b4fa9d499","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BA06BEC-54A3-425D-B066-75D98FFA17C0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"3ee9d64cd1f1","org_name":"IE Road Safety Authority","org_type":"government","ransomware":null,"records_affected":721,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rte.ie/news/2013/1112/486235-ndls-rsa/"}],"summary":"website vuln leaves personal info at risk. The breach occurred on the Contact Us section of the website, which failed to refresh and retained queries, allowing other users to see that information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86ba8524bbbbdc76da8c2780d320fadc040ba113","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E678CD41-6D98-49AF-AFFF-288115D4C5DF"},"incident_date":"2013-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"c7a1dca7618d","org_name":"ICICI PRUDENTIAL ASSET MANAGEMENT COMPANY LIMITED","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehindubusinessline.com/industry-and-economy/banking/rs-90-lakh-worth-icici-prudential-customer-database-stolen-police-probe-on/article4566931.ece"}],"summary":"The customer database was stolen (method unknown). The fraudsters then made hundreds of calls to policy holders after managing to get hold of the customer database, inducing them to put money in certain accounts to avail bonus and providing wrong information about their policies ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd336ab03c3422d95c474d111363677f97503dd5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"403BAD68-8997-436C-AAAD-E142C3CCDC3A"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0cb4d917e4a0","org_name":"IBM","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/cloud-computing/infrastructure/ibms-cloud-business-ex-employee-divulges/240159982"}],"summary":"IBM's cloud computing revenues are smaller and less \"cloud-intensive\" than customers and Wall Street analysts might think. That's the claim of a former IBM employee who backed up more than a few of his/her critical assessments of the vendor's cloud prowess with a number of confid","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f47ab60dd9fa5c819192a374553ffb52af0d79e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CD6F400-DA70-4CB5-8B37-C442BA2FC3FB"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4299d4d67381","org_name":"Iberdrola USA","org_type":"energy_utilities","ransomware":null,"records_affected":5100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bangordailynews.com/2013/04/16/business/cmp-parent-companys-website-breach-puts-employee-data-at-risk/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.rbj.net/article.asp?aID=197667"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227420.pdf"}],"summary":"A hack of Iberdrola USA's recruitment website may have exposed the information of anyone who applied for a job at Central Maine Power or any of its sister companies since January 2007.  Rochester Gas and Electric Corp and New York State Electric and Gas Corp. were also affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28364dc0293e402c9aed54e07e0c350ed139e55c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2AA876F5-73E2-4492-8ED2-959FE49A309C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"99cd8a18093e","org_name":"Hutt Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/dominion-post/news/hutt-valley/9302192/Surrogate-mother-disgusted-by-prying"}],"summary":"Medical filed reviewed without authorization by receptionist staff. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27b11b5deeeda3be2994de242ce7af488315bf34","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F08461C9-90BC-4E4F-B159-1CFB6E2D1AC4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"516fa16089b7","org_name":"Hunter United Credit Union","org_type":"financial","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2013-11-06/credit-union-customers27-email-addresses-mistakenly-distributed/5074108"}],"summary":"Hunter United Credit Union accidentally copies customer email addresses in an email update about interest rates.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5af051593da75dd68f2260eef062621cda1f0fae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B275351-334F-440E-8E3A-50ED48BD863F"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e2f44b14209a","org_name":"Human Resources and Skills Development Canada (HRSDC)","org_type":"other","ransomware":null,"records_affected":583000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.gc.ca/web/article-en.do?m=/index&nid=714639"}],"summary":"lost external hard drive with personal information of 583,000 Canada Student Loans Program borrowers between 2000-2006","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cea49608492161acf95397e03b43c3da2bee068a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C28E1D34-1652-4A0A-982E-8F4165399CE1"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"217ba47a2bef","org_name":"Hudson Valley Foie Gras","org_type":"manufacturing","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedailymeal.com/hackers-release-hudson-valley-foie-gras-customer-information"}],"summary":"Yesterday, it was announced that Hudson Valley Foie Gras's website was hacked Monday and Tuesday, giving hackers access to more than 1,200 customer names, addresses, credit card types, purchases, and email addresses.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e2ff64dc089e4e574df0c376e68e25940e1d5eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80A9C208-EDFD-4D75-88CD-D1317B507D19"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GA","org_id":"093aee0b5c99","org_name":"http://gabonactu.com/","org_type":"technology_saas","ransomware":null,"records_affected":117,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/OpGabon-Anonymous-Hackers-Leak-Data-from-Gabonese-News-Website-376930.shtml#1750853711264353187(20130821)"}],"summary":"Anonymous hackers continue OpGabon. Their latest target is gabonactu.com, a news website that, according to the hackers, is controlled by the Gabonese government. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd1dea7bc0707af04850b06db1343cfca7f657fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F7BD9B6-E98B-47C5-8655-4FE85FA8FFEA"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"9892893001ed","org_name":"HTC Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.engadget.com/2013/08/31/htc-designers-arrested/"}],"summary":"Earlier today, several top designers at HTC were arrested in Taipei under suspicion of fraudulent expense claims, as well as stealing trade secrets ahead of leaving the company to run a new mobile design firm in both Taiwan and mainland China.   The real beef HTC has here is that","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26e245c9448b13952beb361f1e8cfe679349f70b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"225076E4-22B3-4587-AFA6-F5AAB526BB23"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"a99da04b309e","org_name":"Hotusa Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Hotusa%20Website%20Server%20Active%20CM%20Letter_%28WSC%29_EN_Final_0.pdf?"}],"summary":"A server breach or other incident related to credit cards may have affected people who used their American Express cards at locations linked to Hotusa Group's servers.  Account numbers, names, credit card expiration date, and other credit card information may have been exposed fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b44317a0a65f0348de2493c26be45f83ecceb06f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0ECE501C-2EDB-4DF1-A31D-C855624374A7"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f72d583621b8","org_name":"Hospital for Special Surgery","org_type":"healthcare","ransomware":null,"records_affected":537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/and-yet-9-more-breaches-added-to-hhss-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/HealthInfoBreaches.csv"}],"summary":"A desktop computer and paper documents were stolen from an undisclosed location.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4039c26c0d73123d59bde518b5e15fe8b3ff8d9b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B6434EC-6AA1-4966-97D8-0BDCAED0C50B"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7f6d60f83f2","org_name":"Hospice of North Idaho","org_type":"healthcare","ransomware":null,"records_affected":441,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.spokesman.com/stories/2012/dec/29/laptop-theft-proves-costly/,"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/news/press/2013pres/01/20130102a.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dbhdd.georgia.gov/sites/dbhdd.georgia.gov/files/related_files/site_page/HIPAA%20HHS%20Resolutions%201%2014%20One%20page%20version.pdf"}],"summary":"The June 2010 theft of an unencrypted laptop from an employee's car resulted in the exposure of patient information.  The HHS Office for Civil Rights investigated the breach and found that HONI had not conducted a risk analysis to safeguard electronic protected health information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27ee7e4f4936da3dea6351fa69b4bff10d63677e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2920a000-fb20-11e9-ac31-5797fdf8a397"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67f3db4f8339","org_name":"Honolulu police department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.hawaiinewsnow.com/2019/04/30/humbled-man-ex-officer-sentenced-connection-with-case-against-kealohas/"}],"summary":"Police officer provided investigation information to an unauthorized 3rd party (a friend and city prosecutor).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cc4959026ea867927883d764ca52fec2b14e760","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA815388-C9F1-47C3-9C03-917FF1D19B11"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"d07a642fecaa","org_name":"Hong Kong Prevention Association","org_type":"healthcare","ransomware":null,"records_affected":360000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/hong-kong/article/1210756/deceitful-firm-ordered-destroy-personal-data"}],"summary":"The public watchdog condemned a medical centre for collecting personal data from more than 360,000 people and selling it to an insurance broker for direct marketing purposes.  The Office of Privacy Commissioner for Personal Data yesterday revealed that the Hong Kong Prevention As","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec66261946ad8dbc2b12a85dc2db441ed59bd1fd","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBE77A7C-9FC7-4A13-80DA-12C422E8651A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HN","org_id":"26eee3e063c4","org_name":"HN Honduras Ministry of Industry and Trade","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Honduras-Ministry-of-Industry-and-Trade-Hacked-394713.shtml"}],"summary":"The official website of the Ministry of Industry and Trade in Honduras (sic.gob.hn) has been hacked by Anonymous hacktivists. The attack on the Honduras government website comes just before the general election scheduled for November 24.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a88c1e6e9613e6162eef62af9d3db7851ce8e1af","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"818BEB57-53C7-4A53-8D62-72ED45F69046"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HN","org_id":"00c9deacee0a","org_name":"HN Government of Honduras","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/anonymous-honduras-hacks-interpol-police-sites/"}],"summary":"The online hacktivist group Anonymous Honduras has hacked and defaced 6 high profile Honduras government ministries websites against the alleged fraud in countrys presidential elections.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa0847a13642af460da4f763edaab55507c215d2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7093E6AD-E7FC-48ED-AB16-E0BCB1E768D7"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"91aa469303f6","org_name":"Hindustan Times","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hindustan-Times-Hacked-Data-Leaked-388122.shtml"}],"summary":"The website of the popular Indian English-language newspaper Hindustan Times has been hacked and defaced by a hacker calling himself Silent Hacker.  The Hackers Blog reports that the attacker has also leaked some data on Pastebin allegedly taken from the Hindustan Times databases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"473c28af902f500a549b08ace6eea47dbc43b69d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D174663E-3EC2-4182-ABEE-32AFB4A76F41"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"080581f01c06","org_name":"Hilton Head Island Hospice","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.islandpacket.com/2013/03/04/2404198/woman-arrested-in-theft-of-hospice.html"}],"summary":"A Hardeeville woman suspected of stealing and using credit cards of a patient at the hospice where she worked has turned herself in.  Shamika Smart, 31, turned herself in Monday morning, according to a news release from the Beaufort County Sheriff's Office. She was wanted on one ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4d842d6dcdc7ed7821990c3118fd468e67e781d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93FF0545-013A-4CAC-B279-8D81DC0E9ACE"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8b0e2d168bd4","org_name":"Hillside Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/anon-ghost-hacks-hillside-police-dept-website/"}],"summary":"The official website of State of Illinois Hillside Police Department has been hacked and defaced by online hactivist group AnonGhost.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b318a4d2cb84c189ce96c623c86d0c7779dfcdf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AB417DD-32D6-41AC-A9D7-2C976D0B60B6"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"ccb29717a59f","org_name":"Higher Commission for Scientific Research","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/OpSyria-Anonymous-Hacks-Syria-s-Higher-Commission-for-Scientific-Research-393895.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailydot.com/news/opsyria-syrian-government-hack-interview/"}],"summary":"Anonymous as part of OpSyria uses SQLi to compromise Syrian government web server and publish information to Pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01cd7ed17a9bec54b6f5b36135d6989b1edc6d28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBEF60E3-2A61-480B-BB7D-DDD40A4D55A7"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2cc876585bd3","org_name":"High Point Enterprises","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdnews.com/in-other-news/clerk-at-business-charged-with-id-theft-1.83689"}],"summary":"Payroll Clerk stole personal information and committed identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"541dc391ac2d08a35031cc803b8abddbd82add66","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DB30841-F335-4770-AC86-5CFDF9E8105C"},"incident_date":"2013-01-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42f797436512","org_name":"Heyman HospiceCare","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/19/heyman-hospicecare-reports-patient-data-breach/#.USO4ZYPDtFY.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/georgia-hipaa-breach-after-laptop-stolen"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northwestgeorgianews.com/rome/hospice-records-at-risk---affected-patients-will-be/article_c78c1ccc-8688-5810-8575-8b6e320ce49d.html"}],"summary":"Heyman HospiceCare, Ga., experienced a familiar plot on Jan. 4 when an employee left a non-encrypted laptop in their car that contained patient names, addresses, phone numbers, birth dates, Social Security numbers and insurance policy numbers and the device was stolen  Potentiall","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc132fda0e3fbec170f6f3b61179ec4afccefbb6","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C29C4C44-7BB4-4E06-AB72-6452F8A0AEC7"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78ae85df68a6","org_name":"Henry Ford Health System","org_type":"other","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://archive.freep.com/article/20130722/NEWS05/307220105/X-rays-stolen-from-Henry-Ford-Health-System-Detroit"}],"summary":"More than 15,000 X-rays of Henry Ford Health System patients were stolen from a warehouse in May.  That's according to a letter the Detroit-based hospital system sent to patients.  The Detroit Free Press reports Monday (http://on.freep.com/12cXv1F ) thieves may have taken the X-r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfe64c0f46e9571d89fbb6ba4b39d83636aeda0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3586DFB7-A01F-4584-A88E-DFEFA83E6636"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f78e7fbec6e7","org_name":"Heber City Police Department","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ksl.com/?nid=148&sid=27791082#eIovOOl5DzFXvvrk.99"}],"summary":"SALT LAKE CITY  A driver was shocked after he received a speeding ticket with someone else's information on it. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2590d9f4727b3711c4c6218257cdaced5fd1719a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39A35855-8A9F-498B-861F-D993830D22D8"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d45397d888a9","org_name":"HealthMarkets","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/healthmarkets-20130514.pdf"}],"summary":"Inadvertent distribution of personal non-public information put names, addresses, SSNs, DOB and some financial data of agents at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11c5397be6155cc1a61efce4fe236c1f9786f770","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E75B0BB5-59BC-482F-9576-70DCE066F131"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c764e58feac1","org_name":"Healthcare.gov website","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/right-wing-cyber-attacks-on-healthcare-gov-website-confirmed"}],"summary":"Right wing attacks against healthcare.gov site via dos attacks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bfaa17d42a5a58b19a5f6ef4c24692945a5ad2f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E34A10C-5D45-427B-97CC-284A9E828CDF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6377ff4ca43a","org_name":"Healthcare.gov","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/missouri-woman-s-personal-information-stolen-from-obamacare-website"}],"summary":"Lisa Martinson contacted customer service (for healthcare.gov) when she forgot her password. That's when she learned that three different people were given access to her account, her home address and her Social Security number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a653e250aed1dab63a0dcd41af6c64a575dbc00a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6DFFB7A-2B52-4FC1-ADE5-0AEAFFE311EB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"235da4e82fcf","org_name":"HealthCare for Women","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.southcoasttoday.com/apps/pbcs.dll/article?AID=/20130326/NEWS/303260334/1001"}],"summary":"A computer server for SouthCoast medical provider HealthCare for Women was hacked in January, potentially exposing summaries of patient visits occurring from June 2012 to January 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6581991b6ca2196fb905107805ece0e9e5cb675","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB3D9A63-6814-4784-A1EA-B960215D80E4"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e6f1232918ba","org_name":"Health Canada","org_type":"healthcare","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://metronews.ca/news/ottawa/861955/medical-marijuana-patients-outed-by-health-canada/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newswire.ca/en/story/1502559/commissioner-health-canada-violated-privacy-laws-by-disclosing-personal-health-information-of-over-40-000-canadians"}],"summary":"Tens of thousands of medical marijuana patients across the country are receiving a mass mailing from Health Canada exposing them as medical cannabis users and many are now in panic mode.  The letter, which Health Canada says was sent to 40,000 people, comes in a white envelope, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32e604f138b103e547db3585cb09155fdd08eac7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"542F477F-1154-49BD-94B1-F2CD0BD3F065"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"894c90f882d0","org_name":"Head Start","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/023fa65a76cb42fab4057ce5c911fd7f/GA--Medicaid-Fraud-Conviction;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.11alive.com/news/article/313698/3/Ex-businesswoman-convicted-in-fraud-scheme"}],"summary":"Federal prosecutors say a coastal Georgia woman has been convicted in a $4 million Medicaid fraud and identity theft scheme.  Authorities said Wednesday that 47-year-old Schella Logan Hope, of Brunswick, has been convicted of money laundering, aggravated identity theft and health","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deaf9592119fb0f1099b6e99b943ebc05c4bccf2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"834B54F0-0E52-4CEA-851B-84FDBB30712D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"68eb7d76745d","org_name":"Hashraa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.israelhayom.com/site/newsletter_article.php?id=11855"}],"summary":"Hacking spree results in compromise of book retailer website and dumping of customer information and database configuration onto the internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc5c48b9ec050d9de881afc70c44907da65503e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8E07CBF-D0E7-437E-8F3D-71F0E08BC53F"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10e53feff8f0","org_name":"Harbor Freight Tools","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.idradar.com/news-stories/identity-protection/Another-Large-Chain-Hit-By-Credit-Data-Theft,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/new-retail-breach-reported-a-5927,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/impact-harbor-freight-attack-grows-a-5970/op-1"}],"summary":"Harbor Freight Tools, a U.S.-based chain of 400 retail tool stores, has reported a breach against its payment processing system.  The Calabasas, Calif.-based company says in a statement that it was advised by several credit card companies that it may have been the target of a cyb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fcc470dd9357c2b299aa28ea03369a00706ae6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC57054A-1602-467B-ACE4-9A1306AC50B0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"f8649bf91fb3","org_name":"habeas.be","org_type":"other","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Rex-Mundi-Hackers-Blackmail-Belgian-Recruitment-Agency-Habeas-368502.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://belsec.skynetblogs.be/archive/2013/07/16/rex-mundi-hacks-another-belgian-7871246.html"}],"summary":"Rex Mundi Hackers Blackmail Belgian Recruitment Agency Habeas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9edc4f238d358bc46fb3b781b5b93da7b75f3250","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F325081-CC1F-46F3-9C77-FA57BE5E513D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"234f652e4f28","org_name":"Haagen-Daz","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/news/local/article/298288/8/Haagen-Dazs-customers-may-be-ID-theft-victims"}],"summary":"Anyone who made a purchase at the Haagen-Daz inside the food court in International Plaza since April of 2012 may have been affected by identity theft. A flash drive that contained key-logger software was connected to a register at the store. It recorded payment card transactions","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd48a843f3bec6d3cd41efe25d461db3493d1dff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E02B5800-D400-4F89-95CD-D533BAD30747"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ea4e93c893bc","org_name":"Haagen - Dasz","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tbo.com/news/crime/tampa-woman-found-guilty-in-credit-card-fraud-ring-20131213/"}],"summary":"identity theft ring during which conspirators ripped off credit card numbers from unsuspecting customers at International Plaza.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"381c0407f53d85f90aa0ab2a7744acd0d36f7890","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CE69203-D702-4176-A530-BFE51667EFE5"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"80c1c51ae90d","org_name":"H&T Multi Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itemlive.com/news/lynn-tax-preparer-sentenced-on-fraud-identity-theft-charges/article_112047ee-06c1-11e3-8e85-0019bb2963f4.html"}],"summary":"A Lynn tax preparer was sentenced to three-and-a-half years in prison Thursday after pleading guilty to fraud and identity theft charges, according to press releases from United States Attorney Carmen M. Ortiz’ office.  Fernandez operated a business called H&T Multi Services in L","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"044ec239cc88e11ef5b055393d90c01a4c84b834","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99BBCAB8-ED3A-475E-9B6B-1499B94192F0"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"048377173e4d","org_name":"H&R Block Inc","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.delmarvanow.com/story/news/local/2014/09/17/va-shore-hr-block-owner-pleads-guilty-theft/15767107/;http://wavy.com/2014/09/16/local-tax-preparer-admits-to-identity-theft/"}],"summary":"Owner of several H&R Block franchises uses customer data to open unauthorized lines of credit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cdf081e7155324cac0c2623197a5b1b4b561915","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81B084A0-54F5-441A-9E64-C9C004FE290F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d72a3ef9565f","org_name":"H. J. Heinz","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/crime/article/Pa-woman-charged-with-forging-checks-at-Heinz-4940303.php"}],"summary":"Payroll Administrator was forging payroll checks and cashing them in.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cde726a6209d1460bbfd1503d7d61d47fe4e063","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D99B7D59-7BDD-4D33-8BCA-55E3D8746F77"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"447a41f12cef","org_name":"Greensboro ABC Stores","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://myfox8.com/2013/06/27/abc-store-information-hack-more-widespread-than-greensboro/"}],"summary":"Greensboro ABC stores and Triad ABC stores discovered that the software used by cash registers had been hacked.  The malware was discovered after customers complained about fraudulent charges on their debit and credit card accounts.  The ABC stores stopped accepting credit and de","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa3c9ce995098f7c01dac2c2d79626cf8190b77d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61FE43EF-F22E-4467-B5CD-3A8883FE6EDF"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a609e714cab4","org_name":"Graphic Data","org_type":"transportation_logistics","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankingtimes.co.uk/2008/08/26/one-million-account-details-included-in-ebay-action-of-laptop/"}],"summary":"Laptop with non-public data sold on eBay.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"BR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f0cc1d9512cc1d7f0059fdf5e7e41889e4f7d2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"970C7583-BF9D-4F8A-954E-BBF714B87CBC"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"5554c0de7c6f","org_name":"Government of Brazil Websites","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/01/opworldcup-brazil-government-websites.html"}],"summary":" An anonymous affiliated hacker group called as \"DK Brazil Hackteam & An0nat\" targeting Brazil government and defaced several Brazil Government websites in recent days. The operation is appeared to be a protest against the upcoming 2014 FIFA World Cup that is scheduled to take pl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af077ee43d8394c652308bdee6dc05a89b4b6a17","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1CE3F8D-F50B-4730-82E1-F5B27787CD4D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"89ae4f7136fa","org_name":"Goold Health Systems","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/terrific-employee-fired-after-losing-usb-drive-containing-medical-records-011713/77422"}],"summary":"A Maine-based company announced Thursday it fired an otherwise exemplary employee who dowloaded medical data onto a jump drive and then lost the device while traveling between Salt Lake City, Denver and Washington, D.C.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c96cdac87084269a639d4e37cde81ff0fc80d46d","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DE0FC06-7DBC-4F66-9B77-56E71F31354C"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BO","org_id":"0e9f335c7c68","org_name":"Google Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Google-Bolivia-Domains-Defaced-by-Turkish-Hacker-396405.shtml"}],"summary":"The main domain and several subdomains of Google Bolivia have been defaced by a Turkish hacker that uses the online moniker Misafir. Of course, its unlikely that Google servers have been breached by the hacker. Instead, the most likely scenario is that he gained access to the sys","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9af41bb30d03ac6becd7ff337e386464ece533d0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1DDD5D7-F4C5-420F-A466-5E836C3EE1F8"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c0eab5e65f5","org_name":"Godiva Chocolatier, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/godiva-20130528.pdf"}],"summary":"A flash drive was found by an unaffiliated person containing sensitive Godiva information.  The person who found it contacted the company through a lawyer and returned the drive.  Forensics confirm the drive was accessed on April 2, 2013.  Further investigation indicates that a f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da94935a30c92406f2b9c5292b7c19b2034bccad","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16139591-3388-4BA0-84BF-2CA16A114793"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8586bdd9405","org_name":"Glens Falls Hospital","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wnyt.com/article/stories/S2988422.shtml?cat=300"}],"summary":"Glens Falls Hospital says the medical records of more than 2,300 patients may have been compromised.  The hospital says it stored those records for more than 4 months on an unprotected computer server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72cfc666832841d6c0ad6200aafcfaa4b039bd30","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2ABBCF29-CFE3-446E-BEF9-BA3A11FB2DD8"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9152864231e2","org_name":"Givaudan Fragrances Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://scholar.google.com/scholar_case?case=9993980019270546865"}],"summary":"In early May, 2008, Krivda resigned his employment with Plaintiff, Givaudan Fragrances (\"Givaudan\") where he was a perfumer. Prior to his last day on the job, Krivda allegedly downloaded and copied a number of formulas for fragrances. The parties acknowledge the formulas as trade","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7caec1071ae32a83b6d5ab397bce729d212ff084","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A89C3DD-7A0E-42A9-9FA2-4C7FD30C7777"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b37f7df0c99c","org_name":"github.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/01/31/github_ssl_man_in_the_middle_attack/"}],"summary":"Github.com hacked and an SSL certificate replaced for Man in the Middle attack, possibly by China.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d176a9a9a7b08444a05bf8a93fe61abf25202fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"499BF662-A221-4C6A-A472-E81DA98658BE"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"7a145107e589","org_name":"German Government","org_type":"government","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://voiceofrussia.com/news/2014_02_02/All-German-ministries-hit-by-massive-email-and-password-theft-9766/"}],"summary":"Hackers appear to have set up a botnet that snagged data from German government computers in addition to other victims. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af031cc3a46562f6fedeccdf12c5c573405b2f62","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4E73391-F2D5-4364-8286-8131ABC68631"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"5d38afd54a9b","org_name":"German Chamber of Commerce","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/01/anonymous-hacktivist-leaks-141-gb-of.html"}],"summary":"Anonymous posts files said to be stolen from German Chamber of Commerce. Documents were stolen from personal end-user device of a delegate.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7739e0836b309da46200c7f9f73a96596881eb9e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A36AFE8-FD46-42C2-A9F6-252318342CE4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eaec60f40223","org_name":"Georgia Department of Labor","org_type":"government","ransomware":null,"records_affected":4457,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.usatoday.com/story/news/nation/2013/09/06/social-security-numbers-email/2775199/"}],"summary":"An employee error compromised thousands of people's personal information, including social security numbers, the Georgia Department of Labor said. A spreadsheet containing the names, Social Security numbers, telephone numbers and email addresses of 4,457 people who filed for unem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cffdb8844c638a151077b7485600665408137ad3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54B743A7-158B-454E-B47D-62C3622BE541"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b2a32a213bf","org_name":"Georgia Department of Driver Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.13wmaz.com/story/news/2013/11/18/dds-personal-info/3628555/"}],"summary":"Public computer at Georgia DMV office stores in plain text customers personal information such as ss#, pay stub, etc. on publicly used browser and all one has to do is to press the back button on the browser to see and print it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a3392fd9a15ea3e545429a001e835dd9a4b075d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"861B7CD8-03BB-49C4-A074-B42B26C16065"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0ef2c22578a","org_name":"General Services Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/cybersecurity/2013/03/gsa-database-may-have-leaked-contractor-banking-and-proprietary-information/61921/?oref=ng-channelriver"}],"summary":"GSA users may have been able to view the financial information and trade secrets of other GSA users due to a security vulnerability.  The specific database that was affected is called the System for Award Management (SAM).  Contractor and vendor registration records are cataloged","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98db0d48a7da7060f2205abcf5c5a5862033116c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA76E065-EACB-4A17-94D5-D274F18C52FC"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad8c323f167b","org_name":"GE Capital Retail Bank (GECRB)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/GE%20Capital%20Retail%20Bank%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"We are writing to you because of an incident involving your [Retailer Credit Card] account issued by GE Capital Retail Bank (GECRB). Your personal information that is stored in our systems to allow us to service your credit card account was inappropriately accessed and released o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a54ac7e221cfb594941dc870db2c50a92b143ed1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D326C8BF-E69F-4C5B-BEA1-2F61D1DC6A18"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06588ea9101b","org_name":"Freenters","org_type":"manufacturing","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Freenters-Takes-Down-Its-Website-Following-Hack-401236.shtml"}],"summary":"Last week, a group of hackers calling themselves the UChicago Electronic Army hacked and defaced the website of Freenters, a company that provides free printing services for students. The website has been taken offline following the breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0ae2e270fe6b7c01d9abb9e712eb7c0fd31ffda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF305F9E-3ED4-4518-9EFC-12607A48776B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3ed6b6547077","org_name":"Foxtons","org_type":"other","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Leak-Data-Allegedly-Stolen-from-British-Estate-Agency-Foxtons-376583.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.co.uk/news/archive/2013-08/20/foxtons-allegedly-hacked,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcpro.co.uk/news/security/383722/foxtons-investigates-leak-of-10-000-customer-records"}],"summary":"Estate agent Foxtons is currently investigating a possible data breach, which may have resulted in the personal information of 10,000 customers being compromised.  A list including the email addresses, usernames and passwords, many partially obscured, of alleged MyFoxtons users w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"13817f068c66ac35d85a5f0437553aeac672df0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"487E285B-439E-47A4-BE6A-0A4A78F58CD5"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d48a04615f1","org_name":"Fort Dodge Correctional Facility","org_type":"government","ransomware":null,"records_affected":23,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/article/APNewsBreak-Prison-worker-records-left-unattended-4812026.php"}],"summary":"Prison employee left documents containing PII in prison barber shop. 23 records were at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e42220f4acfbb66d4ce20ac87144d7258aa549a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7019DB5A-D535-4C68-9FCC-DE62087BD64F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"153826d8c1e7","org_name":"Florida Digestive Health Specialists, LLP","org_type":"healthcare","ransomware":null,"records_affected":4400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldtribune.com/article/20131125/ARTICLE/131129761/-1/news?Title=NEW-Patient-data-may-have-been-leaked-doctors-group-warns;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/florida-health-employee-caught-photographing-patient-data-gets-fired/article/322701/"}],"summary":"Health Care employee photographed patient information, including name, SSN, DOB, and telephone numbers. No mention of medical information in any of the articles. Suspect was turned in by manager of retailer where the photos were developed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a13890130c4a505d34abfee76c3357b89b9cf08","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EB94845-3745-45F5-8D5B-75B278A8A035"},"incident_date":"2013-01-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14524e0d0491","org_name":"Florida Department of Juvenile Justice","org_type":"government","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.djj.state.fl.us/news/press-releases/press-release-detail/2013/01/11/information-security-breach-reported-at-djj"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.palmbeachpost.com/news/news/crime-law/state-investigates-security-breach-at-department-o/nTtQB/"},{"fetched_at":null,"title":null,"type":"press","url":"http://theleakingvault.com/news/2013/1/16/florida-department-of-juvenile-justice-suffers-security-breach;http://www.esecurityplanet.com/network-security/florida-department-of-juvenile-justice-suffers-security-breach.html;http://www.djj.state.fl.us/news/press-releases/press-release-detail/2013/01/11/information-security-breach-reported-at-djj"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.winknews.com/Local-Florida/2013-01-11/DJJ-investigating-serious-security-breach-"}],"summary":"A mobile device that contained both youth and employee records was reported stolen on January 2, 2013.  Over 100,000 records were on the device and may have been exposed.  The device was taken from a Department of Juvenile Justice office and was neither encrypted nor password-pro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d0b0052b63b867c9f720b5dcb1714ed80c16277","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"420FBA11-63A7-4A42-82EE-2FDA0F89AE97"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cac2f26513db","org_name":"Florida Department of Health","org_type":"government","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clickorlando.com/news/orange-county-health-department-announces-security-breach/22719504"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/a370677dfd5643cc818871484b63b7b0/FL--Pill-Mills-Database-Breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wtsp.com/rss/article/321732/378/Scott-vows-stricter-controls-for-prescription-drug-database"}],"summary":"Employees for the Florida Health Dept stole PII for patients and used it to file false medical claims.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af9313850d8da84539b287743d6169c0729e11b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6DE1B9E-03F1-4D76-A691-CC6F15B93599"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d395630c3ff4","org_name":"Fleetpro, Inc.","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231927.pdf"}],"summary":"This letter is to provide notification of breach of security to Utility Construction Services Inc. (Utility) regarding suspected unauthorized credit card use per Maryland Commercial Law 14 - 3504. (1) Based on a call to Fleetpro from Utility regarding a n apparent unauthorized us","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d5aea0e4eb740c979f32eb1eab0bd91430ceb9a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A722C1A-8BD5-4336-A28D-1B57E9A625AF"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c63313f71f56","org_name":"Flamingo Resort and Spa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/To%20whom%20it%20may%20concern_0.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/flamingo-resort-and-spa-notifying-employees-after-virus-may-have-exposed-payroll-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/californias-flamingo-resort-and-spa-admits-data-breach.html"}],"summary":"Flamingo Resort and Spa is notifying all current and former employees after they discovered that a virus on the payroll computer might have allowed a hacker to access their personal information, including Social Security number, date of birth, address, phone number, and for those","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e86abff712230d4a6ccb82ae192a86a79e9eddfd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5185427-043E-4FA9-BEA3-BE361ED0E61F"},"incident_date":"2013-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8194db7ab3d2","org_name":"Fisher's Popcorn","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-234884.pdf"}],"summary":"Small business owner is deceived by external actor portraying themselves as a Microsoft technician. Access to desktop, that stored company data was provided. No evidence of data exfiltration and not a targeted attack. End game for actor was a 150.00 money order for \"services rend","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8c04f316dbc9866bc4158ec29282162f91c44c3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CE1FDAA-C738-4DD5-93C3-59CF09CFF259"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41a07d2e00e1","org_name":"First Niagara Financial Group Inc","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231591.pdf"}],"summary":"misdelivery of physical mail","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4d19895c33351e9699940817f0b50fe1de44312","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90697722-7D5E-4D84-8F98-5C83B4F6E225"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9b295ee3fa3","org_name":"Fine Fare Supermarket","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dnainfo.com/new-york/20131211/lower-east-side/credit-card-info-stolen-from-fine-fare-supermarket-customers-police-say"}],"summary":"Payment card information stolen from grocery  via unknown method.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1b4f83413f9861a5c74f5d9ad3acfcd550dea02","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C96B625-D1C1-4586-B482-FCAB6535DE06"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"64429c361cef","org_name":"Fidelity Life","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.odt.co.nz/news/national/279367/insurance-company-privacy-breach"}],"summary":"USB drive stolen from car with insurance data about customers on it.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bf27e15e7ce3725f17483c9e3da72016d2d07e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F482B24D-CBDB-4D91-8CE6-FF080298C2F6"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3fa89cc9495","org_name":"Federal Emergency Management Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Leaks-More-FEMA-Data-Hackers-Say-There-s-More-369492.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.globalpost.com/dispatches/globalpost-blogs/the-grid/FEMA-hack-anonymous-retaliates-us-defense-snowden-transparency,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/anonymous-hacks-fema-edward-snowden-2013-7"}],"summary":"While the US Federal Emergency Management Agency (FEMA) has yet to confirm that it has been breached, Anonymous hackers continue to leak data they’ve allegedly stolen from the organization’s systems.  The second round of data, leaked a few hours ago, consists of contact informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"622b25f58833df7bc0a2de3f47a9d24d886a85ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E0E16FE-3668-41C2-B879-F179870F0AB6"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e042a3558a7","org_name":"Federal Bar Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hacker-Claims-to-Have-Breached-Atlanta-Chapter-of-the-Federal-Bar-Association-370237.shtml"}],"summary":"A hacker that uses the online moniker Ag3nt47 claims to have breached the Atlanta Chapter of the US Federal Bar Association (fedbaratlanta.org).  The hacker has published several user records allegedly stolen from the website’s databases. The leaked data includes administrator na","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b1dc69f85e05e10ff7e15d2149b1d037ae2717c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6A827D8-66EE-4746-8146-0143711B3A3A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27ad82a556c4","org_name":"FCC","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.masslive.com/entertainment/index.ssf/2013/02/hackers_break_into_montana_tv.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/07/we-interrupt-this-program-to-warn-the-emergency-alert-system-is-hackable/"}],"summary":"The Emergency Alert Systems (EAS) of several TV stations nationwide were hacked and alerted people to a fictitious zombie attack.  The FCC ordered local broadcasters to change their passwords on EAS equipment and check the security of firewalls before resuming normal internet con","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f5a0002ce01454b771a1f21d465974ac06d7696","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA92F0B1-4257-425F-A7A5-B778273D61AA"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dab92168093c","org_name":"Fazio Mechanical Services Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/02/email-attack-on-vendor-set-up-breach-at-target/"}],"summary":"Actor uses spearphishing messages to gain credentials. Uses those credentials to hack another victim organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ecf58a767d28e6f7351c03fef05af0d2faaf8e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"51F4DF73-2178-44B4-B11D-B3922A5A1649"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f65ba8112c1","org_name":"Family Intervention Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/news/local/personal-medical-records-found-paulding-co-dumpste/nWghG/"}],"summary":"A caller contacted a local news team member and an investigation of mishandled medical documents began.  The documents were in an unlocked dumpster and contained Social Security numbers, bank account information, addresses, dates of birth, and health information.  The documents w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6797cdbc719ee226e84032ddb3d9ebdb339443f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A61CE3A-28E0-4AB0-B706-9A40A06596A5"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.facebook.com/notes/facebook-security/important-message-from-facebooks-white-hat-program/10151437074840766"},{"fetched_at":null,"title":null,"type":"press","url":"http://fortune.com/2017/04/27/facebook-google-rimasauskas/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/usao-sdny/press-release/file/950556/download;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.justice.gov/usao-sdny/pr/lithuanian-man-arrested-theft-over-100-million-fraudulent-email-compromise-scheme"},{"fetched_at":null,"title":null,"type":"press","url":"http://wtaq.com/news/articles/2013/mar/20/ashwaubenon-marine-recruiter-arrested-for-identity-theft-child-pornography/"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57573720-83/apple-facebook-hackers-hit-car-and-candy-companies-too/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/02/19/us-apple-hackers-idUSBRE91I10920130219?goback=%2Egde_36573_member_215647969"},{"fetched_at":null,"title":null,"type":"press","url":"http://apnews.myway.com//article/20130216/DA4FDH281.html"}],"summary":"Facebook discovered a bug that may have allowed unauthorized users to view the personal contact information of Facebook users.  The people who could have used the information would have had some kind of connection to them or some kind of contact information, but users may have th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9fcdda2c70acf18e2fe36db6b3e792cc3030f8d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B3CF185-A4A7-47CE-8A10-BAC74A80C097"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"526ffe130dcc","org_name":"EZ Loan and Tax Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.carolinalive.com/news/story.aspx?id=935898#.UhQhxD9CqB1"}],"summary":"  Nina Monique Allen, 32, and Wendy Marie Johnson, 38, both of Dillon, have been sentenced in federal court in Florence, according to United States Attorney Bill Nettles. Allen previously pleaded guilty to Theft of Government Funds and Johnson previously pleaded guilty to Aggrava","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81bf4a778a879a1490628d6babfccdae02b9014a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F415256-EB02-40C7-BDBF-BF2409E56671"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9745527652dd","org_name":"Exxon Mobil Corporation","org_type":"manufacturing","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/camden/index.ssf/2013/10/stratford_gas_attendants_stole_credit_card_info_with_device_authorities.html"}],"summary":"Three men are accused of using a pocket-sized device to pull information from the credit cards of at least 50 gas station customers, so they could be used fraudulently.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f07e09ef666e5f11049a861ec9923fb842b19be7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DD02745-8CE2-4612-ACAF-63F7480F6F67"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5a28ecf2041","org_name":"Express Scripts","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bloomberg.com/news/2013-02-16/express-scripts-sues-e-y-alleging-trade-secret-theft.html?goback=%2Egde_4636751_member_215315952,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/191701131_Express_Scripts_sues_Ernst___Young_over_data_breach.html"}],"summary":"A partner at Ernst & Young is accused of sneaking into the headquarters of Express Scripts Holding Co.  It is not clear how the Ernst & Young partner got into the headquarters, but it is believed that he emailed over 20,000 pages of data to a personal account.  Express Scripts Ho","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c4695e8b855b399f7326885a4275c9004685d39","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B6CD665-2937-4729-AAD6-2B7E211A6D81"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f530000d7f2","org_name":"Evernote","org_type":"technology_saas","ransomware":null,"records_affected":50000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitalspy.co.uk/tech/news/a462959/evernote-resets-passwords-after-major-security-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/technology-21644317,"},{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/03/02/evernote-hacked-almost-50-million-passwords-reset-after-security-breach/"}],"summary":"A hacker or hackers attacked and may have accessed Evernote's online system. Evernote reset all user passwords as a precaution.  User names, email addresses, and encrypted passwords may have been exposed. UPDATE (03/09/2013): A total of 50 million users were told to reset their p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3705cd03b79df896e986866706312b9e560feabe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98E13D45-AEED-4AAA-A58E-8DEE83093970"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"2f1de2421d28","org_name":"European Union (EU)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/articles/510580/20131001/eu-cds-antitrust-investigation-data-leak-goldman.htm"}],"summary":"EU regulators sent 13 banks confidential information via DVD.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c8ff8a47787135bce2d7c63911fb8df6c12d3b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99C82927-59CC-49C5-B561-212590EDF30D"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"272f81b49ef0","org_name":"Eurasian Natural Resources Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.guardian.co.uk/business/2013/may/23/enrc-data-loss-hacking-stolen-laptop"}],"summary":"The mining group Eurasian Natural Resources Corporation, warned on Thursday that it may have lost internal data as a result of computer hacking and the theft of a laptop.  The problems add to a complicated picture for ENRC, a London-based but Kazakh-facing producer of minerals fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b180b58b2a1b32acc78d59f505cf878de78ae95f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B28C79D5-2476-4EC0-B54E-3B22FC48E108"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd96f9e2f155","org_name":"Etowah County Alabama","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timesdaily.com/news/state/article_fa6ae176-7953-5306-b5dd-05ac8b4a4b93.html;http://blog.al.com/east-alabama/2013/10/etowah_county_personnel_direct.html"}],"summary":"Etowah County authorities say the county personnel director has been arrested on charges of identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5210ebdfccff3b2648c837cb97a7c58f2fd02a36","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69FAAF0D-31BB-4A5F-BDAD-6F45C2743314"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"b85784375013","org_name":"Etihad Airways","org_type":"transportation_logistics","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gulfnews.com/business/aviation/etihad-probing-possible-data-breach-1.1649625;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.albawaba.com/business/etihad-investigating-2013-security-breach-involving-data-7000-customers-790334;"}],"summary":"Personal details of thousands of people who took part in the promotion are believed to have been leaked at a third-party company, which worked with the airline","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aae0be056a712cf182480164ebebdf4f14437dfa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC33D49A-4EE8-41D0-BB3C-1E0CBC4DE9E9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"ff842f3b712e","org_name":"ES Municipality of Tordesillas","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hacks-Tordesillas-Website-in-Protest-Against-Bull-Killing-Tradition-384777.shtml"}],"summary":"Anonymous compromise website of Spanish town known for slaughtering a bull as part of an annual festival.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c915d4f91173e289be7d2b9c79eba522a9dcbfd","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB56FC70-8D1F-4073-B1C5-A2BD25A0BF50"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"534cfc55d862","org_name":"Erskine Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.southbendtribune.com/2013-05-14/news/39263053_1_security-freeze-patients-computer-security-breach"}],"summary":"Virus outbreak in medical office affects devices that stored medical information. No evidence suggests that data compromise occurred. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d27210129917b7e17f0736c97eb9aea563546acb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17470D97-9346-415D-B3AE-E37B9837E092"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c54916d8604","org_name":"Erie County Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/21/erie-county-dss-investigating-health-data-breach/"}],"summary":"An audit revealed that several employees had not been following correct protocol for patient record disposal.  Employees had inadvertently exposed Social Security numbers, copies of birth certificates, personal medical records, tax returns, bank account information, inmate record","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ba3c8e634cfc3c593d35cac2b26bbff42d056fa","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE694F56-3C50-465E-B376-066C0C0B0FE8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee776572d10e","org_name":"Equifax Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://usnews.nbcnews.com/_news/2013/03/12/17287204-sophisticated-id-thieves-swipe-info-on-michelle-obama-beyonce-ashton-kutcher-and-others;"},{"fetched_at":null,"title":null,"type":"press","url":"http://redtape.nbcnews.com/_news/2013/03/12/17286101-celebrity-hackers-stole-data-from-annualcreditreportcom-equifax-says?lite"}],"summary":"The Equifax credit bureau confirmed Tuesday that criminals have stolen credit reports from AnnualCreditReport.com, the website designed to allow consumers free access to their own credit reports.  The theft  suggests criminals have outfoxed AnnualCreditReport.coms defenses, poten","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4add74533bc2af8c3078187296249d5c834a3db2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"664745CE-A24B-4C20-8527-96EFC0F7D918"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65330ceb6322","org_name":"Environmental Protection Agency","org_type":"government","ransomware":null,"records_affected":80000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/politics/2013/04/09/epa-acknowledges-giving-out-personal-info-in-request-that-included-data-on/"}],"summary":"EPA acknowledges releasing personal details on farmers, senator slams agency  FILE: Sept. 6, 2012: Dairy cows at the Sunburst Dairy farm are seen eating in Belleville, Wisc. (REUTERS)  The Environmental Protection Agency acknowledged Tuesday that it released personal information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4cf72aa84582cd2512add918f84c4f182a12161","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E715707E-2FF3-4095-8153-49FB19B65EE8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ee99609f02b","org_name":"Endurance International Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.com/hostgator-bluehost-are-down-due-eig-outage-1523952"}],"summary":"Web hosting company suffers availability loss w no disclosed cause.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db6badb7611ddb49b71374bded6b221c25690d4e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE530ACD-7205-445B-86BE-1D11D4DB1440"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"692e48ffaf0c","org_name":"Emory University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Emory-University-Suffers-Another-Data-Breach-Users-Advised-to-Change-Passwords-376610.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/officials-investigate-scope-of-emory-university-breach/article/307854/"}],"summary":"Emory University has suffered yet another data breach. Individuals who have an Emory University online account are advised to change their passwords.  According to a statement published on Emory’s website, security consultants and law enforcement are investigating the “informatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a686cb0a07e7a248233234c64cbc441f183c2a8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"031B28A0-E582-469E-B0D9-188B74CFA991"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"316ed2bd22b1","org_name":"Embassy Suites","org_type":"other","ransomware":null,"records_affected":44,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/two-skimming-devices-found-on-california-hotel-computers/article/333575/;"}],"summary":"Two skimmers were discovered on hotel check-in terminals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ca4694baf8c0a3d5da1ba2551c15e2b779a2b19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A314D0DF-4DF4-4BC8-B2AA-4EB1C00FA5B7"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7793f6ed7511","org_name":"Elightbulbs.com (SERVICE LIGHTING, INC.)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/03/the-long-tail-of-coldfusion-fail/"}],"summary":"hackers used cold fusion vulnerability to bypass authentication and upload malware to victim web server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a111fbc9813a261fe24a4ae9a9958a00b17667f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EE1FDDF-FBAB-4A6E-A8CF-B1827AB7CF5E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"844d653879ed","org_name":"Eli Lilly and Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=11137388"}],"summary":"Insiders sent trade secrets to rival company","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e36078b350616d5ea185102d2acbc896610a32d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B68DBE34-2C4E-4497-9714-099A5DC1577B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4a339af6c493","org_name":"ELECTRONICS CORPORATION OF INDIA LIMITED","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/indian-defence-contractor-hacked-leaked/"}],"summary":"hacktivist posted 21 documents containing emails, \"ads, brochures, samples, designs and diagrams of different electronic and satellites related products\" from web server of Indian defense contractor Electronic Corporation of India (ECIL)  www.ecil.co.in.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"10f53f0e1a83ec9479976b4f23c8b9abd9ab0c9c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19152A4F-B7D4-4490-8371-00B01A50EA6B"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02ca8252f850","org_name":"El Centro Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ecrmc.org/news-&-updates/&/view/event/id/118/"}],"summary":"On March 22, 2013, law enforcement notified El Centro that x-rays we had provided to a trusted vendor for digitization and destruction were missing from a storage warehouse and may not have been properly destroyed.  We immediately began a thorough internal investigation to determ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02bc2c9ef819643e946655578e914979737d9794","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C284F565-7DDB-4FF3-B278-65E3DE6B061B"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2666259dd0fa","org_name":"eHealth Saskatchewan","org_type":"government","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.paherald.sk.ca/News/Local/2013-11-07/article-3471271/Error-in-eHealth-fax-system-results-in-privacy-breach/1"}],"summary":"The eHealth Saskatchewan, the Treasury Board Crown Corporation responsible for the implementation of the provincial electronic health record, mistakenly faxed 18 results in the province to a private residence.  This error was caused by an employee entering the phone number in wro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3821055f5021694adb9ab3d059521cecd1e623c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A4218E8-7693-420B-AEC2-EAA543D2170C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"37209958d3c7","org_name":"Edinburgh Royal Infirmary","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scotsman.com/news/health/police_probe_hospital_patient_privacy_breach_1_1984317"}],"summary":"Janitor at hospital viewed patient information and contacted her via social networking site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8118b5c2b11baf2cb2d767faa4d4f32356cc561d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36480D84-EAEE-4F00-8C28-722078C5BA37"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a23c422e063f","org_name":"Edge Studio","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227162.pdf"}],"summary":"Their vendor's website was breached, exposing customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e9c87597b948dbf456b6864ae5b83be10997ec3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F67B07A6-20F9-4656-8B71-5A3F54B77487"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3813e00b97e4","org_name":"Eastside Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://github.com/vz-risk/VCDB/issues/897"}],"summary":"Thousands of pages of medical documents containing confidential information are back in the control of a  Eastside Medical Center i after being dumped across a busy Gwinnett County road. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27bebe823071bbadbad7ce1617f8835b048bd0b3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"343E62FE-8506-414C-8CA1-FD144CDB8208"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f33d7f509ed7","org_name":"Eastern Illinois University","org_type":"education","ransomware":null,"records_affected":430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dennews.com/news/e-number-spreadsheet-leaked/article_de603692-65e5-11e2-81ac-001a4bcf6878.html"}],"summary":"At least 65 students received information about the grade point average of 430 students during early January 2013.  The breach occurred when a spreadsheet that contained the information and the E-number of 430 students was accidentally made available online.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d390ae8abc3e25f3e4e09ef4afef5b5dfbd8e7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0767FCBC-0B6B-4BDA-AF90-7B986B4F27D9"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72da367c3a3f","org_name":"Dr. Stephen Secunda","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wesh.com/news/central-florida/volusia-county/hundreds-of-patients-medical-records-found-in-trash/22121784"}],"summary":"A Family Dollar store worker found hundreds of medical records that were tossed in a dumpster behind his Port Orange store recently. The records show patients show addresses, insurance information and social security numbers.  I think it is kind of scary that a doctor's office wo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1939c8caa8bc05335faaf4e3e67bc90596e018b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2FB0990-C5C1-4873-BDBE-C247EF16FAD4"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"896304de2cd7","org_name":"Dr. Sandra Bujanda-Wagner","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kdvr.com/2013/01/08/patients-personal-information-found-in-dumpster-outside-dentists-office/"}],"summary":"A viewer sent FOX31 a tip about medical records tossed in the trash at Southlands in Aurora.  “They should throw all this stuff inside a shredder you know,” says Steven Mendez of Aurora.  He’s talking about his and hundreds of other private dental records, including names, social","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"429bef532bb72caaf4846b2777ea96062b31e463","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3666CEDF-01CB-4879-88E3-B4CDFDFF247D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e255aae61e1","org_name":"Dodge County Tax Appraisers","org_type":"government","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://members.jacksonville.com/news/crime/2013-06-21/story/douglas-insurance-agent-charged-fraud-and-identity-theft"}],"summary":"Insurance agent used personal information to submit applications for insurance policies for 7 employees in order to receive the commisions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ed2d9c760c7897a8c37eb6f25830e3798016f61","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9382FA66-B788-46AB-9E7F-666069DC9DAE"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0c38817f87b8","org_name":"District of West Vancouver","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nsnews.com/news/residents-data-safe-during-breach-says-west-vancouver-1.603887"}],"summary":"The investigation has revealed several attempts to upload various files to the server. These attempts were unsuccessful. The nature of the files themselves is unknown. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d154c605bbe4ded955650458c48626348f935a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEE81C3B-352D-4E59-9C11-4C47CCFCA6EF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"711c228a2797","org_name":"Director's Guild of Canada","org_type":"nonprofit","ransomware":null,"records_affected":2041,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2014/01/05/the-directors-guild-of-canada-hacked-2000-credentials-leaked/#.Usin9UVZyDU.twitter"}],"summary":"A hacker using the handle legionnare aka ObeySec has yesterday leaked data from the directors guild of Canada. The leak was posted to paste bin and the target website was which is the directors guild of Canada who is a national labour organization that represents over 3,800 key c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff3035614d25655b7978a71f6554b957b4fd2c7d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3FA8166F-08C5-4795-B31C-8F273FBCA628"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"8e07cbe9e9af","org_name":"Deutsche Telekom AG","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telecompaper.com/news/deutsche-telekom-admits-staff-data-security-breach--963726"}],"summary":"There has been a breach of security of Deutsche Telekom employees' personal data, Handelsblatt reported. A company spokesman confirmed a report in Manager Magazin to this effect, and said a limited number of staff members have had access to employees' personal data that ought to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19fc0dfb4b19d1a92a6266147fcbddcdd8f3b7ee","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C841D130-132E-4939-A7FD-052171319F33"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19a2613aaa68","org_name":"Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":76000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2009/10/probe-targets-archives-handling-of-data-on-70-million-vets/"}],"summary":"The inspector general of the National Archives and Records Administration is investigating a potential data breach affecting tens of millions of records about U.S. military veterans, Wired.com has learned. The issue involves a defective hard drive the agency sent back to its vend","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34f5b733c32e4ecc8cedcd324d21e50980319283","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16EA1E32-3C6C-42EC-8412-1C0BCA2F549E"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"614d62ff06e5","org_name":"Department of Health Professions","org_type":"government","ransomware":null,"records_affected":43805465,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/attacks/virginia-health-data-potentially-held-hostage/d/d-id/1079193?"}],"summary":"An extortion demand posted on WikiLeaks seeks $10 million to return more than 8 million patient records and 35 million prescriptions allegedly stolen from Virginia Department of Health Professions.  The note reads: \"ATTENTION VIRGINIA I have your sh**! In *my* possession, right n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf3254da16cfd138490130789c2f073e3c005e4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C054BCD0-7514-4E04-93E2-654C61B5A3FF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"9fb3e073ea6b","org_name":"Department of Health Care Policy & Financing","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.heritage.org/2013/11/02/exclusive-healthcare-gov-users-warn-of-security-risk-breach-of-privacy/"}],"summary":"Healthcare.gov disclosed other users' PII to a user upon login.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1de54341803c732a48fa6eb4a3965a555e13ccb0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE48CF43-48E0-48E5-9B6B-8A4E6CFF1E72"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8aa5ab394f19","org_name":"Department of Energy","org_type":"government","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.wsj.com/cio/2013/08/15/department-of-energy-hacked-again/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.itproportal.com/2013/08/16/us-department-of-energy-is-hacked-again/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57598756-83/deja-vu-all-over-again-doe-to-workers-weve-been-hacked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://theleakingvault.com/news/2013/2/4/hackers-breach-us-energy-department-networks;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=14353;"},{"fetched_at":null,"title":null,"type":"press","url":"http://freebeacon.com/cyber-breach/"}],"summary":"The United States Department of Energy notified employees via an email Wednesday that hackers gained personal information, such as names and social security numbers, of 14,000 current and former agency employees as the result of a hack that occurred in late July. This is the seco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b032ee362d25df684783ce63a3faebc4fe1088ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9ABEB48-A807-4277-BE0F-79D335E6F662"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7462f1da9545","org_name":"Denny's Corp","org_type":"other","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azfamily.com/news/Job-applications-with-personal-information-found-in-dumpster-224333401.html"}],"summary":"Job applications containing PII thrown out in dumpster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2db93469da7cc8a338e7cbab2dd8e488476515d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38C0477B-17FC-48D9-8BA8-4A8E75DF6DD9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17d73529bb9f","org_name":"Defense Contracts South FCU","org_type":"financial","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Experian-Notifies-Customers-of-Defense-Contracts-South-FCU-Data-Breach-385034.shtml;http://doj.nh.gov/consumer/security-breaches/documents/defense-contracts-fcu-20130916.pdf;http://www.databreaches.net/experian-reports-another-breach-of-its-credit-report-database/"}],"summary":"The letter sent out to customers doesn't specify what happened. It only notes that certain Experian consumer information \"may have been accessed without proper authorization.\" The data includes names, addresses, social security numbers, dates of birth and account numbers.  Experi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da0738afc5af59d80d51732c1330a8e8d1ad0c39","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3392E644-0DCD-4523-876A-F4663614EB93"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"eaeb04700738","org_name":"Defence Research and Development Organisation (DRDO)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.saharasamay.com/nation-news/676525806/chinese-hackers-breach-drdo-security-steal-thousands-of-secret-files.html"}],"summary":"India Defense Dept claimed espionage from China, stealing thousands of top secrets of documents by accessing a web server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"DE","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69681b8fda09ecd48a4bdcd9fecbec3bf65960c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD316C89-D7B7-42F0-9A4C-7439D13C75D7"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"db61ceea73f1","org_name":"DE State of Saxony-Anhalt","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://translate.google.com/translate?sl=de&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.rp-online.de%2Fdigitales%2F18-jaehriger-hackt-sachsen-anhalts-rechenzentrum-1.3708932&act=url"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/german-teen-arrested-for-ddos-attack-on-government-web-site.html"}],"summary":"RP Online reports that an 18-year-old student from Hamburg, Germany has been arrested for launching a cyber attack on the official Web site for the German state of Saxony-Anhalt (h/t Help Net Security).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b45853a649032be217fcd6d0513614abbe4ac26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E94ACB97-0C60-490C-A525-9FD0B308D2B4"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d41addbfedf","org_name":"DC Sports, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/mahwah/Police_Mahwah_residents_report_credit_card_fraud_after_sports_apparel_vendors_computers_hacked.html"}],"summary":"Third party payment processor is breached resulting in payment card fraud against customers of embroidered sports clothing retailer. Other merchants are affected, but given the information that is publicized, modeling from the standpoint of the retailer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8217a9e465a540227baed54d5865ea0e01506d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10907CF2-6668-4188-80C3-D199D8B777CE"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63b135d7740b","org_name":"Dalton School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wbko.com/home/headlines/Student-Hacks-Public-School--279516992.html"}],"summary":"Exclusive school discloses names of students rejected in newsletter.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90fb4953a571314f16b37c9a588cc7047c58016d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8A3C389-C6C7-439A-B2CA-320B9CB51B2C"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e90b1c9cc099","org_name":"CVS Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/08/30/cvs-agrees-to-250k-data-privacy-resolution-with-maryland-ag/"}],"summary":"CVS pharmacy settled a case in which the attorney general's office alleged that they had been caught dumping patient health information documents in publicly open dumpsters. They settled the suit with a fine of $250,000 US. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef3c83cab454b2ab072e9507e6f4756fef4e6b30","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05E8DB48-D7D4-4118-9880-B6749D7507B3"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"dfd4691725aa","org_name":"Cupid Media","org_type":"other","ransomware":null,"records_affected":42000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/11/cupid-media-hack-exposed-42m-passwords/"}],"summary":"An intrusion at online dating service Cupid Media earlier this year exposed more than 42 million consumer records, including names, email addresses, unencrypted passwords and birthdays, according to information obtained by KrebsOnSecurity.  The data stolen from Southport, Austral","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54b87510fd675c5f0d813829b1ccc0f9b8952c64","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1259A7C-C7E1-4CB3-9475-E89D353350A6"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TW","org_id":"2a075cd4d186","org_name":"CTBC BANK CO., LTD.","org_type":"financial","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://focustaiwan.tw/news/aeco/201308220032.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Taiwan-s-CTBC-Bank-Fined-for-Leaking-Personal-Details-of-33-000-Customers-377856.shtml"}],"summary":"Bank publishes PII of over 30,000 customers on publicly facing website. Also fails to run standard checks in place to discover sensitive information disclosure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f417a7fb968cabd9f118e84ed60264278749693f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E24EC92B-B4F2-4EFE-9C8D-E351B3C6F313"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"ace2d5164492","org_name":"Crytek GmbH","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.welivesecurity.com/2013/08/07/crytek-is-latest-gaming-company-to-face-security-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gamefront.com/crytek-websites-taken-offline-due-to-security-breach/"}],"summary":"Gaming company suffers breach to three websites. User login data is considered at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3834945326b43d3ee8a6cd68bd5de65807212298","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D20D91D-D6DD-4AB7-8B6F-D6D70EB81ED5"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16ec24df2de4","org_name":"Covered California","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kfbk.com/articles/kfbk-news-461777/covered-california-under-fire-for-privacy-11891022/"}],"summary":"Covered California is under fire for giving out names of people who looked but didn't buy.  Officials with Covered California, the state's federally mandated health insurance exchange, has released the names of potential insurance customers to insurance agents.  The names were fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4bec6fdafea095d08f62d1f96889aa791a247ac","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84DEA969-B081-4E8C-B706-81D2422E1EEB"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0b5d74cccb6","org_name":"County of Bexar","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/news/local_news/article/County-employee-resigns-amid-search-and-seizure-4599564.php"}],"summary":"County purchasing employee steals computer equipment and resells on craigslist.org. One of his customers reported that sensitive county information resided on system which led to search of his residence and discovery of truckloads of stolen assets.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6575b403ce50de23694252fafffeb460d4f8b030","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"297E8B03-81D5-42EC-A91A-D1B4EB00AE8D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f28e9d31214c","org_name":"County of Baltimore","org_type":"government","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/baltimore-county-workers-personal-information-stolen/article/319162/"}],"summary":"The personal information of current and past Baltimore County employees was found on the computer of a man who was a former employee of an information technology contractor hired by the county.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32207670e6d142361f6cdc51e855192ccb4b2482","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E85BDCA9-7666-49FF-B619-92CC9769F14A"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ee4be6882cb","org_name":"Council on Foreign Relations","org_type":"government","ransomware":null,"records_affected":1350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://investigations.nbcnews.com/_news/2013/07/25/19682160-hacker-reveals-email-addresses-of-1350-council-on-foreign-relations-members?lite"}],"summary":"The government transparency website Cryptome.org has published 1,350 names and email addresses of corporate titans, media figures and policy executives who are on the Council on Foreign Relations.  The list includes hundreds of intelligence, defense, government and corporate heav","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80058cc632744ad058115650126276f30b2e20e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CF4EE2C-8950-44DF-8896-B961AEA061FF"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ec3325a4290","org_name":"CorporateCarOnline.com","org_type":"transportation_logistics","ransomware":null,"records_affected":850000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/11/hackers-take-limo-service-firm-for-a-ride/"}],"summary":"Unknown everything other than data found on a server with 850k payment cards and personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c863a1d374468e7fefc43ecfccf38a1469134819","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31B10B02-12DA-4A3C-905C-EFBBDDA6A2E1"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec1fc53742ca","org_name":"Consumer's Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cutimes.com/2013/07/22/former-cu-loan-officer-sentenced-in-federal-court?ref=rss"}],"summary":"A former loan officer at the $604 million Consumer’sCreditUnion in Waukegan, Ill. was sentenced in federal court last week to 35 months in prison and ordered to pay restitution for a scheme that involved $1.4 million in fraudulent loans, according to the U.S. Attorney’s Office in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29e9076c2347f03474fe901c6a46270a8b004b9b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBD0FB11-0861-403F-B40C-6DA5D57A1658"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6609ffac833","org_name":"Community Foot Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/texas-podiatrist-pleads-not-guilty-to-fraud-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://txktoday.com/news/local-foot-doc-gregg-petty-pleads-not-guilty-to-fraud-identity-theft/"}],"summary":"Local podiatrist Gregg Petty pleaded not guilty to fraud and identity theft at a hearing Wednesday in a Texarkana federal court. Petty, 52, appeared for arraignment with Texarkana attorney Thomas Johnson in the Texarkana Division of the Eastern District of Texas. Johnson entered ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ddcb40d73954402b7000ecf30e9b2c00b27f427","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"700A72DF-9C84-4E16-95A0-F6E0E95583E6"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"55bed4b95d5b","org_name":"Commonwealth Scientific and Industrial Research Organisation (CSIRO)","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2013-12-04/csiro-employee-suspected-of-espionage-report/5133032"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.smh.com.au/breaking-news-national/industrial-spying-probe-at-csiro-report-20131204-2yp7e.html"}],"summary":"Federal police and intelligence officials are looking into the activities of a Chinese national who until last week worked in the CSIRO's highly sensitive nanotechnology laboratory in Melbourne. It is understood the investigation surrounds whether he sent sensitive information to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30a4b60122d5f0761d40052386f5107967e06901","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1ED48E08-8DAF-4784-8720-F94BECC3864C"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09ec7010e501","org_name":"Colonial Properties Trust","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Colonial%20Properties%20Trust%20ltrt%20Consumers%20re%20Security%20Breach.pdf"}],"summary":"victim detected malware on network. Forensics investigation found that spreadsheet containing personal info was at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483a11cd621e709cf1270d6ce9d5b8f564314b77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D30B911-D73B-4ECE-ABAC-BA4B9810AACC"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9530b19d335b","org_name":"Coinbase","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/coinbase-admits-data-leak.html"}],"summary":"A flaw in Coinbase's systems cause the information of some merchants to be exposed.  Any merchant who created a \"buy now\" button, donate button, or hosted a payment page using Coinbase's Merchant Tools and posted a public link to it online had the page publicly visible on the int","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f17ab2bde27c5866a80e56da1dc42a33b0ce9922","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03EA3D0E-E90A-475D-9832-A3C2C369936A"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b64d0b9dd550","org_name":"Coast Capital Savings Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mondaq.com/canada/x/248576/Trade+Secrets/Enforcement+Of+Privacy+Policy+In+Steel+v+Coast+Capital+Savings+Credit+Union"}],"summary":"In a recent decision of the British Columbia Supreme Court, the Court upheld the termination for cause of a help desk analyst in the IT department who had been employed for over 20 years at Coast Capital Savings Credit Union. (Steel v. Coast Capital Savings Credit Union, 2013 BCS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f14055d767f432d2c289b136be0901eae1d02afd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18A73095-ECC0-47B8-B71C-849BF346C25D"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"ae05e9e01e8c","org_name":"CNWisdom","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/china-insider/article/1336456/website-leaking-chinese-hotel-guest-details-closed-down"}],"summary":"Allegedly due to a breach in hotel wireless provider partner, numerous hotels' guests' PII exposed to Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e7af6442674212753995f44a837487ee5a610fd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"069A3130-060D-4378-87FF-3DB3CD6B5EDA"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da674551a7e7","org_name":"Clinical Reference Laboratory, Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/ca%20ag%20crl%20client%20ssn_001_0.pdf"}],"summary":"Invoice with SSN and medical information lost in transit by USPS. Mail was damaged during processing and likely shredded.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0287d2b003fa0fdf3e4fadc4ae3532e1d8eeab18","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B9348220-43D9-4D97-A3F4-93C43B11732E"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13336a3d0ba2","org_name":"Cleveland Institute of Music","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-232168.pdf"}],"summary":"Hackers gain access to Cleveland Institute of Music web server. Unclear if non-public data was accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7106a5d22919148870598f05bc4a070aef86f143","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD3FE7DA-5062-46BB-9816-86E7DAF1DDEB"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32d4460e444f","org_name":"Clay County Magistrate Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2014/01/the-county-sheriff-who-keylogged-his-wife/"}],"summary":"On April 22, 2013, Miles J. Slack of Clay County, West Virginia made a bad decision. Slack was going through a divorce at the time and had grown concerned about his wife's relationship with an \"unnamed individual.\" So he entered his wife's workplace after normal business hours, l","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82b2dd27f187bf2e8fb6ce3795bdf52302f58032","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8297F79E-EDB7-4420-9A58-7F8B19136C75"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"19571cca3c49","org_name":"City of York Council","org_type":"government","ransomware":null,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.annualcreditreport.co.uk/tagged/data-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.yorkpress.co.uk/news/10249794.Council_launches_investigation_following_sensitive_data_breach/"}],"summary":"Personal and confidential information relating to 49 residents has been stolen from City of York Council.  Documents including names, phone numbers, dates of birth, NI numbers and past convictions were stolen while the council moved offices.  The Information Commissioner’s Office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14be604c11e81bffd290a90700eaf74eef0c10f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFE2511C-99DB-41C6-A0F0-9A941824318E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3355e83d98fc","org_name":"City of Valparaiso Ambulance Service","org_type":"government","ransomware":null,"records_affected":860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://posttrib.suntimes.com/news/porter/22190511-418/valpo-ambulance-users-could-have-had-personal-information-stolen.html"}],"summary":"Up to 860 people who used the citys ambulance service in early 2012 may have had their personal information stolen.  That includes Social Security numbers and birthdates, although so far theres no evidence that anyone who used Valparaisos service was affected.  An employee for th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53544a109bee5ce4a5b72cbd425dbdc0337cad70","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1337BBC1-E027-46B2-9B46-CC67F6B5E357"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"444f92519fb4","org_name":"City of Taylor Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenewsherald.com/articles/2013/12/02/news/doc529d0ecaeb2db420741345.txt"}],"summary":"Police officer misuses computer system to run unauthorized background ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbe75e105f489f94031c37474975e59ec81a7e1f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C318FA80-EA92-47C0-8C47-77682639C58C"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5d8258dacd7","org_name":"City of South Beloit","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wifr.com/home/headlines/Security-Breach-Investigation-212069791.html"}],"summary":"The city of South Beloit is on high alert after hackers got into the citys computer system.  Its city employees whose information could be at risk. The police chief says a hacker got into the sewer billing system and could have accessed employees personal information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5069e62d1789d95580f61fd4efaa8109a998cc80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A90237BB-737B-401D-8766-D9C3F3CCECE9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbbd327f6a37","org_name":"City of Mobile Police","org_type":"government","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkish-Hackers-Breach-City-of-Mobile-Police-Department-Website-352689.shtml"}],"summary":"NOT A DUPLICATE: Activist hackers gain access to police data and publish to Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a618c8f506932c1d86db527ae52b91c8c800aa8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB9514C3-75CB-4119-8E44-045FB131A952"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"2ce78766d7f9","org_name":"City of Joburg","org_type":"government","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thepost.co.za/joburg-billing-security-breach-1.1565943#.UhYUCbwd5Vs"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Flaw-in-City-of-Johannesburg-Systems-Exposes-Bank-Details-of-Citizens-377119.shtml"}],"summary":"a user noticed that by changing the four-digit ID in the website’s URL, he could access any of the 1.1 million accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"adadc06148bdbced76782f173bb0e57ee5d03a87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2707B212-6DAF-4616-A583-AE5713478723"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6d991e5d73a","org_name":"City of Jacksonville","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox30jax.com/mostpopular/story/City-Security-Breach-Of-Workers-Personal/AmT1--EKdEqCYCAv-dDUwg.cspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/city-of-jacksonville-suffers-security-breach.html"}],"summary":"City employee discovered document on internal website that contained PII, including SSN for all city workers hired since 2005. The document was not on a publicly accessible server, but was accessible by internal users that did not have a business need for that information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c97e9bf46bff79e81a84e315eb84d99dc3df293c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C831E1F-8B83-4F80-B6D6-FE032EEE9484"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"a911df1c061e","org_name":"City of Cuero, TX","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.victoriaadvocate.com/news/2013/dec/23/moravitz_indicted_sl_122413_228535/?news"}],"summary":"A former Cuero city secretary has been indicted for intercepting police department emails and passing along the information to \"people who shouldn't have it\".","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2922f74a4ead9b47c2dc3daa39d8eb6cb400d831","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7889E4B-2E36-4D30-903D-7DB8FB15F0D5"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63232620b637","org_name":"City of Berkeley","org_type":"government","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.sfgate.com/inberkeley/2013/04/22/berkeley-says-sorry-for-mistaken-breach-of-city-employee-privacy/"}],"summary":"A media group who regularly collects public employee salary and benefit information released Social Security numbers after they were mistakenly included in a file that the City of Berkeley provided.  The information was sent by Berkeley in March and the mistake was discovered in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3372e497fdf7070fe0f3ed85918facb8e213c63b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB2BDD6F-DB1E-4A92-9DB1-5D517468679D"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19771fea32c3","org_name":"Citigroup Inc.","org_type":"financial","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Citi-Exposes-Details-of-150-000-Individuals-Who-Went-into-Bankruptcy-369979.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.americanbanker.com/issues/178_137/through-software-glitch-citi-exposes-data-on-150000-customers-1060665-1.html"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/BK%20Redaction%20Fully%20Remediated%20Consumer%20Notice%20%282%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/BK%20Redaction%20Remediation%20in%20Process%20Consumer%20Notice_0.pdf?"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestreet.com/story/12058000/1/citigroup-fined-30m-after-analyst-leaks-research-about-apple-supplier.html?cm_ven=RSSFeed"},{"fetched_at":null,"title":null,"type":"press","url":"http://wallstcheatsheet.com/stocks/heres-what-citigroup-owes-over-leaked-apple-secrets.html/?a=viewall"}],"summary":"The personal information of 150,000 consumers who went into bankruptcy between 2007 and 2011 – including their social security numbers – were exposed after Citi failed to properly redact court records before they were put on the Public Access to Court Electronic Records (PACER) s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"064751ec575710f7a261a77e0b52695276c575ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0BC548B-5E1B-43F9-A0F4-6D395DDFC179"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"725911998306","org_name":"Citibank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://docs.ismgcorp.com/files/external/Criminal_Complaint_2013_10_22_19_35_53_114.pdf"}],"summary":"Group of baddies installed skimmers and cameras placed on ATMs at multiple Citibank locations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"IN","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1a2e49f6ac2c4d11e9f360bdba6f825af5e7a95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C6753D7-B367-4EC4-BEA4-851EF2BBB921"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"7157179e2fde","org_name":"CISCE India Board of Education","org_type":"education","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://deedy.quora.com/Hacking-into-the-Indian-Education-System"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackaday.com/2013/06/05/hacking-high-school-exams-and-foiling-them-with-statistics/"}],"summary":"Actor bypasses security by obscurity and obtains test scores for every student in India.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"BD","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb0006f886478fa7ab6a559448ab79b05af762e0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E19557EB-0560-484F-994C-B6D13F0E47F0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"3af07e130e66","org_name":"Ciara Foundation in Venezuela (ciara.gob.ve)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Government-Sites-from-Venezuela-Turkey-Indonesia-and-Saudi-Arabia-Hacked-by-BGHH-412437.shtml"}],"summary":"Bangladesh Grey Hat Hackers (BGHH) are protesting against the killing of innocent Muslims around the world by hacking the website of government organizations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28ea0be4778d7ec605e650b62af12d14f3eb3bd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89A02785-3B57-4652-9ECD-02F7FB084AE2"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"8cff17ee9471","org_name":"Child, Youth and Family","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/politics/8782552/CYF-blackmailed-after-privacy-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10889823"}],"summary":"A privacy breach by Child Youth and Family has resulted in the department taking legal action, claiming a woman was trying to blackmail them after it accidentally sent her somebody else's private information.  In a statement, CYF head Bernadine Mackenzie said the department had m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"559e4a6c675970fd55bb831bdf1c685889788073","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB33D829-B92E-4DF9-B4B8-B43E7E1CBEF8"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1062fac17ed","org_name":"Cheyney University","org_type":"education","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://philadelphia.cbslocal.com/2013/01/25/officials-at-cheyney-u-warning-students-about-personal-data-breach/"}],"summary":"an administrative email sent to all students on Thursday accidentally included a file with personal data - 2100 current and former students","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca996259c25553903f667ea13a8dc139180d07f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C0081AE-CA60-414B-84F2-C7FFEC39563D"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dc52b91a2767","org_name":"Chevron Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canyon-news.com/studio-city-man-sentenced-5-years-for-gas-station-scam/55459"},{"fetched_at":null,"title":null,"type":"press","url":"http://thepinetree.net/index.php?module=announce&ANN_user_op=view&ANN_id=36235"}],"summary":"Charged for ATM Skimmer ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cf50c6b7dc7f2cd1723c1bcadd4e1fc7a34a694","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE3705BD-BC20-4E1D-A467-26BD2D2D5B85"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://palmdesert.patch.com/groups/police-and-fire/p/man-admits-installing-skimming-device-in-la-quinta-atm-in-plea-deal"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/deputies-two-romanian-men-accused-skimming-chase-a/nZyQs/"}],"summary":"A 29-year-old Sun Valley man pleaded guilty Monday to felony charges for using an electronic skimmer to steal account information from customers at a Chase bank branch in La Quinta.  Vahe Ruben Yerkanyan pleaded guilty to one count each of burglary, forging an access card and usi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01897df3d38eb59d63c2c5958e4ba2f8dcdc69ac","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08B8D8B6-D0DA-474C-9466-FACC055FFD57"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65ceef11fdbc","org_name":"Certified Tax Consultants","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wokv.com/news/news/local/local-man-indicted-14-counts-stolent-identity-refu/nbm5B/"}],"summary":"Insider misuse leads to 14 counts of identity fraud. Tax consultant used information acquired at his company to conduct fraudulent transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2965e4e4a4dc14503cda61b0458685931694c849","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F56B0F3-DB31-45FD-B495-1FBFCFEFACAA"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8128a8eb6912","org_name":"Cerro Gordo County Iowa","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://globegazette.com/news/local/article_705bb77e-ac86-11e2-a767-001a4bcf887a.html#.UYLXKH9Ebeg.twitter"}],"summary":"Computer breach from somewhere in Europe.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a8193ac86170f4bcdb358721a60a11c227e7570","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C194C54-6EB4-458A-911C-D6E5F0BA1E69"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4fa13f618799","org_name":"Central University Of Tibetan Studies in India","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fireeye.com/blog/technical/targeted-attack/2013/04/new-targeted-attack-on-taiwanese-government-tibetan-activists-open-up-a-can-of-worms-graypigeon-hangame-shiqiang-gang.html"}],"summary":"Incident 2: threat actor sends spearphishing message leading to malware installation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2012-4681","CVE-2013-2423"],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8876a5b090e119bd97762e9677547820a7afb5b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3EB27F20-FAAD-4C7F-978D-FC9BDCA76FE2"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"fd3c96dbb23d","org_name":"Central Tibetan Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/official-tibetan-website-compromised-watering-hole-attack;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csmonitor.com/Innovation/Latest-News-Wires/2013/0813/Dalai-Lama-s-Chinese-language-website-hacked-warns-computer-security-firm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.technewsworld.com/story/78716.html"}],"summary":"The website for the Central Tibetan Administration, the official site belonging to the Dalai Lamas government in exile, was compromised by attackers who injected code that redirected Chinese speaking visitors to a Java exploit that drops a malicious backdoor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2012-4681","kev_added":"2022-03-03","name":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","days_listed_before_incident":-3348,"product":"Oracle Java SE"},{"cve":"CVE-2013-2423","kev_added":"2022-05-25","name":"Oracle JRE Unspecified Vulnerability","days_listed_before_incident":-3431,"product":"Oracle Java Runtime Environment (JRE)"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfab10f68322b58281818abff02a4c4350b6ed7c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C147422-3A5C-44BB-8499-170FB6CA518D"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8722bbd4dc63","org_name":"Central Laborers' Pension Fund","org_type":"financial","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach/"}],"summary":"A home burglary resulted in the theft of a CD that contained the information of over 30,000 beneficiaries.  The CD contained names, Social Security numbers, and dates of birth and was taken from the home of an accountant at an unnamed counting firm.  The three funds sued the acco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab9cfee2166c29c4642529e94231e6525dbbdb4c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF9F4DFA-4DED-45C1-BB76-2ADA0E639837"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"615b2b475741","org_name":"Catoctin Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wfmd.com/pages/localnews2.html?feed=119935&article=11016926"}],"summary":"Dentist office computer systems hacked.  HHS tool lists Patterson Dental Supply as an involved partner.  The article does not mention them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92e0dc31b6e461152efe17322919a569dd008408","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A029E259-0B9B-4405-AF1E-5AE74A8134BA"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1e6433ad8663","org_name":"Catholic Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/business-associates-failure-to-safeguard-nursing-home-residents-phi-leads-to-650000-hipaa-settlement/"}],"summary":"Business Associate's Failure to Safeguard Nursing Home Residents' PHI Leads to $650,000 HIPAA Settlement - Catholic Health Care Services.  OCR initiated its investigation on April 17, 2014, after receiving notification that CHCS had experienced a breach of PHI involving the theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"796980a00e6c90b6f7fbc142ca549234bc1ff774","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC8F4B84-EA63-4213-9279-5A43AA071E1D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38a7a528fbbd","org_name":"CaroMont Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/nurses-leverage-privileged-access-to-commit-identity-theft.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gastongazette.com/20150306/nurse-pastors-wife-pleads-guilty-to-id-theft/303069932"}],"summary":"The Gaston Gazette reports that Deborah Costner Taylor, 49, a nurse and pastor's wife in Belmont, North Carolina, recently pled guilty to identity theft and obtaining property by false pretense (h/t PHIprivacy.net).  While working as a nurse at CaroMont Regional Medical Center in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d6133bd3115fb5b8c021e8dc71370d5219f2d06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74573CBF-8677-4E70-9A47-C1953F901A2E"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75d7e73e8370","org_name":"CareFirst","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/11/carefirst-reports-three-separate-breaches-to-oag/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227126.pdf"}],"summary":"PHIPrivacy.net reminded us that many of the mistakes made in data breaches involve human error, as there have been three separate instances of CareFirst, a healthcare insurer, making patient mailing mistakes. In all three cases, CareFirst reported the incident to the Office for t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e02549c7c4fee7f559a5800ddc5f1423c5e99dcf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79CC2FA9-A20F-46E1-B4BA-BB8A51D45591"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"f62096bb61b7","org_name":"Capital One Financial Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2013-12-30%20Capital%20One%20Security%20Breach%20Notice%20Ltr%20to%20Consumer.pdf"}],"summary":"Former employee accesses customer information via undisclosed methods.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50a04ed9a003c0862b0aac824ce9639ec63c2dc5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E29FA58-DE29-47F1-821A-1E87BA3FE5C8"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"1f0adce8d675","org_name":"Capital Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/nova-scotia/doctors-warned-about-privacy-risk-of-old-fax-numbers-1.1391435"}],"summary":"Nova Scotia doctors are being warned about the risk posed by old fax numbers after a repeated breach of patient confidentiality in the Halifax area last fall.  \"We were alerted that a business person had been receiving faxes on a number that used to belong to a family physician,\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"547574ba1fea668fd93666f5545ab5022748bbb9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A096618-CA8A-4E81-9EA0-A36FFA1BE8A9"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c80635eba746","org_name":"Capella University, Inc.","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Capella%20University%20Security%20Breach%20Notice%20to%20consumer.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach-asc"}],"summary":"Employee emails unencrypted personal data for students to his home email address in violation of company policy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a95e302e626768fa227ef9dd0a4904e0775042b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A044A16-CD9E-45EA-AB57-4F9F7C3E1442"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1be894e1f43f","org_name":"Callaway Gardens","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/breaking-news/callaway-gardens-alerts-customers-about-credit-car/nX3g7/"}],"summary":"POS malware captures payment card data from hotel. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"692eb842ab950388b930df73ea2ae3210ff469cc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD3237B2-2FBD-472D-846E-F6ACDED62699"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad2ba00cec6d","org_name":"California Beach Erosion Authority for Clean Oceans and Nourishment","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.invincea.com/2013/10/k-i-a-state-of-ca-beacon-hijacked-kore-exploit-kit-serving-bestav-pony/?utm_source=securitybloggers&utm_medium=twitter&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29"}],"summary":"The website of the California Beach Erosion Authority for Clean Oceans and Nourishment (BEACON) was compromised and hosting redirects to an exploit pack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a50aeb12c8baf479612aa24333a5067b6614cea6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F53468A-A827-49EE-8429-5851DA7AD0F4"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BZ","org_id":"54693aa40691","org_name":"BZ Brazil Air Force","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/NASA-Hackers-Breach-and-Deface-Brazilian-Air-Force-Websites-399024.shtml"}],"summary":"BMPoC, the group of hackers who hacked a total of 15 NASA websites back in September in protest against the NSA spying on Brazil, is back. Now, theyve targeted several subdomains of Brazils Air Force (aer.mil.br).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ee8fd9d07eb48a534b72901353a12cc07928cee","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8B6451F-91ED-4407-8F51-31A68A1C5636"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"4b9a72bded15","org_name":"Buller District Council New Zealand","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.radionz.co.nz/news/regional/136292/council%27s-sensitive-documents-found-at-tip"}],"summary":"Confidential documents found at a waste disposal site. Documents were supposed to be buried but the contractor hired to dispose of the documents failed to do so.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fccc143438d865e2368058c229e7ba53253b84f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37CC8B28-EE54-43EB-BFAA-4D7C6CDAE6F9"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"018597dfa6ae","org_name":"BSNL","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/10/bsnl-telecom-india-hacked-by-pakistani-hackers.html?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+TheHackersPost+%28The+Hackers+Post%29"}],"summary":"BSNL gets hacked by the Pakistani hacker with the handle Ch3rn0by1. The Ch3rn0by1 hacker is a crew member of P4K M4D HUNT3RS hacking group.    ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de5a3b185371a435346700c76fe0d8983d6324a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E64C49A7-DA82-4421-9F18-0D4CC2F5C491"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18218a69215c","org_name":"Broward County Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.orlandosentinel.com/news/local/state/fl-court-clerk-id-theft-20131028,0,2828466.story"}],"summary":"A Broward County court clerk on Monday joined the ever-growing ranks of workforce employees convicted of using job-related computer systems to commit identity theft. he then sold the information to another person who used it to file fraudulent income tax returns. According to the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26a9f8f56448830bc6dc0bba673f2ab5a45d06c6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37DE7C25-598B-4DD4-9AF1-D3980BC5BD8D"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5dd195a2fde0","org_name":"Bridgemark Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://fox2now.com/2013/11/22/list-of-social-security-numbers-mistakenly-mailed-to-workers/"}],"summary":"A nurse says a long list of social security numbers were mistakenly mailed to workers.  Current and former workers received the mailing last week.  What people assumed was, routine mail, actually stunned some recipients.  Stephen Miller, of Bridgemark Healthcare, apologized for t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0e4600702be259e37a56401e4a4f2201e6e6307","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8149991C-EF0A-4582-B837-C5EE1F2A6108"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0a0d7ae48fd1","org_name":"Brandon University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/manitoba/brandon-university-website-shut-down-after-server-hacked-1.2186962"}],"summary":"The university sent a letter to students last week, informing them that one of their servers had been hacked and student information had been accessed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5925fb06016edd0948c6a678507f1c8115f0bf49","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BC53B42-7F9E-43FE-853C-98B1CAF2E84F"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a5b263cc0b9","org_name":"Boston Teachers Union Health and Welfare Fund","org_type":"financial","ransomware":null,"records_affected":506,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/boston-teachers-union-20130624.pdf"}],"summary":"Partner-administered web application / database was misconifgured in such a way that PII was publicly available and searchable. 506 employees' PII was at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8562ada24b29e1d4c9ac6d17a0d9141ee519db3b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A80F24F-20A7-48D1-BCF6-63A5C2BC1247"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74671e9448c2","org_name":"Boston Public School System","org_type":"education","ransomware":null,"records_affected":21054,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/lost-flash-drive-compromises-data-for-thousands-of-students/article/307298/"}],"summary":"More than 20,000 students across 36 schools in the Boston Public School (BPS) system had their data compromised when the district's ID card vendor Plastic Card Systems lost a flash drive containing the information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IE","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08ef3700551984ad86107717d97fb6b374817170","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29ED02AF-F3B9-4499-A80F-256C20E1515B"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"158c07f5d818","org_name":"Bord Gais Employee Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/news/laptop-stolen-from-credit-union-1.1065762"}],"summary":"  The office of the Data Protection Commissioner is to conduct an investigation after a laptop with information pertaining to up to 900 Bord Gáis employees was stolen from a Dublin-based credit union.  The laptop, which was password protected but not encrypted, contained the name","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"312a7d498cff5cc2b922d5dc932a3192f282334e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C3DD443-9390-4752-9C37-E625CF96A165"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f0978cb8a236","org_name":"BOLTON NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisislancashire.co.uk/news/10343269.Hospital_faces___500_000_fine_over_lost_patient_notes/"}],"summary":"BOLTON NHS Foundation Trust could be fined up to 500,000 after notes containing confidential information about 25 patients were found in the street.  The data breach has been passed to the Information Commissioner which has said it will determine an appropriate response.  The com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a66674c12570ee3424aeda7141982ebd8a3bd55a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DB3F0A1-FCDA-4468-AE7B-5090DD52BF0D"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CZ","org_id":"733483204fc9","org_name":"Bohemia Interactive","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.escapistmagazine.com/news/view/125917-Bohemia-Hack-Snags-User-Data"}],"summary":"Gaming company hacked via unknown methods, usernames, e-mails, and password hashes were disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcd01939a57a1f11a2a8770cdcca8d0eb0c3bfef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"349D5E9F-89F9-4009-A435-57F5B02905BF"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84d8a724a79f","org_name":"Boger Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://kstp.com/article/stories/s3231397.shtml"}],"summary":"Criminals broke into a Plymouth dental office stole a safe with customers' credit card and check information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b9bf8fa2b8aa76f70e9b7976e03b6fd0a215867","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADC3CE6B-39C3-4868-B6DB-A2BE474BBDF4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49c718f16941","org_name":"Boca Raton Regional Hospital, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/southflorida/news/2013/02/05/boca-raton-hospital-employee-among.html"}],"summary":"Federal authorities charged eight people with identity theft for filing fraudulent federal tax refunds in five separate cases, including that of a former Boca Raton Regional Hospital scheduler.  Shalamar Major had access to the personal information of the hospital’s patients and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9297a9628682fc6609221049b47c589a2a7d1c1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17B25242-FC0D-4E9A-8168-641EECDEC31D"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e301ba084e44","org_name":"Bluewater Health","org_type":"healthcare","ransomware":null,"records_affected":17,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theobserver.ca/2013/01/28/privacy-breach-at-bluewater-health;"},{"fetched_at":null,"title":null,"type":"press","url":"http://blackburnnews.com/sarnia/sarnia-news/2013/01/28/patient-privacy-breach/"}],"summary":"Hospital staff have reportedly been fired after a privacy breach at Bluewater Health.  Multiple sources told The Observer Monday as many as 17 people were dismissed after non-clinical staff accessed patient information through a password-protected system  without authorization  e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fae349622167c88850e6a10ea9a7f93ac3763e86","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB53CB03-6BED-4E8D-8F99-012071C29E9C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79181b7e34e8","org_name":"Bloomberg LP","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2013/05/11/business/media/privacy-breach-on-bloombergs-data-terminals.html?pagewanted=all&_r=3&,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.waterstechnology.com/inside-market-data/news/2290341/bloomberg-makes-public-results-of-client-data-breach-investigation-details-new-procedures;http://www.washingtonpost.com/lifestyle/style/after-bloomberg-news-disclosure-fed-and-treasury-assess-possibility-of-privacy-breach/2013/05/11/6037d7c4-ba78-11e2-b94c-b684dda07add_story.html"}],"summary":"Bloomberg News reporters were able to monitor clients' usage of data terminals leased from Bloomberg LP.  Goldman Sachs is one of the companies that has complained publicly while JP Morgan Chase, the Federal Reserve, and the United States Treasury Department have started investig","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e15e32fff21eb0eb62aa3b717b2dcb48381093eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFA363B6-1D48-4371-85D8-0473A86DEB8B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f290d94bd99","org_name":"Bit9, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/02/08/cybersecurity-attacks-idINDEE9170GK20130208,"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread-malware/,"},{"fetched_at":null,"title":null,"type":"press","url":"https://blog.bit9.com/2013/02/08/bit9-and-our-customers-security/"}],"summary":"Hackers were able to exploit a vulnerability in a web application and use an SQL injection.  The breach occurred in July of 2012, however the server was shut down until January of 2013. Hackers then used Bit9's systems to attack other organizations who relied on Bit9 as a securit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89e9e0ac09c1ba7622894d6e0177a3685c4c4df8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6358E8EF-A84E-46DD-8628-6BF62C519D99"},"incident_date":"2013-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33e501c45153","org_name":"Biogenesis of America","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bentcorner.com/the-curious-case-of-alex-rodriguez-and-his-stolen-medical-records/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/sport/2013/apr/12/mlb-biogenesis-employee-documents-drugs"}],"summary":"Word on the streets is that Major League Baseball and Alex Rodriguez will soon come to an agreement concerning a suspension for using performance enhancing drugs (PEDs). Rodriguez has never failed a drug test, at least not officially, yet commissioner Bud Selig and his minions wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86b438e9d15f2deb1e0a60b7a1f1cd55efc13463","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93F33578-5F3E-4255-AD6B-73912A227DE8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"77db0ae1e0a6","org_name":"Billabong International Limited","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/2-Billabong-Domains-Hacked-by-ZHC-in-Protest-Against-NATO-and-the-US-403202.shtml"}],"summary":"A couple of domains of Billabong, the Australia-based clothing company, have been hacked by members of the famous hacktivist collective ZCompany Hacking Crew (ZHC). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bc8187bf828425a4afa43e60eb21f781ccdf5b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C051617-5B99-4747-9908-0470682548EF"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f5fc98229a4","org_name":"Big Brothers, Big Sisters","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.freep.com/article/20131211/NEWS06/312110147/Big-Brothers-Sisters-identity-theft-prosecutor"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc12.com/story/24204456/big-brother-big-sisters-worker-charged-with-id-theft-of-volunteers"}],"summary":"A Flint woman has been charged with identity theft and a federal prosecutor is one of the victims, according to court documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9b6446f936fd34481d0b0685a3338c4027ea8bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAAA2C79-FDD1-4BFF-9ACF-245D7310DFF4"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"e4c9be03e687","org_name":"Beypazari State Hospital","org_type":"healthcare","ransomware":null,"records_affected":132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/06/01/beypazari-state-hospital-hacked-data-leaked-by-st0rmyw0rm-for-occupygezi/"}],"summary":"A hacker collective who uses the handle @st0rmyw0rm has just announced a leak from a Turkish government website.  The leak is in relation to the on going protests that police have turned in to what looks like a war zone in Istanbul over night.  The site that has been attacked is ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b81e143ebc5df28339b584582ecc74d5a4109f2c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0AC1ECF6-7E6D-472A-8751-9547FF55D023"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f3c40f94b59f","org_name":"BENTON'S ADULT FOSTER CARE","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://record-eagle.com/local/x1084951028/Group-home-worker-accused-of-identity-theft"}],"summary":"Internal Misuse: employee gains credit cards in the name of group home employees","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2568bea27d155e5e3139d83614f307889a9ef319","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D309C7A3-353C-40D4-ACF0-A2D59C1FB2C5"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1802cda50633","org_name":"Benny's Pizza","org_type":"other","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10tv.com/content/stories/2013/03/07/marysville-restaurant-credit-card-folo.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbc4i.com/story/21551253/marysville-police-say-hackers-to-blame-for-hundreds-of-stolen-credit-card-numbers"}],"summary":"Point of Sale compromise leads to capture of restuarant's customers' payment card information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96c71f65e08a8f7fd92195941cbb2100a22d94ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60F46D3F-BA4F-462C-B258-4D85838D943F"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"84a19c49b28b","org_name":"Benesse Corporation","org_type":"professional_services","ransomware":null,"records_affected":46000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2014/07/09/national/benesse-data-leak-may-affect-20-million-customers-including-children/#.U87wEFaFr7R;"},{"fetched_at":null,"title":null,"type":"press","url":"http://the-japan-news.com/news/article/0001420125;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3531228/systems-engineer-arrested-in-massive-data-leak-in-japan/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.4-traders.com/BENESSE-HOLDINGS-INC-6491425/news/Benesse--Stolen-Benesse-info-likely-used-by-English-school-operator-ECC-18759290/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2014/07/22/national/crime-legal/benesse-data-theft-suspects-smartphone-info-22-6-miliion-customers/#.U87wFVaFr7R;http://www.bna.com/japan-ministry-amend-n17179895732/"}],"summary":"Information leaked from Benesse Corp. includes personal data on people who never had a contract with the company, its parent company said Tuesday.  According to Benesse Holdings Inc., the data not only dealt with customers of the subsidiarys mainstay education services, but also ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d3d4d4ea09136771a38950fc308377bc4de8ce0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07A7BCEB-DE3D-4AB7-B2ED-F811F2D577EC"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d29cb5bcaae","org_name":"Bellington Police Department","org_type":"government","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/12/hacker-sent-emails-from-hacked-police.html"}],"summary":"an account of a police officer has been hacked by cyber criminals and sent around 500 emails from the hacked account. - See more at: http://www.ehackingnews.com/2013/12/hacker-sent-emails-from-hacked-police.html#sthash.ZQ0lI1kC.dpuf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89d5f5eef68466b58754d61e78b252f1bbb2b6e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EA12AA80-38B5-4571-9CA7-D84F3E7C5E40"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00144c6c8f85","org_name":"Bell Helicopter Training Academy","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bell-helicopter-training-20130809.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/helicopter-training-academy-notifies-former-attendees-of-breach/"}],"summary":"The Forth Worth- based business learned in July that some former attendees had received spam e-mails that appeared to originate from them. On investigation, they discovered that someone had obtained information from an older database that contained email addresses and credit card","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f84549de2df9b31651cd5378a54ed8a2b9409dc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31DB8E49-1C7D-4719-88A6-5B429A2435D9"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"1a267a84368d","org_name":"Belgian ADIV","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mo.be/?q=en/article/serious-cyber-attack-hits-belgian-military-intelligence-service"}],"summary":"During routine end of year system clean ups the Belgian ADIV (= Algemene Dienst Inlichtingen & Veiligheid / General Service Intelligence & Security) found a highly complex piece of malware on their systems. It was beyond their ability to clean it up so they sought the help of the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"691865948e2376b363afe605d207f4505582945d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2779150A-7311-4E52-9188-8B71FAFE6BC9"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e7712f000fb","org_name":"Behavioral Health Network, Inc.","org_type":"healthcare","ransomware":null,"records_affected":190,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wwlp.com/dpp/news/i_team/medical-records-discovered-in-dumpster;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wggb.com/2013/07/03/behavioral-health-network-notifying-patients-of-unsecured-medical-records/"}],"summary":"Behavioral Health Network, Inc. is in the process of notifying nearly 200 people that their personal patient protected health information records were found unsecured in a dumpster on their property.  BHN made the discovery on Monday finding about 190 patient records in the dumps","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9a393ec7536138c65337fa25a4824036ce83ba9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E383085-EFF4-4C41-BC85-BD74BA920000"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BD","org_id":"b6d3c0fa7444","org_name":"BD Government","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Anonymous-Hackers-Target-Website-of-Prime-Minister-in-Operation-Bangladesh-412749.shtml"}],"summary":"Hackers of the Anonymous movement have resumed the anti-government campaign dubbed Operation Bangladesh (OpBangladesh). Over the past hours, theyve targeted at least three government websites.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"468237038898c31a8c79f5bcd47da1c7cf957a93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE6FB15A-2640-44E4-9049-2C1188CC3725"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd992b7b697e","org_name":"Bashas' Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://supermarketnews.com/retail-amp-financial/bashas-cites-malware-customer-data-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://supermarketnews.com/blog/lessons-bashas-sprouts-data-breaches,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/network-hack-linked-to-card-fraud-a-5483/op-1,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/blogs/taking-security-beyond-compliance-p-1424/op-1"}],"summary":" Bashas’ here said Tuesday that it was the victim of a cyber-attack through which the perpetrators appear to have gained access to customers’ payment-card information.  “Bashas' is and has been compliant with all Payment Card Industry [PCI] security requirements,” the company sai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"18c34a34dbb41c08650fb21db8a428a82488d570","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AD85AB2-E09D-4170-9B2C-9CF36A6A84DA"},"incident_date":"2013-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"57eb56f1d350","org_name":"Barclays Bank PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2426519/Gang-arrested-1-3million-Barclays-hijack-plot-carbon-copy-Santander-scam.html#ixzz2fQ9C2vtE;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.standard.co.uk/news/crime/cyber-gang-steal-13m-by-hacking-into-customer-accounts-at-branch-of-barclays-bank-8828806.html"}],"summary":"Criminal group uses social engineering to install KVM into bank workstation. Employee screen was replicated on external actor's screen and information was used to commit fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98ec33ba78d52d4936c5e93ba22d67ef04d72980","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6AE50671-71FF-465E-ACC8-6D6077E054B6"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4647add2a64f","org_name":"Baltimore Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.baltimoresun.com/2013-06-05/news/bs-md-ci-ashley-roane-20130605_1_tax-scheme-pretrial-release-pre-trial-release"}],"summary":"A U.S. District Court judge has released a Baltimore police officer caught in a drug dealing and tax-fraud investigation from federal custody until trial.  On Tuesday, U.S. Magistrate Judge Stephanie A. Gallagher allowed Baltimore police officer Ashley Roane, 25, pre-trial releas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2029529a0af0bb4443c74d01e3fc35c7ed9fa345","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF80140B-087F-4800-875F-F80DFC3A7B74"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd79a55ae2c0","org_name":"Bailey's Health Center","org_type":"government","ransomware":null,"records_affected":1499,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://herndon.patch.com/groups/business-news/p/patient-information-at-fairfax-county-health-clinic-compromised;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/va-fairfax-county-health-notifies-1499-patients-after-subcontractor-error-exposes-info-online/"}],"summary":"File containing medical records was erroneously stored on an unsecured, Internet-facing server. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b41d5d513dc834b29db38707df58ee9cca6b6ed","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31486C61-3446-47CB-8C8D-1891BA317F94"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f4895abc540","org_name":"B N Roy & Associates PC","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pittsburgh.cbslocal.com/2013/11/12/local-doctor-sues-after-electronic-billing-co-loses-data/"}],"summary":"Billing company loses 1000 of physician's records. No evidence of data compromise, modeling from as Availability loss.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f36bf149d8cecb73b3a1a8f1d250de400ed0216","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"458EDE78-6ADF-49B0-99F6-29310B84CC3B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3b9c675c587","org_name":"B&G Foods North America, Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/B%26G%20Foods%20Consumer%20Letter_0.pdf"}],"summary":"Unknown web application attack exposed personal information and payment card information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"835288aaf9edca2d96fef3126243359daab2cc95","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00224226-4A39-435C-BFFD-672B5D61C7C1"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AZ","org_id":"f2b6d24d80ea","org_name":"Azerenerji","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/09/04/7gb-data-leaked-from-azerenergy-azerbaijans-largest-electrical-power-producer/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CyberWarNews+%28Cyber+War+News%29"}],"summary":"leaked info from Azerbaijan electrical producer","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e9727ec8a52f83187a890f89e93fe8631be3d49","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"377B27C8-FC74-47A0-9BA0-919CBC1A5C8D"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"18e504c06757","org_name":"Axis Bank Limited","org_type":"financial","ransomware":null,"records_affected":37,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.novinite.com/articles/154432/CCTV+Frames+Two+Bulgarians+for+ATM+Skimming+in+India"}],"summary":"Mumbai police authorities have obtained CCTV coverage to implicate two Bulgarians in an ATM skimming scheme.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d980a2ed1831d53bddef3f0d8d2cd98bde6b5207","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EAEB8638-673C-42FF-AB43-92AAAEC780A4"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VE","org_id":"cdf65c0d5e22","org_name":"AVEGID","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Venezuelan-Military-and-Government-Websites-Hacked-by-Anonymous-391564.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/10/anonymous-venezuela-hacks-venezuelan.html"}],"summary":"Anonymous Venezuela defaces several sites, this is modeling AVEGID.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SA","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"183d6059d9c134bcb78dbe6283b8d8c75a610a50","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"762133A8-E08E-4EC4-8FCB-67EA50132159"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"66ee7389e662","org_name":"Auto-Dress.ru","org_type":"retail_ecommerce","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/06/02/auto-dress-hacked-1800-credentials-leaked-by-group-hp-hack/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.anonpaste.me/anonpaste2/index.php?14ee93b7d1658d80#XINjEVAc5K8NItDf3gSFuzUWwDtOl1I/h8wWZW7KvJ4="}],"summary":"An after market automotive accessories website has become victim to a data leak caused by an activist group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7c7f6454f22b006ee7c3c89a19730862f71c3dc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80E107ED-1E0F-4FEE-8F18-88FF7D834E86"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"19fd68e7cebd","org_name":"Australian Competition and Consumer Commission","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Australian-Competition-and-Consumer-Commission-Exposes-Subscribed-Email-Addresses-437523.shtml"}],"summary":"Mis-published user emails to public accessible web location","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"775c3d9d7b714e8522862b4d68bc0c7a44514fda","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"253F7278-D6AF-4D12-B0D6-F61862562734"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e45fedb5afde","org_name":"Aurora Energy","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytelegraph.com.au/news/national/gps-breach-sees-aurora-workers-ready-to-strike-over-security-fears/story-fnjj6010-1226750052311"}],"summary":" GPS network of energy workers' vehicles compromised. PII and customer details are disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b307e5bdc5ed1f967b875fdc35d92133a9c701c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18060EFC-6A9D-41EF-B66B-352A19933DF7"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3bd4195b2584","org_name":"Audibel Hearing Healthcare","org_type":"manufacturing","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://web.archive.org/web/20130624002442/http://blogs.clarionledger.com/consumerwatch/2013/05/06/clinton-resident-going-to-prison-for-id-theft;http://blogs.clarionledger.com/consumerwatch/2013/05/06/clinton-resident-going-to-prison-for-id-theft/;http://www.ago.state.ms.us/wp-content/uploads/2013/08/May-6_Clinton-Resident-Going-to-Prison-for-Identity-Theft-and-other-Crimes.pdf"}],"summary":"Clinton resident going to prison for ID theft Posted on May 6, 2013 Identity theft victims often lack the satisfaction of seeing the perpetrators of these crimes brought to justice, or even knowing who cheated them. But sometimes, justice is served. A Clinton woman has been sente","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7126a1f87e025c222a85fa4e8187cb96ea6e0ad1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3C3FDA5-85CC-4ECC-9BD2-EE720822BA08"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"24aa144dd486","org_name":"AU eHealth Record System","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2013-09-17/man-sent-someone-elses-ehealth-details/4963268"}],"summary":"An Adelaide man who was mistakenly sent another person's confidential eHealth login details says he is concerned about the apparent privacy breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4a233d15e839ae54cf1d42d4f5114283e51a18b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8ADDCEB-9294-4B9D-B9A5-9D01CFDFAEC0"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"3ccba94b0771","org_name":"Asiana Airlines Inc","org_type":"other","ransomware":null,"records_affected":47000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreatimes.co.kr/www/common/vpage-pt.asp?categorycode=123&newsidx=209639"}],"summary":"Tens of thousands of items of sensitive passenger information have been leaked on the Internet in a large-scale private data breach against Korea's second-biggest airline, Asiana Airlines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb79ea6cf0713bbabb265621a45b8ae17636e81d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37D97D72-87C6-47CD-B697-CA051E00022B"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c78ed854fc1","org_name":"Arkansas State University","org_type":"education","ransomware":null,"records_affected":215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://pinboard.in/cached/56116a0f6298/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kait8.com/story/21557312/asu-employees-still-affected-by-security-breach"}],"summary":" Arkansas State University says more than 200 university employees have been affected by tax fraud this year — but the school hasn't yet identified how the employees' personal information was obtained.  Arkansas State first said in February that fraudulent tax returns had been fi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd40118a0b32da8ca52694bc00060b16632aeaa9","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81EAF294-DBDA-4A1F-ABBA-9A51ADCA6919"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"7d6dfc47818c","org_name":"AR Sergio Massa","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Argentinian-Opposition-Leader-Sergio-Massa-Hacked-394772.shtml"}],"summary":"Hacktivists of Team Hacking Argentino have breached and defaced the official website of Sergio Massa (sergiomassa.org), the leader of the opposition in Argentina. The attack came just before the start of the legislative elections that took part in the country on October 27.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4767634090a9879d0e6944f8317c3d5e17aed436","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7124DCE6-7EFC-41A6-B42A-327AB259F76B"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"4769cb81343e","org_name":"AR Argentina Military","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2013/11/union-of-reserve-officers-of-armed.html"}],"summary":"Last week, the Argentinian hackers defaced a website belonging to Argentinas military. They claim they havent deleted any important data. Instead, they simply wanted to show that security doesnt exist in Argentina.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5bd236f629dc7781fce62597dd6f30e75a7a65d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A2A50DB-9F52-4459-A532-2A297556E189"},"incident_date":"2013-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fastcompany.com/3006046/fast-feed/apple-suffers-major-security-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57573720-83/apple-facebook-hackers-hit-car-and-candy-companies-too/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/02/19/us-apple-hackers-idUSBRE91I10920130219?goback=.gde_36573_member_215647969"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/10/04/quotw_first_week_october_2013/;http://www.technewsworld.com/rsstory/79110.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scribd.com/doc/172955029/13-10-02-Order-Re-Apple-Motion-for-Sanctions-Against-Samsung"}],"summary":"Apple detected malware on employee computers.  A small number of employee computers had been affected after their users went to a website for software developers.  Facebook, Microsoft, and Twitter experienced the same breach around the same time.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c517d5a97b2f86518ef35319ea0b2f3cbf70858c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E56149D9-516C-42B0-8EE6-4605CB4DADAE"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"2cfd4ce6138c","org_name":"Append-Hc.com","org_type":"technology_saas","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/irans-web-defacement-archive-website-hacked-database-and-thousands-of-accounts-leaked-by-oxalien/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Defacements-Archive-Append-Hc-Hacked-User-Credentials-Leaked-375805.shtml"}],"summary":"OxAlien, known for his high profile Virgin Radio Dubai hack is back in news by breaking into an Iranian based cyber crime and events archive website, as a result the database and 2000+ login accounts have been leaked online.  The site is not government owned yet contains massive ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe29c2a533b525eee2a3d17e339973eb850a8dc7","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91F5021B-F61D-4084-82C7-18722B836880"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"cc8bebf02420","org_name":"AO Republic of Angola Embassy in Spain","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackread.com/moroccan-ghosts-hacks-angolan-embassy-site/"}],"summary":"The online hacktivist group Moroccan Ghosts have hacked and defaced the official website of Republic of Angola Embassy in Spain against alleged decision from the government of Angola to ban religion of Islam and shutdown all the mosques in the country.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"SY","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b193749b803a521ddad6877892056763be3c497","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8AC347A0-4105-4AA6-8866-AFC924ABFCDB"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SY","org_id":"4430bc960b14","org_name":"Anti-Shabiha.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Syrian-Electronic-Army-Hacks-Anti-Shabiha-Website-for-Supporting-Armed-Terrorist-401103.shtml"}],"summary":"The Syrian Electronic Army has hacked and defaced Anti-Shabiha.com for allegedly publishing the details of innocent Syrians. Shabiha is the term used to describe groups of armed men dressed in civilian clothing that support the Al-Assad government. Theyre said to be mercenaries u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b01622007d173a36fe14f87f75b447547b874f2c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A30DD0B-7E11-49D1-8724-16382B8EB577"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"4bf27173ae36","org_name":"ANGLO IRISH BANK CORPORATION PLC","org_type":"financial","ransomware":null,"records_affected":77,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://businessetc.thejournal.ie/ibrc-employees-data-breach-1051450-Aug2013/?utm_source=shortlink"}],"summary":"Misdelivery of PII and checks occurred during mailings by liquidator to customers of liquidated bank.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a21f9c5fcddc139f7c31f3fdba1a0a2e804721b1","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Encore%20Tickets-C2012106044%20CA%20AG%20Letter%5B1%5D_1.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sprouts-C2013027013%20CA%20AG%20Letter_Customer%20Letter_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37221"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Encore%20Tickets-C2012106044%20CA%20AG%20Letter%5B1%5D_1.pdf"}],"summary":"American Express notified cardmembers that a merchant’s website had unauthorized access and files may have included card account numbers, names, and expiration dates.","supporting_quote":null,"technology_involved":["merchant website"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"FR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20d2ec6f129b5c7a534fa3c65be2d152824726de","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAABDB34-2C7E-4491-863A-0D465FA02FBA"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02e83b7c34f3","org_name":"American Choral Directors Association","org_type":"nonprofit","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/american-choral-directors-association-pakistan-higher-education-commission-hacked.html"}],"summary":"A French teenage hacker who goes by the name \"Hacker Fr0sty Fr0ze, hacked the American Choral Directors Association and published stolen data online.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c61f8caa74825fcf4be67d94db40430a92b27bf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E892301C-70B1-4264-9232-1C3BDA59B492"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BO","org_id":"1de94591c855","org_name":"Amaru Bolivia","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hacked-Bolivian-Tourism-Site-Used-for-Secret-Shopper-Scam-389754.shtml"}],"summary":"Bolivian tourist site was compromised and a fraudulent secret shopper site was installed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0d7b81bfa9de623ecb6f7941ca9b1884ed77598","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FFFE252-DD8B-4E66-B3FB-961F1658705E"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0eaf8eb501a","org_name":"Alpha Ambulance Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fbi.gov/losangeles/press-releases/2013/owners-and-supervisor-of-ambulance-transportation-company-plead-guilty-in-los-angeles-for-roles-in-ambulance-fraud-scheme?utm_source=twitterfeed&utm_medium=twitter"}],"summary":"The owners and supervisor of Alpha Ambulance Inc. (Alpha), a now-defunct Los Angeles-area ambulance transportation company, have pleaded guilty in connection with an ambulance fraud scheme.  Acting Assistant Attorney General Mythili Raman of the Justice Departments Criminal Divis","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1c82af4180027105742dacc9519cd7ce0f04d5b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69A77A6C-4169-4DA7-93F6-36FDAE52D796"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"20ea7da0b4a4","org_name":"All Source Medical Management","org_type":"professional_services","ransomware":null,"records_affected":46000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/10/10/scottsdale-dermatology-clinic-endures-billing-firm-breach/"}],"summary":"Employees at medical billing company steal patient data for identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"PK","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04c87e23b702c9ab79c282670be8bb2552771c0f","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85ED361A-C97C-4F3B-8F65-18426F883324"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"87407ca69788","org_name":"All India Anna Dravida Munnetra Kazhagam (AIADMK)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Website-of-Indian-Political-Party-AIADMK-Breached-by-Pakistani-Hackers-396805.shtml"}],"summary":"The official website of All India Anna Dravida Munnetra Kazhagam (AIADMK), the ruling political party in Tamil Nadu, India, has been hacked and defaced by Pakistani hackers. The Pakistani Haxors Crew defaced aiadmkallindia.org with a message that read slam Zindabad , Long Live Mu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3057829aabe12d18695b4e3776c7bf806b78bb3","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05919830-028D-4BF3-A061-1B7DDDED4BF8"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"376d322ad615","org_name":"Alexza Pharmaceuticals","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Turkish-Group-Hacks-Website-of-Alexza-Pharmaceuticals-394726.shtml"}],"summary":"The website of Alexza Pharmaceuticals (alexza.com)  a Mountain View-based company that focuses on the research, development and commercialization of products for the treatment of central nervous systems conditions  has been hacked. Hackers of Ayyldz Tim, a group from Turkey, have","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d144dc6f8e415db87cf94240de2e20f18800e24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6479528-5187-4828-B37F-21246A9FF6F4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3eee3f663ba6","org_name":"Alberta Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/calgary/alberta-childrens-hospital-calgary-privacy-breach-1.3345781"}],"summary":"Employee accessed patient and employee records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cbcb0456b1020620b313a18869835c805a8e521","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"411CE5F3-51D8-46CF-A500-EF4B3EFBA0D4"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56975ec2716e","org_name":"Alabama State Employees Insurance Board","org_type":"financial","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/August/13-tax-923.html"}],"summary":"Chequlia Motley of Montgomery, Ala., was sentenced yesterday to serve 36 months in prison for conspiracy and aggravated identity theft,  announced Assistant Attorney General Kathryn Keneally of the Justice Department’s Tax Division and U.S. Attorney for the Middle District of Ala","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dad58de472571d142f7f62a4c1d7c9e7f37415c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"644C276B-D520-4139-B0B5-7CC10D3A1CF5"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"392136087645","org_name":"Alabama Social Security Administration","org_type":"government","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therepublic.com/view/story/ae16153373ca4bc29833caa827b7684d/AL--Social-Security-Worker-Indictment"}],"summary":"A Montgomery man who worked for the Social Security Administration in Birmingham is charged with stealing personal information belonging to beneficiaries.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"498219711937aeff843e02c0331bd853c648aab3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC564E17-855C-4B16-8D8E-3B21D598924C"},"incident_date":"2013-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"912c275e26dc","org_name":"Alabama Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.annistonstar.com/news/state/database-misuse-ensares-officers/article_291648f8-3049-11e6-b76b-0bf60f1268d1.html"}],"summary":"An assistant police chief in Tallassee, Amy Robertson Davis, was convicted in 2013 on 29 counts of using the database for personal gain. The indictment against her alleges she attempted to make more than $3,000 by searching for people on the Law Enforcement Tactical System, thoug","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b105df2af697c9d333699042f5bdea7390b65fe4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FD73293-DAB1-43D0-9552-492144ED489D"},"incident_date":"2013-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"632c25b6d100","org_name":"AhaShare","org_type":"technology_saas","ransomware":null,"records_affected":190000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Torrents-Website-AhaShare-Hacked-Credentials-of-190-000-Users-Leaked-388365.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/10/04/ahashare-com-hacked-complete-database-with-190-000-user-credentials-leaked/"}],"summary":"A hacker that uses the online moniker Nairb has published a series of files that allegedly contain data stolen from the movie torrents website AhaShare.com.   Cyber War News has analyzed the leaked data. One of the files contains a list of affiliate usernames and the IP addresses","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f80e7a9467e83503e533466aca14a6abcccf2db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5EB5CD7-8925-4E4B-B6E8-A2C1C575C256"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbf9263ce586","org_name":"Agincourt Wallboard","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Agincourt%20Wallboard%20LLC%20Security%20Breach%20Notice%20to%20consumer.pdf"}],"summary":"Hackers gain access to payroll system for Agincourt Wallboard LLC","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d349186d3ccc095642e2a866837db1d4c44e9ee3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81983601-81FE-4217-BF72-4C5238AD99C3"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"5aedf1c82a17","org_name":"Afrihost","org_type":"professional_services","ransomware":null,"records_affected":18800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/adsl/92837-afrihost-data-leak-explained.html"}],"summary":"African ISP uploaded customer information via google apps and did not realize that their implementation would be indexed and searchable.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93632d8b7572dd82cedcbbc929e352f1c0a38776","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8106cee0-a477-11e7-b5cf-fd750643ba69"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a257b0bed7e4","org_name":"Aesthetic Laser Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.allure.com/story/woman-sues-plastic-surgeon-nude-before-and-after-photos"}],"summary":"Woman allowed plastic surgery clinic to take before and after photos of her nude body. The photos were accidentally published to the internet with her name attached.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0996a9a95a1ad28764b1a91223d24c7c35837f2e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66AF984E-3513-4190-B689-248DED9B5702"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a303efb5c38a","org_name":"Adobe Systems Inc","org_type":"technology_saas","ransomware":null,"records_affected":38000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-million-users/"}],"summary":"The recent data breach at Adobe that exposed user account information and prompted a flurry of password reset emails impacted at least 38 million users, the company now says. It also appears that the already massive source code leak at Adobe is broadening to include the companys ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09572064d8940432ba3555907f4bdd30c1931fba","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E8A462A-9190-44ED-BC0B-700243C78588"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RO","org_id":"40e5d3a4aa65","org_name":"AdNet Telcom","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Major-Romanian-Telecoms-Company-AdNet-Telecom-Hacked-396985.shtml"}],"summary":"The systems of AdNet Telecom, a major Romania-based telecommunications services provider, have been breached. The attacker is said to be a Saudi Arabian hacker that uses the online moniker King of Control. The attack was first announced on the Romanian Security Team forums. Two w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"415924ad7dc82cc517b82fa2f7c20066dcfc8904","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55f9ddb0-a21d-11e8-ae61-0fc7f403e976"},"incident_date":"2013-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7db4ad3a12d2","org_name":"ADams County (WI)","org_type":"government","ransomware":null,"records_affected":258120,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wisconsinrapidstribune.com/story/news/2018/08/10/adams-county-data-breach-exposed-information-up-250-000-people/956200002/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.waow.com/story/38894369/2018/08/Wednesday/adams-county-clerk-suspected-in-connection-with-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.news8000.com/news/personal-information-of-more-than-258k-people-compromised-in-adams-county-data-breach/779821991;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.channel3000.com/news/personal-information-of-more-than-258k-people-compromised-in-adams-county-data-breach/779756539"}],"summary":"A data breach exposed the names, addresses, personal information and even photographs of more than 250,000 people with information on Adams County computer systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0691b36e2a5ebafdb23eefa4140c5d8886ad3262","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EFB472D-D1D2-452C-A999-A349CA5B3795"},"incident_date":"2013-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"f7826fd24ca0","org_name":"Absa Group Limited","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/banking/90585-why-absa-mtn-clients-were-targeted-in-online-banking-fraud.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://mybroadband.co.za/news/banking/76994-this-is-how-sim-swap-fraud-happens-absa.html"}],"summary":"ABSA customers were victims of SIM swap fraud, allowing external actors to receive one-time passwords via SMS (after acquiring other information from phishing attacks). Armed with both sets of data, fraudulent transactions ensue. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2aa3523466359f658adbe1bbdb690a20da0cd27b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF95DBF1-F08C-447C-BFA7-4DF9442E5922"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0dde4e445947","org_name":"Aberdeen City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scotsman.com/news/politics/top-stories/sensitive-aberdeen-child-data-found-in-dundee-skip-1-3043035#.UgoWiA4lfoM.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.digitaljournal.com/pr/1421652,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.stv.tv/scotland/235899-confidential-child-welfare-documents-found-blowing-about-dundee-dump/"}],"summary":"ABERDEEN City Council today ordered an urgent investigation after “extremely sensitive” child welfare documents were found at a council dump in Dundee, almost 70 miles from the Granite City.  • Confidential child welfare documents belonging to Aberdeen City Council have been foun","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ca4eb6d935274f2047dd10446dfe625c8846c3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B29A984A-F3C6-498C-A93E-9A733A22A838"},"incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6003dea13cf2","org_name":"AARP","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infoworld.com/t/data-security/aarp-website-hacked-224206"}],"summary":"AARP is notifying members that the aarp.org website has been hacked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2013-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5e4eff611510bf8a5619765f0d3eb7bbed1df8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95ACEA3B-72F6-437A-96D6-DED71D4DD3B7"},"incident_date":"2013-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1817763021a7","org_name":"99 Cents Only Stores LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sacbee.com/2013/09/11/5728154/8-plead-guilty-in-la-area-id-theft.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://montrose.patch.com/groups/politics-and-elections/p/montrose-man-among-8-pleading-guilty-in-major-racketeering-case-tied-to-armenian-power-gang"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.glendalenewspress.com/news/tn-gnp-me-eight-plead-guilty-to-involvement-with-armenian-crime-ring-20130911,0,4547509.story"}],"summary":"Gang called \"Armenian Power\" located in Southern California installed skimming devices in retail chain called .99 cents only stores. Over two million dollars was stolen from a total of a few hundred victims.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2203015c9e082873470e7eed2a669eb3329126f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AF1808C-8B17-48C3-9C68-3652AF824A5F"},"incident_date":"2012-12-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4152f439cd7","org_name":"Uniontown Hospital","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wpxi.com/news/news/local/hacking-group-says-it-accessed-uniontown-hospital-/nWbkP/"}],"summary":"A hacker or hackers accessed patient information and posted it online.  The breach was discovered by a data privacy expert. Uniontown indirectly notified the public of the breach and breach containment after the privacy expert attempted to reach Uniontown Hospital for several day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b4b896876eff966985970591bf3898f68e54b4d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83D03C18-4552-4EC0-9BC5-98C844B561FB"},"incident_date":"2012-12-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13b2f2a34263","org_name":"Staffing Solutions","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbsatlanta.com/story/16478506/tough-questions-for"}],"summary":"CBS Atlanta started asking Tough Questions about one of Employ Bridge's companies after thousands of documents containing personal information were found in a Gwinnett County recycling dumpster.   Poole said he saw a story on CBS Atlanta about the situation and he started an inve","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b895b18ba49c8e0dd65cda5b9975a81862e4c496","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81FCA696-8C4E-4D29-9C68-0E97ABB1EA9A"},"incident_date":"2012-12-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f55409361d7","org_name":"Crescent Health Inc. - a Walgreens Company","org_type":"healthcare","ransomware":null,"records_affected":109000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.local10.com/news/Computer-hardware-records-stolen-from-billing-center/-/1717324/19046268/-/1207ekf/-/index.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/walgreens-company-announces-data-breach"}],"summary":"Theft of a desktop computer and paper records from a billing center in California results in 109,000 records exposed.  The theft affected employees, employee applicants and patients.  Data included personal health information and SSNs of patients.    Anaheim, Calif.-based Crescen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b00dcd58a9022c77db778a278475ad529c0f6f7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4F34F24-0CCE-4399-A3D8-8D8AFC356EDE"},"incident_date":"2012-12-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e7195c02cf42","org_name":"Hope Hospice","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hopehospice.net/news/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://kgnb.am/news/hope-hospice-warns-800-patients-about-possible-information-security-breach"}],"summary":"An employee emailed a report of recent referral and admission activity to themselves via an unsecured channel.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83417dfaad9513bdee0ca9dc9cc4f8240978680e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D563D7BA-6C79-4069-81E6-888B01EBD7BB"},"incident_date":"2012-12-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aff621c775ad","org_name":"Stronghold Counseling Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":8500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The December 24, 2012 theft of a computer resulted in the exposure of patient information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6cf15f8f3715468dd2b54596c2eccea23124506","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F8759A7D-ADEA-4893-A270-87C6906B9CCC"},"incident_date":"2012-12-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd7e31cd6684","org_name":"Rhode Island Department of Labor and Training","org_type":"government","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessweek.com/ap/2012-12-31/ri-labor-dept-dot-warns-of-possible-privacy-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wpri.com/news/crime/identity-thief-may-have-stole-the-information-of-350-employriorg-users"}],"summary":"The Rhode Island Department of Labor and Training says a technical problem may have led to a privacy breach for some callers to its phone line for unemployment and disability benefits.  Spokeswoman Laura Hart says the problem happened Dec. 24 when some of the 700 callers that day","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4791d166710e78a3cebb0189c052d3bc49b02a90","impact_type":"unknown","incident_date":"2012-12-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notification%20letter%2012-21-12_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"ef4f36bd797f","org_name":"Calif. Department of Health Care Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37629"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-12-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b5bd2c0673a1a343797d67ac82001158a7800cd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E3A7E6B-5650-487F-BF8A-0FA590A87ED9"},"incident_date":"2012-12-24","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd6de767ef4b","org_name":"Bank of the West","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/02/ddos-attack-on-bank-hid-900000-cyberheist/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercecomplianceit.com/story/lessons-learned-cautionary-tale-cybercrime/2013-03-17"}],"summary":"DDoS coordinated with account takeover via stolen creds.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5ed15ea0f4bb8b0f0c3737e958aac39c2a1fecb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98CDE523-4A21-4B70-B5EA-4E4083CA364E"},"incident_date":"2012-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2efb61eaf9cf","org_name":"Richard Switzer MD PC","org_type":"healthcare","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Lost laptop exposes 4100.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2012-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d1db1a0783c721650633fb3a8e320b9c0ca0913","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"666AA510-80BF-448E-A580-AFCE28A4A0A4"},"incident_date":"2012-12-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9adc6f946a0d","org_name":"Lohud.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gannettblog.blogspot.com/2013/01/westchester-facing-threats-paper-hires.html"}],"summary":"On the media website, Lohud.com, the names and addresses of pistol permit holders in two New York counties.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-21","discovered_date":"2012-11-29","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a439b6ef112ada585a20d8d0725d267507d7ceeb","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Multi-State_Skagit_1Leaf_Proofs%20%282%29.pdf%20-%20Adobe%20Acrobat%20Pro_0.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"56020f46307e","org_name":"Upper Skagit Indian Tribe","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Electronic equipment containing or potentially containing customer data was stolen from a Bally employee’s home office.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37622"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Multi-State_Skagit_1Leaf_Proofs%20%282%29.pdf%20-%20Adobe%20Acrobat%20Pro_0.pdf"}],"summary":"The Upper Skagit Indian Tribe’s customer data may have been involved after electronic equipment held by vendor Bally Technologies was stolen from an employee’s home office.","supporting_quote":"Electronic equipment in Bally’s possession in the normal course of business for the purposes of performing services for us was stolen from a Bally employee’s home office and may have contained data of our customers.","technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Bally Technologies"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"b009826c5359","name":"Bally Technologies"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"671f95574b6a7cae619a491819458aec5fdfca0d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E27D80A3-9D54-4014-B9EA-5C3B2E7F7028"},"incident_date":"2012-12-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82f8f12dd48d","org_name":"Center for Orthopedic Research and Education, Inc.","org_type":"healthcare","ransomware":null,"records_affected":35488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen documents/films leaves 35488 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-12-20","discovered_date":"2013-01-11","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6e5bbddf9d80c554fb05c7fe2a468de3dc2a891","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ShopletCA%20notification4_2_13_0.pdf"},"notes":null,"org_country":"US","org_id":"a6ba707d7983","org_name":"Shoplet.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40929"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/ShopletCA%20notification4_2_13_0.pdf?"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ShopletCA%20notification4_2_13_0.pdf"}],"summary":"Shoplet.com reported that a hacker may have accessed systems containing customers’ names, addresses, and credit card information.","supporting_quote":null,"technology_involved":["database server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3baac8f5a33a38163a5197c428064aaeb4493eb9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3B9E261-C214-4CF4-80E9-C3E3E398E2E8"},"incident_date":"2012-12-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"573b75c32cbf","org_name":"Samaritan Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.watertowndailytimes.com/article/20130116/NEWS03/701169858"}],"summary":"On Monday, it was revealed that a registered nurse caring for inmates at the county jail violated federal law by accessing without authorization the medical records of someone who was not an inmate.  Health care professionals at some county agencies have access to confidential re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb7c04f880c1a52f10b28546d17a6a578f6b2ef5","impact_type":"unknown","incident_date":"2012-11-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Customer%20notice%20letter%20template_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c5432352d63a","org_name":"Jetro/Restaurant Depot","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37586"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7034fd94b4f9cf4043dcb826f8462033f2057ab4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F462F92-0E42-45D1-9D83-D4C2EDBF134B"},"incident_date":"2012-12-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f602e5be955c","org_name":"Health Advantage","org_type":"healthcare","ransomware":null,"records_affected":2863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Compromise of paper documents exposes 2863 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-12-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"44aafaecaca16249c7c0a42ce4c16cc8718b73a3","impact_type":"exposure_no_theft_confirmed","incident_date":"2013-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Tennis%20Express-C2013016801%20CA%20AG%20Letter_online%20submission_0.pdf"},"notes":null,"org_country":"US","org_id":"1bef67771f50","org_name":"Tennis Express","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Tennis%20Express-C2013016801%20CA%20AG%20Letter_online%20submission_0.pdf?"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-40876;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227150.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Tennis%20Express-C2013016801%20CA%20AG%20Letter_online%20submission_0.pdf"}],"summary":"Tennis Express website files were accessed without authorization, and the affected files may have included customers’ names and American Express card information.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97a3b43c07f5aeb05b5c5859e2a65261185eb68e","impact_type":"unknown","incident_date":"2012-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/WesternU.12.18.12.Notification%20-%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"463327c3bb8b","org_name":"Western University of Health Sciences","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37376"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3ff8c370a81b5d445542e176b43ba2bce32f582","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3925AABD-65AE-41E6-8078-BAB496D1205F"},"incident_date":"2012-12-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5ee58f5fc9cd","org_name":"Vidant Pungo Hospital","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b48a3e8d783cb461152d0f43ce853f7c65ab4aa5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DF8AB811-3469-46BF-B39A-A8F5322A599F"},"incident_date":"2012-12-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35e0a278c97f","org_name":"Hebrew Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/hebrew-health-20130111.pdf"}],"summary":"employee sent internal document with PI to another employees personal email account rather than business.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"982937cab05c5f7f7d059b5d4358a3ee2d5aa4fe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2899F4A0-CC41-4301-9A3E-B58B866EB7D3"},"incident_date":"2012-12-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1eadb544a2ab","org_name":"City of El Centro Fire Department","org_type":"government","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d5ac93ed5aa9d876f557be8f559b33815f85507","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3DF206F-743B-406F-A4D6-18E6A3D0CC87"},"incident_date":"2012-12-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e8831f2784bb","org_name":"City of Covington Kentucky Fire Department","org_type":"government","ransomware":null,"records_affected":1548,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"200632ea842072973fed169206c4fbbe6b206903","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E96D6748-7CC5-49F3-BB57-5873A10923F8"},"incident_date":"2012-12-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de4bd918ffcc","org_name":"Sunview Vineyards of California, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/SampleLetterforSecurityBreachNotification%2801126564%29%20%283%29_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37686"}],"summary":"Laptop stolen from office in a burglary.  An Excel spreadsheet related to worker's compensation was on the laptop and contained name, social security numbers, and health information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cef1da53f1669e093cb29b6bef8be2d0bafb0be6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80A6FCAC-2C05-416B-875F-341270D29BEF"},"incident_date":"2012-12-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f149b6d4273b","org_name":"Unisys","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/03.04.2013%20Individual%20Notice%20Letter_0.PDF?"}],"summary":"An administrative error resulted in documents with sensitive information from Unisys members being emailed to an incorrect party associated with Unisys. The mistake occurred on December 13, 2012.  The document may have contained names, Social Security numbers, dates of birth, and","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d45aed83794cf1e8da089bdd4d82572e6676e5b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB90ED33-A7D3-432B-A61B-DD68E64ACE46"},"incident_date":"2012-12-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de39e15535e4","org_name":"Talk Fusion","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Talk%20Fusion%20-%20Form%20of%20consumer%20notification%2021113_0.pdf?"}],"summary":"A computer network attack resulted in the exposure of customer information.  The cyber attack was discovered on December 13, 2012 and affected customer databases with names, Social Security numbers, credit and debit card numbers, payment card expiration dates, payment card securi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5d14ccfc7ac01645ab1635bba8ca3da5998e25f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6D166B5-CE17-4C7E-A161-856F87B4B7A6"},"incident_date":"2012-12-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3e4c815c819","org_name":"Prudential Insurance Company of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/03.04.2013%20Individual%20Notice%20Letter_0.PDF?"}],"summary":"Prudential provides, or in the past did provide, group life insurance to you as a result of your employment relationship with Unisys. I am writing to let you know that a Prudential associate made a clerical error and inadvertently emailed a document containing information relatin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-12-12","discovered_date":"2012-10-31","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0671c99e2eef338919279fbd70ba05b04fb082c1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2012-07-19","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Wilton%20Brands%20Customer%20Notice%20Final%20Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"69d314c30b23","org_name":"Wilton Brands LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37224"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38734"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Wilton%20Brands%20Customer%20Notice%20Final%20Letter_1.pdf"}],"summary":"A malicious user was able to view Wilton and Copco user information on a server hosting their websites between July 19 and October 2, 2012.","supporting_quote":null,"technology_involved":["web server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-12","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ae2bef75b82cda28e549cb7ff6df62cb6a6c0d6","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Mt%20Diablo%20notification%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"80d144d6cf83","org_name":"Mt. Diablo Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37238"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Mt%20Diablo%20notification%20letter_0.pdf"}],"summary":"A computer containing employees’ and former employees’ personal information was stolen during a burglary at a district office.","supporting_quote":"One of our offices was burglarized on Saturday, December 1, 2012 and a password protected unencrypted computer was stolen after thieves broke a window.","technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-11","discovered_date":"2012-11-12","entry_asset":"endpoint","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e7d644296115324e7f3ccf4721e4273548932d3","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-11-11","initial_access":"lost_or_stolen_device","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20Notification%20Letter%20Dec%2006%202012_0.pdf"},"notes":null,"org_country":"US","org_id":"318a04918fb7","org_name":"Pepperdine University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37218"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20Notification%20Letter%20Dec%2006%202012_0.pdf"}],"summary":"A laptop computer stolen from an employee’s car may have contained Pepperdine University community members’ personal information.","supporting_quote":"On November 12, 2012, we discovered that a University laptop computer was stolen from an employee’s locked car.","technology_involved":["laptop computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a596bbb963f568682d8f088dd8a0b2523f2478c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"593264EF-9A29-458B-AEA6-F72339A306DF"},"incident_date":"2012-12-11","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32b75750c04c","org_name":"East San Gabriel Valley Regional Occupational Program","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/601841172_1_%28BHDOCS%29_1.PDF?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37685"}],"summary":"Employee sent a career placement email to students regarding open positions which inadvertently included an attachment containing student information.  The attachment contained student attendance information, including name, DOB, SSN.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15a07f4b7b68a6ee62e0400cf7a73434036685e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26FA26C9-A8E1-4FB4-9FB2-F91CBE2ED495"},"incident_date":"2012-12-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fd1bca0b1ed","org_name":"State of California - Health and Human Services Agency - Department of Health Care Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-37629;http://oag.ca.gov/system/files/Notification%20letter%2012-21-12_0.pdf?;http://oag.ca.gov/system/files/Notification%20-%20stuffer%20final%20_0.pdf?"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd0ad79407adce5eea2a41d25dd4f17151f09780","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-09-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SC%20DoR%20CA%20Resident%20Notice%20December%204%202012_proof_v3_0.pdf"},"notes":null,"org_country":"US","org_id":"43a981fec178","org_name":"South Carolina Department of Revenue","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37162"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SC%20DoR%20CA%20Resident%20Notice%20December%204%202012_proof_v3_0.pdf"}],"summary":"The South Carolina Department of Revenue reported that tax returns and related information were exposed in a security breach discovered in October 2012.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a7a28c5040721e3d47c2063900460a58bea4c9e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67EF335A-4A79-4B79-BBF3-6D86F97C3302"},"incident_date":"2012-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4105a5e31e18","org_name":"Oldcastle APG, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":5083,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227131.pdf"}],"summary":"A laptop was stolen from an employee's car on or around December 10.  APG employees may have had their names, Social Security numbers, bank account information, and other information exposed.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2e69e76ff1f779129cc9c19a88e061544b82308","impact_type":"unknown","incident_date":"2012-10-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/CA.FormNotce_0.PDF"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"eab767ac9adb","org_name":"Accume Partners","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37161"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae3e9623d60e0ebf5da09d9fe8e81b7423add19b","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56B4544A-FCF7-48E4-9D98-0A07F5ED99E1"},"incident_date":"2012-12-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e04626fa7088","org_name":"City of Wayland Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.metrowestdailynews.com/top_stories/x1803294068/Wayland-school-employee-fired-for-unauthorized-account-access"}],"summary":"Employee created new accounts, renamed accounts on the town's general ledger and redistributed payroll expenditures, among other unauthorized actions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e452fbb57105cf3309676de7e969a78dfc32b116","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03ED87DE-E1D8-48E3-9C4E-7FD575E58295"},"incident_date":"2012-12-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6dd281233db2","org_name":"Robbins Eye Center","org_type":"healthcare","ransomware":null,"records_affected":1749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"117798b5a91bad61dcdac2f95138ad0fce14bb6b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAFB5479-4701-41F6-8509-49FB62EC5DF0"},"incident_date":"2012-12-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd76ea2c7dfa","org_name":"Pousson Family Dentistry","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.poussonfamilydentistry.com/wp-content/uploads/2012/07/theft-letter.pdf"}],"summary":"Pousson Family Dentistry in Louisiana reported that 1,400 patients  including Dr. Pousson himself  had PHI on a laptop stolen on December 3, 2012. I was able to locate a copy of their notification letter dated December 18, 2012.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07237f3f1d97f289b314edfbdcbb9127d9504e76","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1A5E98F-9C1D-4E32-AEA4-A9A3F9F4B2E0"},"incident_date":"2012-12-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e97faf2b691","org_name":"Landmark Medical Center","org_type":"healthcare","ransomware":null,"records_affected":683,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e4dc926f06f5ba01b7ae8a59a5f87b4dbf9f84e9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"813D503E-277A-4E5A-8E6E-9B1EA7295305"},"incident_date":"2012-12-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b369c9558980","org_name":"Emmorton Associates","org_type":"other","ransomware":null,"records_affected":75,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226833.pdf"}],"summary":"A counselor's file cabinet was burglarized sometime between December 10 and December 21.  It contained client files with names, Social Security numbers, dates of birth, addresses, telephone numbers, diagnosis, treatment information, insurance information, and emergency contact in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80dbbb9878b4f36c1e6ed6e7ebf150f79e1d49f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04C215C8-4166-47E1-9EEA-259D05AD37AD"},"incident_date":"2012-12-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"703a34176721","org_name":"Brigham & Women's Hospital","org_type":"healthcare","ransomware":null,"records_affected":615,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf58378b83f8049c9a5a4b7fd3c26e809130d780","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-12-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/United%20Shore%20Financial%20Services%20LLC%20Gen%20Consumer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"2052a28f1446","org_name":"United Shore Financial Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-40775"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/united-shore-financial-20130320.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/United%20Shore%20Financial%20Services%20LLC%20Gen%20Consumer%20Notification_0.pdf"}],"summary":"An unauthorized third party intruded into a computer system and accessed a server containing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff6fa10768b58f9daa6bb8c0f94d428f6b22a892","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21FE78C7-3638-47D0-9515-9B7D777A920C"},"incident_date":"2012-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5f8eb037668","org_name":"Vector Security","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-231921.pdf"}],"summary":"In December 2012, Vector relocated its office. In the process, they apparently left behind a laptop containing PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f747cd97a0b6b40c7e5e1bcff0bd7227538e73d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89C77A19-EBFD-4FEA-B34A-0E9F33E825D2"},"incident_date":"2012-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"fb4b5055a1df","org_name":"THE NATIONAL BANK OF RAS AL-KHAIMAH (P.S.C)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/11/feds-say-thieves-in-atm-heist-nabbed-after-stuffing-800000-in-suitcase/;http://news.softpedia.com/news/8-People-Arrested-in-Spain-for-Role-in-45M-33M-Cybercriminal-Scheme-412696.shtml"}],"summary":"Organized Crime hacked in to payment processing companies to remove the withdrawal limits on debit cards and stole the debit card information, and then in a coordinated way removed large amounts of sums from various ATMs in a short span of time.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36320328f130b8860c2160c9fec1cc7238608386","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D2852D2-536B-4B88-A6A3-E293340F256B"},"incident_date":"2012-12-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b19e71d7eb6c","org_name":"The J. M. Smucker Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://onlinestore.smucker.com/datafaq.cfm"}],"summary":"attackers use cold fusion vulnerability to hack into Smuckers website and upload malware that grabs payment data as it is submitted to the server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"080fed1d5366ff39be95645625846b11a33aebf9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A79C65C9-7AB3-4D1D-BA91-D94CAA7222B1"},"incident_date":"2012-12-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7463ab7715e","org_name":"Outdoor Network LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Outdoor%20Network%20Notification%20V1%20D_data%20audit%20proof_090613_0.pdf"}],"summary":"2 websites owned by Outdoor Network were breached and malicious PHP script was added to capture payment card data as it is processed by the application and exfiltrated to external actor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23ca2a7de4413163d5b2f0ac3b69cf3aceb7f835","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15EE9708-B1DF-430E-BEF5-70B1CD54EFC3"},"incident_date":"2012-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"340798fb8406","org_name":"NECA/IBEW Family Medical Care Plan","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notice%20to%20Participants_0.pdf?"}],"summary":"NECA/IBEM Family Medical Care Plan (FMCP) participants received disclosure documents related to benefits coverage and modifications.  The outside of the envelopes in which the documents arrived displayed participant Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d02b27365338d1ccc827d1a471da681eb1d00c47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2022C66A-B2CF-4500-963A-599CFB0E776B"},"incident_date":"2012-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"57ddc39d8182","org_name":"National Belgian Railway Company","org_type":"transportation_logistics","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://storify.com/xdamman/sncb-europe-leaks-1-4m-personal-data-of-its-custom,"},{"fetched_at":null,"title":null,"type":"press","url":"http://storify.com/xdamman/sncbgate-nmbsgate,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huntonprivacyblog.com/2013/04/articles/belgian-privacy-commission-refers-data-breach-case-to-public-prosecutor/"}],"summary":"SNCB Europe put by mistake on their public HTTP server a text file with 1.4M records of their customers. Including name, address, email, birthdate, sexe, even phone numbers in some cases. That file got indexed by Google and Bing and a user found it and posted the link on a forum.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21bbf56fe3b1befb26064070e29293dceca588b8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F71EC11-695E-4AD0-833D-01B90D226990"},"incident_date":"2012-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"685ae042138d","org_name":"Mount Diablo Unified School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.sfgate.com/incontracosta/2012/12/22/password-protected-unencrypted-computer-stolen-from-the-mount-diablo-unified-school-district/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.contracostatimes.com/news/ci_22242452/computer-containing-confidential-information-stolen-from-mt-diablo,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Mt%20Diablo%20notification%20letter_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/mt-diablo-school-20121218.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/mt-diablo-unified-school-district-security-breach-notice-ltr-to-consumer.php"}],"summary":"The Mount Diablo Unified School District sent letters out to its current and former employees on Friday December 21, 2012 notifying them that one of their offices had been burglarized on Saturday, December 1, 2012, and a password -protected, unencrypted computer was stolen, accor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ed7bdf03020424cc9ee113999256b0d11d20af6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7897E025-A030-4AB8-B9BE-19D8C5A2177D"},"incident_date":"2012-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11aaff040df9","org_name":"Jackson South Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2012/12/12/jackson-health-system-mum-on-recent-data-breach/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/news/local/Two-Jackson-South-Administrators-Lose-Jobs-After-Investigation-Sources-183098791.html"}],"summary":"Approximately two months ago, Jackson Health System investigated an alleged violation of a patient’s rights and privacy at Jackson South Community Hospital. In order to avoid compounding the potential breach, we are not disclosing details at this time. While no patients were harm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6bbc1127095b3a9bf8929e88a90def875509316","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E79F8D47-8236-47B3-9B8F-36EFEE11B6D4"},"incident_date":"2012-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f692ff116d6","org_name":"Gosten Tax Group, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.accountingtoday.com/news/Identity-Theft-Cautionary-Tale-Tax-Preparer-Colleagues-67437-1.html"}],"summary":"Physical theft of a computer from a tax preparer's office leads to filing fraudulent tax returns in their clients names.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f93440a7566d3f3afac2e9aec10e2af1e32c8a5a","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78AB8EAB-34AC-49A7-9CD1-4DF15C7306E3"},"incident_date":"2012-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"271433163472","org_name":"Flight Centre Ltd","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11199457"}],"summary":"Internal actor accessing pre-paid card environment and commits fraud. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1852b4ddae80ea54b7ff024689dfb54ec5fc7ab4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64F18520-F75E-42E4-A1FB-793B150A27B9"},"incident_date":"2012-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55eb9eb66ed7","org_name":"Federal Network Systems LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/federal-network-20130116.pdf"}],"summary":"Malware infected computer exposes names and SSNs of employees (current/former) and independent contractors.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7749b2f609f484a88c6bcedf8dddbf4a32482ec6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC89A10B-40FD-4A80-9053-022174FCCB83"},"incident_date":"2012-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"cac8c02575f6","org_name":"ElectraCard Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.business-standard.com/article/companies/data-breach-in-atm-fraud-outside-our-environment-says-electracard-113051300030_1.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://smartinvestor.business-standard.com/mf/mfNewsFeature-mfnews-175657-Data_breach_in_ATM_fraud_outside_our_environment_says_ElectraCard.htm#.U88AQ1aFr7Q"}],"summary":"Pune-based ElectraCard Services (ECS) said on Sunday that a data breach in a series of ATM fraud attacks in December last year appears to have happened outside of its \"processing environment\".  Last week, US authorities had brought to light a $45-million global cyber heist involv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ff7a661a51f2e506577b2a7192af1ddc5d2b57","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EED7240E-9F5A-4813-B803-9A2F518CBB76"},"incident_date":"2012-12-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cff9f1333aa9","org_name":"Efficient Services Escrow Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2014/01/firm-bankrupted-by-cyberheist-sues-bank/;http://krebsonsecurity.com/2013/08/1-5-million-cyberheist-ruins-escrow-firm/"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/08/1-5-million-cyberheist-ruins-escrow-firm/"}],"summary":"Remote Access Trojan installed on escrow firm's computer. Credentials stolen and used to initiate fraudulent wire transfers. The losses were enough to cause the company to go out of business.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9876ed62659527a454cde6ac0f6c0c355a8b1074","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3460D6DC-5239-434A-BDE1-33BDF042063C"},"incident_date":"2012-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d63bbd59178a","org_name":"Eddie Merlot's","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lincolnshire.suntimes.com/news/merlotsfolo-LSR-07182013:article"}],"summary":"Corporate officials of Eddie Merlots, whose manager was charged July 2 with stealing customers identities, have pledged to rectify the issue with any affected patron.  In a prepared statement issued last week, Bruce Kraus, director of operations for Eddie Merlots restaurants, sai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8defd4305cc35932b3192d21e3ef46c73e151a56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"480D49AA-5006-4E39-B595-83C9ADEF4D6D"},"incident_date":"2012-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c52286f5c91","org_name":"Club Soda","org_type":"other","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.creditreview360.com/credit-cards-news/878-sophisticated-credit-card-hackers-target-club-soda.html"}],"summary":"Restaurant's customer data stolen probably by tapping unencrypted phone lines to credit card company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8873d08b983a042c19b46f946959f4107615c0cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2808C42E-A6D7-4720-B86B-233FCB71CA77"},"incident_date":"2012-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ad466b79c5f3","org_name":"Bashas' Family of Stores","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mohavedailynews.com/news/local/bashas-reveals-security-breach/article_336206f1-8843-5504-b850-282ce785f43c.html;"}],"summary":"Malware on corporate grocer systems captures PANs; criminals sell data; data is misused","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afa0aea6ea2c53ca8df3e24aa890beb534cefbe6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"268E80BA-B62F-4056-AE23-A5446CCC8F2C"},"incident_date":"2013-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc848c9d9cc6","org_name":"Bank of America","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/news/2013/022813-bank-of-america-says-data-267200.html?source=nww_rss"},{"fetched_at":null,"title":null,"type":"press","url":"http://rapsinews.com/judicial_news/20131002/269042519.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stamfordadvocate.com/local/article/Man-pleads-guilty-to-ATM-skimming-thefts-4744611.php"}],"summary":"3rd party partner disclosed Bank of America security plans by storing on a misconfigured server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-11-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"103aa5e0aa75fc9a0848aa144fa211133843f98e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1293154D-3571-421D-BF2D-545F08F3266D"},"incident_date":"2012-11-30","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c023ed26e23","org_name":"World Travel Holdings","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-37286,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/2012%2012%2020%20World%20Travel%20Holdings%20Security%20Breach%20Notice%20ltr%20to%20consumer.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37286"}],"summary":"An unauthorized person gained access to the booking system by misusing the log-in credentials of an authorized user.  Although credit card information is encrypted when it is stored in the booking system, the unauthorized person used a decryption feature of the system to view the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2012-11-29","discovered_date":"2012-11-27","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc2a84f698e3504df04efdfb5a6831906bb1d263","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-11-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SAMPLE%20Nov%2028%202012%20Breach%20Notification%20Letter%20to%20Client_0.pdf"},"notes":null,"org_country":"US","org_id":"4bc086e3ed56","org_name":"WestCoast Children's Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37088"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20Nov%2028%202012%20Breach%20Notification%20Letter%20to%20Client_0.pdf"}],"summary":"WestCoast Children's Clinic accidentally emailed a referral document containing personal and health information to an unauthorized county social worker.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a61d8845534133816bbd3a9a83a3f2337f5cf60","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0D5E59C-B8B6-45FD-AA6A-D63F86DE5C22"},"incident_date":"2012-11-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65d5468638a5","org_name":"Wayne Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":1182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://citizensvoice.com/news/business/wayne-memorial-informing-patients-cd-with-records-lost-1.1433355"}],"summary":"An unencrypted disc that contained patient information was lost in transit.  The disc had names, Medicare account numbers, and outstanding account balances from patients who visited the Honesdale hospital between 2007 and 2012.  A legal envelope that contained the disc was mailed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"544d7120016749d3ae31857e2f87970f596e853e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55504DEB-92C8-484F-AA6D-D720C4960EFB"},"incident_date":"2012-11-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95939efb8cee","org_name":"Charlotte-Mecklenburg Schools","org_type":"education","ransomware":null,"records_affected":80,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/2013/01/08/3770745/cms-files-stolen-from-employees.html"}],"summary":" About 80 Charlotte-Mecklenburg Schools employees have been warned to be on guard against identity theft after files containing their personal data were stolen from a human resource employee’s car.  The personnel files, which contained names, addresses, Social Security numbers, d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be5c5dcf71805072e90ede7909c65b448f45d2dd","impact_type":"unknown","incident_date":"2012-06-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Attorney%20General%20Notice%20--%20Sample%20Notice%20Letters_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d999276d4947","org_name":"Advanced Data Processing, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37063"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-11-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"caa4765c0551f3db2e57b9f2982d11933b225aa5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05E5ADC8-5CB2-4B74-A895-48EDB2A3C864"},"incident_date":"2012-11-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a2a00fd40de","org_name":"Stethescope.com","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227123.pdf"}],"summary":"A hacker accessed the webserver used to host stethoscope.com on December 3.  The breach was discovered in mid-December during routine server maintenance.  Customer names, addresses, email addresses, and credit card information such as numbers, expiration dates, and security codes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"334c876a2d95651327182872d12580c571a03e54","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61821260-8E5C-4A8C-B954-6BA83D1CDA69"},"incident_date":"2012-11-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84e6d2de3f19","org_name":"Gibson General Hospital","org_type":"healthcare","ransomware":null,"records_affected":29000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.14news.com/story/20441631/gibson-general-hospital-notifying-patients-of-stolen-laptop-containing-patient-information"}],"summary":"Gibson General Hospital has mailed letters to patients informing them of the theft of a hospital laptop containing personal health information.  The laptop was reported stolen, along with several other items, from an employee's home during a burglary on Nov. 27.   The laptop was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-26","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e28263e43ae91fadbf84e2e539b52b4c5c1667a6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"096C9C70-23DF-415F-8D5E-C9A4C63C394F"},"incident_date":"2012-11-26","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"899024e76758","org_name":"Rosenthal Collins Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Consumer%20Letter%20%28FINAL%2047-state%20letter%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/rosenthal-collins-20121224.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37692"}],"summary":"Unauthorized access to a web application exposes customer information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1aebeea35743263546b508dfb5851a4e883a23db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50ECFF79-135D-4CCB-B3CF-6F0F9825476D"},"incident_date":"2012-11-25","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c61bf3d6a1c","org_name":"New York Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dataprivacymonitor.com/identity-theft/its-raining-pii-in-new-york/"}],"summary":"On November 25, 2012, the front page of the New York Post blasted the headline, “Drop Secret. Shred Alert! Covert cop files used as parade confetti.” The Post reported that shredded files appearing to contain material from Long Island’s Nassau County Police Department were droppe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"UA","motive":"financial","name":"Oleksiy Sharapka","variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-11-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4208b5d2ed46df00bae8835c5d22f9d4e0e468d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E171B9D-68A8-4BAB-B4A7-A1E0250BE9B1"},"incident_date":"2012-11-23","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"adcecb7d62b5","org_name":"Fundtech Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"oleksiysharapka"}},{"actor":{"category":"external","country":"IR","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-11-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b857c0236e13c589f6eff479e6e3d94941452b83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A701C62-9D6B-4816-B47B-2460D710AD93"},"incident_date":"2012-11-22","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebfc0bba473e","org_name":"IHS Inc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-41789"},{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2013/02/28/iran-hackers-threaten-vice-president-domestic-u-s-drone-attack-leak-ihs-janes-cbrn-documents/"},{"fetched_at":null,"title":null,"type":"press","url":"http://wikileak.ir/en/leaks/13"},{"fetched_at":null,"title":null,"type":"press","url":"http://cryptome.org/2013/02/parastoo-janes-cbrn.htm"}],"summary":"External activists gained access to victim network and may have gained access to customer information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c78f54d40659225f6b71d720eb07503d275c9b05","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87C76422-1665-4365-91BF-2AB00FFFF0E1"},"incident_date":"2012-11-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a6a179fd259","org_name":"University Dental Associates","org_type":"healthcare","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wp-content/uploads/UniversityDental_NYS_2012.pdf"}],"summary":"Laptop with Patient's PII stolen from office.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a243cc783da496254422cc265caca2c050a0c0b2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99C88989-DFD3-476E-AB7B-7E7ACB744D85"},"incident_date":"2012-11-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46612c0e2ea2","org_name":"Soundental Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":14511,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a portable device exposes 14511 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5bd09eeb1aa4b77a70a9405039a07bc4c3df56f","impact_type":"unknown","incident_date":"2011-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Letter_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d0075f6709e3","org_name":"Oak River Insurance Company","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37024"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a4069af805dba5cf93a918e98365cf19d20b108","impact_type":"unknown","incident_date":"2012-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20to%20CA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d6dcaa69eacd","org_name":"American Tool Supply","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37007"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"03292e2aa34e0078effc14efda8146fbe52dbda8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE4781E2-3082-49CC-B4BF-B3DE92808A2A"},"incident_date":"2012-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26b741af6441","org_name":"Riderwood Village","org_type":"healthcare","ransomware":null,"records_affected":3230,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Five laptops were stolen during the weekend of November 17, 2012.  They did not contain Social Security numbers and did contain unspecified personal information of patients.  A notice about the incident was sent on January 18, 2013 and the breach appeared on the HHS website in Fe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e66cc5954788e9686ddfb307a68c0681b2a5a60","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"021BDDC2-7CD6-42FE-B307-51051F7E6690"},"incident_date":"2012-11-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"05a584746872","org_name":"Human Resources and Skills Development Canada","org_type":"other","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/news/gta/article/1308440--concern-mounts-among-those-affected-by-federal-government-privacy-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunnewsnetwork.ca/sunnews/canada/archives/2013/01/20130101-175145.html"}],"summary":"The massive federal department responsible for Canada's employment, training and pension programs faces a formal investigation into a possible breach of the nation's privacy law after the government misplaced a USB key containing the personal information of 5,000 Canadians.  An e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6518a4609e12ce82957f9fff83884719b2496c2b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A2220AF-D4B4-457D-B2DE-6BCE62EB02C3"},"incident_date":"2012-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf0837de1c6a","org_name":"Surgical Associates of Utica, PC","org_type":"healthcare","ransomware":null,"records_affected":1017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-16","discovered_date":"2012-10-03","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc8e92f007df1920176df2d2fe75aebe7ef7dcc8","impact_type":"data_theft","incident_date":"2012-10-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PE%2320121003-127_letter%20_Final%20Template__0.pdf"},"notes":null,"org_country":"US","org_id":"50b0b1af09d9","org_name":"Nationwide Mutual Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36995"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PE%2320121003-127_letter%20_Final%20Template__0.pdf"}],"summary":"Nationwide reported that an unidentified criminal intruder accessed part of its agent network and likely stole some personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"db2dbe95738fab31516b76eb389bfc64f543667b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4EA24B5C-AC1E-43E0-BADB-184B9D085F23"},"incident_date":"2012-11-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83b16b9517a1","org_name":"First Step Counseling, Inc.","org_type":"healthcare","ransomware":null,"records_affected":638,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99ecc744c18ee37ae2272a7f1fc4f181f242733f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0772109-2249-4F8E-A3EA-F7AB8FC4D898"},"incident_date":"2012-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5755f239306a","org_name":"CVS Caremark","org_type":"retail_ecommerce","ransomware":null,"records_affected":955,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f708d7fdab922aaa04ed6676bd6b09efb4731ccd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C0E6FF1-51CF-4B08-A4E3-B71F59E296C4"},"incident_date":"2012-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c6cc66cd465","org_name":"United Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxbusiness.com/industries/2012/11/15/united-airlines-flights-said-to-be-grounded-nationwide/"}],"summary":"Computer glitch leads to availability issue and grounded flights for airline.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa6f8cb09d9a21bb21f12f8e0762caf1bc15e19e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E96C7FF7-4AA0-455B-9E6C-60D792A8EF64"},"incident_date":"2012-11-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"062c4b6da686","org_name":"Pinkerton Government Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Letter%20to%20Employees_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37151"}],"summary":"Computers were stolen from an office.  The computers may have contained personal information, including names, addresses, and SSNs.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0077b33ff2c9cb9db8150baaec382a01a84856e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BCDACCB-8614-407C-BF9E-3FB64569EFF1"},"incident_date":"2012-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e005aefa63f0","org_name":"Cabinet for Health and Family Services","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/kentucky-health-agency-notifies-2500-of-potential-hipaa-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://surfky.com/index.php/news/kentucky/24461-medicaid-clients-notified-of-potential-hipaa-breach"}],"summary":"The Cabinet for Health and Family Services in Frankfort, Ky., is informing approximately 2,500 clients of a possible data breach that may have released information held by the Cabinet's Department for Community Based Services.  The Cabinet for Health and Family Services (CHFS) is","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"social"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"deef6d03f74cd61302cb5ce1f28b8a479eda2621","impact_type":"unknown","incident_date":"2012-11-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/State%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"d520746ed004","org_name":"Thorlo","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-38841"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/State%20Notification_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Thorlo%20Inc%20Ad%20NO%20Credit%20Services%20r3prf_0.pdf?"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/State%20Notification_0.pdf"}],"summary":"Thorlo filed a consumer notification regarding a security incident, but the supplied excerpt does not describe what happened or what information was involved.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb6fe35928ccd58b0f356f04d085898265aaa09c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F5EC660-3CB5-46C1-93E1-24D8F54B5432"},"incident_date":"2012-11-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"17b4ee96b599","org_name":"Reyerson University","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pogowasright.org/?p=32718"}],"summary":"A reporter called the Ryerson registrars office to investigate the student status of a person who turned himself in for sexual assault. The registrar allegedly gave information about the student's enrollment status to the reporter which is a violation of the privacy policy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07a3bc427a4a7603a1a8b8fc45fb432863faaf9c","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/MIAMI-%23682648-v1-Sprechman-CA_AG_Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"ca2c9edd32e8","org_name":"Sprechman & Associates, P.A.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36961"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/MIAMI-%23682648-v1-Sprechman-CA_AG_Sample_0.pdf"}],"summary":"Sprechman & Associates notified individuals that a former employee may have viewed their personal information without permission.","supporting_quote":"I am writing to advise you that your personally ide ntifiable information (“Information”) may have been viewed by a former employee of Sprechman & Associates without permission.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"826916c9cdc35f284f3fc33ee0990e34dc284db8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7F10C00-9872-4744-842D-D6260DDEB7D5"},"incident_date":"2012-11-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca04bab7b4e7","org_name":"Group Health Incorporated","org_type":"financial","ransomware":null,"records_affected":1771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Breach tool lists this as unauthorized access/disclosure with paper as the asset.  No further details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"756993b13424e73d8c42cc713736b31b08c0469d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FDAE387-9E27-497A-B978-5C4440673CB1"},"incident_date":"2012-11-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17fc7358098b","org_name":"Erickson Living","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazette.net/article/20130402/NEWS/130409912/1022/riderwood-computer-thefts-launches-hipaa-breach&template=gazette;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ericksonliving.com/silver-spring/privacy-breach-march2013.asp"}],"summary":"The five laptops stolen in November from Riderwoods physical therapy offices contained patient names and addresses, policy numbers, dates of birth and certain insurance information, according to Erickson Livings website.  Erickson Livings Dan Dunne, director of communications, sa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-11-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"585dd5160e9e937f2ac126166d0a4dea063646bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C680106-00FB-4F43-B01E-67779D8664C6"},"incident_date":"2012-11-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c60849f0bf67","org_name":"iPromo","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ipromo-20121203.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/ipromo%20Security%20Breach%20Notification%20Letter.pdf"}],"summary":"The company website (ipromo.com) was breached.  Exposed was an old customer data file with name, address, email, and account password.  There was also some exposure to masked and unmasked credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c051b70dc804164f769e1be675943983099bd24","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"101278F2-8031-49FC-ABF9-0918E861F9B9"},"incident_date":"2012-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a16ecc1a31f4","org_name":"Canada Human Resources and Skills Development","org_type":"government","ransomware":null,"records_affected":583000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://truomega.ca/2013/01/31/hrsdc-faces-criticism-for-handling-of-student-loan-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theglobeandmail.com/news/politics/government-faces-class-action-lawsuits-over-student-loan-borrowers-lost-data/article7492261/;"}],"summary":"Those affected by the student loan privacy breach announced on Jan. 11 are organizing and demanding government accountability. Student loan borrowers affected by the hrsdc privacy breach, a Facebook group of 2,459 borrowers (as of 12:27 a.m. PST on Jan. 31), has organized with mo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dd2e581c0a667cdaef8b889c19ae9c706f6bd75","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36A14CF9-22EB-493B-984C-E764AE705239"},"incident_date":"2012-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dccd69a8ebe4","org_name":"Ameriprise Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ameriprise-financial-services-20121113.pdf"}],"summary":"Account transfer forms were mailed out to clients who never received them.  The documents contained client name, address, SSN, account number and client ID.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"47bacbb5d387f8b49d0bc45e7ff5020dcec8947a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5844FF61-21A9-4003-B6D8-751BFDEE181D"},"incident_date":"2012-11-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8415f9d3680f","org_name":"Reyes Beverage Group","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-37728"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/RBGDataBreachLetterFINAL_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37728"}],"summary":"A report containing the names and SS#'s of some employee's was inadvertently sent to an employee of another one it's subsidiary due to a coding error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c937aa371b215f3802fa9934d9ee8156669ce10","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20CA%20notice_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"48d78632ff5f","org_name":"National Processing Company, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36913"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a35a9ff1d6df4cc17dfef054e6ad2284e422fb50","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FCEB5A2-BC6E-4936-987C-C77193D64203"},"incident_date":"2012-11-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b74633bc7c2","org_name":"SourceFire","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sourcefire-20121115.pdf"}],"summary":"A company laptop was stolen on November 6, 2012. Through our investigation, we have determined that the password-protected laptop contained files that include information related to SourceFire employees, including name and Social Security number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4498fa0a7106c93ad0659a54bee46610b020c9ef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CC4183F-16B4-432B-9FFD-C09368502FC1"},"incident_date":"2012-11-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf0b070ee747","org_name":"Office of Dr. Lee D. Pollan, DMD, PC.","org_type":"healthcare","ransomware":null,"records_affected":13806,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56883"}],"summary":"The theft of the doctor's laptop may have exposed patient information.  The theft occurred sometime between November 6, 2012 and November 15, 2012.  Information related to patient names, dates of birth, addresses, Social Security numbers, diagnose and surgery billing codes, dates","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8338e3841f5d722105af80624862477fe3a4f8b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81EFC64C-9B26-437D-BB50-13BCBA9F7A38"},"incident_date":"2012-11-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10d3e1779ab7","org_name":"Lee D Pollan DMD PC","org_type":"healthcare","ransomware":null,"records_affected":13806,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/oral-surgeon-notifies-former-patients-after-laptop-with-their-phi-was-stolen-from-his-office;http://www.phiprivacy.net/wp-content/uploads/LeePollanDMD_NYS_2012.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/31/stolen-laptop-from-closed-practice-cited-in-ny-data-breach/"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbf88e14c6833d12b6f95300a078d1c4806e2ad3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5666F27-29AF-4929-950F-0B6DC9773528"},"incident_date":"2012-11-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b132fb7bfc7","org_name":"Gulf Coast Health Care Services Inc","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec5c9b9f5599491beff1935192a7d0be4bba2358","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"057F49AC-11F1-4BEB-9006-F71229AD1F32"},"incident_date":"2012-11-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c118d3aea384","org_name":"Blount Memorial Hospital, Inc","org_type":"healthcare","ransomware":null,"records_affected":27799,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3986d748c3ad447b56dd2fd5cad5e484c55ca73f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FB404A8-6611-4EA2-9B05-F685BAF210A6"},"incident_date":"2012-11-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d3637df6b46c","org_name":"Calvin L. Schuster, MD","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Calvin%20Schuster%20Breach%20Notice%20_0.pdf?"}],"summary":"Burglary at doctor's offices results in computer stolen that contained names, dates of birth and medical information of patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f98860c786164c3b50ed4842ff54ede40ee1ce0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B6DB4B47-AFBA-455F-9D42-7C3D4BBD6D9E"},"incident_date":"2012-11-05","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2012/12/21/second-data-leak-in-the-state-of-california/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kcra.com/news/local-news/news-sacramento/State-of-Calif-mistakenly-publishes-thousands-of-SSN-online/-/12969376/17723434/-/item/0/-/14jl2vwz/-/index.html"}],"summary":"State agency accidentally publishes thousands of employees personal information online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b46066683f652f076b9233525e4c4fd7e5e1ce9d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D60E042-36C7-4D4E-AC87-F2BF8A2FB5CF"},"incident_date":"2012-11-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran complaint alleging inappropriate access to Veteran Medical Record after receiving a copy of her sensitive patient access report.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5dc5f70c940ee5e339b9bfc580b3f337edfd69d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A86D598-6275-4D99-BC49-89287C1E7A1D"},"incident_date":"2012-11-02","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b8586bdd9405","org_name":"Glens Falls Hospital","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/22/glens-falls-hospital-patients-file-suit-over-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.saratogian.com/articles/2013/04/19/news/doc5171698f495b1242435394.txt"}],"summary":"Two patients ran a google search of their names and were able to find their medical information online.  Doctors' reports with medications, medical treatments, lab information, future and past treatment plans, physical examination information, and lifestyle information could be d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ceb4d93f6feacf94d646aaf9d090ef39fc7e576","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2F7D1F5-4B59-4B69-9126-3E5E7C501DC2"},"incident_date":"2012-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1764faa05938","org_name":"UnitedHealth Group","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_1.pdf?"}],"summary":"An unencrypted desktop computer was stolen from an RR Donnelley facility sometime between mid September and the end of November, 2012.  RR Donnelley is a vendor of UnitedHealthcare.  It is unclear why the breach was not noticed until December 3, 2012.  The stolen computer contain","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a78b5ed3bac787638be43cfc627d6cb8406a0edf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53B0938C-5433-4D1F-B153-5844A00D4E9C"},"incident_date":"2012-11-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2bfe1cb20322","org_name":"UK Royal Air Force","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://nakedsecurity.sophos.com/2012/11/21/prince-william-photos-password/;http://www.theguardian.com/uk/2012/nov/20/prince-william-photos-mod-passwords"}],"summary":"Prince William photos slip-up forces MoD to change passwords MoD resets usernames and passwords of some RAF staff after information was visible on computer screens in PR shots","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5956eb8f42466fae999d3a7a96909448f5b2024","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D091809-ED6D-413D-B095-EE6496BFA000"},"incident_date":"2012-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"f885067eef60","org_name":"Tetriary Education Commission","org_type":"education","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.odt.co.nz/news/dunedin/239614/stolen-research-staff-details-unlikely-be-recovered"}],"summary":"A stolen briefcase containing the private information of 500 research staff from tertiary institutions, including more than 140 staff from the University of Otago, will likely never be recovered, the Tertiary Education Commission (TEC) says.  The briefcase, which contained eviden","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd803e0456d7ba4dd220bee85ba67791309329b3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12009EE8-4A4C-4A67-A58B-6FF98449A8A0"},"incident_date":"2012-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e4ce2c7d87bf","org_name":"Sentara Norfolk General","org_type":"healthcare","ransomware":null,"records_affected":56000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2013/03/lapses-security-put-personal-health-records-risk"}],"summary":"The letter arrived during the Christmas holidays. It looked like junk mail, so Patricia put off opening it.  When she finally read it, the first paragraphs alarmed her: \"Regrettably, we are writing to inform you about an incident involving your health information.\"  In November, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7136c3cb066e054b8b3bcc6dcd20add09ecc50e7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86B22D8D-410B-4EC3-9F12-30D5C4EBD2E9"},"incident_date":"2012-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21d7a1f7f35c","org_name":"Northrop Grumman Corp","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/northrop-grumman-20130809.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Northrop%20Grumman%20Tech%20Services%20Inc%20Security%20Breach%20letter%20to%20consumer%20.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/us-defense-contractor-sustains-data-breach/article/307498/"}],"summary":"Employees for and applicants to the linguist program of Virginia-based defense contractor Northrop Grumman may have had their sensitive information compromised when a database was accessed by an unauthorized party.  How many victims? Unknown. Northrop Grumman employs more than 70","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc735a810ea927f1305e64d3d2d6ef378f25d4d2","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":"2012-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"BE","org_id":"693d0b07e9a9","org_name":"Netlog","org_type":"technology_saas","ransomware":null,"records_affected":49038354,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Netlog","type":"hibp","url":"https://haveibeenpwned.com/Breach/Netlog"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Communication%20to%20Users%20-%20FINAL_0.pdf,https://www.tellerreport.com/tech/2019-07-15---data-breach-at-belgian-social-medium-netlog-affected-49-million-accounts-.BJbxRMqZH.html"}],"summary":"Netlog identified a breach dating to November 2012 in which subscribers’ email addresses and plain-text passwords were exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c009975ad50b34b1d530f1d6be8b1361a2706427","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E408978-B08B-4FE0-B716-2BF174AE534A"},"incident_date":"2012-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"87a8dc52c10f","org_name":"Mansfield General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chad.co.uk/news/health/medical-records-found-by-urban-explorer-at-derelict-former-mansfield-general-hospital-to-be-removed-by-health-trust-1-5090122;"},{"fetched_at":null,"title":null,"type":"press","url":"http://http//www.chad.co.uk/news/health/medical-records-found-by-urban-explorer-at-derelict-former-mansfield-general-hospital-1-5086023"}],"summary":"Private medical records belonging to Mansfield residents which were unearthed by an urban explorer at the towns former General Hospital were removed by health officials on Friday after Chad.co.uk highlighted the issue on Thursday.  The urban explorer - who wishes only to be known","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5c78b52eacf32dc195eda0e02c8e5b0cf268738","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DA10064-7313-4D50-A755-80A873734C03"},"incident_date":"2012-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbabb230877c","org_name":"Kara Falck, LCSW-C","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227129.pdf"}],"summary":"Social worker returned malfunctioning hard drive, that ultimately was sold to third party w/o proper data deletion. Medical information for seven clients was disclosed.http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227129.pdf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3759ada3d8915611f6f539b9140cb2f0cf0f06f4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16612C25-A4DD-4254-A7A4-4BA9BE10B6AD"},"incident_date":"2012-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8c4126d0140","org_name":"Florida Healthy Kids Corporation","org_type":"other","ransomware":null,"records_affected":3667,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Florida Healthy Kids Corporation reported that a breach involving DentaQuest of Florida, LLC affected 3,667. The breach occurred November 1, 2012  December 20, 2012 and involved Unauthorized Access/Disclosure,Paper.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef27039e00de94c05d5fffdf73e34d45000f0641","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78FD6549-7F83-404C-90E9-56EC6294DADA"},"incident_date":"2012-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76a997e88596","org_name":"Florida Agency for Health Care Administration","org_type":"government","ransomware":null,"records_affected":1892,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?s=DentaQuest&x=0&y=0&=Go,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wp-content/uploads/Miami-Herald-Public-Notice.pdf"}],"summary":"Florida’s Agency for Health Care Administration reports that a breach involving its business associate,  DentaQuest of Florida affected 1,892 patients. This was a printing error on the part of OnTouchPoint CCI, DentaQuest's print vendor.  A programming error resulted in member ID","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c34676921071ed20309dad48ddb6c6b292e21f18","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B3E901D-BEA6-41C3-AEC9-AE9FAB89BA61"},"incident_date":"2012-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74c50923b050","org_name":"Equinox","org_type":"other","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://darien.patch.com/groups/police-and-fire/p/two-equinox-employees-charged-with-stealing-credit-card-info"}],"summary":"2 gym employees used credit card information of a customer to complete fraudulent transactions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d2b054e83517d9c2d6e724445f5fd974be83beb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF11CCEE-0AE0-4FCD-84A2-E28CEAEDD05A"},"incident_date":"2012-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"6369d4839b3c","org_name":"Employment and Social Development Canada","org_type":"government","ransomware":null,"records_affected":583000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ctvnews.ca/canada/lost-hard-drive-with-student-loan-data-lacked-password-protection-1.1744884;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/ca-lost-hard-drive-with-student-loan-data-lacked-password-protection/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.priv.gc.ca/cf-dc/pa/2013-14/pa_20140324_e.pdf"}],"summary":"Portable hard drive that contained sensitive information was lost. Hard drive was not protected by full disk encryption or a password.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afbe5f90b812241396c1bfb85bbbebca2d0916e2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B1BE1F2-DD1F-4A8C-9800-253853471BCA"},"incident_date":"2012-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6c723f5e8be1","org_name":"Cambridge University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/uk-man-pleads-guilty-to-cyber-attacks-on-universities-police.html;http://www.cambridge-news.co.uk/News/Man-charged-over-Cambridge-University-hacking-attempts-22112012.htm"}],"summary":"Website DoS & defacement; network/system intrusion","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fb9f09d2740f6fc1c10d1190b417f6357ad96a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBADD966-B5FE-4EBD-9D9E-E4DAF5105D4B"},"incident_date":"2012-10-31","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"85868a2a5208","org_name":"Spec's","org_type":"retail_ecommerce","ransomware":null,"records_affected":550000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/tx-specs-discloses-hack-that-began-october-31-2012-may-have-affected-more-than-500000-customers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news92fm.com/424658/specs-announces-data-breach-customer-information-compromised/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/new-retail-breach-low-and-slow-attack-a-6701;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.net-security.org/secworld.php?id=16622"}],"summary":"Multiple locations of supermarket chain were infected with malware designed to capture credit card data. Systems in 34 locations were compromised and 550,000 payment cards are at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73bab2b0329fa477015ef16d4f683c653fa6dfc2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"04583D77-90C0-42C2-B0B8-E034AC1C2F67"},"incident_date":"2012-10-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c16beff692a9","org_name":"Library Systems & Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Breach%20Notice%20-%20Final_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37274"}],"summary":"Laptop stolen, doesn't say where from.  Laptop contained employee personal data including names, addresses, DOB and SSN.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3a7c262dcf18ab0c40ed049bdb75a5f59257f9e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D0DFF0A-17AD-47D1-B1A9-806156A1974A"},"incident_date":"2012-10-30","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7be5939e0c7","org_name":"LexisNexis","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/lexisnexis-20121206.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/12%2012%2010%20LexusNexis%20Risk%20Solutions%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"An error in a technical change made to a process used to generate reports caused certain sensitive PII to become unmasked and displayed in full on consumer's reports.  Sometimes this also affected others in the household of a claimant, for example.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd171e6147bc04714952dd3d0679ca0b22ec1dff","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-07-27","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_1.pdf"},"notes":null,"org_country":"US","org_id":"9cafa450d027","org_name":"HSBC Bank USA National Association","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36836"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_1.pdf"}],"summary":"A former HSBC employee who resigned left with customer account information that may have been exposed to a third party.","supporting_quote":"We recently became aware of an incident that occurred in late July 2012 where an employee who resigned from HSBC left with information about your account.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcde594a5985794230a615dfed947335e7c90cce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60F9E43E-7043-4FE9-89D6-7BAD51ED2DE8"},"incident_date":"2012-10-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Experian%20Security%20Breach%20Notice%20ltr%20to%20consumer.pdf"}],"summary":"experience with the nationwide credit reporting agencies identified that its clients CASE federal credit union have certain experience consumer information access without proper authorization. The consumer information consists of information found in a Consumer Reports. Such info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bec7b37c7c4672b48e92adc7f9777d808182c79d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5BE1EB5-2D08-44BB-8084-088F137CE48A"},"incident_date":"2012-10-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6435b6f226fc","org_name":"Regional Medical Center Memphis","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.the-med.org/media/Public-Notices/PHI%20Public%20Notice%205.9.13.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthblawg.sharedby.co/share/DcVea0"}],"summary":"Employee accidentally send protected health information via email to the wrong recipients","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-10-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00e22b367540df82d59f7b5cbba4c8f5da8de363","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7193D55B-F53A-40AA-BE67-AB3FE7DC2793"},"incident_date":"2012-10-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"254b914c04c9","org_name":"Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56676"}],"summary":"Some patients who were treated at an outpatient facility between May 1 of 2012 and January 31 of 2013 had their information attached to emails that went out to an unspecified organization or organizations.  Three emails that were not secure were sent on October 29 and November 1 ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-10-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ada480acba6a9a4c579b71e3dcdaddc14240ecce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C138890-5D0F-4CC3-B5A4-67BC8CF571F7"},"incident_date":"2012-10-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c425499af752","org_name":"Yolo Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Yolo%20FCU%20IDENTITY%20THEFT%20VICTIMS-Immediate%20Steps_1.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Yolo%20Skim%20Notice_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mercurynews.com/crime-courts/ci_22502375/bank-card-scam-skimming-devices-target-consumers-at"}],"summary":"The notice only says that it identified the cardholder's card as one that had potentially been compromised and they blocked it.  They don't say what triggered that belief.  They were called out specifically in the article by mercurynews.com as ATM skimming.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"DE","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9c39394e411b73a5e51a5aca9208584e5ae74a3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB059CE8-AAA9-446F-AD25-4650B25AF9D4"},"incident_date":"2012-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"15d3c4ac61cf","org_name":"Ramstein Intermediate School","org_type":"education","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stripes.com/news/stolen-thumb-drives-might-hold-personal-data-on-ramstein-students-1.197984"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stripes.com/news/stolen-thumb-drives-might-hold-personal-data-on-ramstein-students-1.197984,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=26727"}],"summary":"Thumb drive stolen from personal vehicle contains non-public data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2012-10-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"192060d0c8c5520b993031482772c84ffd56676f","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice%20with%20Press%20Release_0.pdf"},"notes":null,"org_country":"US","org_id":"9014ce6a6df4","org_name":"Barnes & Noble","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36794"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice%20with%20Press%20Release_0.pdf"}],"summary":"Barnes & Noble reported that tampered in-store PIN pad devices captured customers’ payment-card information.","supporting_quote":null,"technology_involved":["PIN pad devices"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0a1949ce1924946b8c3314b2a8f44c95839ebf2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1403F12-2540-4015-95BA-0516970EA949"},"incident_date":"2012-10-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6739e739503d","org_name":"WorldVentures Marketing LLC","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/worldventures-20130430.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/BrittonTuma%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"Intrusion into computer systems puts customer cardholder data at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2012-10-22","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cf9c2c50e00fd0decd56af59938e432990b9196","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-09-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/PHILIP%20P%20BREACH%20%28Recovered%29_0.pdf"},"notes":null,"org_country":"US","org_id":"4fb2572b0e74","org_name":"Philip P Corneliuson","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36793"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/PHILIP%20P%20BREACH%20%28Recovered%29_0.pdf"}],"summary":"Philip P Corneliuson reported that a computer containing patient medical records and personal information was stolen during an office break-in.","supporting_quote":"On the afternoon of Saturday , September 15th 2012, we discovered our office suite broken into and our computer stolen.","technology_involved":["computer"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-10-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d3a16ebc65e03e84a4b7dc19885785da5d38657","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4CEA872-3269-4EE4-A18D-21D2444C2234"},"incident_date":"2012-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03be561fbf4c","org_name":"South Shore Medical Center","org_type":"healthcare","ransomware":null,"records_affected":15693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cfpsych.org/HIPAA-Breach-Letter.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ssmedcenter.com/SSMC-Public-Notice-010313.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11395,"}],"summary":"On December 3, 2012, the vendor that hosted our website informed us of a hacking incident that occurred between October 18, 2012 and November 15, 2012. This resulted in unauthorized access to certain information entered on our website between January, 2007 and November 15, 2012. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-10-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4c1a745feb773e1df6badce26adceb1cb95211c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC461BDB-A984-466B-86AA-B60C5DFC62F2"},"incident_date":"2012-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18a356a8f41a","org_name":"Child & Family Psychological Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":7250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cfpsych.org/HIPAA-Breach-Letter.pdf"}],"summary":"Hacking incident at partner hosted website exposes 7,250 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38d57e62196ec061c406745151c455631c07dba0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"744D72E2-2527-463B-B588-DF1C35BDF03A"},"incident_date":"2012-10-18","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"532044cbd6c0","org_name":"Brampton Civic Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.torontosun.com/2014/10/31/actors-witness-rectal-exam-lawsuit"}],"summary":"Medical shows on TV are keen on getting their facts straight and their scenarios realistic.  But at least one patient insists that research shouldnt include letting the actors in to watch you get a rectal exam.  Thats what Walter Fisher claims happened two years ago when he was a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-10-16","discovered_date":"2013-01-07","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"841d117a5881b628f3b12cbe560e4cde914b6f7e","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-10-16","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer_Notification_Ltr_0.pdf"},"notes":null,"org_country":"US","org_id":"fea68619b9bf","org_name":"Fabric Depot, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-39040"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227141.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer_Notification_Ltr_0.pdf"}],"summary":"Fabric Depot reported that an unauthorized third party accessed its website and data system, potentially exposing customer credit card information, names, and billing addresses.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f100be0e6deda413f1e4433050f697e355ca8573","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0338F1E-4936-4509-A968-64FF21B0CC6F"},"incident_date":"2012-10-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"7e422648229c","org_name":"New Zealand Ministry of Social Development","org_type":"government","ransomware":null,"records_affected":7307,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.msd.govt.nz/about-msd-and-our-work/newsroom/factsheets/factsheet-privacy-process.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.msd.govt.nz/documents/about-msd-and-our-work/newsroom/media-releases/2012/independent-review-deloitte.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.msd.govt.nz/documents/about-msd-and-our-work/newsroom/media-releases/2012/independent-review-timelines-deloitte.pdf"}],"summary":"What happened?  On Monday the 15th of October the Ministry of Social Development received a USB containing 7,307 items downloaded from two kiosks.  A team led by the Ministry’s Chief Legal Advisor then put in an intensive effort to analyse these items and categorise them based on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b16d42582d40a70c704c028d7107277c8f81d56d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFE955CE-DAB0-4054-B55F-666F939415BB"},"incident_date":"2012-10-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53b1ab2a7e69","org_name":"Workers United","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/workers-united-20121130.pdf"}],"summary":"on October 25, 2012, workers United was informed by an independent contractor that a hard drive containing certain retiree personal information had been stolen from the contractor's office. The theft is believed to have occurred: October 13 or 14 2012. The hard drive included a d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"774eade82fa7e4d4cf9cc7c9a7e02f239a4530c3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC907BE6-25FD-4D47-8844-FF32466CAFB2"},"incident_date":"2012-10-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e05a3162b683","org_name":"Office of the Medicaid Inspector General of New York","org_type":"government","ransomware":null,"records_affected":17743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/17/office-of-the-medicaid-inspector-general-reports-data-breach/;http://apps.cio.ny.gov/apps/mediaContact/public/preview.cfm?parm=E5EBBF49-5056-9D2A-10DAA90DCDDE22E1"}],"summary":"Office of the Medicaid Inspector General reports N.Y. breach  The Office of the Medicaid Inspector General (OMIG) sent out a release on Monday stating that an internal employee in New York had sent out 17,743 Medicaid patient records to their own email account on Oct. 12, 2012. P","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edb9558db6675a0c4aeabf8ae4759879955787f2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6950113B-E09D-44E9-A394-9B36A1B25BB8"},"incident_date":"2012-10-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"957fdd8ff5af","org_name":"Office of the Medicaid Inspector General","org_type":"healthcare","ransomware":null,"records_affected":17743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/17/office-of-the-medicaid-inspector-general-reports-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://apps.cio.ny.gov/apps/mediaContact/public/preview.cfm?parm=E5EBBF49-5056-9D2A-10DAA90DCDDE22E1"}],"summary":"An OMIG employee sent an email that contained sensitive records to their own email account on October 12, 2012.  Medicaid paitient first and last names, Social Security numbers, dates of birth, and Medicaid client information numbers may have been compromised. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cca20782c9cd16428918edf3047b28d699855f89","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56484370-2893-47C8-ADF8-33215200E70E"},"incident_date":"2012-10-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4edfc1c6fea1","org_name":"Office of Medicaid Inspector General","org_type":"government","ransomware":null,"records_affected":17743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/state-employee-suspended-after-breach-a-5913"}],"summary":"The New York state office that investigates Medicaid fraud has suspended one of its own workers after the individual allegedly sent 17,743 records of Medicaid beneficiaries to the employee's personal e-mail account.  See Also: 2015 Insider Threat Report  The employee, whose name,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b72630ab928ac8a550384ecc35db632e8ee1a66","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3134E9DD-2FB6-42DA-88B7-12D18516CDD7"},"incident_date":"2012-10-12","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e164213ba17c","org_name":"New York Office of the Medicaid Inspector General","org_type":"government","ransomware":null,"records_affected":17743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://apps.cio.ny.gov/apps/mediaContact/public/preview.cfm?parm=E5EBBF49-5056-9D2A-10DAA90DCDDE22E1"}],"summary":"On October 12, 2012, an employee of the Office of the Medicaid Inspector General (OMIG) is suspected of having made a personal decision, without agency involvement or authorization from OMIG leadership or his or her personal supervisors, to send 17,743 records of Medicaid recipie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b45579b9254a6f43d2ec6c25d604c4a63f6e6ad1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23506596-73A0-4ABF-B886-1C82F8CC87B4"},"incident_date":"2012-10-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"036557bd8a41","org_name":"Columbia University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":4929,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Columbia University Medical Center and NewYork-Presbyterian Hospital reported that 4,929 patients had PHI on a stolen desktop computer. The theft from a locked office occurred sometime between October 12, 2012 and October 15, 2012. I was able to find a privacy alert still on thei","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98c3f8c11a218e57aa4c1a22675a929e2c271a00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B3CB0D2-F2FA-4FAD-8904-4E5451A0E9D4"},"incident_date":"2012-10-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"176d18bedbde","org_name":"University of Nevada School of Medicine","org_type":"healthcare","ransomware":null,"records_affected":1483,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.medicine.nevada.edu/news/university-of-nevada-school-of-medicine-notifies-patients-of-possible-information-breach.htm"}],"summary":"The University of Nevada School of Medicine notified 1,483 patients whose PHI were on records that were accidentally disposed of on October 11, 2012 instead of being shredded. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5c77ce6da09bcc80fffad67594f3dac58523dfe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98D19D9E-284A-4736-982F-9A6212AA02CB"},"incident_date":"2012-10-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"22ef275702fb","org_name":"Pinnacle Foods Group LLC","org_type":"manufacturing","ransomware":null,"records_affected":1818,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pymnts.com/news/businesswire-feed/2012/november/26/pinnacle-foods-group-llc-reports-data-breach-individuals-in-multiple-states-could-be-affected-20121126006302/"}],"summary":" Pinnacle Foods Group LLC, a producer, marketer and distributor of branded food products, today announced that the personal information of up to 1,818 individuals in up to 13 states plus Mexico may have been affected by a theft of a company laptop from an employee’s home.  Pinnac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e882a8e75fd9e2a4c9de6aae39539ed4368a7427","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80AFA9CB-F969-489A-8F5D-AE7D7049DAFE"},"incident_date":"2012-10-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1fb2ba90425","org_name":"NYU Langone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":453,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.med.nyu.edu/about-us/potential-data-breach-notification"}],"summary":"NYU School of Medicine, part of NYU Langone Medical Center, notified 453 epilepsy patients on December 10, 2012 that an unencrypted portable USB drive used to store information gathered for a research project regarding epilepsy treatment was reported missing on October 11, 2012 b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2012-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"499d3c03b038ac92c982e153079ebe98be77635e","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"ca501ee03846","org_name":"Korn/Ferry","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36705"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_0.pdf"}],"summary":"Korn/Ferry reported a cyberattack affecting databases that contained some files with personal information, with no evidence that the information had been misused.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f44eeaef92420e8d33892bd6d00e179e3c26cff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2A35375-A122-4C71-9F16-F82B1CF64770"},"incident_date":"2012-10-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c82818edd3d0","org_name":"American HomePatient Inc.","org_type":"healthcare","ransomware":null,"records_affected":1103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"A laptop was stolen or discovered stolen on October 11, 2012.  The incident appeared on the HHS website in February of 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54360c979a62ac9ebf8ffdfbc99dfebaa2d7791f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"114329B6-C17F-4736-B706-7B896188CA5A"},"incident_date":"2012-10-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32457df5fad0","org_name":"Sovereign Medical Group, LLC","org_type":"healthcare","ransomware":null,"records_affected":27800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-additions-to-hhss-breach-tool/"}],"summary":"Incident, of which there is no publicized data, results in data loss affecting 27,800 patients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d64e34457aebe015d89589eede591d626ab7fb1c","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-11-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Recoverd%20-%20USSS%20-%20C2012085620%20CA%20AG%20Letter_Customer%20letter_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36674"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36891"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36903"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37017"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Recoverd%20-%20USSS%20-%20C2012085620%20CA%20AG%20Letter_Customer%20letter_0.pdf"}],"summary":"American Express notified a cardmember that their card number, name, and card expiration date had been recovered during a law-enforcement and/or American Express investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa743d4967204890c4f42f66b7ad7f7ae80ca776","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31EA1BF8-978D-4A87-BB54-2E019D6B569E"},"incident_date":"2012-10-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"eab767ac9adb","org_name":"Accume Partners","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/CA.FormNotce_0.PDF?"}],"summary":"Laptop stolen from Partner CPA firm's vehicle.  It contained employee data including name, SSN, DOB and payroll information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-10-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa8fd21f4a23fc59dc70cba82f3bf3e135b1276e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"889F4563-6DF4-4633-9279-B11CDF30CCB2"},"incident_date":"2012-10-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69d314c30b23","org_name":"Wilton Brands","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Wilton%20Brands%20Individual%20Notice%20Letter_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Wilton%20Brands%20Individual%20Notice%20Letter2_0.pdf?"}],"summary":"Customers who made purchases on www.wilton.com between October 8, 2012 and January 8, 2013 may have had their credit or debit card information exposed.  A Wilton service provider discovered the issue on or around January 8, 2013.  A malicious user accessed the website information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-10-08","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a9964f71fbb374ed314a9d9b99981abdf804db4","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-03-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notification_0.pdf"},"notes":null,"org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36662"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification_0.pdf"}],"summary":"TD Bank reported that two backup tapes containing some customers’ personal information went missing after being shipped to another location.","supporting_quote":"Some of your personal information was included on two data backup tapes that we shipped to another one of our locations in late March 2012.","technology_involved":["data backup tapes"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cce40e7524982ce51a51ae37cd101158197243d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B21D344-E831-469C-B243-839A5747F74F"},"incident_date":"2012-10-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6dd281233db2","org_name":"Robbins Eye Center","org_type":"healthcare","ransomware":null,"records_affected":1749,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11065;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach?order=field_breach_total_value&sort=asc&title="}],"summary":"Records were compromised by a stolen desktop computer at Robbins Eye Center.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00e639337091eb53d0ac6dfae363a816396cec28","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"590BA770-3A10-4DF2-BF15-F3B70E5741F2"},"incident_date":"2012-10-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f3610328fb6","org_name":"University of Virginia Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.clinical-innovation.com/topics/privacy-security/lost-mobile-device-impacts-1800-home-infusion-patients,"},{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2012/12/uva-med-center-warns-potential-privacy-breach"}],"summary":"The University of Virginia Medical Center is warning patients that an electronic device containing their medical and personal information is missing.  The handheld device was used by on-call pharmacists at Continuum Home Infusion. It went missing around Oct. 5.   Hospital officia","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2684086e5ae98c45b7c942761d93f50c85c04f2","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAD8DFDB-9657-49FF-A227-28E50B2BA143"},"incident_date":"2012-10-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e6a5397e2a6","org_name":"Coastal Home Respiratory, LLP","org_type":"other","ransomware":null,"records_affected":3440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Coastal Home Respiratory, LLP in Georgia reported that 3,440 patients had their data stolen on October 4, 2012. Well, I think it was stolen. The HHS log reports it as Theft,Other but I can find no documentation on the incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"ideology","name":"Lauri Love","variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"435b5ddc728ec112c3524a9c20e1b17d7f10233e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA022572-CC8A-423B-87A5-2142FFC4ADB3"},"incident_date":"2012-10-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aa6adb2318b3","org_name":"US Federal Reserve Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://uk.reuters.com/article/2013/02/08/us-usa-fed-hackers-idUKBRE91501920130208;http://mashable.com/2014/02/27/federal-reserve-hack/"}],"summary":"hacker used SQL injection to break into US Federal Reserve and posted confidential information to a public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"laurilove"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e3e61e41bc34725aef7d3457c9784ede67075c0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"610227A8-54AC-4C45-A318-13863761671C"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b0a4d53f40f","org_name":"TooJay","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.orlandosentinel.com/news/local/breakingnews/os-skimmer-too-jays-server-20130829,0,5010687.story"}],"summary":"A woman pleaded guilty in federal court Thursday to stealing credit card numbers from TooJay's customers via a skimming device when she worked at the Orlando deli as a waitress.  In her plea agreement, Jessica Soviero admits her ex-boyfriend gave her a skimmer and paid her cash a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7af56e485460a61fa7f1f238924e8abf12b863a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBF66BEE-55F9-463E-BA47-602753CB2A66"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51174b828d11","org_name":"Texas Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/health-clinic-employee-charged-with-identity-theft.html"}],"summary":"The Texas Department of State Health Services (DSHS) recently announced that it's investigating a former DSHS Mount Pleasant clinic employee who is alleged to have stolen credit card and other personal information from clients.  The former employee, Selena Patino, was arrested on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26e0153edf1c7f5344297dc1358db566f819905c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C43E76D-DA11-461A-8A66-84EB0F716300"},"incident_date":"2012-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46adb37e5da6","org_name":"St. Therese Medical Group","org_type":"healthcare","ransomware":null,"records_affected":3031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36474"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85d6ede93121e945fd63dbefeeb13c3cd8a2ca50","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8667AA0-7967-47F8-854C-0B28C942CF72"},"incident_date":"2012-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b883cbf4bcde","org_name":"SilverScript Insurance Company","org_type":"financial","ransomware":null,"records_affected":852,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-additions-to-hhss-breach-tool/"}],"summary":"Data breach affecting 852 patients reported. No details on how incident occurred are available other than data was in paper form.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8757be518dd2ea093a426093c674773828b4105a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43AC915E-AC99-4302-9CF9-3C36198FF92F"},"incident_date":"2012-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0075c204fb8","org_name":"Sierra Plastic Surgery","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f17e766addc10ffb13beb463d26ebb05f029d163","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81A80A64-3F93-42C9-8178-BD72F648F164"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0b4009e031b","org_name":"Miami Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/news/Former-Miami-Police-Officer-Sentenced-in-ID-Theft-Scheme-242909001.html"}],"summary":"Police officer misused access to gain information which he attempted to sell to an identity theft ring. Actually sold to an undercover cop.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20aa912c4c75d8af547b66add4c725e24b8573f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D828A03B-2629-444C-BA31-F393837D3E75"},"incident_date":"2012-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"d2049d2f8d4b","org_name":"Government and Scientific targets in numerous countries","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securelist.com/en/analysis/204792262/Red_October_Diplomatic_Cyber_Attacks_Investigation,"},{"fetched_at":null,"title":null,"type":"press","url":"http://euobserver.com/institutional/118729"}],"summary":"External attackers have been conducting a campaign of attacks against government entities of several countries.  This is from the Red October Kapersky Lab report.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f08595f22ba8faf0a8b28b5e6f4d6489b7fa0422","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0404932F-7D61-4965-BFB5-D7DBBA346069"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1d7713dbbcf2","org_name":"Glenrothes CID crime team","org_type":"government","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.thecourier.co.uk/fp/news/local/fife/296691/fife-police-officers-data-protection-breach-trial-begins/"}],"summary":"illegally accessed crime files and intelligence database entries relating to two brothers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0bfc589c9be84295021c01afc9ccbb7e99fa7f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C8BF6D6-7488-4ADA-BB52-BE1DA1D4B47A"},"incident_date":"2012-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38138e4f6ac4","org_name":"Fairfax County","org_type":"government","ransomware":null,"records_affected":595,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fairfax-county-notice-unauthorized-vendor-release-of-personal-and-medical-information/"}],"summary":"Fairfax County, Virginia issued the following release yesterday about a breach that does not appear on HHSs public breach tool and that was not previously known to this site. They say a total of 595 individuals were affected, but the number whose PHI were involved was not specifi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25794ddf074601148d105e067f560895fe6f2014","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4C8E9B8-3012-44BD-A859-11D1276022F5"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6e47431c410","org_name":"Econo Lodge","org_type":"other","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dothaneagle.com/news/crime_court/article_5de3944c-f3e2-11e2-b14c-001a4bcf6878.html"}],"summary":"A Troy man faces more than a dozen felony charges alleging he used the computer at a local hotel where he worked to make multiple purchases with customer’s credit card numbers.  Court records show Troy police investigators arrested 28-year-old Jonathan Rofeal Collins on Monday, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4fd393c9ae2536cb503e81abdaae766781007de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F6087AA-2509-4EE2-83CF-FA96B910E654"},"incident_date":"2012-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"other","ransomware":null,"records_affected":40,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859e7c61fe0b1c32db84a9fd5d228249375e0f49","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E46202B6-74FF-41FD-A386-BE097B38E8FB"},"incident_date":"2012-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06a5ff87fdf7","org_name":"Broward Health & Wellness","org_type":"healthcare","ransomware":null,"records_affected":960,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/palm-beach/fl-broward-health-data-breach-20131018,0,7325048.story"}],"summary":"A former Broward Health Medical Center employee took documents containing the personal information of nearly 1,000 patients in a data breach uncovered by local and federal officials, the Fort Lauderdale health system announced Friday.  Some 960 patients, treated between October a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e497c17229fa72433987d38daab85c3b98ace037","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E234808-4D88-4EEC-AD0E-BC109B3E8D07"},"incident_date":"2012-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa55a1c97f50","org_name":"Bright Horizons Family Solutions Inc","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/easydraft-data-breach-exposes-bright-horizons-customers-financial-data.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bright-horizons-easy-draft-20140121.pdf"}],"summary":"EasyDraft, which processes payments for Bright Horizons Family Solutions, recently began notifying an undisclosed number of current and former Bright Horizons customers that their names, bank routing numbers and bank account numbers were mistakenly made available online (h/t Data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbde89c1f5b031cd46e3d7ccc3290e943f4030da","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"300E70CE-1796-4E9C-A5A2-309D5B7E9912"},"incident_date":"2012-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4caeb9437636","org_name":"Arkansas Department of Finance and Administration","org_type":"government","ransomware":null,"records_affected":7039,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The Arkansas Department of Finance and Administration, Employee Benefits Division reported that 7,039 employees were affected by a breach at Health Advantage that occurred in October 2012. The incident involved paper records, and Health Advantage separately reported the breach as","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f06caa2a418409b51d5e3eb0414dcf4a679efe4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBC1B7EC-6561-4B80-802F-FD1BA55DBCA4"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f3b4b516f91","org_name":"Akron General Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.propublica.org/article/clooney-to-kardashian-celebrities-medical-records-hospital-workers-snoop;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ohio.com/news/akron-general-fires-employees-for-patient-privacy-violations-in-hospital-shooting-case-1.341300"}],"summary":"Akron General Medical Center in Ohio fired a \"small number of employees\" for looking at the medical records of a woman whose husband fatally shot her in the hospital's intensive-care unit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0cd99e0c95ffc4f2369d105bf3dc9e8738e1e6f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8718715-0F94-477C-BFF0-9E5A61B25885"},"incident_date":"2012-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d999276d4947","org_name":"Advanced Data Processing, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yumasun.com/data-breach-affects-yuma-ambulance-patients/article_0c4652ed-cb2e-5d49-bdb0-5d48621ef905.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/how-many-were-affected-by-adpi-intermedix-breach-help-track-this-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/default/article/931-in-Berkeley-may-be-ID-theft-victims-4079241.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsmv.com/story/20222801/notification-ambulance-data-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/advanced-data-processing-20121128.pdf;"}],"summary":"A notice posted on the city of Yuma's website reports that account information of ambulance patients served by Yuma Fire Department were illegally accessed during a data breach of the company that provides the billing service. But it's thought that no information about Yuma patie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0d06fc71b4384ed1d4393d29db1e3dbaa653716","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2AE42D0E-A960-4B62-B9ED-7BD28CDA15F8"},"incident_date":"2012-09-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"13e3755625dc","org_name":"University of Georgia","org_type":"education","ransomware":null,"records_affected":8500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/atlanta/news/2012/10/12/uga-employee-data-breached.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/atlanta/news/2012/12/11/uga-dead-former-student-responsible.html"}],"summary":"Hackers have gotten to the personnel records of at least 8,500 current and former The University of Georgia employees, UGA Vice President for Information Technology Timothy M. Chester reported Friday.  The initial intrusion may have occurred as early as Sept. 28. The investigatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3f2cb467edfabbe96f01152da8e8e529866aad2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90B2557D-335C-414B-B490-3226FB070552"},"incident_date":"2012-09-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e0bf9384567","org_name":"County of San Bernardino","org_type":"government","ransomware":null,"records_affected":1370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The County of San Bernardino Department of Public Health in California reported that 1,370 patients had PHI on records involved in a breach that occurred between September 28, 2012 to September 30, 2012 involving Unauthorized Access/Disclosure,Paper. I was unable to locate any no","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb1323629e22103a8cd0ed8cb84fc50afe56030a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5524880E-9EAA-4889-830C-9B52B44CBC8E"},"incident_date":"2012-09-26","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24229f1abca8","org_name":"California Department of Corrections and Rehabilitation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/SVSP%20Notification%20Letter_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36873"}],"summary":"A database file containing personal informatino for custody staff was accessible to all staff on a server.  The file contained name, SSN, phone, address and position information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14085f2154557956d92094e8aa92bc75b92e9942","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1792BEAF-F290-41B4-920C-BA04368F73F1"},"incident_date":"2012-09-25","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1919ba28e7b2","org_name":"Waipahu Aloha Club","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10528"}],"summary":"Employee noticed odd computer activity indicative of remote access. PII of patients is considered at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c17fc488cc919e29212bbc6e131641bf39094a99","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D057965C-EFAB-4B45-8D71-198F80AA63F3"},"incident_date":"2012-09-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"68a3cc76fe3c","org_name":"4Access, National Processing Company","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55285"}],"summary":"An unauthorized person may have gained access to the computer network that supported certain 4Access terminals. These terminals were connected to a computer network that allowed merchant transaction processing. The unauthorized entry was discovered on September 24. Check processi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c8eda940c722e25228731e396861dfffb52d9ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F79354B8-2F30-4AA7-8833-BC9CFF714B47"},"incident_date":"2012-09-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"650377680282","org_name":"Aspen Valley Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.aspentimes.com/news/22463520-113/aspen-valley-hospital-accused-of-patient-privacy-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.aspentimes.com/news/crime/22914628-113/hiv-plaintiff-seeks-anonymity-in-aspen-valley-hospital-lawsuit"}],"summary":"Aspen Valley Hospital accused of patient-privacy breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c6c32cc86f97aaa631e4280d66e2a8932de7eb9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02FE93E3-CB57-4C96-90DA-C17D22C6A12F"},"incident_date":"2012-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f261558ddf6c","org_name":"Alere Home Monitoring, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/alere-home-monitoring-announces-theft-of-company-owned-laptop-180227241.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36954"}],"summary":"Employee's personal vehicle was broken into and company laptop was stolen ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6cc8bf2a3fc77784e789e1d054af4b6ef1030ea","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DCE38CAA-1105-4FF0-A43C-19CF2905F084"},"incident_date":"2012-09-22","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2db997a3d57b","org_name":"SourceForge","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/2160201/smb/compromised-sourceforge-mirror-distributes-backdoored-phpmyadmin-package.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/2162884/security/worst-security-snafus-of-2012.html"}],"summary":"Unknown attackers compromised a download mirror server for the SourceForge software repository, rigging the installer package for phpMyAdmin, a popular Web-based MySQL database administration tool, with a backdoor.SourceForge is a Web-based collaborative software development and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbb1dc968f49a5253e4b0668348e1e4c3e707f3a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2A87D7E-1560-42EF-A37F-B50FF9ABE366"},"incident_date":"2012-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b793ead69b2","org_name":"University of Miami","org_type":"education","ransomware":null,"records_affected":64846,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82245fe03d4ed87306bbd09f58f47b021a5920b6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36530B96-3C66-433F-BD76-BACA4D7E3314"},"incident_date":"2012-09-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb28375c9c6d","org_name":"Lana Medical Care","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ef5455045ca2afe391239537db17554519f9c7b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"656B0D58-EE71-4D79-9EAA-BB2714D73694"},"incident_date":"2012-09-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b9a0d4c01e3","org_name":"James M. McGee, DMD, PC","org_type":"healthcare","ransomware":null,"records_affected":1306,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11065;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Patient's paper dental records were stolen at the office of Dr. James McGee. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-09-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a38e73b43669cbd4cca6041d9d0bb1fe3016901","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E2CF1C7-5C42-4180-81C9-611985C10328"},"incident_date":"2012-09-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"283ac84919ce","org_name":"Hutton Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newschannel5.com/news/local-news/hutton-hotel-warns-customers-of-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/nashville-hotel-pos-vendor-breached-a-9381"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-64177"}],"summary":"3 year POS breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1102e97c0488cf247995b28bd0a9f99860a2cbb8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7E5E977-9E10-4C43-A70D-EB36C2A1F29D"},"incident_date":"2012-09-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf0837de1c6a","org_name":"Surgical Associates of Utica, PC","org_type":"healthcare","ransomware":null,"records_affected":1017,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of a network server that contains patient information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08e836b48647460afc66d2c8d1ba3244840efc1f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"276B6F47-4189-4474-9571-E55B490A70BB"},"incident_date":"2012-09-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce54087ea717","org_name":"L.A. Care Health Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Incident%20Notification%20Letter%20_Final%2010022012__0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36791"}],"summary":"Member ID cards were mailed to the wrong members.  Exposed data types are name, member ID number, DOB.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c94491880f38bc31708b2645587bd18c8ff16680","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"460E91C3-2DE6-4043-B4F2-7AA028523687"},"incident_date":"2012-09-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d40abacba6e","org_name":"Monterey Institute of International Studies","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Notification_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36646"}],"summary":"Laptop stolen from an employee's home contained student names and SSNs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a1606eb5a4c1a570dee12c0420a2dcdf893b5c5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"705B8294-3FF5-4BB3-A366-A3DB254FCCF4"},"incident_date":"2012-09-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e862a83d0056","org_name":"Frontier Natural Products Co-op","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Frontier%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"On or about January 31, 2013, Frontier discovered that a malicious person had added a file to a computer server that hosts the Websites.  As a result of the modification, from September 14, 2012 to January 31, 2013, the malicious person was able to gain access to the server and i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6374b1b4ef48628fbb8f0788fc71f19bd251c3ee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D5F6430B-EDCD-49A2-B7C4-BA5122B80871"},"incident_date":"2012-09-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67c7d14378cb","org_name":"BHcare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":5827,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Web Description: OCR opened an investigation of the covered entity (CE), BHcare, Inc. after it reported that a laptop computer and unencrypted back-up tape containing the electronic protected health information (ePHI) of 5,827 individuals were stolen from a workforce members vehi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b84c9bacf2c9ffabf34e7e3bdbd476298bf1db0a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14B68C61-7059-41FA-BEE1-B72B50949CAF"},"incident_date":"2012-09-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"335bca9a9cfa","org_name":"Square Enix Holdings Co Ltd","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.polygon.com/2012/10/17/3515360/square-enix-closes-online-shop-for-good-after-security-breach"}],"summary":"Square Enix will be ending one of its online shopping services by closing the Square Enix Official Goods Online Shop after the service suffered a security breach last month.  Kotaku reports that while no credit card information is believed to have been stolen during the security ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"016be70ec30f903d706e10e71ee449ccf41208b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59E15734-8C2D-4081-BB18-C83A39F202DA"},"incident_date":"2012-09-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05a1f29c447c","org_name":"Aventura Hospital and Medical Center","org_type":"healthcare","ransomware":null,"records_affected":82601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/florida-medical-center-hit-with-breach-for-third-time-in-two-years/article/372025/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.local10.com/news/another-data-breach-reported-by-aventura-hospital-medical-center/28091182;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/aventura-hospital-notifies-82601-patients-of-possible-data-theft-third-theft-incident-in-2-years/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/02/24/healthcare-data-breach-leads-to-state-court-case/"}],"summary":"Aventura Hospital and Medical Center has reported a data breach; the third time in two years the facility has been hit. The personal information of more than 82,000 people is in danger of exposure, according to U.S. Health and Human Services records, owing to a breach between Sep","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2160fa96d2c8a2db1386046ef1e23ff5c5ccd22","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-08-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Security%20Breach%208282012_0.pdf"},"notes":null,"org_country":"US","org_id":"9bfd0086080c","org_name":"WhatGreatSkin.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36413"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%208282012_0.pdf"}],"summary":"WhatGreatSkin.com reported that an attack may have compromised customer names, addresses, and credit card details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d7f377c38a89573fc7b29bc30787c55b49bf499","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DAD3057-25DB-4996-A97D-2859A78ED94F"},"incident_date":"2012-09-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63f19fe738bd","org_name":"Tri County Behavioral Health Clinic","org_type":"healthcare","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ea731e26e03626caa70ebf664b239e01d3aacd8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28F48C17-97BB-4EFE-B94D-047DE5CCCA62"},"incident_date":"2012-09-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af5e676bab0e","org_name":"Mission Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55611"}],"summary":"Someone called Mission Hospital on August 28, 2012 and claimed that he found a flash drive with sensitive patient information in his garage.  The flash drive was returned to Mission Hospital via mailed envelope on September 11, 2012.  Patients who received services at Mission Hos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36551f6e6f9357dc3d6b0160662e3c5c11f74d66","impact_type":"unknown","incident_date":"2012-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Final%20Notice%20%28C%26E%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"311d0f59d792","org_name":"Local 2/Hospitality Industry Child & Elder Care Plan","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36426"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-11","discovered_date":"2012-09-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"015010e5248692f55e780511ea9219c34113d5fe","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Copy%20Letter%20for%20Attoreny%20General%20UP-load%20%281%29_0.pdf"},"notes":null,"org_country":"US","org_id":"cf275810334e","org_name":"Carmichael Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36425"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Copy%20Letter%20for%20Attoreny%20General%20UP-load%20%281%29_0.pdf"}],"summary":"Carmichael Company reported that an electronic filing report containing a person’s name and Social Security number was found by the Postal Service during a raid on an arrested criminal.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-09-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86cc2373b9de2cac83f0eb20a559245d870c9b83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FAA6BDE-7CC5-45C6-AF6E-66F1FFC89A5E"},"incident_date":"2012-09-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f304438965e8","org_name":"Original Medicine Acupuncture & Wellness, LLC","org_type":"healthcare","ransomware":null,"records_affected":540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthcitysun.com/2012/11/original-medicine-acupuncture-wellness-llc/"}],"summary":"Original Medicine Acupuncture & Wellness, LLC of New Mexico reported that 540 patients had PHI on laptops stolen in an office burglary on September 7, 2012. I was able to locate a copy of their media notice.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7032ef80a6b569947b76c7b9862afd734dd68fc","impact_type":"unknown","incident_date":"2012-08-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/TS%20Letter%20%283%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b8b6f506d2be","org_name":"Churchill Downs Technology Initiatives Company dba TwinSpires","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36358"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-09-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21906ac8c4ee97d19359a27549aec1bcab745757","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A2EC215-834B-421A-84DD-74B1EF95DB3B"},"incident_date":"2012-09-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e83eff4107ad","org_name":"Feinstein Institute","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Feinstein%20Institute%20for%20Medical%20Research%20Security%20Breach%20Notice%20ltr%20to%20consumer.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://blog.boltonco.com/2016/06/28/company-agrees-to-3-9-million-settlement-for-hipaa-breach/"}],"summary":"on or about September 2 and 12 a laptop computer containing research information, including personally identifiable health the nation about you, was stolen from a car of a computer programmer involved in organizing research data at the Feinstein Institute. Although both the compu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"345420140d1cf52bba01b13dc8f4689bc08d7f42","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C1EB836B-5AD7-4691-8C0D-C2F7A0EF5648"},"incident_date":"2012-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"27bc2b3e756c","org_name":"Telco Service Holdings Pty Ltd","org_type":"technology_saas","ransomware":null,"records_affected":462,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.acma.gov.au/~/media/Consumer%20Interests/Formal%20warning/Formal%20warning%20to%20Telco%20Service%20Holdings%20docx.DOCX"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.acma.gov.au/Industry/Telco/Reconnecting-the-customer/TCP-code/telco-service-holdings-warned-for-privacy-breach"}],"summary":"Company sent billing information for 462 people to the wrong recipients.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06ba8b78836477f10251b3ea104d7a32df90b0f7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C61E8BA-E015-467C-91EC-0E3DA06E4ABE"},"incident_date":"2012-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14524e0d0491","org_name":"Florida Department of Juvenile Justice","org_type":"government","ransomware":null,"records_affected":100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.orlandosentinel.com/2012-09-06/news/os-juvenile-justice-computers-stolen-20120906_1_orlando-police-three-computers-juvenile-justice"}],"summary":"On September 6, 2012 it was reported that three computers that contained information from the Florida Department of Juvenile Justice were stolen from an apartment site earlier in the week.  A television was also taken at the time of the theft.UPDATE (01/12/2013): At least one of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d517c05cba92f9567fad348defbf114dd4c17db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"204CD5CC-EB8C-4164-B7FF-D2AE1EDC2FE5"},"incident_date":"2012-09-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ab4c447081d","org_name":"Bristol Community College","org_type":"education","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/man-admits-hacking-law-enforcement-networks-stealing-payment-card-data"}],"summary":"Hacker uses stolen credentials to change grades in community college server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-09-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d12ac7a2e5053e8e76802f33c6b26a13e9068e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B26C97A-BA8E-4B81-9EB9-BB59AB985F21"},"incident_date":"2012-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02dff8039749","org_name":"Arends Hogan Walker LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ahw-20130522.pdf"}],"summary":"Website compromised via undisclosed method, malicious code installed and payment card data was captured.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-08-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5d765cdc12bf15e4ba77e494a85ad0489300021","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39DEE424-3638-45D0-A004-1A760B7AB439"},"incident_date":"2012-08-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c118d3aea384","org_name":"Blount Memorial Hospital, Inc","org_type":"healthcare","ransomware":null,"records_affected":27000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/blount-memorial-hospital-data-breach-affects-27k-patients.html"}],"summary":"Blount Memorial Hospital in Maryville, Tenn., has notified 27,000 patients whose personal information was compromised when an employee's laptop was stolen in August, according to a Knox News report.  The laptop, which was password protected, contained registration records on appr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b3a56ae181887d6f34ae90c5857d3ae98a92439","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15C831B7-473A-448E-8E7E-9E4ABD37B014"},"incident_date":"2012-08-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41442384e26b","org_name":"FEI Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/fei-company-20120918.pdf"}],"summary":"Laptop stolen from undisclosed location contained employee name, SSN, taxpayer I.D., salary, home address, DOB and related basic employment information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-08-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a86134668bc08cecf656019073b742915e0c98df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DE823A6-FC65-4328-8ADD-CF91281E0D49"},"incident_date":"2012-08-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edd2be6b65cd","org_name":"Healing Touch Day Spa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Security%20Breach%208282012_0.pdf?"}],"summary":"Web site was hacked and despite using \"industry standard encryption\" the credit card numbers in their \"secured database\" were compromised.  The website is AtWhatGreatSkin.com.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d338f7c1553f2c9992187f750d50eb2e1f028894","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F1E4760-34FD-404A-B619-82AC219BDAB7"},"incident_date":"2012-08-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8505e61f9ab5","org_name":"Vermont State Employees Credit Union (VSECU)","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/vermont-credit-union-20121023.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/VSECU%20Security%20Breach%20Notice%20ltr%20to%20consumer.pdf"}],"summary":"Two unencrypted computer backup tapes were found to be missing.  The company believes they were thrown away and are now buried in a landfill.  They contained names, addresses, SSNs, Driver's license numbers, financial account information and transaction records.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"45f261448b8d376ab91e56c10ecbf60fe8aef88e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78862461-773C-48B6-88F4-CC3B7ABF094D"},"incident_date":"2012-08-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4652aeb127c0","org_name":"Howard University Hospital","org_type":"healthcare","ransomware":null,"records_affected":66601,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"211be807cb0bdda5034d10bb0a4c71fd8714c2ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"158c9c80-a1a2-11e7-bd2e-43ac41b832c9"},"incident_date":"2012-08-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff0012fba38a","org_name":"Multnomah County Health Department","org_type":"government","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/multnomah-county-notified-1700-patients-after-discovering-employee-was-forwarding-emails-to-personal-account/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/multnomah-county-health-department-suffers-phi-breach"}],"summary":"On August 24, 2012, a Multnomah County Health Department employee automatically forwarded all emails from an employee county email account to a personal Google email account not maintained by the Oregon county. Some of these emails included PHI, which may have created a PHI breac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3debea049ce011b9005eaf0b3230223a04476852","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BEDC4E3B-E94B-4DCF-8CFA-4A2A354786DC"},"incident_date":"2012-08-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/KP%20Privacy%20Incident%20Sample%20Letter%20082412_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36833"}],"summary":"On August 24, 2012, an employee in Kaiser Permanente’s Northern California Region Recruitment department mistakenly emailed a list of former Northern California KP employees who left the organization between 1990 and 2006 to a person not authorized to receive the information. Som","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a808d2ff27425827987657e204ce0456008b811","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-08-13","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/AG%20Data%20Breach%20Notice%20Letter%2008%2023%2012_0.pdf"},"notes":null,"org_country":"US","org_id":"21a8403aaf2d","org_name":"The John Stewart Company","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An inadvertent staff error led to personal information being included in emails sent to employees.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32684"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/AG%20Data%20Breach%20Notice%20Letter%2008%2023%2012_0.pdf"}],"summary":"The John Stewart Company inadvertently disclosed personal information in emails sent to employees.","supporting_quote":"I am writing to inform you that the John Stewart Company (“JSCo”) recently inadvertently included your name, social security number and, in some cases, birth date, in e-mails that were sent to various JSCo employees on August 7, 2012 and August 13, 2012.","technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":["T1657"],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-08-23","discovered_date":"2012-07-28","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b22fa81bbfda4cfb7f4c2a5017c8cd834b2a77b8","impact_type":"both","incident_date":"2012-07-28","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Agent%20Jain%20Williams-Victim%20Letter%20%283%29_0.pdf"},"notes":null,"org_country":"US","org_id":"6741b392fb37","org_name":"State Farm Insurance Companies","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee used customer information inappropriately.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32666"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Agent%20Jain%20Williams-Victim%20Letter%20%283%29_0.pdf"}],"summary":"A former State Farm agency team member inappropriately used customer information, and the letter alleges the employee used a customer’s credit card for online purchases.","supporting_quote":"While employed, and contrary to the business practices of my office, the employee used customer information inappropriately .","technology_involved":[],"third_party":{"archetype":null,"involved":false,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-08-21","discovered_date":"2012-07-26","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a35cae155609f983355b03a3ef9b05232203dbca","impact_type":"data_theft","incident_date":"2012-06-07","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Bellacor%20Data%20Breach%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"19f598ada16f","org_name":"Bellacor.com, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32569"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Bellacor%20Data%20Breach%20Notice_0.pdf"}],"summary":"Bellacor reported that an unauthorized third party injected malicious code into its website and may have extracted customer information from temporary transaction files.","supporting_quote":null,"technology_involved":["e-commerce website","temporary data files"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"713f0dc207d03dd59e1d0abafa9c78727ba9afc2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88040CCA-A096-44A3-B6C5-CE47291DA4E8"},"incident_date":"2012-08-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice%20Transcend%20Capital%202012_0.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"828b5ec37ab9","org_name":"Transcend Capital LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Security%20Breach%20Notice%20Transcend%20Capital%202012_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/transcend-capital-20120820.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36511"}],"summary":"Hacker breached data server containing client data.  At risk are name, SSN, address, account number, phone number, email, security positions and cash positions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-08-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2142eb4580644fa234fb028183854e059f81a756","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Acct%20number%20reissue%20notice_2.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32492"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b81e7bcc9355ad7b2341a7c8b51ea37c205d3a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDE5B131-D5C5-4429-814E-1301ACA8EAEF"},"incident_date":"2012-08-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A Veteran has numerous issues with a contract dialysis nurse who is also is wife. His wife is accessing the Veteran's record when he has appointments and they \nare not for dialysis. His wife has no need to know but is violating the Veteran's privacy. The Veteran has left his wife","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2012-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7044a156ab4dd86b956b4acf8d723648d0a09b6e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29C7C4B5-BDDF-4FFF-923E-E55569259260"},"incident_date":"2012-08-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"458cb370aa4f","org_name":"Zynga","org_type":"technology_saas","ransomware":null,"records_affected":760,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scribd.com/doc/110003006/Zynga-vs-Patmore,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/insider-threat/167801100/security/security-management/240144559/five-significant-insider-attacks-of-2012.html?utm_source=twitter&utm_medium=social&utm_content=fc582eb7-df18-4f0f-bbb6-0bd955a8762c"}],"summary":"Insider executive leaves the company and takes over 700 files containing intellectual property.  Zynga sues.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Cutting Sword of Justice","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e001821422e256cf0035acc8f7038a69fa4af3e7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"268E0C6F-BA8B-43F4-B980-BB135AF9F98D"},"incident_date":"2012-08-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SA","org_id":"ec9964765ad1","org_name":"Saudi Aramco","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/HqAgaQRj;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/08/29/saudi_aramco_malware_attack_analysis/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/2162884/security/worst-security-snafus-of-2012.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/08/29/saudi_aramco_malware_attack_analysis/;http://www.networkworld.com/article/2162884/security/worst-security-snafus-of-2012.html;http://www.cnet.com/news/virus-knocks-out-computers-at-qatari-gas-firm-rasgas/;http://www.nytimes.com/2012/10/24/business/global/cyberattack-on-saudi-oil-firm-disquiets-us.html?pagewanted=all&_r=0"}],"summary":"Analysis Saudi Aramco said that it had put its network back online on Saturday, 10 days after a malware attack floored 30,000 workstations at the oil giant.  In a statement, Saudi Arabia's national oil firm said that it had \"restored all its main internal network services\" hit by","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"cuttingswordofjustice"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-08-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5d6286e77fc099abe805fcfd3dd88b8f2971377","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87CB5911-53B6-448B-89B1-560691C06520"},"incident_date":"2012-08-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8bbfed0d77be","org_name":"Alexander J. Tikhtman, MD","org_type":"healthcare","ransomware":null,"records_affected":2376,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10635"}],"summary":"Device lost containing patient information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"55f3e79e4fb63516d35b13b991b3ee4139c83c7c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D4FDC6B-0DD7-46D0-AD8E-2F2D0610C992"},"incident_date":"2012-08-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":1240,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0813d793d7b64b92ba21c98333a963261021bfc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61E5C0CB-A86B-487B-8D9A-71FECAA34355"},"incident_date":"2012-08-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c6e68a5534f8","org_name":"Upper Valley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e5e10386c92dfab23d2a188ff6e3eb0a50f9301","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A8C7043-1776-456D-AD0D-34552BF63C0D"},"incident_date":"2012-08-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9be613005c1","org_name":"Stanford University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2603,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"932986d167422657a2ce2ca6a0cfca7492ebadb4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DF5FC98-ADDB-48BF-8104-D20188692336"},"incident_date":"2012-08-13","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43a981fec178","org_name":"South Carolina Department of Revenue","org_type":"government","ransomware":null,"records_affected":9699901,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://openchannel.nbcnews.com/_news/2012/11/20/15313720-one-email-exposes-millions-of-people-to-data-theft-in-south-carolina-cyberattack?lite,"},{"fetched_at":null,"title":null,"type":"press","url":"http://governor.sc.gov/Documents/MANDIANT%20Public%20IR%20Report%20-%20Department%20of%20Revenue%20-%2011%2020%202012.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/south-carolina-revenue-20121126.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/south-carolina-department-of-revenue-breach.php"}],"summary":"A single malicious email sent to workers at the South Carolina  Department of Revenue last August enabled an international hacker to crack into state computers and gain access to 3.8 million tax returns, including Social Security numbers and bank account information, in what expe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d3ab847cc653ce96d09208d5915f798531a647d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BADF57E-E253-4CB3-97B4-D22F44B15F9E"},"incident_date":"2012-08-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"191789ccdbf7","org_name":"NYU School of Medicine Faculty Group Practice","org_type":"healthcare","ransomware":null,"records_affected":8488,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb01b1c9cf65ca89b456f2db459aa956a8963bed","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D5D0D90-A7A2-4423-9DAC-D41BA1179B16"},"incident_date":"2012-08-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d303e54bb889","org_name":"Northwestern Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":4211,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb524bc8dc57e57e91f67cce85d8829c6a5f5978","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AF0ED70-9936-44F7-89B7-5C526A7056E6"},"incident_date":"2012-08-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9a26997574d","org_name":"Fujifilm Recording Media U.S.A., Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/fujifilm-recording-20120917.pdf"}],"summary":"The email account of one of their employees was accessed without authorization by an unknown individual.  They used the email account and confidential information of Fujifilm to try and commit an act of fraud against the company.  The attempt was not successful.    Exposed data i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aeb9d6143b556324c5913f7d503300db24b831a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8A6C956-69A9-4423-9376-42680DDBA3AE"},"incident_date":"2012-08-12","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c661ee5a37fe","org_name":"Central Dermatology Center","org_type":"healthcare","ransomware":null,"records_affected":76258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nc-central-dermatology-center-notifies-patients-after-discovering-malware-had-been-inserted-in-their-system-in-2012/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.centralderm.net/protects.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/11/10/potential-health-data-breach-hits-dermatology-facility/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/;http://www.phiprivacy.net/update-to-central-dermatology-center-breach/"}],"summary":"Central Dermatology Center (Central) announced on November 7, 2014 that on September 25, 2014 it became aware that one of its servers had been compromised by malicious software (malware). Central immediately consulted with forensic IT experts to identify and remove the malware an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-08-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc614a80210ad740e7c6e837703b092551961ac7","impact_type":"unknown","incident_date":"2012-07-15","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/sample%20patient%20notification%20letter_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"63392eea3ec3","org_name":"Stanford Hospital & Clinics and School of Medicine","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32459"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b41710a26f5b695a0b308dc0be4bbb6c148bec1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F2F5FF0-71CF-4504-8268-4051262DB679"},"incident_date":"2012-08-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"938763f96813","org_name":"John Stewart Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/AG%20Data%20Breach%20Notice%20Letter%2008%2023%2012_0.pdf?"}],"summary":"I am writing to inform you that the John Stewart Company (“JSCo”) recently inadvertently included your name, social security number and, in some cases, birth date, in e-mails that were sent to various JSCo employees on August 7, 2012 and August 13, 2012. We regret this inadverten","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-07","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65638ab57c3d5b510f2558599f127a2bde1d89ee","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-06-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Fresno%20Mail%20Theft%20Incident%20Breach%20Notice%20%28incident%2012-0510%29%20%28Legal%20Office%20Approved%29_0.pdf"},"notes":null,"org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32448"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Fresno%20Mail%20Theft%20Incident%20Breach%20Notice%20%28incident%2012-0510%29%20%28Legal%20Office%20Approved%29_0.pdf"}],"summary":"A kiosk mailbox at a California Correctional Health Care Services regional building was broken into, and mail containing prospective candidates’ personal information may have been lost.","supporting_quote":"On June 11, 2012, a kiosk mail box located at the California Correctional Health Care Services (CCHCS) Regional Administration building in Fresno, California was discovered to have been broken into.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c7992aa6d5291319b87323d9a727f1857348da9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"018F00D3-5840-438D-96D9-671327AE7D9F"},"incident_date":"2012-08-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76337dbc9f29","org_name":"Kmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wvrecord.com/news/267187-woman-accuses-kmart-of-hipaa-violation"}],"summary":"A Raleigh County woman is suing over claims Kmart pharmacy employees violated HIPAA by discussing her medical information in the store.  Struggling Sears Holdings To Announce Q3 EarningsLeslie J. Pettry filed a lawsuit April 14 in Raleigh Circuit Court against Kmart Promotions LL","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"462890a94cba2328eb700f771a7eced95ca5a5c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93BD00AF-33F0-40F1-A58E-AD81C8C3250D"},"incident_date":"2012-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d07fedc08047","org_name":"Liberty Resources, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3184,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wp-content/uploads/Press-Release-08-15-12.pdf"}],"summary":"A personal computer was stolen from the office that contained personal information of Liberty Resources Inc Consumers in eastern Pennsylvania.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cde671e1e585ecba3b7afb08203b9edcda800a7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B9765F5B-3050-4566-8D2B-8C8EAC260D9B"},"incident_date":"2012-08-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ab3ac00f296","org_name":"Oregon Health & Science University","org_type":"education","ransomware":null,"records_affected":702,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a31a5b8710e5a8f4363723ef954e95569919d1a3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F440683A-E443-4F16-9D07-D40144E5E5C0"},"incident_date":"2012-08-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7becb1c60d9","org_name":"First Republic Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Account%20Security%20Letter%20CA%20Upload_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32466"}],"summary":"Specifically, on August 2, 2012, certain data were discarded in a way that did not adhere to our strict data disposal requirements. This data included client names, account types and numbers and tax payer identification/social security numbers. While we do not have any indication","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"639af70749fb05de0da1c1b124be7ec13d91bc11","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B10AB907-0F5C-4035-8F93-13AA154A239E"},"incident_date":"2012-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"a36996a8e97a","org_name":"Wells Fargo","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://patch.com/pennsylvania/balacynwyd/card-skimming-scam-discovered-in-lower-merion#.VCrM7SldX5w"}],"summary":"Card skimmer was discovered on ATM by technician responding to complaints that the device was not functioning.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"141c1cdbc71af1d1cbcfca7c9ece41df24907a00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE5E8C6D-13BD-4644-8D4F-B3E78BD58B6E"},"incident_date":"2012-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f0d1880b20a","org_name":"Virginia Department of State Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lossofprivacy.com/index.php/2013/07/virginia-state-trooper-arrested-for-computer-invasion-of-privacy/"}],"summary":"insider used Virginia Criminal Information Network to sell personal information about people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9acc68a0c7495e8e9baa6b242e0b43d856a1e71","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD2CC5B5-D6B4-4B62-A5E4-8B6ED36677C2"},"incident_date":"2012-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95c0db5db205","org_name":"Verizon Communications Inc","org_type":"other","ransomware":null,"records_affected":860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/fls/PressReleases/140523-01.html;http://www.databreaches.net/twenty-south-florida-residents-charged-in-wire-fraud-scheme-involving-verizon-and-att-customer-data/"}],"summary":"Internal actors at Verizon & AT&T collaborated with external actors to misuse privileges and cause loss of confidentiality of 860 customer PII records along with the external parties being added to the customer accounts and purchase mobile phones. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"107cfc0e79d1f33e7cf05d4eb6171f02df1193e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17E44A87-62E5-4BA4-8AFA-ACF94D06C31C"},"incident_date":"2012-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e714f60b890","org_name":"Toshiba America Information Systems, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-227160.pdf"}],"summary":"DLP tool alerted on employees saving sensitive data to their systems.  Further investigation found additional instances where these employees had done this.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"435788423b9e8ef3c8136b9df3242c1bc0d57f99","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F70F7CEC-2C01-45A1-B5C0-D095BA1F243B"},"incident_date":"2012-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a08774e5914b","org_name":"TLO, LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/TLO%20Consumer%20Notice_0.pdf?"}],"summary":"On January 15, 2013 TLO discovered that there had been limited fraudulent access to their system.  A hacker or hackers were able to access names, Social Security numbers, and driver's license numbers between August 2012 and January 2013. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de2c935b96560b054a96250d0014645413bbbfb8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B598C5C0-F920-400E-AC97-94C4F5AF8895"},"incident_date":"2012-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42f157e421f8","org_name":"Sheet Metal Local 36","org_type":"nonprofit","ransomware":null,"records_affected":4560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Union welfare fund accessed via unknown method.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8af000ffb9cbdd65ac2eebfaa820ab2daad1652c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CBA77E1-4684-4F2E-9C2F-AFF06E479DD6"},"incident_date":"2012-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7d42e29d931","org_name":"Complete P.T., Pool & Land Physical Therapy, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/los-angeles-physical-therapy-provider-settles-hhs-charges-that-it-impermissibly-disclosed-patient-information/"}],"summary":"Org disclosed PII on website in testimonials page using photographs and full names of clients w/o their authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54b5c402c1fefa1c43d4878ed4b6035b3519a9f9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86421244-D463-4930-9BCD-597335236749"},"incident_date":"2012-08-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"457b713f7dfb","org_name":"Blizzard Entertainment, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://us.battle.net/support/en/article/important-security-update-faq#5;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/life-style/gadgets-and-tech/news/millions-of-gaming-account-details-are-stolen-in-massive-blizzard-hack-8031294.html"}],"summary":" The account details of millions of online gamers have been stolen in a hack attack on games company Blizzard.  The company, which makes the World Of Warcraft, StarCraft and Diablo franchises posted a message on its website today advising players using North American servers to c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c23aae06fa21f65d3caf53ec0f15864d9aa2635e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CD3426E-E26C-4ADC-8C7E-8FDB5216552B"},"incident_date":"2012-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77ef3dcefbed","org_name":"Beth Israel Deaconess Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b14922fdfc596b839a21108759ad3b30b2558452","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC9B3EA0-5140-44A4-A85A-81BC3C71CFB2"},"incident_date":"2012-07-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e2678a6fd30","org_name":"The Litton & Giddings Radiological Associates","org_type":"healthcare","ransomware":null,"records_affected":13074,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The Litton & Giddings Radiological Associates breach involving its janitorial service sending billing records handled by PST Services, Inc.  for recycling instead of shredding was reported on this blog in October 2012. It now appears on HHSs list and indicates that 13,074 patient","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4be3a302d2a2c104cfa77bf76361a018726681b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F6B5142-25B7-46D8-B703-76ABF067D00C"},"incident_date":"2012-07-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9c53ff2e9dd","org_name":"Central States Southeast and Southwest Areas Health and Welfare Fund","org_type":"healthcare","ransomware":null,"records_affected":754,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10249;"},{"fetched_at":null,"title":null,"type":"press","url":"http://centennial-man.blogspot.com/2012/09/one-of-my-least-favorite-topics-theftof.html"}],"summary":"Incident involving unauthorized access/disclosure of paper records.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a8961a674be477dff8e169598fbd55060fc8d0d","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Global%20Payments-Comerica%20Merchant%20Application%20Server%20Breach%20Letter%20Final_0.pdf"},"notes":null,"org_country":"US","org_id":"ac51033f73e3","org_name":"Comerica Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32376"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Global%20Payments-Comerica%20Merchant%20Application%20Server%20Breach%20Letter%20Final_0.pdf"}],"summary":"Comerica notified merchant card services customers that their application data may have been accessed on Global Payments servers, but whether personal information was viewed or taken was unclear.","supporting_quote":null,"technology_involved":["merchant application servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Global Payments"},"updated_at":"2026-10-10","veris_action":"unknown","derived":{"vendors":[{"id":"12d296840a8e","name":"Global Payments"}]}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d93a8e38daf3e693d1c0c005bcae4f4d24c0644","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B17F1FB-53D7-43EC-8780-0D926FC87591"},"incident_date":"2012-09-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cbd4bf787a2","org_name":"University of Texas MD Anderson Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":2264,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"34b82f449878462c35c247371efc6a6bee7ea77b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA32262C-DC46-4FCA-9A07-9DD08BA104CC"},"incident_date":"2012-08-13","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9b7a327774d","org_name":"Surgeons of Lake County","org_type":"healthcare","ransomware":null,"records_affected":7067,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"097776799d132829e607b1d5ab207ab3ed7daa60","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"90E93334-D9CD-4F3E-8293-F2D37F165FC2"},"incident_date":"2012-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2594ecf78c32","org_name":"River Arch Dental","org_type":"nonprofit","ransomware":null,"records_affected":2533,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce6aa15725fd214d25c41438f89b480a3d4f89f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79ED1C34-35CB-4997-9FEC-7CFE39E880B2"},"incident_date":"2012-07-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b1f0cb07129","org_name":"Pamlico Medical Equipment LLC","org_type":"healthcare","ransomware":null,"records_affected":2917,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60a7b5569007e34eb39bebe5ce126332377bbaf7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA379E02-8032-4EC6-8034-D5C6223210D9"},"incident_date":"2012-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"addeb717409a","org_name":"Memorial Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":102153,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d7e81d5a5414e6e26bd6b67247c0b7b40099b758","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50D5AFD3-51F0-4456-BA7E-32F569E4BE59"},"incident_date":"2012-07-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fd67d429ece9","org_name":"HSBC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Customer%20Notification_1.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.expatica.com/fr/news/french-news/court-says-france-cannot-use-stolen-bank-data-for-searches_205420.html"}],"summary":"An employee who resigned from the company left with customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4fc4d608bf3ffd1bb92b7495d5006b97115f35b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"725BF039-79DB-4C3E-88A2-83878E051BAE"},"incident_date":"2012-07-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dac48d4a3df","org_name":"Hamner Square Dental","org_type":"healthcare","ransomware":null,"records_affected":1112,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9cb1d2e76eb1439e85afbc41291a7b306f340a2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63D27EB1-6933-4E15-9192-B77D944A7A0A"},"incident_date":"2012-07-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8d01a8e5b7e","org_name":"Gessler Clinic, PA","org_type":"healthcare","ransomware":null,"records_affected":1409,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0f7b1730795ec40242f9801686b72e0aeb6a64d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56F3C3EF-1E1B-4C51-BF25-85A718CA15C7"},"incident_date":"2012-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"552e13353952","org_name":"Bruce G. Peller, DMD, PA","org_type":"healthcare","ransomware":null,"records_affected":9953,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a37a91b6d4472ca9c90eae29258f7271daa1d837","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1849F47-C227-4CED-9340-C9B6D27D6ADA"},"incident_date":"2012-07-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3375442c3aa9","org_name":"Adult & Child Care Center","org_type":"healthcare","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5a1c2fadff0ea65fbbf8d771df0423a4ae0a4eb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"314D2330-ED2C-4445-8436-AA015E848538"},"incident_date":"2012-07-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"913300296c44","org_name":"Wolf & Yun","org_type":"healthcare","ransomware":null,"records_affected":824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a24ce6237fcd3fbcde4eba077f2d675bf7aadf95","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4624984D-73BF-4B2A-82A6-3160208D019E"},"incident_date":"2012-07-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f5d8b21f940","org_name":"Bill & Melinda Gates Foundation","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bill-melinda-gates-20120823.pdf"}],"summary":"An employee accidentally attached the wrong version of a spreadsheet to an email sent to a number of foundation vendors.  The spreadsheet contained information about vendors of the foundation.  The spreadsheet contained name, address, phone, SSN and information about payment hist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1609bea06fcbfec98a167ff5c1bcff4b6c518baa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25F0F061-B1F2-4F90-86ED-A50E69524108"},"incident_date":"2012-07-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fbb39cc1ddbd","org_name":"Wounded Warrior Project","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.jacksonville.com/news/crime/2012-09-13/story/30-plus-laptop-computers-stolen-jacksonvilles-wounded-warrior-project-hq"}],"summary":"At least 33 laptop computers and iPads were stolen in late July from the Wounded Warrior Project's third-floor office at 4899 Belfort Road in Jacksonville.  They may contain personal information on “some, but not all of our former employees,” according to a letter sent out Sept. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"458cfe35d7f29cdfe9129c56ddd33556d5b52500","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA1C21B7-8A28-42B7-8108-C6384ECE4617"},"incident_date":"2012-07-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ea50730f2fe","org_name":"St Johns Episcopal Hospital","org_type":"healthcare","ransomware":null,"records_affected":566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/a-few-more-recent-additions-to-hhss-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"St Johns Episcopal Hospital in New York reported that its business associate, Emdeon, was involved in a breach that affected 566 patients. The date of the breach is listed as July 24, 2012. I hope thats a typo, but in the absence of information_. The breach was coded as theft, pa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94c6a4cc767f7063fc81ba0869c279eab71a1c99","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-06-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20word%207%2020%2012_0.pdf"},"notes":null,"org_country":"US","org_id":"7999399184c3","org_name":"Mission Linen Supply Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32356"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20word%207%2020%2012_0.pdf"}],"summary":"Mission Linen Supply reported that customer information stored by a third-party vendor may have been compromised through unauthorized access to the vendor’s file servers.","supporting_quote":null,"technology_involved":["file servers"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0eb5c11df346b0f9fdf4787f9835c3bae8740d57","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6C44A9A-8E9A-4BFE-A2B6-1005FDF8F5A0"},"incident_date":"2012-07-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0c7bdbc8b78","org_name":"Charlotte Clark-Neitzel, MD","org_type":"healthcare","ransomware":null,"records_affected":942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/clark-neitzel-20120906.pdf"}],"summary":"Home office of Charlotte Clark-Neitze, MD was broken into and her medical bags and a laptop were stolen. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9e824f6f62ced5007c2d701d87d7dab8703f19d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F6CDFE1-2A28-471E-BA81-82ED0A047C9F"},"incident_date":"2012-07-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46adb37e5da6","org_name":"St. Therese Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Patient%20Notification_1.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Provider%20Notification_1.pdf?"}],"summary":"Computer stolen from medical group's offices contained name, DOB, SSN, date of treatment, and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74d6bf91e1cca0380d39cac22c79f592cf9108c8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E6E0241-A4BD-49F5-996B-204A3D761BD6"},"incident_date":"2012-07-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"421f7b86ce33","org_name":"Contact/Lifeline","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.belfasttelegraph.co.uk/news/local-national/northern-ireland/boxes-collapse-led-to-data-breach-16251600.html"}],"summary":"The collapse of a stack of storage boxes was the incident that triggered a serious data breach at a crisis helpline provider in Londonderry, an investigation has found.  Confidential file notes on clients who had rung the Lifeline service were discovered blowing around outside th","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2012-07-17","discovered_date":"2012-05-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7187a22dbf3a12075590da33df4bdb3ef7d13a39","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-05-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/River%20Arch%20Notification%20Attorney%20General_2.pdf"},"notes":null,"org_country":"US","org_id":"ba281d9a0935","org_name":"River Arch Dental/Hamner Square Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32281"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/River%20Arch%20Notification%20Attorney%20General_2.pdf"}],"summary":"A USB memory chip containing patient information went missing while being mailed by Patterson Dental during a software conversion.","supporting_quote":"The representative and this business partner have searched and continue to search for this USB memory chip, but have not located it to date.","technology_involved":["Eaglesoft","USB memory chip"],"third_party":{"archetype":null,"involved":true,"vendor":"Patterson Dental"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"e6079b77902b","name":"Patterson Dental"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85740e72f9a62ccd47b62da2b91555257bcc7b3c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76967FF5-4D21-4216-870E-4E4461C906FC"},"incident_date":"2012-07-17","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"285317ef2acf","org_name":"Maplesoft","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.maplesoft.com/security/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://siliconangle.com/blog/2012/07/19/maplesoft-faces-security-breach-zeus-trojan-is-the-culprit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/maplesoft-acknowledges-security-breach.html"}],"summary":"Maplesoft is investigating a security breach of its administrative database that took place on July 17th, 2012. As a result of the breach, the perpetrators gained access to some email subscription data, including email addresses, first and last names, and company and institution ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa6cd40f599de9a25930d10bed751f8ce13177f8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED39F8E7-4CB0-4DB7-9A94-413DE124D154"},"incident_date":"2012-07-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e4a9ad63f1d","org_name":"Health Care for All","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/database-designs-20120828.pdf"}],"summary":"A laptop and flash drive was stolen while in the custody of an employee.  The laptop contained data on business clients.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical","financial"],"disclosed_date":"2012-07-17","discovered_date":"2012-05-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c762814337cecab1897d1dc617d840516a7f7ab1","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Eastvale%20Notification%20Letter%20Attorney%20General_0.pdf"},"notes":null,"org_country":"US","org_id":"de63d8315353","org_name":"Hamner Square Denta","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An unencrypted USB memory chip containing patient data was lost while being mailed by Patterson Dental.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32282"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Eastvale%20Notification%20Letter%20Attorney%20General_0.pdf"}],"summary":"Hamner Square Denta reported that a USB memory chip containing patient data was lost while being mailed by Patterson Dental.","supporting_quote":"On May 14, 2012, this envelope arrived at its destination with a tear on the side and without the USB memory chip.","technology_involved":["Eaglesoft","USB memory chip"],"third_party":{"archetype":null,"involved":true,"vendor":"Patterson Dental"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"e6079b77902b","name":"Patterson Dental"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-07-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"483e6027677f7e67ba58c0cd104374fdeb227cd8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"087F2417-4F7B-4E31-864C-D95C328604ED"},"incident_date":"2012-07-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"369b06795411","org_name":"Colon & Digestive Health Specialists","org_type":"healthcare","ransomware":null,"records_affected":5713,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55178"}],"summary":"A vendor working with patient data for digital conversion from Colon & Digestive lost a flash drive that contained patient names, Social Security numbers, dates of birth, addresses, telephone numbers, account numbers, diagnoses, and other protected health information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c40c7dc35450f3e51c941a60d43e9acac1717b4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1723A9AD-113B-472D-B0E0-9124C49B1A6D"},"incident_date":"2012-07-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de2584341e03","org_name":"Valley Plastic Surgery, PC","org_type":"healthcare","ransomware":null,"records_affected":4873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10484;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach"}],"summary":"An electronic device was stolen that contained patient information.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9db40f2de52e6a1e31c5bec3f987674e726711e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D29A11E1-507F-40A3-AA1D-92159C5C63CF"},"incident_date":"2012-07-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Earthbound%20Farm%20-%20Notification%20Letter%20%28California%29_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32379"}],"summary":"This letter is to inform you that on July 13, 2012 MassMutual inadvertently sent via secure email a report containing your personal information to the Plan Sponsor of another retirement plan administered by MassMutual. We have conducted an investigation into the incident to deter","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1833efbd9c4e9bf101c78bb6707dc0ebcfb33b78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D768BB7-B92B-4984-886F-54DBB4C41A03"},"incident_date":"2012-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"735daee71fec","org_name":"Verizon","org_type":"technology_saas","ransomware":null,"records_affected":3000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/exclusive-hacker-nabs-3m-verizon-customer-records-7000009151/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/Nf9ThT03"}],"summary":"A hacker has posted around 300,000 database entries of Verizon customers to the Web, after exploiting a vulnerability in the cellular giant's network.  The hacker, going by the name @TibitXimer on Twitter, told ZDNet earlier this evening that the hack was carried out earlier this","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83e7159f843af283b4f1a0e6017aa1750077d4fd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAF927DF-9882-45E8-9587-5170F56CE424"},"incident_date":"2012-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36e3eb0951a6","org_name":"SwedishAmerican Health System","org_type":"professional_services","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen documents exposes 1500 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2ceb63f39fceb8ce644fdd770cb21fd2917cb66","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Scripps_Notification_Letter_1.pdf"},"notes":null,"org_country":"US","org_id":"ba81582bbce1","org_name":"Scripps College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee shared financial aid application information with an unauthorized financial aid professional.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32212"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Scripps_Notification_Letter_1.pdf"}],"summary":"A former Scripps College employee shared financial aid application information with an unauthorized financial aid professional.","supporting_quote":"Based on our investigation, it appears that a former employee acted in an unauthorized manner, during employment, by sharing certain application information with a financial aid professional who was not employed or engaged by the College.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31cc87f1e1a38c3ae13a750cb86f3a219c681071","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13191567-7A43-496F-BC56-3F3C67A986B0"},"incident_date":"2012-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"84150dd15fbd","org_name":"India Ministry of External Affairs and Ministry of Home Affairs","org_type":"government","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/12/21/indian_government_email_hacked/"}],"summary":"India’s government and military have suffered one of the worst cyber attacks in the nation’s history, after over 10,000 email accounts belonging to top officials were compromised, despite a warning from the country’s cyber security agency.  The attack came on 12 July, four days a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"413dd3118cf12b54a1f0f29e7010a6032dec34bf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A24DECD7-0B9C-4B35-93D2-A85259F6CDDF"},"incident_date":"2012-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/humana-20121217.pdf"}],"summary":"A box of paper files was lost during a move.  Data included member name, demographic information, DOB, Medicare ID number and possibly clinical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38c292cb871f8fee66efbddd2589d2f8c9126e71","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Recoverd%20Cards_AD01_Active%20%28RDCSBMMYY%29%20CM%20Letter_Final_032912_0.pdf"},"notes":null,"org_country":"US","org_id":"f941ff562841","org_name":"American Express","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32194"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32218"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32213"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32312"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32341"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32467"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Recoverd%20Cards_AD01_Active%20%28RDCSBMMYY%29%20CM%20Letter_Final_032912_0.pdf"}],"summary":"American Express notified cardmembers that their card account numbers, names, and expiration dates had been recovered during an investigation.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"CA","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2012-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d408426e18e4606eb8adbad935c76757f62e92bc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE263091-A728-4455-88D5-4EBD1F8B480E"},"incident_date":"2012-07-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"badc3aa2a814","org_name":"Alberta Health Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.calgaryherald.com/health/cited+privacy+breach+after+devastating+Shaw+fire/9079820/story.html"}],"summary":"Staff with Alberta Health Services breached patients privacy by using unsecured personal email and cellphones to carry on business after an outage caused by a fire at the Shaw building. The damage affected servers that stored personal and health information for Service Alberta, A","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-07-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92590dc16205079cb41cfa4051732a6dae23ac47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95A90A7D-4245-4849-9421-152F649B1422"},"incident_date":"2012-07-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4b253296310","org_name":"Christina Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226406.pdf"}],"summary":"An employee accessed patient health records without a valid business reason.  The investigation determined that the employee, who wanted to be a nurse, accessed the records because she was interested in their treatment (these were primarily trauma and emergency patients).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-07-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9fb24dfbbafa114a31eed0f6bb7edcdc365bfa91","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC65C8A2-EE04-49F2-B468-401E1C389559"},"incident_date":"2012-07-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b22d554991fc","org_name":"Bellacor","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Bellacor%20Data%20Breach%20Notice_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bellacor-20120822.pdf"}],"summary":"We discovered that an unauthorized third party obtained unlawful access to certain temporary data files on our website. These temporary data files are used only to complete e-commerce transactions and are not otherwise retained by Bellacor. The information accessed in the tempora","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b99bc1bf2f02b1d8d3f0854256ce5ed8e0abad48","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41C9EE0D-6D72-44A2-A222-7A4170C5571B"},"incident_date":"2012-07-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"211db5f6ed13","org_name":"Cardiovascular Consultants of North Texas","org_type":"professional_services","ransomware":null,"records_affected":2462,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Unauthorized access results in the exposure of 2462 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e3a4c99bf88b7ef0cfac8055610b2410a46c6d9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C84657B6-E97B-4631-9713-6EE654BFF40F"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43430cfdb2bb","org_name":"West Dermatology","org_type":"healthcare","ransomware":null,"records_affected":1900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b9333a387f8774d96bba4be04325a4c65b24ecff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F16E3BB-8BED-474F-8541-6405B4C2B86E"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff92da825680","org_name":"Volunteer State Health Plan, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1102,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2068fe60b85bd7807da3c701a724c59b0048d3c1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"845E7897-41EB-4A23-B9F4-CAFDD8C62104"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"943ee44fb98c","org_name":"Titus Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df80dc9e2dc6b80f2ed5c498ebadf418ab50992f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFF8A77E-8573-4CCF-99B6-62D09A0A4B86"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6109224cf946","org_name":"Temple Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":603,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.templecommunityhospital.com/computer-theft-in-xray-alert/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10133;"},{"fetched_at":null,"title":null,"type":"press","url":"http://latimesblogs.latimes.com/lanow/2012/08/patient-data-stolen-from-temple-community-hospital-.html"}],"summary":"Patients personal and medical information was taken from a computer that was in a locked office.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0109813b9a29e39011671fc8ee50996d85dbab8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"125F978D-13B4-45C1-9E15-91B92B3CFBDD"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b994d9691a1","org_name":"Robert Witham, MD, FACP","org_type":"healthcare","ransomware":null,"records_affected":11136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7601d1c247c35cc1c88e82ab8b9916779d621647","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A16172E9-4B5F-4FB1-BC70-8CAE634F5780"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad40e0a00e36","org_name":"Physician's Automated Laboratory","org_type":"healthcare","ransomware":null,"records_affected":745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8df56acc22af47a699fa4e5ea7cab32486ed6dcf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EAB30025-F493-4057-AC79-4BB771D24C66"},"incident_date":"2012-07-03","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bff75c07a3f7","org_name":"Memorial Sloan-Kettering Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":568,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71020085f3f73c9f0da096763e4ced3811f19f92","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"34467BDF-FF3A-4FF4-B26E-D8325FE56503"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"698ca9ac088f","org_name":"Luz Colon, DPM Podiatry","org_type":"healthcare","ransomware":null,"records_affected":1137,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97bb3acc77714eced8a73ee894de11b72b4f9779","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03A640FC-2988-4224-863F-857BC412E624"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5979d1d57054","org_name":"Lutheran Community Services Northwest","org_type":"healthcare","ransomware":null,"records_affected":756,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e851856e885ddc0374ddb509561c430d7f166eca","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F5291A9-EE23-4C83-96B7-EF829CB84B72"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b608390b4b18","org_name":"Independence Physical Therapy","org_type":"healthcare","ransomware":null,"records_affected":925,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fc858825e831ce511c6a867f3c5c96ad31ba8745","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/GLOBAL_CA_0.PDF"},"notes":null,"org_country":"US","org_id":"12d296840a8e","org_name":"Global Payments Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32155"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/GLOBAL_CA_0.PDF"}],"summary":"Global Payments notified merchant applicants of potential unauthorized access to servers containing personal information, with no confirmed access or theft of that information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30cf709c435ebfec933f01eb85021fc7fef44a81","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20634D68-BFDE-4377-8477-27680833A884"},"incident_date":"2012-07-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db95b32cebc6","org_name":"Duke University Health System","org_type":"healthcare","ransomware":null,"records_affected":1961,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-07-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"166ff89431fd150cbe9adacd9bc9563c3a7618be","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D6E12EB-0B10-481B-8E95-6ED30D463DF6"},"incident_date":"2012-07-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"efab6167daab","org_name":"Ameritas Life Insurance Corp.","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32411"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8df1e3e6e618a99592aec9168295f4b88c221ee3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7B7B913-1090-4DC6-ABE5-898659BA908C"},"incident_date":"2012-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8ebea1508430","org_name":"Providence Health & Services","org_type":"healthcare","ransomware":null,"records_affected":5400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/portland/blog/health-care-inc/2016/07/providence-notifies-5-400-oregon-patients-of-data.html?ana=RSS%26s%3Darticle_search&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+bizj_portland+%28Portland+Business+Journal%29;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bignewsnetwork.com/news/245947265/providence-notifies-5400-oregon-patients-of-data-breach"}],"summary":"Providence Health & Services notified about 5,400 current and former patients that a former employee may have accessed their health records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d00aa5903eb35abd0119b38f4d9f6833a49266f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B785FFBB-E185-494A-AC7A-0CD5D40520C5"},"incident_date":"2012-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"33caa8a1c525","org_name":"Nama Chemicals Co","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/irish-news/courts/former-nama-worker-faces-leak-charge-34829075.html"}],"summary":"emailed confidential business information to competitor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f057fc632d0b99c4fcb521ed46427b318c8b60a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA4DF937-14C5-4A48-8940-553A36163129"},"incident_date":"2012-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7be5939e0c7","org_name":"LexisNexis","org_type":"other","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/data-breach-asc?title=LexisNexis"}],"summary":"LexisNexis informed Sprechman & Associates that the unusual, excessive activity of an associate caused them to eliminate that associate's access to LexisNexis' database.  The associate was later found to have misused Social Security numbers in order to file over 11 million dollar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b70b2c355e3edf5070f705756ff6345df3e06ecf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91E6A812-746C-4BCA-B4C0-F8588A2B0928"},"incident_date":"2012-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b185844be983","org_name":"Lahey Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/lahey-clinic-20120829.pdf"}],"summary":"Physician's blackberry was stolen at an airport in France.  The blackberry was not encrypted and no password was required to use it.  It was wiped 5 days later, but the info on it included patient names, DOB, clinic medical record numbers, diagnosis and procedure names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e967eab635c5b9289646b722d41ff0cbe4d37e17","impact_type":"data_theft","imported_from":null,"incident_date":"2012-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"82f814a449a5","org_name":"Disqus","org_type":"technology_saas","ransomware":null,"records_affected":17551044,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: Disqus","type":"hibp","url":"https://haveibeenpwned.com/Breach/Disqus"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/article/disqus-confirms-comments-tool-hacked/#ftag=RSSbaffb68;"},{"fetched_at":null,"title":null,"type":"press","url":"https://itsecuritycentral.teramind.co/2017/10/10/disqus-data-breach-17-5-million-exposed-shows-rapid-response/"}],"summary":"Disqus reported a breach dating to July 2012 that exposed email addresses, usernames, and salted SHA1 password hashes for affected users.","supporting_quote":null,"technology_involved":["Disqus"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c0cb8eaa9dd48f49e13c4edf531dfa54868cdeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7601B87E-84F7-40BC-A828-ECCC6D464352"},"incident_date":"2012-07-13","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f290d94bd99","org_name":"Bit9, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread-malware/"},{"fetched_at":null,"title":null,"type":"press","url":"https://blog.bit9.com/2013/02/25/bit9-security-incident-update/;"}],"summary":"Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms, has suffered an electronic compromise that cuts to the core of its business: helping clients distinguish known safe files from computer viruses and other","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc8ecf6f5cefffbbf59c882116939693d7b99a89","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21A91BBA-E8F4-4EB1-93E1-463B1D68403D"},"incident_date":"2012-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e2ed29672a0","org_name":"Association of American Medical Colleges","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/crime/aspiring-medical-student-to-be-sentenced-in-mcat-hacking-case/2013/12/12/3e5e012a-6278-11e3-aa81-e1dab1360323_story.html"}],"summary":"Upset with his MCAT scores, external agent pays hackers for hire to breach Association of American Medical Colleges' system to change his scores. Computer system was compromised, but attack was detected before any data was changed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa894273524db30d06c5731eea1d11a6ae24ad07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4972629-EE41-40B2-AAD0-7380909D213A"},"incident_date":"2012-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fef631577e04","org_name":"Advanced Micro Devices (AMD)","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/01/16/amd_nvidia_spying_lawsuit/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/documents-stolen-by-ex-amd-employees-expose-next-generation-console-contracts"}],"summary":"Four managers who left AMD to work for Nvidia are being sued by AMD for intellectual property theft.  AMD accused the former employees of setting up a spying ring in the company before leaving to work for rivaling company Nvidia.  One of the managers is accused of using two exter","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2664d55d270651d75af61c1dd720b395963c0a73","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DDF61A5-1C5D-4E74-BD6B-EBCBF6005090"},"incident_date":"2012-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"77b2641eb07c","org_name":"AAPT","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cio.com.au/article/431782/aapt_subject_data_breach/"}],"summary":"Records accessed by unauthorized agents on a de-commed server.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f626e3f0622c8c9e93e2eac8dc919fbbd2d89ec0","impact_type":"data_theft","imported_from":null,"incident_date":null,"initial_access":"supply_chain_or_third_party","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/USC%20NOTICE%20FINAL%2006.28.12_2.pdf"},"notes":"supporting_quote not found verbatim in source; confidence lowered","org_country":"US","org_id":"1a87bcdf650b","org_name":"University of Southern California","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32132"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/USC%20NOTICE%20FINAL%2006.28.12_2.pdf"}],"summary":"University of Southern California reported that credit card numbers were obtained through a breach of a third-party system used to process transactions at some campus food venues.","supporting_quote":"Access was gained to a third-party software system that is used to process credit card transactions at some USC food venues, including those at the Ronald Tutor Campus Center, the Lab, Seeds and Starbucks on the Health Sciences Campus.","technology_involved":["third-party credit card transaction processing software"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad6c748f3cc8659c91d0b9aba406d45cf94a1b1a","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-04-09","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Parts%20Bin%20Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"9bed152f7987","org_name":"ThePartsBin.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32139"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Parts%20Bin%20Notice_0.pdf"}],"summary":"ThePartsBin.com reported that customer names and credit card information may have been accessed without authorization during an incident involving its website.","supporting_quote":null,"technology_involved":["ThePartsBin.com website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bca73c2621794f435c562ac5b1b111c57793967","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E720C615-A94D-4448-AA2E-74F01FAF7EA8"},"incident_date":"2012-06-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b132fb7bfc7","org_name":"Gulf Coast Health Care Services Inc","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10663;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"An employee with authorization/legitimate purpose accessed information pertaining to patients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":"Nikhil Nilesh Shah","variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a395f96822beeb0f8cec53dfb8e0a0da5cc6e82","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF86926E-CF16-4ECC-B4B2-9C2E26CF98A4"},"incident_date":"2012-06-28","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29db68fb5fdb","org_name":"Smart Online Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/information-technology-manager-pleads-guilty-sending-damaging-computer-code-former-company-s"}],"summary":"A former information technology manager pleaded guilty today to sending damaging computer code to servers at his former employer, a software company, announced Assistant Attorney General Leslie R. Caldwell of the Justice Department's Criminal Division, U.S. Attorney Thomas G. Wal","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware","derived":{"actor_id":"nikhilnileshshah"}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae290fb1ebe0a76ed06fa07e0ac8267dc7d9fa2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"042C4B15-413A-496C-822E-E857BBC253E8"},"incident_date":"2012-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5295cacbfa25","org_name":"City of Henderson","org_type":"government","ransomware":null,"records_affected":1008,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/four-more-breaches-added-to-hhss-breach-tool/"}],"summary":"The City of Henderson in Kentucky notified HHS that 1,008 were affected by a breach that began or occurred on June 28, 2012 and that was discovered on March 3, 2014. The incident involved a business associate, Keystone Insurers Group. The city kindly provided PHIprivacy.net with ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c801e48439c35a3905eda9bb259ae54a52c000dd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D7DB337-7273-47E8-9248-129BF9AEA80C"},"incident_date":"2012-06-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0449169df5e8","org_name":"Cunard Line","org_type":"transportation_logistics","ransomware":null,"records_affected":1225,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cruisecritic.co.uk/news/news.cfm?ID=4878;http://boards.cruisecritic.com/showthread.php?t=1657908"}],"summary":"(7:30 a.m. EDT) -- Cunard has been forced to shut down its online booking system for guests after accidentally sending personal information of more than 1,200 passengers to an undisclosed number of people who are registered on the system.  Cruise Critic first became aware of the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4963baba9718774c3c59f9e7bd16a663d21d4df","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E32B66D-7500-41A1-B0B0-64F447723906"},"incident_date":"2012-06-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e3c7e1f6a8e","org_name":"Karen Kietzman","org_type":"healthcare","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop and another portable device leaves 708 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-06-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9487e9b271b3f83032e56c6b907cb0c8b804fe8f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"993A8D1F-7DA2-46BB-999A-27FCC6325C1A"},"incident_date":"2012-06-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5dc0377c1f9","org_name":"California Correctional Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Fresno%20related%20uploaded%20to%20CalAG_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36435"}],"summary":"On June 20, 2012, a staff member at California Correctional Health Care Services (CCHCS) inadvertently included your Social Security Number (SSN) when sending leave balance information via email to staff members within California Department of Corrections and Rehabilitation (CDCR","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50105a0301912ce987c282252ac41916d4704bc9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93A0070E-529F-46F1-B2C2-2AB089D10FD5"},"incident_date":"2012-06-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Employee found a sheet of a patient_s medical record outside on the ground in back of the hospital on the way to the smoke shelter. It is unknown how it got there. The document was handed in to the privacy officer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-06-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5064d910aa706917ef526e31653353359c8b55c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7244238D-5426-47F0-8B1E-C203B3E9EFCF"},"incident_date":"2012-06-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a01e35026970","org_name":"Anasazi Hotel","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/rosewood-inn-anasazi-20130530.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41892"}],"summary":"CPP notifies hotel that they are the common point of purchase for fraud.    Forensic exam found that hackers may have begun as early as June 18, 2012.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-06-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f5863ff68123a7523c3dd3043b44062290840bb7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DCEE70C-1C59-4EC9-B623-FDDB0179E528"},"incident_date":"2012-06-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b0e9947d016","org_name":"Sharon L. Rogers, PhD, ABPP","org_type":"healthcare","ransomware":null,"records_affected":585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9907;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach?order=field_breach_total_value&sort=asc&title="},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"A laptop was stolen that contained patient information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"434a484cd7f55c85e602279500306a59df8fabbe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6F5FEBB-A2A3-43B0-8283-AED0F67A9841"},"incident_date":"2012-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"041b3b7967a8","org_name":"UK Home Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stokesentinel.co.uk/Alleged-hacker-Stoke-Trent-pleads-guilty-attack/story-20799982-detail/story.html"}],"summary":"Actor puts a link on twitter that lures people to a site. That site also has DDoS code that took down victim organization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ea19e5ab8220785a60bb2072aedb2a9940c5878","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6220346-4049-4FED-B8B1-1B97BFF0ED42"},"incident_date":"2012-06-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3ad15fb1a759","org_name":"Atlanta Fire and Rescue Department","org_type":"government","ransomware":null,"records_affected":908,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Stolen desktop computer puts 908 records at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a9dc1c642bae7a752249df564b3c7757fcbd837","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A325A8B-8853-413D-A042-13B3D4990ED8"},"incident_date":"2012-06-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"758bc92383cf","org_name":"Apria Healthcare","org_type":"healthcare","ransomware":null,"records_affected":65700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govhealthit.com/news/infographic-biggest-healthcare-data-breaches-2012,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Apria%20Healthcare%20Sample%20Notification%20Letter_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/apria-healthcare-20120927.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/apria-healthcare-20120815.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/apria-healthcare-follow-up-notification-letter.php"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32480"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36609"}],"summary":"Laptop stolen from an employee's vehicle puts patient data at risk.  Specifically, SSN, name, DOB and personal health info was included.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-06-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"680856bb7c0724b43323c7addb2b614700b01893","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6162CD0-DFE3-4226-A4AA-59FF69890200"},"incident_date":"2012-06-11","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5d14de2dcf7","org_name":"Clarksville-Montgomery County School System","org_type":"education","ransomware":null,"records_affected":110000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/clarksville-montgomery-school-20120808.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theleafchronicle.com/article/20120611/NEWS01/306110014/Hackers-release-info-on-14-000-Clarksville-schools-students-employees?nclick_check=1"}],"summary":"Nine computer databases that contained the name, addreses, SSNs of current and former students were illegally intruded upon via SQLi.  The information was posted in pastebin.    ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-06-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f84bce814c250296b37680602eb793ca8b780d88","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BC90A19-EACC-4B4C-AE39-FD118A8D5AC6"},"incident_date":"2012-06-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a17c6b7a1ec","org_name":"Bringham Young University","org_type":"education","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldextra.com/news/local/central/provo/small-data-breach-at-byu-put-student-information-at-risk/article_6f8e62b6-15fa-5a78-b808-e5cad9ba6dc3.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.deseretnews.com/article/865559300/800-Social-Security-numbers-of-BYU-students-leaked.html?pg=all"}],"summary":"Website hack may have resulted in the loss of 800 personal records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","credentials"],"disclosed_date":"2012-06-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f80f4149aab0c253d50da0055137f0b8d4d6489a","impact_type":"data_theft","imported_from":null,"incident_date":"2012-06-11","initial_access":"unknown","initial_access_attack_id":null,"notes":null,"org_country":"US","org_id":"477c6500de4b","org_name":"League of Legends","org_type":"technology_saas","ransomware":null,"records_affected":339487,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"Have I Been Pwned: League of Legends","type":"hibp","url":"https://haveibeenpwned.com/Breach/LeagueOfLegends"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/257292/european_league_of_legends_game_players_have_their_account_data_compromised.html"}],"summary":"A breach of the League of Legends service exposed account data, including email addresses, usernames, and passwords.","supporting_quote":null,"technology_involved":["League of Legends"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2c9033389bc0377ebded9f7eacf5b0a8f1341a5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF71CDB0-1399-404E-AFAB-FFE21DECB63E"},"incident_date":"2012-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"517ff2e12311","org_name":"University of Houston for UH College of Optometry","org_type":"education","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c0b0a815e183b0f5ff559544770bdc42e138c9d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA72F806-3F53-4EE1-9AE0-317C937FB625"},"incident_date":"2012-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5327f190a72","org_name":"St. Mary Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23173"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c41b622f455675e9e7ac0f26f20340b3ebfc684","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A19A7498-CA64-4D50-A8F1-D61728DBACC0"},"incident_date":"2012-06-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"157e08a99fc0","org_name":"South Carolina Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":228435,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65d7a3b3bf0b61132bbbd1b5fa35fad1363a28a0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39F3B0C6-BEFC-4CB7-A94B-479DE5FDE444"},"incident_date":"2012-06-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1129487f2fb","org_name":"Safe Ride Services, Inc","org_type":"transportation_logistics","ransomware":null,"records_affected":42000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e5508ce8c5314417c83c8fbe23a03ea0bccdb50","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A88B628-B47E-42C6-AD9D-D7D73E55DE0F"},"incident_date":"2012-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a844db397b6","org_name":"Rex Smith, DPM -Rex Smith Podiatry","org_type":"healthcare","ransomware":null,"records_affected":20915,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4ce4ec783cd0421b84ef409f76325e89f3a9dec","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93B57DA4-ED9B-4890-87B7-38FA41535B77"},"incident_date":"2012-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41ccf5db1983","org_name":"Our Lady of the Lake Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":17339,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62eff46eaef0f4b15a95166324ee809aea0cc59b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D820A86-5110-4240-A391-218247E89DDB"},"incident_date":"2012-06-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e60267ea688","org_name":"IU Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bc077cac8988363cce952f858ddd2f3a13606ae","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7800A789-29A4-4566-8BBD-191B14AE26E2"},"incident_date":"2012-06-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"295e67665987","org_name":"Iowa Department of Human Services","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65fa9b0885d19e1a9f7a0f3ca2d59b2de55252dd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2CA110C-9817-4903-B506-288F4E142F1B"},"incident_date":"2012-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5093cb57f18b","org_name":"IntraCare North Hospital","org_type":"healthcare","ransomware":null,"records_affected":741,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21ebfe4876a4fdff24b726dfff1c995102edacd7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9417D80-8E7A-45B4-9422-801F9B9236D0"},"incident_date":"2012-06-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f423a1cf34ca","org_name":"Hogan Services Inc. Health Care Premium Plan","org_type":"financial","ransomware":null,"records_affected":1134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1eabb86ad9a6df3cc3dcb64c566acc8dc9d1cbbe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEC831FC-BE2D-4901-8112-564CD9944E6F"},"incident_date":"2012-06-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5dd43178d89","org_name":"Awklein","org_type":"other","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae4ae27f2f0b3aa621294a51fe43cb54da70aec4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A95E9A71-64FE-4326-9161-6C1166C50A4D"},"incident_date":"2012-06-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5b61329d97bb","org_name":"Nordstrom fsb","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notification%20Sample%20%28Nordstrom%20fsb%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/nordstrom-20120801.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32433"}],"summary":"Due to an attempt to reformat addresses to U.S. Postal Service standards, a previous billing statement may have gone to an address other than your correct address.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-06-06","discovered_date":"2012-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c8ece584435f0d5066b790d5a2b51acbea9b5e4","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"unknown","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_1.PDF"},"notes":null,"org_country":"US","org_id":"5245009449b3","org_name":"Next Day Flyers","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23338"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Individual%20Notification%20Letter_1.PDF"}],"summary":"Next Day Flyers notified people of an incident involving personal information; the letter does not state how the incident occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edf921ed77944e39ce927702516937a8f08bd98e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CB5C57C-7DFD-4813-8B63-C7A7EB4FA45A"},"incident_date":"2012-06-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7bdb213ecce9","org_name":"Metcare of Florida, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a portable electronic device results in the exposure of 2557 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-06-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d0787e364f2f6366aae90ec75ec6dac8f535b9f","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-06-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/80sTees.com-C2013037430%20CA%20Customer%20Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"56ea1fd8808e","org_name":"80stees.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-41768"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/80sTees.com-C2013037430%20CA%20Customer%20Letter_0.pdf"}],"summary":"80stees.com reported unauthorized access to website files that included customers’ American Express card account numbers, names, and other card information.","supporting_quote":null,"technology_involved":["website files"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a21c9aaa897836901fc504104e1aa40542d5ce9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1657A419-A68E-4928-BAD0-09DA5142ABFC"},"incident_date":"2012-06-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"364373e645b2","org_name":"University of Massachussets-Amsherst","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/08/hacker-pleads-guilty-to-charges-he-sold-magic-passwords-to-sensitive-networks/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/August/13-crm-964.html"}],"summary":"External actor compromises university servers, installs backdoors then sells access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d0b18ca792c5db677888923c5cc7fed458dac03","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"022CCB00-CE98-4DEF-8B89-18C5A20335F4"},"incident_date":"2012-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4895f66664d8","org_name":"Telvent Canada Ltd","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://o.canada.com/news/national/telvent-client-alerted-feds-to-hack-at-energy-company-documents-suggest;http://www.reuters.com/article/2012/09/29/us-hacking-energy-idUSBRE88S01B20120929;http://krebsonsecurity.com/2012/09/chinese-hackers-blamed-for-intrusion-at-energy-industry-giant-telvent/;http://www.huffingtonpost.ca/2012/09/28/calgary-telvent-security--hacking-chinese_n_1924078.html"}],"summary":"Canadian officials confirmed Friday they are aware hackers have breached security at a Calgary-based software manufacturer - one whose products are often used by large energy companies.  According to security news site krebsonsecurity.com, Telvent Canada Ltd. sent letters to thei","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"511564f5ef344dbc78f1268ec60409e3dce6e68f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EF2BD5B-1113-4094-AF0A-C87F843830DB"},"incident_date":"2012-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3752b85a4392","org_name":"Ministry of Health","org_type":"government","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timescolonist.com/news/local/b-c-health-ministry-data-breach-affects-millions-38-000-will-receive-letters-1.47803"}],"summary":"The personal health data of more than five million British Columbians was improperly stored or accessed, said B.C. Health Minister Margaret MacDiarmid, Monday.  The information was used by researchers for research only, MacDiarmid said, however regarding the most serious alleged ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8fa8d4644b6fb1d2421aad3dbc42de75dd75ea2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D67C88C2-4140-497F-829E-227D6114DA5F"},"incident_date":"2012-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08900b8c29bd","org_name":"Louisiana State University","org_type":"healthcare","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wafb.com/story/20260440/almost-400-victims-identified-in-massive-identity-theft-scheme"},{"fetched_at":null,"title":null,"type":"press","url":"http://theadvocate.com/home/4598376-125/seven-arrested-in-identity-theft"}],"summary":"Insider misused access to billing department records to provide data to an identity theft ring which printed and cashed checks from other people's accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6da18f6dd0230c055d3f2cc5f670e775dbd9187","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3934B0B-1465-4DF6-9438-3C3CFD746DCC"},"incident_date":"2012-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33ea785b155e","org_name":"Kindred Healthcare Inc d/b/a Kindred Transitional Care And Rehabilititation Sellersburg","org_type":"healthcare","ransomware":null,"records_affected":1504,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9966;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sellersburgrehab.com/our-center/in-the-news/?id=2147531586"}],"summary":"A safe containing tapes with patient information was stolen.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"ET","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ef8172872563ad09d8e947760f5d7d045f99d75","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B8EDA59-DD44-4657-96A6-E64F7EC8F30D"},"incident_date":"2012-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35658a3a5910","org_name":"Ginbot 7","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB/issues/1639"}],"summary":"Ethiopian government uses spyware to monitor political party","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b391b8c144789f10e7fdde0499ae0f23f96c340b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5D427C6-B22B-47E8-8A3A-9FF7B99C07EC"},"incident_date":"2012-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5d022dc6678","org_name":"EnerVest Operating","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wvgazette.com/News/201401280098"}],"summary":"Man faces prison for computer-related fraud  Kate White Ricky Joe Mitchell told a federal judge he had found out he was going to be fired the night he shut down his former company's computer network and phone system for a month.   Mitchell, 34, pleaded guilty to one count of frau","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9881e2e5f6e65dcf1b5091171a2aa3f02a4b599","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C5F2DEC-02EC-4D99-BCB2-1F5651C31A89"},"incident_date":"2012-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f5156e25ba66","org_name":"British Columbia Institute of Technology","org_type":"education","ransomware":null,"records_affected":12680,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/british-columbia/bcit-warns-medical-database-security-breached-1.1197783"}],"summary":"server was hacked and used to store movies.  On that server was medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"362daef6b738b088c409416d087d3eade8276bea","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A8F53C4-FDE3-4ABE-A306-BAB9D1174C14"},"incident_date":"2012-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78fdc81729fc","org_name":"Adults and Children with learning and Developmental Disabilities, Inc","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/cops-aide-stole-identity-of-mentally-disabled-patient-at-oakdale-group-home"}],"summary":"A Bay Shore woman who worked as an aide for mentally disabled adults was arrested Thursday accused of stealing the identity of a patient and going on a spending spree, Suffolk County police said.  For 21 years, Noreen Hanney, 38, of 1653 N. Thompson Drive, worked as a house manag","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"998ca512013beeb12b020fbd733bc84d48f2fd72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A166AE89-4C5C-4779-8C59-5CACB27BAD7E"},"incident_date":"2012-06-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d14bdd3031e","org_name":"ACLD Inc.","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://identitytheftsolutiontips.com/woman-with-plainview-ties-charged-in-identity-theft"}],"summary":"Health Aide used stol debit card information of patient she was caring for, to pay for her car, plane tickets, ATM withdrawals.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2012-05-31","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"699f12d2e433de64444375fc729f324e8dc0db67","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C3CA451A-B82E-461C-8D7C-1FBACCC0DC4A"},"incident_date":"2012-05-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8bab4d8467a5","org_name":"Public Works and Government Services Canada","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.calgaryherald.com/technology/Hacker+Public+Works+Ottawa+went+unnoticed+days+documents+show/7760124/story.html"}],"summary":"A hacker was able to gain access to two government computers earlier this year, a breach of security that went unnoticed for days until a “trusted source” notified Shared Services Canada of the intrusion.  A forensic analysis of the two computers from Public Works and Government ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-05-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36fabb3b7641acf9b007624de7b12bc66a74a653","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6302089D-4848-46FD-AAD0-23E9766A1F90"},"incident_date":"2012-05-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d5e68f1a3905","org_name":"Bob Ward & Sons, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bob-ward-20121023.pdf"}],"summary":"E-commerce site is hacked, exposing name, address and credit card info of customers of www.bobwards.com.  Discover card notified of CPP.  Oddly, the letter indicates they were notified before the first initial compromise, which doesn't make much sense.  They do state that past 5/","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"737aec99bfa2e2c34b35ddecd679a528c2263c10","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEC1C06A-AE20-43B6-962E-5E1491375B3A"},"incident_date":"2012-05-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9da01964e01a","org_name":"National Health Service Surrey","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/ico-issues-nhs-surrey-monetary-penalty-of-200000"}],"summary":"Medical information was left on hard drive that was subsequently auctioned to public. The error was by NHS Surrey's data destruction vendor.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"919a4b13376ce50b0d896d6a793e8315d97ad6c5","impact_type":"unknown","incident_date":"2012-01-21","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/First%20Republic%2023278%20notice%20only_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a7becb1c60d9","org_name":"First Republic Bank","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23278"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4de20f600eb73694331d3986408ef904091719fb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0569422-8A51-4997-80A6-6FA0A83218D3"},"incident_date":"2012-05-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"08cab4c3ee84","org_name":"Glasgow City Council","org_type":"government","ransomware":null,"records_affected":20143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-scotland-glasgow-west-22807593"}],"summary":"Glasgow City Council has been fined £150,000 for the loss of two unencrypted laptops, one of which contained personal details of more than 20,000 people.  The fine was issued by the Information Commissioner's Office.  The ICO discovered that a further 74 unencrypted laptops were ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd416413c53d1e3154e1727fada7b1a19aa927c0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BD56CB2-69A1-4352-BA4B-8C87759777CD"},"incident_date":"2012-05-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5370a4c64ee5","org_name":"Visiting Nurse Services of Iowa","org_type":"healthcare","ransomware":null,"records_affected":1298,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The Visiting Nurse Services of Iowa reported that 1,298 patients had PHI on stolen paper records. I was unable to locate any additional details.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d7cdc0a6319fb7441cb15f93d822a114eff27a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF160495-648F-4F8F-AB32-A6C66502C3AF"},"incident_date":"2012-05-27","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb40f95a88b6","org_name":"bzpower.com","org_type":"technology_saas","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/AGBywqf5"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/05/30/full-database-from-bzpower-com-leaked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/05/28/bzpower-com-bionicle-hacked-again-900-accounts-leaked/"}],"summary":"Hackers use SQL injection to dump non-public member information and post it to pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcbb02b4f1b81f3873bf987a3d05d53178fc1d8a","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Acct%20number%20reissue%20notice_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"38b6bce69b2e","org_name":"Discover Financial Services","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23276"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23275"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42afb9f4cb8c4beed40d363da309f5ddc9255be1","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Altrec%20CA%20Notice%20Letter%20Sample_0.pdf"},"notes":null,"org_country":"US","org_id":"165d7368a799","org_name":"Altrec, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23270"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Altrec%20CA%20Notice%20Letter%20Sample_0.pdf"}],"summary":"Altrec sent an incident notification offering identity-protection services, but the available text does not describe what happened or how access occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb4bc6a57b5443cdafdd00c20865c24975f0c7ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DA106F8-D1FC-48BE-8149-6419C97E4674"},"incident_date":"2012-05-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1fb2ba90425","org_name":"NYU Langone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":8500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nyu-langone-medical-center-notifies-8400-neurosurgery-patients-that-stolen-computer-may-contain-patient-health-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.med.nyu.edu/about-us/potential-data-breach-7-23-2012"}],"summary":"NYU Langone Medical Center notified patients this week that a desktop computer containing personal health information was discovered stolen from the Faculty Group Practice office of John G. Golfinos, MD, chair of the Department of Neurosurgery on May 23, 2012. Although the comput","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-23","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86af7ea4f222cf65450296e4e6bba306a7695443","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99FBE58D-6A7D-4A27-9056-A7B817E569C6"},"incident_date":"2012-05-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/NSCS%20Notice%20to%20California%20Residents_0.pdf"},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae5aab7deaf1","org_name":"Nebraska State College System","org_type":"education","ransomware":null,"records_affected":650000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nebraska.edu/security,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.reportexec.com/news/Former_student_to_be_charged_for_security_breach__.aspx,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/NSCS%20Notice%20to%20California%20Residents_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/nebraska-state-20120815.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-36410"}],"summary":"A former computer science and math student at the University of Nebraska faces serious charges after hacking into the university's system and causing a major security breach. According to the Journal Star, the U.S. Attorney's Office recently filed a federal charge against the 22-","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87f025c8cc19c9bfd62e769a52750eaaaf360ce8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE10EA89-5CAB-4972-BBD6-F3A0AAE4E102"},"incident_date":"2012-05-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"820869bd1029","org_name":"City of New Haven","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nhregister.com/articles/2012/06/08/news/doc4fd206134783d161651112.txt"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcconnecticut.com/news/local/Rent-Rebate-Laptop-Stolen-from-New-Haven-Library--158177055.html"}],"summary":"Stolen laptop results in potential compromise of PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"EE","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"328e4a264a8cde000720198515583f90f2656432","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"610C7B85-6AB0-4278-88B4-234C3AB9F2EC"},"incident_date":"2012-05-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.silive.com/news/index.ssf/2013/07/sentenced_in_staten_island_atm.html"}],"summary":"ATM skimming ring conducted in 2012 targeting Chase banks around Staten Island.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-05-22","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"880e25ca8edcaf8922454190a62fb5641b989516","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9570496-6288-4144-9D31-C556F99F6702"},"incident_date":"2012-05-22","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79e54a91b5aa","org_name":"Gotickets, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/GoTickets%20Customer%20Notification%20Template_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/gotickets-20120904.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/gotickets-20120803.pdf."},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/go-tickets-20120620.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32074"}],"summary":"Pending the final results of our investigation, it appears that an unknown, outside group or individual improperly accessed www.gotickets.com’s database possibly exposing some of our customers’ sensitive information, including shipping, billing and credit card data related to pur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"619b90105529e18612c22fd3bda6a3f767e4e8f3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD8B6CD8-6481-40EF-9911-1983F284CE14"},"incident_date":"2012-05-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77ef3dcefbed","org_name":"Beth Israel Deaconess Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/laptop-theft-affects-nearly-4k-beth-israel-deaconess-medical-center-patients.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/lifestyle/health-wellness/2012/07/20/patient-information-may-have-been-breached-after-laptop-stolen-beth-israel-deaconess/h4Z1IdEsikanQSCaIODYbJ/story.html?camp=pm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bidmc.org/News/AroundBIDMC/2012/July/LaptopBreach.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ihealthbeat.org/articles/2012/7/23/beth-israel-deaconess-notifying-3900-patients-about-data-breach.aspx"}],"summary":"Approximately 3,900 Beth Israel Deaconess Medical Center patients will be getting letters alerting them that some of their personal health information may have been breached after a physican’s personal laptop computer was stolen from a hospital office.  The theft occurred May 22,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0a49f8d5b5255e6482a06fde9f257d6a50292ad6","impact_type":"unknown","incident_date":"2012-03-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Yolo%20FCU%20US-2012-0244-PA_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"c425499af752","org_name":"Yolo Federal Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23244"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4ac99e379d5c3dec18a49c0a3312e14f9d02f2e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE190DD2-B1AA-4D1A-816D-CDE25CD40434"},"incident_date":"2012-05-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4f692cba64b","org_name":"University of New Mexico Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":2365,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The University of New Mexico Health Sciences Center reported that 2,365 patients had PHI on a server that was hacked on May 21, 2012.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74b650e158260b37229ff856640236210b01d950","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D8E293D-2A9C-4A91-9713-0702837D7B59"},"incident_date":"2012-05-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2dca49a6e82c","org_name":"St. Marks Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/st-marks-medical-center-notifies-patients-after-finding-malware-on-system/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.smmctx.org/news/privacy-notice-for-st-marks-medical-center-patients/"}],"summary":"St. Marks Medical Center in LaGrange, Texas notified 2,988 patients of a breach. From their notice of December 31, 2012:  On November 15, 2012, we learned that on May 21, 2012, one of our employees computers had become infected with malware that appears to have been designed to l","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd6e56d71e7d5735b5932d1aabe6c557b65e7e54","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF330F1A-A365-4493-B851-FD4CE91BCD3C"},"incident_date":"2012-05-21","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca32108d73a0","org_name":"St. Mark's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2998,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smmctx.org/news/privacy-notice-for-st-marks-medical-center-patients/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/st-marks-medical-center-notifies-patients-after-finding-malware-on-system/"}],"summary":"On November 15, 2012, we learned that on May 21, 2012, one of our employee’s computers had become infected with malware that appears to have been designed to look for personal information stored on the computer. We immediately began an investigation and engaged a computer forensi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d0f004711c5543ad0ec753db8202210c02d069f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48AFB7A4-19C3-4037-82BE-FB79F9EFE879"},"incident_date":"2012-05-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97fd8fa639a9","org_name":"Petco Animal Supplies","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Experian%20Final%20Proof%20-%20Base%20Version_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/petco-20120726.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32373"}],"summary":"On Tuesday, July 3, 2012, the outside auditor of Petco's 401(d) plan informed us that five laptop computers had been stolen from their offices during the weekend of May 18-20, 2012. We are seeking an explanation from the outside auditor’s office for the lapse of time in informing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-05-18","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4dd6b8cc7fb9faa5f21a4603de4d329b7f74316","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1AF8236-8B94-4C30-B65F-48DE4AC1AA12"},"incident_date":"2012-05-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7f6992d64e76","org_name":"LabelMaster","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/labelmaster-20121017.pdf"}],"summary":"E-commerce site hacked.  Data exposed includes name, address and CCN.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"746804d8a135ed63a0e0b44eea79ad8cc19e15f4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2799C3DD-CFD2-44B0-881A-0531C22622B7"},"incident_date":"2012-05-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55a106d07038","org_name":"Molalla Family Dental","org_type":"healthcare","ransomware":null,"records_affected":4354,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.verticalnews.com/premium_newsletters/Information-Technology-Newsweekly/2012-07-31/3754IT.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.asia/voter-info-incident-leads-breach-roundup-a-4965"}],"summary":"Molalla Family Dental in Oregon reported that 4,354 patients had PHI involved in a hacking incident on May 17, 2012.   Molalla Family Dental in Oregon is notifying more than 4,300 patients of an online data breach that exposed sensitive information.  The practice reports in a pre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29f3344ce5cd4990630825a292916d772f33fdc1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F0DA627-33F4-4F9B-9080-9F4402511636"},"incident_date":"2012-05-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a902ef9ea184","org_name":"Psychiatric Security Review Board","org_type":"government","ransomware":null,"records_affected":27,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oregonlive.com/politics/index.ssf/2013/05/executive_director_of_psychiat_1.html"}],"summary":"The Psychiatric Security Review Board is set to consider the resignation of its executive director amid a state investigation of board management.  A staff member of the Psychiatric Security Review Board recently lost documents containing the medical, personal or criminal histori","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"725bce1c9b78a8bca083e7e410c3e064fd301536","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0C89DC9-285B-4E7A-AE10-8AACF199D60B"},"incident_date":"2012-05-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b1f0cb07129","org_name":"Pamlico Medical Equipment LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":2917,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9907;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beaufortregionalhealthsystem.org/pamlico_medical.shtml"}],"summary":"A flash drive that was mailed did not get received by its intended recipient.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72cef6f8b3a6f0d9e5761cf347951c4f6a9e23b9","impact_type":"unknown","incident_date":"2012-02-20","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Sample%20Letter%20w-Attachment%20042012_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"69e85051d15b","org_name":"Emory Healthcare, Inc.","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23198"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-05-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"717839e63e0b713d00de2d0f526f40a5939294dd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"26E48349-65F7-4F8F-ACB8-2A88F5E87E92"},"incident_date":"2012-05-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BR","org_id":"90fc82f984db","org_name":"csgameservs.com","org_type":"technology_saas","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&cad=rja&ved=0CE4QFjAD&url=http%3A%2F%2Fhacktalk.net%2Fleaksdumps%2Fcsgameservs%2F&ei=lvAkUZutAoa8qgHK3IGwAQ&usg=AFQjCNF6IQ1vFx9iDEENFxZWBBAKJbYyKg&bvm=bv.42661473,d.aWM"}],"summary":"5k emails and passwords dumped to pastebin from gaming site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"697d6498712c94f22263db1be0ea1e2b808b5f8f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33CACF8A-7DF3-41AF-98D2-5015CEA45D1A"},"incident_date":"2012-05-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1921b9f0ed15","org_name":"Family HealthServices Minnesota, P.A.","org_type":"healthcare","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"A stolen laptop leaves 4000 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"06b88d91aa46e5dce1fed2c8bd0818c4053675d2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"507FF1DB-2F89-4383-A739-BD4D0C65A09A"},"incident_date":"2012-05-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co.","org_type":"financial","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://palmdesert.patch.com/groups/police-and-fire/p/police-man-installs-skimming-devices-in-la-quinta-atm-tries-to-use-stolen-info-in-palm-desert"},{"fetched_at":null,"title":null,"type":"press","url":"http://palmdesert.patch.com/groups/police-and-fire/p/update-palm-desert-fraud-suspect-targeted-68-chase-bank-customers-prosecutor-alleges"}],"summary":"Man installs ATM skimming devices to steal customer payment card info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d88d2807627133d077cfe750e0731c4c8b248993","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UNCC__Consumer_Notice_0.pdf"},"notes":null,"org_country":"US","org_id":"03ad8ab33721","org_name":"University of North Carolina at Charlotte","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"Incorrect access settings made University-hosted electronic data accessible from the Internet.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23160"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UNCC__Consumer_Notice_0.pdf"}],"summary":"Incorrect access settings made University-hosted electronic data accessible from the Internet, and the University reported no evidence that the information was inappropriately accessed.","supporting_quote":"On February 15, 2012, the University of North Carolina at Charlotte (the “University”) announced that, because of incorrect access settings, a large amount of electronic data hosted by the University were accessible from the Internet.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b970162aa663fba579ad7a2ff5dd213132497cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A079FEAB-6583-4B79-95F0-B85C13178DDF"},"incident_date":"2012-05-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A nurse gave a patient his post-op discharge paperwork and inadvertently attached to it was a pre-op surgery list with nineteen (19) other Veterans' names and last 4 of their SSN.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-05-11","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"011b3eb243fc0bdbc2451e7587f26d464204cac4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62289799-7131-405B-A205-3156BB184126"},"incident_date":"2012-05-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1b2d57b4c7a","org_name":"Stanford University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2012/05/stanford-database-breached-by-indian.html"}],"summary":"Indian Hackers Harsha Vardhan Boppana and Codie Root claimed that they hacked into Stanford university website. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-05-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2795834bb45fca48e7a430a445c673da89a3d6c","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter%20to%20CA%20AG_1.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"a226f430b8c1","org_name":"First Data","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23158"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":"Anonymous","variety":"activist"},"attack_techniques":["T1114"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-11","discovered_date":null,"entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04627a60096a3437cc13cfab6eec716da8a74a91","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Notification_Letter_FINAL_SSNs_04-25-12_0.pdf"},"notes":null,"org_country":"US","org_id":"592a6a0e6043","org_name":"California Department of Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23155"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Notification_Letter_FINAL_SSNs_04-25-12_0.pdf"}],"summary":"Hackers affiliated with Anonymous accessed and released a retired Department of Justice agent’s private email accounts, which included some recipients’ personal information.","supporting_quote":null,"technology_involved":["email accounts"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking","derived":{"actor_id":"anonymous"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7f45a171a541c167281548857167e636b57d006","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D8D071D-B080-4CBC-80AA-86759A4B0AF3"},"incident_date":"2012-05-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8d0ba0dce49","org_name":"Utah Department of Health","org_type":"government","ransomware":null,"records_affected":780000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b60a9aef8a9a93f976f2d1a3636325883d8dfa30","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B526D3A-ACCD-4C25-8E94-423BA0837C62"},"incident_date":"2012-05-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d2a1b90fe54","org_name":"University of Arkansas for Medical Sciences","org_type":"education","ransomware":null,"records_affected":7121,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9b0a760eca7d2e845b119d0d8ba83062b060ff4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7E532758-6359-48C9-84D7-897F372C3E0E"},"incident_date":"2012-05-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6cd214a87f9","org_name":"Seton Health Plan","org_type":"financial","ransomware":null,"records_affected":555,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33c58e48f6bfe7bf5b81fe3376a8d9e82a906159","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4D99588-81F0-419F-AC6E-72EB7F9DA7B9"},"incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38f155e85134","org_name":"Roy E. Gondo, MD","org_type":"healthcare","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89a9a953ebefcf0d9f4e5135ad322b2c7f4605d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"458143AD-CAE2-428D-8817-53C22EA5BE7B"},"incident_date":"2012-05-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b2bf45e60b46","org_name":"Rhinebeck Health Center/Center for Progressive Medicine","org_type":"healthcare","ransomware":null,"records_affected":6745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ec1bd691f95f34d39ccf87b8fb7b83389ef464eb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7E6BA66C-583A-4CB9-A9F6-5A581B3BBA3F"},"incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95d187932fa2","org_name":"Policlinica La Familia IPA 343","org_type":"government","ransomware":null,"records_affected":5994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f55599854a0a7a5c460c90d950d11ddd40b1561","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2166926F-6009-45D6-9611-957FF20BB3D5"},"incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d99dcf417bbf","org_name":"Neighborhood Christian Clinic","org_type":"healthcare","ransomware":null,"records_affected":9565,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d97106ecdecc25416740ecc3f8e072a7b630391","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84B1FF3D-7830-4664-BA74-B1B557CB965A"},"incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"addeb717409a","org_name":"Memorial Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":9497,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2a2dd10982e035a1153b6be3d354768c449df88","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87A90852-E8A1-4466-AF25-BB457E51B131"},"incident_date":"2012-05-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3df09eae94d","org_name":"Jeffrey Paul Edelstein MD","org_type":"healthcare","ransomware":null,"records_affected":4800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9972"}],"summary":"A computer server was stolen from a locked closet in the office of Dr. Jeffrey Paul Edelstein.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b9d42f5c12b777f6e70c2d9e9d5c57e373623fe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFEF23A4-8B2A-4F50-8ABF-2580E204FDB3"},"incident_date":"2012-05-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b288e5dd0c3b","org_name":"DRD Management, Inc. D/B/A DRD Knoxville Medical Clinic - Central","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaabreachlist.com/breach/526ed43f2e0bc531a01e4f68"}],"summary":"Improper records disposal.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21ab7747bb381562241f6815b6a0b4454751c1b8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0864FC37-72F9-4063-9CAE-860711E4F921"},"incident_date":"2012-05-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c740cc45b321","org_name":"Dental Office","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/dental-practices-feel-some-pain-following-breach-by-business-partner/"}],"summary":"Both River Arch Dental and Hamner Square Dental  sent patients a letter on July 16 about a breach that occurred when a business partners employee violated their security protocols","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdaa34abbf2dba2551410315394f004912e203c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57E1EAC1-C992-4365-AF58-F1270F6F5E46"},"incident_date":"2012-05-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61f54829846e","org_name":"Shands Jacksonville clinic","org_type":"healthcare","ransomware":null,"records_affected":261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://jacksonville.com/news/crime/2013-01-24/story/office-intern-jacksonville-primary-care-center-charged-id-theft"}],"summary":"Names and Social Security numbers of 261 people were illegally photographed at a Shands Jacksonville clinic then transmitted to another person","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"552372034770d2dae6f101b291bf001e718b3447","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3035B23B-BF32-4745-BB6F-7D8C58E5254C"},"incident_date":"2012-05-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d72a7d7b21c6","org_name":"California Department of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/BR2012-014%20Breach%20Notification%20Letter_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23330"}],"summary":"After conducting a survey at the Bakersfield Memorial Hospital, an L&C employee mistakenly left the survey binder in an unattended vehicle.  Later, the vehicle was broken into and the survey binder was stolen.   The information exposed includes name, DOB, medications, room number","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f816392b6b544bd0f20c184d78e2b12e36d6e641","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60939153-8772-48E9-A515-0863873FABF5"},"incident_date":"2012-05-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e77e2fd0e97","org_name":"Brentwood Primary Care Clinic","org_type":"healthcare","ransomware":null,"records_affected":261,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/01/25/shands-jacksonville-clinic-reports-patient-data-breach/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://jacksonville.com/news/crime/2013-01-24/story/office-intern-jacksonville-primary-care-center-charged-id-theft,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/florida-health-clinic-intern-charged-with-identity-theft.html"}],"summary":"There was a small health data breach at Shands Jacksonville clinic recently, as Jacksonville.com reports that 261 patients’ names and Social Security numbers were photographed from May 7 to June 19 and given to another person.  The report says Daremia Nikeka Crews was charged Wed","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2012-05-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e34b65b3495d001b4798dc613cf161608aef76fd","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-05-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Rest%20of%20USA%20CL%20-%20Final_0.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"40c6e6e102d5","org_name":"ECS Tuning","org_type":"retail_ecommerce","ransomware":null,"records_affected":71,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ecs-tuning-20120619.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32059"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Rest%20of%20USA%20CL%20-%20Final_0.pdf"}],"summary":"ECS Tuning reported unauthorized access to customer information associated with pending and recently shipped orders.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d3414886a71ba8dba9c7efb67955f9e7048f0cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2439B555-7B05-4DD9-83BC-C46B58AC8622"},"incident_date":"2012-05-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e264f371c66","org_name":"Accumetrics Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/acumentrics-20120611.pdf"}],"summary":"on the morning of Monday, May 7, 2012 the company noticed suspicious activity in payroll system logs. The company, with the assistance of its payroll vendor, ADP payroll services, conducted an investigation. The investigation revealed that the breach occurred sometime between clo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe1ac80546808725de6ec15333bd54480fc12bde","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8495FF17-FB94-4637-BB22-3A46DB51AD1F"},"incident_date":"2012-05-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8d01a8e5b7e","org_name":"Gessler Clinic, PA","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/article/20120612/NEWS/120619807"}],"summary":"Documents, called Charge Tickets, containing patient information was stolen from Gessler Clinic.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-02","discovered_date":"2012-04-02","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2573f95602081ab7fc2f5395e6d1f6fcb0b82a51","impact_type":"data_theft","imported_from":null,"incident_date":"2012-04-02","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Redacted%20SSN.PDF"},"notes":null,"org_country":"US","org_id":"df31913557ab","org_name":"Incorporating Services, Ltd.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23127"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Redacted%20SSN.PDF"}],"summary":"Incorporating Services, Ltd. reported that malware enabled an unauthorized party to access personal information stored on a server, including some individuals’ Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d670c70ad165cb872f253b67b21a29f374b34c63","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D59E1DE9-9073-45A0-B1FA-6A92B16342B6"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca14786e0705","org_name":"US Federal Bureau of Investigation (FBI)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/world-us-canada-24215871"}],"summary":"An ex-FBI agent has agreed to plead guilty to leaking information to a reporter about an al-Qaeda bomb plot","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d09636ea8174acee3584031a3ea3286df671f4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7ACBD6DA-9BA7-4DF2-8A1B-F65C512A4553"},"incident_date":"2012-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"591ecb286664","org_name":"University of North Carolina","org_type":"education","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/university-of-north-carolina-servers-hacked-3500-employees-data-accessed/"}],"summary":"A cyber attack on two servers resulted in the exposure of employee information.  The servers were at the UNC Lineberger Comprehensive Cancer Center.  Employees, contractors, and visiting lecturers at the Lineberger Center may have had their Social Security numbers or passport num","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"402d89d984d40a9a13cd151bfb2fbdf22d632129","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"564A2BB8-A01B-4EF3-9217-3A86502CCB54"},"incident_date":"2012-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0d29cff2ad8","org_name":"University of Kentucky HealthCare","org_type":"healthcare","ransomware":null,"records_affected":4490,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9907"}],"summary":"A password-protected laptop was stolen that contained personal patient information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87382cfbcea8c6cf2caff2ff2ad099ce2a679d80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE28282E-7E2D-4721-858A-652AC51C6416"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39be97317ff3","org_name":"State Farm Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Agent%20Jain%20Williams-Victim%20Letter%20%283%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Agent%20Jain%20Williams-Customer%20Letter%20%285%29_0.pdf?"}],"summary":"For at least two months, a former employee used customer information inappropriately.  This information would have included names, addresses, DOB, CCN and SSN.  The employee used some of these cards to make fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d710e19a6f5199598833656390fd70e12f538006","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7007688A-41A8-4F55-BFA2-C0CEC47F05D1"},"incident_date":"2012-05-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9df1d6422be0","org_name":"NHS Surrey","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2013/ico-issues-nhs-surrey-monetary-penalty-of-200000"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techweekeurope.co.uk/news/nhs-surrey-ico-fine-200k-data-breach-121681"}],"summary":"Data destruction company fails to destruct data and the victim is then  fined when a computer is sold containing 3000 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc2832437da205ab015f7138242c5336bb0c2412","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDE74A73-2BAB-4A6B-A6DD-DAE91948EEF5"},"incident_date":"2012-05-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ecbe9a44f413","org_name":"Natural Provisions","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.burlingtonfreepress.com/article/20120727/NEWS02/307270023/Williston-Vermont-credit-card-losses-now-at-120-000-in-Natural-Solutions-case?nclick_check=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcax.com/story/23404692/vt-ag-settles-with-store-after-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.burlingtonfreepress.com/viewart/20130911/NEWS02/309110013/Vermont-AG-settles-Williston-store-after-data-breach"}],"summary":"Complaints are still incoming about the breach of the credit card system at Natural Provisions on Harvest Lane earlier this year, police said.  Detective Sgt. Bart Chamberlain said most complaints were filed between May and early July, but are still incoming.  The credit card dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2dddab01bc2395a7d079ea4d2d8229804c85dc06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54797080-3495-4ECD-A3AF-014785F1D383"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f03a58739234","org_name":"National Oceanic and Atmospheric Administration","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.federaltimes.com/article/20141021/FEDIT03/310210018/NOAA-employee-indicted-theft-sensitive-infrastructure-data?odyssey=mod%7Cnewswell%7Ctext%7CAdvice%20&%20Opinion%7Cp;http://www.norwalkreflector.com/article/5098461?trending=;http://www.fbi.gov/cincinnati/press-releases/2014/noaa-national-weather-service-employee-indicted-for-allegedly-downloading-restricted-government-files"}],"summary":"NOAA National Weather Service Employee Indicted for Allegedly Downloading Restricted Government Files   DAYTON, OHXiafen Sherry Chen, 59, of Wilmington, Ohio, was indicted in U.S. District Court for allegedly accessing restricted U.S. Government files. Chen is a hydrologist curre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"667d23d5528946ea010ab6daedb4472dafedbdb2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D787784-B8B1-4FB5-8CD8-26C13CD13187"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"257a0cadef6f","org_name":"MRT Inc.","org_type":"other","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.japantimes.co.jp/news/2014/10/14/national/crime-legal/ex-systems-engineer-arrested-over-doctors-data-leak/#.VEJvtUuFr7Q;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/jp-ex-systems-engineer-arrested-over-doctors-data-leak/"}],"summary":"Police on Tuesday arrested a former employee of a Tokyo medical recruitment agency on suspicion of illegally copying the personal data of around 17,000 doctors and nurses.  Kengo Mikami, 36, is suspected of copying the confidential information on or around May 30, 2012, while wor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdfeb195acf89814c89b6bd8640a402b906ce5db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF48375D-FDBD-4E70-B62C-42A17D541290"},"incident_date":"2012-05-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42782b90975b","org_name":"Highlands-Cashiers Hospital","org_type":"healthcare","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://1050wfsc.com/data-breach-reported-at-highlands-cashiers-hospital/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/nc-hospital-patient-info-accessible-via-internet-for-longer-than-two-years/article/386513/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cdn3.mission-health.org/sites/default/files/subnotice_112414.pdf"}],"summary":"Highlands-Cashiers Hospital in North Carolina is notifying about 25,000 patients that their personal information  including Social Security numbers  was accessible via the internet for longer than two years.  How many victims? About 25,000, according to reports.   What type of pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4cc17bd7b63220df4e2fb4ea5ea6d0878000b8f9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A11AF86B-FEEF-404E-B091-4FF10AC56A82"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c79db6414a9","org_name":"First Choice Home Health Care Services Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/April/13-crm-467.html"}],"summary":"A group of co-conspirators used Medicaid information from Medicare beneficiaries in and near Detroit to defraud Medicaid and file for $24.7 million in fraudulent claims.  The fraud took place between 2008 and May of 2012.  Hundreds of patients had their information misused so tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22bb9e1d351c1a7b11332175fb6d2ce1e296af3d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3c5282c0-af59-11e7-b9af-6daebc71dd3b"},"incident_date":"2012-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"620b45741b4a","org_name":"Federal Intelligence Service","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/trial-begins-of-intelligence-services-data-theft/"}],"summary":"Trial begins of intelligence services data theft - Swiss Federal Intelligence Service","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"706bf0a7abf3b980acec3099b98712b1a8eb326c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A00BCCFD-2E19-4C81-A94B-A4C0484D3AF3"},"incident_date":"2012-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Coast One Financial had Experian consumer information accessed. Limited information on breach available.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0dfe779535e09ecef6ff33a8022c244a7510aca8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"045B7E23-5876-4DD1-A332-769286B20F27"},"incident_date":"2012-05-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0dce3b03c1e7","org_name":"DJArts","org_type":"technology_saas","ransomware":null,"records_affected":3178,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.surveygizmo.com/s3/1134048/veris"}],"summary":"Gaming website compromised via undisclosed method. User information in the form of usernames and passwords posted to pastebin.com","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fb76b20334381350757e8eead1a2ee0f105d506","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16C5CBFA-4B85-49C9-9DCE-15750183415F"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e946bb8b80a","org_name":"CCS Medical, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ccs-medical-20121210.pdf"}],"summary":"On September 20, 2012, a CCS medical employee reported that another employee may have accessed, recorded and disclosed Social Security numbers and other personal information in order to submit false tax returns to the IRS and collect fraudulent tax refunds. CCS medical immediatel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53721d6a84a22cc13782553b758e14f36eb989f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A72D9ED-D328-41F1-8B87-1B8F04BC06C1"},"incident_date":"2012-05-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52a9d4bb3ae5","org_name":"Bureau of Automotive Repair (BAR)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/california-bureau-of-automotive-repair-admits-security-breach.html"}],"summary":"An unauthorized individual accessed the network of a BAR service provider between May 2012 and March 2013.  The bank routing information of Smog Check stations licensed with the BAR was exposed.  Those who may have had their accounts accessed are encouraged to close their old acc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"354ca40edf49c9a7eb3a573edfa905782ab5eabd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A0CE1B3-35CD-4474-A133-F5945942B53E"},"incident_date":"2012-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9312e7831b2d","org_name":"Apex Laboratory, Inc","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-last-of-five-pleads-guilty-in-medical-id-theft-tax-fraud-but-questions-about-the-breach-remain/;http://www.phiprivacy.net/apex-laboratory-notified-of-system-compromise-by-law-enforcement-in-july-notifying-patients/"}],"summary":"The last of five people accused of tax refund fraud involving identity theft from medical records pleaded guilty Friday for his role in the scheme, U.S. Attorney Wifredo A. Ferrer said.  Michael Ali Bryant, Sr., 41, of Lauderdale Lakes, faces up to 12 years in prison at his sente","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53825321032c4b84d8dd3fb5d805e491c17f1cbf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9431949-A993-4901-982F-B5522066114B"},"incident_date":"2012-04-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"2e3dcf7ddf3d","org_name":"Bow Valley College","org_type":"education","ransomware":null,"records_affected":200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://calgary.ctvnews.ca/investigators-say-bow-valley-college-failed-to-protect-vital-info-1.1419084"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bowvalleycollege.ca/important-message.html"}],"summary":"Bow Valley College disposes of servers without wiping data. Thought that a contract was in place to wipe data also. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["internal"],"disclosed_date":"2012-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fd2e5d7eb6888c1e799e1e07811a5978b6822a1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05D8E8E5-B90F-41B5-8CCB-64D078236177"},"incident_date":"2012-04-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"296223c81e1f","org_name":"Lake County Sheriff's Office","org_type":"government","ransomware":null,"records_affected":16000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach?order=field_breach_total_value&sort=asc&title=;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/newsImage/FBI-Investigates-Lake-County-Sheriff-s-Office-Hack-2.png/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/local/breakingnews/os-hacking-site-lake-sheriffs-office-20120505,0,58306.story"}],"summary":"Hackers were able to access and post law enforcement files online.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"PK","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-04-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8650f7e72327dc8bc6de14e80d4974ba022e7816","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D78A2063-DF5D-4E23-A416-DB5F131A3370"},"incident_date":"2012-04-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"12075ac78ee1","org_name":"eUKHost","org_type":"technology_saas","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/04/30/eukhost_billing_system_compromise/"}],"summary":"Webhosting company's billing system was compromised via undisclosed web-based hacking action. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a37f3cd2a8ec495ce7624901b8dd48e9116c686a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76FE40F7-D15B-441E-BEF0-B23FCA0BFADE"},"incident_date":"2012-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"80535a0b5597","org_name":"International Police Association - International Administration Center","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thehackernews.com/2012/04/international-police-association.html"}],"summary":"Anonymous hackers deface International Police Association website and left an angry message to let the organization know that they hacked the site \"for the lulz\", but also warned them they they might have stolen sensitive data.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9701e10d7fc0d69ef75fb26dd5e872506a7b20e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2592B70D-6080-4BD0-9FAA-E2FD4CC97C9D"},"incident_date":"2012-04-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"552e13353952","org_name":"Bruce G. Peller, DMD, PA","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.journalnow.com/news/local/article_66287b04-2f0b-5ec8-9ed2-3d850bdbb303.html"}],"summary":"Patient information that was held on a computer at Bruce Peller's dentist office was either stolen by Christopher Church or the information was sent from Peller to Church.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5f255c1ca745ead8fb20739fb2e29c7a3f65c20","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D266FB3B-78DD-42F9-B971-499E7F901339"},"incident_date":"2012-04-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"509b91d95aa3","org_name":"Oregon Health Authority","org_type":"government","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen documents expose 550 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c2e29ec97e04998351245fa7f197df3dbeb2db6","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Choice%20Individual%20Notification%20%28Master%29_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e4dfc2c27036","org_name":"Choice Hotels International","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23057"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-04-25","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b07a72cd3b6d6ef4cd77250461e5c434c5106f24","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"654D977D-3D6E-4273-8AC3-6E1F9F9C63E1"},"incident_date":"2012-04-25","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d10f4467902f","org_name":"Smartphone Experts","org_type":"retail_ecommerce","ransomware":null,"records_affected":4146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/smartphone-experts-notifies-customers-of-hack/"}],"summary":"Online retailer payment application breached and payment card information was compromised. Payment information was stored encrypted, but device compromise also provided ability to decrypt the stored information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-25","discovered_date":"2012-04-02","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04c2702f074a6ce0be6b3629ce377227d1fb0f6a","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RentACenter%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"2ff4e6f1accf","org_name":"Rent-A-Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23053"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RentACenter%20Notification%20Letter.pdf"}],"summary":"Computer equipment containing a store server with customer personal information was stolen from a Rent-A-Center store; the company reported no evidence that the information had been accessed or misused.","supporting_quote":"On April 1, 2012, various electronics were stolen from a Rent-A-Center store including the store’s inventory and the computer equipment used to run the store.","technology_involved":["store server"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"353a340707b25bdf7a5a82889a713c164df38f8b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5783DFB0-AF62-4A98-8AB8-B420C4730A2F"},"incident_date":"2012-04-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"913300296c44","org_name":"Wolf & Yun","org_type":"healthcare","ransomware":null,"records_affected":824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9907"}],"summary":"A laptop was stolen from the office that contained patient information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5813b986bbaccd57f0fa5d63f8a2aad9ec39765d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61F0CC85-8D49-444A-9133-F018311085A0"},"incident_date":"2012-04-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c4fe0919ade","org_name":"TLC DENTAL DANIA, LLC","org_type":"healthcare","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents exposes 750 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1491"],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-04-23","discovered_date":"2012-05-28","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30ad627ad33fd1a7117527e5c51213fb0c861fe3","impact_type":"both","incident_date":"2012-04-23","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/2008164.3_3.pdf"},"notes":"records_affected not found in source; cleared","org_country":"US","org_id":"8009d6e847c2","org_name":"American Pharmacists Association","org_type":"nonprofit","ransomware":null,"records_affected":81,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-32315"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/american-pharmacists-20120709.pdf"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-32315"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/2008164.3_3.pdf"}],"summary":"Unauthorized individuals accessed American Pharmacists Association computer servers, copied a file containing credit card information, and defaced the association’s website.","supporting_quote":null,"technology_involved":["APhA website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05b1de0008662f472b8dde1b7d05b5e5ba0f9430","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BF8F7C0-E751-4C27-926C-58EBEA3C3A2B"},"incident_date":"2012-04-24","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Patient A requested a copy of the access report for his record. Patient A indicated 13 names of employees who he believes did not have a need to know in regard to accessing his medical record. The report also indicates that Patient As wife, an employee, inappropriately accessed t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b69300d1257655e76e0c96471a0eab30c168503","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D94C5CDD-371C-43AF-B851-C2E0B13776E3"},"incident_date":"2012-04-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"acd379a0bdfe","org_name":"Oregon State Hospital","org_type":"healthcare","ransomware":null,"records_affected":618,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.statesmanjournal.com/article/20120425/NEWS/304250069/State-hospital-suffers-data-theft"}],"summary":"A theft of patient information from the car of Oregon State Hospital’s chief of psychiatry has breached the privacy of current and former patients.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71c3d637cdc6de161ec4d884e81efddfb865ad06","impact_type":"unknown","incident_date":"2012-04-03","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Letter%20to%20Affected%20Customers.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"e4fe99195d19","org_name":"Indie Research LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23040"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-20","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f0e2e7f2f37f8446c7a0d6f85bebe0859e81489","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2E20521-2E17-4CE6-9FF2-CEA6F08B19C2"},"incident_date":"2012-04-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b248ffd7c7fa","org_name":"f-1racers.net","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globalpost.com/dispatches/globalpost-blogs/the-grid/anonymous-formula-1-bahrain"}],"summary":"Formula-1 racing website defaced and DDoS'ed before race in Bahrain. Anonymous claimed responsibility and stated they are supporting the protests in Bahrain.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ffb794ba11e09f07b5c7ece12dd9e920dbd91aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE1A8552-9ED7-4E52-A5C3-7BA605E5382F"},"incident_date":"2012-04-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0509becc09eb","org_name":"Diagnostics For You","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/02/19/dutch_mp_ethical_hacking_fine/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Fwww.rechtspraak.nl%2FOrganisatie%2FRechtbanken%2FOost-Brabant%2FNieuws%2FDocuments%2Feindhovenaar%2520vonnis%2520anoniem.pdf"}],"summary":"A Dutch MP has been fined €750 (£650, $1,000) after he was convicted of illegally accessing the systems of a Dutch medical laboratory.  Henk Krol claims he only accessed the systems of Diagnostics for You in order to expose sloppy security practices. The MP, who is the leader of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-19","discovered_date":"2012-03-27","entry_asset":"email_account","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92a5c146d6407da8b14fcf1b5670c9a0289b85cc","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-03-23","initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Email%20Customer%20Letter%20final%20approved.pdf"},"notes":null,"org_country":"US","org_id":"4f004582e984","org_name":"Cigna Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A Cigna employee emailed an unencrypted customer document to her home email address and her son's email address in violation of company policy.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23029"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Email%20Customer%20Letter%20final%20approved.pdf"}],"summary":"A Cigna employee emailed an unencrypted document containing customers’ first names and Social Security numbers to personal and family email addresses.","supporting_quote":"On March 23, 2012, in violation of Cigna corporate policies, a Cigna employee emailed an unencrypted document containing Cigna Dental customers’ first names and social security numbers to her home email address and to the email address of her son.","technology_involved":["email account"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8787e88f633b272757fc2e399824755b99629f55","impact_type":"unknown","incident_date":"2012-02-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/English%20Letter.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"af2a8dfd43b3","org_name":"Kern Medical Center","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23021"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef16cbd8d6c4a24e8a6b1f49330d614bbb1aa60d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9BB450F-1EE4-40E2-836F-64D5D579E47A"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3886b5f03833","org_name":"William F. DeLuca Jr., MD","org_type":"healthcare","ransomware":null,"records_affected":577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"291197031aa54c4f58b255271c90c4778c759964","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EFB3FDC-9707-475F-9CEF-7CED055ED5ED"},"incident_date":"2012-04-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f743a90cce2","org_name":"Tufts Associated Health Maintenance Organization, Inc.","org_type":"financial","ransomware":null,"records_affected":3482,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad235978a0111b9181a52a5a2fc14b1590041a1e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D67C057B-E1CA-43C3-8956-B9CADF7422DA"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c56ee35c585c","org_name":"St. Joseph's Medical Center","org_type":"healthcare","ransomware":null,"records_affected":712,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22853"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51aaea180f1d11c2ecfb89351bf3ce00516efab5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFB1B8F3-841A-4C0C-AE02-CB9E5950A83B"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c341e9a0dea5","org_name":"Robley Rex VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f4b0cc36d09c77ccaafd802c2ed9e58611f67da","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F1D90E6-EEE3-4540-AD84-DE6FC612EFF4"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d112a9b6d18","org_name":"Jeremaih J. Twomey,FACP, PA","org_type":"healthcare","ransomware":null,"records_affected":2559,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9235d9d756e1486b81a85589ef156a941dfad286","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B6DADFB-B14B-40A7-B237-C7AB9ABD8C4F"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3837e73dc9ed","org_name":"Georgia Health Sciences University","org_type":"education","ransomware":null,"records_affected":513,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8ce26e795a1c490779559b0d4976eeebfb60b00","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B2C47DA-9CD0-4A5A-9D5C-5C2BA67178CF"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfeda976688d","org_name":"Baylor Heart and Vascular Center","org_type":"healthcare","ransomware":null,"records_affected":1972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f65b1de8eef5b32a6c4d2c4e48c418d743ca90a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBCF22D6-D6B0-4B82-BFC4-C648EAFBEB8B"},"incident_date":"2012-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab8b3247ea14","org_name":"Applegate Valley Family Medicine","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7ebce0b12f9f96cb23a8fc85d427010b27e4f50","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"912ADCC5-3F95-4FF2-9E20-9929D8EE4C8E"},"incident_date":"2012-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"429bccaf8331","org_name":"Alliant Health Plans, Inc.","org_type":"financial","ransomware":null,"records_affected":632,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2012-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30077babbd1e2e893d638ed4a3b52116cb98b2e0","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-04-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/SSFO%20Periop%20Missent%20Email%20Patient%20Notify%20Letter%20FINAL%20nonMedicare.pdf"},"notes":null,"org_country":"US","org_id":"71bac675ccb1","org_name":"Kaiser Permanente","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23010"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/SSFO%20Periop%20Missent%20Email%20Patient%20Notify%20Letter%20FINAL%20nonMedicare.pdf"}],"summary":"A Kaiser Permanente employee inadvertently emailed a report containing patient information to a non-Kaiser Permanente email address.","supporting_quote":null,"technology_involved":["email"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f1eb8ee1407f78b8473c080b3e4ee8ae1e0ce0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"627EF7AE-C448-4340-9005-C17D1A538D67"},"incident_date":"2012-04-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"7d321de451fd","org_name":"Government of Hong Kong","org_type":"education","ransomware":null,"records_affected":8260,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hk-school-websites-compromised-data-privacy/"}],"summary":"Following up on a media report in April, the office launched compliance checks on 12 secondary schools alleged to have leaked student data on their websites. The results confirmed that nine of the 12 schools had exposed personal information on their websites, affecting 2,115 stud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-04-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2618e0dc605893945b46c986d8cd997d4e31367e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D281852-BD13-48D1-9A49-E4DECFB88063"},"incident_date":"2012-04-15","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"415df2e97823","org_name":"Berrien County Sheriff's Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dev.dowagiacnews.com/2012/04/19/berrien-website-hacked/"},{"fetched_at":null,"title":null,"type":"press","url":"http://articles.wsbt.com/2012-04-18/website_31363825"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mlive.com/news/kalamazoo/index.ssf/2012/04/berrien_county_government_webs.html"}],"summary":"Berrien County Sheriff's Department hacked and defaced by Anonymous","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6755878aeae604d1a90ac87d639ae52d3fa01f24","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1241FEA7-1D28-41C4-A0F4-6DCCDD2EDEB4"},"incident_date":"2012-04-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f68126d3d93b","org_name":"Bimbo Bakeries","org_type":"manufacturing","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bimbo-bakeries-20120502.pdf"}],"summary":"Laptop stolen from employee car contained non-public personnel information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3012bb18925583c5fdb42837444e57771fa5f9f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98375463-B590-467D-9FC6-3D43B5575236"},"incident_date":"2012-04-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"acb8919f6b9a","org_name":"Virginia Military Institute","org_type":"education","ransomware":null,"records_affected":258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.roanoke.com/news/roanoke/wb/307564"}],"summary":"An email sent Thursday evening by the Virginia Military Institute administration to the president of the school's graduating class included something it should not have -- a spreadsheet revealing the grade point averages of every member of the school's senior class.  According to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a20f10c80f691c5f5d7eaf0a82a6debec0e2b3b0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2148BB32-FE35-4F56-B94B-343BDE076E91"},"incident_date":"2012-04-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a22b03e156d","org_name":"Under Armour","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/under-armour-20120424.pdf"}],"summary":"the breach of security involved the companies publishing firm, Price Waterhouse Coopers. A Price Waterhouse Coopers employee, in connection with a recent company audit, send an unencrypted thumb drive containing certain payroll information about the company employees by mail. Tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-04-12","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d8337f422b1173e689e4fdd059dc5d72820f95a","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-02-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Breach%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"a2f194cade92","org_name":"Perry Dental","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22992"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Breach%20Notification.pdf"}],"summary":"A burglary at Perry Dental resulted in computer equipment containing patient insurance information being stolen.","supporting_quote":"We are contacting you about a recent burglary in our office that may result in an identity theft problem.","technology_involved":["computer equipment"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e84d2419ed93691579c066a57ce89778410bc130","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7981A7DC-6186-4DD1-9769-F2C408E5D96F"},"incident_date":"2012-04-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbc2603a9733","org_name":"Desert AIDS Project","org_type":"healthcare","ransomware":null,"records_affected":4400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.desertaidsproject.org/notification/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23035"}],"summary":"A thief gained unauthorized access to the receptionist's office computer at Desert AIDS Project.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"020908a6bd74e3694bbda402ad52ba2b82b03d82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5C330C2-A1AC-477C-A795-F70CDB6B8BFF"},"incident_date":"2012-04-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f05b0651c0f","org_name":"Blue Cross and Blue Shield of North Carolina","org_type":"financial","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/in-bizarre-security-breach-blue-cross-sends-private-info-new-member-packets"}],"summary":"Organization accidentally mails PHI for 100 people to all their new members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-04-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1f9f4973abf3241c100a47b019de893d6007598","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D84A44A-731A-4F7E-8D1F-01DE1399B6ED"},"incident_date":"2012-04-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bed152f7987","org_name":"ThePartsBin.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Parts%20Bin%20Notice_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/thepartsbin-com-20120629.pdf,http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/thepartsbin-com-security-breach-notice-ltr-to-consumer.php"}],"summary":"Website security incident compromises customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-04-09","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a18796376f2c3673e6cfad5d8b1dad5da8153763","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4EF65150-7604-4BD6-9027-24722A761540"},"incident_date":"2012-04-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21437247a8db","org_name":"The Howland-Hughes Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/The%20CT%20Store%20Security%20Breach%20Notice%20to%20consumer.pdf"}],"summary":"external hack into shopping cart vulnerability, malware installed and collected payment/order/personal data for months.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdda96f97fbc5a9afef1af5c963857954001a1b2","impact_type":"unknown","incident_date":"2011-08-22","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Reuseit%20-%20Data%20Breach%20Notice%20-%20sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cfb0c2e24a1","org_name":"Pono Products, Inc. dba reuseit.com","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22954"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5d51bb9d6ef2dcd3382d09d6aed7df1309c4507","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F7D3752-E0A2-461C-9DD5-0AC4B089A853"},"incident_date":"2012-04-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3fbabba62d0f","org_name":"Procter & Gamble","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/procter-gamble-05152012.pdf"}],"summary":"Procter & Gamble recently became aware of a security incident involving certain personal information of some shareholders on Sunday, April 8, 2012, SunGard systems, the third-party provider of Proctor and Gamble's shareholder services account online access website, experienced a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8df198dd40519a65baf8ffec5cb315d0efcedb20","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"083D7CE4-053A-4A83-B6B6-D3327FB61754"},"incident_date":"2012-04-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb7c98ab9839","org_name":"Mid America Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/two-hipaa-breaches-involving-mid-america-health-that-flew-under-the-media-radar/"}],"summary":"The theft of a laptop resulted in the exposure of patient information.  Names, Social Security numbers, dates of birth, residential facility names, and digital oral x-ray images may have been exposed.  Specific details of the case are being withheld until the breach investigation","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-04-05","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"21f68fd5ffd6c83b93b3a703a0e0f3037f5cad8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"15DA6E1F-1B38-411A-B103-25FA72417D1B"},"incident_date":"2012-04-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"UZ","org_id":"270a5e796f31","org_name":"uzfiles.com","org_type":"technology_saas","ransomware":null,"records_affected":4130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/uzfiles-com/"}],"summary":"Unknown hackers dump on pastebin 4,130 records from uzfiles.com, an Uzbek music forum.  The records contain usernames, email addresses, and plain-text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-04-05","discovered_date":"2012-02-15","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24e2cf9e852a002f7ca6fb592758a2da282580c7","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/UBC2905_Letter_1_Fb.pdf"},"notes":null,"org_country":"US","org_id":"9e49e4465a35","org_name":"Union Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22924"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/UBC2905_Letter_1_Fb.pdf"}],"summary":"A former contractor retained proprietary Union Bank data containing customer information after leaving the bank.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fba1f82d93e8da143cc63b777bbf95fbff650ab5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"474D2C9C-CD7C-49EE-8684-5017A25DED49"},"incident_date":"2012-04-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"678beda89a36","org_name":"Massachusetts Registry of Motor Vehicles","org_type":"government","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.massdataprivacylaw.com/data-breach/"}],"summary":"Two masked men, operating a stolen jeep, pulled up next to a courier's white van that was parked outside a Massachusetts Registry of Motor Vehicles location, jumped out of the jeep and stole five bags from the courier's van.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d1a23ae7531d865ab2de44491ce82530bac894f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E4E46A3-927F-4C0D-BCCB-BE3240FC9D53"},"incident_date":"2012-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f6d454c9028","org_name":"Lake Granbury Medical Center","org_type":"healthcare","ransomware":null,"records_affected":502,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents/film results in the exposure of 502 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-04-03","discovered_date":"2012-03-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"62c8aebac7e21d8008b11bbc3acbda1b4ab61e92","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"insider","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISRR%2010051307%20-%20U%20S%20LETTER%20-%20BOOK.pdf"},"notes":null,"org_country":"US","org_id":"6741b392fb37","org_name":"State Farm Insurance Companies","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"A former employee allegedly used customer information inappropriately while employed.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22878"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISRR%2010051307%20-%20U%20S%20LETTER%20-%20BOOK.pdf"}],"summary":"A former State Farm agency employee allegedly misused customer information, which may have included names, addresses, credit card numbers, and Social Security numbers.","supporting_quote":"While employed, and contrary to the business practices of my office, the employee allegedly used customer information inappropriately.","technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17cf9127c2cc678158e9b0bf7869bd65fe0bcee1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EA94D98-1D4E-4D0A-ABE6-4E32C53D3A3C"},"incident_date":"2012-04-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf9f239aed04","org_name":"Morningstar Document Research","org_type":"technology_saas","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/business/technology/morningstar-reveals-data-breach-that-may-involve-some-clients-personal-details-credit-data/2013/07/05/920e5a9a-e5c3-11e2-bffd-37a36ddab820_story.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-us.com/view/33348/morningstar-provides-some-information-about-breach/#.UdxLu-0jYA4.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/morningstar-hacked.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Investment-Research-Firm-Morningstar-Notifies-Customers-of-Security-Breach-362049.shtml"}],"summary":"Client information may have been compromised by an intrusion that took place around April 3.  Client email addresses, passwords, credit card numbers, and other information may have been exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b0e072351524c88e79bdac6f110fa44e8e64150","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A18D6C6-5E04-418A-B47C-B9393A888ECF"},"incident_date":"2012-04-03","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5e4693e1860","org_name":"Baylor Law School","org_type":"education","ransomware":null,"records_affected":442,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abovethelaw.com/2012/04/baylor-law-screw-up-reveals-personal-data-of-entire-admitted-class-data-that-weve-got/"},{"fetched_at":null,"title":null,"type":"press","url":"http://sbmblog.typepad.com/sbm-blog/2012/08/httpwwwlawcomjspnljpubarticlenljjspid1202564381624baylors_accidental_doc_dump_provides_grist_for_bias_suitslreturn.html"}],"summary":"Employee accidentally attaches spreadsheet with non-public information to email being sent to students.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb44961f2467c382071cff50d643a882f119eb77","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"565ACD2F-8C78-4B11-B019-90F6DE1B060C"},"incident_date":"2012-04-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"850d272f01dc","org_name":"BullMarket.com","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Letter%20to%20Affected%20Customers.pdf"}],"summary":"Usernames, credit card information, email addresses, billing addresses, and/or logins were compromised between 4/3 and 4/7.  ESI was accessed by unapproved third parties.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69dbf05077238ad9f181ad0adb8fe11edd1cb394","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAAB8DA1-5712-417C-B922-0ACD08E235B5"},"incident_date":"2012-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a666edbbe8c","org_name":"University of Connecticut","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.courant.com/2013-10-29/news/hc-uconn-student-trustee-larceny-arrest-1030-20131029_1_schmitt-student-aid-insurance-fraud"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/university-of-connecticut-20120508.pdf"}],"summary":"A forensic analysis of Schmitt's access to the system revealed that he used an unauthorized password to transfer the $73,000 to the students before they were scheduled to receive the money.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d932f380d67b60c948361ddd87fb05569a956fd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C932A85B-7539-4514-9C14-44986C3344FD"},"incident_date":"2012-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"acb888199ef9","org_name":"Islington Council","org_type":"government","ransomware":null,"records_affected":51,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.islingtongazette.co.uk/news/ico_not_to_punish_islington_council_over_andover_estate_gang_leak_1_3254038"}],"summary":"ICO not to punish Islington Council over Andover Estate gang leak  An investigation by the Information Commissioners Office (ICO) concluded the town hall should not face a fine  despite releasing the details of residents to a gang of yobs they had complained about.  The council w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"EG","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79d48648bc3c310cb397679497ed6433c86f454b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A454AAB-50A5-4558-B1DA-1D7EDB4FA1A7"},"incident_date":"2012-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"8b1d7d6e119a","org_name":"Egyption Homeland Security","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://gulfnews.com/news/gulf/uae/courts/uae-muslim-brotherhood-trial-secret-data-stolen-from-flash-drive-1.1254300"}],"summary":"Classified information acquired from borrowed flash drive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8f3bd1b2ea29f0b255f34f86619cc1829648e3d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"466C5449-B126-441E-BC76-A0B2AF985C67"},"incident_date":"2012-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab16afa50277","org_name":"Claire's Stores","org_type":"retail_ecommerce","ransomware":null,"records_affected":582,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/claires-20120426.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CDsQFjAA&url=http%3A%2F%2Fwww.oag.state.md.us%2Fidtheft%2FBreach%2520Notices%2FITU%2520215616.pdf&ei=hdkiUerTFOvV0gHl8oGACg&usg=AFQjCNEONyI4lZslv76iJLasImpScUQhmA&bvm=bv.42553238,d.dmQ"}],"summary":"Lost CD at retail HQ location contained W-2 information on employees. New Hampshire and Maryland disclosures available as OSINT via their respective attorney general sites. 150 notifications in NH, 432 in MD","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab62b486545cb5d1e43955f51d939348a0c7f221","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B869831A-A4D3-45A5-9F4F-3767F47BE2AC"},"incident_date":"2012-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0211250e8e5","org_name":"California Department of Social Services","org_type":"government","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.latimes.com/2012/may/12/local/la-me-0513-homecare-workers-20120513"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/california-s-home-supportive-services-reports-data-breach"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23166"}],"summary":"Damaged package in postal mail arrives with missing data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"97067624e303050cc69d05b4fc53861a674225ea","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D22CAC1B-7571-49A2-92D6-40F50EC9C7D9"},"incident_date":"2012-04-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbd29e6eac7","org_name":"Bon Secours Mary Immaculate Hospital","org_type":"healthcare","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bonsecourshamptonroads.com/news-and-events-news-room.html?newsID=DFC45C92-9F5B-46BC-BB59-064AD5F92643"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/06/03/bon-secours-health-system-sends-breach-notification-letters/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailypress.com/health/dp-nws-electronic-records-breach-0530-20130530,0,2904197.story"}],"summary":"An audit of a patient's medical record uncovered unnecessary access by hospital employees. Further investigation showed this activity on other patient medical records. Nothing in article that states that the information was used maliciously, or provided to external actors. Will m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4aad51178cd430d4c0cf2364dbae2c4d2faee47","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4C7848E-5FE1-47F5-87F4-0EC9B8DEC617"},"incident_date":"2012-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e5e3a7a6033","org_name":"AccentCare Home Health of California, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"AccentCare Home Health of California, Inc.  reported 1,000, patients had PHI in a breach involving e-mail that occurred in April 2012. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19444fe424996be35eb3e94a1f46b1c30fa705d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7E38685-C92D-493D-88C3-51B1806A7FF9"},"incident_date":"2012-03-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0075f6709e3","org_name":"Oak River Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Sample%20Letter_2.pdf?"}],"summary":"An employee (now former employee) disclosed information about workers compensation claimants to certain individuals who were cooperating in an investigation of suppliers of medical services.  The disclosures occurred between 10/11 and 3/12.  The information disclosed related to w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-30","discovered_date":"2012-01-30","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3763617aff7d199781be125a358a08240337a4c0","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-06-28","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Template%20Member%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"2bf2914f4fba","org_name":"UnitedHealthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22860"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Template%20Member%20Letter.pdf"}],"summary":"UnitedHealthcare reported unauthorized access to a database containing members’ personal information between June 28 and December 12, 2011.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15db12acb9cdabe3c619c42a10acc417132a97fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41D7B101-214B-4187-ABB4-37D86268B65F"},"incident_date":"2012-03-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f423a1cf34ca","org_name":"Hogan Services Inc. Health Care Premium Plan","org_type":"financial","ransomware":null,"records_affected":1134,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach"}],"summary":"An email or emails with sensitive health information related to a health care premium plan was mistakenly emailed to or accessed by unauthorized people. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2012-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37c07e9bc7d20756d469b4af598f319e184d4ba2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41A07FC0-4890-45E2-9158-D49FBBA9B7AA"},"incident_date":"2012-03-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f1f5ba980b57","org_name":"Charlie Norwood VA Medical Center","org_type":"government","ransomware":null,"records_affected":824,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.alertboot.com/blog/blogs/endpoint_security/archive/2012/06/05/laptop-encryption-software-stolen-laptop-breaches-va-information-824-affected.aspx;"},{"fetched_at":null,"title":null,"type":"press","url":"http://chronicle.augusta.com/latest-news/2012-06-01/stolen-laptop-contained-veteran-information-va-says"}],"summary":"Physician's personal laptop was stolen that contains patient and medical providers' names. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2012-03-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cfce968eab2080f4e235060a33a6ad464e592c3","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Final%20SFSU%20HeadStart%20Breach%20Notification%20Letter%2003-15-12.pdf"},"notes":null,"org_country":"US","org_id":"c792903e11cf","org_name":"San Francisco Head Start","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22854"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Final%20SFSU%20HeadStart%20Breach%20Notification%20Letter%2003-15-12.pdf"}],"summary":"San Francisco Head Start reported that unauthorized people accessed personal information in its database between August and November 2011.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-29","discovered_date":null,"entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af1f9ab3f8f16a6a3d83ecaeef424c4114213d06","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-03-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/DCSSsecuritycustyltr_OAG.pdf"},"notes":null,"org_country":"US","org_id":"ee40832e682f","org_name":"California Department of Child Support Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22855"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/DCSSsecuritycustyltr_OAG.pdf"}],"summary":"The California Department of Child Support Services reported that storage devices containing personal information went missing while being transported by contracted service providers.","supporting_quote":"Upon arrival, several devices were missing.","technology_involved":["computer storage devices"],"third_party":{"archetype":null,"involved":true,"vendor":"IBM and Iron Mountain Inc."},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"525fc02e9671","name":"IBM and Iron Mountain Inc"}]}},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3db807343247b4bd6afb5358ce71ef2e95b74705","impact_type":"unknown","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/120328%20Notice%20of%20Disclosure%20-%20Redacted%20Sample.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"6695868b5f94","org_name":"Sacramento Area Fire Fighters, Local 522","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22848"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-03-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da7599e5f455e1f9c049522b138230a6b4d3ae1c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E5670BF-DCEB-47C2-89B5-DD386018389D"},"incident_date":"2012-03-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"da0d509750e3","org_name":"LEGO Australia","org_type":"retail_ecommerce","ransomware":null,"records_affected":1591,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/id/47621717/ns/technology_and_science-security/t/data-breach-topples-australian-lego-fans/#.UkWWjLx54kQ"}],"summary":"Website took credit card information but failed to use SSL. Unknown if any data was compromised.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ab6f2bbcaf83eb405ef8e2e6925293cfcbb6f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CA4C9BB-6731-4BAE-B0D6-DCEC6EBD00CC"},"incident_date":"2012-03-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cf460adbf237","org_name":"CSS Corp","org_type":"professional_services","ransomware":null,"records_affected":66,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/lulzsec-hacks-css-corp/11108"}],"summary":"Lulzsec dumps employee list of CSS Corp onto pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72663179835944e0637be1f40bf1ed2db0421d17","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C884436E-D856-4A19-A83A-B36FAE81938D"},"incident_date":"2012-03-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65ae14a83d4d","org_name":"Cisco Systems, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/cisco-20120409.pdf"}],"summary":"On March 28, 2012, Cisco Systems was informed that certain personal information of a limited number of current and former Cisco employee, as well as some parties associated with recent Cisco acquisitions may have been compromised.  A laptop belonging to one of our partners--Ernst","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2012-03-23","discovered_date":"2012-03-25","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ee0ab567aec229c305a2a4547f377a9e0cdd8ab","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-03-25","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20customer%20notification%20letter.pdf"},"notes":null,"org_country":"US","org_id":"f0b880353e9a","org_name":"Manhattan Prep","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/manhattan-prep-20120403.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22876"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20customer%20notification%20letter.pdf"}],"summary":"An unauthorized third party accessed Manhattan Prep's database, exposing customers' personal information, passwords, and credit card details.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fe81813598b63efc7a30b83ce1257bdcda4d419","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3DFB2FB-9EAE-4C28-8003-976519F5BCF4"},"incident_date":"2012-03-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2914beb1bb38","org_name":"Cigna","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Email%20Customer%20Letter%20final%20approved.pdf"}],"summary":"Employee sent non-public data in the clear over email to personal email address and one other email address","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"077ee280e91505754770f9debff07150a55d4620","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46AC09CF-01A2-43AE-9AFC-F6BB0FA20D3A"},"incident_date":"2012-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1ab5a8ec7a6","org_name":"Chicago Musculoskeletal Institute","org_type":"healthcare","ransomware":null,"records_affected":750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Compromise of a network server exposes 750 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd32b0864028a67f0b0490129c713c2b7f16b57e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B88F805-56DF-4607-BD82-F72E26AB744F"},"incident_date":"2012-03-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"777c59855231","org_name":"StandardAero","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/standardaero-20120403.pdf"}],"summary":"Stolen computer contained credit card numbers, names.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7acd9f56db42cf107888fa78accb2b147749289b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7D843B62-78B4-485F-A846-4F04D9211C1E"},"incident_date":"2012-03-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e35a546cfdb7","org_name":"Principal Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/principal-life-insurance-20120608.pdf"}],"summary":"Principal Life Insurance Company inadvertently provided contract owner information to a distribution partner for contracts sold by a different distribution partner.  This event occurred when the fulfilling a request for contract owner information from this distribution partner.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b02a90ce7a879120ee480afa88d025528ab05ec4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"067174D2-AA1F-4516-BED6-647C04802863"},"incident_date":"2012-03-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27d5dc56f6c2","org_name":"SIRIUS XM Radio Inc.","org_type":"technology_saas","ransomware":null,"records_affected":234,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sirius-xm-radio-20120406.pdf"}],"summary":"On March 19, 2012, the company's management was alerted to a situation involving one of its contractors, stream international global services Philippines Inc. Which handles inbound customer service calls for Sirius.  in the process of speaking with certain customers, employees ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1ab9cf87f6596e7077448daa27031d5ba1df6150","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1C95C02-0940-4382-894A-675AE6B660E9"},"incident_date":"2012-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f27f86398de0","org_name":"Metro Community Provider Network","org_type":"healthcare","ransomware":null,"records_affected":3200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a30576c93110aa8bde2a660cec4caef4e6a529a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06EB298D-2912-4980-B58C-07AC2ABD856F"},"incident_date":"2012-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39507bd10a24","org_name":"Medco Health Solutions, Inc.","org_type":"other","ransomware":null,"records_affected":1287,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d29f117503ca9b70a6821894187ac2b7f8e9afe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89DFA6E4-DB73-4D7C-8CAC-38BE7D667081"},"incident_date":"2012-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f37107a1a3f7","org_name":"Loma Linda University Health Care","org_type":"healthcare","ransomware":null,"records_affected":1366,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d75fa6aadd44f659425e9d2863ba837e729273c4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C546A3DC-4900-467D-B793-3D2412441A47"},"incident_date":"2012-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cf87a5064e1","org_name":"Lakeview Medical Center","org_type":"healthcare","ransomware":null,"records_affected":698,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"806dd83cfcf5defa06805faebd694a12d48e4f35","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"510331ED-7396-425F-9148-C6B61074043A"},"incident_date":"2012-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc681ad76d1","org_name":"Indiana Internal Medicine Consultants","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9037e19bb9916f43d495abcc7cad04c5408535ef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9BB0746-D615-41EE-ADC4-D8E8555918AD"},"incident_date":"2012-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfba4afd973b","org_name":"Goshen Health System, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54c5933ed534fa28f64e3ae999b21efbcddb3ef2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBD91D08-DE13-440E-8E3A-FF37ACA15F16"},"incident_date":"2012-03-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9457556c9fa","org_name":"Georgetown University Hospital","org_type":"healthcare","ransomware":null,"records_affected":1549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6904a21c82ab2611939c53f7c4ecbf2bfbd92bd6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9FB42D1-32CF-4438-9B1D-425367D52E21"},"incident_date":"2012-03-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e56edbf2f153","org_name":"CardioNet, Inc","org_type":"manufacturing","ransomware":null,"records_affected":728,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2a1d865d31d9643347f8e22f991bc8b14f7c475","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55130CAA-B623-4356-B20F-2B5B257A5587"},"incident_date":"2012-03-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7555c69e59cb","org_name":"Wayne County Department of Personnel/Human Resources","org_type":"government","ransomware":null,"records_affected":1229,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wxyz.com/dpp/news/region/wayne_county/wayne-county-sends-out-email-blast-containing-some-1300-names-and-social-security-numbers"}],"summary":"The personal information of more than 1000 Wayne County employees is compromised after an email mistake by the county's Department of Personnel/Human Resources.  A spreadsheet containing the data was mistakenly attached to an email about health insurance. The email went out on Fr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b727823850e6b3abfe0582a14623bd55faeb114e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D01C75FA-3A8F-4CBE-A255-5F3F367643DE"},"incident_date":"2012-03-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41ccf5db1983","org_name":"Our Lady of the Lake Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":17130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ololrmc.com/body.cfm?id=778&action=detail&ref=1915;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9440"}],"summary":"A laptop was discovered missing from an office at Our Lady of the Lake Regional Medical Center.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1b242776f34788e473deaa0edfc3585c8e7d56a","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-09-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"505d85b3913c","org_name":"Kaiser Foundation Health Plan","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22724"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Notification%20Letter.pdf"}],"summary":"Kaiser Foundation Health Plan reported that employee personal information was found on a second-hand external hard drive.","supporting_quote":null,"technology_involved":["external hard drive"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-03-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d57a12e097f93a0b70ec16aeb46e00ae33a1e35f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55051A8F-4AD4-4587-AE19-278B5E531763"},"incident_date":"2012-03-16","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BZ","org_id":"892895a70649","org_name":"Christian Teen Forums","org_type":"technology_saas","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ozdc.net/archives.php?aid=843"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/16/christian-teen-forums-hacked-and-accounts-leaked/"}],"summary":"Christian Teen Forums hacked via SQL injection.  Usernames and email addresses posted to pastebin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dbac1b0e40bc3138e3f8f28cea296aef416c09e6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEF57702-6A12-4DDB-87E1-A3861B04E885"},"incident_date":"2012-03-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebcaa95cf466","org_name":"Tiffany & Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/tiffany-20120321.pdf"}],"summary":"around March 15, 2012, UPS working on behalf of the company misdirected a package containing a customer's credit card application (including social security number) to the address of an unaffiliated business – drugstore.com. The air was immediately realized and the package along ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":["CVE-2012-0507"],"data_types":["personal"],"disclosed_date":"2012-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23faf7ddb8a0afb908a37a70944a06862dbf59bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3254E069-25CF-4DE7-AE4D-B9533773150F"},"incident_date":"2012-03-15","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c683b7df3469","org_name":"Apple Inc.","org_type":"manufacturing","ransomware":null,"records_affected":12367232,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57505330-83/antisec-claims-to-have-snatched-12m-apple-device-ids-from-fbi/"}],"summary":"During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the sh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"kev":[{"cve":"CVE-2012-0507","kev_added":"2022-03-03","name":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","days_listed_before_incident":-3640,"product":"Oracle Java SE"}]}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d581b1342dba52570ef29fab05d8bf16395d173e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4500FF0-1267-42ED-8F45-2CF6D9DF73A5"},"incident_date":"2012-03-14","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"403234afb77d","org_name":"Crowne Plaza Columbus","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"PII and credit card information exposed at hotel ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd051cfbee90bfb83f06a62f6694094e01e37ff5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8DD9BC0-D99B-40D6-BDD4-10CC223572D0"},"incident_date":"2012-03-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3afde59d740f","org_name":"Depository Trust & Clearing Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/depository-trust-20120702.pdf"}],"summary":"Personal information about staff members was placed on an internal system accessible to all staff.   There was insufficient logging to determine if anyone accessed the data.  Information included employee name, SSN, direct deposit bank account numbers, administrative information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eafe1025b41bfc85c782a3e9c240318f7581ff6b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"352C5EC1-0508-41D5-AE58-AF053F38C47C"},"incident_date":"2012-03-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a17c6b7a1ec","org_name":"Bringham Young University","org_type":"education","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.heraldextra.com/news/local/education/college/byu-students-information-released-accidentally/article_b7e5695d-6f00-54a8-8c3c-e7bca51b99fe.html"}],"summary":"Email sent to students accidentally contains non-public data for all recipients of the message.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8baa504afe085b62a5ad057ceb4e9eaa408f954","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"798C5C99-1E91-4CEF-8878-DCE264EE4484"},"incident_date":"2012-03-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21517348bb1b","org_name":"Columbia University","org_type":"education","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/columbia-university-20120423.pdf"}],"summary":"File was exposed on internet facing server and eventually indexed by Google.  It contained 3500 current and former employees and sole proprietor contractor's names, addresses, bank account numbers, SSNs.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9a6d623328c169cc7269b75fc418c1cca4a4e03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E70CD6F5-6D7F-420E-BFDE-D867E587F95F"},"incident_date":"2012-03-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"294707a62037","org_name":"New York Ironworks","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/09/anonymous-hack-police-equipment-supplier-new-york-iron-works-for-fff/"}],"summary":"The hacker group Anonymous has hacked into newyorkironworks.com, a police equipment store.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a9f5d07fb18bfe6bf7672860c0f477a8f63239a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE5D8CDE-D8B8-46CE-9FD4-2A462D60C71C"},"incident_date":"2012-03-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f0ad525b8ed","org_name":"Symantec Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.crn.com/news/security/232301452/symantec-confirms-anonymous-took-product-source-code.htm"}],"summary":"Anonymous acquires old source code for anti-virus software via unknown methods from 3rd party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"35ce2e99c5f890971a7f7438e5604bc11771b7d3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CA4AFCBD-7E98-42BB-BC41-6900222072E5"},"incident_date":"2012-03-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"65884936607c","org_name":"Jala","org_type":"transportation_logistics","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/jala-transport-limited-monetary-penalty-notice.pdf"}],"summary":"Briefcase stolen from car at intersection contained cash and unencrypted hard drive.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f42d740e858e0871c217729b2e6a16a8c5c214fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D53164B6-B45C-4C41-80E9-D744F978B3CA"},"incident_date":"2012-03-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a190bd4555e","org_name":"Baptist Health System","org_type":"healthcare","ransomware":null,"records_affected":1655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Baptist Health System in Alabama reported that 1,655 had PHI on paper records disposed of improperly on March 8, 2012.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-03-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b72949a62aab16a2e851586885ddfe916762d546","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"716C6ECC-CA3E-4E26-AACB-94459F86AF83"},"incident_date":"2012-03-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A Veteran's VA Provider contacted the facility Privacy Officer to discuss the Veteran's desire to revoke authorization he had signed allowing his mother and father from communicating with his providers about his treatment. The Veteran will be submitting a written request to revok","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-03-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fab9fe8552b793cfe34dcaeb89f8ef90c386713","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1367FF69-67EB-4860-937E-EA0F338A4E68"},"incident_date":"2012-03-06","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ES","org_id":"aafda9c04aa4","org_name":"Panda Security","org_type":"technology_saas","ransomware":null,"records_affected":35,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/hackers/panda-security-hacked-lulzsec-is-your-website-safe.html"}],"summary":"Late Tuesday night, at least 35 public facing websites belonging to Panda Security were hacked and defaced by the LulzSec and Anonymous hacking groups.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-03-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9656339207521f13003e83c6688bd2e887a34d36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65522236-D8D9-4C7B-BA3C-26F7F5D69085"},"incident_date":"2012-03-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"4389c2b60458","org_name":"Belfast City Council","org_type":"government","ransomware":null,"records_affected":51,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.u.tv/news/Council-seeks-to-prevent-future-leaks/4eb4add3-0374-468a-b69b-0c544b0e64a7"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.u.tv/news/Council-probes-security-breach/eabc740e-2763-484d-a577-c76bbbaf59cb"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.belfasttelegraph.co.uk/news/local-national/northern-ireland/data-leak-fiasco-deepens-recipient-of-councillors-details-defiant-as-injunction-granted-28722985.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.belfasttelegraph.co.uk/news/local-national/northern-ireland/belfast-city-councillors-bank-details-disclosed-in-data-foulup-28722552.html"}],"summary":"Employee accidentally releases non-public data to a private citizen.  That citizen then published the non-public information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0159c105fdffc8ce3ec6e1aa94d11d7735281d30","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0466974-84FB-45D8-B0C1-BF924DCBE68D"},"incident_date":"2012-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"adbf8a904135","org_name":"Stephen Haggard, DPM Podiatry","org_type":"healthcare","ransomware":null,"records_affected":1597,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"The network server was stolen containing patient information from Dr. Stephen Haggard's office.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-03-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"694bdcd1d107462c4877fa4513c18c5f187cb74b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95B8C160-47EC-4415-8504-A3F8D13ED9AC"},"incident_date":"2012-03-03","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae4a6210f801","org_name":"Linode","org_type":"technology_saas","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/More-Than-13-000-Bitcoins-Stolen-in-Linode-Hack-256467.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://status.linode.com/2012/03/manager-security-incident.html"}],"summary":"Linode, a company that provides virtualization hosting to companies worldwide, was breached recently by an unknown hacker who managed to gain access to a number of 8 accounts which referenced Bitcoin, stealing all the digital currency he could find.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e3c838b8ba24e1de0ff42547b0c784ec5e8ca2e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7C5AB83-C904-4274-A781-92F03E02AAE2"},"incident_date":"2012-03-03","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"FR","org_id":"45f578872d08","org_name":"cifi.fr","org_type":"other","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/raw.php?i=UQJQNRP8"},{"fetched_at":null,"title":null,"type":"press","url":"http://ozdc.net/archives.php?aid=1034"}],"summary":"hackers breach site and post data on Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-03-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1799dfe619f2b5dee1a1edb4aecee0c83896b7c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B7C03E5B-9251-4976-AFA9-B9D061E874C8"},"incident_date":"2012-03-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PA","org_id":"a2e128e75b16","org_name":"cine.com.pa","org_type":"technology_saas","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/04/panama-film-website-hacked-and-accounts-dumped-for-acta/"},{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/cine-com-pa/"}],"summary":"1200 Usernames and passwords dumped after web site breach.  Purported to be part of #OpMarzoNegro.  No specific hacking details provided in OSINT. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f4cc47c3ca16844d035492f75544f1bae15ce36","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B56A96FF-2814-4E9F-8ACC-D7E7E659B10F"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2057f52f928","org_name":"Veracity Payment Solutions, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19ea60b24bff179f960ae6c0262f3a20aac4701a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB7D8E08-C2D6-4FAE-888B-F66B0C1B1E62"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e932719285c5","org_name":"USAA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cde564af968ef058f996fee20abda2e94d4242aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2cbf1240-148b-11e9-9b0e-db2459a65ffe"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2cd3c53f546","org_name":"Transitional Development and Training","org_type":"healthcare","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://ridgefield.dailyvoice.com/news/woman-faces-25m-restitution-after-admitting-role-in-fraud-scheme/745741/"}],"summary":"“The investigation further revealed that, in March 2012, Nikkita Chesney, who was employed by a health care provider that provided substance abuse treatment, including a detoxification program in Bridgeport, began to steal the personal identification information of Medicaid clien","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4b39c1b5c086be08436278cf411282298b9deeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"648DC21D-7296-4A53-95BC-66F8C8B377A6"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9266ad9ff4b9","org_name":"Thunder Burger and Bar","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://dcist.com/2013/10/georgetown_waiter_used_stolen_credi.php"}],"summary":"A 48-year-old Maryland man who worked as a waiter in Georgetown was sentenced to 38 months in prison today for stealing credit card information and using it to buy fancy pieces of art and jewelry.  Kerry T. Washington, a former employee of Thunder Burger and Bar, pleaded guilty i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a64831d26486289d4b948e78639631e7fb10e7b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0442278A-925C-4C6B-913C-324E11BFB454"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d7ca0660bf9","org_name":"Teachers Insurance and Annuity Association - College Retirement Equities Fund","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1f80b689da84e95b57402eb1456a5651ef7fb7d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"901ED6A6-5952-442B-BBF9-0FDF82B5DEC6"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"65e377b5989c","org_name":"TD Ameritrade Holding Corp","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7881246c0d40ac4f719f4bba2470f02551e8d80f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43BCD096-E27F-48AA-A3E2-83FB710236D6"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7e2d41c1bb","org_name":"Tampa General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/courts/criminal/haley-tampa-general-hospital-employees-accused-of-selling-patient-ids/2129886"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/07/08/tampa-general-hospital-deals-with-patient-identity-fraud/"}],"summary":"Employee accesses patient billing data for tax fraud purposes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd7eb36ef40a329bec773e9947cb7b30578754ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4947CF6D-9486-4B44-A1CA-364343FA8907"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7029a239e0ee","org_name":"Penn Station","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/interviews/breached-retailer-i-wish-i-had-known-how-sophisticated-i-2833?rf=2015-08-18-edbt&mkt_tok=3RkMMJWWfF9wsRolsqvLZKXonjHpfsX57uQoUaSg38431UFwdcjKPmjr1YYBRMR0aPyQAgobGp5I5FEIT7HYRrhpt6cOXA%3D%3D;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/penn-station-card-breach-grows-a-4862"}],"summary":"Restaurant chain Penn Station Inc. has upped the number of franchise locations affected by a payments breach to 80, almost double what it originally reported.  See Also: Rethinking Endpoint Security  The breach, which Penn Station says it's still investigating, is connected to a ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"446b410eb491020e888ed0374adf714176887688","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F7333DE1-FA59-4D42-B95E-98F752CFC3D2"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e452a5d67b7","org_name":"PayPal, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2afdc1a3c831d3dca43a625a5b7785857a27917","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19382A61-B1FC-476B-B367-17BE46889CA3"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa8d9dd03ba4","org_name":"Ohio State Board of Pharmacy","org_type":"government","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/oh-solon-dentist-charged-with-illegal-use-of-state-database/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ohio-dentist-pleads-guilty-to-misuse-of-states-prescription-monitoring-system/"}],"summary":"A Solon dentist was indicted by a Cuyahoga County grand jury earlier this month for looking up personal information on an ex-girlfriend using the Ohio State Board of Pharmacy database. Between March 10 and Dec. 26, 2012, Dr. Fred Glick, 55, of Russell, used the computer network t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RU","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c50b1ca33a1e4b9f80bbed58ddf44041695c6714","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC57BA6E-0F9C-4716-9233-27B73E0D482D"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"2238161dfa27","org_name":"North Atlantic Treaty Organization","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.rawstory.com/rs/2013/11/19/nato-tech-expert-gets-seven-year-jail-sentence-for-data-theft/;http://en.ria.ru/military_news/20120813/175181664.html"}],"summary":"NATO IT Administrator copies sensitive information about computer security and hides it in his basement with plans to sell to a foreign power.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"defc513792026a2e42925511ed3d2cd202d26705","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D85BCF4C-6282-4014-917C-FE22666EC222"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1aa967c7371","org_name":"Nordstrom Federal Savings Banks","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f87c2f7fa097cfe6520f3e2c788ed44cdb7d0a3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1659E13A-26FC-4B72-BB40-9CAD8D7F9348"},"incident_date":"2012-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ae8a17807a0","org_name":"Kennedy Space Center (NASA)","org_type":"government","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2012/11/15/nasa-data-breach-stolen-laptop/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://epic.org/2012/11/nasa-suffers-more-data-breache.html"}],"summary":"In March 2011, algorithms used to command and control the International Space Station were exposed. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69ec73ec54651a413f4d7637ad8933792cf65a20","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC4E2CCE-4666-4E09-AA5F-604B22DEFC49"},"incident_date":"2012-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"2e779bfaead2","org_name":"Ireland 65th Battalion, Reserve Defence Forces","org_type":"government","ransomware":null,"records_affected":70,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.herald.ie/news/military-names-on-stolen-laptop-28003790.html"}],"summary":"A MILITARY laptop containing the personal details of hundreds of reserve defense force (RDF) members has been stolen.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3a7e87760fcdf3bf6b89b43c8747e2645a8c1c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB9377E2-B69D-4FED-BFA0-FD53D9D08E9B"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4415e1f8ee0","org_name":"iPayment, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51ebfd5dd178b44d3e0c8b1ba3e29d6ccd78235c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8546DB0B-AD10-4638-88CB-F04E19D29E15"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14524e0d0491","org_name":"Florida Department of Juvenile Justice","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/courts/criminal/haley-tampa-general-hospital-employees-accused-of-selling-patient-ids/2129886"}],"summary":"Florida man steals identities from juvenile records and uses them for tax fraud purposes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40a221be414431ffd9fd60709b14535d6f3f6d72","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76C4481D-2C65-4F8B-87B8-D44B1A8795A2"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/experian-20120517.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/arizona-central-cu-experian-20120608.pdf"}],"summary":"Unauthorized parties may have obtained online consumer credit report disclosures from Experian.  This is typically through the credentials of one of its customers.  This letter does not specifically name the customer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"240a1ba31ccac51b911989a3846adea5058231b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"743FC054-B74A-4813-A626-8F20BD249518"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"068e28e3e93f","org_name":"Electronic Payments Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7894001097a310122fe8b0647320b42ceed560b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0185D70F-AFC9-4354-8C66-0AC8DBD16D28"},"incident_date":"2012-03-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"81ed0b8e6d58","org_name":"Eastern Buffet","org_type":"other","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://waukee.patch.com/articles/west-des-moines-restaurateur-tracks-down-the-culprits-in-credit-card-fraud-cases"},{"fetched_at":null,"title":null,"type":"press","url":"http://westdesmoines.patch.com/articles/west-des-moines-police-find-link-in-spate-of-credit-card-fraud-cases"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.yelp.com/biz/eastern-hibachi-and-sushi-west-des-moines"}],"summary":"2 employees at restaurant used fake identities to secure jobs for the purpose of skimming customer credit cards. At least 30 cards were used to make fraudulent charges.  Business suffered significant reduction in business post-breach and was forced to close. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3775c6f4e3e6622eed97a59847b03e524ee17fc0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8621A54D-D7CA-4CE5-BDD6-6C21E3FD2F1F"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16db2d17f755","org_name":"E-Trade","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f1d106fe1ba410a7197a46b315bfeb6a5a7ad53b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2BA94FC1-E4C3-41AF-B4AE-6060BDAD9579"},"incident_date":"2012-03-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a72be73caac4","org_name":"Defense Finance and Accounting Service","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a4cd90a0d4a9003dac9657126a0499eb86ddbef","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BE7E4D9-6E05-4906-B726-36B4C09063F5"},"incident_date":"2012-03-08","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"29b1e159d575","org_name":"British Pregnancy Advisory Service","org_type":"nonprofit","ransomware":null,"records_affected":9900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/enforcement/%7E/media/documents/library/Data_Protection/Notices/british-pregnancy-advice-service-monetary-penalty-notice.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/health-26479985"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2012/03/09/british-pregnancy-advisory-service-hack_n_1334570.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/news/uknews/crime/9132654/BPAS-Hacker-held-over-illegal-breach-of-abortion-website.html"}],"summary":"Attacker utilized an attack CMS vulnerability in the website of UK abortion service to get names and phone numbers of those who called in to obtain information about services. The perpetrator planned to publish the names and numbers but was arrested prior to doing so.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b546b71306ec1699498f1c7e4a0e71adc12ae14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAD82681-F13F-4770-862D-5BAFC8E9296B"},"incident_date":"2012-03-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f9ae3a5d7355","org_name":"Bank of Nova Scotia","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thechronicleherald.ca/novascotia/1336220-alleged-scotiabank-privacy-breach-leads-to-proposed-class-action;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/alleged-scotiabank-privacy-breach-leads-to-class-action/"}],"summary":" bank employee accessed and disseminated her personal information,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fc2db9dd1faf7480c56cb937db74977a34d6216","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BA8500B-E6B3-48A0-88EC-8F3061ACFBC2"},"incident_date":"2012-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ccd79bdbf90","org_name":"Austin Rare Coins","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/austin-rare-coins-20120720.pdf"}],"summary":"A security breach they were notified of in March, 2012 intiially indicated that there was no personal data taken.  In May 2012, they were notified that in fact, some customer's credit card data was compromised.  The data affected is name, credit card information, phone and home a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-02-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d5a1927cb879fa95fa9321261ddaa24cebd924d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E1662D0-94C5-403A-8A62-673C99CE441B"},"incident_date":"2012-02-29","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"1b1ae8dd5629","org_name":"Epson","org_type":"manufacturing","ransomware":null,"records_affected":67,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/04/electronics-giant-epson-hacked-and-data-leaked-by-anonymous-hacker-anonyintra/"}],"summary":"Epson hacked by Anonymous, posted on pastebin.  Leak contains basic table information. usernames and clear text passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"223742dc7cd2c95a04665625b2013252a44e55c2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3409F9D5-44C1-4CE1-A975-EE9090B91590"},"incident_date":"2012-02-28","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"4678a3979fa8","org_name":"Kalmar Airport","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Sweden-s-Kalmar-Airport-Hacked-by-Sepo-255578.shtml"}],"summary":"After identifying an SQL injection vulnerability in the site (kalmarairport.com), the hacker gained unauthorized access, but didn’t cause any damage. He simply published some information from their server to prove that he gained access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42d014fe16cf746f3783f95a7e8f5ca91435a271","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C971C4BD-218E-4347-B5F3-B04BD4B9DC94"},"incident_date":"2012-02-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c19f7f24bb4b","org_name":"Fidelity Investments","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/fidelity-20120320.pdf"}],"summary":"Company provided incorrect fax number to customer resulting in customer sending fax containing PII to incorrect number.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"28be19775d983248c7b642e18709b8097ad9b85a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"816112D5-1A59-4AD4-9C1C-74B754F21CCB"},"incident_date":"2012-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b793ead69b2","org_name":"University of Miami","org_type":"education","ransomware":null,"records_affected":1219,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d5d58403bc17ade3b9477379edb4b6ee4376806","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFDB9F40-23FA-46B3-924E-49EF492E68E0"},"incident_date":"2012-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e16388676a5b","org_name":"Triumph LLC","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bca5b0793f232dd92d8aeb81a1da737564cb7d9a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0432CDE-1FE7-41A8-B7C2-564AEAAB25E7"},"incident_date":"2012-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"09d544fc87df","org_name":"PBH","org_type":"healthcare","ransomware":null,"records_affected":50000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e730cb359887daf5d5e80fcae4b7c7029d175b39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FA5B4DE-8718-4995-846A-44CE0A582587"},"incident_date":"2012-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4621fd837a4b","org_name":"Ontario Association of Chiefs of Police","org_type":"nonprofit","ransomware":null,"records_affected":8,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23426"}],"summary":"Ontario Association of Chiefs of Police's website suffers cyber attack by Anonymous or its affiliates.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b1a8348a1a2833456accd24b1ed00501ab3c1d5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64D210B5-1744-48CF-82E4-7FE711133C6E"},"incident_date":"2012-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7b71de6b2cf","org_name":"Oldendorf Medical Services","org_type":"healthcare","ransomware":null,"records_affected":549,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ccbc162c619f875046c2e48173c21ed7ce36bc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52CEC1DF-2509-4453-9242-8BC62665F15B"},"incident_date":"2012-02-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c20e62e35bf","org_name":"Flex Physical Therapy","org_type":"healthcare","ransomware":null,"records_affected":3100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cc136953d36ceff672169481b9a92e3b9f9d1c2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85DAFE0F-EA0D-4F5B-84E6-9930A3E7797F"},"incident_date":"2012-02-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4509972b5b01","org_name":"Department of Medical Assistance Services","org_type":"government","ransomware":null,"records_affected":1444,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1010a0ae4930c5747be2756446d4649868325330","impact_type":"unknown","imported_from":null,"incident_date":"2011-11-26","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ISN-AON-Proof21_Redacted.pdf"},"notes":null,"org_country":"US","org_id":"12453631a502","org_name":"Trident University International","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22468"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ISN-AON-Proof21_Redacted.pdf"}],"summary":"Trident University International reported an unidentified person’s attempt to gain access to student account login information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0414856501a80f0b45985fedeb840674828722f0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93BA2A29-8D3E-4EDC-8190-9AF60193C14B"},"incident_date":"2012-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f785ca1b1aab","org_name":"La Nueva Casa de Amigos Eye Clinic (University of Houston College of Optometry)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.opt.uh.edu/news/casa-english.cfm;%C2%A0http://www.opt.uh.edu/news/news.cfm?title=Important%20Alert%20for%20La%20Nueva%20Casa%20de%20Amigos%20Eye%20Clinic%20Patients&id=1043"}],"summary":"on February 22, 2012, the database computer located at La Nueva Casa de Amigos Eye Clinic was compromised by an unauthorized individual/entity originating from outside the United States.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","medical"],"disclosed_date":"2012-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"806592c0616f3f08c800491a45f3518e477fecd1","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-10-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/RJL%20NotificationLetter%20Basic%201.pdf"},"notes":null,"org_country":"US","org_id":"7bbb03c33165","org_name":"RJL Insurance Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22449"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/RJL%20NotificationLetter%20Basic%201.pdf"}],"summary":"RJL Insurance Services reported that unauthorized electronic access compromised one of its servers, making some files accessible for about two weeks and potentially exposing personal information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-02-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c27dffe2e0d0c8297cb411b7e0e014c0ee445cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C686D43A-EE1B-4C67-A73A-7BDFFE1DA9A5"},"incident_date":"2012-02-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"400b7926166f","org_name":"Los Angeles County Police Canine Association","org_type":"government","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-27080_3-57381992-245/hackers-nip-at-la-police-canine-group/"}],"summary":"Group claims to have found objectionable photos of children in officer's e-mails after breaking into police Web site and stealing passwords and other data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3809ab59cc659aa9b6f3e67909f610012b22af73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9F2BD1EA-BA33-4A86-83DC-8E1FDA613F69"},"incident_date":"2012-02-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a8a0ffeae0e","org_name":"Dartmouth College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/dartmouth-20120314.pdf"}],"summary":"Laptop w/ PII stolen from vehicle.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7815cc297b8a8fd0f5b3e75683682ab9bf4bdcb1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7ED50E9-6809-4998-9C0A-B4014745ECD1"},"incident_date":"2012-02-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"035f38566e55","org_name":"Active Community Team","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charitypeople.co.uk/news-Charity_jobs_at_risk_following_laptop_theft-801301617.aspx"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisisscunthorpe.co.uk/Jobs-risk-thieves-steal-Scunthorpe-charity-shop-s/story-15295921-detail/story.html#axzz2LDwW5ZbU"}],"summary":"Stolen laptop contained the only copies of critical data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"DayKalif","variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-02-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae16b66d9a1c0f88af0172e202c6f7a9d9abfc4f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C24E5307-0772-45A5-B73C-A7DF5F946841"},"incident_date":"2012-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RU","org_id":"819d6fbd7aea","org_name":"Rambler","org_type":"technology_saas","ransomware":null,"records_affected":98167935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/major-leak-100-million-passwords-russias-yahoo-surfaces-online-1579900#"}],"summary":"100 million usernames and passwords from a Russian internet giant called Rambler have surfaced online in the latest in a long line of hacks that first occurred back in 2012","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"daykalif"}},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"413ac4d69a6ca78b0f09fd45ffed2304b7b17fcf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"177D96C9-5764-4607-BF14-A453E7E6C936"},"incident_date":"2012-02-17","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"05d25013d848","org_name":"City of Springfield Missouri (springfieldmo.gov)","org_type":"other","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-leader.com/article/20130917/NEWS01/309170081/hacker-John-Anthony-Borell-III-springfield-missouri;"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2013/06/hacker-who-led-anonymous-sponsored-hacks-against-police-agrees-to-plea-deal/"}],"summary":"Anonymous-linked hacker used SQLi to compromise City of Springfield website and posted PII on over 2000 residents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afc5a047fdf655ba49d6f76df65f05e2887df459","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F742634-0C6E-4D26-863E-64DB124EEAC1"},"incident_date":"2012-02-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c70e2d15e677","org_name":"City of Springfield Missouri","org_type":"government","ransomware":null,"records_affected":2100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-leader.com/article/20120228/NEWS06/302280028/springfield-city-website-hacked-data-break-citizens-identity-protection?odyssey=mod|newswell|text|Special%20Reports|s&nclick_check=1"}],"summary":"Springfield officials say the personal information of about 2,100 citizens may have been obtained by hackers when the city’s website was “compromised” Feb. 17, a Friday.  Some functions have been turned off on the city’s website, springfieldmo.gov, as authorities investigate the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d992076913c6ee3f505ee58fb940dbd1b0135b18","impact_type":"unknown","incident_date":"2012-02-10","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/02162012.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"4a9bab940200","org_name":"DHI Mortgage Company, Ltd., LP","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22431"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0267f993804c8bc7c17d32620c881b92f80c077","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6453319-6ABC-4594-B33C-4CB62AB1115E"},"incident_date":"2012-02-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a98e5590f7b6","org_name":"TransUnion","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/transunion-20120312.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/54879"}],"summary":"The company has determined that your personal information (address, Social Security number and other details contained in your credit report) was accessed by an  unidentified person between January 22 and February 15, 2012 without proper authorization. The unauthorized access to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b2b93dd13ecc61ef5886f785f57dd0269c6a697","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C92D7C34-B29E-4527-A869-88BD40B359FE"},"incident_date":"2012-02-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e09964e613ad","org_name":"Hostgator","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2013/04/former-employee-arrested-charged-with-rooting-2700-hostgator-servers/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/04/21/hostgator-hacked-suspect-rooted-with-own-rootkit/"}],"summary":"An employee was found to have installed backdoors on more than 2,700 company servers.  The issue was discovered the day after the dishonest employee was dismissed.  He worked for Hostgator from September 2011 to February 15, 2012. The dishonest employee was arrested and charged w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-02-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa6859ad05adbd52d059aaf020fe31a82d10d3c5","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-02-14","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Opening%20Ceremony%20-%20Notice%20re%20Security%20Breach%20to%20Customer.pdf"},"notes":null,"org_country":"US","org_id":"5dea3c449d67","org_name":"Opening Ceremony Online LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-22861;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Opening%20Ceremony%20-%20Notice%20re%20Security%20Breach%20to%20Customer.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22861"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Opening%20Ceremony%20-%20Notice%20re%20Security%20Breach%20to%20Customer.pdf"}],"summary":"Opening Ceremony said personal and credit card information entered on its website during a stated period may have been acquired by an unauthorized person.","supporting_quote":null,"technology_involved":["website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7e3b0b68ea489223e88b790bd10aacf4cdcdfdb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"354179A9-C59D-4752-8D94-E42CF1F3433B"},"incident_date":"2012-02-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f02299f45d91","org_name":"Hagerty Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/hagerty-insurance-20120221.pdf"}],"summary":"A recent change to the website (www.hagerty.com) may have unintentionally permitted temporary read-only access to a limited number of consumer's personal information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-02-14","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b60082896f93c799410d0f5b01a6247eaa30e23","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00EC558C-0CB9-4574-9187-9A483335EF84"},"incident_date":"2012-02-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdeac4c53c4c","org_name":"Combined Systems","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.examiner.com/article/anonymous-strikes-war-profiteering-tear-gas-manufacturer-combined-systems"}],"summary":"Anonymous compromises web server and replaces w/ propaganda video.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b66fcc1464b44019129a691acc4df6f8355895e9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"311179EA-D06F-4AC8-B9E7-7E5FE7B2A2D5"},"incident_date":"2012-02-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec06326d626c","org_name":"Case Western Reserve University","org_type":"education","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/metro/index.ssf/2012/04/case_western_reserve_notifies.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.attevo.com/blog/600-alumni-of-case-western-reserve-university-involved-in-data-b/"}],"summary":"Stolen laptop results in potentially exposed PII for 600 former students","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f138586cc4c003fba95b4ce5bf708976de19b407","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0EFD0FCC-7C3A-4D66-8F60-71579BEE5757"},"incident_date":"2012-02-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d611280e85b","org_name":"Jamaica Hospital Medical Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ny-jamaica-hospital-medical-center-employees-charged-with-illegally-accessing-patient-information-that-they-provided-to-lawyers-and-medical-mills/"}],"summary":"Two employees who registered patients into emergency room at hospital provided their information to ambulance-chasing lawyers and others.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"480d3ad59eb8b73464082a3b1c5ba04de970bc35","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CF35E9F-0838-4A9F-8CE6-A33817CDB149"},"incident_date":"2012-02-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"2e1c8ba820fa","org_name":"MacForBeginners","org_type":"professional_services","ransomware":null,"records_affected":714,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/tag/b4lc4nh4ck/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/09/macforbeginners-com-hacked-and-data-leaked-by-xdev-b4lc4nh4ck/"}],"summary":"A hacker by the name of  xdev @ b4lc4nh4ck hacked the MacForBeginners website and posted their customers information. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"443f8b95bfdc011dc2dccb8de3b8ca972ec0602e","impact_type":"unknown","incident_date":"2011-12-31","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/Notice%20to%20Individuals%20SAMPLE%20TO%20AG.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9f0d152d23de","org_name":"Impairment Resouces, LLC","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22311"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c26fc2f3df044a316571e054fe484f43b95ccc4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8947DAD-B839-46DC-94BD-8E3260AE60CE"},"incident_date":"2012-02-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"38b37965bb76","org_name":"Doshi Diagnostic Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=8976"},{"fetched_at":null,"title":null,"type":"press","url":"http://manhattantimesnews.com/February-15-2012/confidential-patient-records-found-in-the-open.html"}],"summary":"Paper documentation of paper records disposed of in insecure manner. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-02-08","discovered_date":"2011-11-06","entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5de444f0291ae04e16a5083386055a93e99419e","impact_type":"data_theft","incident_date":null,"initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/ALLSTATES%20notice%20e-mail%20template%20%282-6-12%29PDF.pdf"},"notes":"attack_techniques without supporting words dropped: T1213","org_country":"US","org_id":"ec2d71ec2a59","org_name":"Valve Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22302"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/ALLSTATES%20notice%20e-mail%20template%20%282-6-12%29PDF.pdf"}],"summary":"Valve reported that intruders obtained a copy of a database containing Steam transaction information.","supporting_quote":null,"technology_involved":["database"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"grudge","name":"Joseph Roque","variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-02-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ce2c324ba463e7c2a04b900335ec5b4e82d21ed","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9FC3D60B-A20A-419D-A3CA-EEB8527B497D"},"incident_date":"2012-02-08","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee35f062b186","org_name":"Jose Munoz","org_type":"nonprofit","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/West-New-York-Mayor-Acquitted-on-Hacking-Charges-387795.shtml;http://blog.nj.com/hudsoncountynow_impact/print.html?entry=/2013/09/first_day_of_deliberation_passes_without_verdict_in_trial_of_west_new_york_mayor_felix_roque_and_his.html"}],"summary":"hotmail account hack to impair access to other e-mail accounts, takedown a facebook page and to get godaddy creds to delete site contents & de-register a domain name","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"josephroque"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-02-08","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8de4b245065bf9392f911e3312f1a144464f499","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDEF350E-7205-4604-A778-FA182BCFAB0B"},"incident_date":"2012-02-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c205b7e624d","org_name":"Edmund Optics, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23616"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/edmund-optics-20120313.pdf"}],"summary":"Cold Fusion vulnerability exploited on web site. Customer payment card information was disclosed. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-02-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b02b96583aa60e3a4a1ad56dd8dbadb2baa3476","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-02-06","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/X-Rite%20Consumer%20Notification.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"b7467fab2f6b","org_name":"X-Rite Incorporated","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22965"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/X-Rite%20Consumer%20Notification.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/x-rite-20120409.pdf"}],"summary":"on March 23, 2012 client and limited database servers was attacked by malicious third-party. The server contain personal information, including name, contact information and credit card information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb7c01a88dcb407f01cb9691b1498f85421b8eda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C763487D-FA11-4ADA-85F9-2482FEACCB1E"},"incident_date":"2012-02-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c584faefe1dd","org_name":"LPL Financial","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Redacted%20LPL%20client%20letter%2002.06.12_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Redacted%20Participant%20Letter%2002.06.12_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22542"}],"summary":"A desktop computer stolen from the office of an agent contained customer name, SSN and financial information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cee8e31e64ca16dff9c851fa176f031ba80f848","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7AF42844-11AE-429D-A329-C8CE944ED3BD"},"incident_date":"2012-02-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de9583adcf30","org_name":"Court ADR Resource Center","org_type":"technology_saas","ransomware":null,"records_affected":30,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23230"}],"summary":"The names, postal addresses, phone and fax numbers and titles or positions of 307 contacts were dumped on the Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e4941c206bbb42fd07a814d4e474cb656a1de1d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E06FFF4-EF37-4EE1-AE99-A05D6568FF5B"},"incident_date":"2012-02-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94f7de552bfc","org_name":"Rubio's Restaurants","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Blank%20Notification%20Letters.PDF?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sandiegoreader.com/weblogs/news-ticker/2012/apr/20/rubios-warns-shareholders-their-social-security-nu/"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22725"}],"summary":"On February 5, 2012, a CD-ROM containing a list of people who owned equity shares in Rubio's Restaurants was taken offsite by a third party vendor, BDO USA, LLP.  Rubio's contracted with BDO to perform financial auditing services.  A BDO employee removed the CD-ROM from site, whe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-04","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05c824f01ffb7ce48752790c67b5aaf423315383","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2329314F-FB56-4DEC-8497-0BEFF879E3C2"},"incident_date":"2012-02-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c366d4551ea","org_name":"Dallas Police Department","org_type":"government","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://crimeblog.dallasnews.com/2012/02/hacker-claims-credit-for-attac.html/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcdfw.com/news/tech/Dallas-Police-Departments-Website-Hacked-138823209.html"}],"summary":"Dallas PD web site compromised; 10 officers' usernames and passwords posted online","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2012-02-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"badfd2508db1866a666ba937efadfe0204f009c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7C96808-DEFC-4E52-B5CB-32941334801A"},"incident_date":"2012-02-04","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"bc187a37741b","org_name":"Ankara Police Directorate","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bianet.org/english/freedom-of-expression/136509-redhack-hacked-police-directorate"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.hurriyetdailynews.com/turkish-police-secret-files-password-123456-hackers-reveal-.aspx?pageID=238&nid=15187"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/01/redhackers-hack-police-net-and-ankara-police-directorate/"}],"summary":"Hackers breached network of Ankara Police Directorate and released non-public information to the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7cb024379ef9b7f3dbc113aa6ee3c9dfd1034f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDD1DE7E-4DEB-428D-A97E-C7D650238C5D"},"incident_date":"2012-02-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e3383368b4f","org_name":"Kansas Department on Aging","org_type":"healthcare","ransomware":null,"records_affected":7757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfe42a056bc59ad8f6c92f8dd932ba87a9744c09","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"262472C8-D111-4F25-992F-DBB7AF2EACBE"},"incident_date":"2012-02-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fcc9b32ceaee","org_name":"Delta Dental","org_type":"financial","ransomware":null,"records_affected":11646,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-02-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a18a9c5cf644fcf6986c9c459042d9b1e5b91eaf","impact_type":"exposure_no_theft_confirmed","incident_date":null,"initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/IndyMac%20Resources%2C%20Inc.%2C%20Notification.pdf"},"notes":null,"org_country":"US","org_id":"2b8755db2bc0","org_name":"IndyMac Resources, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":"An employee of a contractor placed the PII on a web server where it was publicly accessible.","schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22262"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/IndyMac%20Resources%2C%20Inc.%2C%20Notification.pdf"}],"summary":"IndyMac Resources, Inc. reported that employee PII was placed on a public web server by a contractor’s employee.","supporting_quote":"We believe that the information may have been publicly accessible via the Internet as early as January 2007 and as recently as December 2011.","technology_involved":["public web server"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"error"},{"actor":{"category":"external","country":"VN","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-02","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f767aca94090196da9455c2ec177c7e902a54703","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66650162-DAB0-4C82-A32A-0DEC83735370"},"incident_date":"2012-02-02","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"VN","org_id":"4d7ca24ab051","org_name":"Bach Khoa Internetwork Security Company","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://talkvietnam.com/2012/10/website-of-vietnams-top-internet-security-firm-hacked/#.USPSIlpASLE"},{"fetched_at":null,"title":null,"type":"press","url":"http://talkvietnam.com/2012/10/suspect-seized-for-hacking-vietnams-top-net-security-site/#.USPSkFpASLE"}],"summary":"Bach Khoa Internetwork Security Company website hacked and DDoSed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b09d226f5838f716d4670e884fd266eb1c5a94b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59C007D3-B34E-4C4F-A4CF-7540327FB421"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e5e0094b22e","org_name":"Washington Administrative Office of the Courts","org_type":"government","ransomware":null,"records_affected":160000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/technology/160-000-social-security-numbers-exposed-washington-state-court-hack-1C9864740"}],"summary":"Up to 160,000 people may have had their information exposed by a breach.  Anyone who was booked into a city or county jail int he state of Washington between September of 2011 and December of 2012 may have had their Social Security number exposed.Additionally, three classes of pe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":"Antisec","variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f460d814457ebf5fbe5eccd49bb9dc8c94ba0958","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADD7E519-6980-4972-B188-6C3FCE21A54A"},"incident_date":"2012-02-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49f312b11eaf","org_name":"US Business 1","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2012/12/intruders-hack-industrial-control-system-using-backdoor-exploit/;http://info.publicintelligence.net/FBI-AntisecICS.pdf"}],"summary":"Hackers access SCADA system at unnamed company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"antisec"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd00f65fc1c297ec814efe5bc98fc4a92337184c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6A6EFCC3-0823-4F5F-9FC7-9A1704C837A3"},"incident_date":"2012-02-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran A requested to receive a complete copy of his medical records on CD. The CD was labeled with Veteran As information, however the contents of the CD belonged to Veteran B. Veteran A returned the CD to Release of Information (ROI).","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"974fc943dad584675706ce92dcc589884e33b66d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"392F3FFB-06FE-4AEC-9BB2-250B52A7F238"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96c42ed2cb0f","org_name":"Syracuse Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://centralny.ynn.com/content/top_stories/572563/syracuse-police-website-hacked/"}],"summary":"They are faceless, leaderless by design. The organization exists only in the ether. The internet is the gathering place for those addressing a host of complaints.  It was in this world of \"Anonymous\" that the Syracuse Police Department became a target.  On Wednesday night, userna","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"409630795841a840e13846e261a42f90b116522a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72C7FAAB-34AC-4FA5-A0E1-E0BD6D1C06AE"},"incident_date":"2012-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9665a5bd1315","org_name":"South Miami Hospital","org_type":"healthcare","ransomware":null,"records_affected":834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/03/15/new-details-emerge-in-south-miami-hospital-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcmiami.com/investigations/Hospital-Identity-Theft-Growing-Amid-South-Florida-Hospitals-197866811.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11930"}],"summary":"Following a recent trend of tax fraud resulting from patient data breaches, there are now more details regarding the patient data breach at South Miami Hospital involving 834 patients that occurred between June of 2011 and February 2012.  Photos have now surfaced of convicted ide","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07a4265ab4adccc8483a0eaa7f6a05159700fdc6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9BE90EC4-4D60-40FA-A60A-F4391B4D475B"},"incident_date":"2012-02-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"ec99d3cc6717","org_name":"Polk County School District","org_type":"other","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/article/20140403/NEWS/140409776;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baynews9.com/content/news/baynews9/news/article.html/content/news/articles/bn9/2014/4/4/polk_school_employee.html"}],"summary":"Publishing error leads to document uploaded to public web site, which exposed 350 employees' SSN.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59d0ef7ea460b195c7ba273b7884aabbe6ffd79f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59479089-D587-4A95-A1E2-B164FB99E23A"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"6eb21994d35e","org_name":"Netfleet Domain Names","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/it-pro/security-it/hackers-infiltrate-domain-name-auction-house-20120201-1qtgk.html"}],"summary":"Computer hackers penetrate database of Netfleet, possibly accessing addresses and credit card numbers.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61bffebdb9ea1a08a898a3e1d65487300be26848","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E671ECBA-E440-42C1-8040-766833CFA628"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"ecfaf4510f18","org_name":"Netfleet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.smh.com.au/it-pro/security-it/hackers-infiltrate-domain-name-auction-house-20120202-1qtgk.html"}],"summary":"Computer hackers have penetrated the database of Australia's biggest internet domain name auction house, possibly accessing client home addresses and encrypted credit card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"KR","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3650f32de227ee39f1faf4dcd8459e4102f91e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B0D36AE-C0E4-4486-9095-1FB4D13BCCF0"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"c2633c1631f9","org_name":"KT Corporation","org_type":"technology_saas","ransomware":null,"records_affected":8700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/police-arrest-two-south-korea-telecom-hack-exposed-87-million"}],"summary":"Police in South Korea have reportedly arrested two people for hacking into the network of KT Corp., the country's second largest mobile carrier and selling the data. According to a report by the Yonhap News Agency, police arrested a 40-yeard-old suspect  identified only by his fa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f409e312971621fc77af3d7906712b5328f564d8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"385FAC6E-F9A8-47EC-8A5E-35BF780B37B2"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fc85c4e1c0b8","org_name":"Kent Police Website","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-22149435?goback=%2Egde_4636751_member_232435183"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/east_kent_mercury/news/Computer-hacker-jailed-860/"}],"summary":"Incident 4: Kent man admits Oxbridge and police force cyber attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"591f66da2b273f112dab69089bad7179e33caf33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"003F5B6A-CA75-4694-AA76-FE9498FF0C3E"},"incident_date":"2012-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://legalinsurrection.com/2014/06/irs-admits-leaking-personal-information-in-prop-8-debate/"}],"summary":"IRS employee leaks confidential information from a political group's tax returns.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae7fbb0c0141a0a88e47959f1a7fdf111665e612","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D83B7CE-01C6-4EED-96F8-49AE12532696"},"incident_date":"2012-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69e85051d15b","org_name":"Emory HealthCare","org_type":"healthcare","ransomware":null,"records_affected":315000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/id/47120697/#.UVBP0oVLGws"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.emory.edu/stories/2012/04/ehc_missing_data/campus.html"}],"summary":"Backup tapes discovered missing from storage location. Data resident on tapes included SSN and medical information on 315K patients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d39a2b11ee1e3be486d9f4669106b6318ae3609","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE3524EA-8E42-485F-A110-8F66769710F2"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"473ac6f4a46a","org_name":"Digital Playground","org_type":"technology_saas","ransomware":null,"records_affected":72000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2012/03/12/digital-playground-hacked-manwin_n_1340285.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2012/03/12/digital-playground-passwords/"}],"summary":"pr0n website compromised 70,000 user records and 40,000 payment cards at risk. In addition to releasing usernames, passwords and credit card details, The Consortium also made freely available some 52 pornographic movies","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5ffdd1732076ddeafc99e6c3863d3a9db426157","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFAD0F77-B4A0-4183-832C-9866A0935062"},"incident_date":"2012-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc1761edd157","org_name":"City of Mobile","org_type":"government","ransomware":null,"records_affected":46000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://weldbham.com/secondfront/2012/02/10/hacker-group-targets-alabama-over-hb56/"},{"fetched_at":null,"title":null,"type":"press","url":"http://freakoutnation.com/2012/02/09/anonymous-your-government-leaves-your-sensitive-data-vulnerable-to-hacking/?wpmp_tp=1"}],"summary":"NOT A DUPLICATE: Alabama state govt servers breached by activist group via unknown methods. PII on 46,000 residents at risk. Some data disclosed on pastebay.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8cf7586477bdfad2b26e10650d1ebd8fa32efeb5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37BDFE6D-170C-4471-87EE-C4E477C39298"},"incident_date":"2012-01-31","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e49e4465a35","org_name":"Union Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/UBC2905_Letter_1_Fb.pdf?"}],"summary":"On February 15, 2012, Union Bank discovered that a former contractor kept proprietary bank data in his possession upon his departure from the bank on January 31, 2012. This data contains with your customer information such as your name, account number, home address, phone number ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"327c266af0687d99e0fc3c5ccf3c06a877ac6f6d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13863311-B3E3-4E6C-866F-E1BBFFBBC563"},"incident_date":"2012-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66962d77f3b0","org_name":"Smile Designs","org_type":"other","ransomware":null,"records_affected":1670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ed1c784ad1da12654be1c54aeac2c954e5ac973","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F9A5C110-16DF-49F5-9F71-7707DC959004"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43e2bbcff42e","org_name":"Salt Lake City Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://slcpd.blogspot.com/2012/01/police-department-website-temporarily.html"}],"summary":"The Salt Lake City Police Department’s website, www.slcpd.com, has been taken offline due to a security breach.  At approximately 2:30 p.m. this afternoon, odd postings started to appear on www.slcpd.com. According to claims posted on Twitter, the hacking collective Anonymous cla","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59b7a5c150ec953367a5eeb208bd800b78a60e6b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7153A4A7-4628-4B73-A015-7A0DE68DB59E"},"incident_date":"2012-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f042a5b02a08","org_name":"Robert S. Smith MD Inc.","org_type":"healthcare","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f43f87028b7ed9862212d535f75548591c55057","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42FCEAC1-1504-40AC-8E12-63B687919791"},"incident_date":"2012-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95af6a4b91b8","org_name":"Muskogee Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":844,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e129677aae21c706e4f299a825c14daa5b9e91c8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F79572F2-46E6-406A-B474-FC2CAD22ABFB"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ba878d181ed5","org_name":"Molina Healthcare of California","org_type":"financial","ransomware":null,"records_affected":11081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36f9baed3619418ab3611c6f840e47af82d54459","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"422CCDD5-FC53-46BB-819B-2A5F9D6C8A87"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"137ba552406b","org_name":"Lincoln Financial Securities Corporation","org_type":"financial","ransomware":null,"records_affected":4657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/red-boat-advisor-20120820.pdf"}],"summary":"it appears Red Boat's server was accessed without authorization between January 2012 and early April 2012. Based upon the facts available, we believe the purpose of the intrusion was to use the virtual server as a jumping off point for attempted intrusions into third-party comput","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d45cc004d398108c3398a99b2ab6200ac419e5c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9E88A14-8611-4127-84D1-8B95C0D6B103"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f25642624268","org_name":"Foundation Medical Partners","org_type":"healthcare","ransomware":null,"records_affected":771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae9d0435d0b8de4659cf0e2fde66ffaaacd49a62","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73918254-90BB-45B7-9B29-5A8797A6EDBB"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76dabd6fe634","org_name":"Derry Township","org_type":"government","ransomware":null,"records_affected":2038,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wgal.com/Printing-Company-Releases-SSNs-By-Mistake/-/9361174/10232776/-/10fjm1hz/-/index.html"}],"summary":"The Social Security numbers of thousands of Derry Township residents have been exposed.  Officials with a West Shore printing company admit they made a mistake and they are offering identity theft protection to the taxpayers whose personal information was exposed.  On Tuesday, ta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07c65f2e0f395417820e9b65a20443078238ce2b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6A4A861-F899-4D9F-BC6F-048BD218A592"},"incident_date":"2012-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bdf326f6f857","org_name":"Concentra Health","org_type":"healthcare","ransomware":null,"records_affected":870,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/concentra-health-settles-hhs-charges-over-2011-laptop-theft-breach-to-pay-1-7m/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d75adc71f9bccfe10242114afc6d28d076143b26","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B026CFF-F741-429F-8FD2-83BF8E96406F"},"incident_date":"2012-01-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"f5164bfde7c8","org_name":"Blacknight","org_type":"technology_saas","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconrepublic.com/enterprise/item/25604-blacknight-hit-by-external/;http://www.techcentral.ie/blacknight-suffers-security-breach/"}],"summary":"Blacknight hit with external security breach  Hosting provider and domain registrar Blacknight has revealed it had been hit by a security breach. While no data was compromised, the breach may include client contact details, such as email addresses and phone numbers, the company c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9118978c9fe5b7224f8788a3cad7f8dd375cbd77","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D54A214B-0F42-4B50-B530-C2224F025953"},"incident_date":"2012-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f20bf91d6de7","org_name":"Aegis Sciences Corporation","org_type":"healthcare","ransomware":null,"records_affected":2184,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8af35052afae3009d66fc41b8d4de56e3653c79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4DB95DE-6546-4632-A075-9515F6E558C7"},"incident_date":"2012-01-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"28316ee06d2a","org_name":"Metropolitan Police Service","org_type":"government","ransomware":null,"records_affected":1136,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.guardian.co.uk/uk/2012/feb/02/metropolitan-police-victims-email-addresses;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-16846042"}],"summary":"Human error let to the police department sending victims each others email address. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc32f4c6bbaa4118dd79ba26e8ac977b1e4b9f72","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2FFF2036-21AC-44F6-BD88-9A36D4D33DCB"},"incident_date":"2012-01-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d51ca30ec9d3","org_name":"Greene County","org_type":"government","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whio.com//news/news/local/greene-co-website-hacked-users-warned/nHRQH/?__federated=1"}],"summary":"GREENE COUNTY, Ohio  Greene County residents who have used an email address, user name and password on any Greene County website may want to change that information in other applications because the countys web server was hacked into Monday night. Greene County Auditor David Grah","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0f7fa928f1857144fce8a1f4ea09dfc93800d1c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12509819-4B66-456D-B7C0-B934A1E95923"},"incident_date":"2012-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"97bf12d6c6fd","org_name":"University of Oxford","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-22149435?goback=%2Egde_4636751_member_232435183"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/east_kent_mercury/news/Computer-hacker-jailed-860/"}],"summary":"Incident 3: Kent man admits Oxbridge and police force cyber attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12a5492559d0bd2ab02f0defb6c03c8c84713207","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0FE58E91-C3A5-44AF-80ED-94E96B04CB06"},"incident_date":"2012-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3954c9a699ec","org_name":"University of Cambridge","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-22149435?goback=%2Egde_4636751_member_232435183"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/east_kent_mercury/news/Computer-hacker-jailed-860/"}],"summary":"Incident 1: Kent man admits Oxbridge and police force cyber attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33a252e99c5fd3fe882a08a0c4fcf8c4c586768c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F22F6117-826A-4546-B893-00B10D4E7056"},"incident_date":"2012-01-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"514b3cb4ab0c","org_name":"Jefferson Davis Community College","org_type":"education","ransomware":null,"records_affected":5815,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Usernames and encrypted passwords were dumped onto the Internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3991612b82b844f403f7e84590902ed3ed9d55d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DC627D4-21CC-44CD-976A-1B181C2127BF"},"incident_date":"2012-01-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"820afd31fc55","org_name":"Back of American and Chase","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/ddos-new-attacks-against-banks-a-6449"}],"summary":"Denial of service attack","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b37ca66d3f40fb8a99ab0ed20fa0963d66c4dd6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14B00C7D-7303-4574-AFCF-1C1D9BD36605"},"incident_date":"2012-01-27","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c48e8ed8b5ad","org_name":"WPX Energy, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/wpx-energy-20120224.pdf"}],"summary":"I am contacting you regarding a security incident Company. The incident involved potential disclosure of Social Security numbers. On January 27, 2012, 1099 tax forms were mailed to interest owners or contractors. Their Social Security number was subsequently found to be visible t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0928219313465d9252637191d1250b4fe46a292","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"286CEBFF-BF96-4234-846A-2C6715C7C5C2"},"incident_date":"2012-01-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"7b5efb035307","org_name":"Koninklijke KPN N.V","org_type":"technology_saas","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23293"}],"summary":"Unknown digital intruders stole personal data such as user names, home addresses, phone numbers and bank account numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"315a1641c30637f6eb09b864d26e75c80f260a99","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDA97AB0-E76E-43EF-B1D8-627E373F8B02"},"incident_date":"2012-01-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"d2af7fa55d34","org_name":"Halton District School Board","org_type":"government","ransomware":null,"records_affected":54400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestar.com/life/parent/2012/02/06/halton_school_board_alerts_parents_after_employees_laptop_with_student_data_stolen.html"}],"summary":"A laptop containing thousands of Halton students’ names, numbers and birthdates — even their standardized test scores — has been stolen, prompting the board to warn all parents of a possible privacy breach.  “While we don’t believe data contained on the laptop to be damaging or h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a18ced9045df5d9dad491e97a54ba861c646bc9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F845C9C-94EB-4E3F-ACA9-2CD808C1BE54"},"incident_date":"2012-01-27","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3df287c0e374","org_name":"CenterLight Healthcare","org_type":"healthcare","ransomware":null,"records_affected":642,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"CenterLight Healthcare in New York reported that 642 patients had PHI disclosed in an email incident on January 27, 2012. I was unable to locate additional information on this one.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b20976e4a93506998647632451af951d500d4cee","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"720F30D5-32F1-44E2-97F2-06F4E2884C04"},"incident_date":"2012-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b4c1be086d1a","org_name":"LifeSize Communications","org_type":"manufacturing","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/lifesize-20120309.pdf"}],"summary":"Computer equipment was stolen that resulted in one person's personal information being compromised.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4e858b1ce4410205e59a85a7ad478a8dd892fe8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D9E85C9-D2FF-4E1A-A4E9-EFFBA3A9375A"},"incident_date":"2012-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbb104e26f84","org_name":"Baylor Health Care System","org_type":"healthcare","ransomware":null,"records_affected":1972,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://thescoopblog.dallasnews.com/2012/03/stolen-ipad-leads-to-worries-t.html/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scribd.com/doc/86119184/BHVH-480-Breech-Legal-Letters-A"}],"summary":"Theft of an employee's iPad that contained medical information from the employee's vehicle. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f20a51a82f86af59780ead3b13f8a02dfbc3007b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4565451-FCCB-4B4B-ABAA-5CA5FB5FDF6E"},"incident_date":"2012-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3007aac9e65d","org_name":"Advanced Clinical Research Institute","org_type":"professional_services","ransomware":null,"records_affected":875,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://eznotice.com/notices/3319596"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.idtheftcenter.org/ITRC%20Breach%20Stats%20Report%202012.pdf"}],"summary":"Paper records stolen from the back of a truck in an impound lot.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial","credentials"],"disclosed_date":"2012-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7dd3996200ae2b294555f0530a704e5cfd9a5be","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-12-08","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Trymedia%20Notification%20Letter%20%28General%20Template%29%201-17-2012_0.pdf"},"notes":null,"org_country":"US","org_id":"0b71d25e4121","org_name":"TM Acquisition LLC","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22211"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Trymedia%20Notification%20Letter%20%28General%20Template%29%201-17-2012_0.pdf"}],"summary":"Intruders may have obtained customer personal, payment-card, and account information from transactions processed through Trymedia's ActiveStore storefront application.","supporting_quote":null,"technology_involved":["ActiveStore Web-based storefront application"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00b01c8162a00d38ce70b0d21d39f37399b7f88b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F2EFB3B-CE7B-4618-A68E-B35699A7566F"},"incident_date":"2012-01-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"88161e894eff","org_name":"James A. Haley Veterans Hospital","org_type":"healthcare","ransomware":null,"records_affected":106,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://tbo.com/news/breaking-news/haley-volunteer-accused-of-stealing-patientsx2019-identities-20130905/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/courts/criminal/haley-tampa-general-hospital-employees-accused-of-selling-patient-ids/2129886"}],"summary":"A volunteer at the James A. Haley Veterans Hospital has been accused of stealing patients identities and using that information to file fake income tax refunds of about $550,000, according to federal court documents. The scheme began on Jan. 25, 2012, when Rodriguez stole about 1","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80d813bef92056add5785358fd631a265915b628","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B34F95B5-A928-4421-8585-7BAE0A2ED8AD"},"incident_date":"2012-01-25","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f06cf854acc7","org_name":"Eaton Vance","org_type":"financial","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/eaton-vance-20120208.pdf"}],"summary":"Investment management company mailed shareholder documents with customer SSN potentially visible in the envelope window","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-23","discovered_date":"2011-11-18","entry_asset":"physical","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71b0665041892f8521dfac21b3e1cef6c1c500a1","impact_type":"exposure_no_theft_confirmed","imported_from":null,"incident_date":null,"initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Sample%20Letter.pdf"},"notes":null,"org_country":"US","org_id":"3c75b37a9d60","org_name":"Regions Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22147"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Sample%20Letter.pdf"}],"summary":"A flash drive containing Regions Financial Corporation plan participants’ personal information went missing while being mailed by Ernst & Young.","supporting_quote":"When the package arrived at its destination on November 18, 2011, the flash drive was missing.","technology_involved":["USB flash drive"],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":"Ernst & Young LLP"},"updated_at":"2026-10-10","veris_action":"physical","derived":{"vendors":[{"id":"b252ab975f4d","name":"Ernst & Young LLP"}]}},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2012-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cac9ba7ad2f91d684d8079ed0242117ecf71a95","impact_type":"exposure_no_theft_confirmed","incident_date":"2012-01-05","initial_access":"supply_chain_or_third_party","letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/CA%20customer%20letter.pdf"},"notes":null,"org_country":"US","org_id":"7226910f99c6","org_name":"New York State Electric & Gas and Rochester Gas and Electric","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22146"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20customer%20letter.pdf"}],"summary":"An employee of a consulting firm contracted by NYSEG and RG&E allowed unauthorized access to a customer information system containing customer personal and financial information.","supporting_quote":"earlier this month we discovered that an employee of an independent software development consulting firm (contracted by NYSEG and RG&E) allowed unauthorized access to one of our customer information systems.","technology_involved":["customer information system"],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"735f957b180a27acd46405a92780cc70a18c15f3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB28D7DE-A037-433E-AC1C-84FEA934E2E8"},"incident_date":"2012-01-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df1e2dbdbf37","org_name":"Euronet Worldwide Inc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/kansascity/news/2012/01/23/euronet-faces-first-criminal-computer.html?page=all"}],"summary":"Euronet Worldwide Inc., a Leawood company that provides secure payment services, has reported a criminal computer security breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"362b4142c450ba131bc87dcc2ae85e9767b85808","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1DB83F4-055C-4302-AA1B-1079546FFBEB"},"incident_date":"2012-01-23","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db11d0f6c753","org_name":"Derry Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/derry-londonderry-center-20120409.pdf"}],"summary":"Former employee of medical center still had access to patient data. Used this access to look up into on a patient and went to her place of employment to ask her out.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3516d4eca089138f9bb23fa004d06f3a74ea2d86","impact_type":"unknown","incident_date":"2011-12-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/pacifica_letter01_newmembers_6.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"d13ca1194e02","org_name":"Pacifica-Coastside Credit Union / SF Fire Credit Union","org_type":"unknown","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-22123"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e7d687376df7b473efdfb12e951c595189bf405","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79D1DDE7-B93F-4B8B-A281-2AED9FF942CA"},"incident_date":"2012-01-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1f0279f29bb","org_name":"McDonald's Franchise","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegraph.com/news/local/article_6456b376-2246-11e3-90cf-001a4bcf6878.html"}],"summary":"Bryan was accused last December of using information on former workers to continue to receive their paychecks and cash them.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-19","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c42f85281c8409eb5da82636143bec0cd87259a5","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"78752C44-B7D0-4BAE-8DD5-0CDA899C4EA7"},"incident_date":"2012-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9649239b62e","org_name":"Salt Lake Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sltrib.com/sltrib/news/56858879-78/borell-police-hacked-website.html.csp"},{"fetched_at":null,"title":null,"type":"press","url":"http://archive.sltrib.com/article.php?id=24171085&itype=storyID"}],"summary":"In  a plea agreement with prosecutors, Borell, 22, admitted that on Jan. 19, 2012, he hacked into the Utah Chiefs of Police Associations website and then publicly bragged that the sites security had been compromised. Less than two weeks later, he hacked into the Salt Lake City Po","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b320ebe87aa997ee1c80df7b7d3c36c609cd5e27","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A24DA94-8FCF-41A0-9775-1677854CA413"},"incident_date":"2012-01-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"253037efdb92","org_name":"Dream Host","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/dreamhost-hacked-mass-password-reset-issued/10175"},{"fetched_at":null,"title":null,"type":"press","url":"http://dreamhost.com/dreamscape/2012/01/21/security-update/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9223625/DreamHost_resets_passwords_after_database_breach"}],"summary":"Web hosting database accessed via undisclosed method. Legacy plain text FTP passwords were determined to be at risk. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c6b55f952739af55d0056db4f184d9fb55531e0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB6683DD-3186-4027-95F8-E1A6F93F2E03"},"incident_date":"2012-01-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3837e73dc9ed","org_name":"Georgia Health Sciences University","org_type":"education","ransomware":null,"records_affected":513,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.georgiahealth.edu/archives/5161"}],"summary":"Theft of a laptop computer from a nurse practitioner's home that may have contained patient personal information ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fb13c521474b3b316f211a36f6bac16934a61b9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FD45130-141B-4B1C-902E-922B4C6DA99A"},"incident_date":"2012-01-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0128190da7bf","org_name":"American Stock Transfer & Trust Company, LLc","org_type":"financial","ransomware":null,"records_affected":6,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/american-stock-20120214.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/american-stock-20120413.pdf"}],"summary":"American Stock Transer & Trust Company, LLC accidentally mailed tax forms to the wrong people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"NL","motive":"financial","name":"'xS', 'Yoshioka' and 'Yui'","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffd1ac0b580136059037df7d4812e6a0c7e5ad2d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6CA4461-3649-4502-A2E3-483C92C13735"},"incident_date":"2012-01-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"49cc967e945d","org_name":"KPN","org_type":"technology_saas","ransomware":null,"records_affected":539,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworld.com/news/security/teen-arrested-for-hacking-hundreds-of-kpn-servers-3347525/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.techworld.com/news/security/kpn-apologises-for-downing-2-million-email-accounts-3337504/"}],"summary":"KPN has been left severely embarrassed by events that saw a youngster access its core routers at will and its customers denied email service after a possible over-reaction. The hack happened in January but the company's hand was forced last week after those responsible appeared t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"xsyoshiokaandyui"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a6aece7d02c54b7584981626efeffe513b90e80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAD37D33-39DC-4A9B-8B35-EA68E121567A"},"incident_date":"2012-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17cc5fa75a91","org_name":"Davidmorgan.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":24000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Government-and-Military-Members-Exposed-After-David-Morgan-Hack-247111.shtml"}],"summary":"A hacker managed to bypass the security mechanisms implemented by online clothing and accessories store David Morgan, leaking usernames, represented by emails, and password hashes. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-01-16","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7e60b3c04fca749597eef5b9c09ca7c7d3d151c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"036335D2-78B1-4348-AFCF-ACE8203AF1CF"},"incident_date":"2012-01-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1b18916e9d70","org_name":"Alabama Book Store, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tuscaloosanews.com/article/20120125/NEWS/120129865"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/breaking/2012/01/tide_fans_ordering_from_bamast.html"}],"summary":"Hackers breach college bookstore website and stole non-public data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82237cde89a898752ae754324d1cf3e878132abb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E1D8805-BBE4-4163-993D-0A7730F4C9D2"},"incident_date":"2012-01-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79d0bd1adde9","org_name":"Owner-Operator Independent Drivers Association","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/owner-operator-independent-drivers-20120619.pdf"}],"summary":"An unauthorized individual gained access to some coded online forms stored on a remote server housed with a third party ISP.  The individual changed certain informatino on the forms which caused the forms to be sent to this individual as a blind copy email.  The breach may have e","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1b2c90bc80aea51f7375af633b64cc3d74e4997","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A633E28-1B9A-4A2F-BF36-714D7E05A713"},"incident_date":"2012-01-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9eb38d17361","org_name":"Lee Miller Rehab Associates","org_type":"healthcare","ransomware":null,"records_affected":10480,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"A network server was stolen or discovered stolen on January 15, 2012.  The incident appeared on the HHS website in February of 2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"48271bb558ba8e039e06388462f3392fa68b5eb4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A273C32-F366-42EA-A38A-B17D9F8D3EE5"},"incident_date":"2012-01-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6d5a46a2409c","org_name":"Cambridgeshire and Peterborough NHS Foundation Trust","org_type":"healthcare","ransomware":null,"records_affected":47,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-cambridgeshire-17002503"}],"summary":"Documents containing non-public patient information went missing while in transit using inter-office mail.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"809938f2a5879b17478f5e583c841d56e26a0075","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30B6BA6F-DFD4-42EB-B1F7-6DD7E8DC182F"},"incident_date":"2012-01-12","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a2bf102f4c1","org_name":"FileDen","org_type":"technology_saas","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Online-Storage-and-File-Hosting-Site-FileDEN-Hacked-Users-Exposed-246059.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/FileDen-Works-on-Securing-User-Data-After-Breach-246520.shtml"}],"summary":"Database compromise leads to public posting of 4500 usernames, passwords, and e-mail addresses. Passwords were hashed, but not salted and many were cracked.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7a0e95ffd316211bfd1947cc41cd99815906f07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"874ACD7E-8430-41C6-846B-20D5E6D05A1E"},"incident_date":"2012-01-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0d29cff2ad8","org_name":"University of Kentucky HealthCare","org_type":"healthcare","ransomware":null,"records_affected":878,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a697c5a2fc3ae543594b265440a80af60e368371","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"903FC1C4-4ACC-407E-B1D6-CE082D9005E3"},"incident_date":"2012-01-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"88628d132fbb","org_name":"State of Tennessee Sponsored Group Health Plan","org_type":"financial","ransomware":null,"records_affected":1770,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01e6f70a751bcd55b3b4fdebd23d909602567dc2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4D55F456-BC52-4C5A-A986-43FE5ECB2821"},"incident_date":"2012-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebbabfa5ee9f","org_name":"Rite Aid Corporation","org_type":"retail_ecommerce","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e9c74811de68ed251e91d9bb71ec01f7ad15e66","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E161E75-56D5-4F48-988D-97A9B1194DAA"},"incident_date":"2012-01-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fda885657a9f","org_name":"Open MRI of Chicago","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bd50e1bdc5f130a1ac90d5b73681f23f71346482","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ECAF4BA-6AFB-4F52-93E5-AB78E39353AD"},"incident_date":"2012-01-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"7a1e1c71e167","org_name":"Bar-Ilan University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/bar-ilan-university-geography-and-environment-department/"}],"summary":"From Bar-Ilan University Geography and Environment Department (home.geoenv.biu.ac.il):  36 names, email addresses and SHA1 passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d96889c4025618a952ffb0a2220eff915cf1fd03","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1778916B-4F49-4E0F-8ABF-89F4A962A721"},"incident_date":"2012-01-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9b96e3a9d50","org_name":"Alicare, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Alicare%20Inc%20Notice%20ltr%20to%20consumer.pdf"}],"summary":"on January 13, 2012, Alicare, Inc., third-party administrator of the national retirement fund discovered a potential information security incident involving certain personal information of yours that was inadvertently provided to a mailing service imprinted on the mailing label a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fb989bd55c5bdddc7c65938aec7cad4a119fd77","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62F5000E-A9D7-41E6-823E-281065CD18F2"},"incident_date":"2012-01-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72e689ec118d","org_name":"Advanced Occupational Medicine Specialists","org_type":"healthcare","ransomware":null,"records_affected":7226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a4b961d2c621bdc6487442b7ad278bdfccc014e4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"522F02F5-5B04-4CAA-AC38-E02566E7522C"},"incident_date":"2012-01-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3410970b71af","org_name":"Terrell County Health Department","org_type":"government","ransomware":null,"records_affected":18000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Terrell County Health Department in Georgia reported that 18,000 had PHI involved in an incident that occurred January 9, 2012 to April 17, 2012 involving Unauthorized Access/Disclosure,Network Server. Ive been unable to find any details on this breach, but with 18,000 affected, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-07","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9064f6530217173ecd0ed1e6b04fd77265f249c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0D7EED2-7F2B-47C6-BD9D-6101EF2D7EAD"},"incident_date":"2012-01-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"32c0fdabdf1f","org_name":"CoveritLive","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gamepolitics.com/2012/01/14/coveritlive-warns-users-possible-security-breach#.USPaFeip1Tg"}],"summary":"\"CoveritLive recently discovered that certain proprietary data files were accessed without authorization starting on or about January 7, 2012. We have not yet determined if, or to what extent, CoveritLive account information (i.e., usernames, email addresses and/or passwords) was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6bfbf2e48d7cfcfd76100e1f527194a88d724c94","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C860A58B-729A-47F2-9C66-812BD5AA3662"},"incident_date":"2012-01-04","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"941f1adcf19d","org_name":"College Board","org_type":"education","ransomware":null,"records_affected":430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/college-board-20120113.pdf"}],"summary":"A spreadsheet containing personal information of 430 individuals who registered for or participated in the November 2011 Chinese Bridge Delegation was not properly secured, and potentially viewable via the internet.  It contained name, DOB, passport number and contact info of the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-03","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9959704b35c4d919c24887dc99d6e4044df9e699","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE00D0BA-54A0-4C83-A8E0-099FFCC5B8C1"},"incident_date":"2012-01-03","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"5b1dab4bd0c2","org_name":"One.co.il","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.haaretz.com/news/national/saudi-hackers-claim-to-post-personal-information-of-400-000-israelis-1.405147"}],"summary":"Saudi hackers claimed Monday to have released the credit card information of hundreds of thousands of Israelis, after hacking one of Israel's leading sports websites.  A hacker claiming to be a member of the Saudi hacking group, Group-XP, claimed Monday that he penetrated one of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"833541893fb197ae17d0ec56a56e8eb7cdf6cded","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D5BC7F7-FF13-423C-825A-5786741039BF"},"incident_date":"2012-01-02","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52dc67b26a41","org_name":"Bank of America Merchant Services, LLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/BAMS_Notification_Letter_Final_5_14_12%5B1%5D_0.pdf?"},{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23279"}],"summary":"It has recently been brought to our attention that personal information about merchants who currently process with Bank of America Merchant Services (“BAMS”) had been shared outside of the company by our service provider, First Data Corporation (“First Data”). This information wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb168b635c2d8acf5600ce072cfeebe8ad840d43","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9d4b4560-1faa-11ec-aba2-27b717aed560"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"a165f8dcd951","org_name":"Zushi","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.japantimes.co.jp/news/2013/11/07/national/crime-legal/stalking-victim-info-leaked-by-zushi-officials/"}],"summary":"Zushi officials leak personal data that allegedly lead to murder by a stalker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebffb6caf36208b38925409d9794a39729976d56","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"692DEEBA-F5CD-414E-B516-1ED7ABFB29C3"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"f567b1677fe7","org_name":"zssf.gov.cn","org_type":"government","ransomware":null,"records_affected":1410,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/anonymous-hacks-hundreds-of-chinese-government-sites/11303,"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/5icmNK7g"}],"summary":"The hacktivist group Anonymous now has a Chinese branch. An Anonymous China Twitter account was created late last month, was endorsed by the YourAnonNews Twitter account, which by the way has over 562,000 followers now, and the individuals behind it went to work. Boy have they be","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fbb077643ff040656c193e4d4b399e3effe6dd6a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F313A84-523E-4B82-B351-A4B7A0C5B51B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZA","org_id":"d7b3960ecd83","org_name":"Zone Technologies","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/01/16/zone-technologies-hacked-and-accounts-dumped/"}],"summary":"Small hosting company, Zone Technologies from south Africa has been hit by hackers going under the handle of “The Israeli Hackers Team”.  The hack has resulted in the dumping of accounts and personal information but its at least worth noting they did encrypt passwords, although t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5701aa6951271b86ad6df413534e2eafd1b1ca9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E84811CB-610F-43A7-A057-CE1E90E0468F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfd13a6c4976","org_name":"Zappos","org_type":"retail_ecommerce","ransomware":null,"records_affected":24000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/attacks/zappos-hack-exposes-passwords/232400441"}],"summary":"Online shoe and clothing retailer Zappos, which is owned by Amazon.com, began emailing its 24 million customers Sunday, advising them that its site had been hacked, and some customers' personal details and account information likely stolen. But Zappos said that no credit or debit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22c2a03a7dd54a01669154ecec7580018214ad3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9D4FA299-EBF4-49B9-A06C-225EC11101D3"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08620a9677a1","org_name":"Yurman Design, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/yurman-20120207.pdf"}],"summary":"Tax forms were mismailed to contractors, included PII.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a8923433554695803fdd5d5a6b195bd6d96c4f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6EDD321-2E00-44D9-B6A1-8E5CEB5652D9"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a278b926d2d2","org_name":"Yamaha Commercial Audio Systems","org_type":"other","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/1-700-Clear-Text-Passwords-Leaked-from-Yamaha-Audio-Systems-253921.shtml"}],"summary":"Cyber War News informs us of a hacking operation that exposes the usernames and passwords of more than 1,700 individuals who own accounts on the Yamaha Commercial Audio Systems website.  Unfortunately, not only the users were exposed by a hacker called Muldaria48, but also a numb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e55f3e56b325b9544fc1c7d102ec25964a1f9d62","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C37CC12E-A471-4C58-8148-1C87B027A817"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ef670dffd76","org_name":"Yahoo","org_type":"technology_saas","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eweek.com/c/a/Security/Yahoo-Confirms-400000-Passwords-Stolen-in-Hack-112338/"}],"summary":"Yahoo officials confirmed that an older file from the Yahoo Voices (formerly Associated Content) was stolen July 12 by hackers, allowing them to get their hands on more than 400,000 user credentials.  Of that amount, less than 5 percent of the Yahoo accounts had valid passwords, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2c135302e5a27e683ea8cc3bc3e00569622f003","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E175188-D873-4919-821D-D6A03F03B7CD"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cb38bc632301","org_name":"Xbox Resource","org_type":"technology_saas","ransomware":null,"records_affected":1630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Xbox-Live-Clans-Hacked-Used-Data-Leaked-249116.shtml"}],"summary":"Usernames, passwords and email addresses dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"596c4b228d213de0e94032e84e6694ee3b4a5ab5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"737925D5-713D-4B50-BC1A-8B7CF597F7E1"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"14adc30d9b34","org_name":"Xbox Live Clans","org_type":"technology_saas","ransomware":null,"records_affected":35000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Xbox-Live-Clans-Hacked-Used-Data-Leaked-249116.shtml"}],"summary":"An Xbox Live community with around 35,000 members called Xbox Live Clans suffered a data breach, hackers managing to obtain and leak usernames, represented by email addresses, and password hashes.  The hacker alsa7r posted all the information on Pastebin, potentially exposing all","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86a549a41c4ad623bef4aaea67b866f238f1f2ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7676C52-36BD-493A-8E6B-45A4EC5C6940"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a34d43aa72b","org_name":"www.fixasmile.com","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fbi.gov/washingtondc/press-releases/2012/oakton-dentist-convicted-of-illegally-distributing-narcotics-health-care-fraud-and-id-theft"}],"summary":"Hamada Makarita, 51, of Oakton, Virginia, was convicted today by a federal jury of using his position as a dentist to illegally distribute prescription pain pills to patients, employees, and a woman whom he dated. He was also convicted of using the identity of another dentist to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0d04c7dac3c6526bfd95de44877a8740ea05bac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B46BD1D-8EF2-4A50-A665-C0ED5CFAA078"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d402592296d0","org_name":"Wright-Patterson Medical Center","org_type":"government","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whio.com/news/news/local/air-force-group-names-social-security-numbers-misp/nhWgw/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/oh-wright-patterson-medical-center-notifies-3800-of-breach-involving-their-info/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.journal-news.com/news/news/wright-patt-alerts-3800-to-possible-personal-data-/nRDtm/"}],"summary":" Wright-Patterson Medical Center has alerted 3,800 people of a possible personal data security breach when a notebook containing their names and Social Security numbers was temporarily misplaced after a blood drive, according to a base spokesman. The 88th Medical Group sent notif","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb6f3e9c82207717f929a0271bb9cdc8fceed03c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B061AF4F-40B8-412B-AC50-26FBD6B2E43A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"6e510755c4ee","org_name":"wow-gold.de","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Wow-Gold-First-Victim-of-Anonymous-in-Operation-Golden-Coin-245151.shtml,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/01/09/wow-gold-de-hacked-by-anonymous-in-opgoldencoin/"}],"summary":"Anonymous released a video to reveal their intentions of targeting online game websites that fail to properly protect their customers. To show they’re serious, they already breached a website and leaked tons of information from its databases.  “Many users of the Internet actively","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"251c1bd0dcda36e3974cd51dfa76f169f231f453","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B41BDEBB-8FA9-4EA1-8474-B96EFB602235"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f24a678cadec","org_name":"World of Warcraft Latino America","org_type":"technology_saas","ransomware":null,"records_affected":257,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Usernames, e-mail addresses and passwords dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20807b5653c41ae24a53145679b483b25cf59d53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2E11392-874E-480A-A4B0-8EFA44436334"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"42ad7587d2e8","org_name":"Workplace Health, Safety and Compensation Commission","org_type":"financial","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegram.com/News/Local/2012-02-03/article-2885584/Workplace-safety-commission-reports-privacy-breach/1"}],"summary":"The Workplace Health, Safety and Compensation Commission is investigating a privacy breach by an employee.  The commission announced today that an employee accessed 12 injured workers’ records without a justifiable work purpose over a three-year period.  The breach was reported t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1179d9016eef177b53866ffe10d5ddbad89be74","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55C1ED02-0B84-4829-85F4-726ACC5C70C5"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7d253a3486e","org_name":"Woodrow Wilson National Fellowship Foundation","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/woodrow-wilson-fellowship-20120618.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/woodrow-wilson-fellowship-20120607.pdf"}],"summary":"in May 2012, the foundation became aware that some Fellowship applicant's personal information may have become publicly accessible during an update of the foundation's website. Due to an IT oversight, certain information was inadvertently placed outside the foundation's Internet ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2bd3596164fca3fc2462e2eb272db2a368bfe92","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"532CFE1F-E1D1-471E-A5DC-140703F28553"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"25f961c352de","org_name":"Windstream Communications","org_type":"technology_saas","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/2012/01/25/2957510_mt-pleasant-man-accused-of-stealing.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach/new"}],"summary":"A concerned neighbor noticed that packages were being delivered to an abandoned house. Law enforcement confronted a man who was collecting the packages and found that he had stolen old Windstream customer files and used the information to open fraudulent accounts with online reta","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75e5c05c2262b835759bb162a4d7a2116a43190b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3298E1F5-BAD2-462B-B32E-BCE1C5027D92"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_letter","url":null},"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69d314c30b23","org_name":"Wilton Brands","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-37224,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/wilton-brands-20121212.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/wilton-brands-llc-security-breach-notice-letter-to-consumer.php"}],"summary":"On or about October 31, 2012 a service provider of Wilton discovered that a malicious user had added a file to a computer server that hosts www.wilton.com and www.copco.com. During the period of July 19, 2012-October 2, 2012 this activity resulted in the malicious user being able","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e007e0f43535561776fa7060d71581e96cbc28a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2733A92D-7570-47F2-ACE7-1680884B1DD7"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e339c07edff8","org_name":"Wilson County School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"PII of students who met with graduation coaches not properly redacted from meeting materials","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9d9bf9b18ea5bea6bd7957fe41ac70c51e56f2cf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE066AAA-98FA-4A98-B585-BF72EE8FDD06"},"incident_date":"2012-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ec30629ceefc","org_name":"WHMCS","org_type":"professional_services","ransomware":null,"records_affected":500001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/database-security/167901020/security/news/240001090/social-engineers-steal-500-000-customers-data-from-whmcs.html"}],"summary":"Client management billing platform WHMCS last week notified customers that hacker group UGNazi fooled its Web hosting firm into providing the hackers with administrative credentials.  The hackers stole the data, deleted it from the hosting provider's systems, and then posted it o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8d4b612e186e560d30b68a755b8b2f98b1561ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93821196-0425-4DF8-81F4-DF2772276E50"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"463327c3bb8b","org_name":"Western University of Health Sciences","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-37376,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/WesternU%20Security%20Breach%20Notice%20ltr%20to%20consumer.pdf"}],"summary":"On November 14,2012, WesternU learned that BanWebSelf-Service Federal Work Study reports were potentially accessible to BanWeb suers with a WesternU ID and password.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3517a26f9bdab2577f7b827d34671457c6f05ac2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"69B69F68-6262-4F51-AD98-FD9E286AA20E"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"0d8620eba570","org_name":"Western Memorial Regional Hospital","org_type":"healthcare","ransomware":null,"records_affected":1043,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ganderbeacon.ca/News/Local/2013-11-29/article-3524447/Western-Health-privacy-breach-charge-going-to-trial/1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thewesternstar.com/News/Local/2014-04-30/article-3707668/Donna-Colbourne-pleads-guilty-to-breaching-health-information-act/1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/newfoundland-labrador/donna-colbourne-fined-in-western-health-privacy-breach-1.2763637;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegram.com/News/Local/2014-11-17/article-3942232/Western-Health-privacy-breach-court-decision-favours-plaintiffs/1"}],"summary":"A former employee with Western Health was fined Thursday in a privacy breach at the hospital in Corner Brook.  Donna Colbourne accessed more than 1,000 patient files at Western Memorial Regional Hospital while working there as an accounting clerk until 2012.  Judge Kymil Howe, ap","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14e9a088f9c618e7c1ff821cb5c769f0092904ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F9EAF7B-9C0C-4F3F-8B49-FAAA202F5DBF"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4bc086e3ed56","org_name":"WestCoast Children's Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/SAMPLE%20Nov%2028%202012%20Breach%20Notification%20Letter%20to%20Client_0.pdf?"}],"summary":"A referral document containing patient's name, date of birth, Social Security Number, address, and current health concerns was unintentionally sent by email to an unauthorized recipient, a county social worker, at the Alameda County Department of Social Services, Child and Family","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7de2ed99ebf66a7eea827aa7259773ad6a4f1126","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAF0CF9D-173B-4FC8-8A5E-1277D2B473DB"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06b8cfd9b9bc","org_name":"Westboro Baptist Church","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.inquisitr.com/440545/anonymous-hacks-the-westboro-baptist-church-posts-all-their-personal-information/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.inquisitr.com/441336/hackers-continue-assault-on-westboro-baptist-church-release-social-security-numbers/#aKOq1KOQJrZHHlTP.99"}],"summary":"With many people understandably upset that Westboro Baptist Church plans to protest the victims of the Sandy Hook massacre and sing praises to God that children were killed, it is hard not to cheer for Anonymous in their latest battle against the “church.”  As The Inquisitr previ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b133dcd060a09b6b261f0913e1c45ab72e7d593","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C5CA8F4-7CDD-48AC-9ACA-2B42B68EE511"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"87fe24066c52","org_name":"West Virginia Chiefs of Police Association","org_type":"nonprofit","ransomware":null,"records_affected":150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2012/02/08/west-virginia-chiefs-of-police-association_n_1262892.html"}],"summary":"Hackers affiliated with the group Anonymous obtained personal information for more than 150 police officers from an old website of the West Virginia Chiefs of Police Association and posted the data online.  He said the hackers obtained the home addresses, home phone numbers and c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02bfffbef6b14a72d198e8dcc4178f67ac29552f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1DA4B93-E4F0-44F6-B493-E1064F8C1040"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"f09c273cc4d8","org_name":"Webassur","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Extortionists-Threaten-to-Leak-Databases-of-300-Websites-Designed-by-Webassur-292469.shtml"}],"summary":"Rex Mundi attempts to extort from web hosting provider who was breached by the hacking group. According to the group they compromised data from over 300 customers of hosting provider.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75af0aa71991f08d08e9c5e658a71a56e88e1a98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31C5AD57-8017-4CFE-B51B-C546D3F2568D"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b53e64abfb7e","org_name":"Weather Shield","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wqow.com/story/21996096/2013/04/16/weather-shield-employees-find-out-they-are-identity-theft-victims-once-again"}],"summary":"A total of 55 current and former Weather Shield employees across the country discovered that someone had stolen their identities and filed fraudulent tax refunds.  Several employees who were victims of identity theft in 2012 discovered that they had been affected again when filin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e71f3744447bc6c06188b9b7a63bb9bb4502ad12","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8D905AB0-1A6D-4E6B-A1CE-B7623D7B1C91"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4eddfb222cbc","org_name":"Wayne State University","org_type":"education","ransomware":null,"records_affected":2803,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/wayne-state-university/"}],"summary":"@_TeaMp0isoN dumps 2,803 intranet users' details (username, plaintext password) from the official site of Wayne State University.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f84d9bf01d9ad9bbad97278efffcc575e9fb7348","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6135168A-4903-4574-88ED-4182EF36B70E"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65d5468638a5","org_name":"Wayne Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pahomepage.com/news/wayne-memorial-worker-fired-after-privacy-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nepabuzz.com/2016/02/01/privacy-breach-at-wayne-memorial-hospital/"}],"summary":"Nurses aide access medical records of patients not in her care.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e035429e68a6271525696d7736287f05d3f98f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28051601-826A-4A8C-9C1A-7F5FFA2ED4FC"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"dd8a5bc45f60","org_name":"Waveny Wholesale","org_type":"other","ransomware":null,"records_affected":2167,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Customers' names, e-mail addresses, phone numbers, postal addresses, and I.P. addresses dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e72ee3a01f83beed7b9486b27eeb7213428ac904","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1814BC8C-DBAC-424C-A767-F93BD4CEB0CC"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"badb18ad8587","org_name":"Washington University","org_type":"education","ransomware":null,"records_affected":4100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/washington-university-20120315.pdf"}],"summary":"On February 17, 2012, our client, Washington University in St. Louis discovered that an employee was copying electronic files onto an external hard drive.  While the employee was authorized to see the data in these files, they were not authorized to copy the first onto an externa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edec510bb9704d03806337ea5cf54ac9b7ccfafb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D13C414-E37E-4253-9746-11B677C0FD58"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"34be23a50ad1","org_name":"Wards Nursery & Garden Center","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.berkshireeagle.com/ci_19787695"}],"summary":"Ward’s Nursery & Garden Center may be at the center of a security breach that resulted in scores of fraudulent purchases made this month with information from dozens of locals’ credit and debit cards.  Gregory Ward, co-owner of the South Main Street store, said his company was co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2cb36c7e57a373cb9c43d1af6aa22a3751ef39db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6E4E68A1-C346-47E3-99DC-FDDF4F7DE19F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"08bf96026e37","org_name":"Wallace Community College","org_type":"education","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/qtJSibas,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23351"}],"summary":"Usernames and hashed passwords dumped to pastebin by SEPO.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9580cf2d8e4792843a0f395c153dfb520ad88a69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FFDC6655-E421-4BEC-835F-1BDFEC4F6C70"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"75bcdb7a7a88","org_name":"Walking on Air Clinic","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-hampshire-16843607"}],"summary":"A laptop containing personal and medical information of up to 1,500 people has been stolen from a podiatry clinic in Hampshire.  The Zoostorm laptop, containing unencrypted data, was taken from the Walking On Air clinic in Gosport on Tuesday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8341200118b9bcb492708d6d4e78bf95a16042b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"135A05BA-A6E8-4DA9-B3BD-7DB2686D2556"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"369602f7b3b5","org_name":"Walbridge Aldinger Co","org_type":"professional_services","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.crainsdetroit.com/article/20160724/NEWS/160729954/keefe-brooks"}],"summary":"corporate espionage","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cefbe680d9960090f553fd9e82af6270195c0b80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BD9D7E8-2161-4F21-AEE0-C9C8A9EA0B9C"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32d97f80602e","org_name":"Vote Sex!","org_type":"nonprofit","ransomware":null,"records_affected":35959,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Usernames, e-mail addresses and passwords dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09590b19fa235db1d0b52337c70490b33cdfe767","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B9ECDFA-41D6-4AEF-9087-1EE18BC407AD"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"fab99669b6c0","org_name":"Volunteer State Community College","org_type":"education","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.volstate.edu/securityID/"}],"summary":"mispublished personal information through web app","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b2e6d491cc5cc66fa95b0a6c0d8ad0cdf20ef25","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B503E17B-A4EE-48A0-9E0B-9B72F552E26B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"1851a64a32fe","org_name":"Vista.pl","org_type":"retail_ecommerce","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/29/12000-accounts-leaked-from-polish-website-vista-pl/"}],"summary":"The targets seem to be all Polish websites and the hackers are said to be from Poland as well. So far they have hit Vista.pl and dumped well over 12000 user accounts from the software information and download portal.  The leak is in two pastebin pastes and contains over 6000 per ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb53ae26cac321d3d22622bda5a0828d9a9acef","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E6C1DF8-6A53-4FD1-9F01-EE5C874E1A97"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"89bfcdad4d5b","org_name":"Vision Technologies, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/l-3-sued-for-breach-of-non-disclosure-agreement-157787535.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://washingtontechnology.com/articles/2012/06/07/l3-and-subsidiary-lawsuit.aspx"}],"summary":"L-3 Communications and its subsidiary L-3 MAPPS Canada is being sued for breach of non-disclosure agreement with Vision Technologies, Inc. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cae716ba8e5a908d614c4c31c022524cd4561641","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"743CF9EA-DE65-43A1-904E-FDE2C08F9A45"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3a8c70bba340","org_name":"Virgin Atlantic Airways","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.huffingtonpost.com/2012/04/07/virgin-atlantic-employee-resigns-after-allegedly-revealing-celebrity-passengers_n_1409679.html"}],"summary":"A Virgin Atlantic employee has resigned following allegations she routinely fed information about the airline's celebrity clientele – from Madonna to Sienna Miller – to a paparazzi agency.  The employee was a junior member of the team that looks after high-profile clients, Virgin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba00fae2d9474311bdba923efb648c40e0fa940b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83FB438C-2470-445C-A963-D040EC8C6A21"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"590ac7c8d34a","org_name":"Video Games Plus","org_type":"retail_ecommerce","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Canadian-Video-Games-Plus-Hacked-21-000-Customers-Exposed-247028.shtml"}],"summary":"Canada-based Video Games Plus (VGP), a major gaming website that commercializes games and console accessories has been breached after the hacker xdev@b4lc4nh4ck managed to bypass their security protocols.  Names, dates of birth, email addresses, phone numbers and encrypted passwo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0685db541c1d9bf092cf943f8cad1f749ab6b456","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE276FDD-F801-47E3-A150-C1F740444EA8"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18e2a0040129","org_name":"Vertecto Transaction Services","org_type":"financial","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jaymiescotto.com/2012/12/19/vertecto-responds-to-security-breach-stops-the-rumor-mill/"}],"summary":"Vertecto Services, LLC, a provider neutral transaction services to route buyers and sellers in the wholesale telecom industry, recently experienced a security breach, which the company reported was isolated to a single account. Vertecto reported that while the breach didn’t direc","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b2de6fb94edaadc1152ae8050a81b5ccb2ba282","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75828758-24C6-49F5-8E33-86B77802457A"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b31f46af8de","org_name":"Vermont Department of Taxes","org_type":"government","ransomware":null,"records_affected":1577,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/23194/vermont-tax-agency-posts-social-security-numbers-federal-tax-ids-online/"}],"summary":" The Vermont Department of Taxes admitted this week that the social security numbers of 1,332 Vermont tax payers and federal ID numbers of 245 businesses were inadvertently posted online.  The personal data were contained in a weekly batch of property transfer tax returns, accord","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8bbc1dcee33eadf9308c5672f3ed8ebfd6abb5c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2A15289-C01D-4657-98F0-29B9948A5A6B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"308f9e2d17d6","org_name":"Verisign Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2012/02/02/hacking-verisign-idINDEE8110CS20120202"}],"summary":"VeriSign Inc (VRSN.O), the company in charge of delivering people safely to more than half the world's websites, has been hacked repeatedly by outsiders who stole undisclosed information from the leading Internet infrastructure company.  The previously unreported breaches occurre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1381768e180cd653a0f96602e8f1cb04debc340","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC187D52-1440-4C87-AF84-2BFB67C1B916"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"bba338f2c577","org_name":"veluwe.info","org_type":"technology_saas","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/06/04/veluwe-info-hacked-200-accounts-leaked/"}],"summary":"A hacker who use’s the handle “HANIKO YUNOKAWA” has hacked a Netherlands based information website and leaked 200+ accounts via pastebin. The announcement of the breach was made via their facebook page not so long ago.  The leaked data contains just over 200  usernames and encryp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36ea0ad323e1f339dd6183b2d73e3c1fc24634cc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35E2D8A6-975B-470F-9534-5C41CAC533FB"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dd48fb87b8f","org_name":"vBCoderz","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/vbcoderz-com/"}],"summary":"usernames and hashed passwords dumped on the internet by a hacker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3eadf6a310017823a8c3c81ead06e925e7ec73ad","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E62AA41E-58CA-4D1D-AFC7-7B95D3078D17"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"8ca46d51418c","org_name":"Vancouver Coastal Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bc.ctvnews.ca/ctv-personalities-among-victims-of-medical-breach-1.1069119"}],"summary":" A female Vancouver Coastal Health employee has been fired after accessing the confidential electronic records of five local media personalities – including three from CTV News.  Anchors Tamara Taggart and Coleen Christie and health expert Dr. Rhonda Low were among the victims co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"720dc2a5a16cded4c1266156ec36d2f1dabf0d76","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05CFF863-9618-41D5-A500-40B3F290D243"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GH","org_id":"2ff89e17c650","org_name":"Valley View University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23354"}],"summary":"Valley View University in Ghana is a private chartered university.  According to Wikipedia, it is part of a worldwide system of over 100 tertiary institutions operated by the Seventh-day Adventist Church. And according to Virtual SEPO, it was hacked. The data dump includes entrie","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dcb0319e9a3482f228d7d11613f77a3c81f936bb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C07E499F-C3B9-4E72-A424-322D3EC9A299"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7ae7d19de74","org_name":"Valencia Self Storage","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securshred.com/blog/2012/06/01/id-theft-by-puzzle-piecing/"}],"summary":"Grant Lind allegedly was a dumpster diver with a lot of patience and a talent for putting together puzzle pieces.  Lind, 49, was charged last month with 44 felony counts in connection with a check counterfeiting scheme, according to authorities who say he gleaned bank account inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d60dc7233059b166cb8b67bb397daca8100252b2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6210CE5F-E777-44EA-BBFF-074141873FD7"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"36b23d19d0c5","org_name":"Valencia College","org_type":"technology_saas","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/mistake-put-personal-information-valencia-college-/nHWdn/"}],"summary":"Valencia College is apologizing after a mistake allowed the personal information of 9,000 current and prospective students to be posted online.  The school said an Excel spreadsheet with the students' names, address, date of birth, and student IDs was listed online on a password-","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33a6319d7604d4e7fc5043109b871df889016305","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"482ABC7D-B313-4A61-AF41-2E5E23DCB67A"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"107adfe17477","org_name":"US Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2012/October/12-tax-1287.html"}],"summary":"Corrupt mail carrier recruited into identity theft ring. Thieves would file false tax returns and have a debit card mailed to an address on the mail carriers route. Mail carrier steals debit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05d087b8f421c2f8bf84a8c4788b493ef66454bf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F9BC1E0-0793-41F3-A4A5-3C945ACB8840"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"082218617878","org_name":"US Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://freebeacon.com/darrel-issa-irs-officials-sent-private-data-over-personal-email-accounts/"}],"summary":"IRS Officials Sent Private Data Over Personal Email Accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e092fe3beed417900bad1db228e5cf87b86b4bbc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B08CF38F-268F-4E60-BE46-E91185819967"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca14786e0705","org_name":"US Federal Bureau of Investigation (FBI)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/09/24/usa-courts-leak-factbox-idINDEE98N00220130924"}],"summary":"\"Former FBI bomb analyst Donald Sachtleben agreed in September 2013 to plead guilty to disclosing national defense information for telling an Associated Press reporter details of a failed airline bombing attempt \"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e97337b9ba051722d6ad40d72ca613b0a19786c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80BDAF62-1415-4E35-91C2-B1C76C9344C1"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2619fb0127e7","org_name":"Upper Skagit Valley Casino Resort/Bally Technologies","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Multi-State_Skagit_1Leaf_Proofs%20(2).pdf%20-%20Adobe%20Acrobat%20Pro_0.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/upper-skagit-casino-resort-20121221.pdf"}],"summary":"A partner (Bally Technologies, Inc.) experienced a burglary from an employee's home office, which resulted in the theft of a computer containing customer data.  Data included name, driver's license number, SSN and bank account information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e40cccb28cf8f4a7c7dc1b1f24e1c447aaa5a53","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14E103D3-6790-45BD-83DE-C837FAB0373D"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aff54830d69e","org_name":"University System of Maryland","org_type":"education","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.idt911.com/en/sitecore/content/GlobalElements/KnowledgeCenter/NewsAlertItems/800694373.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.gazette.net/article/20120127/NEWS/701279589/1034/social-security-some-credit-card-numbers-were-stored-on-public-usm&template=gazette"}],"summary":"The University System of Maryland recently learned that the server it was using to store the Social Security numbers and credit card information of prospective students was open to the public.  The issue was discovered as part of a study by the state's General Assembly's Office o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24c8af9aca5b38d147af4e3d30be59e8cdda7ab5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3AC09D02-942D-4428-A485-220E33364507"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"bd474eb9b5be","org_name":"University of Victoria","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.saanichnews.com/news/137764458.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/british-columbia/story/2012/01/26/bc-uvic-data-theft.html"}],"summary":"Stolen information affecting the bank accounts of thousands of people would never have ended up in the hands of thieves if an existing policy was followed at the University of Victoria.  Before assigning blame, the school wants to wait for two reviews looking into whether an empl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f70b37b4d6bee5cca9720b5642b89c64d0ee4652","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA0CB7CB-7BF1-40A1-886E-ACF7C9683C8E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c3f97b309fd","org_name":"University of North Carolina Lineberger Cancer Center","org_type":"healthcare","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chapelboro.com/Hackers-Reportedly-Access-Thousands-Of-UNC-Lineber/15197571"}],"summary":"Thousands of people have had their private data publically exposed, after hackers reportedly got into a server at UNC’s Lineberger Cancer Center.  The Chapel Hill News reports that the victims found out shortly after Christmas, when center director Dr. Shelley Earp sent out lette","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57369e0155f91f4c13400c9a8eb2601e3b7c33c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7113E27-FDAF-493A-93AE-FE7FAEA66DEB"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"591ecb286664","org_name":"University of North Carolina","org_type":"education","ransomware":null,"records_affected":350000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/university-of-north-carolina-20120509.pdf"}],"summary":"Data were exposed to the Internet, including financial account numbers and approximately 350,000 social security numbers. The exposure has been  remedied, and the University is acting to alert people who may have been affected by this exposure. However, because of the size and na","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12f09aced2dcb8cd33ebe5ff04cf6b0c71a43f8d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED9DE82A-7933-473E-B37B-22E3E51B2628"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab1a922aee6f","org_name":"University of Michigan Health System","org_type":"nonprofit","ransomware":null,"records_affected":68500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.freep.com/article/20121221/NEWS05/121221077/Stolen-health-information-affects-4-000-University-Michigan-Health-System-patients,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedailyjournal.com/article/20130102/NEWS01/301020050/South-Jersey-Healthcare-tells-patients-data-stolen?gcheck=1,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sentara.com/News/NewsArchives/2012Archive/Pages/Privacy-Notice-for-Sentara-Healthcare-Patients.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wvec.com/my-city/hampton/Sentara-patients-may-have-been-victims-of-security-breach-185459822.html"}],"summary":"The University of Michigan Health System (UMHS) will be notifying approximately 4,000 patients some of their health information may have been stolen.  UMHS vendor Omnicell alerted the health system Nov. 20 that electronic equipment storing patient information was stolen from the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"033d9e183b5cc6fe17a71510b92f656b4d22781f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92053914-ECF9-4AF9-ABC7-01DCF4096379"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"73d752a35fc4","org_name":"University of Florida Shands Medical Center","org_type":"healthcare","ransomware":null,"records_affected":14339,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/university-of-florida-medical-clinic-acknowledges-security-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.ufl.edu/2013/04/03/potential-identity-theft/"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/04/university-of-florida-reports-patient-identity-theft-ring/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news4jax.com/news/Shands-patients-notified-of-potential-identity-theft-incident/-/475880/19575532/-/c176ufz/-/index.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://jacksonville.com/news/crime/2013-04-23/story/more-arrests-scheme-involving-identity-theft-shands-hospitals"}],"summary":"An employee working at a University of Florida medical clinic who had ties to an identity theft ring may have compromised patient personal and health information.  UF is notifying 14,339 patients of the UF&Shands Family Medicine at Main practice that they should take appropriate ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859d11d20cdba4ba825a7ceccbf822dd284bc702","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFA6DEFB-55AB-4672-9D1F-E3FF78B9DCB1"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1d96add406b","org_name":"University of Arkansas","org_type":"education","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/en_us/blogs/uams-alerts-patients-data-breach-linked-fired-resident-112712,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.uamshealth.com/breach"}],"summary":"The University of Arkansas for Medical Sciences is letting some 1,500 patients know their information was kept without permission by a resident physician after she was terminated.  The health care facility plans to mail impacted patients who had surgery or were seen by a neurosur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0bdb0fae07bfc51a6544e4bc346f363a1612c29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0012CC25-9167-40D8-8FE3-3D0DFD8FB6BB"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"fe241f259a53","org_name":"Universal Jobmatch","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.publicservice.co.uk/news_story.asp?id=21676"}],"summary":"Sensitive information belonging to jobseekers has been put at risk on the government's new Universal Jobmatch website, it has been reported.  The security flaw was uncovered during a Channel 4 News investigation. Hackers were said to have been able to register as an employer on t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c905bd683198d5f7b6ee3fcff050736f3ff53c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93F581E8-34F4-4905-9C67-879C0EB55691"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0189af7e255","org_name":"United States Post Office","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://menlopark-atherton.patch.com/articles/postal-worker-arrested"}],"summary":"A U.S. Postal Service mail carrier accused of stealing thousands of pieces of mail to provide credit cards to friends has pleaded not guilty to several charges and is expected to return to court on Thursday, San Mateo County prosecutors said.  Romeo Maniulit Natan, 38, pleaded no","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c22374fc26265fb8d458a869eae0e1e02e0b89d9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A7EF9EDE-121E-49B1-94E9-365F714FEB5B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3d860aaa2ae","org_name":"United States Navy","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2012/12/21/53358.htm,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2012/12/21/hitselberger.pdf"}],"summary":"A federal judge ordered home arrest for an American linguist accused of stealing national security secrets while working at a U.S. Navy base in Bahrain.      James Hitselberger, 56, is fluent in Arabic, Farsi and Russian. Global Linguist Solutions assigned him to the naval base i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2951a1521ba2387e889a810ae126355d1561a705","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A5EE892-E42F-4870-833B-86E8EE2CF8C2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c08deb919e22","org_name":"United States Army","org_type":"government","ransomware":null,"records_affected":36000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.app.com/article/20121228/NJNEWS/312280021/Hackers-take-data-36-000-people-fort?nclick_check=1,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240145376/ssns-salary-information-exposed-in-breach-of-army-servers.html"}],"summary":"Army officials have confirmed that cybercriminals obtained personal information of 36,000 people from multiple Army commands and visitors to the former Fort Monmouth base via a server hack.  The Army Communications-Electronics Command (CECOM) told The Asbury Park Press that the d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":"Ammon Cunningham","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e62e5e61ff3946fea66e2db0c5bcd7886a74282","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C1CFDE70-C50E-4380-8ED2-3A306AB1A4BC"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c6cc66cd465","org_name":"United Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.komando.com/happening-now/359401/hacked-united-airlines-data-stolen-and-sold"}],"summary":"hacked website and then sold tickets on craigslist","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"ammoncunningham"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a3e863c581ec66dc2e9682a84509288ce1a084e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"442E4333-25BD-4B06-966D-33B2EF6D178B"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a1d1e21c37a","org_name":"Unique Vintage","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Customer%20Notification%20Letter%20%2892312rv%292_0.pdf"}],"summary":"Retailer discovers malware on their online storefront which is copying off customer data including credit card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c640484e954d338d43280b9200dadb042c3682c6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19E55526-D875-4A1A-9E6D-D454DD72508F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"76535074a5e8","org_name":"Ulster Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.ie/business/irish/no-end-in-sight-to-ulster-bank-problems-causing-chaos-for-customers-26871744.html"}],"summary":"Bank had an IT \"glitch\" causing massive availability loss for at least 3 weeks, attracting attacks and fraud attempts. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb69459d3a972cc9df3ee15f03c25a27491bd368","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8CD420DA-23B3-4FC4-9206-268CDBC6FA88"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a02dad57aa5","org_name":"Twitter","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.usatoday.com/story/tech/2012/11/08/twitter-password-third-party/1691461/"}],"summary":"Twitter sent out e-mails to some of its users Thursday prompting them to reset their passwords because of possible security issues with third-party applications.  \"Twitter believes that your account may have been compromised by a website or service not associated with Twitter,\" t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"578df237e42b0fe9e5049cb5d8e4fdc8f369d704","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"c8489ae0-2da4-11eb-8132-47626699b560"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0236bfc10e4f","org_name":"Turret Labs","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://theloadstar.com/cargosprint-stole-our-tech-to-set-up-as-a-competitor-claims-software-developer/"}],"summary":"Turret labs had data about and designs of their product stolen by employee of a partner who gave up the data to Turret labs competitor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e128380f637ebf7b09ea392ba45b0359fe57ec2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6F33C831-FD34-4875-ADBB-C5AD1A9ED2A0"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"3859b10ebf2e","org_name":"TurkTrust","org_type":"technology_saas","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eweek.com/security/ca-leak-highlights-weakness-in-net-security-again/"}],"summary":"A Turkish certificate authority mistakenly issued two intermediate CA certificates to untrusted users, giving them the power to create a certificate for any domain. For the third time in two years, an incident at one of the hundreds of certificate authorities that underpin the se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"996e620eb747d07049f1e65f23f146e16931d1b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5133F18B-600C-474A-B8D9-FFC4CFF35928"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"TR","org_id":"fda5b50766ca","org_name":"Turkish ICA","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/articles/297770/20120213/turkey-opdigiturk-anonymous-ica-pastebin.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/14/turkish-information-technologies-and-communications-authority-hacked-and-lots-of-data-leaked/"}],"summary":"Part of #OpDigiturk. The Anonymous collective has hacked Turkey's Information Technologies and Communications Authority (ICA) and leaked information on Pastebin as part of an assault against a Turkish satellite provider.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01ff78b0288179000d21bf223328e9a6c302ea85","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D17DCFC-5501-4755-A817-20E977C2309F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c3cb530a6e1","org_name":"Trymedia/RealNetworks","org_type":"other","ransomware":null,"records_affected":12456,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/tm-acquisition-trymedia-20120113.pdf"}],"summary":"we recently became aware of the criminal intrusion into our ActiveStore web based storefront application that processes purchases of digital games made by customers on our partners websites. We believe the intruders may have been able to intercept and obtain cardholder names, cre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9f72f54a0e7a091d2da515276d3cfb15cc52240","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBC5F07D-AF57-4DD7-B702-AE6B48656189"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fff5464091c","org_name":"Trendnet","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tgdaily.com/security-features/61290-home-security-camera-feeds-posted-to-web"}],"summary":"Images of children in their bedrooms have been freely available on the web, following a security breach by webcam company Trendnet.  The breach affects thousands of feeds, and was caused by an error in code introduced nearly two years ago. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e72a32f042b13ff8f6a79956b76ac2ef2c2222db","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E15A7480-F2D6-4051-B229-104AF907EC75"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"455e6ce3a81f","org_name":"Tobacco Haven","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/tobacco-haven-20120727.pdf"}],"summary":"Point of sale computer found to have malware.  Processes were identified as taking snapshots of network traffic and saving aside cardholder data in a log file.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"173c97b3e83d8749a221454969959a6cedd39dc5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F62F4F4-FC9B-4CED-9A3A-33ED22C2B40F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebcaa95cf466","org_name":"Tiffany & Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/tiffany-co-20120905.pdf"}],"summary":"We were recently informed by J.P. Morgan Chase Bank that there was unauthorized access to chase his computer servers containing personal information of some employees. Chase told us that the affected servers, which contains certain information provided in connection with an emplo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9aac2b1d7edf4ac75fb6ef8cf0b57462c728e513","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84C0B399-4B36-43F7-B34A-744B471E8C7B"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cc615bd4a51","org_name":"The Kirkbride Center","org_type":"healthcare","ransomware":null,"records_affected":922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kirkbridecenter.com/Information%20about%20Identity%20Theft%20Prevention/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/12/17/florida-healthcare-data-breach-may-lead-to-identity-theft/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kirkbridecenter.com/Information%20about%20Identity%20Theft%20Prevention/"}],"summary":"An individual in Florida was recently arrested and tried for causing a healthcare data breach that compromised patients PHI.  The arrest of one individual soon led to the realization that patients protected health information (PHI) had been compromised.  A small number of paper d","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"586e973fecb1e22fd1c1a37e52062ef6d828119e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6AD36141-ADEC-44F3-A224-4CE0B38716E4"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bb8383c302dd","org_name":"The Home Depot","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/home-depot-20120416.pdf"}],"summary":"An employee accessed certain HR information for unauthorized purposes, with what appear to have been failed attempts to misuse the information to obtain fraudulent credit cards.  The information included name, contact information, SSN, driver's license numbers and financial accou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"IR","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e596f50e9c8af50cb4309790718a679d8bd814de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAE8DFA2-3603-4BC5-9AE9-EE9FB7270779"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IR","org_id":"b54a3afcc0b8","org_name":"The Central Bank of the Islamic Republic of Iran","org_type":"financial","ransomware":null,"records_affected":30000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://threatpost.com/iranian-takes-credit-pos-hack-spills-three-million-bank-accounts-041712/76448;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/google-kills-iranian-blog-with-3-million-hacked-bank-accounts/11779"}],"summary":"3M payment cards dumped onto site by security researcher. Unknown if he used privileged knowledge (Misuse) or discovered and exploited a security hole (Hacking)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fceda42713c5ec09291fc15f2d5bf3dc36bdf330","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EE17BB5-3445-4FC9-995F-F954DE6B8526"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"f59e69637b58","org_name":"Tertiary Education Commission","org_type":"professional_services","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.odt.co.nz/news/dunedin/239614/stolen-research-staff-details-unlikely-be-recovered"}],"summary":" A stolen briefcase containing the private information of 500 research staff from tertiary institutions, including more than 140 staff from the University of Otago, will likely never be recovered, the Tertiary Education Commission (TEC) says.  The briefcase, which contained evide","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fc606158f4a880bbdd37ec156a17c8586ab8abb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4002848-E677-4F04-9DC1-72378517AFB7"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6109224cf946","org_name":"Temple Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/data-on-600-patients-stolen-from-temple-community-hospital-in-los-angeles.html"}],"summary":"Temple Community Hospital in Los Angeles has warned 600 patients that their personal and medical information was breached when a computer was stolen from a locked office in July, according to a Los Angeles Times report.  The computer contained CT scans of patients, patient names,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":"Comment group","variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afc07b3bbd87b590f0094b0e3e830b9745a1a80a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CE82D11E-951C-40B2-89D4-642BCF39F097"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"4895f66664d8","org_name":"Telvent Canada Ltd","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2012/09/chinese-hackers-blamed-for-intrusion-at-energy-industry-giant-telvent/;http://www.computerworld.com/s/article/9231748/Energy_giant_confirms_breach_of_customer_project_files"}],"summary":"Chinese hackers plant malware on victim computer systems and gather information about SCADA products.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"commentgroup"}},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71445285c48114d566ea862b4b5eae09d6ff2804","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CD224D4-B007-4213-A865-0C7F86E09DC7"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a2b1fce3a4d","org_name":"Ted's Jumbo Red Hots","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.buffalonews.com/apps/pbcs.dll/article?AID=/20130128/CITYANDREGION/130129128/1002"}],"summary":"Restaurant chain suffers POS intrusion. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c696fa71b7d96479d008db85fb100c8bf754ef2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB15495D-F4C9-4543-B8E4-8D844CE21499"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f006cc20fcee","org_name":"TEC Industrial Maintenance & Construction","org_type":"energy_utilities","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/account-takeover-utility-sues-bank-a-7190/p-2"}],"summary":"Company has banking credentials stolen via malware and numerous fraudulent transactions occur.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39de73f6d23508a1d490c9b8f629207f07fa8adf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CB53E4A-7B25-4E90-8F23-81F1849DE456"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b327a9365739","org_name":"TD Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Customer%20Notification_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/td-bank-20121012.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/td-bank-security-breach-notice-ltr-to-consumer.php"}],"summary":"Two backup tapes were lost containing name, address, SSN, account and debit/credit card.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6113dabe305dcdddcfac482301fddcb56607490","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DEB455D0-1D65-44A9-B03E-9511E0C82640"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4e7e2d41c1bb","org_name":"Tampa General Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/second-tampa-general-hospital-employee-charged-in-patient-identity-theft-for-tax-refund-fraud-scheme/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tbo.com/news/crime/second-tgh-employee-accused-of-identity-theft-tax-refund-fraud-20160203/"}],"summary":"Medical documents were found in threat actors' car during traffic stop. She was using the info to commit tax return fruad","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9d72915e46629d94e67980085beb6dc42386455","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60E66832-7DB6-45C1-903D-5E779A65995B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9b7a327774d","org_name":"Surgeons of Lake County","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://go.bloomberg.com/tech-blog/2012-08-10-hackers-steal-encrypt-health-records-and-hold-data-for-ransom/"}],"summary":"The Surgeons of Lake County, located in the affluent northern Illinois suburb of Libertyville, revealed last month that hackers had burrowed deeply into its computer network, infiltrating a server where e-mails and electronic medical records were stored.  But unlike many other da","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c8c11b2ec2693820e4ca3b9092cf32c61efce358","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8ACCEF4-8E4E-456A-8144-974880BBCF58"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64d8e88e45f5","org_name":"Sunshine Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-press.com/story/news/crime/2015/02/19/naples-man-pleads-guilty-medicare-fraud-identity-theft/23670121/"}],"summary":"A Naples man has pleaded guilty to multiple federal charges related to a Medicare fraud scheme between 2009 and 2012 involving Sunshine Pharmacy and Sunshine Solutions Pharmacy in Collier County.  Adam Parrish, 35, admitted to seven counts of conspiracy to commit health care frau","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b178d01cee5df6b984cd8c8ffb6677fbdb6f01b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0618B6D-51B7-40CA-831B-64DFD6AF2FE5"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44989ed314e0","org_name":"Sully's Superette/CCR Data Systems","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sullys-superette-20120725.pdf"}],"summary":"point-of-sale content unit was compromised company was notified by city from services and Secret Service is suspicious that these were occurring during credit card swipe at the store. Technicians also examined the computers and certain suspicious processes running on the point-of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cdfa6930427581700a3724bda68d652d31e65f05","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"089D303D-E0F2-4429-9A8F-5240A5BA429E"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2afeb7d3fc1b","org_name":"Stoke City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://staffslive.co.uk/2013/04/21/dumped-pupil-records-and-lost-ipads-among-stoke-city-council-data-breaches/?goback=%2Egde_4636751_member_234933076"}],"summary":"Lost memory sticks lead to potential data disclosure.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4d6a87954a6a140f6f6570c812d51866547710a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25CEB94A-C768-47CE-AA4D-0094438E6CE2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a138697310d","org_name":"Steubenville High School Football Teams Website","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://deadspin.com/5971165/hackers-take-over-steubenville-high-school-football-teams-website-threaten-to-release-personal-information-of-people-involved-in-alleged-rape-case"}],"summary":"Hackers who claim to be from the groups Anonymous and KnightSec have taken over the Steubenville High School football team's website, posting a video and message demanding an apology from those involved in the alleged rape that took place in August involving players of the footba","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e44f35191a53c1c22e08f0c882e4068f2a71a1d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF31FC1E-9CF5-4262-82A2-DA74C4175C45"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39be97317ff3","org_name":"State Farm Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/ISRR%2010051307%20-%20U%20S%20LETTER%20-%20BOOK.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/ISRR%2010051307%20-%20SINGLE%20CUSTOMER%20LTR.pdf?"}],"summary":"Employee used customer information inappropriately.  The informatino mya have included names, addresses, CCN, and SSN.  Employee may have also used the credit cards they took to purchase concert tickets.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d41c50481296ab17dfa464593b8dada3965ed50","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94ED35C9-1E26-4DFC-AF80-09D7D745DAB8"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1cf2528c377","org_name":"Staples Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://harrison.dailyvoice.com/news/mamaroneck-staples-cashier-charged-181k-fraud"}],"summary":"A cashier at the Staples in Mamaroneck has been charged with stealing, then selling, 50 customers' credit card numbers, leading to $181,800 in credit card fraud, according to a Westchester County Police press release.  Valerie Fajardo, a 21-year-old from the Bronx, was arrested a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2e42abdf58fe381532cc5a5ca5282260d39de93","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"341E1FB3-72A5-4F2C-9B65-77213DEFF69F"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29ebe2a26dd9","org_name":"Sprechman & Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sprechman-20121113.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/sprechman-and-assoc-security-breach-notice-ltr-to-consumer.php"}],"summary":"a former employee of the company may have viewed names addresses dates of birth and Social Security numbers without permission.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb9fee1e2b984b75e84e53453aa40ef7302ecb3e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D6B2D40-1247-4701-9A4D-793C0291AE3B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"67d24f3b0951","org_name":"Spellman High Voltage Electronics Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach-asc"}],"summary":"A disgruntled employee announced his resignation and then was caught copying files from his computer to a flash drive.  Employees at Spellman began experiencing transaction and intranet disruptions after the disgruntled employee left even though his access to company servers was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0ad0531950607523a504581caf564995c8555ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C4452FC-A60E-4D38-BC66-8EDFAB131AF0"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1fc48a80e6aa","org_name":"South London Healthcare Trust","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/04/16/south_london_healthcare_trust_loses_memory_sticks/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.evault.com/cloud-connected-recovery/the-uk%E2%80%99s-biggest-data-loss-disasters-of-2012/"}],"summary":"In the second incident, the lost memory stick contained the names and dates of birth of 30 children, and full audiology reports for a further three children.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a3c306795bacbec1d9446dfa51063b37b3b7133","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9568C11D-27C8-4410-A89E-4A2C7D3C4940"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"3508b282af30","org_name":"Softbank Corp.","org_type":"professional_services","ransomware":null,"records_affected":261161,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23715"}],"summary":"    A software sales company affiliated with Softbank Corp. said Thursday that personal information related to up to 261,161 customers may have been compromised from its database due to fraudulent access.      Vector Inc. based in Tokyo said data that may have been stolen include","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"29634a6daef913fad61e507882bc3bab077417bc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7DCE9AD1-2138-4DAA-BEDE-9FAF49B81B59"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"da7551bd4155","org_name":"SINA","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.marbridgeconsulting.com/marbridgedaily/2012-01-05/article/52705/sql_injection_attack_exposes_sina_passwords,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com.au/News/349585,28-million-clear-text-passwords-found-after-tianya65279-hack.aspx"}],"summary":"Chinese online security website Youxia.org today revealed a security loophole in Chinese internet company Sina's (Nasdaq: SINA) iAsk search engine that exposes user passwords.  According to the site, iAsk is vulnerable to an SQL injection attack that allows access to the iAsk dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94c7d908d11bb22ade865e89942b23f1e5cf452f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C1EE90AB-4B8F-493F-A2CF-6FA383679C72"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e8ece2d75674","org_name":"Silver Star Motors","org_type":"retail_ecommerce","ransomware":null,"records_affected":25,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.daily-chronicle.com/2013/01/30/cortland-car-dealership-owner-charged-with-id-theft/ab2qnpq/"}],"summary":"The owner of a Cortland used-car dealership was charged with seven counts of identity theft Wednesday for allegedly using his customers information to take out phony car loans.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e58c331f2fe4b3cadba5444fc733be830df5c2c0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D4A5799-88D3-411E-B6DD-9CE2DE5546AF"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"338d66b80d4d","org_name":"SHIELDS For Families","org_type":"healthcare","ransomware":null,"records_affected":961,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9771;"},{"fetched_at":null,"title":null,"type":"press","url":"http://1shields1.ipower.com/hipaa/"}],"summary":"Individuals stole the program's computer server where personal information was stored; as well as a server, monitor and keyboard. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5fbab681addb89736ed8ac3fd282d8738286a090","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2398ba30-9a6b-11e8-8652-5d096cfefbb4"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3ca1a6bb4cf","org_name":"Select Rehabilitation Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.postandcourier.com/news/mount-pleasant-speech-therapist-convicted-of-health-care-fraud/article_993b32dc-91cd-11e8-a94c-17d1c0cad32c.html"}],"summary":"A Mount Pleasant speech therapist charged last year in a health care fraud scheme was convicted this week following a federal trial.  A jury found Gena C. Randolph, 44, guilty Thursday on three counts of making false statements relating to health care matters.  She was also found","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7df4d6e17b1bc6ec3fb83d53c30f21f9c3db67c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"698DD436-3B6E-4F02-886D-2894EF211108"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8394e541cec3","org_name":"Sarasota Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/news/national/florida-hospital-worker-stole-dead-patient-credit-card-info-hours-dies-police-article-1.1123008"}],"summary":"A heartless hospital worker in Florida is accused of swiping credit card numbers from a patient who had died only hours earlier.  After pocketing the information last month, police claim, the 53-year-old staffer paid for airline tickets, phone bills and even bridal shoes.  Margar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b06727b69bfce75c23f7a1ad4bdde8a9e47cd2b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4ABAB245-B300-43B0-AA00-D4952BDACBDB"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83b0612c4853","org_name":"Sailboat Owners, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":2258,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/sailboat-owners-20120320.pdf"}],"summary":"The company is a small business which has maintained a retails sales website at shop.sailboatowners.com.  On Feb 23, 2012, staff noticed unusual activity on the web server, which led them to suspect that the network was under attack.  They immediately shut the site down and retai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c560206268793236d0a4e8e754efaf3261f9d87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8EC8D370-F657-40C4-A8C2-9E38635E4DE2"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ccc0ad77d801","org_name":"Safeway Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/bayarea/article/Safeway-to-pay-nearly-10-million-in-waste-case-5995203.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/california-prosecutors-settle-phi-breach-18997/"}],"summary":"Safeway Inc. agreed to pay nearly $10 million after a two-year investigation revealed that the Pleasanton-based company was improperly disposing of hazardous materials like medications and batteries as well as customers medical records, prosecutors said Monday. The $9.87 million ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb3fa84a250ae02cbe370e87dcd9d971abce517e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA68CBC1-0A0E-44DB-B830-EADAB10E334E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71956579fa43","org_name":"S2 Games/Heroes of Newerth","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2012/12/hackers-breached-heroes-of-newerth-and.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Heroes-of-Newerth-Suffers-Password-Security-Breach-315895.shtml?utm_source=ForumSoftpedia&utm_medium=ForumSoftpedia&utm_campaign=ForumSoftpedia"}],"summary":"Hackers gained access to user passwords after breaching a third party software application that interacts with their account database.  No credit card or billing data was exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d6074c4c9248d7e8549387dee02df0860e36563","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8031762-723D-4DD9-A533-0C2ACD0BC708"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a25593f2fa4a","org_name":"Royal Canadian Mounted Police","org_type":"government","ransomware":null,"records_affected":5,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.nationalpost.com/2014/12/16/rcmp-broke-privacy-laws-by-sharing-medical-histories-of-officers-report/#__federated=1;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ca-rcmp-broke-privacy-laws-by-sharing-medical-histories-of-officers-report/"}],"summary":"The RCMP committed a serious privacy breach and broke federal privacy laws when it shared sensitive medical information about five of its officers while throwing accusations at their psychologist, according to a privacy commissioners report written last month and obtained by the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b10cfbb08cc6faff3b4f8886d9a6d5ecb8c89da5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0f312330-c491-11e7-9a8b-47d1b690bc01"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c057c3bc8dd0","org_name":"Roseway Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/nova-scotia/shelburne-roseway-hospital-privacy-breach-patient-records-1.4165051"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f05d0c9074a5200f72356de4ac48d84d5eab971d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9A5B00A2-C242-4017-8A7F-D8C823D3E48B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547d1d573418","org_name":"Riverside Health System","org_type":"healthcare","ransomware":null,"records_affected":2318,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailypress.com/health/dp-nws-security-breach-riverside-20140729,0,1160235.story;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2014/07/riverside-health-warns-2000-possible-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2014/07/cancer-hard-enough-and-then-data-theft-too"}],"summary":"Cancer.  It's a word that makes people tremble. Even when a case is curable, the stress on patients is indescribable.  We all know that. Everyone has been touched.  Preying on people with cancer is one of the most despicable acts imaginable. Yet that's exactly what one Elizabeth ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0824b6742036d8fc245bc8b156263d413a2c2dd1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85A30797-10F5-483C-8BCD-0576F93D3A3F"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00a55fa9b9df","org_name":"River Falls Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/04/river-falls-medical-clinic-announces-patient-data-breach/#.UQ_77ybLrSo.twitter"}],"summary":"Perhaps the Office for Civil Rights (OCR) was so specific with subcontractor language and breach notification amendments in the HIPAA omnibus rule for good reason. Similar to many recent healthcare data breaches, River Falls Medical Clinic notified about 2,400 clients of a breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"AU","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"becf8f3a2741a2c367733cd6874cbac66801274f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ED3973D-1F1F-43A5-9D42-C22A38E0A65F"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0f8c08bc467","org_name":"Riot Games, Inc.","org_type":"professional_services","ransomware":null,"records_affected":24500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.neoseeker.com/news/23672-league-of-legends-hacked-north-american-player-information-at-risk-new-security-features-coming/"},{"fetched_at":null,"title":null,"type":"press","url":"http://beta.na.leagueoflegends.com/en/news/riot-games/announcements/important-security-update-and-password-reset"}],"summary":"Security breach at Riot Games results in exposure of some personal information and salted passwords.\nHere's how he claimed it happened: During their first bout of bruteforcing passwords in the 2012 North America attack, Duffy's group obtained details for a senior staff member. Aw","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df2819aa8a67c5d9fbb9e64ab46ae3c214a71fa2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73EAF6FA-8643-4431-8E5C-A02D71197E6D"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f8fecd6c390","org_name":"Quest Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/quest-diagnostics-20120817.pdf"}],"summary":"in 2012, a former Qwest Diagnostics employee inappropriately forwarded e-mails that included personal information to their personal e-mail address. The information included some or all of the following data: name, address, Social Security number, date of birth, driver's license n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fe8664f58617245d85d0fe85c602a53867a273cf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80BA819B-DB2B-4F4B-8A4C-B4154C7F84B8"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"40425c1b6c1e","org_name":"Pure Med Spa","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"A Las Vegas woman got quite a surprise as she drove around looking for empty boxes to store her holiday decorations. She found some near a dumpster but they weren't empty. To her surprise they were packed with medical records. So she emailed Action News wondering how they got the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80a65022d5a770abc696c32d327caea7411b89c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BFB4053-8110-4110-B57C-57019FA0F0FE"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1bc956e618dc","org_name":"Providence Holy Cross","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/providence-holy-cross-employee-in-california-allegedly-posts-patients-record-on-facebook.html,"}],"summary":"A staffing agency employee who worked at Providence Holy Cross Medical Center in Mission Hills, Calif., allegedly posted a patient's medical information on Facebook to make fun of her and her medical condition, according to a Los Angeles Daily News report.  A printout of the empl","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ba683949304a89e1ed1245c3b9f626cda899f81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B64BDED3-227A-443D-98FD-92A7EF9563A9"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"26e36305cd59","org_name":"Prince Albert Parkland Health Region","org_type":"healthcare","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/employee-in-prince-albert-snooped-into-ex-husbands-daughters-medical-files/"}],"summary":"It was alleged that the ex-wife   a combined laboratory and x-ray technologist in the Prince Albert Parkland Health Region  snooped into the records of the ex-husband and their daughter and also tested the daughter's urine.  However, with respect to the urine, there were no recor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f85d3f9ddec8a692107f78427dfff0f19b9c4d85","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D05399A-7834-43CD-B409-0C6E598CB608"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aabf217d194b","org_name":"Postcard Press/Next Day Flyers","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/postcard-press-next-day-20120605.pdf"}],"summary":"Company discovered an electronic file on  its system that was storing transaction information, including name, address, email, and CCN for customers who placed orders through its website.  NDF does not know if it was accessed, or how it was created, but it detected the file near ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"104e09b4452feac54e56f9ee036baa11840922c6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E269CD10-324E-4B1F-ACA2-5C251804D123"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f81aa2db6f2","org_name":"Planned Parenthood","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cdph.ca.gov/certlic/facilities/Documents/PlannedParenthoodOfTheNorthValleyAPBreach230009277.pdf"}],"summary":"Clinic worker snooped on medical record of patient who was dating her ex-boyfriend.  Then sent text messages to the patient saying she would tell everyone that the patient had an STD.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d38619615b31f06b26b6d62c0f61aeb0f5a51ff","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F431B29-C3F0-400A-9D93-3C4AEC034DB6"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db7a838050cb","org_name":"Planet Smoothie","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"An employee was caught stealing customer credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cda282c13eeeb1a48005c8aa4de9dbcd51a1d756","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E63EC79C-E36F-4781-9080-86728DCA15EC"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0d6ba364f77","org_name":"Philip P Corneliuson, DDS, Inc.","org_type":"healthcare","ransomware":null,"records_affected":980,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=10516"}],"summary":"A computer was stolen from the office suite.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d38f3649f9ca088902b954705b351680d1167e8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13F31F2B-6032-4DAC-B2B9-912240BE906A"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a5973a3eed04","org_name":"Peterborough Regional Health Centre","org_type":"healthcare","ransomware":null,"records_affected":280,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mykawartha.com/news/article/1597294--class-action-lawsuit-filed-against-hospital-former-staff-and-fleming-college;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thepeterboroughexaminer.com/2013/10/23/student-felt-backlash-after-prhc-privacy-breach"}],"summary":"A student in Fleming College's practical nursing program at the time, Hopkins said her private medical records were inappropriately viewed by her college instructor, a PRHC nurse, who shared the medical records with Hopkins' classmates.  The allegations, which have not been prove","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"84468f87ce8a7e643ff96e63972dd6bb0dccaf85","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7A6FA8A1-CA05-4562-8D30-B491FC15E171"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"318a04918fb7","org_name":"Pepperdine University","org_type":"education","ransomware":null,"records_affected":8300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pepperdine-graphic.com/headline/laptop-theft-compromises-information-of-8300-campus-community-members/"}],"summary":"President Andrew K. Benton sent an email today informing the university community that a laptop computer belonging to an authorized university employee was stolen from that individual’s car. This laptop had been used extensively in work related to the IRS, “and it contained data ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85ecdd249be45f154b648f7ab6f4284e7150007f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08433415-5E29-4AB9-854F-51461B623013"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f15999052cd","org_name":"Penn State University","org_type":"education","ransomware":null,"records_affected":1406,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblive.com/news/allegheny/3207432-74/information-university-breach"}],"summary":" Penn State University officials on Friday began notifying former students of a security breach on a computer server that contained 1,406 Social Security numbers for enrollees at the Altoona campus before 2005.  An operator at Penn State's call center said officials were alerted ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f28cd8510fc42c2d3a9c541480318e8365b89605","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0A1ECCD-F001-42B7-B32B-B0CD5793067B"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3b5762df17a","org_name":"Patriot Self Storage (CubeSmart Management, LLC)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/patriot-20120203.pdf"}],"summary":"Files that contained customer lease documents were missing that contained personal information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"129c579d3b3bb9d9e6cb72d455ae16839b5857d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"938CB631-16DC-4C8A-948A-D3B08F21A8EF"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"59f52e4be6f6","org_name":"Panpacific University North Philippines","org_type":"education","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Indian-Hackers-Leak-Data-from-Panpacific-University-North-Philippines-269806.shtml"}],"summary":"Indian hackers called Harsha Vardhan Boppana and codie root have breached the website of the Panpacific University North Philippines (punp.edu.ph).  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b07c641b74206f0e104427fc7a932c839ab945e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C17077E-ABD9-45D3-87E3-E7E39C1E349F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"ff6db88c7cb9","org_name":"Panasonic","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Panasonic-Hacked-Visitors-Redirected-to-Other-Website-248049.shtml"}],"summary":"The official Chinese website of Panasonic, the world renowned manufacturer of electronics and high-tech gadgets, has suffered a data breach at the hands of a hacker named Q-R3ST; who is from India and part of a hacker group named Vatan.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d6c969d1221771969ea5b5ac7bb1c67cef8b3b8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DED3BBE8-1435-409C-9819-508289359404"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b78cb73092f9","org_name":"Palos Verdes High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/01/27/students_hack_teachers_computers/"}],"summary":"Three high school juniors have been arrested after they devised a sophisticated hacking scheme to up their grades and make money selling quiz answers to their classmates.  The students are accused of breaking into the janitor’s office of California's Palos Verdes High School and ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"474be95903cd35b6ace8f8fe42c44c26ce114e39","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A8464B81-FEE8-4DA1-AF3A-3688D89C5682"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5fbbce18479a","org_name":"Palo Verde Hospita","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://paloverdevalleytimes.com/main.asp?SectionID=1&SubsectionID=1&ArticleID=19838;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/palo-verde-hospital-warns-patients-of-data-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/legal-regulatory-issues/former-palo-verde-hospital-executives-file-suit-against-board-healthcare-district.html"}],"summary":"Palo Verde Hospital administrators released a statement Wednesday which concerns possible HIPAA violations. Hospital administrators released the statement, in addition to, mailing letters to patients.  Palo Verde Healthcare District (PVHD) recently became aware of a breach of pro","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecbdda2ed5dbf8de349e088a24b5b78a0f734936","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AD3E592-0F4A-454D-B0EE-6428340D9178"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b3520fe8c717","org_name":"Palo Alto school district","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.paloaltoonline.com/news/2013/10/15/family-says-teacher-breached-sons-privacy;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pogowasright.org/family-sues-palo-alto-school-district-alleging-breach-of-sons-medical-privacy-and-discrimination/"}],"summary":"Teacher disclosed medical condition of student to another parent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5499bb787ad30aee44d0d0a98014927ea0ed7716","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E8BD2DA-233B-435F-AF46-14281EB04F74"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12a3df862552","org_name":"Palm Beach County Health Department","org_type":"government","ransomware":null,"records_affected":86,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/palm-beach-health-department-employee-steals-patient-names-social-security-numbers.html"}],"summary":"The Palm Beach County (Fla.) Health Department issued a public notice that at least 86 patients of its health centers may have had confidential information in their medical records disclosed to an unauthorized source.  The breach occurred when an employee created a client list co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"216398815fb492c7af9fe938fd765d698b6d7e23","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"322AD2A1-BB2A-4257-9B48-93C01E5928E3"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PK","org_id":"c8fb623f6607","org_name":"Pakistan International Airline","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://propakistani.pk/2013/08/20/travel-agents-stole-rs-72-million-worth-of-e-tickets-from-pia-website;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehackerspost.com/2013/08/cyber-crime-pakistan-international-airline-pia-72-million-etickets-stolen.html"}],"summary":"Glitch in e-ticketing application allows travel agents to make free airline reservations on Pakistani airline for over a year.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a23e66c6746ff93f43fd89c75ae3f80242c5107d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43B9EC0C-B789-4F1B-84EA-BD83E8A3B74A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e90ee0d9b2a5","org_name":"Orvis Company, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/orvis-20120323.pdf"}],"summary":"Partner who hosted website and provided auction software that accepts registration and bids for merchandise may have been accessed by an unauthorized person.  Partner indicated that although they had not conducted a forensic investigation, they believed that its computer network ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"870274fa3cd2c5042bb82a0ac73a63bbaa642b88","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3815F0DE-0635-4FF1-A04C-DAF7F3824888"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8fd6e8be8c02","org_name":"Opus Trust Marketing","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Thousands of workers' pay details were sent to others due to printing error. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a8331c9e62d0bef2a83303c064e2015897fa37d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F9A864B-1627-4A00-B91E-42EBC0B79EAD"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"78c5b8b9ed52","org_name":"Ontario Elections Board","org_type":"government","ransomware":null,"records_affected":4000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/toronto/story/2012/07/17/ontario-voter-data-breach.html"}],"summary":"Ontario's chief electoral officer has said the personal information of voters in as many as 25 ridings in the province has been compromised.  Greg Essensa said at a Tuesday morning news conference that Elections Ontario can't account for two unencrypted memory sticks containing i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e29ec5395c1a0cfeaa9927e7c344482fa6012d8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6EDF5178-3809-4611-B25E-A550246F4E72"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7193bb242a40","org_name":"Office for Nuclear Regulation","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-tees-17073049,"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.evault.com/cloud-connected-recovery/the-uk%E2%80%99s-biggest-data-loss-disasters-of-2012/"}],"summary":"A memory stick containing a safety assessment of a nuclear power plant in north-east England has been lost by an official, it has emerged.  The unencrypted USB pen drive, containing a 'stress test' safety assessment of the Hartlepool plant, was lost by an employee of the Office f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fab08275430f8a7b464f292bf4f6d9fb2969bf1c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A65406B2-F60B-43A4-945B-0E3010D3CCF2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DK","org_id":"e32a289a6838","org_name":"Obiblio","org_type":"technology_saas","ransomware":null,"records_affected":4933,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"E-mail addresses and hashed passwords dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb21f605407847f918ac7c5bc6130466c01d70b0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"652BF8D8-80F7-4A08-B13D-78987548D87A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa26c471ba5a","org_name":"Oakland Vision Services, PC","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc1ba750343b611c0acbab6efef7848ba18d7db0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A043544-A409-4AF4-B523-A01058883661"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1fb2ba90425","org_name":"NYU Langone Medical Center","org_type":"healthcare","ransomware":null,"records_affected":8400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/8400-patient-records-are-vulnerable-following-theft-at-nyu-langone-medical-center.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/computer-with-patient-data-stolen-from-nyc-hosptial/article/252618/"}],"summary":"A desktop computer storing personal health information for approximately 8,400 patients was stolen from NYU Langone Medical Center in New York City, according to an SC Magazine report.  The computer was stolen from the faculty group practice office of John Golfinos, MD, the chair","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a5bf135a792e4d2b9b621ea2cb09edc96dc2af9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9DC451B-A8F3-4DD3-BE28-AD306490AD10"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24c3d3b36a22","org_name":"nychiefs.org","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hackmageddon.com/tag/nychiefs-org/"}],"summary":"Anonymous dumps some emails from NY Police Chiefs (nychiefs.org).  The leaded documents contained mail spools for 10 NY Police Chiefs, over 300 usernames and md5-hashed passwords for all NY Chiefs and several \"Law Enforcement Sensitive\" and \"For Official Use Only\" documents.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0235cc2214030efba0cf353a6af1888f6689404","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2E3F2A0-C0CB-4ADE-8281-C99368C3EA92"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa4e0c30ba49","org_name":"NVGA Gymnastics","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.loudountimes.com/index.php/news/article/applicants_personal_information_stolen_from_ashburn_business898/"}],"summary":" Applicants personal information stolen from Ashburn business Friday, Dec. 7, 2012 by Crystal Owens | 0 comments | Email this story  Several applications containing the personal information of applicants for NVGA Gymnastics in the 44600 block of Cape Court in Ashburn were stolen ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4984b10fecca5c9a090b0b0023f6fa6bf7293a9c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66B1D96B-A72A-4BBE-B547-661C9A2EC058"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a8b8d435b65","org_name":"Northwest Florida State College","org_type":"education","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tampabay.com/news/education/college/hackers-heist-300000-records-from-florida-college/1255854"}],"summary":"A massive security breach at Northwest Florida State College has affected 300,000 records in the school's computer systems, including information on about 200,000 students statewide who were once eligible for Bright Futures scholarships, the school said Wednesday.  The compromise","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b3da7c4bc0fa61fd9a83d422944e65e6278917c1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"504800A3-3FAB-4567-A1CE-49C06225F713"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21d7a1f7f35c","org_name":"Northrop Grumman Corp","org_type":"manufacturing","ransomware":null,"records_affected":31,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Personal information was dumped onto the Internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"82fdda4a668102d4a4053d3bdea4121114b97527","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27B69538-B0F7-4613-93B0-424E641C007F"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db79ed64a880","org_name":"North Shore University Hospital","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abclocal.go.com/wabc/story?section=news/investigators&id=8617099"}],"summary":"There was a breach at North Shore University Hospital that resulted in private health records being stolen.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be19836c2a430e0d959e8d0d506f9c0df67246ef","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DFBF5F2-74E7-425A-AE12-13234751A946"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ebe9de5161ea","org_name":"North East School of the Arts","org_type":"education","ransomware":null,"records_affected":1253,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"External hard drive containing student applicant's information was stolen from a teacher's vehicle.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"565c43bf48ad42151bae94e6d049fbb77b6330f6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44645C08-C310-4B19-BDD4-BF6B529775BA"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e69cac5e9054","org_name":"North Cumbria University Hospitals NHS Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsandstar.co.uk/news/cumbrian-patients-data-left-on-train-1.921755?referrerPath="}],"summary":"Patient information from North Cumbria's hospitals were lost on a train. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2eb24ba14ceff08e7ed2f816ce7ad2704469ecca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD9F7ECE-111C-4013-8C24-0063160523AB"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b7ccf5767f17","org_name":"Norfolk General Hospital","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/nurse-sacked-snooping-patient-files;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.delhinewsrecord.com/2013/08/13/norfolk-general-hospital-notifies-1300-of-privacy-breach"}],"summary":"Insider (nurse) viewing customer records without work-related purpose","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1d58d917118df86480432cec37d5b4f6a04b4c8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72BFC2AA-31F0-436E-9196-D73C2C40A95D"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac2e2e1e1f9e","org_name":"NJ Lenders Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.northjersey.com/news/police-arrest-11-in-connection-with-identity-theft-englewood-department-helped-contribute-to-case-1.642868"}],"summary":"Police were able to identify a connection between all the victims, who had recently refinanced or applied for mortgages at NJ Lenders Corporation, a mortgage brokerage company based in Little Falls. The company kept customer files in a Paterson warehouse called C. Marino Records,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01aca48ff35e649c93dc7a822e7d4ffb4116294b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CA2EE94-F4D7-4E11-9EC4-44CED0422B7C"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c2620a34cad","org_name":"Nissan Motor Co.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/virus-causes-nissan-data-breach-a-4698;"},{"fetched_at":null,"title":null,"type":"press","url":"http://nissannews.com/en-US/nissan/usa/releases/statement-nissan-is-taking-actions-to-protect-and-inform-employees-and-customers-following-an-intrusion-into-the-company-s-global-network-systems?la=1&download_url=%2Fen-US%2Fnissan%2Fusa%2Freleases%2Fdb7532f4-1e6e-4b5c-bc51-54f07b4dc502%2Fdownload%2F825faf56-0ccf-4f70-8210-394656dadd32"}],"summary":"Malware placed on Nissan Motor Co.'s network allowed user IDs and hashed passwords to be transmitted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"16c595ac9e23367f47785b2bb74134de95eb7b7d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70EB2D8F-14B6-4767-8DAA-5789B43A1628"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1403b3f55b8a","org_name":"Nippon Express","org_type":"transportation_logistics","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/53393"}],"summary":"Information on 900 employees were found in possession of a licensed nurse who may or may not have been affiliated with North Shore University Hospital  that was arraigned in another breach case.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ff265d4a76c610685880611dd65bb06abad3042","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B2E0B9B-B4D8-4AAC-B438-F7AB82611771"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NG","org_id":"1fded4d5d6a7","org_name":"Nigerian Society of Chemical Engineers","org_type":"manufacturing","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Names, addresses, phone numbers, academic degrees, title or position and dates of birth dumped on the Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ca5dea558aa29661e0de66a35172a5d74170ba5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B33FCE7-F4A6-4A04-9B9F-2347098845AD"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"3a4e94fce121","org_name":"New Zealand Corrections","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.voxy.co.nz/politics/another-govt-privacy-breach-nz-first/5/143158"}],"summary":"Corrections spokesperson Asenati Lole-Taylor says the latest breach happened when an individual who wanted to visit an inmate was sent official forms to apply for permission.  \"This individual was sent an envelope with the official forms - but the envelope also contained the pers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6c10b3ce693197d5903d82af7bda067eb271c23","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89D43975-81FB-4918-890F-B969C29CE35B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c3f45b85898","org_name":"New York State Electric & Gas, Rochester Gas & Electric","org_type":"energy_utilities","ransomware":null,"records_affected":1800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/CA%20customer%20letter.pdf?;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/new-york-rochester-gas-electric-20120123.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.infolawgroup.com/2012/08/articles/data-privacy-law-or-regulation/data-breach-at-new-york-utility-prompts-enforcement-action-and-industrywide-data-security-review/"}],"summary":"An employee of an independent software development consulting firm (contracted by NYSEG and RG&E) allowed unauthorized access to one of our customer information systems.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f3f62fa06a9dcc1098e7f98c1084052c8b3f7bd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58875861-EDCA-4492-9167-D3445D05295E"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8586fa9c3f6f","org_name":"New York State Department of Health","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/nys-inadvertent-release-to-adoptee-of-birth-mothers-identity-leads-to-reforms/"}],"summary":"Inadvertent release to adoptee of birth mother's identity leads to reforms - New York State.  New York State Inspector General Catherine Leahy Scott yesterday released a report of an investigation that found the State Department of Health's (\"DOH\") complex and antiquated storage ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"98a8ea987eec1c2c9e62ae4a9a7382a77ee22f29","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82C81C0B-CFF3-4B01-882A-6E9CFADD892A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a461b3c8f1b6","org_name":"New York State Association of Chiefs of Police","org_type":"nonprofit","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/law-enforcement-targeted-by-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/antisec-dumps-e-mail-and-contact-info-for-nys-law-enforcement-groups-but-which/"}],"summary":"One of the files in the data  dump is a passwords file with 340 first and last names, usernames, MD5 passwords (some decrypted), and e-mail addresses. A second file, addresses, contains 1,348 entries consisting of agency address, cell phone number, email addresses, first and last","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d688cc28a26a0a876c43ff9fa7f61d8160367bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE347B09-DA7F-4AA3-A4FC-A0F7AA494905"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2760666401c4","org_name":"New Jersey Health Department","org_type":"government","ransomware":null,"records_affected":481,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2012/12/19/nj-health-department-apologizes-after-privacy-breach-in-email-to-medical-marijuana-patients/?utm_source=dlvr.it&utm_medium=twitter"}],"summary":"Some medical marijuana patients in New Jersey are upset that an email from the state health department included the email addresses of all recipients.  The state e-mailed more than 480 registered medical marijuana patients to tell them not to call the state, but instead to call t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c611c750c91ce2758015fdbcdbabbfe9521149a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BC2C0E0-98D0-4B90-A76E-4DF7EF569385"},"incident_date":"2012-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0641111efbcc","org_name":"Neurocare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/neurocare-20120709.pdf"}],"summary":"Neurocare was notified by its payroll processing vendor that it had received instructions from Neurocare to re-route a suspiciously large number of employee automatic payroll deposits.  As Neurocare had not provided such instructions, the account was immediately disabled by the p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"292d045203f49244e70d7d6ab6567a8a7a8b865f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BC9393D-B583-4F5D-BB1D-D3B686415716"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d99dcf417bbf","org_name":"Neighborhood Christian Clinic","org_type":"healthcare","ransomware":null,"records_affected":9565,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Lost device contained data on patients. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"612f90d1879b955d0370eb20039aa455ce10cb76","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"144EDA15-5D58-4D4F-BD26-9D1973AFE370"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"8a66e1ff8cc9","org_name":"Nefesh Bnefesh","org_type":"nonprofit","ransomware":null,"records_affected":594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=22776"}],"summary":"Anti-Israeli cyber attacks resulted in a dump of emails from Nefesh B'Nefesh (NBN)  that consisted of people signing up for meetings or workshops.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"522f919c308b74db436f277eb35f30d40a604166","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ACA22495-BD4C-4BE1-B779-BCF7DC3F5C08"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"4cfb682ef82e","org_name":"NDB (Swiss Intelligence Agency)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2012/12/04/us-usa-switzerland-datatheft-idUSBRE8B30ID20121204"}],"summary":"Secret information on counter-terrorism shared by foreign governments may have been compromised by a massive data theft by a senior IT technician for the NDB, Switzerland's intelligence service, European national security sources said.  Intelligence agencies in the United States ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5033529a1519e67fff76160423f230dda0778bd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8B62DB02-F770-43ED-84F4-7449FD816B71"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RO","org_id":"0cdf692c8add","org_name":"NaturEnergy","org_type":"energy_utilities","ransomware":null,"records_affected":200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.technewsworld.com/story/74718.html"}],"summary":"A security breach has allowed for users information to be posted onto the Internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad2f2eeb47446a1611f964cb74d44f4526fc183f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7D688DE-5C52-4E39-A3B0-2F89683CCCC4"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"634013703b72","org_name":"Nationwide Insurance Company","org_type":"financial","ransomware":null,"records_affected":1100000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/news/2012/120712-nationwideallied-security-breach-highlights-litigation-264896.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationwide.com/notice.jsp,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.turnto23.com/money/dont-waste-your-money/nationwide-insurance-company-hit-by-security-breach_43236964,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/PE%2320121003-127_letter%20_Final%20Template__0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/nationwide-security-breach-notice-ltr-to-consumer.php"}],"summary":"The Nationwide Mutual Insurance went public on Wednesday with notification of an Oct. 3 break-in of a computer network also used by Allied Insurance. Data stolen from the insurers included names, Social Security numbers, driver's license numbers and birth dates. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f93801b16c4507e3e0051183826cc256e684fbd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6B76A22-BC42-47D7-BB8C-84F25103399D"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SG","org_id":"44d6a44e2598","org_name":"National University of Singapore","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/singapores-nus-confirms-security-breach-2062303396/"}],"summary":"Hackers have infiltrated the National University of Singapore's (NUS) backend systems and made away with a trove of information, including staff usernames, domain information and hashed passwords. University has confirmed the incident but noted that the affected data is not confi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3af75e678112b03ef28858cd9d6cbe70765ac29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"899E1901-C5E9-4E78-9360-5EC02933F680"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NG","org_id":"07b7a93ff64d","org_name":"National Examination Council Nigeria","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/12/24/national-examination-council-neco-of-nigeria-hacked/"}],"summary":"The official school website of National examination council (NECO) nigeria(www.necoschools.com) has been breached by the hacker collective ‘NIGERIAN CYBER ARMY SQUAD.22′.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90f33bb3fc7b562efdce01e034400459eb9119d3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"825D4121-F611-4D37-B9E4-571D927FB582"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12e1322e56a7","org_name":"National Endowment for the Arts","org_type":"nonprofit","ransomware":null,"records_affected":13,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Personal information was dumped onto the Internet. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0fc4aa676d30e90db4d2068937d59a927dd236c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79803C56-9631-44C0-BB0D-6D0AD657DD8D"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"85da02b0a8d4","org_name":"National Democratic Party (NPD)","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://m.ibtimes.com/anonymous-spank-naughty-neo-nazis-opblitzkrieg-hack-275692.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/articles/245458/20111108/operation-antisec-anonymous-hackers-expose-finnish-parliamentary.htm,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/01/04/anon_op_blitzkrieg/"}],"summary":"Members of Anonymous have re-doubled their offensive against German neo-Nazis.  The hacktivists of Operation Blitzkrieg this week launched a WikiLeaks-style website that aims to expose members of the far-right National Democratic Party (NPD) and other extremist groups, Der Spiege","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"868a4f60f960a762dc2f2af91dfc76cc364efffe","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74A0F529-A445-4EC3-8F8B-2DFE9ED8156E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b79e30cfceb","org_name":"National Capital Planning Commission","org_type":"government","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Personal information and job titles were released on the Internet. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d27bf5778125506944ef504eb11a844814550b81","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"014876A1-AC39-452B-91CC-C714C3F1D79D"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"749d7aec979c","org_name":"NASA Jet Propulsion Laboratory","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://latimesblogs.latimes.com/lanow/2012/11/jpl-workers-call-for-probe-into-nasa-personal-data-breach.html"}],"summary":"On Oct. 31, a NASA laptop was stolen from a parked car in Washington, D.C. NASA workers whose unencrypted information was on that computer were not immediately informed, but have since received notification from the space agency that data gathered for background checks conducted ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56388d77d377bb0ad371ba178dcdf9e65bed3e34","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10567C90-A00F-473C-A312-CCE52CE23400"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe47e14600c0","org_name":"NASA Interagency Advanced Power Group","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://geinvestigations.com/blog/2012/05/page/2/"}],"summary":"NASA, Air Force and Harvard Computers Hacked by a group known as ‘The Unknowns’","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e42a3e293b1e66ff56aa8f475fc12fb27c6ef398","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D6B9AE7-CF26-40D1-8121-4B25755DDE2B"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"758251e546d0","org_name":"Naperville Unit School District 203","org_type":"education","ransomware":null,"records_affected":10,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://triblocal.com/naperville/2012/01/26/report-cards-mistakenly-delivered-to-emergency-contacts/"}],"summary":"Naperville Unit District 203 may not get very high marks in the subject of report card distribution this semester.  The district recently learned copies of some high school students’ report cards were accidentally sent to the person listed as their emergency contact.  Chief Infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"remote_desktop","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c24ee39961691baaef26f520c7cb4aac236acb6e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"479B903A-60C8-4775-B40C-4FEB6BEC7FC1"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"ce596e7d22de","org_name":"Namesco Limited","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/01/13/namesco_phish_like_security_warning/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/01/13/namesco_phish_like_security_warning/page2.html"}],"summary":"Namesco reports a warning after credit card info leak through a third party hack.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"237926aa2dbc9c934e5d9096316d3cad75b26fbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A23FCDE-049D-4C34-BA43-2C1F3E0001F1"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PY","org_id":"409d08e44503","org_name":"Mundo.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/24/venezuelan-public-defender-and-two-other-sites-hacked-by-hacker-claus/"}],"summary":"A person or a group called Hacker Claus has dumped information from three separate websites.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ef69e335995f75b79519ed08c5f5b637a1654c0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"930A66AB-DE5F-42D1-9FE4-3513D150E0E6"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"69dac87a611b","org_name":"Motorola Mobility Inc.","org_type":"manufacturing","ransomware":null,"records_affected":6200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/motorola-mobility-20120203.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chicagobusiness.com/article/20120203/NEWS08/120209906/tablet-snafu-motorola-says-not-all-data-wiped-from-refurbished"}],"summary":"Motorola Mobility Inc. says some of its refurbished tablets have been sold with previous owners' data still intact on the devices.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e14e813adbeb9f6e03f7e541ab64dc61439314da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62436D3D-21C6-48E4-81B2-2847A9071120"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SE","org_id":"01e00f70eb1e","org_name":"Mortal Online","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tentonhammer.com/mortal/news/mortal-online-security-breach-leads-to-mischief"}],"summary":"A security breach that led to the destruction of in-game assets and account status changes at Mortal Online.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f344dcf95b51828f7947e967b2d9edc6b6495193","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1061E9DC-9CDE-4579-9B46-133F7AC65C7A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"93d2ae13c85f","org_name":"Moodie Report","org_type":"financial","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Names and usernames, with encrypted and decrypted passwords dumped on the web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07dbaf12fffebc205de1cfd85903896634067011","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79880588-3949-4199-BCCF-B258DAED4C7D"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"249645dc4872","org_name":"Montreal Police Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/montreal/ex-montreal-officer-arrested-for-alleged-leak-to-hells-angels-1.1928324"}],"summary":"A former sergeant-detective with the Montreal police who specialized in fighting biker gangs has been arrested for allegedly selling information on open police cases to the Hells Angels. The investigation demonstrated that he had transmitted pertinent information to organized cri","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20b05ee2931c63f43eec7ec2b15ce95e95cbf03b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F2BB805-EBEB-469A-8DDF-F0DD08F4FBF5"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"42a5e360bca7","org_name":"Montana State University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/montana-state-university-20121221.pdf"}],"summary":"Documents on a network storage device were left unencrypted and available on the network for a month and a half.  The device had been decrypted and reset to factory settings in order to troubleshoot a problem.  It would only be accessed on the internal network.  It contained stud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d1c62e13a6e7c28d208f4998192df8d479ccfc98","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"692D46BC-8BBB-4881-833A-29D3143B29AD"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f7e75d0389d","org_name":"Monroeville 911 dispatch center","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.post-gazette.com/stories/local/neighborhoods-east/feds-accuse-monroeville-911-dispatch-center-of-violating-hipaa-privacy-rules-680970/"}],"summary":"The U.S. Department of Health and Human Services is investigating allegations that proprietary information from Monroeville's 911 dispatch center was released in violation of federal privacy law.  An August 2012 complaint to the department's Office for Civil Rights alleged the mu","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e3fcfb7adcaeccb05e6fee635a92aa1d7569336","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA178310-F00A-4860-A3B7-91AF8B31068A"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f63e21c99ba","org_name":"Mo Money Taxes","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23385"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc24.com/news/local/story/Personal-Information-Found-Dumped-Behind-Mo-Money/jLsP5acBpkirlMxPHLVxvw.cspx"}],"summary":"Personal information was found dumped behind the office of Mo' Money Taxes.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"873dfb30bc17b211c8cf12177245588775dd1b14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"205F95B3-02A4-4A7A-B2D4-E096271B65AC"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7999399184c3","org_name":"Mission Linen Supply Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Customer%20Notice%20Letter%20word%207%2020%2012_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/mission-linen-20120724.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/mission-linen-supply-co-security-breach-notice-ltr-to-consumer.php"}],"summary":"On or about June 29, 2012 we received word from one of our customers that several of their employees had reported unauthorized charges on their credit cards. As you probably know, we are in the business of selling uniforms, apparel and related items. Many of these sales take plac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3034647a4841df97900ee8e663d1d9ab7f8be670","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32B511FC-EE16-4F2F-A95E-5963851B603B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ddcd5b6f89d","org_name":"Minnesota Department of Public Safety Driver and Vehicle Services (DVS)","org_type":"government","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kare11.com/news/article/974638/391/Personal-information-of-3700-Minnesota-drivers-leaked"}],"summary":"The Minnesota Department of Public Safety Driver and Vehicle Services (DVS) announced Friday that the personal information of 3,700 licensed Minnesota drivers has been compromised.  An internal audit revealed the illegal access. DVS says there are no indications that the data is ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"874f7f93349f69d2a686f7d89f137ff8ee6e1bfc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44024B76-5DD7-4E66-B209-ED3F1CF4B205"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5564b40d792d","org_name":"Minnesota Department of Labor and Industry","org_type":"government","ransomware":null,"records_affected":350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.twincities.com/crime/ci_24026416/state-ex-worker-stole-269-ids-public-employees"}],"summary":"Group of employees steal identifying information from their workplace for ID theft purposes","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5392c77d4fba48a2d7f598a985c6ed55c3b5c1a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"749CE13F-FE0B-4FE6-A16A-72D56132F2CC"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6341783bcab","org_name":"Minneapolis City Hall","org_type":"government","ransomware":null,"records_affected":3370,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/local/minneapolis/184365241.html?refer=y"}],"summary":"A top Minneapolis employee facing a criminal charge of misusing driver's license records argued in court Thursday that he's being unfairly targeted for a practice that was rampant at City Hall.  After 37 years as a city employee, housing inspections director Tom Deegan was put on","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01c01ce49a86fcab1f1f9017e0b489418fcfdd32","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A9BF0327-BB36-4565-B14A-F7715B642152"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LB","org_id":"3f865ee30966","org_name":"Ministry of Economy & Trade","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Breach-the-Lebanese-Ministry-of-Economy-and-Trade-255263.shtml"}],"summary":"Mad HackerZ Team, the Lebanese hackers, managed to leak data from the server on which the official site of Lebanon’s Ministry of Economy and Trade is hosted. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51c24dcb609f66ee734de409ede4421b1236363b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1ACE76A7-BC75-47F1-832F-F3FD00706618"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a2f1b52e13f","org_name":"MiniMins.com","org_type":"professional_services","ransomware":null,"records_affected":80461,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/80-000-User-Accounts-Leaked-from-MiniMins-Com-260677.shtml"}],"summary":"A hacker called Le0nB3lm0nt breached minimins.com, a popular weight loss support forum, leaking the website’s entire database, totaling 80,461 record sets.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed4226e9b2ab6ee308999806704f1e517cfc689b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E720BFE-B609-4E63-8781-34706C569080"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"54a40e3594bd","org_name":"Millard High School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23032;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wowt.com/news/headlines/Student_Allegedly_Admits_Hacking_Schools_Computer_Network_138229584.html"}],"summary":"A student at Horizon High, an alternative high school in Millard Utah, has hacked into Millard High School's computer network.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fde1e1befaf1b58b4dee1adef907f78c4afc80a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6B68837-DA55-41C7-97B1-0E9FFFB8AF02"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76fc1334a314","org_name":"MilitarySingles.com","org_type":"technology_saas","ransomware":null,"records_affected":163792,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://securitywatch.pcmag.com/none/298270-lulzsec-exploited-photo-upload-tool-in-militarysingles-com-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23736"}],"summary":"LulzSec Exploited Photo Upload Tool in MilitarySingles.com Breach. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c216c88b43571852d83527f1dd5427a73292fd3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7E573571-5DA3-4E02-B042-114693E29EA6"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"09fdb97d7c33","org_name":"MidCentral District Health Board","org_type":"government","ransomware":null,"records_affected":133,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/manawatu-standard/news/8018794/Data-breaches-parents-sent-private-details"}],"summary":" MidCentral District Health Board is grappling with two separate data breaches after 133 parents were sent letters containing personal details of other people's children.  The Manawatu Standard revealed yesterday that Palmerston North woman Zelda McConachy was mailed other patien","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c89f62ea6fdcac5dcb9a15ccf3ee0008b231857","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8407B29E-AD2A-40F5-BA39-AE6C4A876247"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"ca60f2dc053d","org_name":"Microsoft Store India","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/249927/microsoft_india_store_a_victim_or_poor_data_security_not_hackers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://content.usatoday.com/communities/technologylive/post/2012/02/hackers-breach-database-of-microsofts-india-store/1"}],"summary":"A chines hacker group exposed customer data due to poor data security at Microsoft India Store. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"11016dc072ab132c26d30885472aca030ebef67c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A337C1D3-2976-4E7E-9751-95EAE2B51A00"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2204c6a98e58","org_name":"Microsoft Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theguardian.com/technology/2014/mar/20/former-microsoft-employee-arrested-over-windows-8-leaks;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconrepublic.com/enterprise/item/36198-ex-microsoft-worker-arreste;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.seattlepi.com/local/article/Ex-Microsoft-employee-charged-with-passing-5331715.php"}],"summary":" A former senior software architect at Microsoft has been arrested and charged over allegedly stealing Windows 8 trade secrets and passing them along to a tech blogger in France.  Former senior architect Alex Kibkalo, apparently because he was unhappy with a recent performance re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb2a95b65c8b209e45a9b7cd09b05fe8a308f1f7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2C18727-29D8-4558-97F0-5AA2D2BF34AA"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76de0ced7794","org_name":"Michigan State University","org_type":"education","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2012/12/msu-database-hacked-and-leaked.html"}],"summary":"An Anonymous hacker named DARWINARE has claimed to have breached the Michigan State University server and compromised the database.  He has published the stolen database in AnonPaste.  It consists of about 1500 login credentials. The leak contains sensitive information including ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd2d3c44b79010d07f1cdf6fed82a78709e936f6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50B355C7-176B-42D9-8305-35AA80419D63"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dd6396caf50d","org_name":"Michigan Department of Community Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://americanindependent.com/218779/not-so-confidential-hiv-testing"}],"summary":"Since 2003, the Michigan Department of Community Health has been secretly collecting the names, dates of birth, risk categories, and other demographic information of people submitting for confidential HIV testing at grant-funded locations throughout the state and storing them in ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e9eb1531dadc84120730c6c52c2202f3b9cd167","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6512f7f0-c4fe-11e9-8a5a-abdcbb867af8"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e531b088ed2a","org_name":"Metropolitan Council","org_type":"government","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.nashvillescene.com/news/pith-in-the-wind/article/21083101/metro-to-settle-lawsuit-after-exposing-employee-social-security-numbers"}],"summary":"    In June 2015, former Metro employees, Michael and Margaret Abbott, were informed by the Internal Revenue Service (IRS) that they were victims of identity theft and that someone attempted to file a fraudulent tax return in Michael Abbott’s name. In August 2016, the Abbotts lea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0551b2876f8fc6370e2e51a72143fd8fb85febcf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44377EFD-99D0-45A4-863B-492F93CB6CAC"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AR","org_id":"e296c4c2b477","org_name":"Mercotour.com","org_type":"other","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/06/09/9000-accounts-leaked-from-mercotour-com-by-nrtnz/"}],"summary":"Accounts were leaked by a hacker named @nrtnz. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6df4fb0c7ee529f2bf9742748b3f1779c42a73f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"aca999f0-9730-11e7-a11c-5542f7e3819f"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b240126fded0","org_name":"Memorial Healthcare Systems","org_type":"healthcare","ransomware":null,"records_affected":115143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://wlrn.org/post/florida-company-pay-55m-over-stolen-patient-information;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/local/broward/fl-reg-memorial-hippa-settlement-20170217-story.html"}],"summary":"The company that operates six South Florida hospitals has agreed to a $5.5 million settlement with the federal government over patient information that was stolen by two employees. The South Florida Sun Sentinel reported Friday that Memorial Health Care systems reached the agreem","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51f06f774541ae01b0319744c17899f5691081ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AB34EE5-4DCE-4BBA-8D85-FC037913C53A"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74b6c8fab656","org_name":"Mecklenburg County Department of Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/mecklenburg-co-social-worker-pleads-guilty-in-connection-with-medicaid-fraud-scheme/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.charlotteobserver.com/2014/10/23/5261647/mecklenburg-social-worker-pleads.html#.VE66M0uFr7Q"}],"summary":"A social worker with the Mecklenburg County Department of Social Services pleaded guilty Thursday in federal court after prosecutors said she sold childrens identities to people who then filed fraudulent claims with Medicaid.  Ieshia Hicks Watkins, 33, of Charlotte, pleaded guilt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"abca8573e2ac796b977fec715cb70df638a851b3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDD62757-900C-4E5C-965A-FEF39F672C33"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9f39debc5fd1","org_name":"McGill University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/24439/mcgill-shuts-down-website-that-published-confidential-donor-data/"}],"summary":"A website called McGill-Leaks website published confidential data on school donors, including names, addresses, phone numbers and the amount they donated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0df2103bdb2bfcefca0a753d54257b4206379bee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10F2CD0B-3DC2-46BC-92B9-D449244FE9C9"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6d6261191e5","org_name":"Massachusetts Mutual Life Insurance","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/national-financial-20120413.pdf"}],"summary":"Partner misdirected electronic file to another client.  Exposed data includes client name, address, SSN/Tax ID Number, account number, username, holdings, balances and historical account level data.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e76366bcdf9f66b0858c126bdc2471ea4a8dbeb5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE910780-7E6B-4791-A64C-63290A2BD021"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e0d61aff3d0","org_name":"Masons of California","org_type":"nonprofit","ransomware":null,"records_affected":4056,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Personal details including names, addresses, phone numbers, and emails dumped on the Internet. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"183fcc76043e6ba578b53f12361989f24b988f11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96D6C6C4-D2EA-4720-A87B-4711FAD6BC5D"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b23e91033041","org_name":"Manpower UK Ltd","org_type":"other","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=22947"}],"summary":"One of the data controller’s employees had emailed a spreadsheet containing the personal data of over 400 individuals to 60 employees in error.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b1f9dcdca27e93c489ec6937c01e64f6136d5a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"012E4242-E4BD-4B44-9C3C-DC4DBBD190E6"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21fd21f70dcf","org_name":"Mangement of Aggressive Behavior Training International, Inc","org_type":"education","ransomware":null,"records_affected":1763,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Management-of-Aggressive-Behavior-Site-Hacked-User-Credentials-Leaked-273217.shtml"}],"summary":"Hackers part of the Anonymous-affiliated k0detec collective have gained unauthorized access to the systems of MOAB Training International.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb2fea9c0ed70e97b839a26e14ff7fa97ba9b6e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99800B97-2383-45CA-98EA-8DC3290D343D"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"1893bc2e7e54","org_name":"Macquarie University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/au/breach-at-macquarie-uni-hackers-claim-1-million-plain-text-passwords-exposed-7000008199/"}],"summary":"Macquarie University has had one of its sites breached and defaced over the weekend in an apparent show to demonstrate that its servers' security are not being maintained to a sufficient standard.  On Friday, one of Macquarie University's web applications, designed to assist inte","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cb979adc708721e72cf8c495829b76b40d9aaab8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0143B312-F58E-4BA0-B20D-4D048F4AC9A4"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6a9b3c924af","org_name":"Luxor Industries","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/patient-medical-records-found-in-dumpster-in-florida.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox4now.com/news/local/183093551.html"}],"summary":"Hundreds of patient medical records were found in a dumpster in a Fort Myers, Fla., strip mall Dec. 11, according to a Fox 4 News report.  An individual was looking through a dumpster for cardboard boxes to help him move when he stumbled upon what appeared to be patient medical r","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b65bb0c815f90aeb60f91ed7e60b666016fcf05","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42994604-BC7C-4088-A4B5-16F3CC362C43"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5979d1d57054","org_name":"Lutheran Community Services Northwest","org_type":"healthcare","ransomware":null,"records_affected":3040,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=9806;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lcsnw.org/bremerton/pdf/BreakInNotice.pdf"}],"summary":"Computers and electronic devices were taken during break-in at Lutheran Community Services Northwest.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ec78dd1ba06d12ea74395b19459153e9a5c80d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F955EA7-CBDF-4082-99C7-E14633007257"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"825589179b7c","org_name":"Lustigen Taschenbuch","org_type":"technology_saas","ransomware":null,"records_affected":24000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=24425;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.iol.co.za/scitech/technology/security/user-data-stolen-off-publisher-s-website-1.1312834#.UUdwmzeRfp0"}],"summary":"The publishing house that issues Donald Duck and Mickey Mouse comic books in Germany alerted fans on Tuesday that its website had been hacked and data on thousands of users stolen. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00cdd854d8b2ca022f29a0b71949c0fcf1056aeb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2D75685-8F63-4E79-8C0E-C0B256CF2415"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5247f0cd42c8","org_name":"LSU Health","org_type":"other","ransomware":null,"records_affected":400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox44.com/news/nerves-rattled-identity-theft-involving-lsu-health-employee,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wafb.com/story/20260440/almost-400-victims-identified-in-massive-identity-theft-scheme"}],"summary":"LSU Health is already working to restore its reputation after an employee allegedly stole the identities of hundreds of patients.  Authorities say roughly 400 patients from Louisiana and beyond have to go through the process of reclaiming their lives.    Police arrested seven peo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"923a7337bd6dae22cca1bfe4c66f16da91b8031e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B7B5C12-FBDF-4A51-BB77-30BC24CB11E8"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9ebfaa00faac","org_name":"Loyalist Certification Services Exams","org_type":"education","ransomware":null,"records_affected":202,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"E-mail addresses and passwords dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39f5ef44b5473b989cb5382be7af817ce7fff40b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1280FEE-FABA-4A89-9DE4-A0583E07E98B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"ebd908f8eed2","org_name":"Loongson","org_type":"manufacturing","ransomware":null,"records_affected":223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/17/chinese-cpu-maker-loongson-hacked-and-data-leaked-by-muldaria48/"}],"summary":"Anonymous hacker @muldaria48 hacked Loongson and data was leaked. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43d6132509b872c0c615911a0d9b691ed85259ec","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21B66CD7-B7DA-450D-B7A5-735B940981CD"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50dc3992458a","org_name":"Long Islands Head Injury Association","org_type":"nonprofit","ransomware":null,"records_affected":56,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/new-york/health-center-worker-stole-identities-patients-severe-brain-injuries-filed-fake-tax-returns-refunds-officials-article-1.1062539"}],"summary":"Dozens of victims of severe brain injuries had their identities stolen by a man who worked at the New York center where they were treated, a prosecutor said Monday. The suspect then filed phony tax returns with the Internal Revenue Service and in at least two states, pocketing ov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4ff2413b004e5375954061f2162abc7d8272c07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E0735263-146D-448A-ACD3-68BAA2759E0F"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"111cb0181bfc","org_name":"LogMeIn","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2012/12/logmein-docusign-investigate-breach-claims/"}],"summary":"Customers of remote PC administration service Logmein.com and electronic signature provider Docusign.com are complaining of a possible breach of customer information after receiving malware-laced emails to accounts they registered exclusively for use with those companies. Both co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1655db81feaaac41d4e83a387b183208dfb5aa0a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"153B36F0-9AC1-47AB-A506-CD0CE76F4B8D"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9a5b20d2a24","org_name":"Logan Community Resources, Inc.","org_type":"healthcare","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0585966da7cc1e00aa05b73a14be25f2585a8ff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF033213-06B9-4021-BB56-DAB66E5EDBDF"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"311d0f59d792","org_name":"Local 2-Hospitality Industry Child & Elder Care Plan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Final%20Notice%20%28C%26E%29_0.pdf?"}],"summary":"On August 13, 2012, following an investigation of a missing portable device (USB drive) containing Child and Elder Care Plan participant files, we determined that the USB drive has been inadvertently lost.  The data on the USB drive may have included your name, SSN, and address. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8421607407b77ae9085b9cf2ab9132c9af5a37d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E19FD70C-B8BA-4C1F-ADCF-2E6205F8B661"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7f37fca0b3c5","org_name":"Lloyds Banking Group plc","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Three-Lloyds-TSB-Clerks-Used-Hacking-Device-to-Steal-Money-from-Customer-Accounts-439202.shtml"}],"summary":"Three Lloyds Clerks Used Hacking Device to Steal Money from Customer Accounts","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f7b417a5afa5942f76b550f31f8a749f9d60530","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56aca960-3598-11ec-9ec7-15e66f657ea5"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1e6f0e026fe","org_name":"Livejournal","org_type":"technology_saas","ransomware":null,"records_affected":26000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.zdnet.com/article/26-million-livejournal-credentials-leaked-online-sold-on-the-dark-web/"}],"summary":"26 million LiveJournal credentials leaked online and sold on the dark web","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37b042620961bf9fff40b6bd91087f3c40efe7e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C3191ED-C7CD-4272-9465-F5B538218F98"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3b8cf264cdc","org_name":"LinkedIn","org_type":"technology_saas","ransomware":null,"records_affected":6400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2012/06/07/us-linkedin-breach-idINBRE85511820120607;http://www.zdnet.com/blog/btl/6-46-million-linkedin-passwords-leaked-online/79290;http://www.scmagazineuk.com/linkedin-to-pay-750000-in-security-breach-settlement/article/367603/"}],"summary":"LinkedIn Corp is working with the FBI as the social network for job seekers and professionals investigates the theft of 6.4 million member passwords, the company said on Thursday.  The company does not know of any accounts that were taken over as a result of the security violatio","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"965f6de3ce6cdeef24e49a8007d40b03952fa09f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C679AE9-95A6-4E23-B3F4-BBF4D4BE244F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4fb7e1f637a","org_name":"Lindenwood University","org_type":"education","ransomware":null,"records_affected":180,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stltoday.com/news/local/education/confidential-lindenwood-university-student-information-posted-on-twitter/article_7c20d51c-67d6-11e1-8114-001a4bcf6878.htmlhttp://www.stltoday.com/news/local/education/confidential-lindenwood-university-student-information-posted-on-twitter/article_7c20d51c-67d6-11e1-8114-001a4bcf6878.htmlhttp://www.stltoday.com/news/local/education/confidential-lindenwood-university-student-information-posted-on-twitter/article_7c20d51c-67d6-11e1-8114-001a4bcf6878.htmlhttp://www.stltoday.com/news/local/education/confidential-lindenwood-university-student-information-posted-on-twitter/article_7c20d51c-67d6-11e1-8114-001a4bcf6878.htmlhttp://www.stltoday.com/news/local/education/confidential-lindenwood-university-student-information-posted-on-twitter/article_7c20d51c-67d6-11e1-8114-001a4bcf6878.html"}],"summary":"The Twitter account held in the name of @LindenLeaks for Lindenwood University published a document listing the names of students suspended last semester.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b229790f012179b5a7d96bfe9259e48dcaff76cc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0864F07D-F0D0-4DB7-BFFC-0F97E30CE8FB"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"62b116452f52","org_name":"Lewisham Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/news/politics/council-spending/9751236/Lost-data-blunders-costing-councils-1.9-million.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.evault.com/cloud-connected-recovery/the-uk%E2%80%99s-biggest-data-loss-disasters-of-2012/"}],"summary":"A social worker left papers containing sexual abuse allegations in a plastic bag on a train in one of a series of blunders that saw fines for data breaches at councils hit £1.9 million. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf21712a3cda111229caeff1d64b18df70dfdd81","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4869BEE-929E-4F46-BB2F-B1DC61C3127A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05dc32a6ceed","org_name":"Lewis-Clark State College","org_type":"education","ransomware":null,"records_affected":7000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.krem.com/news/local/LCSCs-student-records-targeted-by-hackers-147179385.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.krem.com/video/yahoo-video/Lewis-Clark-State-College-server-hacked-unknown-if-information-stolen-147396335.html"}],"summary":"A computer server holding student information from Lewis-Clark State College was hacked. The hackers accessed a database of around 7,000 student registrations.  The database includes addresses, phone numbers, the last four digits of credit cards and Social Security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa5d8ba868e92b203237cf42666c1445d4fef9be","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31F035FF-B2BE-4128-99DD-B56DDEBA9A9B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b4d05d4e1270","org_name":"Learning Disabilities Resource Community","org_type":"education","ransomware":null,"records_affected":132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Names, usernames, email addresses and passwords dumped on the Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b43c5e7dd913b19fb2e4e05c00887589dc1594e9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4A6B0E2-2F6E-4162-BA7D-6E63449DF726"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"5ada787f1c36","org_name":"Le Muse Societ Cooperativa","org_type":"other","ransomware":null,"records_affected":109,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Usernames, encrypted passwords and decrypted passwords acquired and dumped by hacker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f17495104ad5e50dcebedb1579023588e1359750","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"037B7432-60E7-4B1D-8904-0A1D513DB382"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6b45def6ca59","org_name":"Last.fm","org_type":"technology_saas","ransomware":null,"records_affected":2000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.csmonitor.com/Innovation/Horizons/2012/0607/In-wake-of-LinkedIn-hack-Last.fm-confirms-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.csmonitor.com/Innovation/Tech/2012/0713/LinkedIn-Last.fm-now-Yahoo-Don-t-ignore-news-of-a-password-breach?nav=topic-tag_topic_page-storyList"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/last-fm-investigating-security-issue-passwords-leaked/12358"}],"summary":"The music website, Last.fm, was hacked and user passwords were leaked.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78667142951643d4f8183e3a1c1e86a358fe9639","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59045243-98F3-421C-8096-9EB26E3B2AA9"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9d8da7bce68","org_name":"Lakeshore Mental Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/01/lakeshore-mental-health-institute-leaves-patient-data-exposed/"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/09/19/nhc-healthcare-oak-ridge-loses-unencrypted-backup-tape/"}],"summary":"Old documents for Lakeshore Mental Health patients were found at the doorstep of an abandoned building. A location where these files were stored had been vandalized in 2012, and it is suspected that they were stolen at that time.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cc1c5754cb39b1716702c368c07cd8c844fd844","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E78DB20-F398-44CB-9075-3E7E673D14C8"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec634dcb22e5","org_name":"Lake Worth Independent School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach?order=field_breach_total_value&sort=asc&title="}],"summary":"It is suspected that a former employer accessed the personal information of employees and could have misused the information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3fda04c97e492f4e28306dffd61179b8a6bea11","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DBDAE09-AC5E-43AE-A5C1-C88DFC4EB175"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f6ff9fd3fa4","org_name":"Lake Braddock Secondary School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/education/fairfax-officials-2-lake-braddock-students-stole-passwords-erased-school-data/2012/01/13/gIQArRuExP_story.html"}],"summary":"Two Fairfax County middle-school students used stolen passwords to wreak havoc with a school software application used countywide by thousands of teachers, students and parents, according to authorities.  Officials at Lake Braddock Secondary School in Burke reported the breach to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1609160b4258966adbe6c5e4b4778ce2c4598ab6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC96FE9B-5A0F-4F0A-83EF-5C70B7A9D0FE"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef16277dcf64","org_name":"LABusinessConnect.com","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/19/la-business-connect-hacked-exposed-data-leaked-and-taken-offline-by-anonymous/"}],"summary":"Anonymous  hacked a Los Angeles county based company and  as a result they have exposed a link to a adult site,  adultstaffing.com/default.cfm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad2964559c6debec27d5ee7bead33d85c879c2ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BFCCC3B-12B4-4725-BA89-00D419ED5F78"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b7a96c41f37","org_name":"La Palma Intercommunity Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/hospital-608152-records-patients.html"}],"summary":"Hospital employee viewed patients' information containing PII and limited medical information without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17bb3c52c881ef00d756bf8f66d79dd1af74510a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"47836BA4-9960-46C0-BF3F-C052F25DDF84"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"242f75c85307","org_name":"LA Fitness","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=24221;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kpho.com/story/18362022/passerby-finds-hundreds-of-documents-with-personal-info-in-dumpster"}],"summary":"A passerby found paperwork pertaining personal information for customer's for Fitness 1.  Fitness 1 sold their location, contracts and memberships to LA Fitness in 2000.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3938e6e68f39ea29d5bbe9728053a47cae3946eb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CAF2AA3-3FEF-4950-9388-54BDB6F1E5A6"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2369cd729e23","org_name":"KTSU Texas Southern University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.houstonpress.com/hairballs/2013/01/cops_suspect_up_to_300_counts.php,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxhouston.com/story/20547670/2013/01/09/ktsu-radio-volunteer-behind-bars-for-id-theft"}],"summary":"Texas Southern University's radio station KTSU gave a volunteer position to a person with a criminal history of credit card fraud.  The volunteer was later arrested for allegedly using the radio station's donation drive to steal credit card information.  The dishonest volunteer f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc0f007bea9c89d65f56303f0ed1f254b449058a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A84AFAE-344B-4891-9FEF-E706FB07E2AC"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cd2a64d0dc2","org_name":"KTSU Radio","org_type":"professional_services","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxhouston.com/story/20547670/2013/01/09/ktsu-radio-volunteer-behind-bars-for-id-theft"}],"summary":"A former KTSU Radio volunteer is behind bars on accusations he stole personal information from hundreds of donors.  Prosecutors believe Michale Whitfield, 32, stole credit card information from the pledge sheets of KTSU listeners and then used that information to buy electronics ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79d6c5d88f7dad665bafa7f2a0223538a0315b09","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D25710C-2A5A-4132-A4A1-707359437164"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"964e6a161578","org_name":"Korn/Ferry International","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/korn-ferry-20121228.pdf,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Notification%20Letter_0.pdf"}],"summary":"Sophisticated cyber attack carried out against organization.  Investigation determined that affected databases were not designed or structured to receive sensitive personal information, but they were nevertheless included names, drivers license, government issued identification n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a82014f35759e5470e9ef164b4824fd55ed6096","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DB30869-87FF-42AB-BFBF-E40ED9CC9E44"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KP","org_id":"a40e8682112b","org_name":"Korea Investors Service","org_type":"financial","ransomware":null,"records_affected":315,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Databases with usernames and clear-text passwords or usernames plus e-mail addresses dumped on the web with some admin logins.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e910abdd91fc195338017387238efeca50d2526d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73FC16AC-2D5B-4C81-9AA5-6445C7867C5B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"808c3744fc19","org_name":"Korea Credit Bureau","org_type":"other","ransomware":null,"records_affected":104000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.securityweek.com/20-million-people-fall-victim-south-korea-data-leak"}],"summary":"Insider stole customer credit card data and sold it to a third party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"87b98079a021742764235f597e3adb8d97de6561","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29AEA135-067D-428F-8D15-4AE0F6A14BA1"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ab749db3d941","org_name":"Kingston Council","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=24164"}],"summary":"A mailing error resulted in rent statements being sent out with the first page belonging to one tenant’s account and the second page belonging to a different person.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70bfdab673f97344fef6c260bbe9cbe2bab12c19","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB953BCC-8299-4455-9227-8555609D8AB2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2e496ab0129c","org_name":"King Edward VI College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://socialbarrel.com/europes-youngest-application-designer-aaron-bond-expelled-from-school-for-hacking-the-computer-system/33493/"}],"summary":"Aaron Bond, 14 years old at the time, hacked into King Edward VI College's computer system and has been expelled as a result.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56487385b2cac2783eee575ba0ef0fb51176c35a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A84FA72-1AF3-48D3-8D1C-6B8110DAF89D"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af2a8dfd43b3","org_name":"Kern Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1431,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.turnto23.com/news/your-neighborhood/east-county/kern-medical-center-resident-physician-loses-1-500-patient-records,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/English%20Letter.pdf?"}],"summary":"Research documents were stolen from an employee's vehicle.  They contained confidential patient information.  Officials said the resident took home the records in a computer bag, which she left in her car parked at her apartment complex.  The records contained information, includ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea6ef85ff59dad17a2dc699de6cbdd4d5856d465","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4FEFF3CB-4DE2-4442-A350-8662AB3F348E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"6dd149588ae0","org_name":"Keetch Clothing","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/01/16/massive-amount-of-hacked-sites-by-stk-part-3/"}],"summary":"A hacker using the handle STK leaked usernames, emails and encrypted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e54149ec2c8671846bb6bd1f196331dc0d77d44f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76046B1F-DA1B-4B1E-AD98-C16D0E898A2B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f5e899d98253","org_name":"Just10time.com (Big Rock Enterprises Incorporated)","org_type":"technology_saas","ransomware":null,"records_affected":4000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/01/27/just10time-com-hacked-and-thousands-of-accounts-leaked-by-psykonx-of-netbashers/"}],"summary":"A hacker named @psykonx from @Netbashers leaked usernames/emails and encrypted passwords. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fd21690291653734c593908dc060d5de92a8526","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76103D55-D77F-4088-A3C5-064EC98B2C3D"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ba2625b4f32","org_name":"JPMorgan Chase & Co.","org_type":"financial","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cyberenvoy.com/content/jp-morgan-chase-capital-one"}],"summary":"Two men face charges of conspiracy to commit bank fraud, conspiracy to commit access device fraud, and aggravated identity theft after being indicted for attaching skimming devices to ATMs in New York, New Jersey, Illinois, and Wisconsin.  At least nine other people are believed ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d9c3a2533b82080e03982402ff1a9f4ce8cce82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3EEABDF9-FE54-47C6-AA89-63F79993D99D"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2e53b040ee05","org_name":"Jordan Middle School","org_type":"education","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2016/02/schools-kicked-boy-based-dna"}],"summary":"Parents disclosed son had CF markers (but not CF) in his genes. Teachers told parents of kids who did have CF about other student.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c1609f92799f2a546c7b305310931cb59d98397","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43D81C8C-842D-4437-838F-D8C6BEAC400A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"d14a946d3cf2","org_name":"Jobs in De Regio (jobsinderegio.nl)","org_type":"technology_saas","ransomware":null,"records_affected":874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.efortresses.com/2012-Breaches-Matrix.htm"}],"summary":"Employers' and job-seekers email address with plaintext passwords were dumped on the Internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d9322386aea855b05d8efbf6dcf7a36829f8eeb","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43DDCD89-7C94-4251-9954-3FEBE633DE84"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"20696b2bdd6b","org_name":"Japan's Ministry of Agriculture, Forestry and Fisheries","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nye/pr/2013/2013may09.html"}],"summary":"Hackers Steal 3,000 Classified Japanese Government Documents  Several of the confidential documents were related to negotiations over the TPP free trade agreement. By Jeff Goldman  |  Posted January 04, 2013 Share                                   A recent cyber attack on Japan's","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9f12d665835c059a9d878a32a48f77bbf15bdb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5DD40EA-7C06-4B43-8FC3-856121A8C6BA"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"b31ea296c7e5","org_name":"Japan Aerospace Exploration Agency","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://english.ruvr.ru/2012_11_30/Japan-confesses-data-breach-on-Epsilon-rocket/"}],"summary":"The Japan Aerospace Exploration Agency (JAXA) has reported a possible data breach on its first Epsilon solid-fueled rocket, Kyodo news agency says.  Spyware was found on one of the agency’s personal computers on November 21. It was immediately disconnected from the local area net","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c50cb3b2fcb6f494a23a94ed12f9d5685436545f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"675F8789-FDC4-4B4D-B8C2-58B4C2EE41ED"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c811336c51c0","org_name":"Jackson Health System","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthcare.com/story/jackson-health-bans-cell-phones-volunteers-after-data-breach/2013-01-11"}],"summary":"What do a hospital volunteer, a cell phone and a McDonald's parking lot have in common? They were all factors in a massive scheme to steal patient identities. The fallout led Miami's Jackson Health System to ban smartphones for all volunteers across the system, Report on Patient ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d536c2d9c844ef1be89f14a8d5bf86a803f1ae1d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B62D936A-9905-45ED-8EDA-4E5C8FB6AFF2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"faf6884da9f5","org_name":"Israeli Ministry of Construction and Housing","org_type":"other","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/14/300000-accounts-and-details-leaked-from-israeli-ministry-of-construction-and-housing/"}],"summary":"300,000+ Accounts and details leaked by 0xOmar from Israeli Ministry of Construction and Housing.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1887403c25ee5e89ed87e027fe37cdb0e5af6a30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E3FE25D-D9AC-450C-8D7C-A5EECF7E88FA"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"3e3627a90140","org_name":"Israeli Airforce","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/15/israeli-airforce-secret-data-leaked-for-recent-air-attacks-by-0xomar/"}],"summary":"Well its been a quiet couple of months on the cyber waar front for Israeli, that is until today when a hacker who use’s the handle 0xOmar has claimed to leak secret information from the Israel air force. The attack comes not long after the recent attacks which have so far left ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e381f8bb5e1529688dd09ccfd296d123b31ca61","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"134B7A45-88F2-41EC-8489-32CD79BD66B0"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IL","org_id":"1b81936f2d96","org_name":"Israel Institute of Technology","org_type":"education","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=22776"}],"summary":"During an Anti-Israeli cyberattack, the Israel Institute of Technology was compromised.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5465a33e08eeb629140c070f3955540603d9ee9f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6D4FE67-8416-4C14-A9C7-7FD8CEED66AA"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9cbf2633f76e","org_name":"Islamic Network","org_type":"nonprofit","ransomware":null,"records_affected":17000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/12/24/islamic-network-hacked-17000-user-credentials-leaked/"}],"summary":"A hacker who goes by the handle @th3inf1d3l breached accounts from the Islamic network website.  The attack is part of an ongoing operation named #OpFuckMohammad which has been going for some time now and mainly been carried out by @th3inf1d3l.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IL","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"378d0de20eae8eea1cdd062ab3e47799f54961e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"962C3255-464B-4B07-96FB-E69C3335305D"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd1d6f1349cd","org_name":"Islamic Finder","org_type":"professional_services","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/17/islamicfinder-org-and-culturecrossing-net-hacked-by-alienz-and-a-message-to-anonymous/"}],"summary":"Websites were attacked and they were islamicfinder.org and culturecrossing.net and both contained account leaks.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ed24e473f3113454da32b1f82e47674ca1ff9d86","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"699CA1CB-35C2-4239-9CC7-DA58229FEC0E"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"29f5b43332e0","org_name":"Isaac Miller Elementary School","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kionrightnow.com/story/16481347/books-student-personal-documents-thrown-in-dumpsters-at-school;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.idtheftcenter.org/artman2/uploads/1/ITRC_Breach_Stats_Report_1H_20120630.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.privacyrights.org/data-breach"}],"summary":"Boxes in a dumpster outside the elementary school contained books that were to be donated and personal and financial information related to applications for free and reduced price meals.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"922ab4e479f5ca5a0e0976d7ad4eaa75f351a3cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E586E8F1-0AAA-4BEB-8D62-8ECB12D94304"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf3bbebbfb9c","org_name":"Irvine Scientific","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/irvine-scientific-20121218.pdf"}],"summary":"Company received a communication from a former contractor claiming he had possession of credit card information of some of their customers.  The contractor refused to return the data and to identify precisely what data he has.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83b1c83691ce6217ce8a63e4c03a44b4793bb590","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3009282C-BC59-43A2-AD32-6385ECEE5CD8"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"5dec0d4aee69","org_name":"International Police Association of Australia","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/International-Police-Association-Australia-Hacked-by-S3rver-exe-259635.shtml;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.vestabyjgs.com/?p=782"}],"summary":"A hacker known as S3rver.exe managed to breach the official website of the International Police Association of Australia (ipa-australiapolice.com.au), defacing the Houses domain.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f4a38d12e386711c5de780a632866b30ccac0e4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE0C2CD4-0A0F-47D1-A21C-5B7EF3B1D6E5"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abcbe439c2be","org_name":"International House of Pancakes","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.toledoblade.com/Courts/2013/01/05/Local-IHOP-ex-owner-on-house-arrest-until-trial.html"}],"summary":"Tarek Elkafrawi, the former International House of Pancakes franchise owner indicted on 53 federal counts, is on house arrest after release from custody Friday.  Mr. Elkafrawi, 54, was taken into custody May 23 after being charged with multiple counts of money laundering, harbori","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c9a23829d326b4bca7b666165f67290eb7bc4a0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"59E37F28-80F0-4805-A508-0D3FF39AC9C9"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AT","org_id":"44d46f51bdcd","org_name":"International Atomic Energy Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/technology/technolog/u-n-atom-agency-says-stolen-information-hacker-site-1C7302434"}],"summary":"The U.N. nuclear watchdog said on Tuesday that information stolen from one of its former servers had been posted on a hacker website and it was taking \"all possible steps\" to ensure its computer systems and data were protected.  The stolen information was contained in a statement","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bd77dfdd489b8ce2fcf5d763a9ce446bb9b3ad7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21FC25F2-D32E-44EF-8FBA-FB08A9D2D8A2"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed74f403bff3","org_name":"Inova Fairfax Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/blogs/crime-scene/post/fairfax-county-police-find-atm-skimmers-at-hospitals/2012/11/30/8fd4739a-3aec-11e2-a263-f0ebffed2f15_blog.html"}],"summary":"Fairfax County police are investigating skimmers that were found attached to two automated teller machines at Fairfax hospitals. The devices, discovered this week, are designed to copy personal bank card information and pass codes for thieves.  Authorities said the devices may ha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0ed42aecdef773e7f45daa2b76a8ee9b115b67b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1A4C3A2-50B5-4D89-8DE9-93AC0DC64758"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5323f2a97c23","org_name":"Indiana University Medical Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wibc.com/news/story.aspx?ID=1685268"}],"summary":"Personal documents that contained prescriptions for powerful pain medication and patient information were discovered on Wednesday in a dumpster.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ae0effe2ee2b8f68694a363ed5c65ea4a4a7418","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1721F7E6-AE8F-4B0F-A649-9A21AC177D7F"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9dc681ad76d1","org_name":"Indiana Internal Medicine Consultants","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://datasecurityweekly.com/roll-call-of-healthcare-data-breaches-for-2012/"}],"summary":"A laptop was stolen that contained patient records.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"026cb1f9f3feced35e6e23abb4e66a2d8f021295","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1CCC9F9-DB0F-49A3-A76E-2DFAC7FF0AC2"},"incident_date":"2012-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df31913557ab","org_name":"Incorporating Services Limited","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Redacted%20SSN.PDF?"}],"summary":"external actor uploaded malware on to corporate server that was externally hosted. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a04d466a293137b5d5e991dc99e40cd3dda964f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6EB67F2-41DD-486B-8558-190454EE8D93"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"da863059dcc3","org_name":"Ida G. Israel Community Health Center in Brooklyn","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nyc.gov/html/hhc/html/pressroom/press-release-2013-01-31-notification-lost-data.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12813"}],"summary":"The New York City Health and Hospitals Corporation (HHC) this week began to notify almost 10,000 patients who received services at the Ida G. Israel Community Health Center in Brooklyn about the possible disclosure of some of their personal or protected health information (PHI) w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"IN","motive":"financial","name":"Raju Tevar","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73ff8290d994ff9d8a946d50f6604d2a1ffd8e37","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C892471-CAC3-4CB1-B7D6-F12203774FF1"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"922d9c4b8d61","org_name":"ICICI Bank Ltd","org_type":"other","ransomware":null,"records_affected":30000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ndtv.com/article/india/delhi-man-arrested-for-credit-card-fraud-worth-crores-392169"}],"summary":"Man stole data from an employee of ICICI Bank by copying it from his laptop using a pen drive. Since then, he had used the data of around 4,500 credit card holders during the last one-and-half years to make financial transactions,\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical","derived":{"actor_id":"rajutevar"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"841ae73b5c4bb7c608a347a42c08e71a0fdc4d33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D7303FD-34AE-4B48-9AAF-E28D6D57E1A2"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"3caee5e41075","org_name":"Hong Kong Institute of Education School of Continuing & Professional Education","org_type":"education","ransomware":null,"records_affected":8505,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"The Office of the Privacy Commissioner for Personal Data has discovered that sensitive personal information of students has inadvertently been exposed online, potentially affecting as many as 8,505 students from 11 local schools, including tertiary institutions.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51998849fc6ad05a0e6a2f49f17366edb1a20044","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD46F6F4-806C-4214-B426-0829CC0F1DAC"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9b0ff43da3b9","org_name":"HMRC","org_type":"healthcare","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theboltonnews.co.uk/news/14845786.Hospital_accountant_jailed_after_ID_thefts/"}],"summary":"HOSPITAL accountant stole the identities of more than 50 NHS workers and used their confidential information to fraudulently claim tax refunds","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05d71b2224e771d90c0d6b3a98f0427b07519f22","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5BDC5852-2BEA-46F4-8E98-6726ED0108EA"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d83b03f7d62","org_name":"Hertz Corporation","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/hertz-corporation-20120801.pdf"}],"summary":"A partner's system was hacked into, and the data at risk includes names, address, bank account numbers and SSNs of suppliers, consultants, employees and former employees of Hertz.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"765fc2c5c31d5df4a48ee791dcbe67e8d64d672f","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F2F7FB0-7798-4AF8-A105-C78300D3F6AE"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77bdaf199475","org_name":"Hawaii State Department of Health, Adult Mental Health Division","org_type":"government","ransomware":null,"records_affected":674,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4adeb3b8031c18258d5e8f49bba64bec29b3fc27","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA30CC56-033F-448C-9162-CD9D8B2D640B"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0963cda531e6","org_name":"Hartford Hospital","org_type":"healthcare","ransomware":null,"records_affected":9558,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/boston/blog/mass_roundup/2012/08/emc-laptop-cited-in-patient-data-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/computer-theft-affects-nearly-10k-hartford-hospital-vna-healthcare-patients.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tripwire.com/state-of-security/latest-security-news/emc-hospital-to-pay-90000-over-data-theft-from-stolen-laptop/"}],"summary":"A laptop carried by an employee of an EMC subsidiary has been reported stolen by Hartford Hospital, compromising the personal health records of about 9,000 patients, the Connecticut Attorney General's Office reports.  According to a news release from Nutmeg State Attorney General","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2d8cdd1804b72d21743f5b3a5196d8679cece59","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84B73E23-E84F-4A90-B913-294E8AB23914"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c419755e8d10","org_name":"Harris County Hospital District","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/former-harris-county-hospital-district-employee-allegedly-sold-patient-information-as-part-of-medicare-kickback-scheme.html"}],"summary":"Around 3,000 patients of Harris County Hospital District in Houston may have had personal information stolen by a former employee indicted in a federal court this year in a Medicare kickback scheme involving home healthcare operators, according to a Houston Chronicle report.  The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb6d2f9f16fc488d243161cf05e4983dfbb70ca1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C5503167-2846-4EE8-B449-C9B815733429"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa693640c362","org_name":"Hanover Insurance Group, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/hanover-insurance-20120306.pdf"}],"summary":"Theft of computer backup hardware from a partner exposes name, address, SSN and medical information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f6da56c3919c562e9e96443db3200f87addc694","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1B7E473-13D5-46AC-A7F5-43607299E853"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"30f40c5ac1fd","org_name":"Halifax Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newburytoday.co.uk/2014/bank-clerk-involved-in-2m-halifax-scam"}],"summary":"Employees were coerced into getting/allowing software (via USB sticks) onto bank computers, enabling key-logging and \"to steal account details and make fraudulent transfers.\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89d26e51a5a87cd1578c9134b7961573e5cd2e32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCA1E0EF-DB4B-4A9E-8D89-3D079BD8DCC7"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"4df6b7e277ea","org_name":"Groene Hart Hospital","org_type":"healthcare","ransomware":null,"records_affected":493000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nu.nl/binnenland/2927832/groene-hart-ziekenhuis-lekt-medische-dossiers.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://securityevangelisteu.com/category/information-security/operating-system-security/windows-security/"}],"summary":"A hospital in Gouda, the Netherlands called Groene Hart Ziekenhuis (Green Heart Hospital) had according to Bonnie at the Nederlands Genootschap van Hackende Huisvrouwen (Netherlands Society of Hacking Housewives) and reported to the journalist Brenno de Winter (@brenno) allowed w","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"AU","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"270d80188d7f0ac2efa7ae88172202f1bd4f91b8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0823A858-14D6-44A8-9ADD-3BEBAB603F10"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3d101adaa7e8","org_name":"Grindr LLC","org_type":"professional_services","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://securitywatch.pcmag.com/security/293112-grindr-hack-leaves-hundreds-of-thousands-exposed"}],"summary":"The hacker reportedly spoofed several accounts in Sydney, sending messages and changing profile pics to explicit images without the real user's knowledge. The hacker had apparently cracked the token used to communicate between smartphones and learned that this same hash can be us","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e81a9f075c32befe3fbdd63845d917168770b24","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E62DC08-71E6-46B0-AC56-8A9214826281"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"c0f29cc93cb2","org_name":"Gold Coast Medical Centre","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.goldcoast.com.au/article/2012/12/10/443366_gold-coast-news.html"}],"summary":"A GOLD Coast medical centre which had its patient records hacked by international computer hackers will stay open.  But the owners of the Miami Family Medical Centre fear they may have to pay $4000 to the extortionists, who hacked into a server and encrypted the medical records. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddbcf40ea08bd595ae9135df925ea040cc1dea7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"12377004-44BE-4C1C-98FF-EC9F841B5187"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"9e2cac71f639","org_name":"German Federal Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thelocal.de/national/20120109-39999.html#.UQmz-2dTTSg"}],"summary":"A hacker attack which infiltrated Germany’s federal police computer system using Trojan programs and a system of routes via Russia last summer was due to a row about internet usage between a top cop and his daughter. It resulted in the “Patras” server being closed down – meaning ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b7c1630919163b11586fc29e0f977e3e3d162654","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB549F07-9FE3-43EC-BFD6-D02D78D1E90C"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"681ddedf2540","org_name":"German Federal Intelligence Service","org_type":"government","ransomware":null,"records_affected":218,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://rt.com/news/171180-germany-spy-scandal-policy/;http://rt.com/usa/171104-us-admits-recruiting-german-spy/"}],"summary":"First since WWII: Germany may start spying back on US after double-agent scandal  Germany may scrap its decades-old policy of not spying on key NATO allies in response to the latest spy scandal, which exposed a German intelligence officer as a double-agent leaking secret document","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"018a57ef925cda72df5b14464a98fbccbc4fbf30","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2D8AC6F-1301-478E-B88E-642972DE8B27"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"c1d348f051c1","org_name":"Gamigo","org_type":"professional_services","ransomware":null,"records_affected":8200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.gmanetwork.com/news/story/266588/scitech/technology/8-2m-passwords-hacked-from-gamigo-gaming-website"}],"summary":"\tAt least 8.2 million user credentials have been compromised from gaming website Gamigo and then dumped online, a hacker news site reportede Tuesday.   The Hacker News said the compromised usernames, emails and encrypted passwords included three million from the US, 2.4 million f","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IL","motive":"espionage","name":"Gery Halon, Ziv Orenstein","variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b90999cbb468fe767870c8c9ea8b0e17940a4d0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84DE3A4C-E18A-4D49-A056-EEB8A9CEC6A6"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a0fb9a38202","org_name":"G2 Web Services LLC","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2015/11/jpmorgan-hackers-breached-anti-fraud-vendor-g2-web-services/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/wp-content/uploads/2015/11/U.S.-v-Shalon-et-al-Indictment-S1.pdf"}],"summary":" hackers targeted this company so that they could more easily push through payments for spam-advertised prescription drugs and fake antivirus schemes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"geryhalonzivorenstein"}},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal","secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ebbf1aa777a7d396630c121e178a51205d8312aa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C3A8AF3-B297-4D86-A2BD-EE1D879E1C05"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33c536f9f6ef","org_name":"Freedom Energy Logistics","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.unionleader.com/Big-victory-for-Auburn-energy-company-in-corporate-espionage-case;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunjournal.com/news/lewiston-auburn/2016/01/19/nh-jury-awards-550k-against-auburn-energy-companies/1855734"}],"summary":"trade secrets stolen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1da9b191ed88df65d9027404cd2c9a12d306e35","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C73080F-6AE6-4B24-A2A1-6FB59E49A066"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2fc640ce554","org_name":"Florida Hospital Tampa/University Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":45,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.myfoxtampabay.com/story/20224892/2012/11/30/two-accused-of-stealing-patient-information-from-hospital"}],"summary":"Forty-five hospital patients had their personal information stolen, and now two people are under arrest and accused of filing phony IRS returns to collect more than a million dollars.  Federal agents say Tanya Cullens and Kenyon Williams filed those returns using patient IDs from","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96e5f608e12666df1bcb2082d4612bba530b56b3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8FB8D399-0A41-4806-9C20-1C48A761DB36"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"LK","org_id":"4ae335ee0247","org_name":"Fitch Ratings Lanka Limited","org_type":"other","ransomware":null,"records_affected":886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://techyzilla.blogspot.com/2012/07/fitch-rating-sri-lanka-website-hacked.html"}],"summary":"Website and database compromised via SQL Injection attack. Usernames, clear-text passwords, and e-mail addresses were posted to public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"133e42b3309315952cd7d7a587334331f87dcdab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1712E719-712F-4EEB-AEC6-DC593B003A82"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8029bb8f3256","org_name":"First Marblhead","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/suntrust-loan-education-20121221.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/SunTrust%20Security%20Breach%20Notice%20Ltr%20to%20consumer.pdf"}],"summary":"while executing a search warrant at the home of a former contractor police discovered loan documents pertaining to First Marblhead and Suntrust Loan Education.  The breach was first discovered on October 31, 2012. The company does not know the details of the specific documents.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a37432a2d1edd0920cbe41bd2aae65d7d0e9948c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B8AB0DD-2EBE-45AA-A1BD-294F7B74FA54"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"577e24b98ad3","org_name":"Federal Bureau of Investigation","org_type":"government","ransomware":null,"records_affected":1600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2012/12/11/ghostshell_christmas_release/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/london/anonymous-intercepts-records-fbi-scotland-yard-cybercrime-call/2896"}],"summary":"The hacking collecting GhostShell has announced it has finished operations for the year, but has signed off with a dump of around 1.6 million account details purloined from government, military, and industry.  The group claimed the accounts come from the ESA, NASA, Pentagon, Fede","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17b66c71104234c554c156d35694299f950e9034","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"500311F2-6CE4-4558-AA47-AA028ADAFB8A"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bd264d62f40","org_name":"Family Healthcare Group Inc. and Houston Compassionate Care","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2012/December/12-crm-1498.html"}],"summary":"A federal jury in Houston today convicted Ben Harris Echols, 63, of Houston, for conspiring to commit healthcare fraud by falsifying plans of care for Medicare beneficiaries, including patients whom he did not treat.  After a four day trial, the jury convicted Echols of one count","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5ab71b29c03a928c9ab04713dce1611d8351b27","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C0DD39E-CACA-4A65-B302-B45FCC1051E6"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d04dba5f9e3","org_name":"Family Chiropractic Center","org_type":"healthcare","ransomware":null,"records_affected":450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bybradio.net/2012/01/17/medical-records-stolen/"},{"fetched_at":null,"title":null,"type":"press","url":"http://kokomotribune.com/local/x2019121991/Thieves-swipe-medical-records/print"}],"summary":"Chirporactic center suffered a physical break-in over New Year's break; ~450 files were stolen. The clinic did have electronic backup copies.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3278bacada83949d7b164108a963d90a5a6449b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E541AF0-D9E1-4A91-9E03-942D2DC633EA"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46679c5cfa3d","org_name":"Fairfax High School","org_type":"education","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fairfaxunderground.com/forum/read/2/1072197.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/blogs/the-state-of-nova/post/fairfax-underground-website-ordered-to-remove-fairfax-high-school-grades/2012/12/21/0326c090-4bb0-11e2-a6a6-aabac85e8036_blog.html"}],"summary":"Fairfax Underground is an online bulletin board, not a blog, where almost anything goes. Anyone can anonymously start or join a discussion about local drug dealers, complaints about the Fairfax County police or schools, places to meet women, politics, breaking news, all manner of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e20fad0577acd6bb65f54258398bddba652c2225","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79936763-D9E5-4507-83A0-5D4D8149861D"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"65498fdab474","org_name":"Fairfax","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com.au/News/288847,privacy-commissioner-probes-fairfax-hack.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com.au/News/288661,fairfax-microsites-hacked.aspx"}],"summary":"The Office of the Australian Information Commissioner has opened an investigation into the breach of two Fairfax microsites to probe whether sufficient security mechanisms were in place during the attacks.  Media giant Fairfax has confirmed that two of its microsites were hacke","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6199dfa75ed5dec0f8baeef4de2dce2862fe4ee8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DB60D29-FC6F-4840-9C2D-6DED22C1210E"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7702229dd49c","org_name":"Fairbridge","org_type":"nonprofit","ransomware":null,"records_affected":16,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.alertboot.com/blog/blogs/endpoint_security/archive/2012/02/20/laptop-encryption-software-fairbridge-signs-undertaking-with-uk-ico.aspx"}],"summary":"Laptop lost in airport that contained PII for 16 employees. Laptop was password protected, but did not utilize full-disk encryption.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7420db896bc4dc14a3fb332556439c414386b2ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"654339BC-64C5-47D8-8071-0F14CB2350E1"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hothardware.com/News/Facebook-Confirms-Massive-Data-Breach-and-Vulnerability/Default.aspx"}],"summary":"A self-proclaimed security enthusiast has exposed a major flaw in Facebook, one in which nearly every user's phone number can be used to view their personal information. His name is Suriya Prakash, and his method of cultivating numbers involves using Facebook's mobile site to byp","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"676347e509c2c8f355596541ac4f30878f684c88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D749F627-C539-4F82-A05D-9765174252FA"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"10501e2e2ede","org_name":"ExploitHub","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.facebook.com/ExploitHub/posts/378826135545043,%20http://www.networkworld.com/news/2012/121212-exploithub-admits-39embarrassing-oversight39-lead-265019.html"}],"summary":"Today, the ExploitHub marketplace web application server was compromised. A group called \"Inj3ct0r Team\" who themselves host an exploit database has claimed responsibility for the attack. ExploitHub is obviously a high profile target as the ExploitHub market houses exploits and o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"727d0da793048d939eee606ce6b2ab5f7f208cf4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F2CB788-892C-4721-9150-C8C977F363BB"},"incident_date":"2012-02-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/experian-20120504.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/speedy-recovery-20120217.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/experian-20120116.pdf"}],"summary":"Unauthorized access to Experian records.  These are typically through their customer's credentials, although none is mentioned in this source doc.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40f0d2d4d055ad5b1c85e999e4aea6a8b97500c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DA64661F-4C91-4B00-92A2-643D6473FAF0"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"743e56dfb174","org_name":"Essex Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-2086866/Eight-officers-resign-illegal-searches-dozens-people-using-police-files.html"}],"summary":"Eight police staff have lost their jobs after illegally accessing the confidential records of dozens of people on the Police National Computer.  Of the eight, one police officer and one community support officer (PCSO) are facing criminal charges after an investigation by Essex P","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e7afd8484dd7d37a60502f1549af698ff9869e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6234B624-6251-442D-B387-0FBDBC76CF46"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8bca820d0189","org_name":"Equity Trust Company","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice%20%28retail%20final%20draft%29_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Security%20Breach%20Notice%20%28retail%20final%20draft%29_1.pdf?"}],"summary":"An unauthorized third party accessed Equity Trust Company's computer network.  The breach was discovered at the end of January 2013 and notification letters were sent on April 15.  Equity Trust customers may have had their names, Social Security numbers, addresses, and other info","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0ae17892afef9f221298bb8accb693dcb96113d6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D8DA244-64F9-4B6F-B7A5-7A5DB77656DB"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"914dd4885f26","org_name":"Epsom and St Helier Trust","org_type":"healthcare","ransomware":null,"records_affected":63,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kingstonguardian.co.uk/news/10727323.Confidential_patient_details_lost_in_major_security_breach_at_Sutton_hospital/"}],"summary":"A hospital lost a filing cabinet containing vulnerable patients confidential details in a major security breach, it has emerged. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"NG","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6d0395b105a3e752c5bf8422d83ba6b1d5fd872","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D9C5117-9BC0-4A94-BE83-4F2CEC9BC192"},"incident_date":"2012-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65330ceb6322","org_name":"Environmental Protection Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/cybersecurity/2014/06/fake-dot-gov-webmail-used-phishing-scam-hack-epa-and-census-staff/86374/"}],"summary":"Nigerian actors set up phishing sites to target credentials of US .gov employees, then sold them to accomplices.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9c6cd5b324cf2de50657bf15feaaa7beb718a8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83C7C7AB-9B4E-4ECE-B02A-5C6004755D92"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c252cd62157","org_name":"EmblemHealth","org_type":"financial","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.emblemhealth.com/default.aspx?Page=about_news_20121219_privacy"}],"summary":"EmblemHealth is notifying approximately 1,800 GHI PPO members about a privacy breach that occurred in November 2012 and offering those affected free credit monitoring for the next 12 months.  On November 26, 2012, EmblemHealth discovered it had inadvertently included individual p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5edfec0459eddd85ac63892d86e8e214e93ed14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A95184DD-0274-4017-B35C-BFF7574C01F2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PH","org_id":"364b448640cc","org_name":"EMAXX","org_type":"manufacturing","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/01/12/emaxx-hacked-by-tehmaskz/"}],"summary":"Motherboard manufacturing company has 7 usernames and encrypted passwords posted on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c6632bf6110049b604a474245f761f9c55760c6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"972F26E8-BE47-4930-96A9-DF827CF8D808"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"695d9c71579e","org_name":"Elsevier","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://retractionwatch.wordpress.com/2012/12/11/elsevier-editorial-system-hacked-reviews-faked-11-retractions-follow/"}],"summary":"Retraction Watch has learned that the Elsevier Editorial System (EES) was hacked sometime last month, leading to faked peer reviews and retractions — although the submitting authors don’t seem to have been at fault. As of now, eleven papers by authors in China, India, Iran, and T","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"434881f71dcb31acf2db7b5ee416fe03869fe6c1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97D6C4F6-DC7A-4D27-ACC6-105CDBE5E65D"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59fe59d08615","org_name":"Elliott Greenleaf & Siedzikowski","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abajournal.com/news/article/suit_claims_ex-partner_installed_software_allowing_continued_access_to_law_/"}],"summary":"Lawyer installed Dropbox on corporate devices and accessed files after moving to another firm.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c641d9b019f049c74ca443b1729d49c34624c90","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C95116E4-B544-415A-A873-D7F3A0A50B1E"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"314ea2ef408b","org_name":"Electronic Arts","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.wsj.com/speakeasy/2012/10/30/medal-of-honor-warfighter-looks-to-battle-through-controversy/"}],"summary":"The game publisher during the pre-launch phase of Medal of Honor Warfighter the “partners” tab offered direct links to gear manufacturers’ sites, potentially letting all comers — including underaged ones — get to pages that displayed real guns, custom magazines, scopes and big kn","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8fed82fcdeafb1c6c8a896e6f87f520892b6ed8c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF4A5BA6-0C6F-475E-A80D-A78CC34853FF"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f054627350ff","org_name":"Elections New Brunswick","org_type":"government","ransomware":null,"records_affected":553000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/story/2012/05/09/nb-privacy-breach-voters-list-1026.html"}],"summary":"CD with voter information was provided to political parties. Extraneous information including drivers license numbers and phone numbers was included.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0b288665346681769f00df07b85d9b6a461f658","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84FFAD65-556F-4AEC-89B1-6AA0C424DA2A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"47c7384a76b7","org_name":"Elantis","org_type":"financial","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3355659/hackers-blackmail-belgian-bank-elantis-over-unencrypted-customer-data/"}],"summary":"Hackers compromise mortgage database and blackmail victim company. No details in publicly available information on method of breach","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"63f892a6f3e3a98aacad9bb90d9cc41e05e0b742","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0546f650-971a-11e7-a11c-5542f7e3819f"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5d94c147aab","org_name":"El Camino Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wsj.com/articles/cybersecurity-startup-tanium-exposed-california-hospitals-network-in-demos-without-permission-1492624287;"},{"fetched_at":null,"title":null,"type":"press","url":"https://arstechnica.com/information-technology/2017/04/security-vendor-uses-hospitals-network-for-unauthorized-sales-demos/"}],"summary":"For years, cybersecurity startup Tanium Inc. pitched its software by showing it working in the network of a hospital it said was a client, according to people familiar with the matter and videos of the demonstrations. That and other efforts helped the company grow quickly, notchi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0c204af68a153308c5ca4648c3a3f1e4f2326c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C580116-D2C5-4316-9372-94E048EA4C47"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86efebfcd659","org_name":"eHarmony","org_type":"technology_saas","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/violetblue/sex-tech-bitcoin-louis-theroux-booth-babe-life-eharmony-password-scandal/1357"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"The simultaneous, massive password leak at dating mega-site eHarmony was a bad situation as well.  On Thursday eHarmony admitted that its password database had been compromised and somewhere around 1.5 million passwords were exposed and out in the wild.  With no irony whatsoever,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e22f8f72be9c37db37db600adf7eb6889557531d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C5CACD2-28BA-474A-A8BE-786C482BC71F"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e5ba6b148a9b","org_name":"Economic Development Association Scotland","org_type":"professional_services","ransomware":null,"records_affected":647,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/09/economic-development-association-scotland-hacked-and-data-leaked-by-epoch/"}],"summary":"Hacker posts 647 usernames and encrypted passwords to pastebin.com. Method used to access information not provided ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"71cf9288010e5fde8035a67b0020be355f44e98e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2865B948-B7F1-497D-AE94-FB4B020541B0"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2835c7186e2e","org_name":"Easton Area School District","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.mcall.com/2014-01-27/news/mc-easton-technology-director-wiretap-ard-20140127_1_drago-easton-area-school-district-school-official;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.lehighvalleylive.com/easton/index.ssf/2013/08/arrest_warrant_issued_for_form.html"}],"summary":"Employee recorded internal meeting that involved sensitive organizational data. Further investigations discovered unauthorized access to other computers and exfiltration of sensitive data. Inappropriate images were also found.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e3b6389324c8f6235ca928334d35d5ed45675f6f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EBFE3E81-B319-4B90-963C-A8EBEDB7BD87"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3bb7e76df89c","org_name":"Eastern Health Authority","org_type":"healthcare","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.ca.msn.com/local/newfoundland/court-date-set-for-nurse-involved-in-privacy-breach"}],"summary":"A former Eastern Health employee has pleaded not guilty to unlawfully obtaining health information.  Colleen Weeks was terminated in July 2012 for accessing files of more than 100 patients in St. John's. Weeks was a nurse at Eastern Health for more than a decade.  At the time, sh","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8986e63af38d4b8c6d7cbff508eb607bdd627abd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C1F9356-364B-46CE-A139-BA1B3698F79E"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"beb301952e2c","org_name":"East Lothian Council","org_type":"government","ransomware":null,"records_affected":1075,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eastlothiancourier.com/news/roundup/articles/2012/02/09/423493-school-data-loss-apology/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.eastlothian.gov.uk/news/article/1026/council_apologises_for_loss_of_information"}],"summary":"School employee downloaded information, including student PII onto a USB drive to work from home.  USB drive was then lost putting data at risk. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b288b36846c5818193ee475d3f0a38b0e4508e8","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D5271AD-A39C-4B0C-A2E4-1A20FD9E7198"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b24ec36deb2a","org_name":"East Baton Rouge Acceleration Academy","org_type":"education","ransomware":null,"records_affected":187,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.americanownews.com/story/16641742/nearly-200-high-school-students-fall-victim-to-identity-theft?clienttype=printable"}],"summary":"Student at high school acquired printout of 159 students' names, SSN, DOB. Used data to commit tax fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96f00962d88454dcbe626bb0964df8238f0696b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFCC7DEA-5AE2-4775-B37B-3B4666CEEE64"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EG","org_id":"eb1d8b80e3bf","org_name":"e-teacherdiploma.com","org_type":"education","ransomware":null,"records_affected":242,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://itechengine.com/hack/e-teacherdiploma-com-hacked-and-accounts-leaked-by-alienz.html"}],"summary":"Website compromise leads to dump of usernames and encrypted passwords on public web site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1667305d5f0bdbfaca854814f2e7d8d1ffad359","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7CFFD48-D95D-431F-9038-27C2CAFF277A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb110211b3fd","org_name":"E.J. Phair's Brewing Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ktvu.com/news/news/crime-law/hackers-steal-credit-card-information-concord-pub/nTHCm/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://concord-ca.patch.com/articles/credit-card-theft-case-at-ej-phair-remains-a-mystery,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/EJ%20PHAIR%20BREWING%20CO%20and%20ALE%20HOUS-C2012116470%20CA%20AG%20Letter_customer%20notice_0.pdf?"}],"summary":"An East Bay pub says computer hackers stole the credit card information of dozens of customers recently and there may be more who were affected.  Every time a business swipes a credit card, that information is collected by a third party, so the business can get paid.  But in this","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49ff092705ebf73260d14b7d9cdc160561d6a592","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5FDEAD1E-927C-4606-A4CD-E185F225FDC3"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1384859ad1f","org_name":"E. I. du Pont de Nemours and Company","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytimes.com.pk/business/07-Mar-2014/us-businessman-sold-trade-secrets-to-china-jury"}],"summary":"Two men in California are facing more than two decades in prison for stealing a recipe for making titanium dioxide (TiO2), a chemical used to whiten the cream in Oreo cookies, as well as numerous other uses in the manufacture of paper, plastic, and paint.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b87befc73f7f7e99547f0825f466e4f144c6f5c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"33F98FAB-6D50-42D7-9B85-2CA264764FAD"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db95b32cebc6","org_name":"Duke University Health System","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dukehealth.org/health_library/news/notice-to-patients-who-previously-filed-chapter-13-bankrupty"}],"summary":"Billing department included patient PII and medical information with proofs of claim submitted when patients had filed for bankruptcy and it was necessary to prove legitimacy of debt.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2bac783f019a0aec74b7433076697526c35b286c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AF77EAD6-8D12-4D80-9594-A2B344DECF45"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fb5c7930c1ff","org_name":"Dropbox","org_type":"technology_saas","ransomware":null,"records_affected":68680741,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/that-dropbox-hack-was-much-bigger-than-previously-revealed/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.theguardian.com/technology/2016/aug/31/dropbox-hack-passwords-68m-data-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.hackread.com/68-million-hacked-dropbox-data-free-download/"}],"summary":"A couple of weeks ago Dropbox hired some \"outside experts\" to investigate why a bunch of users were getting spam at e-mail addresses used only for Dropbox storage accounts. The results of the investigation are in, and it turns out a Dropbox employee's account was hacked, allowing","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6c7d563dd197cf3d4ee41e564755e2ac4f94429","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4AF16838-DB1C-4967-BFB6-3D4762C69318"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"3606bcb9df84","org_name":"Drake International","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://business.financialpost.com/2013/01/09/drake-international-confirms-database-with-user-information-hacked/"}],"summary":"Drake International, the Canadian-based job placement firm, confirmed Wednesday that it has been the victim of a hacking scheme by a group seeking to extort payment in exchange for not releasing the personal information of people who have used Drake’s services.  With offices in n","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46d2c2c910f78aef149eb77a1f10e36e7437b18e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DD06240-746C-4AC3-BEE4-9420B10A41B4"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af5ecae08c3d","org_name":"Drago's Seafood Restaurant","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dragosrestaurant.com/media/official-statement-02-16-2012/"}],"summary":"Food server used hand-held skimmer to steal payment card information while on duty at restaurant.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52860eeae654d2d7458f9998da34197ba2d58386","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B1CF762-4B41-49B6-85F7-20AED3A61DB4"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"96c8512a8cb0","org_name":"DirectTV","org_type":"technology_saas","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/06/15/directv-hacked-data-and-accounts-leaked-by-teamintricate/"}],"summary":"@TeamIntricate has announced they have hacked DIRECTV http://www.usdirect.com/ and as a result they have posted a leak of data to pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f6af579a679c72d1bb8f4eb82d111b323a40086","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2EF181E-4AA4-48F3-AC04-DC90DE1B71BF"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"RS","org_id":"c40e600cd3bf","org_name":"digitword.com","org_type":"technology_saas","ransomware":null,"records_affected":2886,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/06/07/2886-accounts-leaked-from-digitword-com/"}],"summary":"Forum hacked user creds (encrypted pw) pasted to PB.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"32f6dea344426efdd7c0b42b4bc9171510d6e8d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BEB4BBE-4072-4D0A-8F74-75932C6DE3F4"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"MX","org_id":"70513343838b","org_name":"DiarioBasta.com","org_type":"technology_saas","ransomware":null,"records_affected":144,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/E8zvHDpS"}],"summary":"Site hacked and files dumped on pastebin.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6814e6d2ddc4d86505783ff534c082b37abc3bbe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44423A31-3B6A-49C7-BDFA-66341DA6AFA5"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5c4326dbd786","org_name":"Diagnostic Health Solutions","org_type":"professional_services","ransomware":null,"records_affected":3550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23234"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-essex-16853109"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/news/uk/home-news/council-workers-hit-by-data-leak-6699452.html"}],"summary":"3rd party hosting partner breached. PII and medical records dumped on public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e70890027b42404e5256ec69132857a49194f7f3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21B632FF-E4E2-4AA4-8B78-89D7787C2A46"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a9bab940200","org_name":"DHI Mortgage","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/32387,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.thedenverchannel.com/news/homeowner-accounts-hacked,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/02162012.pdf?"}],"summary":"We have reason to believe that the integrity of your personal information may have been compromised due to a security breach of the DHI Mortgage Loan Prequalification Website.  On the evening of Friday, February 10, 2012, DHI Mortgage became aware that a software security breach ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90db8a38d56cf1cda94ea80c19bb767c0ec11f6c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76A74D6A-01DD-44F0-873E-7E0F665BD2E6"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"4488de0139a7","org_name":"Devil's Cafe","org_type":"technology_saas","ransomware":null,"records_affected":4940,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/02/08/4940-accounts-leaked-from-media-devilscafe-in/"}],"summary":"The attack which targeted media.devilscafe.in  and the leaked data contains usersnames, emails and encrypted passwords.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"507b107298ad2014a63efcc70c2b046d6a93f721","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E682B589-4D69-4E99-A582-B573928FF0FE"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"416c340238fa","org_name":"Destiny Software","org_type":"professional_services","ransomware":null,"records_affected":1630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/06/07/destiny-software-hacked-1630-user-details-leaked-by-googleswe/"}],"summary":"Software company website compromised, user emails and clear text passwords leaked to PB.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8a1549872c87502f01391e3aa518718546152015","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2D205CC-2F1A-4AB9-8EBD-873BF38E5461"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dd95f4b59d5","org_name":"Department of Human Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/blistering-audit-reveals-illinois-dhs-failed-to-protect-confidential-patient-information/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sj-r.com/article/20140529/NEWS/140529241/11143/NEWS%20"}],"summary":"A state audit has found that Gov. Pat Quinns administration left behind tractors, a forklift, computers, and confidential patient and employee records when it closed three Department of Human Services facilities.  The report by Auditor General William Holland  released Thursday  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8791c9e482c0c737ad819fa2fc29a63fd56ec4e0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"811E782A-64C2-4295-A79D-1D0091356B17"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc2e4a50ca32","org_name":"Delta Dental of Illinois","org_type":"financial","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?s=Delta+Dental&x=0&y=0,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.news-gazette.com/news/health/miscellaneous/2012-06-20/some-delta-dental-records-lost-during-shipping.html"}],"summary":"3rd party shipper loses medical records; xrays. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fb83928ef6c5017a8fa832d76a1b75b089a5dc0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B4E92F5-6454-4BC7-BA5E-9F3E1C6C6B0C"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f7cf269f85e","org_name":"Dell Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessweek.com/articles/2013-02-14/a-chinese-hackers-identity-unmasked#p2"}],"summary":"Dell Incident Response botnet takeover uncovers 200 compromised system across the globe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"54e62b3e89d6ea808d8c6948655432acd1c68ebd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D9FD8EC-52DE-4A41-9495-D1CB42964D41"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a443fba9b1b4","org_name":"DeLaval, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/delaval-inc-security-breach-notice-ltr-to-consumer.php"}],"summary":"Fidelity, our retirement program administrator, detected some unusual activity related to a small number of company employees retirement accounts. Based upon that unusual activity, we were able to conclude that unauthorized access to the personal information of all company employ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79c23188080d9f08e8fe775c800db320f580e3dc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A734C48-9214-45D5-9F8A-6B6456672CB8"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a54c9a49ca80","org_name":"Cuyhahoga County Board of Developmental Disabilities","org_type":"government","ransomware":null,"records_affected":613,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsnet5.com/dpp/news/local_news/cleveland_metro/laptop-stolen-from-cuyahoga-county-board-of-developmental-disabilities-may-compromise-600-people"}],"summary":"The Cuyahoga County Board of Developmental Disabilities has notified 613 people who receive its services that their names and birthdates may have been on the hard drive of a laptop stolen from an employee’s car in North Royalton.  The laptop itself was password protected. The Boa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e1b2977871691dca127deeabbf54ba9bdf92699","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"504C8B52-4E90-479F-B2ED-09C223D2A4D3"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PA","org_id":"a730c1799d68","org_name":"Cricfire","org_type":"technology_saas","ransomware":null,"records_affected":3452,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/3-452-Accounts-Leaked-from-CricFire-258877.shtml"}],"summary":"over 3000 account names and encrypted passwords dumped on pastebin. No OSINT on hacking method(s) used.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce6f0aabfc5a82218bf8a3eb5f080ff97cd2ea87","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48A1F0F0-C0BB-4D0B-B6F6-316E4FBAE23B"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16181b538174","org_name":"Cornell Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":5000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.9news.com/news/article/248924/339/Dumpster-full-of-medical-records-found-outside-pharmacy;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/pharmacy-fined-125000-for-breach-a-8173"}],"summary":"The unshredded documents were found in plain view in an open dumpster at the corner of Gaylord and 18th Streets.  The dumpster is used by Cornell Pharmacy.  After reviewing the documents, 9Wants to Know estimates around 5,000 people are mentioned in the documents, along with corr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17082d5070a22c0286657d048792c7059cd6840f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"124DD87B-C61E-4C74-BDF4-4A4DE0220D15"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa9bcd34e7cc","org_name":"Connextions","org_type":"technology_saas","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"A Connextions employee used Social Security numbers from a number of other organizations for criminal activity.  At least four members of Anthem Blue Cross and Blue Shield were affected by the criminal activity.  The breach was reported on HHS as affecting 4,814 patients, but mor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8554e069324c310e953bc0ed225a91d88f8eb0d1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D56B055-6D19-4D4B-9850-A29DB5B1BC37"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"036aad9a525c","org_name":"Concepta, Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Canadian-Launches-DDOS-Attack-Against-Former-Employer-Fails-at-Covering-His-Tracks-377043.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/08/how-not-to-ddos-your-former-employer/"}],"summary":"ex-employee launched ddos attack against former employer and then the ISP.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de8a26872278307cf29f70cccb9505c53e13595e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"696CE7E5-A939-49CD-8C5E-1933E88775A5"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ET","org_id":"a6a872d6bac8","org_name":"Commercial Bank of Ethiopia","org_type":"financial","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ethiopiantimes.wordpress.com/2012/01/26/commercial-bank-of-ethiopia-website-hacked-data-leaked-by-sepo/"}],"summary":"DB compromise posted to public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4cf802ad2e04d859bbadf3cc439bc200a06300f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D33E9C57-8EBB-461F-9C73-4F91196BF9F7"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82f89c56739b","org_name":"Colorado Department of Health and Environment","org_type":"government","ransomware":null,"records_affected":107,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfgate.com/news/article/Colo-marijuana-patients-protest-privacy-breaches-4748286.php"}],"summary":"CO health department employees disclosed names of patients on medical marijuana registry against policy.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e31b7d546a4a3a76d89d528b5237e4e1f60ef41d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"79C40EB2-4AA2-4838-BA43-1AF31B3BD3E8"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IT","org_id":"2fe200123691","org_name":"colmic.tv","org_type":"technology_saas","ransomware":null,"records_affected":3223,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/uNVgNdaH"}],"summary":"usernames and encrypted pw dumped on pastebin. PHP vulnerability likely used to pop database.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8d7de5414bca0453b18d349dee7e4179ca6dee1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DDA41A97-7724-43C4-81DA-D8EB3604EE16"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6f20d0335de","org_name":"Cogent Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nj.com/bergen/index.ssf/2014/08/medical_worker_stole_patient_identities_committed_credit_card_fraud_bergen_prosecutor_says.html"}],"summary":"A medical records coordinator at Cogent Healthcare in Hackensack stole the identities of multiple patients and used them to commit credit card fraud in late 2012, Bergen County prosecutors said Thursday. Latoyha S. Sapp, 37, of Wayne was being held on $35,000 bail in the Bergen C","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cd2de70297ad9a9a028dcde07c59f2a265d88f06","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"990F0B2B-2E92-469B-A732-090D5A35ABC6"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2aeb201cb23c","org_name":"Cochise College","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://azstarnet.com/news/local/crime/man-indicted-for-filing-false-tax-returns-with-stolen-ids/article_77354ae2-43ea-11e2-9ffc-0019bb2963f4.html"}],"summary":"A man has been indicted on federal charges of filing false tax returns using stolen identities, authorities said Tuesday.  Osabuohien Odyssey Oronsaye, 34, is charged with 58 counts of filing false claims, wire fraud, aggravated identity theft and access device fraud. He was arre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"89fb54af6fd05386d6ededf078e92c1ddef2cb82","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75F0782F-911F-4B1A-81BB-FD7D60055F08"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"71c5f0c6edba","org_name":"Coastal Behavioral Healthcare, Inc.,","org_type":"healthcare","ransomware":null,"records_affected":4907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.coastalbh.org/pdfs/website_notification.pdf,"}],"summary":"Coastal Behavioral Healthcare, Inc. (Coastal) became aware of a breach of patient information on October 10, 2012 when a law enforcement officer contacted Coastal to report discovery of a list, dated April 2011, of approximately 136 Coastal patient names and identifying informati","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26481eed8c28cbcf300df9bce92ea265598908ab","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BD04743-C5D6-4D72-84FF-CCCD99D3B5FE"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"57ccc5170c25","org_name":"CoaLogix","org_type":"manufacturing","ransomware":null,"records_affected":100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.policeoracle.com/news/Officer-dismissed-after-sending-'inappropriate'-texts-following-teenager's-death_89764.html"}],"summary":"Insider stole IP from company to start new business, actually several companies. This is one from 2012-2014, the most recent.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e7dac97a3227dfdcb1bc655e07d79e2f86f2464","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E19281B-8FD6-46D8-BF4F-43FE02E15EB7"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8f229e7c77e8","org_name":"Clark, Friel and Joyce, PA","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/clark-friel-joyce-20121228.pdf"}],"summary":"While moving enrollment from Healthy Families to Medical, the DHCS mailed out new ID cards to the wrong people.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ffd7dc0f35d8e9eb7b314d13c438bc147470b98","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2AFE2200-91E6-441C-86E0-68804CA907C1"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5cfa2f531223","org_name":"Clackamas County Elections Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pamplinmedia.com/cr/321177-201020-secretary-of-state-clackamas-county-elections-allowed-access-to-protected-voter-information"}],"summary":"public terminal provided access to PII  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0159bf4bccb3c48152143ecd5e7311b84386b84d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC19288C-4070-4789-BC0F-308378FFD6B2"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e4363bf18ba","org_name":"City of Point Pleasant","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mydailyregister.com/view/full_story/17244934/article-City-computers-possibly-hacked"}],"summary":"The City of Point Pleasant may’ve been hacked.  According to a press release from Mayor Brian Billings on Friday morning, the City of Point Pleasant was notified from an outside agency of a potential security breach of its computer system. Billings’ statement said the apparent br","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"323d884849665cddc969252786fd3d0fd4aca080","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4E18948-F363-453E-8699-5B66866539FF"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19771fea32c3","org_name":"Citigroup Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/citibank-20120313.pdf"}],"summary":"User credentials were stolen from a third party and used to access Citibank web banking site for numerous customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7315a01b4c16ed7fc70619f787588b0c5e1a9956","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D01ABE67-31DD-4D31-92FE-995B64AE5E98"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"725911998306","org_name":"Citibank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://njtoday.net/2013/09/10/ny-man-pleads-guilty-to-role-in-atm-skimming-scheme/#ixzz2ebJWWAr3"}],"summary":"A Romanian national and Queens, N.Y., resident admitted to a scheme to steal account information from bank customers throughout New Jersey, New York and Connecticut by installing secret card-reading devices on ATMs, U.S. Attorney Paul J. Fishman announced Monday.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"17c39bfda4ac665ce677b27e7069c7d0b5d87095","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B35C205C-EED2-4E62-BEBA-A560895BB646"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18f0437a5aff","org_name":"Christus St. John Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2012/11/26/christus-st-john-hospital-reports-data-breach/"}],"summary":"Houston-based CHRISTUS St. John Hospital fell victim to unencrypted device theft in late September when a memory stick containing patient data was lost on the hospital campus. The hospital notified affected patients on Nov. 16 on its website after it learned about the breach on S","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"326784f3deca624f4f36c97cfa6ad45dd79242d1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E450362B-7167-4315-90B0-EA463DB1656C"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d998751b3c2","org_name":"Children's Services Council of Palm Beach County","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/forte-20120314.pdf"}],"summary":"Information copied from their web portal while performing a system upgrade became publicly accessible through the internet and was indexed by Google.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d9abb1c5d3a0deb3d3344a190b1a91abc6c079f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67F0157D-E874-4F01-8818-398FAB1D45A9"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c05cd0b1d25e","org_name":"Children's Center","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.localnews8.com/news/Children-s-medical-records-found-in-Dumpster-to-be-shredded/-/308662/17839236/-/e4edh6/-/index.html"}],"summary":"A man is questioning just how safe our medical records are, after he found volumes of records in the Dumpster behind his workplace.  Dustin found seven boxes and a garbage bag packed with children's medical records from a place called The Children's Center.  \"Names, addresses, So","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86346e4fb9d2c02dc4218da18886dc6b983246cd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6976B917-A49E-4181-9239-4E09A925EA86"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3201a410f753","org_name":"Checkers","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/crime/checkers-restaurant-manager-sentenced-for-stealing-employees-identification/2014/08/27/34648308-2e04-11e4-994d-202962a9150c_story.html"}],"summary":"Fast food manager uses PII of employees to commit identify fraud and open lines of credit in their names.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9aa023003f5afbc9d1eed8650ad5746cd371335","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A49DEB6-E30D-409E-9D53-062E24A5C44E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06b84aa6e655","org_name":"Carolinas Medical Center-Randolph","org_type":"healthcare","ransomware":null,"records_affected":6300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://it.tmcnet.com/news/2012/12/07/6779814.htm,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2012/12/10/health-it-security-breach-at-carolinas-medical-center-randolph/"}],"summary":"The private information of some 5,600 patients of Carolinas Medical Center-Randolph might have been accessed by a computer hacker, according to hospital officials.  Carolinas HealthCare System notified those patients plus, as a precautionary measure, another 700 additional patien","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b8716d5ae1fd84d41dd15adf854ea0abc4ee859","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C771BF66-517E-4349-84CF-C115684BE3BC"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"75d7e73e8370","org_name":"CareFirst","org_type":"financial","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-226728.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-225400.pdf"}],"summary":"An employee responding to two separate document requests under the Full and Fair Review requirements accidentally placed the documents in the wrong envelopes and mailed the information to the wrong members.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c2b87991e771361ca41aa966f3dbbbe238bf9b9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52A96C8F-6A43-40EA-BC3B-2E736A3B541A"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00649498dc86","org_name":"Cancer Care Group","org_type":"professional_services","ransomware":null,"records_affected":55000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govhealthit.com/news/infographic-biggest-healthcare-data-breaches-2012,"},{"fetched_at":null,"title":null,"type":"press","url":"http://ehrintelligence.com/2012/08/28/stolen-backup-media-causes-health-data-breach-at-cancer-care-group/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/about/news/2015/09/02/750%2C000-dollar-hipaa-settlement-emphasizes-the-importance-of-risk-analysis-and-device-and-media-control-policies.html"}],"summary":"In a press release today, Cancer Care Group (Indianapolis, IN) announced that a laptop computer containing its computer server backup media was stolen from an employee’s locked care on July 19, 2012. The breach has potentially exposed the protected health information (PHI) or per","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b5763cde38818fa05d8a1345198ff8b99064874","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1C3B4CD-42E8-4872-A155-D92C972BD68F"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e46117d2671d","org_name":"Canadian Naval Intelligence","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canadafreepress.com/index.php/article/51719"}],"summary":"Over the past few weeks, news of a treasonous security breach at Naval Intelligence has dominated the headlines.  In case you missed it - Canadian Navy intelligence officer, Sub-Lt. Jeffrey Paul Delisle, pleaded guilty last month to passing classified information to Russia.  CBC ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e53f91894a0004a06aa3ef67db69b9beadec815","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2DCA290-87BE-417E-9486-213B50246DF4"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0de965efe92d","org_name":"California Statewide Law Enforcement Association (CSLEA)","org_type":"professional_services","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.computerworld.com/19507/double_wham_bam_antisec_hacks_dumps_ca_ny_law_enforcement_emails,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/attacks/antisec-hacks-ny-california-law-enforcem/232301357,"},{"fetched_at":null,"title":null,"type":"press","url":"https://kevtownsend.wordpress.com/2012/01/02/text-of-the-anonymous-message-posted-on-the-cslea-site/"}],"summary":"Part of the message left by Anonymous on the CSLEA site stated the \"California police have a notorious history of brutality and therefore have been on our hitlist for a good minute now.\"  AntiSec hackers had a \"good laugh\" after reading some of the private email correspondence, b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e525ee52901ab555fa3a83ce3024d7707019a78b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08A1428A-138A-4696-BAC7-5FE6D3AF4665"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3cbdaf4b2d69","org_name":"California State University San Marcos","org_type":"education","ransomware":null,"records_affected":740,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.10news.com/news/student-faces-federal-charges-accused-of-trying-to-rig-cal-state-san-marcos-election"},{"fetched_at":null,"title":null,"type":"press","url":"http://fox5sandiego.com/2013/02/08/fbi-arrests-cal-state-san-marcos-student-body-candidate/#axzz2LSFf99qA"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nbcnews.com/technology/technolog/fbi-suspects-student-candidate-hacking-his-own-election-726362"}],"summary":"Actor attaches keyloggers to computer lab workstations to collect credentials and rig an election for student body president","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a548d6199acf9af704ffb0b8d4a4c529d5acabb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6D556D2-904F-4D04-B9A7-A339DBA6C53B"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21a64db932cb","org_name":"California Department of Healthcare Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notification%20letter%2012-21-12_0.pdf?,"},{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notification%20-%20stuffer%20final%20_0.pdf?"}],"summary":"Information about children's enrollment to Medi-Cal from the Healthy Families Program was mailed out to the wrong people.  Information disclosed included the child's name, Client Index Number, DOB, gender and the date the card was issued.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43599b7d27a7571ddca22145a18e41cae5d8debf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E25230D-A295-45F9-8750-DCA0AC83E6DC"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee40832e682f","org_name":"California Department of Child Support Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/fileshttp://oag.ca.gov/system/files/DCSSsecuritycustyltr_OAG.pdf?"}],"summary":"We are contacting you because on March 12, 2012, the California Department of Child Support Services learned that contracted service providers, International Business Machines (IBM) and Iron Mountain Inc., could not locate several specialized computer storage devices containing p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be28a37b90299a6207f183871d3d3c1e4ae0fd8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8F25A26-C649-476E-858B-FC87A4E3E221"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9609afdf986a","org_name":"Burger King","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kptv.com/story/16997177/former-burger-king-employee-accused-of-stealing-credit-card-bank-information"}],"summary":"restaurant employee uses skimmer to copy customer credit card information and make fraudulent purchases","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"716fa1ae7dc654e7acecd8d912603e61c05a379d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE2C4338-73F6-4E1C-8A30-C8C0D619485E"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a989a5f3ffe4","org_name":"Bronx Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nypost.com/p/news/local/bronx/bronx_cops_in_file_flub_FtFy50i23GDupS14Ieki4M"}],"summary":"Bronx cops disposed of dozens of sensitive files by tossing them in the garbage outside the 40th Precinct station house, where they were fair game for local Dumpster divers.  The files — including at least one domestic-violence report, stolen property records, criminal complaints","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eee37a6328146a2e6d94f17f4662b2fb93918b1d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB6E8720-B246-498B-9CDC-E706C5758409"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77a11f9bd8c7","org_name":"Boston Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":2159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.boston.com/whitecoatnotes/2012/05/22/boston-children-hospital-notifies-data-breach-affecting-more-than-patients/SHpxoNkyKf3RwgKPFK2pIM/story.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcare-informatics.com/news-item/boston-children-s-hospital-reports-data-breach"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsfactor.com/story.xhtml?story_id=12100BIECM3B"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.darkreading.com/compliance/167901112/security/attacks-breaches/240001031/stolen-laptop-exposes-boston-hospital-patient-data.html"}],"summary":"lost laptop unencrypted with patient health data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6b2bbd5a0abc20a21455e4a82335fecd40295ec5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3476154-AE43-4A50-B93A-E644334B32DD"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49c718f16941","org_name":"Boca Raton Regional Hospital, Inc.","org_type":"healthcare","ransomware":null,"records_affected":57,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/fls/PressReleases/130205-01.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=12657"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/hospital-employee-accomplice-plead-guilty-to-using-patient-information-for-tax-fraud.html"}],"summary":"Internal employee misused access to patient personal data to file false tax returns and steal refund money","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c9885642da4caf4085f646f5fe4b2ac6355bb81","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6A1EA26-24A4-471E-A3F3-23067B2FE93E"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"46dc4181eb9c","org_name":"Blue Cross & Blue Shield of Minnesota","org_type":"financial","ransomware":null,"records_affected":56,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://minnesota.cbslocal.com/2015/03/02/blue-cross-blue-shield-nurse-accused-of-illegally-accessing-patient-records/"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2015/03/03/potential-hipaa-violation-from-minn-bcbs-nurse/"}],"summary":"Nurse with a history of narcotics theft illegally accessed a state database that contains prescription drug records for 1 million Minnesotans.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dfb2d328b8695c52deee93dcbb85e76be0afe78","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FAF6DD3B-D307-4458-B413-0E9012D679BC"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"65186519ce66","org_name":"Beta Technology, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lexology.com/library/detail.aspx?g=1f7efeef-6d7f-4aa0-b2a3-225143d0473f"}],"summary":"Former president and account manager use confidential information copied from laptop prior to resignation to compete against former employer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8d99ef22875247f4765fadec71fa3996dbea5b1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC9D5987-24C8-4156-980C-768BD1C6694C"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"b9141e73bc27","org_name":"Bay of Plenty District Health Board","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sunlive.co.nz/news/35925-hospital-worker-fired-privacy-breach.html"}],"summary":"A Tauranga woman has been fired for accessing almost 50 people’s medical records while working for the Bay of Plenty District Health Board.  The sacking followed a four month investigation by the Bay of Plenty District Health Board, following allegations the 66-year-old woman had","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6447b89a83c657617541555b388bafeed30cb29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BD4707D-F010-40D3-959B-7ABA7163B3B0"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"08872b220338","org_name":"Bath Lodge Practice","org_type":"healthcare","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/medical-receptionist-prosecuted-after-unlawfully-accessing-patients-details-12032013;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/uk-medical-receptionist-prosecuted-after-unlawfully-accessing-patients-details/"}],"summary":"A former receptionist at a GP surgery in Southampton has been prosecuted by the Information Commissioners Office (ICO) for unlawfully obtaining sensitive medical information relating to her ex-husbands new wife.  Appearing at West Hampshire Magistrates today, Marcia Phillips was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"567e824a5133816b533e2f84c9c7af05c5055c0b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"261517D9-6951-4CB9-9595-5A019C4FF1E1"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"33d71e93ba1a","org_name":"Basildon Council","org_type":"other","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-essex-16853109"}],"summary":"Details of an Essex council's entire workforce were released online in a \"serious security breach\", it has said.  Names, dates of birth, sickness information and work contact numbers for Basildon Council's staff of \"about 1,000\" were published on the internet.  A council worker s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fc250226a7ed6066741441115e710da16916f98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8214EC3-F7D7-45AB-9659-934E90EABD15"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b9e8df4d4835","org_name":"Barnes & Nobles","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://bgr.com/2012/10/24/barnes-noble-security-breach-credit-card-information/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/barnes-noble-20121024.pdf"}],"summary":"Hackers were able to breach more than 60 Barnes & Noble (BKS) stores, including locations in New York City, Miami, San Diego and Chicago, and obtain credit card information, according to a report from The New York Times. The information is believed to have been stolen from keypad","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6160f3f5a88fc963560b3189abc7fef98792df29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"496B958F-15F3-4C4E-A0A1-87D2F879C71C"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26b2fa73dc45","org_name":"Bamastuff.com","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/breaking/2012/01/tide_fans_ordering_from_bamast.html"}],"summary":"University of Alabama fans who bought items from Bamastuff.com between Aug. 1, 2009, and Jan. 16, 2012, are being alerted to contact their banks for possible illegal and unauthorized use of their credit cards.  Bamastuff.com has sent out email notifications informing customers ab","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"23c3c20a21c7df23dd3b90484f9d4dc784898a5e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"690D300E-98CF-42B4-89BF-23FB4852BFF3"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"000ad58c4723","org_name":"Baltimore County Goverment","org_type":"government","ransomware":null,"records_affected":6600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/baltimore/blog/cyberbizblog/2013/11/baltimore-county-reports-additional.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.onenewspage.us/n/Business/74w4ezyvc/Baltimore-County-reports-additional-data-breach-of-employees.htm"}],"summary":"Contractor (treating as insider) was found to have 6,600 county employees personal information, individual checking and bank routing numbers were found on their computer(s). ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24f45def199d811228a5eb2a62ca02c4cdab7ed4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BF7F74F-9FAA-4BFD-88CE-509651A8EB72"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a3c69aa99294","org_name":"BAE Systems","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailytelegraph.com.au/news/national/bae-systems-army-tender-withdrawn-after-security-breach-and-sackings/story-fndo2dsc-1226542069170"}],"summary":"A $500 MILLION Army communications contract will be retendered after a BAE Systems employee leaked sensitive internal Defence information.  The BAE Systems employee, who had access to the Defence Department's computer network, informed a colleague of material that gave the compan","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d4c3178b6142717cca5fb6cb64afa4aa99c6cdf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC9B9258-083E-4372-B6AC-274B40DD7AF3"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"5d85801c97e6","org_name":"Aviva Corp Ltd","org_type":"other","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.com/news/business-35063022"}],"summary":"Employee misuse leads to sale of 1400 PII records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"570b825754ac7cf1b6fa8a1764861a7c1647333b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"556777D4-EC0B-4BA2-8163-DEA385222C7C"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"05a1f29c447c","org_name":"Aventura Hospital and Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.local10.com/blob/view/-/17390350/data/1/-/jvf7gj/-/Aventura-Hospital-and-Medical-Center-statement-pdf.pdf"}],"summary":"Miami Beach Healthcare Group LTD dba Aventura Hospital and Medical Center in Florida reported 2,560 patients had PHI stolen from their EMR between January 1, 2012 and September 12, 2012.   Hospital statement: On September 7, 2012 law enforcement notified Aventura Hospital, statin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd809d00f150c6333316bb2fbf901bf60b94bc22","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38C620DF-B8FE-4554-8AB4-D10E35B42510"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"2bea250499b5","org_name":"Australian Securities and Investments Commission","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.finextra.com/news/fullstory.aspx?newsitemid=23337"}],"summary":"The Australian Securities and Investments Commission (Asic) is urging the country's online traders to \"urgently review\" their account security after a wave of hacks. The watchdog says that during its regular surveillance it has \"become aware of several stockbroking account intrus","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c3fe392b3a83ed85e1dc580e8ec9a0dd48b2a14","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6264D27-9AD8-4E7F-93E5-3156D59F473A"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"bfd15510c21a","org_name":"Australian Reserve Bank","org_type":"financial","ransomware":null,"records_affected":160,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theaustralian.com.au/news/nation/banknote-error-tops-rba-security-woes/story-e6frg6nf-1226545445009"}],"summary":"THE Reserve Bank sent a computer disk containing 160 high-resolution images of banknotes to a website developer in one of 18 security breaches over four years identified in documents released under Freedom of Information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60a62685401a5867b166f733e4111d5248838c30","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0A1770C-8755-48C7-BF69-16DD16B63630"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"0458b1861398","org_name":"Australian Defence Force Academy (ADFA)","org_type":"government","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.abc.net.au/news/2012-12-11/adfa-hack/4421690"}],"summary":"The private details of thousands of staff and students at the Australian Defence Force Academy (ADFA) have been hacked and released online.  The details include the name, rank, birth dates and passwords of up to 20,000 people.  A member of the infamous Anonymous group, known as D","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb4587e6d5ef27b5df3a9d9b40ef4334f368d520","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CCE300D-6EB6-4C0D-B9E8-E4E221CDF13C"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e613b76fbc5","org_name":"Attorney General's Office","org_type":"government","ransomware":null,"records_affected":6500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/news/houston-texas/article/Texas-AG-releases-voters-Social-Security-numbers-3510642.php;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/texas-error-exposed-over-13-million-voters-social-security-numbers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.chron.com/news/houston-texas/article/Texas-AG-releases-voters-Social-Security-numbers-3510642.php"}],"summary":"State Attorney General Greg Abbott's office inadvertently gave the Social Security numbers of millions of Texas voters to opposing lawyers in the voter ID case but said on Wednesday the information never was exposed publicly. The slip occurred when Texas was ordered to give lawye","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"22c739f415c738b7e267b3d39d2b0aa58a89c582","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C008981-3653-47E3-8F77-1739D1AF07BE"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78a52e7980dc","org_name":"Atlanta Womens Health Group","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/local/ob-gyns-worried-burglaries-fires-are-retaliation/nQT4d/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsbtv.com/news/news/local/2nd-doctors-office-targeted-laptop-theft/nLchZ/"}],"summary":"Atlanta Women’s Health Group laptop stolen in a targeted attack against abortion providers in the area","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7484047aebc27cc7b1ebaf89fa7dff5cf38d4d33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1317A240-E483-49BF-A1E6-A0B138A8C0F9"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8cf7ff8cca4e","org_name":"Arizona State University","org_type":"education","ransomware":null,"records_affected":180000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azcentral.com/arizonarepublic/local/articles/2012/01/19/20120119asu-system-back-online-after-breach.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://cronkite.asu.edu/mcguireblog/?p=298(20130212)"},{"fetched_at":null,"title":null,"type":"press","url":"http://downtowndevil.com/2012/01/19/19699/asurite-system-shut-down-to-protect-personal-information/"},{"fetched_at":null,"title":null,"type":"press","url":"http://downtowndevil.com/2012/01/26/20213/asu-phoenix-law-hacking-asurite/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.statepress.com/2012/01/25/following-hack-asurite-accounts-are-target-of-phishing-attacks/"}],"summary":"External hackers breached the ASURITE authentication system at Arizona State University and downloaded files.  Response resulted in complete shutdown for at least one day.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f27708e263c97e5c4c901edf4a422ba57a4b51ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C36F51E8-07AE-4ADB-AC39-5EB57973C958"},"incident_date":"2012-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a52f55abff","org_name":"Aon Hewitt","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms;"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f32d9f859701721a6cef4285e9a4c3e3fff308d3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EF0CF986-375A-4483-9B58-E6D62B21DF39"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"e474243a7f4a","org_name":"ANZ Bank","org_type":"financial","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theaustralian.com.au/technology/security-leak-sees-anz-pull-down-cyber-shutters/story-e6frgakx-1226242133716"}],"summary":"Programming error causes bank customers to view other customers bank statements online instead of their own.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd5d723aea4a46e5fa87ef0f915c13affb9dc40f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09659208-0DB3-40A4-B53A-4DEC15DA2B9B"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"efab6167daab","org_name":"Ameritas Life Insurance Corp.","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/ecrime/databreach/reports/sb24-32411"}],"summary":"Employee's personal vehicle was broken into and a company laptop computer, along with other business and personal items were stolen from the employee's car.   ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dfbdc518004078a3f18b60f007c6988f371cf3f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91324BCD-F525-4445-A5B0-216CDF69811F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6dcaa69eacd","org_name":"American Tool Supply","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"http://oag.ca.gov/system/files/Notice%20to%20CA_0.pdf?,"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/american-tool-supply-20121119.pdf"}],"summary":"A hacker gained access to the ATS online ordering system.  Customer names and credit card numbers were stored in the system at the time.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e423a2d94c364600433436945807f67e0bf0b599","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AD7932A2-2053-4505-890E-2A5CC0EA060B"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62327c7359c0","org_name":"American Quality Exteriors","org_type":"other","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newsok.com/piedmont-woman-linked-to-id-theft-investigation/article/3640901#"}],"summary":"Between February and December, members of the Oklahoma City Economic and Identity Crimes Task Force seized dozens of stolen identification cards, credit cards and checks, along with multiple computers, scanners, printers and related items used to create bogus checks and IDs, acco","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b66d32bb3c1efdac15045c3e674259c798eb71d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D39BEDB9-0678-40B7-B0D7-1E90D164DF33"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"165d7368a799","org_name":"Altrec, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":3011,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/altrec-20120524.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU%20215640.pdf"}],"summary":"Fraudulent activity on payment cards of people that had visited altrec.com.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27075bed0d9ad01f7eac2e1d04ebc571e7027086","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"49A807C5-9600-45C0-B3EF-354DD9CA920E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"SD","org_id":"e1ea3a6736cf","org_name":"almshaheer.com","org_type":"technology_saas","ransomware":null,"records_affected":322,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/kCAbE5BQ"}],"summary":"website hacked, database contents posted to Internet","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9d67c1e1c494ac5f906f08bbaf28793f87e3577","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"765D9E0A-A246-4CE6-A827-7E34B6435949"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3cb03df4f9f","org_name":"Alaska Department of Health and Social Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/alaska-medicaid-settles-hipaa-security-case-for-17m.html"}],"summary":"While investigating a data breach in which a portable electronic storage device that may have contained electronic personal health information was stolen from the vehicle of a DHSS employee, HHS found that the department did not have adequate policies and procedures in place to s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2ee21900142ac129339af68c7620d15b41d0d61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F723AE84-01EC-44B2-BE83-0E773161E48F"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AE","org_id":"f94b6b9b2d0c","org_name":"alamiravideo.com","org_type":"technology_saas","ransomware":null,"records_affected":250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/vrRwPTV8"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/YM4iyzxN"}],"summary":"Hackers break into website and post non-public information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c99935128132c9fdea2981c6b0ec9f2b7b57e00","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2D042C4-E121-4D4C-8697-BC246A5ED225"},"incident_date":"2012-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"003636115d9f","org_name":"Alabama Department of Public Safety","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Hackers-Breach-Alabama-and-Texas-Law-Enforcement-Sites-251967.shtml"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23257"},{"fetched_at":null,"title":null,"type":"press","url":"http://pastehtml.com/view/bniks0jem.html"}],"summary":"Hacker breached the website for Alabama Department of Public Safety and posted database tables and sample data online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"191fdd575b6f138dbace8b2737737c7ba1853bfe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5E814071-C010-4522-B765-EE94FA74FDA6"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"99551b18ca84","org_name":"Alabama Department of Public Health","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/06/30/alabama-dph-sends-500-patient-data-breach-notices/"}],"summary":"Data stolen, presumably by insiders, but unknown most everything.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15e3c8f9c62d7e0a06e8968696bf5144f11427c7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D385EAB-88A8-4F03-A2AC-5BA7E33BAB63"},"incident_date":"2012-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df15049da402","org_name":"Alabama Department of Corrections","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jailtraining.org/node/2925"}],"summary":"Sasha Webb, a medical records clerk at an Alabama Department of Corrections facility in Elmore County, was sentenced Thursday to serve almost six years in federal prison for her involvement in a stolen-identity, tax-fraud scheme.  She was also ordered to serve three years of supe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0f09620b3fd17317b659645b52972ae4c5d9ccc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"807C10AB-AE06-4857-979D-BD9B34FAE596"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0926c7cf08a","org_name":"Adult Insider Network","org_type":"technology_saas","ransomware":null,"records_affected":10679,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2012/03/19/10000-accounts-leaked-from-adult-insider-network/"}],"summary":"Hacker compromised Adult Insider Network posted encrypted authentication credentials on public site.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3617e1073390ae14c73445545c66fa55de0c2a6c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7952DD16-101D-4B94-8C57-CDA0C2CF39F5"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a303efb5c38a","org_name":"Adobe Systems Inc","org_type":"technology_saas","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9233595/Adobe_investigates_alleged_customer_data_breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.networkworld.com/article/2162884/security/worst-security-snafus-of-2012.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://thenextweb.com/insider/2012/12/16/following-adobe-user-forum-breach-hacker-claims-he-has-access-to-some-yahoo-servers/"}],"summary":"Adobe said Wednesday it is investigating the release of 230 names, email addresses and encrypted passwords claimed to have been stolen from a company database.  The information was released on Tuesday on Pastebin by a self-proclaimed Egyptian hacker named \"ViruS_HimA.\" The hacker","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15f6fd63c157c15375adb93c2097ea6b0c2e4adc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A38B6411-D3DF-4EE3-909E-1B033F14275B"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c33b99e67332","org_name":"Adobe","org_type":"technology_saas","ransomware":null,"records_affected":150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.eweek.com/security/adobe-connect-security-breach-exposes-personal-data-of-150k-users/"}],"summary":"Adobe pulls down the forum for its video conferencing service, Adobe Connect after a hacker breached its security and leaked information, including password hashes, on 150,000 users. Adobe pulled down a forum for users of its video conferencing service, Adobe Connect, after a hac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00765cd982ee4dc43ca325c2a709bf02c963eaaa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB4BC4A0-5D89-455E-807B-DCB31712408C"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d7a1ed5123b2","org_name":"Action For Children","org_type":"nonprofit","ransomware":null,"records_affected":45,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisisnorthdevon.co.uk/Children-8217-s-centre-loses-sensitive-family/story-15177841-detail/story.html#axzz2Kz443YHQ"},{"fetched_at":null,"title":null,"type":"press","url":"http://business.highbeam.com/438499/article-1P2-30783753/centre-may-face-pounds-500000-fine"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.accessmylibrary.com/article-1G1-307262910/children-charity-says-lessons.html"}],"summary":"employee improperly copied sensitive personal information to a usb device which was then stolen along with her handbag.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65a3bd7d3abca3a4e502a29866934d455fd4aa0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B158996A-8D83-4F35-9B90-1E67719C3942"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"26f089512986","org_name":"Acer India","org_type":"manufacturing","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Acer-India-Hacked-20-000-User-Credentials-Leaked-311394.shtml?utm_source=dlvr.it&utm_medium=twitter"}],"summary":"A Turkish hacker called Maxney has managed to breach and deface a number of six subdomains owned by Acer India. The file containing the leaked user credentials has been removed from RapidShare, but The Hacker News reports that it contained the complete details of 20,000 individua","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"824f6d503189bd0746d6a13e0a1c9eadaa1193fd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBB2CB0E-C07E-4FB7-8D62-4B6598314AD6"},"incident_date":"2012-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61c1c266c29b","org_name":"Accurate Accounting & Tax Service","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.vvdailypress.com/articles/tossed-34195-files-hesperia.html"}],"summary":"Tax business improperly stored or improperly disposed of physical tax records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"VN","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4301ec9c3aba7722f4edc5e65c13d38aa9baead","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"745C0DCC-184C-4125-9EC0-EB89D3083391"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dfd20dcca13a","org_name":"Accucom Corporation","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/accucom-20120222.pdf"}],"summary":"on January 3, 2012, someone outside our company used our credentials to make an unauthorized one dollar charge to a number of customer payment cards that had previously been used by customers to make an authorized purchase through one or more of our affiliated websites. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dc7049fc6098989e6efc5505cf68d53898c1f348","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20EA585E-4496-4740-A67F-EBDD9F7773C1"},"incident_date":"2012-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7fa9df901743","org_name":"ABQ Health Partners","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kob.com/article/stories/S2861824.shtml?cat=500"}],"summary":" Some patient records may be in jeopardy, thanks to a lost or stolen laptop computer from ABQ Health Partners, the state's largest independent doctor's group.  ABQ Health Partners sent out a letter telling patients their personal information is at risk of falling into the wrong h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91b5223e013b78a1fd43bc07bbaf4c3515059415","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5A3B22CB-4892-4587-9652-2CA14A888E0E"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"77b2641eb07c","org_name":"AAPT","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/309902,aapt-investigating-alleged-data-breach.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/au/anonymous-begins-dump-of-stolen-isp-data-7000001749/#comments"}],"summary":"AAPT has confirmed a breach of systems held at an external service provider that saw some of the telco's \"business customer data\" compromised.  The telco told iTnews this morning that it was investigating if a potential data breach, after hacking group Anonymous threatened to rel","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc9ec25e60a2da20ae945375a73f0df5f3fcee2f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A86BDA9-0DF0-4D21-9561-999557072202"},"incident_date":"2012-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"06f7a6f54e8d","org_name":"460 Productions","org_type":"technology_saas","ransomware":null,"records_affected":216,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://pastebin.com/qnKiBJNj"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2012/03/460-productions-database-leaked-by.html"}],"summary":"Hackers breached a website and posted non-public data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"313a380ae9982e2fd178b4d5709b2a97d6d3c447","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DB7893C7-EC4E-4263-810C-CA2EEEFBC1F6"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"EE","org_id":"2f6316a31d06","org_name":"220 Energia O","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://balticbusinessnews.com/article/2012/12/12/authorities-to-probe-a-possible-data-breach"}],"summary":"Estonian Data Protection Inspectorate has launched an enquiry into whether privately owned electricity trader 220 Energia OÜ may have breached data protection requirements since its system gave access to the customer database of Elering in a way that enabled to browse personal da","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2012-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"647f04d3e33cf977680daf1d88005d0f0ca57db9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBF88776-91CD-437B-98ED-6C2E872911E6"},"incident_date":"2012-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"830a0024e89a","org_name":"1000 Genomes Project","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2013/01/18/health/search-of-dna-sequences-reveals-full-identities.html?_r=2&"}],"summary":"The genetic data posted online seemed perfectly anonymous — strings of billions of DNA letters from more than 1,000 people. But all it took was some clever sleuthing on the Web for a genetics researcher to identify five people he randomly selected from the study group. Not only t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60d5c9ecc628140680268d3bccf17c48219ce304","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4306365C-950B-4234-B8F6-4D9B97FEBF6D"},"incident_date":"2011-12-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b35183e1a3e0","org_name":"Impairment Resources","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/impairment-sedgwick-20120320.pdf"}],"summary":"Stolen laptop contained partner data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ad687594f3ec373fe0139a21b2020423ff529ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C372B16C-FF13-473D-AD8C-4B216FFE1BC4"},"incident_date":"2011-12-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cda94c6c71d8","org_name":"Sleep HealthCenters LLC","org_type":"healthcare","ransomware":null,"records_affected":2988,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop exposes 2988 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-12-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca72e65d9885ecde5c1e9ec9c331f261312b0882","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"480D23BD-57EB-4442-B9DF-4628B0552AA0"},"incident_date":"2011-12-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0f78ade6b00","org_name":"Akliz, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/assets/files/Akliz%20Notice.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU215459.pdf"}],"summary":"We believe that one of our internal servers compromised on December 27, 2011. We discovered this incident during a routine examination our server logs and C with any time to our customers associate incident. It appears that an attacker was able to gain access to the internal serv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cc2b34136b0218a0e213f361529987d290f26811","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A45A9D8-7382-4E4C-BF42-7E18CADFC227"},"incident_date":"2011-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c9b8495e5ce0","org_name":"Soundpath Health, Inc","org_type":"healthcare","ransomware":null,"records_affected":7581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"A laptop containing the protected health information (PHI) of approximately 7,581 clients was stolen out a workforce member's vehicle and subsequently used to access the covered entity's (CE) company server.  The laptop contained clients' demographic information.  After the incid","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c60bab1c293c45649873a870ae9b4a3e212c1b68","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"274B8442-6548-46FC-9978-674E7D055419"},"incident_date":"2011-12-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12fe7fdaade7","org_name":"Coca-Cola Company Family Federal Credit Union","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/coca-cola-credit-union-20120222.pdf"}],"summary":"Two laptops containing member information included names, SSNs and credit card numbers were stolen from their partner.  No location detail is provided.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-12-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7f5533ef413766a4a570161563737287dcc876fc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1E70A11B-8892-435B-97F9-BFD6AEDE2811"},"incident_date":"2011-12-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"d3315e7b9c49","org_name":"Bailian Midami Digital Technology Co., Ltd","org_type":"technology_saas","ransomware":null,"records_affected":6000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techinasia.com/hackers-steal-data-of-millions-of-chinese-net-users/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/security/chinese-hacker-arrested-for-leaking-6-million-logins/11064"}],"summary":"In what is being called the biggest hacking case in China's Internet history, police have arrested a man, surnamed Zeng, suspected of leaking personal information belonging to more than 6 million users of the China Software Developer Network (CSDN). Zeng has been detained on char","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae40f81f1bbdb5383680956490a0f3c6a88f5df8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80F07C81-FEF5-435E-A066-E27C4B9B416E"},"incident_date":"2011-12-20","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3ccba20d01c","org_name":"Anchorage Community Mental Health Services Inc.","org_type":"healthcare","ransomware":null,"records_affected":2743,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.wheretofindcare.com/newsletters/2012DataBreaches.pdf"}],"summary":"Unauthorized disclosure involving a computer or computers that resulted in the exposure of protected health information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ad65a9249b6349414d08a468057b350e1769040","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6FAD9B90-9C57-456A-A2B5-6C379CA58834"},"incident_date":"2011-12-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e532b49d9800","org_name":"Paul C. Brown, MD, PS","org_type":"healthcare","ransomware":null,"records_affected":4693,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen device exposes 4693 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ffe720918ca1641e225b4da4576f1fb56bf5eca7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40D0954B-83CF-4337-B98E-EA7F8B1F7628"},"incident_date":"2011-12-13","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8104299074b1","org_name":"Prime Healthcare Services","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://californiawatch.org/dailyreport/prime-hospital-fined-95000-confidentiality-breach-18706?utm_source=publish2&utm_medium=referral&utm_campaign=sacbee.com"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.enquirerherald.com/2013/01/18/2559386/former-patient-claims-confidentiality.html"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.documentcloud.org/documents/274983-california-watch-dec-13-response.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://dbhdd.georgia.gov/sites/dbhdd.georgia.gov/files/related_files/site_page/HIPAA%20HHS%20Resolutions%201%2014%20One%20page%20version.pdf"}],"summary":"Medical center, in response to a billing dispute, disclosed a patient's medical record to employees and to a journalist. Said patient is now suing the medical center.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2011-12-12","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff190622cc1c7c3fca44f322ec281f0a8d3425cb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4B2AA90-5346-4B12-B2DC-BA472DF15813"},"incident_date":"2011-12-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PA","org_id":"92b599eb3656","org_name":"CPPS","org_type":"technology_saas","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2011/12/12/20000-cpps-testville-accounts-leaked/"}],"summary":"gaming site hacked via unknown methods. 20K creds posted onto pastebin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bba97bfe01f08e7c324e50318bc628bbf17f32f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"002599D4-A872-433B-9980-BD9F257B283F"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2acdf07aa74a","org_name":"Sutter Medical Foundation","org_type":"nonprofit","ransomware":null,"records_affected":943434,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.trendmicro.com/sutter-health-sued-for-1-billion-following-data-breach/"}],"summary":"A group of patients filed a class-action lawsuit against Sutter Health this week, after it was revealed a laptop containing information on more than 4 million patients was stolen from the headquarters of the Sutter Medical Foundation (SMF) in Natomas, California.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"662490d8879dc512893d065693ab077884b573fa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CB6DAAA0-F206-4177-9C02-36B498489585"},"incident_date":"2011-12-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9b33266ac12","org_name":"Ocean Reef Club","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/ocean-reef-20120314.pdf"}],"summary":"A software development consultant working for the Ocean Reef Community was running security checks on confidential community databases being used by the company's software systems vendor, Forte Interactive.  They discovered that the vendor's server didn't have proper protection a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c86b028a36c0fc2f05ede6245f319983fcf7d518","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E16E53D8-49CC-4D2F-A682-921A5EEE615F"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0f7884a08fbc","org_name":"Medcenter One","org_type":"healthcare","ransomware":null,"records_affected":650,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e49d9d7b577b66a501cd40e5b00dd8f26dd9e2b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A8B56CE-5194-4BDB-8341-67FF3F30E5E3"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6a0f46e0caaa","org_name":"Logan County Emergency Ambulance Service Authority","org_type":"healthcare","ransomware":null,"records_affected":12563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"384320b2081e88c958da4718f4c2ce2988176a03","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2979D4A1-69D1-4D04-B3A1-16E981B0C395"},"incident_date":"2011-12-08","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45373e90b2e9","org_name":"Lebanon Internal Medicine Associates","org_type":"healthcare","ransomware":null,"records_affected":55000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3930ba8d39e3337aff2fcd7293bd698d3379d18c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B38108B4-039D-46BE-A78C-4FD75BC1DE0D"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4127c6f9041e","org_name":"Lankenau Medical Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d83548a3ef890488d7b21c3af815b2d649d1b96f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27BA18ED-C035-4D56-9CCA-6AF4D49C8795"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"98dc527cb396","org_name":"KCI USA, Inc.","org_type":"other","ransomware":null,"records_affected":567,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66725114cdbeb442fb1d177e515e996586fe2c66","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36E102F9-F81F-4E3E-AE97-FBA986ABEBD1"},"incident_date":"2011-12-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c834893032d","org_name":"Good Samaritan Hospital","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"64c1a19cb0db39c621a8d34bbf1c3f92ecddd190","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"38920CBA-4ED0-48C5-95C9-47EEA5C6C508"},"incident_date":"2011-12-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce8bbbf204a1","org_name":"Dallas County Hospital District dba Parkland Health & Hospital System","org_type":"healthcare","ransomware":null,"records_affected":2464,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72665a0081c364a4a05a75466bf33eaf14decd3a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58FADF45-4AB7-441F-B10D-6830F268F4AE"},"incident_date":"2011-12-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"777abb97e3fa","org_name":"Jay C. Platt, DDS","org_type":"healthcare","ransomware":null,"records_affected":10705,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of an electronic device leaves 10705 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a9d214ea7f52ddc4e271850707aba3287f8679a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E3ABBCD-2707-4467-81BD-3897D749C7C5"},"incident_date":"2011-12-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"295e67665987","org_name":"Iowa Department of Human Services","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dhs.state.ia.us/docs/Warren%20County%20Fire%20FAQ%20.pdf"}],"summary":"Due to a fire at the Iowa Department of Human Resources building in Warren County partially burned documents were found on neighbors' lawns containing confidential information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"465b8169a08e0ae93f127686b95757427182de3c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"032C679A-8A51-4826-B131-CB961BE4573F"},"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b61783c41905","org_name":"Trion Worlds","org_type":"technology_saas","ransomware":null,"records_affected":3300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/trion-world-hacked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.zam.com/story.html?story=28613;http://massively.joystiq.com/2011/12/22/trion-worlds-customer-database-hacked-no-evidence-credit-card/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/trion-20111221.pdf"}],"summary":"Trion Worlds has become the latest in a long string of MMO studio security breaches this year, as the company reported an intrusion into its customer database. At risk of compromise were customers' user names, passwords, birthdates, email and billing addresses, and partial credit","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"783fe65f8186d02a44053b5f7a4a516e00723250","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10B0C36C-C3BF-48E7-BA4D-E95E97633AB3"},"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"29eadf7ddb44","org_name":"Tianya.cn","org_type":"technology_saas","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/40-Million-Tianya-Members-Exposed-After-Data-Breach-243215.shtml"}],"summary":"Tianya.cn, one of the largest Chinese social networking websites, suffered a data breach as a result of which 40 million users became exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eedc3586b8da8f869a298e49833e6e0f52008c88","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23BA80FD-BCA7-417A-9058-BF8E21CF4AE3"},"incident_date":"2011-12-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e9fda7f77d1a","org_name":"Spotsylvania School Division","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.fredericksburg.com/gettingschooled/2012/01/05/spotsylvania-school-employees-personal-information-was-av/"}],"summary":"Personal information of some Spotsylvania school division employees was briefly accessible online over the holidays.  An employee discovered the problem on Dec. 23 and division staff immediately moved to address the issue, shutting down the internal system known as “self serve” t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"231ba905b5fb7c87d203b2857fd82d4bb4d87f51","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1C06FF20-8E09-413C-8173-2785FA41E0E0"},"incident_date":"2011-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ab7f5aaa553b","org_name":"RBC Royal Bank of Canada","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thestarphoenix.com/news/Toronto+pleads+guilty+skimming+bank+card+data/8966136/story.html"}],"summary":"A Toronto-area man who skimmed debit card information from ATMs in a string of Saskatchewan towns was only identified after he was arrested for similar crimes in Ontario.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b0c241d09971193eca027b04983caae54bd5558","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31DD567C-A743-4ACA-807C-79D05B3CB7C1"},"incident_date":"2011-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cc6f40fea74d","org_name":"Primex","org_type":"financial","ransomware":null,"records_affected":55,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/primex-20120529.pdf"}],"summary":"A tape and external drive were stolen from a partner.  Personal identifying and medical data for up to 14,000 workers comp claimants and auto insurance claimant were included after a burglary.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b89b925be31995a2049892975b848b23f408d771","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23286CD9-786B-45F8-B9FE-C92803A9010B"},"incident_date":"2011-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d86126b4feb4","org_name":"Memorial Healthcare","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/fl-defendant-convicted-in-identity-theft-tax-fraud-scheme-involving-medical-patients-personal-identifying-informati/"}],"summary":"Kenol Augustin, 36, of Miami, was convicted by a federal jury of one count of conspiracy to commit access device fraud, in violation of Title 18, United States Code, Section 1029(b). Sentencing is scheduled for January 15, 2015. At sentencing, Augustin faces up to five years in p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e09e6f4db1466941a43746a7bd35b54a04520f8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1A3CA6E1-F8C4-4667-AC9C-56835C5F1C54"},"incident_date":"2011-12-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0f74377da84","org_name":"Flores Mexican Restaurant","org_type":"other","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kvue.com/news/Lakeway-restaurant-customers-victimized-by-cybercrime-credit-fraud-138534759.html"}],"summary":"LAKEWAY -- Police say hackers stole credit card information from dozens of diners who all ate at a restaurant. While investigators have cleared the restaurant of any wrongdoing, the owner tells KVUE he is taking steps to restore the business that's been lost due to the fraud. By ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42f16505c399cbb0f8ffb0669981e8deb05af503","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C8C789D-9600-4CDB-B335-B6B66B81E354"},"incident_date":"2011-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1306ba566fdb","org_name":"Cleveland Clinic Florida","org_type":"healthcare","ransomware":null,"records_affected":772,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of records exposes 772.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49e1af7c6d64b928669dac58d385d83ca9c64230","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0311CF15-E5D1-43C8-9364-3A1DA1BB5292"},"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6fe0b0714479","org_name":"Care2","org_type":"nonprofit","ransomware":null,"records_affected":17911623,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Environmentalist-Website-Care2-Hacked-18-Million-Passwords-Reset-244005.shtml"}],"summary":"The website of Care2, an organization thats all about living a healthy, green lifestyle, has been breached in the last days of December by an unknown hacker team that managed to access the login information belonging to a number of the sites members.  The official statement relea","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eaf29b8fb46df3cabe2a7da1e03f99455bfac802","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3F3690A-6B82-439F-AA8E-832D7AD03027"},"incident_date":"2011-12-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d192cfb78d36","org_name":"Cardinal Fitness","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wthr.com/story/16770212/cardinal-fitness-customer-receipts-found-in-dumpster"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.theindychannel.com/news/ag-investigates-cardinal-fitness-dumped-documents"}],"summary":"Company improperly disposes of non-public payment data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f58a059e69c5d8e5c9a10dacb98efbdb674bd2a4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2E8628B-C30C-44C6-B559-81B31FE6E18E"},"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e603b262c80","org_name":"Bailey's Inc","org_type":"retail_ecommerce","ransomware":null,"records_affected":250000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/baileys-notifies-15000-online-customers-of-payment-card-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/baileys-discovers-breach-more-extensive-than-originally-reported/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/attacker-compromises-information-of-250k-in-baileys-data-breach/article/483630/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.baileysonline.com/pdf/databreach_info.pdf"}],"summary":"Outdoor equipment retailer Bailey's Inc. notified its customers that an attacker may have stolen payment card information from the company website and that the length of the breach was longer than once thought.  How many victims? 250,000 What type of information? Credit card numb","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2011-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b2d046acf5fe32903217a95d3cfc7e8ac8707087","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76C447D7-42E4-4AB3-968D-091079F61A6E"},"incident_date":"2011-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"c5fe52a04be6","org_name":"178.com","org_type":"technology_saas","ransomware":null,"records_affected":10000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/38-Million-Users-Exposed-After-Gaming-Site-Hacking-242616.shtml"}],"summary":"Hackers steal userid/password of a gaming site and post it online.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fdd75f6a6b7d0eb89c7e22e759ceb788009fcc78","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D2761208-761A-40D6-BA90-EB0607919BB3"},"incident_date":"2011-11-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"79826051ad19","org_name":"Waterloo Region District School Board","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.therecord.com/news/local/article/650845--computers-with-personal-info-stolen-from-school-board"}],"summary":"Nine computers stolen from the Waterloo Region District School Board's education centre in Kitchener on Dec. 1 contained personal information about individuals.  No details on what type of personal information was contained on the laptops, used by staff, were released by the Boar","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-30","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beae489926b44eac5ce7cef5dc4f8bb0926daf1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"07A0736B-783E-4DEB-9962-3F189C2609CB"},"incident_date":"2011-11-30","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2f9531ec2cd7","org_name":"Strategic Forecasting, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/strategic-stratfor-20120119.pdf"}],"summary":"Based on information currently available to us, we believe that members of a hacker collective calling themselves \"anonymous\" illegally obtained access to the company's secured data systems and stole credit card and other personal information of some or all of the company's curre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fd060bab55777f29cd1563501c4bde48ca3780e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C13195F-810D-4135-A456-93A022124995"},"incident_date":"2011-11-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c75b37a9d60","org_name":"Regions Financial Corporation","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/businessnews/2012/01/regions_says_employee_401k_dat.html"}],"summary":"Personal information about Regions Financial Corp. current and former employees was lost in November when a flash drive with the data came up missing after being mailed by outside auditor Ernst & Young in the same envelope as the decryption code.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-11-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cb4ac0c1a11b45e06539a108cee451564af84d2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E8D57FE-26A5-4733-909D-5DCBB25761D3"},"incident_date":"2011-11-30","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2ce921f6dad","org_name":"Great River Entertainment","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/great-river-20121001.pdf"}],"summary":"Payment application systems infected by malware.  Potential compromise of CCN data.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-29","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"616fad707e2141dfcbe5b8c656c69c1928c4116f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25461118-6CFD-4125-96F0-32BB6AED68DC"},"incident_date":"2011-11-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e301a3743a3","org_name":"Trident University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/trident-university-20120222.pdf"}],"summary":"On November 29, 2011, Trident detected an unsuccessful attempt by an unidentified person to access a database containing usernames and passwords for current and former student accounts.No other information was contained in the database. The company permanently removed the databas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"deterministic","prompt_version":"v3","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"46132b19b640056364d39d9c1a33c0bea272b2aa","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-11-29","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"no_text","url":"https://oag.ca.gov/system/files/California%20Security%20Breach_0.pdf"},"notes":"built from regulator checkboxes; no narrative available","org_country":"US","org_id":"9cb25646ed25","org_name":"Investacorp, Inc.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-23280"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/investacorp-20120419.pdf"}],"summary":"Partner data breach , \"inadvertent sharing of electronic files\" included client name, SSN and account level data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2011-11-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94d3b31a49ddbead9e6fcac73a42648fbc889243","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"21349E3F-D0A7-42AA-B483-90611B09C58A"},"incident_date":"2011-11-28","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94e1063c8538","org_name":"VG","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Couple-That-Posed-as-Anonymous-Hackers-Sentenced-to-3-Years-Probation-394021.shtml"}],"summary":"Person hacks into law firm. Grudge for firing someone.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ee39e9924fe2d117ce0b400775077818902e5fb7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0343D549-E369-4A69-B80E-CEB4A81FDEFD"},"incident_date":"2011-11-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7189a9bde75b","org_name":"Plymouth City Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2012/local-councils-fined-over-300000-for-losing-personal-data-17122012;http://ico.org.uk/news/latest_news/2012/~/media/documents/library/Data_Protection/Notices/plymouth_city_council_monetary_penalty_notice.ashx"}],"summary":"News release: 17 December 2012 There is an underlying problem with data protection in local government  Information Commissioner  The Information Commissioners Office (ICO) has criticised local governments attitude towards protecting personal data, after four local councils were ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-11-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b44e6c346872f82670543b399276548bbd93c974","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91833B6F-7D16-4E7C-B070-B081E5FC24B8"},"incident_date":"2011-11-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c7d6b2c18bdc","org_name":"Cereus Network","org_type":"other","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bestpokerrooms.com/news/ultimate-bet-player-data-leaked/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/millions-of-online-poker-players-data-leaked-on-the-internet/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.subjectpoker.com/2011/12/ub-data-leak/"}],"summary":"In the latest news from the doomed Cereus Network, it has been revealed that Ultimate Bet player data was recently leaked onto the internet. While the information was only discovered this week, the information has been on that website since November 20th. The information is prese","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79bae0ce82bdb545f4aa1ec855101193ebdb73a9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BB56443-9C97-4527-8D9A-F458717AA845"},"incident_date":"2011-11-19","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6058bc9406bc","org_name":"Ascent Services Group","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"One of the HR people's laptop was infected by malware.  The entire contents of the laptop was shipped off to a file sharing site.  It contained full payroll data dump.  Company did not choose to notify--claimed exemption as a government agency.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fca480521f7597b7a49c974e85040577a2342844","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CA71B5F-957B-457C-968D-35D5274B6267"},"incident_date":"2012-06-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"An employee received a call from Port City Glass stating that they received a patient's records on their fax. They were told to shred the information that they received and told that the Privacy Officer would probably call them immediately. The patient's information was faxed to ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"396ddacf9b5bcc3c653c77e882e0e0da777e3a0a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1D406CD5-4EE3-449C-8D8D-7822BC6FF47D"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b35430f74db","org_name":"UCLA Health System","org_type":"healthcare","ransomware":null,"records_affected":2761,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8098523a61c82c3b8ed652760a922a9f1c379e36","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"267038D2-5423-47E0-9375-91C055B9291C"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edce8986ba70","org_name":"Stone Oak Urgent Care & Family Practice","org_type":"healthcare","ransomware":null,"records_affected":3079,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f5cfefbf748631a368650bb39ac6d2cdae548a9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3AC4FC0C-668E-4345-8D76-28210ED4F244"},"incident_date":"2011-11-18","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"460b4d58dec8","org_name":"Premier Imaging","org_type":"healthcare","ransomware":null,"records_affected":551,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fa14fc9e9abdb13113de5b57eb56ac2e552c7e0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CD6280B-A5F3-4241-B30B-52BEE3BD8B28"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3777e5f30ab3","org_name":"Morris Heights Health Center","org_type":"healthcare","ransomware":null,"records_affected":927,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93b92260b6062b43f6b94cae9a0331027a2ee0f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E79137CB-84CE-42B3-A3FF-69D4C7AEC89F"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74e7d3333187","org_name":"Julie A. Kennedy, DMD, PA","org_type":"healthcare","ransomware":null,"records_affected":2900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b7efb2610140d1b7c934fa513c548fc212685d8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B25A95F2-5B47-4D3A-B818-B619ECCE81A0"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"931a4a29e3c5","org_name":"Conway Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1472,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ab550d1f07f636d923d2a9bf685ca1f8d8bf675","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3876E334-B5CE-4D5F-B541-AF6D73938BF8"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1f667e569e6b","org_name":"Concordia Plan Services","org_type":"financial","ransomware":null,"records_affected":7059,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d01975bf927ff77730fa0f880616773e423d733d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00DCB3AD-AF4C-4AC1-8A6E-682DB697C727"},"incident_date":"2011-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b14dd35474d0","org_name":"Amerigroup Community Care of New Mexico, Inc","org_type":"healthcare","ransomware":null,"records_affected":1537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-11-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"939c44eca5e92503725528bfd9de60642b627228","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6E7644A-794A-46AE-BB03-250BFB307E65"},"incident_date":"2011-11-16","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dda427e888b","org_name":"Rensselaer County Jail","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/04/01/good-samaritan-hospital-data-breach-update/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/03/11/good-samaritan-hospital-sends-health-data-breach-letters/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://saratogian.com/articles/2013/03/01/news/doc513105ba6f4ba045285003.txt"}],"summary":"A nursing supervisor of Rensselaer County Jail was found to have misused credentials to access patient records without cause.  The Rensselaer County Jail information is maintained by Samaritan Hospital.  The hospital learned of the breach in November 2011, disabled the employee's","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f31a91ed4c5a56f74727acf9e43a17b13d5b8fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8E04295-D559-4B6E-BC63-505A808F5F69"},"incident_date":"2011-11-15","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d8c8a8fcffac","org_name":"Anthem Blue Cross Blue Shield of Indiana","org_type":"financial","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthpayer.com/story/info-6000-members-risk-after-social-security-numbers-stolen/2013-04-12"}],"summary":"Private health information for 6,000 patients was put in jeopardy when data was stolen from a server connected to Anthem Blue Cross Blue Shield of Indiana, Anthem Blue Cross Blue Shield of Ohio and Empire Blue Cross Blue Shield of Indiana.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f78070aaa612b7747d4aee953008e076b775c05","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FBCC05F-1982-49BB-B720-4CA60D301D11"},"incident_date":"2011-11-08","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0dde4e445947","org_name":"Aberdeen City Council","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/council-employee-publishes-vulnerable-childrens-welfare-details-online-30082013"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/~/media/documents/library/Data_Protection/Notices/aberdeen-cc-monetary-penalty-notice.pdf"}],"summary":"Employee accidentally publishes non-public information to public website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-11-06","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"280162eddcfab554f2dffaaaeeae866016f362f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C9A4D30-7CBC-493B-8CE1-97334E41CE75"},"incident_date":"2011-11-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ec2d71ec2a59","org_name":"Valve Corporation","org_type":"technology_saas","ransomware":null,"records_affected":35000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/valve-corporation-20120208.pdf"}],"summary":"Steam game forums hacked and defaced.  Intruders obtained a copy of a database with information about Steam transactions between 2004 and 2008.  This database contains user names, e-mail addresses, encrypted billing addresses and encrypted credit card information. We do not have ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c948dec147d6ff2e2b3315095a922531120f337c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FE50583F-CD84-40B7-8720-93F3E42AB243"},"incident_date":"2011-11-04","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"265a4a560425","org_name":"Wyatt Dental Group","org_type":"healthcare","ransomware":null,"records_affected":10271,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool-part-1-many-older-incidents-newly-added/;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-224477.pdf"}],"summary":"Wyatt Dental Group in Louisiana reported what sounds like an insider breach affecting 10,271 patients. According to the log entry, the breach occurred between November 4, 2011 and April 15, 2012 and involved ,Theft, Unauthorized Access/Disclosure,Electronic Medical Record. I was ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1f869285faa63f00b65609f4d64df2f807b8524","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58F9BEE9-595F-477B-8F03-CB74AB83AEA2"},"incident_date":"2011-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547f395ea00d","org_name":"Thomas Jefferson University Hospitals, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3150,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be7a93d97d957f2d2f27d65e143ab2ef77aa212f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"817E36D5-1791-4AEB-A75C-EAEFF6E1440A"},"incident_date":"2011-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c0521e9b719b","org_name":"Summit Medical Group, PLLC","org_type":"healthcare","ransomware":null,"records_affected":731,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c55bba7dbe967e3166adc2747cbb75c22c35f303","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F173851-CA3D-40AB-9252-9BDA1B5CC518"},"incident_date":"2011-11-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f22bdcb9d01f","org_name":"Florida Hospital","org_type":"healthcare","ransomware":null,"records_affected":12784,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c4984f52a16247b07df4b5fd2703aa0748b5a9e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE76ECD0-AA66-49C2-8E08-86C02505258D"},"incident_date":"2011-11-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"804af9f798a9","org_name":"American Continental Insurance Company","org_type":"financial","ransomware":null,"records_affected":690,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"922aee59793f2c22b8b469a1c623f76d2722520e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1137DFD-37E3-442C-A844-9A04071531A8"},"incident_date":"2011-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"509f7e58e254","org_name":"Regina Qu'appelle Health Region","org_type":"healthcare","ransomware":null,"records_affected":7,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cjme.com/story/report-slams-regina-quappelle-health-region-privacy-breaches/96232"}],"summary":"After several privacy breaches Saskatchewan's Information and Privacy Commissioner is telling the Regina Qu'Appelle Regional Health Authority it needs to do something to stop its employees from snooping.   The recommendations stem from three incidents that happened in the RQHR ov","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8daa5daaa2f75ca6655f62490372fa72695c1e4d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DAC5BD0-09FD-4ED9-9E09-908E4A6B43B8"},"incident_date":"2011-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"c78661ffef17","org_name":"Nexon Korea Corporation","org_type":"technology_saas","ransomware":null,"records_affected":13200000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.koreaherald.com/view.php?ud=20111127000229"}],"summary":"The police are investigating the hacking of 13.2 million users of Nexons massively multiplayer online role-playing game Maple Story.  On Thursday, Nexon found that Maple Storys backup server had been hacked, and personal information of 13.2 million of the 18 million registered us","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e87820ee159f19e2341148a0251e15e56fcef29","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"48934C98-689F-4EE7-905E-A525D8DAD761"},"incident_date":"2011-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b63317bf504b","org_name":"Lone Star Steakhouse","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cjonline.com/news/2011-11-29/company-settling-privacy-invasion-case"}],"summary":"A company accused of leaving thousands of sensitive employee records in an open trash container in a Wichita alley will pay $200,000 to the state and take steps to protect employee privacy in the future, Attorney General Derek Schmidt announced Tuesday.  Schmidt entered into a se","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6865ccd5a92b3c974ea50a398dd1eb8087beb194","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"61087A58-5CB0-40E7-A89A-86F95350A651"},"incident_date":"2011-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2d9c0c6888a","org_name":"Holy Cross Hospital","org_type":"healthcare","ransomware":null,"records_affected":9900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/southflorida/news/2013/09/24/holy-cross-hospital-patient-records.html"}],"summary":"Holy Cross Hospital notified 9,900 of its patients that their personal information might have been breached by an employee who may have intended to commit tax fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1330cdfa4599123f003c27eef0821cc99c7472d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C95593C-AAF7-4B57-B440-2391D21DE50B"},"incident_date":"2011-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cac2f26513db","org_name":"Florida Department of Health","org_type":"government","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/florida-department-of-health-of-orange-county-discloses-insider-breach-for-tax-refund-fraud-affecting-2300-patients/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wftv.com/news/news/local/identity-thieves-target-department-health/nbcqR/"}],"summary":"Health care workers steal patient data for tax fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"VN","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61234a9385b3bda4150e98e1582309cf39d70733","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E9FAC77B-EF35-4BCB-AF2B-53F74A5FDEC1"},"incident_date":"2011-11-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":200000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/10/;http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/"}],"summary":"Identity theft ring impersonates private investigator to purchase PII from Experian-owned company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f52c05afd21d5bc8a65922b25663aeaee449ed0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F72291C-CE82-4CD6-B8D5-CAF064FE9EC2"},"incident_date":"2011-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b252ab975f4d","org_name":"Ernst & Young","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/23621/ernst-young-loses-401k-information-of-bank-employees/"},{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/businessnews/2012/01/regions_says_employee_401k_dat.html"}],"summary":"Encrypted flash drive mailed from one corporate location to another did not reach destination. Letter was ripped, drive was no longer located inside.  The decryption key was mailed in the same envelope and was still inside.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"GB","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eb9c749da4325b9a777ae0566f15291853dded32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"740D7581-0D48-4DFE-9D46-766FC2966775"},"incident_date":"2011-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"9c032ffa641a","org_name":"Enable Scotland","org_type":"nonprofit","ransomware":null,"records_affected":101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.stv.tv/scotland/300202-charity-lost-personal-data-of-more-than-100-people-in-theft/"}],"summary":"Several USB drives were stolen from an employee's home.  PII for 101 people was stored, unencrypted on the drives.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"581b17f20b0647728ec7bbe79a56cb6091c81008","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D07B50C-88C3-4718-9B47-53C2C12A4A99"},"incident_date":"2011-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"8bb563e42685","org_name":"District Health Board","org_type":"healthcare","ransomware":null,"records_affected":64,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stuff.co.nz/national/health/85499091/nurse-suspended-after-snooping-through-64-patients-records"}],"summary":"Employee snooping","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b62fbd76723a2df7899fe4abe6aa1a2901852830","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8ACA5990-471E-4092-928E-DB5D16755266"},"incident_date":"2011-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"725911998306","org_name":"Citibank, N.A.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.argusleader.com/article/20130821/ARGUS911/308210056/Former-Citibank-employee-facing-embezzlement-charges-after-allegedly-using-customer-cards;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kdlt.com/index.php?option=com_content&task=view&id=29262&Itemid=57"}],"summary":"Bank employee uses access to customer banking data to commit fraud and embezzle money.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a76bb4f5e2805576de8b52ab48aabe3ee3b95f9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3353D554-7286-46FB-AF3B-2E311CD98A45"},"incident_date":"2011-11-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"2ad9194b1493","org_name":"Cattles Limited","org_type":"financial","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/business-16443598"}],"summary":"Two storage tapes were lost, which contained low-level personal data of clients who signed up from October 2005 to October 2010. They also contained human resources data relating to 18,000 current and former employees of the Cattles Group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49c466dbe322bfea0d70d5f43b334d2e03789064","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BA9B9B3-4CD9-4EEA-AC99-9FD947DB7ED7"},"incident_date":"2011-11-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6cc9eddf307","org_name":"BJ's Wholesale Club","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/bjs-20120402.pdf"}],"summary":"On March 1, 2012, BJ's Wholesale Club learned of the unauthorized use of the name, address and membership number of a resident of the State of New Hampshire.  The data was used to create a new online profile on BJs.com, which was used to purchase goods on the website.  The purcha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ef8459e2cc1346b52bfd2ccf45f1d721fe32c85","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3862DD36-B118-4946-821E-17AF12130E61"},"incident_date":"2011-11-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca8049da57e8","org_name":"101domain, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/101domain-com-suffers-securty-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hosted.verticalresponse.com/387203/30e48da6ce/1648530933/"}],"summary":"A vender of 101domain.com was compromised by phishing attacks. No customer data was confirmed compromised, however a potential exists that customer information, including payment information, was compromised. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-10-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9bd246336fcc9205985899a69220b8373aba7c32","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDB47895-DF24-421B-9DDA-952C8044EBAF"},"incident_date":"2011-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"31188d7182e3","org_name":"Guide Publishing Group, Inc.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/guide-publishing-20111207.pdf"}],"summary":"Hackers gained access to GuideYou.com's servers and credit card data of their customers.  They were storing name, address, PAN, expiry, CVV2/CVC2/CID.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-10-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"07f45e7e03414ec0aa7d1bec9520e0cb62162fbf","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC763C16-D218-4DAB-BB6F-28ABBFEA069E"},"incident_date":"2011-10-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9a14929a09cb","org_name":"Brevard Emergency Services","org_type":"professional_services","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents results in 2200 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7bb530daa78f7118ae6cea8295ba2f09598191d1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40F9EE27-934A-49BB-83C1-72B3563829F9"},"incident_date":"2011-10-23","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c665be8faa27","org_name":"First Transit","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/oh-first-transit-notifies-employees-after-malware-discovered-on-server/"}],"summary":"First Transit notifies employees after malware discovered on server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-21","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad9dfe5726db4c55341d9f10410027ddc328e259","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B69F509-37C1-4280-A754-A93BCE2ED166"},"incident_date":"2011-10-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"c90cc3578d14","org_name":"International Association of Chiefs of Police","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/law-enforcement-targeted-by-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/anonymous-and-antisec-attack-law-enforcement-websites/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/2011/10/anonymous-law-enforcement/"}],"summary":"Anonymous and Antisec factions dumped files on the net Friday detailing data from the computer systems of multiple law enforcement agencies and a law enforcement vendor, including the International Association of Chiefs of Police, Boston Police Patrolmens Association and the Bald","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-10-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"145df2fd623652f9fa1268a7ead47a8f5f497d06","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D0C474D-07A7-4C13-917E-C1768FF5F9E6"},"incident_date":"2011-10-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":4243000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/22111/"}],"summary":" Sutter Health, a healthcare system in northern California, reported that an unencrypted laptop containing personal information on more than four million patients was stolen from its Sacramento offices.  Sutter Health announced Nov. 16 that it first learned of the theft on Oct. 1","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e74dc476b4dd14d6dd1ae33be49bcb2a567519b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A6BEE54-ADF8-4925-BA98-D6D8E3BA13D8"},"incident_date":"2011-10-11","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A VA employee sent an un-encrypted email message containing a screen shot of the full Social Security number and name of one of VA Providers to VetPro Help \nDesk e-mail group. The email group is outside of VA network. The mail group is comprised of 10 VA staff and one non-VA staf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f370722188bcd059c245c05fd59fdc78ca543a2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27C66855-5735-4AF2-937E-DB616F5156D2"},"incident_date":"2011-10-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2a3af623020","org_name":"21st Century Oncology Services","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/21st-century-oncology-employee-stole-patient-information-for-tax-refund-fraud-scheme-feds/"}],"summary":"21st Century Oncology Services, an affiliate of Peninsula Cancer Care Center and 21st Century Oncology of Maryland,  notified the Maryland Attorney General in July that they had been informed by federal law enforcement of an insider breach allegedly linked to a tax refund fraud s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86a3eb053670b375452508e925ff2b62bed23c78","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"36628749-6BBC-4628-9AB3-099E25D6FDEB"},"incident_date":"2011-10-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e3e157a1a110","org_name":"Nursing and Midwifery Council","org_type":"nonprofit","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2013/nursing-and-midwifery-council-receives-150000-penalty-15022013;http://ico.org.uk/news/latest_news/2013/~/media/documents/library/Data_Protection/Notices/nmc_monetary_penalty_notice.ashx"}],"summary":"The DVDs with confidential information went missing in the mail. These DVDs were not encrypted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ce38d9cd272c2e4955cb11069aae1c4ee4326db6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF87CA5A-325A-4D5B-B087-EFF4C0431401"},"incident_date":"2011-10-05","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ee3df5788817","org_name":"Federal Reserve Bank","org_type":"financial","ransomware":null,"records_affected":71,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/former-federal-reserve-bank-of-chicago-supervisor-admits-data-theft.html"}],"summary":"Brian McCarthy, 31, a former supervisor at the Federal Reserve Bank of Chicago, recently pled guilty to theft of property for stealing 71 computer files containing confidential information relating to the bank's responsibility to assess and monitor its credit risk exposure.  McCa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f3c43c4e887c0abc9cb6504e32ee08e579557cf6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4DD79E62-7083-42DA-91CF-8C2E0B8497DF"},"incident_date":"2011-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"720ec110fb9a","org_name":"Winn-Dixie","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/jacksonville/print-edition/2012/08/10/former-winn-dixie-employee-sues-over.html?page=all,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/jacksonville/news/2013/04/08/purchase-program-company-agrees-to-pay.html?goback=.gde_4636751_member_230225934"}],"summary":"On July 31, Burrows’ attorney filed a class-action lawsuit against Winn-Dixie and a third-party vendor called Purchasing Power LLC. The suit, which claims damages of more than $5 million, states that the personal information that was breached included Winn-Dixie employee names, a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5ad9ad6deaf7a8ed5f6be49878d63effbefb102","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"980F6D26-F8CB-4834-B804-3E99DFC21A4C"},"incident_date":"2011-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"392fdbc77b2d","org_name":"TAT Elbowoods Memorial Health Center","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Improper disposal of desktop puts medical information for 10000 people at risk.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a577ccbfb8343de9bffcc1d181bc5e6df91c39c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AB2510D-1B7E-4516-BD3F-848E9773D751"},"incident_date":"2011-10-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"11c1e0d3e0a6","org_name":"Kaiser Permanente Northern California Department of Research","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/kaiser-permanente-northern-california-department-of-research-to-notify-participants-of-potential-breach/"}],"summary":"Malware discovered on a server containing personal and medical data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d789c57dd8e6968e5baa7f5fe0c35fc02d9c77b6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25CAD94C-8005-400C-8F3F-526AB0B5A748"},"incident_date":"2011-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"c2676aecf62e","org_name":"Julius Baer","org_type":"financial","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/08/22/us-swiss-datatheft-idUSBRE97L0I820130822,"},{"fetched_at":null,"title":null,"type":"press","url":"http://online.wsj.com/article/SB10001424127887324165204579028513334141776.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessweek.com/ap/2013-06-28/julius-baer-tax-data-theft-case-before-swiss-court"}],"summary":"A Swiss court on Thursday sentenced a 54-year-old computer specialist to three years in jail for selling client data from Swiss bank Julius Baer to the German tax authorities, after the man agreed a plea deal with prosecutors.  Switzerland has come under growing international pre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"921df9ea98c79b0b35202d150ded280526638607","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"126035B1-234D-4E45-B5A9-BB39C6E13EA8"},"incident_date":"2011-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"3d2f6b22cf72","org_name":"Hong Kong Police Dept.","org_type":"government","ransomware":null,"records_affected":285,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmp.com/news/hong-kong/article/1338971/police-and-hospital-authority-warned-watchdog-over-loss-private-data"}],"summary":"Confidential Personally Identifiable data lost by Police Dept","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bfb581493ac05d6f0e5406b70396498049af66a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25CE9AA9-2F4C-4E48-99F0-5E35F7D6F81A"},"incident_date":"2011-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d753e60a4e54","org_name":"GMR Transcription Services, Inc.","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ftc.gov/news-events/press-releases/2014/01/provider-medical-transcript-services-settles-ftc-charges-it;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ftc.gov/system/files/documents/cases/140203gmrcmpt.pdf"}],"summary":"A company that provides medical transcription services has agreed to settle Federal Trade Commission charges that its inadequate data security measures unfairly exposed the personal information of thousands of consumers on the open Internet, in some instances including consumers ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93bec49961235306fadd6a230bf5f4eb3df56237","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3124B1F6-2355-4F55-BBFC-7F3A7239CBC3"},"incident_date":"2011-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5373d9b78cd9","org_name":"Edge Auto Sales","org_type":"retail_ecommerce","ransomware":null,"records_affected":44,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kansascity.com/2013/02/12/4062584/jackson-county-id-theft-case-grows.html"}],"summary":"Missouri Attorney General Chris Koster on Tuesday called a Jackson County identity theft case the largest ever prosecuted by the state and said 44 victims have been identified.  The case against former Independence car dealer Terry Lee Morrow Jr., 25, had expanded significantly i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aaa33513457bbf60c5f170e5ed6383a29388a881","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1C4E9BA-9955-4D1B-8EE1-0A1A6504E1F7"},"incident_date":"2011-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"055af3841e3f","org_name":"Crozer-Chester Medical Center","org_type":"healthcare","ransomware":null,"records_affected":144,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/philadelphia/blog/health-care/2014/04/delco-health-care-worker-pleads-guilty-to-stealing.html"}],"summary":"A 50-year-old Brookhaven, Pa., man pleaded guilty today to stealing hospital patients identities as part of a tax fraud scheme. Reynaldo Estrada pleaded guilty today to one count each of conspiracy to commit identity theft, aggravated identity theft, and aiding and abetting the u","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96612daabe6db09ea15bd8c5cf8878106713d2df","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"295B5B09-6764-47F5-B101-773670F48796"},"incident_date":"2011-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"18218a69215c","org_name":"Broward County Court","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.sun-sentinel.com/2013-07-17/news/fl-broward-court-clerk-fraud-20130717_1_former-broward-court-clerk-courts-howard-forman-records"}],"summary":"At least three times between October 2011 and March 2012, an employee fraudulently used her work computer to steal the names, dates of birth, Social Security numbers and other personal information of drivers, which she then sold to someone else who used them to file income tax re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-10-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e7e401301d11dfe0f7c533d8e825cdeef00e59da","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF17827D-7826-4366-96E1-C28DA6F243B2"},"incident_date":"2011-10-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"afdbb440e93c","org_name":"Automatic Data Processing Inc","org_type":"other","ransomware":null,"records_affected":130,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/Sharapka,%20Oleksiy,%20et%20al.%20Arrest%20News%20Release.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/nj/Press/files/pdffiles/2013/Sharapka,%20Oleksiy%20et%20al.%20Amended%20Complaint.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/feds-bust-cybercrime-ring-targeting-payroll-financial-firms"}],"summary":"Organized criminal group uses stolen customer credentials to access accounts and transfer money to actor-controlled cards that were then cashed out at US-based ATMs or fraudulent purchases.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c7e86037ae26e27de219b3013c9bec12a9e6283a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4792F6E4-E605-4441-90B4-E38D232C02AB"},"incident_date":"2011-09-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"4dc0c084de6a","org_name":"MAPFRE Life","org_type":"financial","ransomware":null,"records_affected":2209,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.9news.com/story/news/2014/09/27/denver-company-hit-by-data-breach/16333735/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/denver-firm-reports-data-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/more-details-emerge-on-madison-street-provider-network-breach/"}],"summary":"Theft of a laptop results in the exposure of 2209 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2011-09-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4177287015e10f30218faf86fb66472dfbad4b6e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5B335CC-5C70-4526-88ED-A49E259A17CD"},"incident_date":"2011-09-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c252cd62157","org_name":"EmblemHealth","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/emblem-health-20120529.pdf"}],"summary":"Shortly before his departure, an employee emailed a copy of Emblem's Broker Master File to an email account owned by his wife.  It was also sent to the company he was about to join.  It contained the names, SSNs and broker license numbers of brokers.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9dbdc8292a6bb4d05f49a476df7256b74661714","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD47B217-3437-4227-8805-1EE6AB317AB6"},"incident_date":"2011-09-24","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e961ee2d22d9","org_name":"Kaiser Permante","org_type":"healthcare","ransomware":null,"records_affected":50539,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infolawgroup.com/2014/01/articles/breach-notice/california-attorney-general-files-lawsuit-based-on-late-breach-notification/"}],"summary":"In the first case of its kind (that I am aware of), the California Attorney Generals office filed a complaint against the Kaiser Foundation Health Plan, Inc. (Kaiser) alleging a violation of Californias unfair competition law (Business and Professions Code sections 17200-17210) a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"455ef366621032da09aab118f8112d1b521c575c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"134EB8C7-4188-40E8-A7CD-E502EDB51531"},"incident_date":"2011-09-24","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9f23a2be6aae","org_name":"Diatherix Laboratories","org_type":"healthcare","ransomware":null,"records_affected":7016,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govhealthit.com/news/when-patient-health-data-lands-google;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-243549.pdf"}],"summary":"A Huntsville, Ala., clinical diagnostics laboratory has notified more than 7,000 individuals of a HIPAA breach after the company discovered protected health information contained on a third-party server had been unsecured for nearly three years.  Diatherix Laboratories last month","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6add9430ccc01514a8020712bc17b98f2934063b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FEB6C666-8B88-4BF7-AAD8-51DEB6D38927"},"incident_date":"2011-09-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ee776137ccd","org_name":"Health Texas Provider Network","org_type":"healthcare","ransomware":null,"records_affected":1259,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Stolen laptop leaves 1259 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0b41aeeef250171483fb80a9c6bc3ceda90bfd32","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98DF5214-CAFE-4146-88A3-01214CE4B097"},"incident_date":"2011-09-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"73b4d770d955","org_name":"United States Airforce","org_type":"government","ransomware":null,"records_affected":438,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yokota.af.mil/news/story.asp?id=123331983"}],"summary":"On August 21, 2012, the 374th Medical Group (374 MDG) at Yokota AB, Japan, discovered a potential compromise of patients' protected health information (PHI) when, on or about September 22, 2011, a former 374 MDG provider mailed surgical reports he performed at the facility to his","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fdf2d5b98ddb214f94f7179b20e1f3f41ded4f5","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EDC96784-66A9-46CC-86B4-3C83861DD947"},"incident_date":"2011-09-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aaceae8e532a","org_name":"Lawrence Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=21361"}],"summary":"Lawrence Memorial Hospital learned that certain information maintained by Mid Continent Credit Services, Inc., d/b/a Blue Sky Credit, the hospital’s vendor for online patient bill-pay services, was inadvertently made publicly available on the Internet.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0c72bc4f68251c35d36719150d8deb0eaeb7961d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8C2BD75A-89FD-47D8-9396-5913E3D930B6"},"incident_date":"2011-09-14","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"779b86276531","org_name":"Skagit County Public Health Department","org_type":"government","ransomware":null,"records_affected":1581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/03/07/hhs-fines-skagit-county-for-first-county-hipaa-violation-settlement/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/wa-skagit-county-government-settles-potential-hipaa-violations/"}],"summary":"ePHI published erroneously to a public server, and HIPAA penalties ensue.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecf7ac261ba0cf84d538370c81bc5bb63b6b7734","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC463A06-B2D7-44BD-AF00-00303745261A"},"incident_date":"2011-09-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a74fdde58918","org_name":"John T. Melvin, M.D.& Associates","org_type":"healthcare","ransomware":null,"records_affected":2541,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of documents leaves 2541 records exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3adedd550db1bd3f88853241403761800557313e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3D12E02-BDE4-49D9-AFAD-A024BEF62EBD"},"incident_date":"2011-09-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2eff0a7559d9","org_name":"Adult & Pediatric Dermatology, PC","org_type":"other","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff9df48dfe33362f518a05f529fad54cdb878da6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A2843185-5C8E-4FD7-BC40-E626023451AE"},"incident_date":"2011-09-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83c8aa4172ec","org_name":"TRICARE Management Activity","org_type":"government","ransomware":null,"records_affected":4901432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/security/risk-management/military-health-plan-data-breach-threatens-49-million/d/d-id/1100509?"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.mysanantonio.com/news/military/article/Tricare-patient-data-lost-after-car-burglarized-2195822.php"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5242315b894acc59a9b568eeea4baf3b7f194e6a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE7C843B-1180-4DEB-A419-5245230D9EC3"},"incident_date":"2011-09-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64863aa73a87","org_name":"Texas Health and Human Services Commission","org_type":"government","ransomware":null,"records_affected":1696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"\"An unencrypted laptop was stolen from an employee's vehicle.  The laptop contained the ePHI of 1,696 patients.  The information at issue included patient names, dates of birth, gender, Medicaid identification numbers, procedure codes and diagnosis. Following discovery of the bre","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20b24a66c24758b7f4f4fe2644e7c14689b1f949","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"696DAF40-C970-4924-AA6A-3E0709C95E6B"},"incident_date":"2011-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6915be16ae85","org_name":"Vendini","org_type":"other","ransomware":null,"records_affected":105947,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theintelligencer.com/local_news/article_a717e6fc-cf90-11e2-a095-001a4bcf887a.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www2.ljworld.com/news/2013/may/23/lawrence-theater-warns-customers-credit-card-infor/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.starnewsonline.com/article/20130531/ARTICLES/130539915?Title=Thalian-Hall-says-hackers-may-have-stolen-customer-information;"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/south-orange-arts-center-20130529.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://detroit.cbslocal.com/2013/06/13/um-warns-ticket-buyers-of-security-breach/;"}],"summary":"Online ticketing service provider suffers data breach that leads to payment card loss. Numerous secondary victims, mostly theatres, are affected as a result.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8efe898ac1c1d916c0fac5bd319133b6702f1572","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"32F4DDA3-EEBC-40B2-8815-A30CD20C35EA"},"incident_date":"2011-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02efea3e5f0c","org_name":"Sentara General Hospital","org_type":"healthcare","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2013/08/two-former-sentara-workers-charged-identity-theft;"},{"fetched_at":null,"title":null,"type":"press","url":"http://hamptonroads.com/2013/10/sentara-employees-took-info-3700-beach-patients,"}],"summary":" Two former Sentara Healthcare nurse's aides were indicted Wednesday on charges of stealing the identities of at least a dozen patients as part of an elaborate scheme that netted more than $116,000 in fraudulent tax refunds.  Festus Ighalo, 36, of Virginia Beach and Emmanuel Effi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3c287c5f57241c63e01cbaa27604e6dd0e2affd1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D17744C-1DB8-457C-BAE8-D444471275C0"},"incident_date":"2011-09-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fbc07e2fd33b","org_name":"Morrow County Firefighters and Squadsmen Association","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://archive.marionstar.com/article/20140418/NEWS01/304180006/Morrow-County-EMS-911-breach-raises-questions"}],"summary":"Patient information in the Morrow County emergency medical service and 911 systems was at risk of being compromised in 2011, said the 911 coordinator at the time and the current 911 supervisor.  Keith Acker, current 911 coordinator for the Morrow County Firefighters and Squadsmen","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"440c52069883a392c7d29a392a34bb1df7723f0e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"570148F4-C919-4FA5-BD74-C805D6B36063"},"incident_date":"2011-08-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"59b8975770de","org_name":"InStep Foot Clinic, PA","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2768975f05451aac9555fbf7bd1c414d639df6d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98A48AC0-E3AF-4DC8-A4ED-C01359939124"},"incident_date":"2011-08-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"An employee emailed Veterans/patients and included their name and phone number The employee also emailed the messages to himself and another patient. One email to himself contained patient name and last four SSN as well as medications and treatment note.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c178f210ed27e787f591923509b18109b4454da5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"54822B02-C23F-4028-869D-4188A9B1A95B"},"incident_date":"2011-08-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc7c2ff05c97","org_name":"Indiana University","org_type":"education","ransomware":null,"records_affected":3266,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c67145ff5981aee63dd8d7013f7a29d28b2470a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"82A76F7F-A90D-4E6C-ADD9-28D8FFBF2766"},"incident_date":"2011-08-12","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95a251f0a170","org_name":"Indiana University School of Optometry","org_type":"healthcare","ransomware":null,"records_affected":757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d02f983e27946ecef44db5ba5e75fcfa0a4a18f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6F1AEBA-9472-484F-8941-B552075FA07D"},"incident_date":"2011-08-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"24363aa72fc7","org_name":"Diversified Resources, Inc.","org_type":"professional_services","ransomware":null,"records_affected":863,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7827f14e2a6d99b4857bcaebea43c5e20b3231a7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E0324E1-3548-48E9-AE3B-AB0494A34671"},"incident_date":"2011-08-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"643173013a58","org_name":"Highmark","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/itu-235011.pdf"}],"summary":"On August 9, 2011, Highmark sent an email to Benecon, among others, with a ZIP file attachment containing a number of documents.  Unbeknownst to Benecon at time, Highmark had inadvertently included certain personal information in that attachment, including the names and SSNs of a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4aa34a82877230af1444306eda5f1ba1286f6e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2DBA8CB0-F0A4-4752-91E7-DA5D797359EF"},"incident_date":"2011-08-09","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1720a6ef76f","org_name":"Experian","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/experian-20120405.pdf"}],"summary":"Credit reports accessed using a customer's credentials.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cfb53a618e5e02b31a3a1839dfe68a037b12cae1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D95C59B-FB3C-4333-9B4E-B6EB4A83C440"},"incident_date":"2011-08-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"429b8c2c9a47","org_name":"Ashley Industrial Molding, Inc. Employee Welfare Benefit Plan","org_type":"financial","ransomware":null,"records_affected":506,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"hacking of a network server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3120fa6b4d7b65f5b17340aa2f6f6cf330540502","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EAC07B6E-B57E-4400-9D23-34187CF98510"},"incident_date":"2011-08-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78ae85df68a6","org_name":"Henry Ford Health System","org_type":"healthcare","ransomware":null,"records_affected":520,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be6a8644bceb8373e232a674ace2ff8b1962abd8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"534C81DA-FE38-4CA0-98E1-185B4FE224C1"},"incident_date":"2011-08-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"feea94ec9768","org_name":"Freda J. Bowman MD PA","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cf7e59c367c64a29436fa29d7ec0bb7c9f1fc71","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B279927-00E9-41B0-8DF7-95417D7A5993"},"incident_date":"2011-08-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"703a34176721","org_name":"Brigham & Women's Hospital","org_type":"healthcare","ransomware":null,"records_affected":638,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/?p=11108"}],"summary":"A computer was stolen from building at Brigham and Women's Hospital that contained patients records ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4f7032d3ee822c049a9ff88310a27b01d625bb4e","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8E16E5E-8BE5-4D22-AACF-2C0E91656BC4"},"incident_date":"2011-08-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"64c3c603eb4f","org_name":"Tallahassee Memorial HealthCare","org_type":"healthcare","ransomware":null,"records_affected":124,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/02/01/tallahassee-memorial-healthcare-strengthens-privacy-policies/"}],"summary":"Patient data was compromised when Parson gained unauthorized access to his manager’s log-in to the hospital computer system to pull patients Social Security numbers. Additionally, investigators said he stole patient information from emergency room data sheets that had been thrown","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"906eee3c6cd84d1897863bbb97f34ba671f001ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1F3E3415-9E72-4B81-A849-161940C95CBA"},"incident_date":"2011-08-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6259c41c475b","org_name":"Nemours Foundation","org_type":"healthcare","ransomware":null,"records_affected":1055489,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.inforisktoday.com/16-million-affected-by-lost-backup-tapes-a-4139"}],"summary":"About 1.6 million individuals are being offered one year's worth of free credit monitoring and identity theft protection following a breach incident stemming from the loss of three unencrypted backup tapes at a facility owned by a children's health system.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de0125fec287aad6af399914690b4b0252d36ee5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6171024E-1F60-40C5-A9F2-C35A90302777"},"incident_date":"2011-08-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2ce921f6dad","org_name":"Great River Entertainment","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/great-river-20121001.pdf"}],"summary":"Payment card system (not clear if server and or terminal) had malware that captured and stole credit and debit card information. Fraud resulted for some customers. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c0dcd275451ce777f0c3a0c48be16a4cbeda0f4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86487EF5-848A-44FC-B556-62572F23122E"},"incident_date":"2011-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2af5e2a1f6dc","org_name":"Flow Traders","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/08/26/usa-crime-trading-idUSL2N0GR1HA20130826"}],"summary":"Internal actor acquires IP from employer and sends it (source code) to outside party.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"589a3ee4fbca1b393089eb5edfb69a48af66f886","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F01D807-AA42-4D27-B0BE-9357D7B2EE8F"},"incident_date":"2011-08-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"cfc8ec00b154","org_name":"Combined Healthcare","org_type":"healthcare","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisisstaffordshire.co.uk/Patient-details-faxed-wrong-number/story-19283108-detail/story.html"}],"summary":"A MENTAL health trust has been fined for sending medical details of three patients to a member of the public.  Combined Healthcare, which runs psychiatric and learning disability services in North Staffordshire, has been told to pay £55,000.  The financial penalty is for what the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c140967fe8c11517cdc0dc8e183422ecb09458b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80143753-A5B3-4F98-84DB-4E207079A128"},"incident_date":"2011-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"557a5cfb49f9","org_name":"Best Buy Co., Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abcnews.go.com/US/ala-student-sues-best-buys-geek-squad-circulation/story?id=19950219"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nydailynews.com/news/national/suit-claims-best-buy-geek-squad-stole-naked-pics-article-1.1427879"}],"summary":"Geek Squad employees steal nude photographs from customer laptop and upload to Internet resulting in lawsuit.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"557b59f906d1ae1ee905151218864aa9f5e2cc07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3A742F30-39E2-4CCF-86FD-29015A6D71AA"},"incident_date":"2011-07-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef1b846ba0dc","org_name":"Treatment Services Northwest","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9309ef125aae010ad0356631df8986a1cbac171","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCD46E07-7EB1-4416-AE9C-4FB9E3C08FC6"},"incident_date":"2011-07-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5bda24f72356","org_name":"United of Omaha Life Insurance Company","org_type":"financial","ransomware":null,"records_affected":1631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b38d8d8c98542c89069da91bf72c663100084a5d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5D77EF2-87D4-4CC2-9EE4-6CA1355A8523"},"incident_date":"2011-07-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7306b7cbfb5d","org_name":"United Health Group Health Plan","org_type":"financial","ransomware":null,"records_affected":3994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25c23c8e4b9fab84cbc0e7268be1ea084f8672bf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3B36210-9E12-4F67-B5CF-57880324360E"},"incident_date":"2011-07-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"911020c64f18","org_name":"Mutual of Omaha Insurance Company","org_type":"financial","ransomware":null,"records_affected":705,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e38bc36a24791f60e95896d51b4be5003b438de1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B3F7F60-CC74-4980-93CA-51D3DDF246FD"},"incident_date":"2011-07-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a50d9d421bd","org_name":"Muir Orthopaedic Specialists, A Medical Group Inc.","org_type":"healthcare","ransomware":null,"records_affected":1800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c4f6d161afc04ae1b28638d70c625691554f155","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9E691CF8-D2CC-464E-BE0C-B44F956692E1"},"incident_date":"2011-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A Veteran employee suspected that a co-worker had inappropriately accessed his CPRS file and requested a Sensitive Record Access report be run to show who \nhad accessed his record from 07/20/08 through 07/01/11. The report was run and identified one co-worker who had accessed his","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92c2b2a821bb00c9438ca5c2fb29077f51214c8c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3BB05C7-3260-4638-9BB3-5B146C66DBA7"},"incident_date":"2011-07-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"82d253d212fc","org_name":"North Memorial","org_type":"healthcare","ransomware":null,"records_affected":9500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fiercehealthcare.com/it/minnesota-health-system-pays-1-55m-after-failing-to-make-ba-agreement-conduct-risk-analysis"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a3a27dafe90b4d33e26b317660d42cb142dda00a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C2015E67-C45C-43F0-8218-5699F2C3C4A5"},"incident_date":"2011-07-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c50a1dab5e28","org_name":"Fairview Health Services","org_type":"healthcare","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0196072257b4433ddc2ba550d04f952acdf12daa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25D9F821-45F0-41ED-94E4-512F4ED63663"},"incident_date":"2011-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7b09139e417","org_name":"VA Gulf Coast Veterans Health Care System","org_type":"government","ransomware":null,"records_affected":1797,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"800f0868bb56dd378b57309afd272e59f1394e4d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63C77F22-82F6-4A7F-AB6D-A637BB616857"},"incident_date":"2011-07-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a55861ee80d","org_name":"University of Wisconsin Oshkosh","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-07-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c662ea25b1d6eeaa9d24f840c308ff92e5680dd","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D7CB445-4174-4C34-A09A-0D9BFFA99AB6"},"incident_date":"2011-07-18","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"9b568f5bb697","org_name":"SK Communications Co., Ltd.","org_type":"technology_saas","ransomware":null,"records_affected":35000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cso.com.au/article/402450/anatomy_cunning_apt_sk_communications_breach/"}],"summary":"Hackers breach an antivirus and patching company and redirect computers from a single victim to download a remote access tool. Hackers then steal personal data for approximately 70% of the South Korean population.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-07-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0feb4ad060270d6e89b8796b6ed5cacc2c13af5e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3E5FBAF-6B3D-4203-A13C-C72B4B27EC73"},"incident_date":"2011-07-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"cfd9cd1d0632","org_name":"Dialogic Inc","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-215180.pdf"}],"summary":"Break-in results in stolen devices, which contained PII of current and former employees.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f15c8e8fe734b0be70590f5ded5bbd78d205c928","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DAA921A-2B94-49F3-9957-516AE19D6F69"},"incident_date":"2011-07-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a033b4e18659","org_name":"VA Illiana Health Care System","org_type":"other","ransomware":null,"records_affected":518,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6fcf986428d57edf1ec70533c4bcf183c848dd2d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CF8145D0-59DE-4B9D-AB41-2843A32A850B"},"incident_date":"2011-07-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f59bc774506","org_name":"Jonathan Noel MD","org_type":"healthcare","ransomware":null,"records_affected":2059,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdcf3929e2c9f5689bf34d22e35b3d98e75308f7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"74CFC54E-69CD-4584-80C1-ADDA04E29B08"},"incident_date":"2011-07-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b420536b41d","org_name":"NEA Baptist Clinic","org_type":"healthcare","ransomware":null,"records_affected":3116,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"IN","motive":"espionage","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a47080d58614fdaceb4540a807b696d606460d8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"40029DA6-6C33-4344-82AA-27B9BA623EEC"},"incident_date":"2011-07-11","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IN","org_id":"311c96123f27","org_name":"Arhan Technologies","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mumbaimirror.com/mumbai/others/Pune-firm-wins-Rs-60-lakh-in-data-theft-case/articleshow/20709853.cms"}],"summary":"Corporate espionage incident involving former employee of victim company who left with sensitive data and continued to access the e-mail system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5665d78705b3a3ef330218ac07d74eabce24aab2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"382E858F-6B90-47CA-9ACB-36762DB41EAB"},"incident_date":"2011-07-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7557d70d0e5","org_name":"Austin Center for Therapy and Assessment, LLC","org_type":"healthcare","ransomware":null,"records_affected":1870,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de917afe63e51d6840d81f2aee15e30be4bafa09","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C8497995-FF55-462C-9C4E-4A3861017E33"},"incident_date":"2011-07-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d289c18686d","org_name":"Neurological Institute of Savannah & Center of Spine","org_type":"healthcare","ransomware":null,"records_affected":63425,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1056584a647dd39806f824862a65842e4be603c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C1B56CB-1685-48EF-B44B-61FE9528A9A8"},"incident_date":"2011-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"76cfe39c6784","org_name":"Workplace Health, Safety and CompensationCommission","org_type":"financial","ransomware":null,"records_affected":12,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thetelegram.com/News/Local/2012-02-03/article-2885584/Workplace-safety-commission-reports-privacy-breach/1"}],"summary":"employee accessed 12 injured workers' records without a justifiable work purpose over a three-year period","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d671b3480d8aa89b3513b445ea8b0bd76b285980","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AB6CA6E-2D3D-43A7-A9ED-4667F86388E0"},"incident_date":"2011-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e05edfafdc09","org_name":"Washington State Department of Social and Health Services","org_type":"nonprofit","ransomware":null,"records_affected":3950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e0572e4b00aebd84bffe06a55061d82c26e3f6e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3A0D2C3-DB93-45C9-B276-07C1D2E8E7F4"},"incident_date":"2011-07-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d753c4121e6c","org_name":"Serco Inc.","org_type":"professional_services","ransomware":null,"records_affected":123587,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/computer-security-breach-at-serco-affects-123000-thrift-savings-plan-participants/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nextgov.com/cybersecurity/2013/08/tsp-board-new-contractor-tighten-security-federal-retirement-plan/69554/?oref=ng-dropdown"}],"summary":"Article on contractors for ACA site disclosed prior security breaches. This entry is modeling the 2011  incident that exposed thrift plan contributor data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d01aad22c1d3c0aa1fc1cdc8902d1acfe7f9a98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7EC52E4-FEFF-4392-B80B-2379E323F205"},"incident_date":"2011-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1198ccf7c407","org_name":"Leeds City Council","org_type":"government","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://ico.org.uk/news/latest_news/2012/local-councils-fined-over-300000-for-losing-personal-data-17122012;http://ico.org.uk/news/latest_news/2012/~/media/documents/library/Data_Protection/Notices/leeds_city_council_monetary_penalty_notice.ashx"}],"summary":"News release: 17 December 2012 There is an underlying problem with data protection in local government  Information Commissioner  The Information Commissioners Office (ICO) has criticised local governments attitude towards protecting personal data, after four local councils were ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a01636dc8e54f4b93809f06ed91ab6dbb902c8c8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"62591138-DAC8-4299-ADDF-A2CC574812FC"},"incident_date":"2011-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d11c141d19d6","org_name":"Health Research Institute, Inc., Pfeiifer Treatment Center","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"93aaa1dd9544f0ebbd19257a5e41a6324a02c2fe","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"42EC4C3F-89FD-400A-B9DF-F24F6A5DAC7E"},"incident_date":"2011-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"12d296840a8e","org_name":"Global Payments Inc.","org_type":"financial","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/global-payments-breach-tab-94-million-a-5415/op-1"}],"summary":"Hackers gain access to Global Payments and steal 1.5 million credit card numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6de2ae15a2bbbc4275477ab95134130f6ba16636","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DCCC00D-588B-4EB3-BD1B-72B198657021"},"incident_date":"2011-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"911285bb3fc8","org_name":"Florida Hospital Celebration","org_type":"healthcare","ransomware":null,"records_affected":760000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.govinfosecurity.com/prison-time-for-health-data-theft-a-5442"}],"summary":"A former Florida Hospital Celebration emergency department registration clerk has been sentenced for selling patient information he improperly accessed in a breach of thousands of patient records.  See Also: How to Identify Meaningful Alerts from the Security Noise  Dale Munroe I","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"beb4c294d6c628b76f0a6a8f694610ff17b6bf8e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0CC51554-22AB-4C41-A3A3-AC54DB1527DB"},"incident_date":"2011-07-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f9ae3a5d7355","org_name":"Bank of Nova Scotia","org_type":"financial","ransomware":null,"records_affected":643,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.canlii.org/en/on/onsc/doc/2014/2014onsc2135/2014onsc2135.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.rubinthomlinson.com/blog/privacy-breach-employee-price-tag-employer/"}],"summary":"Richard Wilson, an employee of the Bank, has admitted to providing private and confidential information of Bank customers to his girlfriend, who then disseminated the private information to third parties for fraudulent and improper purposes. As a result of the Bank employees cond","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8e0c310595359946885c9775cb9aa056f3ec612","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92C10AF3-00B2-48D9-AB60-09561BBCAEE4"},"incident_date":"2011-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"446a36a2bb21","org_name":"Accretive Health, Inc.","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ftc.gov/news-events/press-releases/2013/12/accretive-health-settles-ftc-charges-it-failed-adequately-protect;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ftc-approves-final-consent-settling-charges-that-accretive-health-failed-to-adequately-protect-consumers-personal-information/"}],"summary":"Accretive Health, Inc., a company that provides medical billing and revenue management services to hospitals around the country, has agreed to settle Federal Trade Commission charges that its inadequate data security measures unfairly exposed sensitive consumer information to the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-06-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2128b1a532126fa57070b4c6fb5ddc58504102a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"76EB5510-1415-4C04-A489-64FB61963AC8"},"incident_date":"2011-06-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"58f2a5ec3f35","org_name":"Valpak","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/valpak-20121214.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.atg.state.vt.us/issues/consumer-protection/privacy-and-Data-Security/documents-and-resources5/valpak-security-breach-notice-ltr-to-consumer.php"}],"summary":"on November 14 and 12, our client, learned from an investigator at the United States postal inspection services that a temporary independent contractor used by the company was indicted and charged with mail fraud. When the individual was arrested November 2012, law enforcement fo","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0a60ca43e654d3e7577783d6b67836136fa609c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"174DC2C2-C333-40BB-9E9B-317310FE2EEC"},"incident_date":"2011-06-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1764faa05938","org_name":"UnitedHealth Group","org_type":"financial","ransomware":null,"records_affected":19100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/hhs-updates-breach-tool/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7fa7cdf0ab8765702e90202932404858773fa88","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B38B2904-6CCC-4B43-9AB3-C79702932151"},"incident_date":"2011-06-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"199e0ffbb08e","org_name":"Health Care Service Corporation","org_type":"financial","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-06-27","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"00b686069f3b6353a5799a1122460ca4af771e91","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2FE0113-539F-4F60-B8BC-5FAC3B6C0A3B"},"incident_date":"2011-06-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"9f97858cd432","org_name":"Washington Post Co/The","org_type":"other","ransomware":null,"records_affected":1270000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcmag.com/article2/0,2817,2388200,00.asp"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/wp-srv/jobs/product-pages/fraud-email.html"}],"summary":"Unknown hackers broke into The Washington Post's Jobs website last month, stealing about 1.27 million user IDs and email addresses. The Post did not elaborate on the methods used by the intruders or vulnerabilities in its systems that might have given outsiders access to users' p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8f7409f102010064e0f483a764d91d906b9bade6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5F5FBD41-76A0-4A4A-8B86-8D864582803F"},"incident_date":"2011-06-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dc8ed083aae","org_name":"Gail Gillespie and Associates, LLC","org_type":"professional_services","ransomware":null,"records_affected":2334,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bbc72c51d38f1295aa89451116aecf1bda542bf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94BF4941-37F8-4CE4-B125-D29DAD2E4983"},"incident_date":"2011-06-24","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3440a2c09f57","org_name":"US Central Intelligence Agency","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nationaljournal.com/defense/panetta-leaked-information-to-hollywood-writer-20131211"}],"summary":"CIA Director Leon Panetta accidentally leaked \"top secret\" information to Mark Boal, who wrote the script for Zero Dark Thirty, about the raid which killed Osama bin Laden. The incident happened at a June 24, 2011 CIA awards ceremony where Panetta spoke. A Panetta spokesperson to","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b63009a132558b56217785bb6ed2940f71e86537","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4420894A-25CD-417D-8A5C-83691326BFC3"},"incident_date":"2011-06-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f732d20cbbfc","org_name":"Clara Maass Medical Center","org_type":"healthcare","ransomware":null,"records_affected":8795,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b101a039288c5dd0bcbedc14c01a4d5544705de","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0E387C0-C662-425D-9F71-FF1EE034AE32"},"incident_date":"2011-06-23","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4dd8fd57107","org_name":"NYU Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"65d1201f5555495320a7c28456d78f72da6d30fa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CCA32518-8858-4ABD-903E-983E56BAFE45"},"incident_date":"2011-06-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f7a928edbfaa","org_name":"NOL, LLC d/b/a Premier Radiology","org_type":"healthcare","ransomware":null,"records_affected":810,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a laptop exposes 810 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"092eac0eaa91e5db3eb25e3f1635f844727dec49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E06952E3-3154-49A4-A123-6EEFA6ED1796"},"incident_date":"2011-06-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b723540f427","org_name":"Texas Health Presbyterian Hospital Flower Mound","org_type":"healthcare","ransomware":null,"records_affected":10345,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-06-17","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e3ea3818bf234371174000677b6efdb53156dc3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2974774-6D71-4049-942C-8AEC62CE9EA6"},"incident_date":"2011-06-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b81f3906b817","org_name":"Arizona Department of Public Safety","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/law-enforcement-targeted-by-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/a-breach-that-crosses-the-line/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/231156/lulzsec_hacks_arizona_state_police.html"}],"summary":"The pinheads over at LulzSec have crossed a major line. They hacked into the Arizona Department of Public Safety and published the names, addresses and other personal information of police officers (including their wives names and email addresses). They also published a lot of pr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-06-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94e2c56dcd45b286f0e2a81160c74cc0c36b92e3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9151967F-6A4A-4B97-8F31-44D08867D08B"},"incident_date":"2011-06-28","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran A was given a prescription to fill with Veteran B's name, last 4, and DOB on it. He returned it stating it wasn't his information. The employee was questioned and she stated she had the wrong patient pulled up on her screen by accident. Supervisor spoke with employee abou","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2011-06-15","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6e428d8c300e31e97d0c06eea4e38983458e267d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F2B414EC-ECAF-457A-A423-0599789E9863"},"incident_date":"2011-06-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b1298a7910d9","org_name":"Fling.com","org_type":"technology_saas","ransomware":null,"records_affected":40000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ibtimes.co.uk/fling-com-breach-passwords-sexual-preferences-40-million-users-sale-dark-web-1558711"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/security/2016/05/cluster-of-megabreaches-compromise-a-whopping-642-million-passwords/"}],"summary":"40 million credentials reportedly stolen from an adult dating website called Fling.com have been put up for sale on the dark web. The  information reportedly contains email addresses, plain text passwords, usernames, IP addresses and date of birth records. Additionally, the compr","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e8bb5f0c7cad2d0e4acbcfecd75262340317c45","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03BEF0EF-0925-4711-8859-1EC0131397F3"},"incident_date":"2011-06-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53d685af4598","org_name":"University of Missouri Health Care","org_type":"healthcare","ransomware":null,"records_affected":1288,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c4ab30e502cb6572b18a4371619da034e988ad7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5D0436CA-F4FA-4406-A868-190A4075C006"},"incident_date":"2011-06-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8469aa29c37","org_name":"Mount Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":712,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"67f8fce6ece4d4cdc0c1acfa682cb87b3fe753fb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DC1291BA-AD0A-465C-9BF7-3EACF9ED148B"},"incident_date":"2011-06-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a4a18784625","org_name":"Ohio Health Plans","org_type":"nonprofit","ransomware":null,"records_affected":78042,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-06-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"514c12f7227c0ec410cb2820ac7f310480b1844b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6CD44468-F59D-4F7A-9D88-C9DCEA743969"},"incident_date":"2011-06-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ace0e729d19","org_name":"Saint Joseph - Berea","org_type":"healthcare","ransomware":null,"records_affected":1986,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Loss of a portable device exposes 1986 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b8e887af18a1ee83ad5c60f01ea5a17baffc491","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BAD113A-3592-44E5-A3E9-2BC5A110FE55"},"incident_date":"2011-06-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9137e0e382cc","org_name":"Zocdoc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/patient-appointment-booking-service-notifying-patients-of-potential-breach/;"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/CA%20Consumer%20Notification%20Zocdoc_0.pdf?"}],"summary":"Zocdoc, an online booking system for dental or medical appointments, is first notifying patients almost one year after they learned programming errors enabled providers to access patient information they should not have had access to.  In June, 2015, Zocdoc reportedly learned tha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f5532ee6f5ad0b1ec51b5564e0b0c2141fe353f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7710424D-5278-4C35-857F-732E8F0BF30F"},"incident_date":"2011-06-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c6cc66cd465","org_name":"United Airlines","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newser.com/story/121363/united-airlines-computers-crash-strand-thousands.html"}],"summary":"Network outage results in numerous grounded flights for United Airlines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"activist"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6a4ad4d354e228e9ca7e9043e4f1737622ed030c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0C6D8130-A1C0-407A-99C3-939126346DC7"},"incident_date":"2011-06-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7452dc549144","org_name":"Sony Pictures Entertainment Inc.","org_type":"technology_saas","ransomware":null,"records_affected":1000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://mashable.com/2011/06/02/sony-pictures-hacked/"}],"summary":"Hackers compromise website and steal customer data for 1 million users.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9144880eb59a0d311377ac97418277376b27008a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"87E93D67-A9A6-421B-B14D-05E975FB65D5"},"incident_date":"2011-06-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b85cced1d67","org_name":"Northwestern Mutual","org_type":"financial","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/usao/ins/press_releases/Pressrelease12/Myers.20120911.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.1011now.com/home/headlines/Customers-Scammed-by-Their-Financial-Adviser-200619271.html"}],"summary":"Employee misues access to commit identity fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e905c670e7d0efeced271b1a7a5f8c6aadc7154a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BE63400-AEDE-44EB-8755-A78A96FB11A3"},"incident_date":"2011-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"5f61075c3ed8","org_name":"GB Ministry of Justice","org_type":"government","ransomware":null,"records_affected":1182,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/UK-Ministry-of-Justice-Fined-for-Exposing-Details-of-Over-1-000-Inmates-393251.shtml;http://www.databreaches.net/uk-privacy-watchdog-fines-ministry-of-justice-for-email-leaks-of-prisoner-details/"}],"summary":"clerk at UK Ministry of Justice sent personal information of 1,182 prison inmates via email attachment on three different occasions (misdelivery)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"BE","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f530bc5d4d4a38d092504d2d83d16afa6ee2e61","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3D01D30-EB1A-458C-A259-679A688760C8"},"incident_date":"2011-06-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"c2a59d18b03f","org_name":"Belgian port of Antwerp","org_type":"transportation_logistics","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/world-europe-24539417"}],"summary":"Drug traffickers recruited hackers to breach IT systems that controlled the movement and location of containers.  Involved Phishing tactics and physical break-ins to install key loggers and remote access hardware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b588dbe3c33ea0b8b0055534c25a8413a1b1933","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E89B9A8E-92FD-4E0D-88DF-2B6F88B88366"},"incident_date":"2011-05-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2566544db229","org_name":"Sutter Gould Medical Foundation","org_type":"healthcare","ransomware":null,"records_affected":1192,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7fc1a16626a1eb2085fc4f08c32e5911b52af1a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7FE42151-7AB9-43C3-B7B7-80A1AA3DEB5D"},"incident_date":"2011-05-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"166819700fa2","org_name":"Lexington VAMC","org_type":"retail_ecommerce","ransomware":null,"records_affected":1432,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73c1b810851a4e42277cdb576e6553f934789c49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8157A85D-CF9B-4B10-912D-CFCFBF2A99C3"},"incident_date":"2011-05-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbf7508fefe4","org_name":"Yanez Dental Corporation","org_type":"healthcare","ransomware":null,"records_affected":10190,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a960505b35df3dfa96d290ae34ca35a2b2e68cbc","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44319114-0DE6-446B-9509-7344D236116E"},"incident_date":"2011-05-13","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c3bf9762ba5","org_name":"Anderson Air Force Base Guam","org_type":"government","ransomware":null,"records_affected":700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-05-10","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6aee6f651059679f84dba6db5db7bcd8fcda4e7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D67D2CB4-2B0C-4C15-98AE-A3F02B405583"},"incident_date":"2011-05-10","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"19771fea32c3","org_name":"Citigroup Inc.","org_type":"financial","ransomware":null,"records_affected":360083,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ct.gov/ag/lib/ag/press_releases/2013/20130829_citibank_complaint.pdf"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.computerworld.com/s/article/9217665/Citigroup_reveals_breach_affected_over_360_000_cards?taxonomyId=17"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcworld.com/article/229891/Citigroup_Hack_Nets_Over_200k_in_Stolen_Customer_Details.html"}],"summary":"Hackers use forced browsing to access bank account information on victim's web application.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60c0fd9e63deb86f30f052c6aaa515981a143e2e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"955BEDD7-332F-4CA8-9DB9-FDB79BF24D14"},"incident_date":"2011-05-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"d5e67cac5ca3","org_name":"PMC Medicare Choice","org_type":"healthcare","ransomware":null,"records_affected":24361,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of a desktop computer exposes 24361 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b8bae4d584275bc8393f6dd7229c63ce5b3b6fb6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1CEE19F9-F5F6-4D59-B76F-92D55F290A40"},"incident_date":"2011-05-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16089c88fc9b","org_name":"Gypsum Management and Supply, Inc. Medical and Dental Plan","org_type":"healthcare","ransomware":null,"records_affected":25330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fea40ceaaf3d1f1a7ca185fd867802f72883d0be","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6320F9E-C3F1-4B0D-B4DA-AF69A3294C74"},"incident_date":"2011-05-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6203c21b691","org_name":"Robert B. Neves, MD, Inc.","org_type":"healthcare","ransomware":null,"records_affected":611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"849d28841c8ea80be658477595d06077a0fec915","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D4512B77-06F8-449E-9A7E-41753054FFA1"},"incident_date":"2011-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c36bfff2bf1e","org_name":"State of Florida","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ice.gov/news/releases/1305/130524orlando.htm"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ice.gov/doclib/news/releases/2013/130524orlando.pdf"}],"summary":"Florida Man (@_floridaman) abuses his access to issue fradulent drivers licenses in exchange for money.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4fc2a0da56006beada929aa3ada08ab0ee4cd36e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A4804C0B-AD7E-4694-B8C5-29FF527D6A60"},"incident_date":"2011-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1cf2528c377","org_name":"Staples","org_type":"retail_ecommerce","ransomware":null,"records_affected":50,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://harrison.dailyvoice.com/news/mamaroneck-staples-cashier-charged-181k-fraud"}],"summary":"A cashier at the Staples in Mamaroneck has been charged with stealing, then selling, 50 customers' credit card numbers, leading to $181,800 in credit card fraud, according to a Westchester County Police press release.  Valerie Fajardo, a 21-year-old from the Bronx, was arrested a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ac707ae0244911603f87a935854bc45d1ce4722d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7982C0C-3681-4297-AB2A-D1CADB52A0EE"},"incident_date":"2011-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a0ec7d31ae0a","org_name":"Midlothian Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scotsman.com/news/health/140_000_fine_after_sending_child_data_to_wrong_people_1_2085605"}],"summary":"A SCOTTISH council has been fined £140,000 after repeatedly releasing sensitive information about vulnerable children and carers to the wrong people.  Midlothian Council was guilty of five data protection breaches in as many months last year.  It is the first local authority in S","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b5a5704e381a11cc15b084dd9d30d99bd56f5c03","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30C172BE-0479-43E2-BE18-2150C324C77A"},"incident_date":"2011-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"6eae8519cd74","org_name":"London Health Programmes","org_type":"other","ransomware":null,"records_affected":8630000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techweekeurope.co.uk/news/nhs-researchers-lose-laptop-with-8m-patients-records-31810"}],"summary":"A laptop holding the records of eight million patients has gone missing from an NHS store room, reports Mike Sullivan in The Sun newspaper.  According to the report, the laptop was one of 20 that disappeared from offices of the North Central London Strategic Health Authority. The","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"666d18603beab18edeb85e53302a787b0b598a7c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94176B55-3AFA-4A43-BE47-5C8BDD4BB24D"},"incident_date":"2011-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"e2b7c7be9b6f","org_name":"Leicestershire County Council","org_type":"government","ransomware":null,"records_affected":18,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.gov.uk/news/latest_news/2012/leicestershire-county-council-in-data-breach-17042012.aspx"}],"summary":"Theft of a briefcase containing sensitive personal data from a social worker’s home. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad2351d8ded671c345bc757b38bd0340bc6861fe","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92897533-7697-400B-B40C-52FD990C995A"},"incident_date":"2011-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"ba6f2077817c","org_name":"Canadian Imperial Bank of Commerce","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.calgarysun.com/2013/09/19/criminal-record-for-calgary-bank-employee-who-sold-customer-info-fraudulently"}],"summary":"Bank employee embezzled personal information and sold it to fraudster.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a10d54b218ad60bfd3686ec96f2fc0102f32c49","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"06CF3C1B-5941-41EB-8EED-D549FEE8F538"},"incident_date":"2011-05-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f0978cb8a236","org_name":"BOLTON NHS FOUNDATION TRUST","org_type":"healthcare","ransomware":null,"records_affected":19,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thisislancashire.co.uk/news/10343269.Hospital_faces___500_000_fine_over_lost_patient_notes/"}],"summary":"In May 2011, a customer at McDonalds, in Derby Street, found documents with details of 19 patients on, in a bin. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1c103e351359fa19cb820ef5fd6ffc6cd4216ba","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA89AEB7-09C1-4B19-9117-F44BEBC349B0"},"incident_date":"2011-05-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"57eb56f1d350","org_name":"Barclays Bank PLC","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.v3.co.uk/v3-uk/news/2296863/barclays-employee-fined-gbp3-360-for-illegally-accessing-customer-data"}],"summary":"A former employee of Barclays Bank has been fined 3,360 after being found guilty of illegally accessing a customers data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0da3a13a0cc33f656d36818d438495bf0900db8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8862E524-04A1-4509-8933-0EC5CD92C3FA"},"incident_date":"2011-04-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93787166e362","org_name":"Foothills Nephrology, PC","org_type":"healthcare","ransomware":null,"records_affected":1280,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"066f94a737c0c06dda55aee6a49b7349c2e3bc95","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66D9713B-E61D-4562-9DE1-7A5047939FF3"},"incident_date":"2011-04-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"032bc489b5d0","org_name":"Health Plan of San Mateo","org_type":"healthcare","ransomware":null,"records_affected":694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0cad33c4fa4ae0be0c8884a25079f2d756c90982","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10A705AF-9742-415E-8BB4-838FD6D41BEE"},"incident_date":"2011-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8586fa9c3f6f","org_name":"New York State Department of Health","org_type":"government","ransomware":null,"records_affected":550,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"538498d1794e492a3a41ab348d3929376f03735b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BFE96F4B-9D12-441D-AF44-9FAC366E81D6"},"incident_date":"2011-04-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0b652f529f4c","org_name":"HealthCare Partners","org_type":"healthcare","ransomware":null,"records_affected":15677,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3bbb0f6a0596abab966aa1e94921b712d5fcbdbf","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A025D88E-B136-436B-8162-782F2121C098"},"incident_date":"2011-04-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"77ef3dcefbed","org_name":"Beth Israel Deaconess Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2021,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","internal"],"disclosed_date":"2011-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1260aa29b8a94567ddb0208e2ab317f2399ce898","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC4BE9C4-58B0-4D32-A584-D244D80DA642"},"incident_date":"2011-04-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5de0b9153450","org_name":"Sony Online Entertainment","org_type":"technology_saas","ransomware":null,"records_affected":2462300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.psu.com/news/11514/SOE-hacked--12700-credit-card-numbers-and-246-million-accounts-may-have-been-compromised;https://www.soe.com/securityupdate/"},{"fetched_at":null,"title":null,"type":"press","url":"http://en.wikipedia.org/wiki/PlayStation_Network_outage"}],"summary":"SOE hacked: 12,700 credit card numbers and 24.6 million accounts may have been compromised  Earlier today Sony Online Entertainment shut down service because of an intrusion into the system, and now weve learned thousands of users credit card numbers were stolen. The news was ori","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca50e2c45e5d000a7b957869ddd295a489fdefc0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C169CAF2-381A-4442-A28C-677A7F287ABF"},"incident_date":"2011-04-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c89def9ad7a","org_name":"Methodist Charlton Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.methodisthealthsystem.org/workfiles/MCMCMedicalManagementApril2011PublicNotice.pdf"}],"summary":"Office burglary results in stolen laptop computer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6f178d9de2de5ac054c494b009ab1f2192a6f33","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CD6924E0-40AB-40F6-A250-799BB14DC4E8"},"incident_date":"2011-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"adfccf20af49","org_name":"Silverpop Systems, Inc. Health and Welfare Plan","org_type":"professional_services","ransomware":null,"records_affected":884,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9f18a07bbedf5236c8dbea940bbb660baddb6930","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A6D1C2F4-5858-45B8-A6E2-5C7C334138CD"},"incident_date":"2011-04-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f32006ae321d","org_name":"Drs. Edalji & Komer","org_type":"healthcare","ransomware":null,"records_affected":563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2859160ae9d9200d7b22240ad5e8d88137992c9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C558E42A-116C-47F0-A7F2-9ED645D2EFCE"},"incident_date":"2011-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72e0e4c3ba9c","org_name":"Medicare Fee-for-Service Program","org_type":"government","ransomware":null,"records_affected":13412,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88f29c1b933221705c110824a70d288d0f395ee0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"861B8916-1764-4713-A44C-B3660A14A087"},"incident_date":"2011-04-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79571621940c","org_name":"Blue Cross and Blue Shield of Florida","org_type":"financial","ransomware":null,"records_affected":3463,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bad7c52f8018204108beea5dcd6d19b7106f232","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2E9F980-A53E-431D-8448-D3A23B13BF0C"},"incident_date":"2011-04-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2bf8a96773e","org_name":"Gene S. J. Liaw, MD. PS","org_type":"healthcare","ransomware":null,"records_affected":1105,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3cdf0f209ada72a7d7ec9fac4e9b51cc5697b0a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6069176-2E35-4A58-B3BA-4C66AF561B13"},"incident_date":"2011-04-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"58f7d60ca40e","org_name":"Speare Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":5994,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.unionleader.com/apps/pbcs.dll/article?AID=/20110503/NEWS03/705039970/0/NEWS"}],"summary":"A laptop computer containing health information of nearly 6,000 Speare Memorial Hospital patients was stolen April 3 from an employees vehicle in Boston, officials announced Monday.  Michelle McEwen, Speare Memorial Hospitals president and CEO, said the company immediately began ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea6ff16a962230179c7aedaafe6e4ba9099785f0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1428BE28-B5EE-43D9-884D-B462C515E468"},"incident_date":"2011-04-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b0d4de4a5ee3","org_name":"Reid Hospital & Health Care Services","org_type":"healthcare","ransomware":null,"records_affected":22001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5c98d280600a846f12b4109bfaa80c1d048bb635","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46A66340-170C-48AC-A56D-7DEB1124A4D7"},"incident_date":"2011-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"591ea8d983b0","org_name":"Urological Associates of Southern Arizona, P.C.","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tucsonnewsnow.com/story/26177803/local-urology-clinic-discovers-potential-breach-of-medical-information"}],"summary":"employees improperly disposing of patient data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"70ee828c3db0a5ef9aeeeef63ef5b08cbdeeb71a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6BEAA82-F426-4140-822A-97659933DE26"},"incident_date":"2011-04-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"788570c7c08e","org_name":"Tuba City Regional Health Care Corporation","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f7233eabd16efd0b55f2b1a8191f2fd7e19950e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3866200-D3ED-4282-95DD-FC75FF6DB8D6"},"incident_date":"2011-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"91e661d89b17","org_name":"Robert B. Miller, MD","org_type":"healthcare","ransomware":null,"records_affected":620,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c71a938ae71149d4e626b074b5207bdcdc567f41","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"01E81B3F-A5D4-426A-8671-0021B3B6E626"},"incident_date":"2011-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e883bd91c928","org_name":"New River Health Association","org_type":"healthcare","ransomware":null,"records_affected":950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"51416ca52aecb00ab93c068dbc1a240be1a17323","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"150BDB40-17CE-4C42-A06C-C61DFF51DD52"},"incident_date":"2011-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"c39e745f4d53","org_name":"Ashampoo","org_type":"technology_saas","ransomware":null,"records_affected":14000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/255273,hackers-breach-security-vendors-defences.aspx"}],"summary":"German software developer Ashampoo has informed its 14 million customers that hackers gained access to its customer database in an embarrassing security breach.  The breach stings particularly for Ashampoo because it offers security software as part of its product portfolio.  Ash","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f905c127e91d5f65c62b30cba5fc898112d4a4ac","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"288D9A52-366B-4C18-8D74-0B68B7639BD7"},"incident_date":"2011-03-30","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b86ad654648e","org_name":"VA Caribbean Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":6006,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1feb6e40043699b9f49935bfb5865df2e75ddcf7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"494FCE92-FD57-4D2D-B7AE-F7976DCC6A56"},"incident_date":"2011-03-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"35969a31b0c1","org_name":"Spartanburg Regional Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b512250f3464dfd8d87b60d721cb7b89d3ca04af","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B8C687C-5411-40BA-9534-DE4AEE611BAA"},"incident_date":"2011-03-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"88e7170b31ad","org_name":"Park Avenue Obstetrics & Gynecology, PC","org_type":"healthcare","ransomware":null,"records_affected":635,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e55caa46fa2cb0aafd9593a09cf3e569c6b0ad25","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1D49722-F171-47E3-9475-CD8733D8C5B7"},"incident_date":"2011-03-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"96b7abc5eff0","org_name":"Edmonton Public School District","org_type":"education","ransomware":null,"records_affected":7622,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/edmonton/story/2012/01/20/edmonton-public-schools-memory-stick-breach.html"}],"summary":"Edmonton Public School District did not follow its own policy in the loss of memory stick containing personal information of more than 7,500 employees, says the Alberta privacy commissioner.  An investigation by the Office of the Information and Privacy Commissioner found informa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e1de2a5bea44d69c5704132f96fa59b75c5afbff","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3576320-0FD1-4060-A594-30FFEEC90CE3"},"incident_date":"2011-03-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"The Research Office noticed that their research paperwork on one Veteran went missing. It was last seen in the Research Office in the basement, out of the file cabinet. It contained the consent form, inclusion/exclusion form, enrollment questionnaire, and the spirometry form.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f98dff623f5e362e71e1fbac1f4fbb38cc8b6aa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D20FB140-462A-4BDB-9AAE-F0D94C883CEC"},"incident_date":"2011-03-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2881d90f9ae1","org_name":"Troy Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":881,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/05/24/troy-medical-center-patient-data-thief-receives-prison-sentence/#.UaSxib-YAcA.twitter"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6fd47f5230ab9cbca6af25f2115ea7575de28de","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E436F0AD-2235-4A11-BF08-DF99DA4745E0"},"incident_date":"2011-03-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4cf6a586e09","org_name":"Navos","org_type":"healthcare","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76cef10c7a861818caf1ee3bec7b4b036e79972e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F4AC0DC-BA49-4D50-847C-3597F27CE238"},"incident_date":"2011-03-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fe5acd724d9f","org_name":"Imaging Center of Garland","org_type":"healthcare","ransomware":null,"records_affected":1031,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b1b98b4429b8ed120a463994aa7870f3e1a11dcd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB9D5035-85D1-435C-9381-5846D0A7D48C"},"incident_date":"2011-03-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d4a9a591551","org_name":"Eisenhower Medical Center","org_type":"healthcare","ransomware":null,"records_affected":514330,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0f4062a1780211e228f2caa2294aeac5424c0dfa","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"364979B4-95F2-4E76-B016-433EF6453292"},"incident_date":"2011-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f740629ccc3","org_name":"West Lake Hospital","org_type":"healthcare","ransomware":null,"records_affected":686,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking incident exposes 686 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c4965cae5f2dd4c3030ddd5bd4137f32527d9602","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DFCAC6CF-A98F-433C-BB02-EE99F36C840F"},"incident_date":"2011-03-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":66,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"On 7/22/10, a Dorn VA Housekeeping Aid was inadvertently added to a CPRS View Alert which consists of a Veterans Mental Inpatient Treatment Plan. The error \nwas discovered when the Housekeeping Aid notified the Privacy Officer on 8/19/10. The information disclosed ncluded Veteran","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0e3c8ecc37bed9907e80499caae99270176c3e20","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B00012A1-4BFB-4C59-B053-963BA865CD88"},"incident_date":"2011-03-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51174b828d11","org_name":"Texas Department of Health and Human Services","org_type":"government","ransomware":null,"records_affected":1696,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"edb418397ed564fb685f1858b93c9f52873316a8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4CA67861-C681-4020-A2DC-D14D12BC682E"},"incident_date":"2011-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f07ba472e468","org_name":"Phoenix Health Plan","org_type":"healthcare","ransomware":null,"records_affected":9393,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking exposes 9393 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ca246f81071642decb6aff0550c44aa392dca220","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D037D24E-C3B2-4C25-87E8-74ACA6DF5581"},"incident_date":"2011-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9fc2ec8e6255","org_name":"MacNeal Physician Group","org_type":"healthcare","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking leads to 532 exposed records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8fa2ac1f6d71d2a610c16cc53f6a001b3520a35","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5CEC2C43-45A3-4ED0-A940-F5E3A459352B"},"incident_date":"2011-03-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56d07761ba4d","org_name":"MacNeal Hospital","org_type":"healthcare","ransomware":null,"records_affected":845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Hacking/IT incident exposes 845 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bfe2ddd7aa4a0a66a19f5bc3bb57e4dc0fc1b4f5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"665A1899-2422-409E-83B6-8802F8D20A55"},"incident_date":"2011-03-08","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6689fd44f304","org_name":"MMM Healthcare, Inc.","org_type":"financial","ransomware":null,"records_affected":29143,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2011-03-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a514e6fe14100711742a56be859c035920b31a2c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6B04926D-E79A-4812-B06B-FE666EB603EB"},"incident_date":"2011-03-07","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4bb8ae145b4f","org_name":"American Superconductor Corporation","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2013/June/13-crm-730.html"}],"summary":"Sinovel, once AMSC's largest customer, contracted with an AMSC employee in Austria to get the software designed for Sinovel's turbines.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c6c685eab9049b62f6154bac06178ca9c7d2ccd3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CE005E4-B2FD-481B-AF76-FAADFF7A5AA7"},"incident_date":"2011-03-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4ef310582b3","org_name":"Windsor Health Plan","org_type":"healthcare","ransomware":null,"records_affected":1378,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"988c19150c5cee9543ab4b9ff7365f2ba3823b10","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BFD1398-E3ED-450D-9528-A546494A1777"},"incident_date":"2011-03-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e97091a17335","org_name":"Tallahassee Community College","org_type":"education","ransomware":null,"records_affected":3300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.tcc.fl.edu/College/Pages/Security-Breach.aspx,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wctv.tv/news/headlines/TCC--199528531.html?ref=531,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.tallahassee.com/article/20130322/NEWS/130322006/Update-TCC-students-among-victims-in-3-3-million-ID-theft-case"}],"summary":"Federal investigators informed Tallahassee Community College that a hacker gained access to their main computer system.  The personal information of students who applied for financial aid may have been accessed.  It appears that an insider hacked into the computer system. Hacked ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6462fe2200437c8ac0acfd5998eba9c4d1b1760","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72EECE19-7DD1-4FA9-A04B-BB706B52C4E9"},"incident_date":"2011-03-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2fd5d412a7ef","org_name":"Sutter Health","org_type":"healthcare","ransomware":null,"records_affected":4479,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"email disclosure of 4479 records by partner","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69cb80141e57ce1dd8bc12d8ca8e34195e6d3e0a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E4C6532-3D5F-4C72-92C7-348F24A18AEE"},"incident_date":"2011-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"768f6de37b69","org_name":"Brian J Daniels D.D.S.,Paul R Daniels D.D.S.","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"107265ed1ef11334aa63bff729eb5fa6610284b5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A8F7D76-978D-4520-9DB0-83AEABD2BDAB"},"incident_date":"2011-02-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b21c5c4aeaa","org_name":"Center for Arthritis and Rheumatic Diseases","org_type":"healthcare","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9083829846c3e17b1fcc2bf09a7767e7fae94fe8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC00372F-3E6F-4358-9865-18FEE90A473D"},"incident_date":"2011-02-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4b4bbd1ef48","org_name":"County of Los Angeles","org_type":"government","ransomware":null,"records_affected":667,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d4266763c385be46b0a011fca0e14c73ec3eaf82","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4E790BF2-7A96-4D6D-AF8F-8DFF3C3DF69F"},"incident_date":"2011-02-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1238e3de6416","org_name":"Community Action Partnership of Natrona County","org_type":"healthcare","ransomware":null,"records_affected":15000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75bff47a9cc35566eff332671c18cd68ce2dd860","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"64C3D97B-80B7-49FD-84D2-0394223F9C9F"},"incident_date":"2011-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PR","org_id":"9ace80906eb9","org_name":"Departamento de Salud de Puerto Rico","org_type":"government","ransomware":null,"records_affected":2621,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Desktop computer is compromised, resulting in the exposure of 2621 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f0325d3c84954fff59f48bf3ab5017080fc89991","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99B7ED2E-3A62-4F53-9304-60B6855E73CD"},"incident_date":"2011-02-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c50a1dab5e28","org_name":"Fairview Health Services","org_type":"healthcare","ransomware":null,"records_affected":1215,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a2aa7f63476a4ee58956b511bac2576e46c8eb86","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8390BAE-87D0-4499-BA8D-DF7DD9DB026F"},"incident_date":"2011-02-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ee49d7a79f7","org_name":"Union Security Insurance Company","org_type":"financial","ransomware":null,"records_affected":935,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c885a62af1f0d243722706a45bf76e8518d95fdd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"207DD5A3-D7B3-429F-B143-7F8B994598BB"},"incident_date":"2011-02-16","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c84986c1fb7c","org_name":"SW General Inc.","org_type":"healthcare","ransomware":null,"records_affected":566,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cbe67bea2c52da9b467dd0ef75b55efe7fc4de20","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DF3FD25-68C5-42A9-92FE-F21D4AD5C359"},"incident_date":"2011-02-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7a385d35e85","org_name":"Keith & Fisher, DDS, PA","org_type":"healthcare","ransomware":null,"records_affected":6000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4e2721dfdd76c50551990fbe8c14429c46b078aa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C6DCD1A-C5A6-44F6-97CC-4887EB254A62"},"incident_date":"2011-02-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e4ed24b2a86","org_name":"Aiken Community Based Outpatient Clinic","org_type":"healthcare","ransomware":null,"records_affected":2717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6a70011e0a8fd6d2d3e2231e85943a2ace00eba","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BB82443-CD6F-4E7C-91CF-BC0C5FCE27D0"},"incident_date":"2011-02-14","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0d2cca4f78b4","org_name":"MidState Medical Center","org_type":"healthcare","ransomware":null,"records_affected":93500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"428b0e6c7b894e04b7cbbed60414ac546e3585e1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0C8B10A-6508-402B-B930-266079CA4E96"},"incident_date":"2011-02-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d219a5c798a4","org_name":"MDwise, Inc.","org_type":"financial","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Unauthorized access/disclosure results in exposure of 2700 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-08","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9393f081cf6e65e0316dcf9e16de67cfe8e1efd8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C46C49B-9E51-4A4B-BE71-C297B4060783"},"incident_date":"2011-02-08","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"390f55210e94","org_name":"Charleston Area Medical Center, Inc","org_type":"healthcare","ransomware":null,"records_affected":3655,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"19e602665c272c85e28039aefb2fd750edb0c31f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA1381E7-DC27-4E9F-8B11-349FD506202D"},"incident_date":"2011-02-05","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cea4bfa5f63c","org_name":"Capron Rescue Squad District","org_type":"healthcare","ransomware":null,"records_affected":815,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d0bb2a7313538541920437de2fbae56b38f3a500","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"758B0DE1-A88F-429A-AE29-6D1F4ED88676"},"incident_date":"2011-02-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9cafe7964ea4","org_name":"Rape & Brooks Orthodontics, PC","org_type":"healthcare","ransomware":null,"records_affected":20744,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-02-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ea6bad7d2763bd6ea35558244a4d6313e5814e8a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11693195-77EB-4460-8FDF-4E107BB835CE"},"incident_date":"2011-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"97bf12d6c6fd","org_name":"University of Oxford","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bbc.co.uk/news/uk-england-22149435?goback=%2Egde_4636751_member_232435183"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/east_kent_mercury/news/Computer-hacker-jailed-860/"}],"summary":"Incident 2: Kent man admits Oxbridge and police force cyber attacks","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e313a7abb4944233c63a4e7699df09be39f04136","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83019D4C-1D47-43E0-B759-717C07521D3D"},"incident_date":"2011-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a15d2360f18b","org_name":"Time Insurance Company","org_type":"financial","ransomware":null,"records_affected":675,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Unauthorized Access/Disclosure leads to the compromise of 675 medical records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"66653bc10d7c1f5e812e10e85d84a0dde59ed586","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C0BEAD1A-3C63-461D-84B9-5D729222C118"},"incident_date":"2011-02-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aea5462e866c","org_name":"Catholic Social Services","org_type":"nonprofit","ransomware":null,"records_affected":1700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6ae619ceb648502d9cbca10a8994f548714116c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35EB4A31-1161-4A9F-B2B2-69B513995247"},"incident_date":"2011-01-31","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b07efcfb1770","org_name":"Henry Ford Hospital","org_type":"healthcare","ransomware":null,"records_affected":2777,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-01-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"460d6679e478ecf419ef6bb6ee8ae2d615cc7d1e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A0309A22-68F1-4CC4-961E-623C5E6B407F"},"incident_date":"2011-01-31","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"011507026333","org_name":"brokersXpress","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/brokersxpress-20120605.pdf"}],"summary":"A former employee engaged in unauthorized access to brokersXpress's third-party email archive system and viewed documents containing personal information.  ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d78f9871d95749cd7baf3d09cc391c527f7adf62","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3407347-100D-4791-9257-3904BE529E62"},"incident_date":"2011-01-27","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"bf28d51c0498","org_name":"NZ Southern District Health Board","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.odt.co.nz/news/dunedin/266850/patients-privacy-breached"}],"summary":"Internal misuse. Employee accesses health records for a person she knows so she could snoop.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5255384abf6011cfa9132beb41cbd5d31a7ba2db","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E3A5E46C-CAB0-4030-8974-694A2CD2E0E3"},"incident_date":"2011-01-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"191789ccdbf7","org_name":"NYU School of Medicine Faculty Group Practice","org_type":"healthcare","ransomware":null,"records_affected":670,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa193cb795c1c5c977f614f8ed1fc678a6a0c49a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FC4B4DC3-D764-43D6-A805-C3D1CA9570D0"},"incident_date":"2011-01-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49e89812d363","org_name":"Walgreen Co","org_type":"retail_ecommerce","ransomware":null,"records_affected":2700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of portable electronic device leads to breach of 2700 patient records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad581500d90afc08c6721471925c84c6a8778ebc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"93222308-4EAA-4FEA-96BE-6F7064FB0952"},"incident_date":"2011-02-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"NOK request records of deceased veterans. The NOK did not provide an address so the address that was in Vista was used. This address has since changed and \nit was not known at the time the records were sent with that information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"80ee4c6726f709c033fe21383611ad2a08811672","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"28079BEF-F3E2-4179-BD6F-3F661E43ECD9"},"incident_date":"2011-01-25","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76fda654eca3","org_name":"University Hospitals","org_type":"healthcare","ransomware":null,"records_affected":692,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cleveland.com/metro/index.ssf/2014/11/uh_employee_gained_improperly.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthdatamanagement.com/news/Hospital-Employee-Peeks-at-Records-for-More-Than-Three-Years-49367-1.html"}],"summary":"An employee of University Hospitals improperly accessed medical and personal information of 692 patients over a three-year period, the hospital system said Friday.  The employee, who has been dismissed, breached the hospital system's electronic medical records, allowing the perso","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ceb8bd23773f57850954dc585fd9e552c88cc48","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADB5547D-87EB-4A46-890C-8F7796B49775"},"incident_date":"2011-01-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7626fcad9f06","org_name":"Maryville Academy","org_type":"healthcare","ransomware":null,"records_affected":3897,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c1df223e2b288979f5ce152e619b254d6870ba7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BF6182C-4EB7-4E3D-8F27-D3151FDF4009"},"incident_date":"2011-01-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4ef8516d0cd7","org_name":"Health Net, Inc.","org_type":"financial","ransomware":null,"records_affected":1900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hipaahealthlaw.foxrothschild.com/2011/03/articles/breaches/the-new-largest-marcher-in-the-parade-of-reported-phi-security-breaches-health-net-inc/"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"83bab32cc8fbe130436f122912d6493baa1261c3","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F5C3FE41-48A7-469E-B811-0381B32C8519"},"incident_date":"2011-01-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5755f239306a","org_name":"CVS Caremark Corp","org_type":"retail_ecommerce","ransomware":null,"records_affected":654,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of documents","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"859bffb9230bddc32c3e6b2f4d9be2bcb28909c5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6AD30B6-6271-46B5-B3BD-8CCD976BC589"},"incident_date":"2011-01-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e34191c0fbab","org_name":"Saint Francis, Inc.","org_type":"healthcare","ransomware":null,"records_affected":84000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of network server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c1e8c2798e7fad53b1d739bc8b7336c4aa9fe4a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4069257-1DCD-457A-AC6D-3938F7A95416"},"incident_date":"2011-01-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63d1f0617d45","org_name":"Green River District Health Department","org_type":"healthcare","ransomware":null,"records_affected":18871,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddc98334bd1f2e919257bf0abc6c5a413cf001f8","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65BC9D93-E1AB-44DB-A470-28CA80C35AF4"},"incident_date":"2011-01-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53d685af4598","org_name":"University of Missouri Health Care","org_type":"financial","ransomware":null,"records_affected":765,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4913397f4dfcb5b8e0011dcf6f47dbfccf16945d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE143CCF-9309-4A54-9323-AAA8D6F23D4D"},"incident_date":"2011-01-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4daf8d16ef85","org_name":"Omnicare Inc","org_type":"other","ransomware":null,"records_affected":8845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":"Stolen laptop","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d2b4466c133198bb4df33a18d03f74764968197e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"587B713E-130F-4415-B25E-38FFC8F00B93"},"incident_date":"2011-01-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"09f7c8b27f52","org_name":"North East Lincolnshire Council","org_type":"government","ransomware":null,"records_affected":286,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/hundreds-of-childrens-details-lost-on-unencrypted-council-memory-stick-29102013"}],"summary":"An unencrypted memory stick and has been missing since July 1, 2011 when the device was left in a laptop at the councils offices by a special educational needs teacher. When the teacher returned to the laptop the memory stick was gone and it has never been recovered.  The device ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3986db9833c8358d7074a0ec57f35f7ab983c01e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"174702AA-FA9F-4628-A871-CF2596243278"},"incident_date":"2011-01-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f194ee0fe078","org_name":"Cancer Care Northwest P.S.","org_type":"healthcare","ransomware":null,"records_affected":3100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"30827c8503344af46649fa9d7a2c936e4ec436c3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EE6933F-2B2E-40DD-83B9-7B6D5AAA3CB6"},"incident_date":"2011-01-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cbadd5a35ce","org_name":"Riverside Mercy Hospital and Ohio/Mercy Diagnostics","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52b382fbcad07f17486ad74335590b46af6c7a14","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B4C25BFE-5954-4F1E-B12E-13FF4760090E"},"incident_date":"2011-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39e5e3882ede","org_name":"Pinnacle Health System","org_type":"healthcare","ransomware":null,"records_affected":1085,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9a613ab695abf960bbc8f9bd08cfda39bba8382e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30ADD540-CB73-4D12-B69F-28BA20197B30"},"incident_date":"2011-01-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d98b206a48a","org_name":"Gary C. Spinks, DMD, PC","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"05aae3eb42f58e36e756942f967863d241b87743","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E0D841E-43D9-432A-912E-ED9215FC0727"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9137e0e382cc","org_name":"Zocdoc","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.hipaajournal.com/zocdoc-notifies-patients-breach-discovered-june-2015-3435/"}],"summary":"Programming error leads to ability to view patient records by medical professionals no longer using the online appointment system","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25fe8748d55495732008975c3e5ff20c39484612","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8A31DBA-7849-4BCB-9E19-55C8E83D08C1"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"880dc72eb4ee","org_name":"Wrigley Field","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://2fwww.threatpost.com/en_us/blogs/skimmers-hit-patrons-wrigley-field-chicago-restaurants-043012,"},{"fetched_at":null,"title":null,"type":"press","url":"http://illinoisattorneygeneral.gov/pressroom/2012_04/20120427.html"}],"summary":"Six individuals were charged late last week with “skimming” more than $200,000 from victims who used their credit or debit cards at Wrigley Field and other Chicago restaurants.  A press release from Illinois’ Attorney General Lisa Madigan on Friday alleged that Joseph Woods, 32, ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a6860bdcca906b9ea2625fe973b648199adb6a67","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A37C9F76-CCE9-4D08-8835-616F6D48B42C"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ddc31e580e3","org_name":"Women & Infants Hospital of Rhode Island","org_type":"healthcare","ransomware":null,"records_affected":14004,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f02620f591d666d61a8e5bed4a790d8410c6240a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B134F51-50E2-409F-A831-680174806FED"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fffde8cc4799","org_name":"Woman to Woman Healthcare,","org_type":"healthcare","ransomware":null,"records_affected":26,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chicagopressrelease.com/news/police-shut-down-identity-theft-operation-at-clinic"}],"summary":"Chicago police have located the hub of an identity theft operation and have arrested the two women coordinating the scheme.  Carmencita Kennedy, the reception at Woman to Woman Healthcare on the South Loop, has been charged with organizing a long-term financial crimes enterprise.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CN","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c2ac949d49bc8167b793674e8737df0d47154d07","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"980E7FA8-E202-4EC3-AAD6-55CF657CC764"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"23d41418ff50","org_name":"Wine Library/STEKLEN & WALKER CO., INC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/wine-library-20120124.pdf"}],"summary":"Between October 20,2011 and November 7,2011, customer personal information including name, CCN with CVV and expiration date, username, password, address, was taken from the website by computer hackers based in China.  For some customers, this included multiple credit cards.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b73afa022ae1df5ab913e950a43dd8347c036dd7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"94826261-20BD-4BDD-A5A2-31FDB56202EC"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"820e6265ea9b","org_name":"Waters, Kraus & Paul","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2012/03/23/44961.htm"}],"summary":"An attorney claims in Superior Court that a law firm specializing in asbestos claims shared confidential client files stolen from a competitor, and fired him after he discovered the data on the firm's servers.  Ashrafi, now managing attorney of the defendant firm's Los Angeles of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0ededf61e12b8e719c79ce9c594aca2be5570a5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"789F0A4D-6261-480B-B989-09F5477D1134"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6f40d379f70","org_name":"US National Security Agency (NSA)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.grassley.senate.gov/judiciary/upload/NSA-Surveillance-09-11-13-response-from-IG-to-intentional-misuse-of-NSA-authority.pdf"}],"summary":"In 2011, the NSA OIG was notified that, in 2011, the subject had tasked the telephone number of her foreign-national boyfriend and other foreign nationals and that she reviewed the resultant collection.  The subject reported this activity during an investigation into another matt","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4af1dd31f9c9f81ff68f736ad56ac696843c93ce","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13FFE22F-8112-4B24-B434-A53571B27BB3"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c1c1b4eec438","org_name":"US Central Intelligence Agency (CIA)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/09/24/usa-courts-leak-factbox-idINDEE98N00220130924"}],"summary":"\"Former CIA officer Jeffrey Sterling was charged in 2011 with illegally disclosing classified information about Iran\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2aa27e32643138a855ee886d9d7ba44da76855a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27CC6B1C-C0AF-4014-BF19-054BF440C434"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5e604defda05","org_name":"University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.propublica.org/article/clooney-to-kardashian-celebrities-medical-records-hospital-workers-snoop;"},{"fetched_at":null,"title":null,"type":"press","url":"http://tucson.com/news/local/crime/umc-workers-fired-for-records-access/article_4f789a48-1e8c-11e0-929a-001cc4c002e0.html"}],"summary":"University Medical Center in Tucson fired three employees for snooping in records after the shooting that left then-U.S. Rep. Gabrielle Giffords in critical condition. A contract nurse also was terminated.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c74a0b2a9d10d1c9fc61791e82ef4675a91c94aa","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC4CC0AF-19AC-4852-9553-C6A0F12E66F8"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c08deb919e22","org_name":"United States Army","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.fbi.gov/news/stories/2013/april/soldier-receives-16-year-sentence-for-attempted-espionage/soldier-receives-16-year-sentence-for-attempted-espionage"}],"summary":"A 22-year-old military police officer in Alaska has been sentenced to a 16-year jail term in connection with his efforts to sell classified documents to a person he believed was a Russian intelligence officer.  In 2011, William Millay was stationed at Joint Base Elmendorf-Richard","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2d68acb80ebbd5ba72df6e15d1eb0409fcc430e1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"00EF0132-EE8B-4DD2-8DBF-624D2633F598"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"58acef3a0eba","org_name":"UK National Health Service","org_type":"financial","ransomware":null,"records_affected":1600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.independent.co.uk/life-style/health-and-families/health-news/nhs-trust-sends-data-cd-to-landfill-2355834.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.techworld.com/security/3457470/hospital-fined-200000-after-hard-drive-full-of-patient-data-bought-on-ebay/"}],"summary":"Partner throws away customer data.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26733de35b5f82ee71aec3c0b5a5eeb4feedc531","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"732293FB-428B-4DC3-814A-4894ECAE93E3"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c602881aa38c","org_name":"Torrance Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/09/05/patient-files-privacy-breach-suit-v-torrance-memorial-medical-center/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.latimes.com/business/la-fi-hospital-patient-privacy-20130905,0,7915045.story"}],"summary":"During surgery at Torrance Memorial Medical Center, an anesthesiologist decorated a patient's face with stickers while the patient was unconscious  giving her a black mustache and teardrops under her left eye  and then a nurse's aide snapped her photo.  The 2011 incident has prom","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3eddb174403af67ce8074cd6fd21ff7f0dadcfee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81C7388E-0BD6-4B01-BB95-1E1E50357C1E"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"943ee44fb98c","org_name":"Titus Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":108,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hipaahealthlaw.foxrothschild.com/2012/01/articles/hitech-act/when-will-they-learn-snooping-nurse-fired-patients-notified/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/titus-regional-medical-center-nurse-fired-over-hipaa-violation.html"}],"summary":"A nurse has been fired by a Texas hospital after accessing information on patients for whom she had no clinical responsibility, according to the Mt. Pleasant, TX Daily Tribune. The hospital, Titus Regional Medical Center, reportedly discovered the unauthorized access in the cours","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"26a1a6f48d2327af89273a3d0419a20b0292e21e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"981F6B4E-A1E1-4D46-9D49-E472F28A87CA"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8e576c44b0c6","org_name":"Tift Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/data-on-5300-healthfirst-members-caught-up-in-fraud-scheme/article/429020/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthfirst.org/blog/healthfirst-provides-notice-of-data-security-incident/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.law360.com/articles/683739/consumers-info-exposed-in-healthcare-fraud-data-breach"}],"summary":"http://www.tiftongazette.com/news/ashburn-woman-charged-for-filing-fraudulent-tax-returns/article_792b5df0-36fe-11e5-9974-937ac8a85503.html; http://www.moultrieobserver.com/news/local_news/tax-fraud-sentences-handed-down/article_88ed6fcc-3716-11e5-86dd-dff847652426.html","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"68fef5ddb8c29bafbaf01ed24691e2238ec6acd1","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BA7292B-B990-4968-A94B-892BEDBDA178"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"349365120797","org_name":"Texas Durable Medical Company","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yourhoustonnews.com/cypresscreek/safecommunities/houston-woman-convicted-of-health-care-fraud-following-state-and/article_f6c61222-bb4a-11e3-949f-0019bb2963f4.html"}],"summary":"Owner of medical device company bills Medicare for tube feeding supply kits that were never ordered by a medical professional.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d63b7230526ee420bc1229a3a56667dbe35ba215","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A349508B-DA36-41BC-993C-CC129D04244F"},"incident_date":"2011-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"5e18f3ecdee1","org_name":"Tencent Holdings Limited","org_type":"technology_saas","ransomware":null,"records_affected":12000000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.echinacities.com/news/Tencent-QQ-Group-Data-Leaked-12-Billion-QQ-Accounts-Affected"}],"summary":"Tencent QQ was hacked using a combination of social engineering and hacking.70 million groups were exposed with 1.2 billion partially repeating QQ numbers exposed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"NZ","motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8198609eaf7245b0a395dc4556103ddc9ce61073","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08BB91E9-69B8-426E-98CF-19F5537718F4"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NZ","org_id":"714acfe5b766","org_name":"Telecomm","org_type":"technology_saas","ransomware":null,"records_affected":2150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/telecom-database-accessed-by-employees-of-power-marketing-ltd/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10700000"}],"summary":"A major security breach has revealed personal details of every Telecom customer - and a commercial rival is implicated.  The Herald on Sunday accessed the Telecom database using login details supplied by sales staff working for rival telco Slingshot. It gave us names, addresses a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f82c47913620568e2a7fdaa2a48d8bc0f5c69e6","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BD53F6E-9CE4-462C-8DBB-3980C6ACC723"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b7f413081f9","org_name":"Tampa Police","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tbo.com/news/crime/attorney-tampa-officer-stole-tax-refund-checks-to-fund-divorce-20160118/"}],"summary":"stole checks from the department's evidence locker to fund her escape from a bad marriage ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6ec1dae72f14756b44397f59f179dad073842da9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E4AA3507-29F9-46B5-87F3-9211DFD9A674"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3272922c8b5c","org_name":"Subway","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://news.cnet.com/8301-1009_3-57574791-83/two-charged-in-theft-of-$40k-from-hacked-subway-keypads/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/billsinger/2013/03/15/subway-restaurants-rocked-by-pos-hackers/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2013/03/feds-charge-two-men-in-plot-to-sell-hacked-subway-gift-cards-worth-40000/,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/subway-breach-hacker-sentenced-a-5437#.UQLUrwdIw_I.twitter,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/01/subway-hacking-scam/?goback=.gde_4636751_member_202683271"}],"summary":"A former owner of a Subway franchise used software from his new job to access the computer systems of Subway restaurants.  The former owner sold point-of-sale software to Subway restaurants across the country and then worked with an accomplice to remotely hack into at least 13 Su","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ba6113a6e7d43fbf7afbe29d83811a3880584b6b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B2E623D-9AF5-48B0-A977-777223C57AD2"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"4a805164f368","org_name":"Stockport Primary Case Trust","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.out-law.com/en/articles/2013/june/failure-in-sweep-of-old-premises-costs-health-body-100000-in-data-breach-fine/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ico.org.uk/news/latest_news/2013/~/media/documents/library/Data_Protection/Notices/stockport-pct-monetary-penalty-notice.ashx"}],"summary":"The watchdog said that when SPCT sold an old site it had owned it failed to conduct proper checks to ensure that patient records had either been \"removed or transferred\". The purchaser of the site subsequently discovered boxes containing approximately 1,000 documents after SPCT h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"500cc308c31e957c90a29ec325b17b0ab29bced7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB429911-010B-430E-8827-8DB2269B2005"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c36bfff2bf1e","org_name":"State of Florida","org_type":"government","ransomware":null,"records_affected":21,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bizjournals.com/southflorida/blog/morning-edition/2013/03/wilton-manors-man-used-id-theft-to.html"}],"summary":"Accused made fraudulent \"unemployment benefits\" claims totaling ~ 200K by using identity theft and setting up a fictitious company.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dc31d39c8ade1a2843adb69d7c881074a8b9acc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08BA778C-1581-499D-BCCB-D749C1170082"},"incident_date":"2011-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9c0ad5da7004","org_name":"Stanford Hospital & Clinics","org_type":"healthcare","ransomware":null,"records_affected":20000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.nytimes.com/2011/09/09/us/09breach.html?_r=0"}],"summary":"A medical privacy breach led to the public posting on a commercial Web site of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif., including names and diagnosis codes, the hospital has confirmed. The information stayed online for nearly a year.  A m","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e335952fca46c497016c8ff426206c172dfbd7de","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BE4FBDA8-083C-4F71-8E9B-FD1405162305"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"335bca9a9cfa","org_name":"Square Enix Holdings Co Ltd","org_type":"technology_saas","ransomware":null,"records_affected":1800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.google.com/hostednews/afp/article/ALeqM5jE-rJ9tRIWAYNjLaBJPss8yaGJWQ"}],"summary":"Japanese game developer Square Enix said that servers containing data on 1.8 million customers had been hacked, but said the extent of the damage was not yet known.  The producer of hit titles such as Final Fantasy and Dragon Quest pulled down the Square Enix Members service shor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fb34001367508344b9868f128b5575deb000553","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"89970DC7-6B7D-45B0-A355-D15B10E39D9F"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8da882aac066","org_name":"Southwest Ambulance","org_type":"healthcare","ransomware":null,"records_affected":581,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.azcentral.com/business/articles/2011/04/18/20110418southwest-ambulance-reports-data-breach.html?nclick_check=1"}],"summary":"A former Southwest Ambulance employee took 581 patient records that included the names, financial and medical information from those customers.  Southwest Ambulance recovered the records and notified affected customers about the breach of their private medical records.  The Mesa-","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"36c014bc89aaad7201cb3314246f99f9c8e006a4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7BD685C3-745E-4FA1-82C0-C2414C1D0192"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"35d2013543ca","org_name":"Shopacheck","org_type":"financial","ransomware":null,"records_affected":1400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mirror.co.uk/money/city-news/shopacheck-loses-data-on-14-million-157430,"},{"fetched_at":null,"title":null,"type":"press","url":"http://blogs.evault.com/cloud-connected-recovery/the-uk%E2%80%99s-biggest-data-loss-disasters-of-2012/"}],"summary":"A bungling loan firm has raised the alarm after losing sensitive personal data on 1.4 million customers.  Shopacheck, a doorstep lender charging sky-high rates of 400% APR, has said the information was on two IT back-up storage tapes, which have gone missing.  The company, which ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2c6f9b1bd8982848d559503a0492c0e67410e3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F6C70497-14D7-4C22-9BFD-DEA84292FEA9"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"c8bbf503a5dd","org_name":"Shanghai Municipal Health Bureau","org_type":"government","ransomware":null,"records_affected":140000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globaltimes.cn/content/729905.shtml;http://www.shanghaidaily.com/nsp/Metro/2012/08/29/Identity%2Btheft%2Brings%2Bbusted%2Bin%2BShanghai/;http://www.darkreading.com/privacy/shanghai-police-investigate-database-of/232602851"}],"summary":"Local police have arrested a computer database manager accused of stealing more than 140,000 pieces of personal information about newborn babies and their parents from a Shanghai Municipal Health Bureau database, police announced at a press conference Wednesday.  The suspect, sur","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a91fb9777903e94de4b4e94eef3cee449513286e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D46CA0D2-853B-4C1D-878C-A6B36AE04E3F"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ef5aeb46502c","org_name":"Segmark Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thehour.com/wilton_villager/news/police-fairfield-man-charged-with-computer-crime-after-hacking-into/article_6f119c92-bc37-5141-9194-215ddbb3ee8b.html"}],"summary":"A Fairfield man was able to hack into his former employer's computer systems, but couldn't cover his tracks, according to police.  Remy Charmoz, 62, of 160 Glengarry Street in Fairfield, is being charged with second degree computer crime and illegal use of credit cards after a si","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab30de0e8d7e41881bb4eca356372d60b92855e1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA52DE82-0F5E-4F2C-8400-84316377DA60"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"7b45f774bc71","org_name":"SEGA Corporation","org_type":"technology_saas","ransomware":null,"records_affected":1300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/blog/gamification/sega-1-3-million-customer-records-hacked-lulzsec-promises-retribution/481"}],"summary":"Sega is the latest game maker to have its databases hacked. The company acknowledged Sunday that information on 1.3 million customers has been stolen from an online database - though credit cards aren't part of it, Sega assured customers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fad7c9b2724c48fddd3ec2ac3ac7d7c7d08865e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"936DACD7-A781-4EAC-AEB6-7C3A6A82586D"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d6df279ea059","org_name":"Seattle Public Schools","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kirotv.com/news/news/education/teacher-passwords-stolen-grades-hacked-at-3-seattl/nD69q/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.kirotv.com/news/news/memo-warning-teachers-of-stolen-passwords/nD692/"}],"summary":"Someone has stolen teacher passwords and changed grades in a Seattle Public Schools computer system, the district said in an email to teachers obtained Thursday by KIRO 7 Eyewitness News.The district's IT staff found the theft of network login passwords \"appears to have been goin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1073ff81fc0165512fd11a2245d23c03564b87f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B9429FD-ABC6-49BE-8001-243260F55164"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c261ea2e81fe","org_name":"San Jose Medical Supply Company","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/HIPAA%20Breach%20Letter%20-%20San%20Jose%20Medical%20Supply_0.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.sccaseinfo.org/pa6.asp?full_case_number=1-13-CV-244620&crumbs=Civil%20Index&crumbs=Party/Case%20Type%20Search&crumbs=Party/Case%20Type%20Results&crumbs=Cases%20Involving%20Front%20Medical%20Supply,%20Inc.,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/san-jose-medical-supply-acknowledges-security-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/san-jose-medical-supply-reports-insider-breach-sues-former-employees-and-two-competitors/"}],"summary":"California's San Jose Medical Supply Company recently began notifying current and former customers of a breach of their personal information, which took place in 2011 but was only recently discovered by the company's new management.  When the company's former owned died in August","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5e57ca520f882e727e8ea0144afa0042bd6ea18c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DD72747-0305-4283-897F-55B111C03BE7"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"e70dce092ff6","org_name":"Ruijin Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.globaltimes.cn/content/839523.shtml#.UuWGY3mtszU"}],"summary":"Huangpu District People's Court has sentenced two former hospital employees each to one year in jail for selling medication usage data to pharmaceutical companies, local media reported Saturday.  The defendants were a pharmacist surnamed Wang and a buyer surnamed Le from the equi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2fb6016fac90b1b6662fafe11076da3e8278774d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66670517-B391-4CF9-B929-3CB6206BAFFF"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1ee14ecfec7","org_name":"Premier Tax","org_type":"professional_services","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.justice.gov/opa/pr/2012/November/12-tax-1315.html"}],"summary":"Six people who worked in tax preparation were charged with fraud and filing false tax returns in March of 2012.  Over 1,000 false tax returns were filed between October 2009 and April 2012.  The fraudulent returns totalled more than $1.7 million.  UPDATE (01/29/2013): Two others ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b0b41487c9e601ae67a77078f23700acb0b7283","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1AB2D4FC-02CC-4640-A88D-75CE1D4AD285"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"727980521afc","org_name":"Plentyoffish Media Inc.","org_type":"other","ransomware":null,"records_affected":30000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2011/01/plentyoffish-com-hacked-blames-messenger/"}],"summary":"Hackers have breached the database of online dating site PlentyOfFish.com, exposing the personal and password information on nearly 30 million users. In response, the companys founder has implied that the editor of KrebsOnSecurity.com was involved in an elaborate extortion plot.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"espionage","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25a83848949d8fe1b2fde6ea133dabb03de80355","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D816827D-BC61-4105-87F7-BA4FBD655EC0"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f369a38d683c","org_name":"Philips Lumileds Lighting Company LLC","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.natlawreview.com/article/federal-court-california-sheds-light-computer-fraud-and-abuse-act-allegations-indire;http://www.tradesecretsnoncompetelaw.com/files/2015/03/Koninklijke.pdf"}],"summary":"Employee steals confidential data and takes it to new employer. They alleged that Dr. Gangyi Chen, while employed, downloaded Lumileds trade secrets and confidential business information onto a portable storage device, then resigned and began working for a competitor in China, El","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e5f39b3ebff199e680ff4bc15dc01372ffeac746","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D432CC1D-91D4-4449-A050-7AC6B0890A7D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6c5bb3c1691c","org_name":"Parkland Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dallasnews.com/news/community-news/park-cities/headlines/20141031-ex-parkland-employee-to-plead-guilty-to-medicare-fraud.ece"}],"summary":"A man was indicted on a federal identity theft charge last year, was a patient registration specialist at Parkland when authorities say he misused the patient information to drum up business for Dallas Home Health Care, which he formed in 2006.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"004bb7c5658d0c6eb9442fa29c00ce7483387d53","impact_type":"exposure_no_theft_confirmed","incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Network%20Intrusion_Breach%20Notification%20on_0.pdf"},"notes":null,"org_country":"US","org_id":"dcf9c5d28f85","org_name":"OneWest Bank, FSB","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-41287"},{"fetched_at":null,"title":null,"type":"state_ag","url":"https://oag.ca.gov/system/files/Network%20Intrusion_Breach%20Notification%20on_0.pdf,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=27468"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Network%20Intrusion_Breach%20Notification%20on_0.pdf"}],"summary":"OneWest Bank reported that an unauthorized person accessed files held by a service provider that contained customers’ personal information, with no copying or downloading believed to have occurred.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_hosted_data","involved":true,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"476f8d138eedf28a30768abe784f32a3edb4f73d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0B0D6883-3413-4171-9611-BF0D7D24BFEA"},"incident_date":"2011-01-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a1fb2ba90425","org_name":"NYU Langone Medical Center","org_type":"professional_services","ransomware":null,"records_affected":640,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nyu-langone-medical-center-notifies-patients-that-stolen-computer-contained-clinical-information/"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/nyu-langone-medical-centers-hospital-for-joint-diseases-notifies-patients-of-potential-data-breach/"}],"summary":"NYU Langone Medical Center notified patients recently that a desktop computer was discovered stolen from an NYU School of Medicine Faculty Group Practice physicians office on January 27, 2011. The computer contained correspondence with patients regarding their office visits but c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b28a30eb4eceeeac77b8c4649cf52e0f502f5e4e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"23cf5870-ec41-11e7-b683-c1703914e4a4"},"incident_date":"2011-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"0499199cb0fe","org_name":"Nottinghamshire County Council","org_type":"government","ransomware":null,"records_affected":3000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-nottinghamshire-county-council-fined-70000-for-data-protection-breach/"}],"summary":"Nottinghamshire County Council posted the gender, addresses, postcodes and care requirements of elderly and disabled people in an online directory which didn’t have basic security or access restrictions such as a username or password.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"31dd5569be234bdd8180895bfdcfcc2f5a374e0e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"14fd2670-971d-11e7-a11c-5542f7e3819f"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"ac0acfaf71aa","org_name":"NHS Trusts","org_type":"healthcare","ransomware":null,"records_affected":780000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.silicon.co.uk/workspace/nhs-loses-patient-documents-206267?PageSpeed=noscript"}],"summary":"he NHS has admitted thousands of patients may have been affected by the loss of records that went undelivered over a period of five years Thousands of patients may have been put at risk by the loss of more than half a million NHS records that went undelivered over a period of fiv","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa1aa3145b38a67640a1eb5c98e34125008a3872","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2450E2E4-BD00-4597-B15A-8A5FE95CB7CF"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b1801cdb9256","org_name":"NHS Shared Business Services","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/uk-nhs-apologises-for-sending-vital-patient-information-to-wrong-gps-for-five-years/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.express.co.uk/news/uk/692457/NHS-Jeremy-Hunt-GP-medical-records-wrong-health-Government"}],"summary":"NHS apologises for sending vital patient information to WRONG GPs for five years","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3578ea5c27145bdb20330a76e50b995dd78168a6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43DE11F0-D9BB-4A4B-9C4D-E5E07E000EA2"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"d88c513e5213","org_name":"NHS Central London","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.telegraph.co.uk/news/health/news/10753001/NHS-blunders-put-millions-of-records-at-risk.html"}],"summary":"They include a major incident in 2011 in which a laptop containing details of 8.3 million patients was stolen from an unlocked store room at the headquarters of NHS Central London strategic health authority. A report on on the breach reveals that there was enough detail in the re","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fce3c84e6abdd3778ccf8029290b2d75461c3a41","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ABDA520D-6C1B-4824-8132-3E0BE95BB1CF"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44dd9f080134","org_name":"New York Police Department (NYPD)","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2014/05/27/feds-nypd-officer-gave-out-drivers-license-info-to-use-fraudulently/"}],"summary":"Police officer used position to steal identity info and sell it for false IDs, etc.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2da2a65f5cb07d2e699e34f0bc0e2287eda81fa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E895BBBB-9327-4AE9-A2E3-DB37D5FF1E2D"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"898135d84b9d","org_name":"New York City Health and Hospital Corporation","org_type":"healthcare","ransomware":null,"records_affected":1700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.infosecurity-magazine.com/view/15958/new-york-city-hospital-system-admits-to-massive-data-breach/"}],"summary":" The New York City Health and Hospital Corp. (HHC) said that personal information of nearly 1.7 million hospital patients, staff, vendors, and contractors was stolen from a GRM Management Information Services van.  The data breach affected patients, staff, vendors and contractors","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"996d397c8a79456adcfda2fbb0b552c2cab6873e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB945489-CCF6-4635-AF93-D14F1DA856A7"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a248371cfdc3","org_name":"Mother and Daughter Personal Care Home","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://chronicle.augusta.com/news/crime-courts/2013-01-31/augusta-man-pleads-guilty-fraud-identity-theft"}],"summary":"An Augusta man admitted Thursday he stole nearly $200,000 from the dead and their families, an elderly boss and people too ill or infirm to care for themselves, including disabled veterans.  Bryant K. Evans Webb, 44, pleaded guilty in U.S. District Court to charges of wire fraud,","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d25c8d3a4f6e5dd398cf23427a8408a61fb7d3fb","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C6755B9B-00B2-44AE-A319-173D6BA35B9C"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c720b55b0803","org_name":"Molina Medicare","org_type":"financial","ransomware":null,"records_affected":4573,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6911e716ac3656db4999c5ab91dc731bb40f4eb1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D49275C0-AC4B-475D-AFC7-DFA827E7065A"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"a0ec7d31ae0a","org_name":"Midlothian Council","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scotsman.com/news/health/140_000_fine_after_sending_child_data_to_wrong_people_1_2085605"}],"summary":"A SCOTTISH council has been fined £140,000 after repeatedly releasing sensitive information about vulnerable children and carers to the wrong people.  Midlothian Council was guilty of five data protection breaches in as many months last year.  The first breach came to light in Ma","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a7dd5257c7c79d92e342b88b5234e7a9aa898144","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F549D056-4DC7-45ED-A130-96A1BF7DDB80"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a44a6f85faa6","org_name":"Michaels Stores, Inc.","org_type":"retail_ecommerce","ransomware":null,"records_affected":94000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://abc7chicago.com/archive/8112520/;http://krebsonsecurity.com/2011/05/breach-at-michaels-stores-extends-nationwide/;https://www.privacyrights.org/data-breach-asc?title=Michaels;http://www.fierceretail.com/retailit/story/michaels-breach-convictions-point-to-the-most-sophisticated-pin-pad-attack-yet"}],"summary":"Pin pad tampering at several Michaels stores in several states results in the theft of payment card data","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":"Jeremy Jones","variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5af16b187c74738f29ce1c0e636d3845a9d061f5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43A7DB3B-9DBC-4532-98C0-337E51BD1C9D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00c726db3685","org_name":"Memphis Neurology","org_type":"healthcare","ransomware":null,"records_affected":146,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/memphis-man-accused-of-using-stolen-patient-identity-information-to-defraud-banks-of-1-6-million/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.fox13memphis.com/news/memphis-man-accused-of-using-stolen-identities-to-defraud-banks-of-16-million/91705748"}],"summary":"Memphis man accused of using stolen patient identity information to defraud banks of $1.6 million - Memphis Neurology  The affidavit of complaint against Jeremy Jones said he started stealing identities of patients of Memphis Neurology back in 2011, and he used those identities t","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse","derived":{"actor_id":"jeremyjones"}},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bed49931902dfc057e09407fb754315d12067cf4","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"247E3DF0-B5C6-40FD-8CDD-EB99C811874F"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f06a385ac2f6","org_name":"Medway Maritime Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/kent/news/hospital-faxes-patients-records-to-27296/"}],"summary":"Sensitive data has gone missing entirely. During an office move, a consultant filled two black bin bags with the contents of their desk, both of which went missing after being left unattended.    The consultant faced disciplinary action for the breach.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ba60ad27d06c9396f776b5b696690a8e699e40d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9292CD03-D61A-4E92-9674-8D579BA9847D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d241f92be124","org_name":"Matthew David Hair Design","org_type":"other","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lohud.com/article/20130911/NEWS04/309110051/Feds-Brewster-salon-owner-stole-from-customers-pay-vacation-flight?gcheck=1"}],"summary":"Salon owner stole payment card info from customers and made fraudulent withdrawals. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e485aaa67848377ace348924cf12064ce17a1d1a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0B2D58E-1708-4CF4-852B-F3DE6915FDC9"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6cdc1cc377c2","org_name":"Massachusetts eHealth Collaborative","org_type":"healthcare","ransomware":null,"records_affected":13687,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.utsandiego.com/news/2012/jan/25/tp-leaky-records/all/?print"}],"summary":"One afternoon last spring, Micky Tripathi received a panicked call from an employee. Someone had broken into his car and stolen his briefcase and company laptop along with it.  So began a nightmare that cost his small nonprofit health consultancy nearly $300,000 in legal, private","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42ab10cae9f1dcd8318c71114bc3a7954d33fe83","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"541E3F2B-8969-4FA6-95F8-8FDC3550B4AC"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"702b45d85d69","org_name":"Los Angeles County Department of Public Social Services","org_type":"government","ransomware":null,"records_affected":132,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/55824"}],"summary":"A dishonest employee pleaded guilty to using a Los Angeles County computer system to file fraudulent tax refunds.  The fraudulent activity occurred between July 2009 and the 2011 tax year.  The IRS found 44 pages of screen prints with the information of 132 assistance participant","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8de226bdfe86e36e58fd5356e389dd2088521216","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"20A789F8-8993-430E-B1A4-676D828061FA"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"6eae8519cd74","org_name":"London Health Programmes","org_type":"government","ransomware":null,"records_affected":8600000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thesun.co.uk/sol/homepage/news/3637704/Missing-Laptop-with-86million-medical-records.html"}],"summary":"A LAPTOP holding the medical records of eight MILLION patients has gone missing.  The computer vanished from an NHS building in the biggest-ever security breach of its kind.  It went missing three weeks ago but has only just been reported to police.  The unencrypted laptop contai","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c963cf3e6dfedbd84a7813fa406624ad7578456a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0B6CA56-1A03-4314-87A8-28B1B539995C"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f61231bd97b4","org_name":"Lahey Hospital & Medical Center","org_type":"healthcare","ransomware":null,"records_affected":599,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/lahey-clinic-hospital-settles-ocr-charges-stemming-from-theft-of-laptop-used-with-ct-scanner/;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.bostonglobe.com/business/2015/12/04/lahey-hospital-pay-fine-after-stolen-laptop-exposed-patient-information/HWxW2xS1diOhu8jSPXAoCL/story.html"}],"summary":"Hot off the presses: there's been another settlement announced by OCR. This one involves Lahey Hospital and Medical Center (Lahey Clinic Hospital), who have agreed to pay $850,000 and to adopt a robust corrective action plan to correct deficiencies in its HIPAA compliance program","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"high","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a005ed43f9840a96d40933bcb65c34fb751a2f98","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dd44d010-e376-11e7-bf7a-0771e1cc9602"},"incident_date":"2011-01-01","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"76337dbc9f29","org_name":"Kmart","org_type":"retail_ecommerce","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.grandforksherald.com/news/4213810-minnesota-viagra-privacy-lawsuit-dismissal-upheld-appeal"}],"summary":"A pharmacist inadvertently provided information about a man's Viagra prescription to his estranged wife.  The complaint stemmed from one phone call back in 2011. John Doe's ex-wife was a pharmacist in a different town. When she allegedly called the Willmar pharmacist at the Willm","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d19ac14043329d65ffa8f84ca37fa026eedec59","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41053D59-6830-4162-9C74-31FA7118DD68"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db210e358980","org_name":"Kelly Services","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/kelly-20120309.pdf"}],"summary":"A former employee retained electronic documents on his personal computer containing information on some employees.  Data types are not disclosed.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"513c91f7cfe56111c88d5021a4a00197cdc0d4ee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"dafc31a0-1648-11ec-8258-83f74c3914c9"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cbadd774083","org_name":"JPMorgan","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://dailyvoice.com/new-york/suffolk/news/ex-investment-bank-director-from-long-island-sentenced-for-insider-trading-scheme/780217/"}],"summary":"Ex-Investment Bank Director From Long Island Sentenced For Insider Trading Scheme ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e926f6b8e2610b5f4a84634cbd8bf83eedd1326e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C01CFDBE-7724-42F2-AF92-9A8517F60A6A"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"f34ec492f201","org_name":"Japanese Coast Guard","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/04/29/japan_coast_guard_forgets_wipe_data_norks/"}],"summary":"The Japanese government's data protection policies have been called into question after it emerged that a decommissioned coast guard vessel was sold to a pro-North Korea organisation without any checks as to whether key data on board was first deleted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7417c25ea7581400de7051a2ef1f2f47f961dc35","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F77F05C3-62C6-4A68-AE01-6C0F48D46F10"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c811336c51c0","org_name":"Jackson Health System","org_type":"healthcare","ransomware":null,"records_affected":24188,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.whec.com/article/stories/s4042759.shtmlhttp://www.miamiherald.com/news/health-care/article59339038.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.miamiherald.com/news/health-care/article59339038.html"}],"summary":"Secretary accessed almost 24K records over a five year period; some used to commit ID theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"high","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5d360da045cee6d6b79eb75b32e7d44d5ae54071","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"d7ca1480-c885-11e7-ad9d-998b531c9197"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2bb269d34ecf","org_name":"Internal Revenue Service","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.usnews.com/news/best-states/new-mexico/articles/2017-11-07/ex-irs-employee-in-albuquerque-gets-prison-term-for-id-theft"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/kellyphillipserb/2012/07/09/irs-employee-accused-of-identity-theft/?feed=rss_home"}],"summary":"Ex-IRS Employee in Albuquerque Gets Prison Term for ID Theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38c2ad5122b662e517858e1416b622218d12662f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9375288E-2A51-44F7-96B1-973404E6F2EE"},"incident_date":"2011-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc58119d652","org_name":"Indiana University Health Goshen Hospital","org_type":"healthcare","ransomware":null,"records_affected":12874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazine.com/indiana-university-hospital-laptop-stolen-contains-data-on-10k-patients/article/293088/"}],"summary":"Malware may have allowed attackers to make off with the personal information of thousands of people connected to Indiana University Health Goshen Hospital.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal","personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"335e23f2eb9972126dd1091e34d6ac210f689be5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43EBEEB3-2D3B-4782-B561-04F323EAFB67"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62b1a5270b13","org_name":"Huntington Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.com/ap/ApTopStories/201105080424"}],"summary":"A lawsuit filed by Huntington National Bank claims six former employees stole more than 2,000 customer records before they quit to go work for the competition.  The bank filed the lawsuit in federal court against former vice president Sandra D. Kokoska, former assistant vice pres","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d95d063ef6a09629e5943c080757a9a92d0e4a28","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B164EFD-7D5B-4843-9C50-2F66EFC0ED39"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a38da0ac9d2f","org_name":"Human Services Agency of San Francisco","org_type":"government","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sfexaminer.com/local/crime/2011/02/thousands-medi-cal-records-san-franciscans-breached;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.californiahealthline.org/articles/2011/2/8/san-francisco-reports-data-breach-affecting-medical-beneficiaries;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/thousands-of-medi-cal-records-of-san-franciscans-breached/"}],"summary":"An employee dispute at the Human Services Agency of San Francisco has resulted in an information breach affecting about 2,400 Medi-Cal beneficiaries, the San Francisco Examiner reports. Medi-Cal is California's Medicaid program. Trent Rhorer, the agency's director, said the breac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b871321273030ecd138de3ddc61edcca834a9968","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F65BBE8-D047-4EC6-AFC2-E07C0CEC2D8B"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"HK","org_id":"3d2f6b22cf72","org_name":"Hong Kong Police Dept.","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/hong-kong-privacy-commissioner-for-personal-data-publishes-reports-on-two-investigation-into-data-security-at-the-hong-kong-police-department/"}],"summary":"Confedential Personally Identifiable documents leaked via File Sharing software.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd80c6c5cd85c578ec47be19555621dc59d43502","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2EE02485-6930-48DA-95D8-9EFD85C789A5"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"7eba66e5dfc8","org_name":"HM Prison Services","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://nakedsecurity.sophos.com/2013/03/04/jailed-hack-prison/"}],"summary":"Prison inmate (imprisoned for cyrber crimes), \"managed to hack into the prison's mainframe computer\" while taking an IT course in the prison.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7cb626f6d1c3d7881d69502cc1f272430703d6c2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"118D4FF7-24B1-4EE5-B9B1-6053DF714653"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ac5dca180a25","org_name":"Highmark Blue Cross/ Blue Shield","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/pittsburgh-area-counselor-stole-600k-through-alleged-insurance-fraud-scheme/"}],"summary":"A woman who was a counselor defrauded an insurance company by billing for services that were never given to the amount of $600,000.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd73beaa1940f57664da267e37213a9fc9d2008c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85A75A1A-B1CA-4816-97FA-2C84B0481CD5"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e9bebedee0e","org_name":"Henry Ford West Bloomfield Hospital","org_type":"healthcare","ransomware":null,"records_affected":305,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.detroitnews.com/story/news/local/metro-state/2014/11/18/two-indicted-identity-theft-tax-return-charges/19252631/"}],"summary":"Two alleged identity thieves stole personal information of more than 1,000 Metro Detroit hospital patients and then schemed to receive nearly $500,000 in phony tax return refunds, according to the U.S. Attorneys Office.  Markitta Washington, 29, of Hampton, Georgia, previously of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88c63b0e882060efc84fbc1a8912e5fa09ae444e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B5E2ACD7-9BD0-4406-ABA3-70D5DA1FF24A"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c3d8beeb7a21","org_name":"hasta Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.jdsupra.com/legalnews/hospital-disclosure-of-phi-to-media-and-86023/?goback=%2Egde_4636751_member_250704577;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/shasta-agreement-press-release.html;"},{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/shasta-agreement.pdf"}],"summary":"Shasta Regional Medical Center (SRMC) has agreed to a comprehensive corrective action plan to settle a U.S. Department of Health and Human Services (HHS) investigation concerning potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"078b100a3a0521edf60019ab65eb7f5d5c8ade89","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"65D4C141-7045-4767-A9B9-FDBAA392FABB"},"incident_date":"2011-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"PL","org_id":"c06aa6753b71","org_name":"Hakin9","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kahusecurity.com/2011/hacking-magazine-hacked/"}],"summary":"One of my favorite hacking resource site appears to be hacked and possibly even infecting visitors.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2a517b71e43a69c911916240a716f7c6e2fa8ae3","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A19E4EA7-0297-4B52-9AC9-534F0B525853"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b090de351dd8","org_name":"Guthrie Clinic","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.newsday.com/news/region-state/court-to-look-at-nurse-s-confidentiality-breach-1.6413292;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/ny-lawsuit-alleges-nurse-divulged-confidential-information-on-std/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.courthousenews.com/2011/03/02/34570.htm"}],"summary":"He went to a private medical clinic to receive treatment for a sexually transmitted disease. But when the man, known in court papers only as \"John Doe,\" arrived, a nurse recognized him and texted Doe's girlfriend.  The nurse in question is Mr. Doe's girlfriend's sister-in-law.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CN","motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f72d666ba4ce03ce944c2580059022134b893ef7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AE2887B8-F00B-4B52-BA46-39672AF7C2F8"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"ca42f037bab0","org_name":"Guangdong Public Security Bureau","org_type":"government","ransomware":null,"records_affected":4440000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.thenanfang.com/blog/guangdong-police-border-control-servers-hacked-data-leaked-online/"}],"summary":"Servers belonging to the Entry-Exit Department of the Guangdong Public Security Bureau (PSB) have been hacked, and the legal names, passport and ID numbers, dates of birth, home addresses and telephone numbers for more than 4.44 million people have been leaked online, writes Sout","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"253b963e1310da729b474cb27a9b099ab3ad5ae7","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13AA9A62-F870-45AF-BE05-F5A7A3CDCE29"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1502b46b36c9","org_name":"Genesis Clinical Laboratory","org_type":"professional_services","ransomware":null,"records_affected":1070,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e182dc5687cd97a1ed5f7a35f4cecd1373cd88e","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A37A1264-7C6E-4216-A6B0-1E38FCEB798D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f65b0953028e","org_name":"GDF Suez","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.yorkshireeveningpost.co.uk/news/latest-news/top-stories/leeds-computer-worker-s-19-million-fraud-1-5970739"}],"summary":"Internal actor forged signatures on numerous purchase orders to acquire computer equipment that was ultimately sold online to fund gambling addiction.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6336f37d11401b9fe5fbb02e98ee38dad04b5501","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6876AF13-A15C-4053-ACE0-F50F68EE14AA"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bc3693d94301","org_name":"Gattison & Associates","org_type":"professional_services","ransomware":null,"records_affected":557,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtontimes.com/news/2016/jun/27/tax-preparers-sentenced-for-id-theft-fraudulent-re/"}],"summary":"tax preparers identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8f0dbf8992e9b3d91a6c9e9691bb761a989e725","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"37D3AEC1-C876-401B-861E-72596D265626"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"f22bdcb9d01f","org_name":"Florida Hospital","org_type":"other","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareinfosecurity.com/selling-records-for-profit-alleged-a-5054"}],"summary":"A former staff member at Florida Hospital Celebration was arrested for allegedly inappropriately accessing more than 760,000 electronic health records with the intent to disclose, transfer or sell certain information for personal gain.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"920093624d8c183d6a61c2bc3c502e6f973a0442","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D8F9848E-B52E-42ED-9A9C-CA743C2BF278"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"f1d9cf27e569","org_name":"Fidelity National Information Services Inc","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.finextra.com/News/FullStory.aspx?newsitemid=24885;"},{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/06/fdic-2011-fis-breach-worse-than-reported/"}],"summary":"Payment processor suffered a compromise that led to fradulent increasing of pre-paid debit accounts and cash-outs of ~13M USD.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"MD","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41f01e0303755b6081a8ecea1c16aec4deacb839","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CECA9B17-91A7-458D-9BED-E8ACA63EC220"},"incident_date":"2011-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02c5a7bf10e8","org_name":"FIDELITY INVESTMENTS INSTITUTIONAL OPERATIONS COMPANY, INC.","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2013/11/feds-charge-calif-brothers-in-cyberheists/"}],"summary":"Hackers use stolen credentials to transfer money from victims customers","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3d1fd663f76cf49a7838c4f64d77d20460dee5c8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B19DDC2-A883-423A-A9DC-486F19130EFE"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ffbcc9a0f20b","org_name":"Facebook","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theregister.co.uk/2013/06/08/facebook_cloud_versus_cloud/"}],"summary":"Weather conditions cause data center to flood with moist air which condensed in the cold room leading to rain inside a building. Availability was affected.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"environmental"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5f25c7194ce665f539a3057c3507d5867142b205","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB3229D2-103F-4C32-BFD1-D1E3FE448C68"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df1e2dbdbf37","org_name":"Euronet Worldwide","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2012/01/23/us-euronetworldwide-idUSTRE80M2ET20120123"},{"fetched_at":null,"title":null,"type":"press","url":"http://digitaltransactions.net/news/story/3405"}],"summary":"Payment processor disclosed that they suffered a data breach. No information was provided regarding how information was breached or how much.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"99235dea3f3b9e0f3a063aa8ae0f31e15d5c549c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E8554507-CD87-4D71-A0C3-F84EA1DAE33D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0a18045aec5","org_name":"Enki Corp","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.computerworld.com/s/article/9245867/Misuse_of_proprietary_data_alone_doesn_t_violate_CFAA_judge_rules"}],"summary":"Former employee uses access granted to new employer to exceed authorized access.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"RU","motive":"ideology","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ff17187d738e26f91ea9cc766de88af9995e63f0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B260809-1C59-4634-8411-470FF7E0E48D"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"695d9c71579e","org_name":"Elsevier","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sciencealert.com/this-woman-has-illegally-uploaded-millions-of-journal-articles-in-an-attempt-to-open-up-science"}],"summary":"Russian scientist put 48 million journal articles online at sci-hub.io. (Really it hasn't downloaded them all, it just uses donated keys to allow other people to download the papers.)","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"US","motive":"grudge","name":"Robert Beeter","variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aa9dfe67194bcc2da191b7536289eabb176910ea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0b57d610-aa0e-11e8-b272-396d7fe012b7"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1f6cba86bbd","org_name":"Elgin Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailyherald.com/news/20180125/former-elgin-deputy-chief-will-pay-20k-for-hacking-email-of-girlfriends-husband"}],"summary":"A former Elgin deputy police chief will pay $20,000 to settle a federal lawsuit for hacking into the email of his then-girlfriend's husband to gain information to help in her divorce.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking","derived":{"actor_id":"robertbeeter"}},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"318ddac0ef75bda8c457bbb6e2a966cc247c7fe5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5ACC229C-D16B-40EA-80B5-3A00878C694C"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"1f06ad637550","org_name":"East Kent Hospital Trust","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kentonline.co.uk/kent/news/hospital-faxes-patients-records-to-27296/"}],"summary":"East Kent Hospital Trust had a total of 13 breaches - the most in the county - including eight instances of staff inappropriately accessing patients' records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"278b91535f73b331f755094b758d9a0bde2d9612","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D35A71F8-8E98-4837-9811-C3D6E85B1057"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CN","org_id":"d467dc8b6857","org_name":"Duowan","org_type":"professional_services","ransomware":null,"records_affected":8000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techinasia.com/hackers-steal-data-of-millions-of-chinese-net-users/"}],"summary":"Yesterday, the Chinese internet was shaken by the news that IT portal and community CSDN has been hacked and data for its more than six million users had been stolen, including usernames and passwords. Today, reports have it that CSDN wasnt the only site affected.  Duowan, a game","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4a1fd4048128c6f95f99ffc177499c443e3a4784","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"55AF3878-09A9-43A8-A4F9-5412C1B2AF0C"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"bedd0c729f80","org_name":"Dr. R. Burnham and Associates Medical Clinic","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.lacombeglobe.com/2011/05/20/ahs-program-records-impacted-by-private-clinic-break-and-enter"}],"summary":"The Dr. R. Burnham and Associates Medical Clinic in Lacombe has informed Alberta Health Services that a portable hard drive recently stolen from this clinic contained backup copies of Alberta Health Services' Central Alberta Pain & Rehabilitation Institute (CAPRI) client records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf87e5c1078e41fe58915c0b0a3739a8442d7dbb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6D1AC1F7-42DD-47B2-AC0C-9E7A03C8A0BF"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2f0529f5743","org_name":"Dr. Jeffry Barnes","org_type":"healthcare","ransomware":null,"records_affected":60,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theledger.com/article/20110506/NEWS/110509526?Title=Sensitive-Patient-Records-Found-in-Winter-Haven-City-Recycling-Dump&tc=ar"}],"summary":"Records containing more than 60 Social Security numbers and sensitive medical histories were found this week by a woman diving for coupons in a large recycling bin.  The paper records found at the city recycling area near the Orange Dome in Winter Haven on Tuesday came from the o","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a47f321a96818afe4ef493392ba183a287e96c5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F48CC2B-F0D8-443E-8A53-51D4A3E7A10C"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"AU","org_id":"19a2613aaa68","org_name":"Department of Veterans' Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.itnews.com.au/News/397965,veterans-affairs-forced-to-apologise-over-privacy-breach.aspx"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.stripes.com/veterans-personal-information-accidentally-posted-on-ancestry-com-1.166409"}],"summary":"Department of Veterans Affairs shared medical data in an inappropriate manner","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb4f85fe1a72d3d4253cf58831a3ea8ff9772e48","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A28FE07C-C227-4D9B-8787-E88E1F6B5AB9"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce7d22972efa","org_name":"Dallas Fire-Rescue Emergency Medical Services","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2014/10/17/small-number-of-laptops-with-phi-missing-from-ambulances/"}],"summary":"Over a period of approximately three years, a small number of laptops have gone missing from ambulances in the Dallas area. The laptops in question disappeared between January 1, 2011, and August 29, 2014, according to the Dallas Morning News, and reportedly contained patient inf","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d3643b11d5c2ea250d35a57b0dc2df0f1a7d768","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BC600177-1AC0-4B09-999F-32244A11BDAC"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"575cb717b141","org_name":"Craven District Council","org_type":"government","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23272"}],"summary":"The Information Commissioner (The Commissioner) was informed by the Council of the theft of an unencrypted laptop containing a database with child swimming lesson details for 2300 individuals. The information was not of a nature that would be defined as sensitive personal data in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2b8449da6a3aed443f0696d4e6a4698f44cab704","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"870D4800-8C69-4950-BDEF-0BCC483A925A"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32606e84b157","org_name":"Coalition of Law Enforcement and Retail","org_type":"professional_services","ransomware":null,"records_affected":2400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/law-enforcement-targeted-by-hackers/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/coalition-of-law-enforcement-and-retail-c-l-e-a-r-hacked/"}],"summary":"According to its web site, the Coalition of Law Enforcement and Retail (C.L.E.A.R.) was formed in November 2008 by a group of Law Enforcement and Retail Loss Prevention professionals that saw the need for the formation of a partnership. According to a hacker called Exphin1ty, how","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"846ac8e4b6a29b4d34a43506cf6cb687df259671","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB502F52-1174-4F99-ABAC-52BB6D1A761F"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0cefb56a1ba9","org_name":"City of Miami Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.sun-sentinel.com/news/local/crime/fl-cop-identity-theft-20131001%2C0%2C7341282.story"}],"summary":"City of Miami Police Officer Malinsky Bazile was found guilty Thursday of using his job to steal hundreds of people's identities and commit identity theft.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ae52ed987494dfa1187596f3f960cfe0bfbc34a4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBC2DCED-1155-4F27-B1B5-62C102A329F6"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"439cf8b2d746","org_name":"City of Macon Georgia","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.41nbc.com/news/local-news/18526-davis-personal-info-left-on-city-computer-hard-drives-sold-to-computer-repair-shop"}],"summary":"A computer repair shop bought used computers on govdeals.com in 2011.  The computers were found to have information from city employees when they were removed from storage on January 5.  Social Security numbers, pension information, and other personal information from Macon polic","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f29bf7ce6be67275a23933298342e4cc6940a495","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CED9EF42-51CA-4B5B-BE03-3316EE8FF821"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b222efaeb9f8","org_name":"City of Cumberland","org_type":"government","ransomware":null,"records_affected":275,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcsh6.com/story/local/2013/01/16/2088724/"}],"summary":"Cumberland investigates website security breach CUMBERLAND, Maine (NEWS CENTER) -- The town of Cumberland is trying to figure out how a 2008 document with the names and social security numbers of 275 employees was uploaded to the town's website. That document has since been taken","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1a8701d920e92d754f758be60e08a0fff8bc088a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A58DA343-23D1-4370-B38E-F84C0EDA593A"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c68bfee46490","org_name":"ChoicePoint","org_type":"financial","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/?p=23024"}],"summary":"Adetiloye, 40, pleaded guilty on February 16, 2011, to participating in a scheme to defraud financial institutions and individuals out of money. Adetiloye was living in Toronto, Canada, from before January of 2005 to May of 2010, when he was extradited to the United States. Durin","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bd3dd32ad621bdab7b72259af69ae890bb99d33","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7B9D36E6-5C56-4CB4-B301-767378D6B3FB"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a354be4c5e96","org_name":"CenterPoint Energy, Inc","org_type":"energy_utilities","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.click2houston.com/news/identity-theft-inside-houston-electric-companies/-/1735978/20066602/-/140cpmxz/-/index.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.click2houston.com/news/fired-customer-service-representative-convicted-of-identity-theft-before/-/1735978/20098828/-/8wecfjz/-/index.html"}],"summary":"Employee working in billing uses customer information for identity theft","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2092f8d4a97fb644882b95f26d1a35f97ff1a560","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FCDE811A-732A-414A-B962-CD7ACFFB0756"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fc8038dc63e5","org_name":"C.R. Bard, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.siliconindia.com/news/general/Indian-National-Admits-Stealing-Trade-Secrets-in-US-nid-167198-cid-1.html"}],"summary":"Internal actor was arrested for stealing trade secrets from 2 organizations that he worked from from 2004-2011, and 2012-2013.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b76378ceeaf29f2624add3afb0aaecf8637f605","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"30B9EF90-2118-4AD6-9613-0945226AEB99"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"61a649c2a47c","org_name":"Bonney Lake Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2367,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/wa-bonney-lake-doctor-office-burglarized-medical-i-insurance-and-social-security-numbers-stolen/"}],"summary":"Bonney Lake Medical Center was burglarized on August 12, 2011. The thieves broke into the office and stole password-protected computers including a computer server containing patient information. The personal information may have included name, address, Social Security number, in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7ac268e16b0f9632e01cbb41acaa4f86b48fc73e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1440DFDA-972D-4DDA-BF5A-F0C378314D4F"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8228a455f49d","org_name":"Blue Cross Blue Shield of Florida","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.news4jax.com/news/exblue-cross-employee-pleads-guilty-to-id-theft/31653424"}],"summary":"A woman who had access to customers' personal identifying information while working for Blue Cross Blue Shield of Florida in 2011 has pleaded guilty to a federal charge of aggravated identity theft.  Laura Butler, 40, faces a maximum penalty of seven years in federal prison with ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5aea0f278b178ab95d3ea27ddf5773a0c288608b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C9F0464-5BB6-4FA5-8680-5F6E180EF960"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CH","org_id":"2a90c9d02411","org_name":"Bank Sarasin","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://genevalunch.com/2012/01/03/bank-employee-admits-sharing-hildebrand-private-data/"}],"summary":"A computer system employee of Bank Sarasin turned himself into police 1 January, it was revealed late Tuesday, after sharing documents linked to currency transactions made by the family of Philipp Hildebrand, chairman of the Swiss National Bank.    The documents were given to an ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"CA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20798bbdfed01ae9fee2850627d3fdab4a0abb2a","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"92D8E6F8-0B8C-40C4-A4F3-732E61AE5072"},"incident_date":"2011-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"f7665c114c01","org_name":"Alberta Health Services Central Alberta Pain & Rehabilitation Institute (CAPRI)","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.albertahealthservices.ca/rls/ne-rls-2011-05-20-lacombe-clinic-records.pdf"}],"summary":"The Dr. R. Burnham & Associate s Medical Clinic in Lacombe has informed Alberta Health Services that a portable hard drive recently stolen from this clinic contained ba ckup copies of Alberta Health Services’ Central Alberta Pain & Rehabilitation Institute (CAPRI) client records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8077f501680b85d82c3642a189cfeb9f42bd2580","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"954195BD-0F88-49C9-A52B-6A265CDA873A"},"incident_date":"2011-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e4ed24b2a86","org_name":"Aiken Community Based Outpatient Clinic","org_type":"healthcare","ransomware":null,"records_affected":2717,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unaffiliated"},"attack_techniques":["T1190"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df9a3118faf8808afa03b89c7b0e084d99e4613e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2A921ADB-0CEA-43C3-B1E8-BFFF8334E715"},"incident_date":"2011-01-01","initial_access":"exploit_public_facing_app","initial_access_attack_id":"T1190","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"88fb051c6d55","org_name":"Aerticket","org_type":"other","ransomware":null,"records_affected":1500500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.rt.com/news/354191-german-airline-passengers-data/"}],"summary":"searchable database since 2011","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7858472ceefdc3404fa89d9b44c719fcf2bbf3e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5B55E755-BB32-41D2-91F1-7200D1242ABE"},"incident_date":"2011-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cfeab2fa9b9","org_name":"Adventist Health System/Florida Hospital Celebration","org_type":"healthcare","ransomware":null,"records_affected":760000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreachtoday.com/health-data-theft-case-prompts-lawsuit-a-5690,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareinfosecurity.com/prison-time-for-health-data-theft-a-5442,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.beckershospitalreview.com/healthcare-information-technology/adventist-health-faces-lawsuit-over-data-breach-affecting-more-than-763k.html"}],"summary":"Adventist Health System faces a class action lawsuit seeking damages for failure to safeguard the HIPAA-protected information of 763,000 patients at several of its hospitals in Florida.  At the heart of the lawsuit is a breach that involved a former emergency department worker of","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2011-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d8fb0ac40dfd5d5f0c2b1e5a524271cb7cd99d57","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CBE7099B-29C0-426F-8010-84B9C63AC1E2"},"incident_date":"2011-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c382066b298","org_name":"Accendo Insurance Company","org_type":"financial","ransomware":null,"records_affected":175350,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"289a1bae39a486d0be190779978793aa072ed85c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A55BD3FB-CAAB-434D-AB99-95FE3E2BCE10"},"incident_date":"2010-12-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7f42a4a8017","org_name":"Lake Woods Nursing and Rehabilitation Center","org_type":"healthcare","ransomware":null,"records_affected":656,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c5c50384d9468bc46202b6cac1d8806689d9ca79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5EAF8FE8-88A3-4B1D-A47B-98D972E456F9"},"incident_date":"2010-12-30","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Nurse educator discovered that a nursing student had printed documents from a patient's CPRS record and taken them home.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4407ac574c74ee48cb58c10e5de7410ccc445560","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B427DFB8-0AD2-49A9-BE96-D00F5DB52E05"},"incident_date":"2010-12-23","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f60ae6fce24","org_name":"Texas Health Arlington Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":654,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdac0e4207e61657b6954d9160223ad5a1fbad28","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9755EE3-042B-4A59-A38B-3D0C57408BF6"},"incident_date":"2010-12-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bd105f669f5f","org_name":"New York City Health & Hospitals Corporation's North Bronx Healthcare Network","org_type":"healthcare","ransomware":null,"records_affected":1700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75b078649468c2e84c3344a6175e08e35cbe1f32","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B0AFD700-CE60-4A86-B322-46D10F3DB2EC"},"incident_date":"2010-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f56b50c213ed","org_name":"Zarzamora Family Dental Care","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"854299e2640e33e70aefa80504403fe0e2ba5a2a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E9D00A0-74A6-4509-A642-89B3D27B234B"},"incident_date":"2010-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d0ad225f5876","org_name":"Mountain Vista Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2284,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"90eab6ce62e8942b01cd0bfc37a18f27106f4671","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AAC0CBFF-6DA2-413D-9427-4822CF512099"},"incident_date":"2010-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62a8b3157d55","org_name":"Hospital Auxilio Mutuo","org_type":"financial","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d766008ea4a464b46b440122336f245aa51662b0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6B1D1FD-6221-4729-B5CB-4DF39956EFF7"},"incident_date":"2010-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2e50373cdec","org_name":"Dean Health Systems, Inc.; St. Mary's Hospital; St. Mary's Dean Ventures, Inc.","org_type":"healthcare","ransomware":null,"records_affected":3288,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"768eb3abd6b4d28f7173e06a4ed08e7e239aa4f1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5C5D8C14-9751-4EA9-90F6-2F89A71A4B73"},"incident_date":"2010-12-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9033131c8c27","org_name":"Cook County Health & Hospitals System","org_type":"healthcare","ransomware":null,"records_affected":556,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0bc668ec1cc3327fc95bfb7f325a1332c9f31671","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0096EF99-D9CB-4869-9F3D-F4E0D84F419B"},"incident_date":"2010-12-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"37a7cc28ca48","org_name":"Friendship Center Dental Office","org_type":"healthcare","ransomware":null,"records_affected":2200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2496c728f6e98f579e5f9fc85cf7d38bdbf48d30","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C409390-50BA-49AA-B5EE-726789B58D9C"},"incident_date":"2010-12-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52c313a9ef2a","org_name":"Ortho Montana, PSC","org_type":"healthcare","ransomware":null,"records_affected":37000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df744e2efec7a3d10d20f43eb487b86db01841f4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB52D807-2EFD-41F0-A5D6-102F8762221E"},"incident_date":"2010-12-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db6bdff10f5d","org_name":"Jefferson Center for Mental Health","org_type":"healthcare","ransomware":null,"records_affected":546,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":"Theft of paper records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9150c3770d2cedcfa2415f4998b4fc951aa6496","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E88DDFEC-4F20-4EA7-8265-0E5C96E14C63"},"incident_date":"2010-12-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"17173d1f29b9","org_name":"Saint Louis University","org_type":"education","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdac833c8031ead3b01f042a39e624ac0a201b8b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E1290AC8-2724-4297-935D-49EF44E6713B"},"incident_date":"2010-12-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"283e16761d6f","org_name":"University of Tennessee Medical Center","org_type":"healthcare","ransomware":null,"records_affected":8200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5991a93f88b8d0ef234a60e510f54f61d26afad2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8619557A-AA1B-47CE-81DF-ED690AD68513"},"incident_date":"2010-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3dcb598ebcc5","org_name":"Triple-S Salud, Inc.","org_type":"financial","ransomware":null,"records_affected":398000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a9af8633ffb1b1567c92b7f7b35aeb545c23c00d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DC16B92-6768-4CFE-9080-8F5C923F544C"},"incident_date":"2010-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7cd76fe9754a","org_name":"Oklahoma City VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1950,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8c3fe8b77cfb39a1341c0b70d3fcfcc70fef82c4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C529B44F-6137-42B7-AF2A-86B1270D9AF5"},"incident_date":"2010-12-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c8ade923324","org_name":"Ochsner Health System","org_type":"professional_services","ransomware":null,"records_affected":9475,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8421a464602c451884dc877a8f2ac0e5d2352d89","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4174F012-212C-4ADB-AC95-553492E696FC"},"incident_date":"2010-12-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed30a772df52","org_name":"Newark Beth Israel Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1744,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1e26ca4538c1fa985c8e5b42df5b63619459f0d1","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6C85557D-F69F-402D-A382-68DDC7ACB211"},"incident_date":"2010-12-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e1b6e1e2c1e","org_name":"Memorial Hospital of Gardena","org_type":"healthcare","ransomware":null,"records_affected":771,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8baa96ef7fb582764ef776ae9fa24145db95e3cf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"19EAE609-DD0B-47B3-94A3-70FE6865E175"},"incident_date":"2010-12-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d69287de1f06","org_name":"Long Beach Memorial Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4be09d7a4d8c7434f0697371553521c98d12cb95","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9602385F-506E-4B0F-B828-8C7F33830BBA"},"incident_date":"2010-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"511ab977fcff","org_name":"Kings County Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":542,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"324ebe788b621c976fcd3ebb72acdf3f279c0c69","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFB3751B-CA0C-42A2-8AD2-C8AA1413FF10"},"incident_date":"2010-12-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9b48a6abd262","org_name":"Albert Einstein Healthcare Network","org_type":"healthcare","ransomware":null,"records_affected":613,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-12-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bcb81befa4f20a58df0aa1436f37fb5d86de60e1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39DD8553-32FE-4124-84A7-57E762F227F3"},"incident_date":"2010-12-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e37c5c7d225","org_name":"CBR Systems (Cord Blood Bank)","org_type":"healthcare","ransomware":null,"records_affected":300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/01/28/cbr-cordblood-privacy-idUSL1N0AX8IY20130128,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/cord-blood-registry-settles-with-ftc-over-privacy-breach.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://thehill.com/blogs/hillicon-valley/technology/279605-ftc-announces-data-breach-settlement-"}],"summary":"The 2010 theft of a company laptop, a hard drive, and a number of unencrypted backup tapes resulted in the exposure of sensitive information.  Social security numbers, credit and debit card numbers, driver's license numbers, and dates of birth were contained on one or more of the","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"601835aac1949de6195d2c80e2973826e2907fc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E33C7A22-B590-4C2A-AE3D-F7C5E3540492"},"incident_date":"2010-12-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bf811257aa9a","org_name":"CHC Memphis CMHC, LLC","org_type":"nonprofit","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ef18c0ea74ab1f514c152df42a4486b4776b8d3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C9A209D0-80AB-44D0-9E84-237F4DB204A9"},"incident_date":"2010-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"43e12c8aa7e9","org_name":"Robert Wheatley, DDS, PC","org_type":"healthcare","ransomware":null,"records_affected":1400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b6e2b543d5f354b66eab0446aedac2f78848dced","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95E02948-AF96-4BCE-9AB1-C579122B0F99"},"incident_date":"2010-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e0d50132db3d","org_name":"Prime Home Care, LLC","org_type":"nonprofit","ransomware":null,"records_affected":1716,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1515a6d033364faad443a7423247bd9336dfc460","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B63EB3D-F818-4EBD-8533-5DDEB6B71F22"},"incident_date":"2010-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2d9c0c6888a","org_name":"Holy Cross Hospital","org_type":"healthcare","ransomware":null,"records_affected":1500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a7acaa3209fd305a5de4437611f57e56609915a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ADF9B541-1A5A-4D95-AAC7-9CCF062EB1E4"},"incident_date":"2010-12-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfeda976688d","org_name":"Baylor Heart and Vascular Center","org_type":"healthcare","ransomware":null,"records_affected":8241,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0262744197d08684f22b52908eacf1eee8736872","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"25EE0CC5-C946-4291-B4ED-2F6EC48334AD"},"incident_date":"2010-12-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed8c1aacc480","org_name":"United States Postal Service","org_type":"transportation_logistics","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.reuters.com/article/2013/02/17/us-usa-tax-fraud-idUSBRE91G05M20130217"}],"summary":"Bruce Parton was only a few weeks from retirement after 30 years as a mail carrier in sunny Florida.  He never lived to fulfill his retirement plan of moving back to a quiet life in the Catskill mountains of New York, not far from where he grew up on Long Island.  Instead, he was","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"activist"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-12-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf5e5ca8e0666404c36b838161a155240d17973d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4488AA2-11FC-43B6-8F36-EB5A846C0901"},"incident_date":"2010-12-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"430f313d296f","org_name":"Santa Cruz County","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.santacruzsentinel.com/santacruz/ci_24689688/ohio-man-pleads-guilty-santa-cruz-county-cyber?source=rss"}],"summary":"DDoS attack on government site occurs protesting ban on camping outside of a CA courthouse.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1f807c77bad7ec6ee27768cfc51436bacf4ac32b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8BC9F991-DA52-4E24-876C-1AEE7C4DA37A"},"incident_date":"2010-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"093681dae5a0","org_name":"Misericordia Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/canadian-doctor-suspended-for-privacy-breach.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cpsa.ab.ca/Libraries/pro_complaints_disc/011469-000015972511-1.pdf"}],"summary":"The College of Physicians & Surgeons of Alberta recently found Dr. Deanne Watrich guilty of unprofessional conduct for accessing the electronic health records of three people with whom she had no doctor/patient relationship (h/t PHIprivacy.net).  The investigation followed compla","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2010-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"49f6150659df7b6f5900c54fd5c951b3a8c06fdb","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7566279B-AC11-4853-BB03-892004FC07E0"},"incident_date":"2010-12-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2454e016fcbd","org_name":"Los Angeles Times","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://arstechnica.com/tech-policy/2013/03/reuters-social-media-editor-charged-over-anonymous-hack-of-la-times/"}],"summary":"Former employee provided creds to Anonymous to hack and deface latimes website.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-12-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"736ffca48ecf14c8e3757795f5b9be029521b9b7","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"443C22C7-6AAD-4EF9-A631-552FD6B1779B"},"incident_date":"2010-12-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"50e9cbe34da4","org_name":"Epsilon Data Management, LLC","org_type":"professional_services","ransomware":null,"records_affected":5000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/attacks/epsilon-fell-to-spear-phishing-attack/d/d-id/1097119"}],"summary":"external actor uses spearphishing to entice a user to click a link and download malware.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df5e5ae4c2aef4caebea9cdcf2877def4b979ed1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FA33EC45-911D-4196-B963-C095A8FEBBFC"},"incident_date":"2010-11-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4a612a8c7861","org_name":"Baptist Memorial Hospital - Huntingdon","org_type":"healthcare","ransomware":null,"records_affected":4800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1fe5f4147c353dc6855d28879989dbea4b61f503","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58095EE3-AD13-4786-89A2-6031FB1E1A90"},"incident_date":"2010-11-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d19e1b76fb6b","org_name":"Osceola Medical Center","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"320a769dea97c3c0b45d0347a50c6e600787b1fe","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"67A66320-7DD9-44DC-A70E-05B2CDB3588C"},"incident_date":"2010-11-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7e1fe0aeb97","org_name":"Jeffrey J. Smith, MD","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-24","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a92f30ac892256a9d2ea91a6c10fc70c6f356b3a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0A16E92-C14C-4DED-92C0-0648C926AAF5"},"incident_date":"2010-11-24","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f6c5172fd976","org_name":"Hanger Prosthetics & Orthotics, Inc.","org_type":"other","ransomware":null,"records_affected":4486,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3e710c86feec3104294b75ac799b87243a9fdc7e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B775025C-D22F-472C-AD01-EC90325CC584"},"incident_date":"2010-11-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6bcb5b49fcd8","org_name":"Grays Harbor Pediatrics, PLLC","org_type":"healthcare","ransomware":null,"records_affected":12594,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9afab9caaf16bb1eea891d2d592b5d08ecdca214","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1110840D-DA8A-4E67-8E61-9E9D57D754CE"},"incident_date":"2010-11-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6d5f0dee8ffe","org_name":"University of Nebraska Medical Center","org_type":"healthcare","ransomware":null,"records_affected":611,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d3c4fefff82bbffce7af8b05bd1870e7b3633a1b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C53129EB-44BD-4EA8-AA7F-7E1EFAF2C271"},"incident_date":"2010-11-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1ba44dfa13c0","org_name":"Benefit Resources, Inc.","org_type":"professional_services","ransomware":null,"records_affected":16200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4bc0db9e05a020ed5835577c677320ca8dcec71f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41287D7A-42AA-4A1B-8FB2-AA5CCE8FF4D6"},"incident_date":"2010-11-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79cce091a241","org_name":"VNA of Southeasten CT","org_type":"healthcare","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f6f70cc510b4691134dfb28297440d3d2d611c63","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5572E2DE-D0ED-48EC-B45A-A84862A8C819"},"incident_date":"2010-11-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff17d39e43b5","org_name":"Sta-Home Health & Hospice","org_type":"healthcare","ransomware":null,"records_affected":1104,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"PR","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["medical"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f335e42ada01e50d0307c1b3047a8695781790a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8DCBC566-AE66-41FA-BCD0-4374F1CFA201"},"incident_date":"2010-11-19","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de0576179919","org_name":"Puerto Rico Department of Health","org_type":"government","ransomware":null,"records_affected":400000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1694f40f2f6c0ac5ea11d3c650a1167e26e4e94b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F7B8440-BB96-46BE-8F97-EDC6300057E6"},"incident_date":"2010-11-19","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4137589fbaa6","org_name":"Manor Care of Indy (South), LLC","org_type":"healthcare","ransomware":null,"records_affected":845,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical","personal"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2092800ee4dc4ba6c5725adbc58a4ef2e87f23b4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73A2FCD7-4BB8-405B-B79A-F0F5FA199D83"},"incident_date":"2010-11-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"877adf86c716","org_name":"King Drug & Home Care","org_type":"retail_ecommerce","ransomware":null,"records_affected":13619,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.kingdrug.com/docs/PHIBreachNotice.pdf"}],"summary":"An employee reported that a portable hard drive was missing on November 23, 2010.  The device had last been seen sometime around November 19.  The data on the device included information from before July 31, 2009.  Client names, Social Security numbers, medical record numbers, ac","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"14c0e1c83911a281ca3ddf4e7b1b18f54f26fdea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8827E9A1-E022-476A-BEA8-512E7A74319C"},"incident_date":"2010-11-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b07efcfb1770","org_name":"Henry Ford Hospital","org_type":"healthcare","ransomware":null,"records_affected":3700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e2d90667037e1b79fe0276f0831cfe04e8910220","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BA463F72-32F8-41DD-BFE7-7E4078FEF91A"},"incident_date":"2010-11-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c7d649f35f5","org_name":"State of South Carolina Budget and Control Board Employee Insurance Program","org_type":"government","ransomware":null,"records_affected":5596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"04136fae5e88d137e2fcbf595404e7f63ec2bd96","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0DC355DE-3FB0-42BA-9D19-0BE2F7CA31B6"},"incident_date":"2010-11-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"30c6594559f3","org_name":"Fransiscan Medical Group","org_type":"retail_ecommerce","ransomware":null,"records_affected":1250,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"decfe364c8e24da6a2e869f3dfe5dbf629ba1f97","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8F96536B-4F4D-4690-920F-41C33FE74976"},"incident_date":"2010-11-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74853a0665e7","org_name":"Southern Perioperative Services, PC","org_type":"healthcare","ransomware":null,"records_affected":2046,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/update-on-southern-perioperative-services-breach/"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3b000eb94c27fe0aa7b7d2afceb12a0f15b28402","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F96D5971-7C66-431C-B0EE-DB835A71F24D"},"incident_date":"2010-11-17","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c5690099289","org_name":"Blue Cross and Blue Shield of Michigan","org_type":"financial","ransomware":null,"records_affected":2979,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"848222e91bdf2bc0f7f3f329ce040165d5a94b3b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F1B8B771-F8E1-4C47-80AA-D1E7F5A83469"},"incident_date":"2010-11-15","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94a2a3a9f186","org_name":"St. Vincent Hospital - Indianapolis","org_type":"healthcare","ransomware":null,"records_affected":1848,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"40847ea7c52e49eea5b35717d7f1639cc427ee77","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAC92CAB-D578-43BA-A17B-987D3D63831A"},"incident_date":"2010-11-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7e4f486bf479","org_name":"California Therapy Solutions","org_type":"healthcare","ransomware":null,"records_affected":1226,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e8810d13f03299049d670bc1e34d7360f5ced767","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"011B835F-8DC0-4EAC-BA14-52156C75A1F4"},"incident_date":"2010-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb691291e4db","org_name":"Visiting Nurse Service Association of Schenectady County","org_type":"healthcare","ransomware":null,"records_affected":535,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Theft of laptop exposes 535 records","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ef933a51ba8a758f350c5b0e245fc7b9548b0ed","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"86D55AE1-BB50-4D80-8552-F2B9C51D35B5"},"incident_date":"2010-11-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8a9c42739f66","org_name":"Seacoast Radiology, PA","org_type":"healthcare","ransomware":null,"records_affected":231400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1c187130bb832e973fcab434a64bbafad99afc97","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B957DCC3-1738-49D2-B63F-FBD9FEB1CE73"},"incident_date":"2010-11-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"41e28fd2d430","org_name":"Centra","org_type":"healthcare","ransomware":null,"records_affected":11982,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c7662fc27c080e847cf01609e432354cb328fa9","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83D876F2-5D2A-47E6-9C76-76ACE88A981A"},"incident_date":"2010-11-11","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"26ee89223a13","org_name":"Kadlec Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":834,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0c58555f205627ab4942bfe1ece9b600d6c399e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6547F59D-C915-4137-A239-F2A31C3EB909"},"incident_date":"2010-11-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d973da76bf7f","org_name":"Northridge Hospital Medical Center","org_type":"healthcare","ransomware":null,"records_affected":837,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3eaa6b36e5c0b74b49cecbcacedfefffe181ec49","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CF64C5D-5869-4243-AAEA-F874CC990939"},"incident_date":"2010-11-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c01d635cb2fa","org_name":"Debra C. Duffy, DDS","org_type":"healthcare","ransomware":null,"records_affected":4700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b08c9718d7fae0199bca57cb5b692af3d9be98c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8616C4DD-C518-449C-BB48-C3A000136EC4"},"incident_date":"2010-11-10","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e32a36968f03","org_name":"Ankle & foot Center of Tampa Bay, Inc.","org_type":"healthcare","ransomware":null,"records_affected":156000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-11-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"20ed8eaff35ff477e7a6479cb1b7414cef72df29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BCDBCC6-4F77-46AE-916D-82A13ED4C6CB"},"incident_date":"2010-11-10","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"financial","ransomware":null,"records_affected":2345,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthcare-data-breaches.findthedata.org/l/190/Aetna-Inc"}],"summary":"unauthorized access of a network server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d96290ef04d5351a3f3803b3cc3df90b1e41d44f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC15A803-C25B-4059-BF4E-BFD089AE5A6E"},"incident_date":"2010-11-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c175b17ae04","org_name":"Indiana Family and Social Services Administration","org_type":"healthcare","ransomware":null,"records_affected":757,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9101013d579c988e2a2d83c022354109d9301c9d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2BFCF0E-51DA-499A-A5D7-98EA85DAF115"},"incident_date":"2010-11-06","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21afa6957757","org_name":"Geisinger Wyoming Valley Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2196eeebe87c3e63a0cf2cf4280c43b8edbe5263","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7C718394-9BE8-49C0-A902-CFC82CC6DCCA"},"incident_date":"2010-11-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e5250c57f71b","org_name":"OhioHealth Corporation dba Grant Medical Center","org_type":"healthcare","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3f7f7aadf09027f6f24cf821cd2ca1268dd578b0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10EABC97-DB33-4CA5-A0E0-BF09254DDD8E"},"incident_date":"2010-11-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7ae5759c3990","org_name":"International Union of Operating Engineers Health and Welfare Fund","org_type":"nonprofit","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-02","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a414b033177dc965e74acd069fa5e2e8d6443a8f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CEA2F1C-7BF0-43CE-B3D4-0DF6657001AF"},"incident_date":"2010-11-02","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7c4cf25387eb","org_name":"Mankato Clinic","org_type":"healthcare","ransomware":null,"records_affected":3159,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"grudge","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials","internal"],"disclosed_date":"2010-11-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e524291c9692adce40523a41c8fdc21aea2c6f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"364FE118-0919-499A-B6F4-D81F876C53C2"},"incident_date":"2010-11-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1db7bad646b0","org_name":"Gawker Media","org_type":"technology_saas","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.forbes.com/sites/firewall/2010/12/13/the-lessons-of-gawkers-security-mess/"}],"summary":"Hackers breach Gawker.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"AM","motive":"financial","name":null,"variety":"organized_crime"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2010-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6560146ff09688eaff7136b0c88324f15336f0b4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE291C75-5734-4888-979E-4F5D13023E56"},"incident_date":"2010-11-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8a50fb0098f","org_name":"Chase Bank","org_type":"financial","ransomware":null,"records_affected":1100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.simivalleyacorn.com/news/2013-05-10/Community/Card_skimmers_draw_lengthy_sentences.html"}],"summary":"ATM skimming operation in California conducted by organized criminal group.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de9d5b5ed936c8b368d9e5f4ba1983dc25948bd1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"53C8505F-B71D-426A-B34C-A4808BDB2B94"},"incident_date":"2010-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"93c70027b0c7","org_name":"Cartagena Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":603,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/il-pharmacist-sentenced-to-seven-years-in-prison-for-obtaining-1-7-million-from-health-insurers-for-drug-he-never-dispensed/"}],"summary":"A Chicago pharmacist was sentenced to seven years in federal prison after being convicted at trial of collecting more than $1.7 million through false claims he submitted to insurance companies for a drug that he never dispensed and stealing the identities of unsuspecting pharmacy","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-11-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a712b908a5a1c2779820118dcd546794fdd09dee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D6CECFD7-677D-4FB9-B70B-55A6FD897DF2"},"incident_date":"2010-11-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e301ba084e44","org_name":"Bluewater Health","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.theobserver.ca/2013/01/28/privacy-breach-at-bluewater-health"}],"summary":"In November 2010, 123 Bluewater Health patients' personal health records were breached by an employee at the West Lambton Community Health Centre, resulting in changes to auditing practices and staff access levels at both organizations.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"de8a15ade688390f643919fa4b42b884aca42514","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"182463A2-8898-4922-B708-CF8F1FF1BB4B"},"incident_date":"2010-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7d2a1b90fe54","org_name":"University of Arkansas for Medical Sciences","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-28","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"92f95ef412a85745aee5972992853927d68dc7e2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"084F33FE-B3DC-4389-9A97-2F40D7276820"},"incident_date":"2010-10-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c2e0aa4a6579","org_name":"SW Seattle Orthopaedic and Sports Medicine","org_type":"healthcare","ransomware":null,"records_affected":9493,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"701028fe6d200b680800d6b988fd8694613bc440","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18ACCA89-6AFF-44AE-8C2C-19B16BD4CC3B"},"incident_date":"2010-10-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3a5458c82aab","org_name":"Keystone/AmeriHealth Mercy Health Plans","org_type":"financial","ransomware":null,"records_affected":808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e80a29e6387306a3f91afcf7fdd00ed6f9d5b722","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"43E5755C-FA9C-4C40-B6B3-4F986085FB81"},"incident_date":"2010-10-26","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"78d178b39bc3","org_name":"Clarksburg--Louis A. Johnson VA Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1470,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fb86f217c9d972aa25316e69852d235901036838","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"330236BB-FA81-45AB-BE23-021B33D73087"},"incident_date":"2010-10-19","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"60a30f9bad0d","org_name":"Johns Hopkins University Applied Physics Laboratory Medical and Dental Insurance Plan","org_type":"professional_services","ransomware":null,"records_affected":692,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7fa23dccc56bde92a5dcd0b6f6f3842fc6ad15d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C7E0BE47-8156-4505-888F-D9DF8E1EB962"},"incident_date":"2010-10-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"058408388bcc","org_name":"WESTMED Medical Group","org_type":"healthcare","ransomware":null,"records_affected":578,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bde4292bd179f1cea3b38ce48554235c4543e037","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5C321E2-F82D-4EAB-9009-33C8666CFED3"},"incident_date":"2010-10-18","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a8d0ba0dce49","org_name":"Utah Department of Health","org_type":"government","ransomware":null,"records_affected":1298,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b451aa091052d03ab95c2ed9be5d6176209ea63","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"288A20BA-801D-4CA9-AEC4-16627F2D9D28"},"incident_date":"2010-10-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b6bbc5db9ac1","org_name":"LoneStar Audiology Group","org_type":"healthcare","ransomware":null,"records_affected":585,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0edd4e86486fbea8022f4376f58d15c1f6a5e662","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB4DA59E-3E47-4960-9361-A5DFEB036D98"},"incident_date":"2010-10-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d79cac78dcbf","org_name":"Cumberland Gastroenterology, P.S.C.","org_type":"healthcare","ransomware":null,"records_affected":2207,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3a43a2d476d337706be7cd9e671f5ccccdce1f4c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF383842-5141-4209-99FE-5B79E98E80D8"},"incident_date":"2010-10-16","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"79571621940c","org_name":"Blue Cross and Blue Shield of Florida","org_type":"financial","ransomware":null,"records_affected":7366,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"195e109c28e2b96766cd602d1fe7336449adb1f3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"601DB840-1A29-42DB-91AC-89BC6BD2D567"},"incident_date":"2010-10-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"63406fa57350","org_name":"Wright Patterson Air Force Base","org_type":"government","ransomware":null,"records_affected":2123,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9b10e01e7393d52ed39b52af48bd59092356e8c3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E6A13F78-DF28-4EEA-A0DD-616EB38D99E4"},"incident_date":"2010-10-07","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1764faa05938","org_name":"UnitedHealth Group","org_type":"financial","ransomware":null,"records_affected":1270,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a1be0809a61eb50cb6311014516a74c6d5a90868","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09E06F34-1AE3-4FF3-A22E-2222C7F516D0"},"incident_date":"2010-10-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3528d7ba3dfb","org_name":"Lorenzo Brown, MD, Inc.","org_type":"healthcare","ransomware":null,"records_affected":928,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b770879a89f6e9686e4ded1919d004590cb39c27","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6BA5FB99-7436-4984-B611-918C8D6928F2"},"incident_date":"2010-10-07","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9aa8bf1d9d46","org_name":"Alliance HealthCare Services, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1474,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"58d058dade1aaf0046e64fd65428bcdc3189630c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3A01611-3A93-4A0E-B519-A3107D574C04"},"incident_date":"2010-10-05","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74e0e48310b6","org_name":"Milton Pathology Associates, PC (Milton Hospital, Inc.)","org_type":"healthcare","ransomware":null,"records_affected":11000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3fcdfa2822ea75d1ba8439e8c2e7df2687262857","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"39941F5D-5D44-4B08-8136-3724EBCC0037"},"incident_date":"2010-10-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"822557e20fa2","org_name":"University of Oklahoma-Tulsa, Neurology Clinic","org_type":"healthcare","ransomware":null,"records_affected":19264,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08a1bc01ad0322745c7c3e63940847aefa89569a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D321429-37CE-4E0B-91AF-5E17317F342E"},"incident_date":"2010-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9bc32f9e6f29","org_name":"State of Alaska, Department of Health and Social Services","org_type":"government","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5a2a0a4715af48aadd6c3f2ee30d8e44129a573f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FDFE1F75-E566-43AF-B988-D2A6EBC46F7F"},"incident_date":"2010-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f44406052bd5","org_name":"St. Vincent Hospital and Health Care Center, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1199,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a0ae53de416555c36e331a895f300b7c7fea422d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E5D535B4-02DA-4032-A7CE-6E8DDCEC5963"},"incident_date":"2010-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a42be55fa1c8","org_name":"St. James Hospital and Health Centers","org_type":"healthcare","ransomware":null,"records_affected":967,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f695c1a4f7895ac4d86c74458e5da5bd292668ac","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7F3783A-8F00-4F8B-87C6-AEBD36616E87"},"incident_date":"2010-10-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b66871e73a82","org_name":"New York Presbyterian Hospital and Columbia University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":6800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.businessinsider.com/new-york-presbyterian-columbia-hipaa-settlement-2014-5"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6dbf99bb9136c94bfde303ec4f1e6c1bd3ba0017","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"508E6A35-FD8A-4E5C-A6DE-803E8B89FAE4"},"incident_date":"2010-10-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"3752b85a4392","org_name":"Ministry of Health","org_type":"government","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.timescolonist.com/news/local/b-c-health-ministry-data-breach-affects-millions-38-000-will-receive-letters-1.47803"}],"summary":"October 2010: Health Ministry data containing the personal health numbers of about 21,000 people - with diagnostic information for about 262 chronic diseases conditions - was shared on a USB stick with a researcher without a request being approved. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7a3ff7177d47e29fddf7e2787e9fb1097ae77848","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F4CF0FC8-80A4-4405-8BFB-A1A9402696B7"},"incident_date":"2010-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bff36a9b34e6","org_name":"Milford Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":19750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ce03fc5d133d669ef32b1e648e2ba297ec10fbd","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F00DFE6-0E05-4E36-A298-8982D2B20AE2"},"incident_date":"2010-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a81aca2ee89","org_name":"Matthew H. Conrad, MD, PA","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0634d223a5733bb8fc2d763df40ad191e36c2bb2","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1B71B98D-AF53-46D7-B8CA-2409B9DB9267"},"incident_date":"2010-10-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"66623b7fbc35","org_name":"Knox Community Hospital","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c97bb6088b75f92d0f836acc4dbc625ef755531a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F0850BA8-F6A4-46CB-A4F5-F71B043F7C7B"},"incident_date":"2010-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4b4bbd1ef48","org_name":"County of Los Angeles","org_type":"government","ransomware":null,"records_affected":33000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-10-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6a4f81164dae99e551a8ba51f8adfba838a2e12","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CCF5F97-74B6-4951-A685-FC18BA8E68FA"},"incident_date":"2010-10-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8d41e2969288","org_name":"Counseling and Psychotherapy of Throggs Neck","org_type":"healthcare","ransomware":null,"records_affected":9000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3ecdf1c94e6642c21b03806ff4b21dde4132b841","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"136124C5-48C3-4A70-B0E6-B121F1D49917"},"incident_date":"2010-09-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6ed295ad59a4","org_name":"University of Massachusetts Health Services","org_type":"healthcare","ransomware":null,"records_affected":942,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9a4f0175ec78dd5f3d98ded0fb5f77749312d73","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"387D3F7D-6F08-40C3-94A5-FE98AFF80125"},"incident_date":"2010-09-28","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df44cf0e95f6","org_name":"Indiana Regional Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1388,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52a80d8b9bbe5ae8d3b80ef7930eccc3f03ecf36","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84A662CF-7C21-45CA-9095-CB601D911642"},"incident_date":"2010-09-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c366b8443f4","org_name":"University of Rochester Medical Center","org_type":"healthcare","ransomware":null,"records_affected":857,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2ab8998bf13f9ed8399c4ddef22029a7e11f63ce","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE0AA6C3-7578-47CA-9850-03D50FC5DEA7"},"incident_date":"2010-09-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"53bb4297124a","org_name":"Ault Chiropractic Center","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"01a14aa4ff30d252d2d9bf6e38750d37b7f5f039","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"57613EFA-09B7-44A7-A9E4-2BE3D06F2132"},"incident_date":"2010-09-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9d6e221dc591","org_name":"State of Delaware Health Plan","org_type":"financial","ransomware":null,"records_affected":22642,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d533011e9462d82543ae4907462087b939485d7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3F48C10-8CC5-46AE-AFB8-49BF3C2F9FA9"},"incident_date":"2010-09-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dc55d736c6b","org_name":"Pediatric and Adult Allergy, PC","org_type":"healthcare","ransomware":null,"records_affected":19222,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c65c45aad8bfcc175e460ec642a28359b7c90ae","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F0CCF06-1DDC-4642-8F9A-9A014E30C523"},"incident_date":"2010-09-20","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8697c54ef6f9","org_name":"Mayo Clinic","org_type":"healthcare","ransomware":null,"records_affected":1740,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bc6c68a0c6908087fd2bab2fcdb419c75cf596a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C22B221C-7DA7-4F5C-854B-B60021EA3563"},"incident_date":"2010-09-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5a11329eef64","org_name":"LabCorp Patient Service Center","org_type":"healthcare","ransomware":null,"records_affected":507,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"afaa10594cfed827b250ea8508271fe5d4a1a580","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"436C83D7-3B38-4AFF-B3DB-05DBBEE6EE2C"},"incident_date":"2010-09-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5c6c76bb44f1","org_name":"Kent Center","org_type":"healthcare","ransomware":null,"records_affected":1361,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"785fe372c04ba996c3dfd00ab3ace72d588d55fc","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EA6A1C8-C1B7-49F0-997E-F6B810D20D44"},"incident_date":"2010-09-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7854c63df89e","org_name":"Curtis R. Bryan, MD","org_type":"healthcare","ransomware":null,"records_affected":2739,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9783c362bff8f4ef16841b497d4557b383971531","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD4695B2-35D0-48ED-BDF6-A938949B75C9"},"incident_date":"2010-09-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b12e47fe4cf","org_name":"SunBridge Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"12da0f83125059f427d2093d6a324bacb892fdf8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"734E58A7-BC86-4979-9E54-3BD354EA1223"},"incident_date":"2010-09-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"94dcb8c74852","org_name":"Saint Barnabas Medical Center","org_type":"healthcare","ransomware":null,"records_affected":3630,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bffc3e226b0bde42731228cfc7643341e7ebfbfa","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85D0408E-963C-434E-A2C2-2E04E1AC7363"},"incident_date":"2010-09-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bcd4a9ee230f","org_name":"NYU School of Medicine Aging and Dementia Clinical Research Center","org_type":"education","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"efc9b8d2fa9bebb0313cc6ee482b0e971d9d3c3f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A1ACFB4F-8B2D-4EDE-9167-F4DA11E5F0E9"},"incident_date":"2010-09-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed30a772df52","org_name":"Newark Beth Israel Medical Center","org_type":"healthcare","ransomware":null,"records_affected":956,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aaaac8350ea062164cb5f2c85e46416f7dbb0433","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FD1C1199-9790-43FD-9CC1-B2A77CB59CE1"},"incident_date":"2010-09-09","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f9be613005c1","org_name":"Stanford University Medical Center","org_type":"healthcare","ransomware":null,"records_affected":19651,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d639cdd99042578ebe3a9d4090a1edea840611b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"29A83DD0-3259-45DC-9B75-8BCCAE5C3B86"},"incident_date":"2010-09-06","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9ce0300cd1a2","org_name":"Vitalit Health Network","org_type":"healthcare","ransomware":null,"records_affected":142,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/vitalit-health-network-informs-patients-of-privacy-breach-1.2549511"}],"summary":"Doctor accessed medical records of 142 patients without authorization.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-09-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e917241dfa1c9e1f0b427e118687ff9bc3cca43","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9CC4A11F-42A6-435A-A35C-846DAD315B74"},"incident_date":"2010-09-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":11,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"An employee found the End of Shift Report for a unit from 09/02/10 when leaving the facility. The report contained eleven patient's names, PHI and partial social security numbers.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"43859c4d51873ca7f56e347ac0c9e47f83ddf47c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4C1BC05B-81AF-4C3C-AA31-96B6A21FE29A"},"incident_date":"2010-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4496dd0a52d","org_name":"US Social Security Administration","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.providencejournal.com/news/courts/20121201-west-warwick-man-faces-charges-of-fraud-identity-theft.ece"}],"summary":"A former Social Security official in Rhode Island has agreed to plead guilty to stealing the identity of a Coventry man to fraudulently sell more than $160,000 worth of the man's stock certificates. He also agreed to plead guilty to not paying $61,999 in taxes.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"329265eea6f56a22bcbf479f64add386fa4157b7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5DD712EE-C7EF-4AE4-9143-C392D291833E"},"incident_date":"2010-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56bce1f777e6","org_name":"University of Kentucky","org_type":"education","ransomware":null,"records_affected":2027,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"UA","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e13ead0bc554597c49e403305ed1e1d2b52e637a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"41523C5D-D6C9-42F8-BF7A-5A13730591F2"},"incident_date":"2010-09-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"abfc137db18f","org_name":"Oregon Hay Products","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/wp-content/uploads/2013/04/Oregon-Hay-v.-Community-Bank.pdf"}],"summary":"Hackers get into company's bank account and make several large wire transfers, draining the account.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dba41342353c9703fb3ff3a4c8115b586e70460c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"267C7D9C-E28F-4007-A8AE-ABF5CC5B29C2"},"incident_date":"2010-09-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0dd6738c3075","org_name":"Holyoke Medical Center","org_type":"healthcare","ransomware":null,"records_affected":24750,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"156aaee5b1311636bfe6bcfac313d917fe9f6365","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0F416FB2-5998-4FF1-959C-BA20E6582B7E"},"incident_date":"2010-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4dc42b185d51","org_name":"Eastmoreland Surgical Clinic","org_type":"healthcare","ransomware":null,"records_affected":4328,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"464888f5a637545ac025995afe14b5fdc34d277e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B8407F30-DDB9-4947-A40D-EDDBEE1348A5"},"incident_date":"2010-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9033131c8c27","org_name":"Cook County Health & Hospitals System","org_type":"healthcare","ransomware":null,"records_affected":7081,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb37ca97c250a30dd6e5f6d8114d714139825c3c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A173DB4D-D6E9-4759-AF08-AA002089C0E8"},"incident_date":"2010-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c5023fa7f1f3","org_name":"Chattanooga Family Practice Associates, PC","org_type":"healthcare","ransomware":null,"records_affected":1711,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"73dedbd4e8a376ea8187723f7a89f7c12da24e26","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3F2CA7E5-4264-4C46-85FC-E1B41D68AC41"},"incident_date":"2010-09-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97954f62a664","org_name":"California Police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://cper.berkeley.edu/journal/online/?p=3011"}],"summary":"Police officer misused priv access ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-09-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1db44cbfe6aa0d72ac801b7edea1b2c7ee1fe945","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E2DBDF80-A3D9-435B-81C8-E005B64C24E5"},"incident_date":"2010-09-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b5c71ccc677e","org_name":"Baylor College of Medicine/Texas Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2010-08-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f430443f9e357d8226d8ca13c850f9890ddb727f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"09d6b4f0-c4ed-11e9-bbcb-6517d645041f"},"incident_date":"2010-08-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"45d9256a466d","org_name":"Dominion National","org_type":"financial","ransomware":null,"records_affected":2960000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.beckershospitalreview.com/cybersecurity/dominion-national-alerts-members-of-9-year-data-breach.html,https://www.delawareonline.com/story/news/2019/06/26/95-000-delawareans-impacted-data-breach-lasted-nine-years/1572753001/,https://kehoelawfirm.com/active-investigations/dominion-national-data-breach,https://healthitsecurity.com/news/insurer-dominion-national-reports-server-hack-that-began-august-2010"}],"summary":"breach due to unknown actions lead to patient data disclosure","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"908aa1e4a00f6fd222077c7977e368ce2c5f439c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"63F5C971-8B48-4D09-8186-57FFBBDFED7D"},"incident_date":"2010-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbdd82904ca4","org_name":"Yale University","org_type":"education","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/yale-university-20110809.pdf"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f419a6b2c06fd05dffb6f0ec78e08816c9f4bdc3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0F1DBCF-C394-4460-B3D4-EF3B47171AA6"},"incident_date":"2010-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1a051833f118","org_name":"Ward A. Morris, DDS","org_type":"healthcare","ransomware":null,"records_affected":2698,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"61347a9895428eedc2a8bcdd47cf9c70c57dd322","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"422136CD-0101-47BC-886A-DC118926EA51"},"incident_date":"2010-08-20","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d70219dd4d3b","org_name":"UNCG Speech and Hearing Center","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"08249620469f208a7386b3c221b728f56f137362","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2843E686-3D2D-49ED-9333-6F645FC040B5"},"incident_date":"2010-08-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5f70cde7b7c7","org_name":"St. John's Mercy Medical Group","org_type":"healthcare","ransomware":null,"records_affected":1907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86702bf8f11808e35cbd175c11f5980f389f2949","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3C0B2BD9-85B0-47C1-8C68-063E0633D5DE"},"incident_date":"2010-08-20","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"90cb96b9decc","org_name":"Penn Treaty Network America Insurance Company","org_type":"financial","ransomware":null,"records_affected":560,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5ca5f785d5b3184c6c8a984193aa1db11af96553","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"833945A7-7D1F-4359-B808-FB58986F8EB4"},"incident_date":"2010-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51204966a7cb","org_name":"Loma Linda University School of Dentistry","org_type":"education","ransomware":null,"records_affected":10100,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad644ac476ef28d0d373c2047b2b8e389632900e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"68CA4F6D-E638-47CC-87A8-19C90AAD2BA0"},"incident_date":"2010-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3584af3ae575","org_name":"Idaho Power Group Health Plan","org_type":"financial","ransomware":null,"records_affected":5500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d2f66729cbb4a41fa4e89f52865940ce80e7ea4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE749AA7-40BF-4553-8F1D-211D5A0E1608"},"incident_date":"2010-08-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7a568348eb53","org_name":"Aultman Hospital","org_type":"healthcare","ransomware":null,"records_affected":13867,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8095cc791a134b4fe194b4d7a2481b4e391a2aad","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E8B2BC7-C238-40FC-9F2F-46ABD23ABD98"},"incident_date":"2010-08-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ded0a244074","org_name":"Wright State Physicians","org_type":"other","ransomware":null,"records_affected":1309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"74dfa8092007d90317fa2ab2e87df361cca1060a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0468A98A-CDBD-47B2-899F-4BEFA6776808"},"incident_date":"2010-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"49c75c6e3120","org_name":"Walsh Pharmacy","org_type":"retail_ecommerce","ransomware":null,"records_affected":11440,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1daa6a2db060bcb8990557b01a9a7aa954462e5f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2E40EE9D-8DF5-460A-B295-A2BA716AB673"},"incident_date":"2010-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"547f395ea00d","org_name":"Thomas Jefferson University Hospitals, Inc.","org_type":"healthcare","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2816e13e766776361da5709e7409b7042cb6ede7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB73F853-3113-4A91-8FA3-F886A3B8EAD7"},"incident_date":"2010-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7dc8292a583c","org_name":"Jewish Hospital","org_type":"healthcare","ransomware":null,"records_affected":2089,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5212463df3861b056c80b4f70f3a94e83738b5a4","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F11C172A-CACA-4955-80B2-92C551725EBE"},"incident_date":"2010-08-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cbe20ad5a38f","org_name":"Humana Inc.","org_type":"financial","ransomware":null,"records_affected":2631,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a78d8e3b2032a62451f3e30f75c5919504c09520","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"478B5B58-3F70-447D-BDCE-3FFA984F79B1"},"incident_date":"2010-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fbc5ab9a1d40","org_name":"Fort Worth Allergy and Asthma Associates","org_type":"healthcare","ransomware":null,"records_affected":25000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0fd4ccc5e3db188761bf423777a6845182c53a29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"56074026-1981-4B1B-B422-71DD74451E8C"},"incident_date":"2010-08-18","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a7588bf94f64","org_name":"Carolina Center for Development and Rehabilitation","org_type":"healthcare","ransomware":null,"records_affected":1590,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a236c664fc6a1af40d9182030921044da7b6952f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CAF7F42E-C8BE-4BB6-821B-790355D4DC4D"},"incident_date":"2010-08-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"854d2aba2249","org_name":"Beauty Dental, Inc.","org_type":"healthcare","ransomware":null,"records_affected":657,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d921669c689b67bbe9efb74991f35c88dcf387d0","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ABB7CDF4-8F13-4045-B993-43144C2DD06E"},"incident_date":"2010-08-07","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"IE","org_id":"8ead23d0a9dd","org_name":"Cavan Monaghan General Hospital","org_type":"healthcare","ransomware":null,"records_affected":300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.irishtimes.com/newspaper/ireland/2013/0212/1224329951036.html"}],"summary":"A doctor has been found guilty of serious professional misconduct after up to 300 medical records of 32 patients were discovered dumped on open ground. The patient records from the Cavan Monaghan General Hospital group were found on waste ground in black bags, after they were fir","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"686d32bdf81af2df3cd52e3e3c67ef8e64e87ade","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ADB1C36-E8BF-43D3-A99F-F7F896DFFD21"},"incident_date":"2010-08-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dab2adc4441a","org_name":"WellPoint, Inc.","org_type":"financial","ransomware":null,"records_affected":31700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"59032f3e1210ba5f1d6bfe8852cf73ad7bdd29f2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"73B93DBA-E470-4CD9-8ABE-B5C4CE57B5D9"},"incident_date":"2010-08-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ddb3978d965","org_name":"Montefiore Medical Center","org_type":"healthcare","ransomware":null,"records_affected":23753,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"046e964554aa686664818dfb78da68706d37022b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"60C7FF53-0B9F-478C-8C05-BD00A42AE832"},"incident_date":"2010-08-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51715032db7e","org_name":"DC Chartered Health Plan, Inc.","org_type":"financial","ransomware":null,"records_affected":540,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"573bf88083a03e00de1afff636151bc33d00185a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C44C3AC1-BB42-4B16-8FB3-D3F67D0A6E5D"},"incident_date":"2010-08-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0ccd1fa2561c","org_name":"University of Texas at Arlington","org_type":"education","ransomware":null,"records_affected":27000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b2f1cef6e38e422ddc797552b44aada6c385651","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"27E2DAFF-B1FD-4DF4-A8F8-323ADEF9A45E"},"incident_date":"2010-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1764faa05938","org_name":"UnitedHealth Group","org_type":"financial","ransomware":null,"records_affected":735,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"eeb8067fe50ee455f5e65a69d98a41991ceb8720","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9EC46077-B724-4534-854B-823D016EE229"},"incident_date":"2010-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff50d02eb6d1","org_name":"Trinity Health Corporation Welfare Benefit Plan","org_type":"professional_services","ransomware":null,"records_affected":1073,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f4cd82f30777c70717359805128619b0a696cdb3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A28F4B10-132B-4B60-9EBA-EC56C55BB40F"},"incident_date":"2010-08-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"995b0a1ccc9b","org_name":"Charles Mitchell, MD","org_type":"healthcare","ransomware":null,"records_affected":6873,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-08-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2f8115b231dd76f3029032ca12db7fd19debaad","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A44B06FA-0E54-48A2-8D58-335280E3FFC4"},"incident_date":"2010-08-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7173dff8cad1","org_name":"Central Brooklyn Medical Group, PC/Preferred Health Partners","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial"],"disclosed_date":"2010-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cab62cfa4e3eb0cca25e0884012893391bda52ca","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BAFDF3C9-B815-4F3A-AE50-DB4DC4ACC08D"},"incident_date":"2010-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a5a451d68d22","org_name":"Galleria Woods senior living center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.credit.com/2015/04/senior-center-resident-reportedly-lost-335k-in-id-theft-scam-114789/"}],"summary":"An Alabama woman has reportedly agreed to plead guilty to identity theft and bank fraud charges for a scheme in which she stole more than $300,000 from an elderly resident at the senior center where she was employed. Shostocka Keya Ward, 43, of Vestavia Hills, used the resident's","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-08-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"72b8a9a6225338bc5f4bd5e1d546510abb181b7a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4B1B9992-947F-4CF2-A5C3-FE7222D378D1"},"incident_date":"2010-08-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e1f6cba86bbd","org_name":"Elgin Police Department","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mystateline.com/story/stockton-police-chief-arrested-for-identity-theft-stemming-from-love-triangle/d/story/DkORURAPW0OYNgKUyAw-ew"}],"summary":"Police sergeant misuses departmental assets to acquire information on another officer's finances that were provided to the said officer's wife (also a cop) during a divorce settlement.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"low","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal","financial"],"disclosed_date":"2010-08-01","discovered_date":"2012-12-13","entry_asset":"web_application","evidence_level":"org_confirmed","extracted_by":{"model":"openai:gpt-6-luna","prompt_version":"v4","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"810e26d98c4ed22dbfec6127bf9831d7bf1fea4e","impact_type":"exposure_no_theft_confirmed","incident_date":"2010-08-01","initial_access":"unknown","initial_access_attack_id":null,"letter":{"date":"2026-10-10","outcome":"extracted","url":"https://oag.ca.gov/system/files/Centric_Consumer_Notification_Letter_0.pdf"},"notes":null,"org_country":"US","org_id":"e05d9b94b288","org_name":"Centric Group LLC","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"California AG data breach report","type":"state_ag","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-37742"},{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/centric-group-20130109.pdf"},{"fetched_at":null,"title":"Notification letter","type":"state_ag","url":"https://oag.ca.gov/system/files/Centric_Consumer_Notification_Letter_0.pdf"}],"summary":"Centric Group reported that credit and debit card information provided on its AccessCatalog website may have been accessed without authorization beginning in August 2010.","supporting_quote":null,"technology_involved":["AccessCatalog website"],"third_party":{"archetype":null,"involved":null,"vendor":null},"updated_at":"2026-10-10","veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2010-07-31","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9e1b4de607e3abef275552740e9f0c65a5a2dad2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D69AE3A-8DB3-45C2-B1CE-E0ACD74A6540"},"incident_date":"2010-07-31","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b1186d51b8e7","org_name":"WorldPass","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://doj.nh.gov/consumer/security-breaches/documents/worldpass-20120327.pdf"}],"summary":"around March 5, 2012 we learn through our IT administrator that we were the victim of cyber attacks by someone who gained unauthorized access to parts of our internal network and data systems.  the cyber attacks may have begun as early as July 2010. The database unlawfully access","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6c9bc0aea539e648a40b1550e7fefbc85ac216a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0963BDE2-2BAC-44AD-AC80-66B519A3E48C"},"incident_date":"2010-07-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2b443531c0e0","org_name":"Texas Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":694,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf"}],"summary":"Laptop theft exposes 694 records.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"53a068a0e54d6497d6c1b5bfc560549e694c932a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8056FC2C-07B1-4349-9F6A-9101D116F87B"},"incident_date":"2010-07-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"84d5fa2ec553","org_name":"Medina County OB/GYN Associates, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-07-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1b82349e21e2c4e6bc3e5d24cb5a82486b8efeec","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4A35D1FF-E685-4ED9-852F-83D53FB099D0"},"incident_date":"2010-07-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cd9893711f8b","org_name":"Aetna","org_type":"financial","ransomware":null,"records_affected":6372,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"25d2e137f0180c16500f0dc5199cfc49af184064","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E098D7B-7E22-45FA-BF97-15724C1DDC03"},"incident_date":"2010-07-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7462c6a0d771","org_name":"John Deere Health Benefit Plan for Wage Employees","org_type":"financial","ransomware":null,"records_affected":1097,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"116a39a027030f2abab89c787a97484c5105cdfb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E057515-371F-419B-B851-708112B0F9A3"},"incident_date":"2010-07-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9fb3e073ea6b","org_name":"Department of Health Care Policy & Financing","org_type":"government","ransomware":null,"records_affected":105470,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4307a564f2a99cb3855ae0717138eb7b1f7ddede","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D4D1D6F-2875-495E-998A-D294F000F2EF"},"incident_date":"2010-07-21","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a941076563e3","org_name":"University of Louisville Research Foundations, Inc.","org_type":"education","ransomware":null,"records_affected":708,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d740c98424d5000c191712f1e3f662ca6554701","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1DDF9D10-2EC2-402D-B40D-F9D19DE8F528"},"incident_date":"2010-07-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"03be561fbf4c","org_name":"South Shore Medical Center","org_type":"healthcare","ransomware":null,"records_affected":800000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.idtheftcenter.org/artman2/publish/lib_survey/ITRC_2008_Breach_List.shtml"}],"summary":"South Shore Hospital hired a contractor to destroy files no longer in use and lost the shipment. The back-up computer files possibly contained names, addresses, phone numbers, dates of birth, Social Security numbers, driver’s license numbers, medical record numbers, patient numbe","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-21","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1152060d68c5cec78baa089b66ba1777d244159b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8820F328-B96E-4222-8C1D-9E44324AC814"},"incident_date":"2010-07-21","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0a3f0ed82156","org_name":"Prince William County Community Services","org_type":"healthcare","ransomware":null,"records_affected":669,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-07-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b18010605a0974b08e1d4fc98f894c8b99c81a9d","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D0972751-066D-4861-8D2E-2E18BFD0B714"},"incident_date":"2010-07-20","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":3,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"The CBOC sends out specimens, (labeled) and a sheet goes along with it. The sheet would have a lab sticker with patients name and social security number. It left the clinic with the courier but did not make it to the destination with the specimens when the courier delivered the s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8705bfc4d552afbc5e6f985192af131fe34c2d67","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BCE2AEC0-34CC-4833-B24D-24FFF954F871"},"incident_date":"2010-07-19","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae6c8c78be79","org_name":"Wilkins E. Brooks Family Medicine, PA","org_type":"healthcare","ransomware":null,"records_affected":13000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3557efb7cf29269c1d060c0e12da48254ad6dba0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D1AA9A90-65A2-4CD5-B5BF-E1D074A6C499"},"incident_date":"2010-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4dd8fd57107","org_name":"NYU Hospital Center","org_type":"healthcare","ransomware":null,"records_affected":2563,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"556fb10bf11e5c10ef5ec6cc641fd26643d1d482","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA650815-C10F-4AAF-9FE8-2AD4D21570E0"},"incident_date":"2010-07-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"842b2d25f70e","org_name":"Long Island Consultation Center","org_type":"healthcare","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6591744f2271aa7e400c6251db75b61944d32f9f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EB622F8D-F092-4466-A3E4-C0DA5C20A246"},"incident_date":"2010-07-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce7f5f7f6e2f","org_name":"University of Florida","org_type":"education","ransomware":null,"records_affected":2047,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"50335224f214160971db8a6d173c0fa1c64e17b3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC733FDB-0A89-41BF-9FCC-FA2F4E586602"},"incident_date":"2010-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95954d41fda8","org_name":"University Hospital","org_type":"healthcare","ransomware":null,"records_affected":14000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d5b28961f98d80f2f02a83db8d63ae5fab525453","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3B0349DE-7AD0-4B80-BD23-966CA05E3280"},"incident_date":"2010-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3b12e47fe4cf","org_name":"SunBridge Healthcare Corporation","org_type":"healthcare","ransomware":null,"records_affected":3830,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0478e48159f08693bcb4641a0603c99fc443bf4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A02C34D3-5B25-411E-BBDA-05ED5F676DF6"},"incident_date":"2010-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"caa0a0337be1","org_name":"Centerstone","org_type":"healthcare","ransomware":null,"records_affected":1537,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"738d6899b3ae7b4bc6586e8c1f272609e297bd56","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"716477BE-41AA-4EE3-9596-AA38C2811DA3"},"incident_date":"2010-07-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"21a64db932cb","org_name":"California Department of Healthcare Services","org_type":"government","ransomware":null,"records_affected":29808,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d6583b4bcb743885b7db81083c34e50999d785d5","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E212E7FC-BF72-42F7-A78D-B21BD581E83E"},"incident_date":"2010-07-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0e3276bacaec","org_name":"DeKalb Medical Center, Inc. d/b/a DeKalb Medical Hillandale","org_type":"healthcare","ransomware":null,"records_affected":7500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"919af12a9afc52eec3ec5d851267187be21ca07a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BBEC3496-5276-4933-8796-218E8C6400E7"},"incident_date":"2010-07-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"15ec5fbe4a14","org_name":"Alma Aguado, MD PA","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f7d4920072afc60bdba5f799e7616820628409a1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F383972B-7244-465A-B1BC-A36BEF2B2C29"},"incident_date":"2010-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0f441bd38b0","org_name":"University Health System","org_type":"education","ransomware":null,"records_affected":7526,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5055c220a6e955ed4996b2796067a581f82e5a29","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4F43990C-EE45-4BF3-B7B5-B4476A882D4C"},"incident_date":"2010-07-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8c9f100ea281","org_name":"Sinai Hospital of Baltimore, Inc.","org_type":"healthcare","ransomware":null,"records_affected":937,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d892b76f9e5a4f54979c283713d1b41131f0447a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"97A4896D-D9B3-4B0E-96EF-473258E257FB"},"incident_date":"2010-07-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c21e56735080","org_name":"Mary M. Desch, MD","org_type":"healthcare","ransomware":null,"records_affected":5893,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-07-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dd88eae7099a360f1c876e2faae0231a68b67861","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9C744D94-C3EA-4E97-9965-7CD73BD50585"},"incident_date":"2010-07-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ca6cd87e9b29","org_name":"Children's Hospital & Research Center at Oakland","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b0c4de3130c96f315d3064f1e48ccbbf07278e3f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"915622F7-7383-4154-9819-61BF9302A674"},"incident_date":"2010-06-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran A received Veteran B's medical information. Veteran B requested a copy of the medical records be mailed to the home and it was sent to the wrong veteran with the same name. The information included name, address, and full social security number, along with other medical i","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d0bdd518ce02c2e6d5dcabc880e3186c5401b93","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"05A40554-4D38-4C88-8F7F-BEF62E0375C6"},"incident_date":"2010-06-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d30aa04c6ecc","org_name":"Lincoln Medical and Mental Health Center","org_type":"healthcare","ransomware":null,"records_affected":130495,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e9f13da26421ea8496261579369cc7edc1998b0d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84D8DA94-EFDA-436E-AE30-4F38BA29329D"},"incident_date":"2010-06-29","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f4ff9eaac195","org_name":"Comprehensive Care Management Corporation","org_type":"other","ransomware":null,"records_affected":1020,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"96ca1e19c007cc08a39d02ad853866613345f189","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50510AC2-EA43-473A-BE08-8D18D385B44B"},"incident_date":"2010-06-26","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a0a19535887f","org_name":"Children's Medical Center of Dayton","org_type":"healthcare","ransomware":null,"records_affected":1001,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2c1e530ec082c6aee8ee6858a2e0bb45c466d702","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"703E6593-E90B-4811-BA22-FBBB884706EA"},"incident_date":"2010-06-25","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"83c8aa4172ec","org_name":"TRICARE Management Activity","org_type":"government","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f9a1a05f03754a7c23ba46b827c56eb4d57de274","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4747399D-A83D-4C91-8798-1BBD2136495F"},"incident_date":"2010-06-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"62b806ebe6d7","org_name":"TennCare","org_type":"healthcare","ransomware":null,"records_affected":10515,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-11","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dada9b21c36550c75cb6e42b6e6a01d65a2a7850","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CC5E5B26-62A1-42C5-9C12-FC25F4267271"},"incident_date":"2010-06-11","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"edc16e2e78e8","org_name":"Occupational Health Partners","org_type":"healthcare","ransomware":null,"records_affected":1105,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a8c864ea904d7bff4a0372e85ea58db33d872cea","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"81EF3489-9198-4BC0-99EB-EFAA8FBE7E7B"},"incident_date":"2010-06-10","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cb2d79539168","org_name":"St. Jude Children's Research Hospital","org_type":"healthcare","ransomware":null,"records_affected":1745,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5cd2406d90169a9d28708d14729d639cbc506262","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"13EB66CA-A1AF-4BAC-B83B-CF56F2435649"},"incident_date":"2010-06-09","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1764faa05938","org_name":"UnitedHealth Group","org_type":"financial","ransomware":null,"records_affected":16291,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c0538887b877c306758023891cf4798af141fb6f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3DF514E1-694D-4332-AFF9-8A7B5986EE3E"},"incident_date":"2010-06-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d21f6b46145","org_name":"Nihal Saran, MD","org_type":"healthcare","ransomware":null,"records_affected":2300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"33ddaf41cbb375cb46bf59a299726ab0178f9bf1","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2F1517E1-41C7-450C-8894-6D727B815C58"},"incident_date":"2010-06-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9e51201525dc","org_name":"Omaha Construction Industry Health and Welfare Plan","org_type":"financial","ransomware":null,"records_affected":800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"15fdb12a51c2742fa2f7c3e05c1a76c0ea151cdd","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3CCF0BF0-EC5D-4F41-B2A2-29EA741FBA4B"},"incident_date":"2010-06-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"95704762b054","org_name":"AvMed, Inc.","org_type":"financial","ransomware":null,"records_affected":1220000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mainjustice.com/2013/09/05/settlement-reached-in-healthcare-data-breach-lawsuit/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.topclassactions.com/lawsuit-settlements/lawsuit-news/5201-avmed-agrees-to-3m-health-data-breach-class-action-settlement"}],"summary":"The company has settled a class action lawsuit without admitting guilt after the theft of two laptops containing sensitive information on 1.2 million patients.  Subsequent fraudulent use of the data has been confirmed as part of the lawsuit by customers of the company. The settle","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"477743a329f1d13fad0f5a6dd034e6684cd3e9a2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EFE5232B-18E8-4BC0-BD05-0043CC6F70B4"},"incident_date":"2010-06-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6f59ae3276a2","org_name":"Rainbow Hospice and Palliative Care","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"811db60fa39340b0053722f173fca6949eae011b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B49B813A-ADB0-4B91-87C0-4DCCA192EB8E"},"incident_date":"2010-06-03","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"a5973a3eed04","org_name":"Peterborough Regional Health Centre","org_type":"healthcare","ransomware":null,"records_affected":201,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newz4u.net/anti-abolition-leader-fired-in-wake-of-privacy-breach/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://full-timewhistle.com/health-5/anti-abortion-activist-snooped-into-patient-records-3732.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://metronews.ca/news/canada/1266934/anti-abortion-activist-snooped-into-414-abortion-files-while-working-at-peterborough-hospital/"}],"summary":"An Ontario woman, who is an anti-abortion activist, was one of seven accused and fired for a privacy breach where almost 300 patient medical records were accessed without authorization at an Ontario hospital that performs abortions. There is a lot at stake for Ontarians with the ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e6cec55e9d360b59bc5503dfafbd4d5324ebb5ae","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"95E11D9F-38D8-4BF0-B39C-13C12988CA9E"},"incident_date":"2010-06-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"399273cde9e2","org_name":"City of Charlotte Health Plan","org_type":"financial","ransomware":null,"records_affected":5220,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-03","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6885127f7d51eb0b25c457d10831885ab0e64215","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"4BDD4E32-D6A0-4DE2-B103-0271D66EE441"},"incident_date":"2010-06-03","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f454dc1cd5b1","org_name":"Cincinnati Children's Hospital Medical Center","org_type":"healthcare","ransomware":null,"records_affected":60998,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-06-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"668d00038135debfb3b3c00e77bcb5c582df35de","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2D149236-27DD-421C-B22F-332B3022987D"},"incident_date":"2010-06-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"33db5d616e49","org_name":"Goldthwait Associates","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bostonglobe.com/lifestyle/health-wellness/2013/01/07/doctors-billing-company-pay-penalty-for-records-tossed-public-dump/TID36TNbXa9Amx2aFbjCBK/story.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.boston.com/news/health/articles/2010/08/13/mass_hospitals_investigate_exposure_of_records/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareinfosecurity.com/state-settles-hipaa-case-for-140000-a-5411"}],"summary":"The former owners of a medical billing practice that dumped sensitive health _records at the Georgetown Transfer Station have agreed, along with doctors involved, to pay $140,000 in a settlement with the Massachusetts attorney generals office.  A Globe photographer _noticed the p","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b592fe75d3177cb2871f6a8c962a7640f4305c0d","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1BFDF555-06E9-456F-9753-ACE437A354B5"},"incident_date":"2010-05-28","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3c366b8443f4","org_name":"University of Rochester Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2628,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d21c465277fd197528508701fd4bf565f6e9ab0","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F83273F6-1061-4678-BA2B-ED15AD9D92BA"},"incident_date":"2010-05-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e16e7b5b7dfb","org_name":"Oconee Physician Practices","org_type":"healthcare","ransomware":null,"records_affected":653,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-25","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"aae7f33b3d6f9250e21ab69752a9b72b38782c5e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F00664BB-3620-4DCE-9F69-A7F5738098D9"},"incident_date":"2010-05-25","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"171002bce041","org_name":"VA North Texas Health Care System","org_type":"healthcare","ransomware":null,"records_affected":4083,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b31752618fa044f5b8a9f5116b9bba6b99f46c80","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0522392F-DDB4-4976-B3F5-2D6E48F3B8C6"},"incident_date":"2010-05-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"b45f398683dd","org_name":"Regina Qu'Appelle Regional Health Authority","org_type":"healthcare","ransomware":null,"records_affected":15,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.leaderpost.com/health/RQRHA+adequately+protect+health+information/8066232/story.html"}],"summary":"The Regina Qu'Appelle Regional Health Authority (RQRHA) failed to follow provisions of the Health Information Protection Act (HIPA) in a 2010 privacy breach, according to Saskatchewan's Information and Privacy Commissioner.  Gary Dickson's office began an investigation into the R","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"27d12c561892ff5310e2fc7f6ca0f338c8681a86","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB83DFBD-AE12-429F-B98E-81749A7D95D6"},"incident_date":"2010-05-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"02723d1ce147","org_name":"Veterans Health Administration","org_type":"government","ransomware":null,"records_affected":656,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fa506b7afab2a97603b817bbfd376477ed2e8d7d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"16667D1B-1E0E-459A-B052-CA4AF9BCB085"},"incident_date":"2010-05-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"39bb41677e15","org_name":"State of New Mexico Human Services Department","org_type":"government","ransomware":null,"records_affected":9600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"124dac7728e9aa182027e03b1d336b15993bb885","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8A68F804-06E7-403A-9D02-990F659ABCA0"},"incident_date":"2010-05-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"226d724ec622","org_name":"Rockbridge Area Community Services","org_type":"healthcare","ransomware":null,"records_affected":500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-19","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7b9404e1765ca28101f53d05cee5ada06c00da2c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B78658A4-05B1-4065-88E9-9EEA26A32840"},"incident_date":"2010-05-19","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a9457556c9fa","org_name":"Georgetown University Hospital","org_type":"healthcare","ransomware":null,"records_affected":2416,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-18","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c214c5dea3f342ac14e06b41f9ac9908508525fb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FBCEAEF4-DC51-4496-BC0C-4265639AE451"},"incident_date":"2010-05-18","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bbb901362196","org_name":"Heriberto Rodriguez-Ayala, MD","org_type":"healthcare","ransomware":null,"records_affected":4200,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f51fff684e4faa6d3f1c169b5d39378c0ecaa2f6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"646A08FD-0067-43D8-AE69-B19B1E706CCA"},"incident_date":"2010-05-17","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"b7c2f5a8b44b","org_name":"VA Eastern Colorado Health Care System","org_type":"healthcare","ransomware":null,"records_affected":649,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c89e4f7acc2260e56f8b85b78ea0f3d0cf8321ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52152E4A-33F8-4998-BDEB-BF7AC9E0FAFB"},"incident_date":"2010-05-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0c3471137d0e","org_name":"Silicon Valley Eye Care Optometry and Contact Lenses","org_type":"healthcare","ransomware":null,"records_affected":40000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-17","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"701cdfab620c1a9786bbb347ec54983fcc20d6c2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ED48DAF1-98E6-45B6-8A9D-DCD41B1394EC"},"incident_date":"2010-05-17","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f37107a1a3f7","org_name":"Loma Linda University Health Care","org_type":"healthcare","ransomware":null,"records_affected":584,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-13","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"688b6505eb1d99b7cbb53b8831195832be2a9c80","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3A04ABB-41F8-42A1-8343-36E402B06C66"},"incident_date":"2010-05-13","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e404fa434b48","org_name":"Miami VA Healthcare System","org_type":"healthcare","ransomware":null,"records_affected":568,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"91dddf05f4dfe0a5a4106a8387ace761092c90e3","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C19049B3-9D99-44F7-8AB1-FD56013D59FA"},"incident_date":"2010-05-12","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4ac8ea243a8","org_name":"South Texas Veterans Health Care System","org_type":"healthcare","ransomware":null,"records_affected":1430,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-05-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"911c84a646cbf32a2d9b16d5134e43e735bbf397","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FB2EF559-F00E-42D5-804D-1A516DE2B4A1"},"incident_date":"2010-05-10","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"t time of discharge Patient A was given Patient B discharge summary which Patient A took to the Pharmacy as instructed. The Pharmacist briefed Patient A about Patient B medicine and order medicine. When patient A reported to the window to pick-up prescription he handed the discha","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7021900830b69ed2c1a94898977e857ae6394544","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"255563D0-5AE7-4F50-B98F-C7EC3AFA5DDD"},"incident_date":"2010-05-06","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"55c5b716a0f7","org_name":"Pediatric Sports and Spine Associates","org_type":"healthcare","ransomware":null,"records_affected":955,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2e56bce06eec2a40583fb68f49cc4a95cb17772a","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B0FEF7B-272A-42D5-8AD4-63C08491389D"},"incident_date":"2010-05-06","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"778bee2f4151","org_name":"Centro de Ortodoncia","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"436acf4b91c1d22142162244dff66956fe10d51a","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F14F4C68-FA1B-4C9E-8C75-BDBE7F114594"},"incident_date":"2010-05-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7392919e8b05","org_name":"General Agencies Welfare Benefits Program","org_type":"financial","ransomware":null,"records_affected":1874,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-05","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f03405f99be4bdd7f69580f55c0c8317acb45226","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"219548AC-9E5D-4819-9644-1676C7E6534B"},"incident_date":"2010-05-05","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ce8c9b82ba29","org_name":"Emergency Healthcare Physicians, Ltd.","org_type":"healthcare","ransomware":null,"records_affected":180111,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"79a5744a90a246103dc6a2e4a1300767c537ca8b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2C2FCD20-4725-41A1-AE05-1CFDE3A029A3"},"incident_date":"2010-05-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cfdcb968f254","org_name":"South Carolina Department of Health and Environmental Control","org_type":"government","ransomware":null,"records_affected":2850,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d1321e242858585e0fbcea73955679ee8009161","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"08E55D23-765B-436A-BB58-FFCE829C9B6D"},"incident_date":"2010-05-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"8b96063248aa","org_name":"Praxair Healthcare Services, Inc.","org_type":"other","ransomware":null,"records_affected":54165,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c1dff58eb2ddc55564754e91c42116d6ade6d2d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECA12F58-D667-417C-A3F4-9396F37C05C1"},"incident_date":"2010-05-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3e830601386f","org_name":"Our Lady of Peace Hospital","org_type":"healthcare","ransomware":null,"records_affected":24600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5eb157021919101e740ac461e38e41d08627117d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA464FE7-9027-44DB-B5A4-0658751DA115"},"incident_date":"2010-05-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d1429695060f","org_name":"Medical Center at Bowling Green","org_type":"healthcare","ransomware":null,"records_affected":5418,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8b50e7424f3c365410e8556a76ddd613b989cd67","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"03B94103-B239-4093-80CB-AC9430E6CE8F"},"incident_date":"2010-05-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aba1c72f4bf4","org_name":"Massachusetts Eye and Ear Infirmary","org_type":"healthcare","ransomware":null,"records_affected":3621,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-05-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6f330a1bde8ac7eaf72d74f99123333449d5616e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"005C42A3-3FE8-47B5-866B-AFBB5E3F5B95"},"incident_date":"2010-05-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f2488bec0a59","org_name":"Blue Cross and Blue Shield of Rhode Island","org_type":"financial","ransomware":null,"records_affected":12000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2010-05-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"031f7534cb90ac488bd3c9cfb54e008cde2b5436","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"740B3135-2862-4F91-90CF-172B77078678"},"incident_date":"2010-05-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0004feca279f","org_name":"Purdue University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ehackingnews.com/2014/01/former-purdue-university-students-plead.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://news.softpedia.com/news/Former-Purdue-University-Student-Sentenced-to-90-Days-in-Prison-for-Changing-Grades-430041.shtml"}],"summary":"Purdue students used a hardware keylogger on professors computer to obtain credentials.  They used the credentials to change their own grades.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-30","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"60292b41a0666ceca8abaf8df757df222d42b766","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"057D4B76-8BEE-4BE1-B81B-3C9D795D386F"},"incident_date":"2010-04-30","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a76cab21c072","org_name":"St. Joseph Heritage Healthcare","org_type":"healthcare","ransomware":null,"records_affected":22012,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-29","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d23e4ebae92fa35d6f45de1e15a56a94dd9a031f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11544B18-1A8E-4CF2-9389-38A5DC70E45D"},"incident_date":"2010-04-29","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fa16eaf8fd0f","org_name":"Beatrice Community Hospital and Health Center","org_type":"healthcare","ransomware":null,"records_affected":660,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df2f241b05894085ebe284855e77be6cfee48b2b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6518041B-EA5D-41DC-96CB-A869FB84FFD7"},"incident_date":"2010-04-27","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7940ba924394","org_name":"Affinity Health Plan, Inc.","org_type":"government","ransomware":null,"records_affected":344579,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-26","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"da740dacd1cc7c660abe39fa498d976a66f339a6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"52942CCF-A5B4-4A75-B56D-F48D801ED490"},"incident_date":"2010-04-26","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"72fa3d1d9b40","org_name":"Tomah Memorial Hospital","org_type":"healthcare","ransomware":null,"records_affected":600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cc7880674b5dd92a4976fef396c72fe869e2b7b","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"8E907DB4-5AE4-43BD-B6EE-9207ACD03E4F"},"incident_date":"2010-04-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"362fc00d79d5","org_name":"Texas Health Harris Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":9922,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"187cf9639e7512af712cc909531903b60133821e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"75E49A4C-C0D9-4CD9-AFED-668868804830"},"incident_date":"2010-04-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran B was given 3 different prescriptions of 7 day supply each that belonged to Veteran A. The pharmacy personnel who dispensed did not recall any unusual event at the time. Veteran B was called in to pharmacy to identify the signature, but he was not able to do so. The infor","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-20","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"37b030e0e617460c67996ea0c69c4d86a8979f82","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"99BF8711-737F-460B-B6A7-63057031394A"},"incident_date":"2010-04-20","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ff2edb4c056b","org_name":"Reliant Rehabilitation Hospital North Houston","org_type":"healthcare","ransomware":null,"records_affected":763,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bc50b0c176b74849985ae69513f3014ee5430b87","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0BE266E9-F18E-4DDC-AC1C-346090406B45"},"incident_date":"2010-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"cdc6199a5b6d","org_name":"VHS Genesis Lab Inc.","org_type":"healthcare","ransomware":null,"records_affected":6800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1cc8fe1844dddc0bdfb020b0e616ce21dd24e846","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A03C063F-4447-4E11-B32F-E8650CB7A31B"},"incident_date":"2010-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6368945bbb5","org_name":"University of Pittsburgh Student Health Center","org_type":"healthcare","ransomware":null,"records_affected":8000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"regulator_filing","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9ab4902199862b81db18d73f1d45b83d58f6c6a9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD6DC73D-C581-483A-BE46-900698A3757F"},"incident_date":"2010-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d4eb9b17b64d","org_name":"Providence Hospital","org_type":"healthcare","ransomware":null,"records_affected":83945,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"hhs_portal","url":"http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-15","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ef71b61abb220623ee8e7d623db29260a27a8eb8","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"392E7C46-6993-45D8-9EFF-30E034B3BA6C"},"incident_date":"2010-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3f59390a4b92","org_name":"John Muir Physician Network","org_type":"healthcare","ransomware":null,"records_affected":5450,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d35fb3cb338e919299ac3475a510d63ddbf4fda","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A723B1AD-7341-466A-A8CC-3BBCE7493EE8"},"incident_date":"2010-04-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f8469aa29c37","org_name":"Mount Sinai Medical Center","org_type":"healthcare","ransomware":null,"records_affected":2600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"804e4787cf02c9b167fcad3e12995aaa3f526e37","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FF324193-1132-4B42-86D7-0082C6E07354"},"incident_date":"2010-04-12","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"365caf7ff8c6","org_name":"Hypertension, Nephrology, Dialysis and Transplantation, PC","org_type":"healthcare","ransomware":null,"records_affected":2024,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-12","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a671220a06e7d77a28280a09f178b954ba644d65","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"58782940-5E96-4CE2-BAD6-A5F41BEA655B"},"incident_date":"2010-04-12","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4f1d2656e4be","org_name":"Griffin Hospital","org_type":"healthcare","ransomware":null,"records_affected":957,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-04-10","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1653f31d8ba3f647bc615b0e18fecf862d943cea","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E27E2419-B286-4167-B4C7-2AEF523026BC"},"incident_date":"2010-04-10","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"56f393691fe5","org_name":"Westminster Police Department","org_type":"government","ransomware":null,"records_affected":96,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ocregister.com/articles/arganda-240231-westminster-violence.html;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.eff.org/deeplinks/2015/11/misuse-rampant-oversight-lacking-californias-law-enforcement-network"}],"summary":"Police officer uses database inappropriately","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-04-07","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"010f0285423ce9183814b0cf7221c3eb9ca79a46","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"2B6947F8-AFFA-41D2-9140-CC67CCC2FC9A"},"incident_date":"2010-04-07","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2c938de6db39","org_name":"Cignet Health Center","org_type":"financial","ransomware":null,"records_affected":4500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.amednews.com/article/20110307/business/303079963/6/"}],"summary":"For the first time, the U.S. Dept. of Health and Human Services has levied a civil monetary penalty for a violation of the privacy provisions of the Health Insurance Portability and Affordability Act.  Cignet Health Center, a group of clinics based in Prince Georges County, Md., ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"US","motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d88fc31c9f5877f6447aae6741ac7c68e3f35e91","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0AE928DD-4233-4233-BAC2-5C651C13BC97"},"incident_date":"2010-04-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d753c4121e6c","org_name":"Serco Inc.","org_type":"professional_services","ransomware":null,"records_affected":207000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2010/05/stolen-laptop-exposes-personal-data-on-207000-army-reservists/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.databreaches.net/obamacare-exchange-contractors-had-past-security-lapses/"}],"summary":"Article on ACA contractors deferenced prior breaches. This entry is modeling a 2010 incident involving Serco Inc. and a lost laptop.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2010-04-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0d0c64639697f156be6c664a79ccfc97daf6768","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"5FB8F81A-B07E-46ED-9AF7-6F453C06E707"},"incident_date":"2010-04-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"b398332c160a","org_name":"Betfair","org_type":"other","ransomware":null,"records_affected":3150000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.bankinfosecurity.com/breach-reported-18-months-later-a-4127/op-1"}],"summary":"The breach of online gambling site Betfair is alarming to banking institutions and security experts because the company waited 18 months to report the incident.  Betfair's systems breach, which occurred in March and April 2010, was not uncovered until this past May, when a server","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8d291d1c6efcfab26dcc6d9a8c521e2ee1735c97","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A795BC73-7D84-4E6E-92F6-D456EC64AF98"},"incident_date":"2010-03-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2d63f2b02033","org_name":"University Medical Center of Southern Nevada","org_type":"healthcare","ransomware":null,"records_affected":5103,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4c134984e25be7943284743f3845250ad8b0a7a6","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"88AF7DA3-1A45-44BE-AEA3-8E65729CDA6A"},"incident_date":"2010-03-31","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a26f51c1dba1","org_name":"Lee Memorial Health System","org_type":"healthcare","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-31","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c308215aba96ad4bcce0a946c5225292ce72b700","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"72364F3B-62F5-4209-B6B1-B8FF56898B7A"},"incident_date":"2010-04-15","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6e0d82a8fb72","org_name":"Laboratory Corporation of America","org_type":"healthcare","ransomware":null,"records_affected":2773,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"9c5d117ae60c8850ec52fea79b309048ff858b0c","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ECAC5DCF-4D30-4855-8640-4D6C25E82DE9"},"incident_date":"2010-03-23","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c98b5f50ade3","org_name":"Wyoming Department of Health","org_type":"government","ransomware":null,"records_affected":9023,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1455402e1e4a8624057b5ceada14ca06ec417a8a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"83067D8E-676A-41D4-90D3-3D74BBC9882E"},"incident_date":"2010-04-02","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":174,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"A patient was in the EKG room and apparently was left alone for a moment. When the nurse came back in, the patient was going through all the printed consult requests that had been left on the printer unattended.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"176553c0ab6c950b4387ee4b87ed72636415cdc4","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22D9F2D8-725B-4182-B845-03D751374991"},"incident_date":"2010-03-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0356283bca81","org_name":"Thrivent Financial for Lutherans","org_type":"financial","ransomware":null,"records_affected":9500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"81336a2faa5a49d3e67b48d1a8687a10e2c5457f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"02FDBD7A-988E-44A7-B6F6-413841B34FB0"},"incident_date":"2010-03-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ddb3978d965","org_name":"Montefiore Medical Center","org_type":"healthcare","ransomware":null,"records_affected":625,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad1b9365aa08d19f519fc454f15ee995de4a0498","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"068C2F46-4C97-48A8-9D32-005B50284C39"},"incident_date":"2010-03-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51902ba6ebf5","org_name":"Ernest T. Bice, Jr. DDS, PA","org_type":"healthcare","ransomware":null,"records_affected":21000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-23","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ad8da59966818e02fb1c938453ddbe3938077657","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A67C4991-A002-4608-A797-77BE1D0DA610"},"incident_date":"2010-03-23","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9fd9068536b3","org_name":"Aspen Dental Care PC","org_type":"healthcare","ransomware":null,"records_affected":2500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e097dea4f2da4c4d6e33801c73961f9de9045567","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B3294DFA-0BAE-4B33-AE7E-960F9659DCEB"},"incident_date":"2010-03-14","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"de0576179919","org_name":"Puerto Rico Department of Health","org_type":"government","ransomware":null,"records_affected":2621,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3971dbd02df055ae4cc6c2ccc62c1b705a785a0e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CDCAB00D-62DB-44CE-BC12-4CA88500BFF1"},"incident_date":"2010-03-09","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c4f692cba64b","org_name":"University of New Mexico Health Sciences Center","org_type":"healthcare","ransomware":null,"records_affected":1898,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"cf6634d34fec69911e9cf1a6b83c9814594dad4f","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A5148C0F-DD89-4B76-9581-3021527B5C61"},"incident_date":"2010-03-09","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"831d861fd094","org_name":"State of Tennessee Bureau of TennCare","org_type":"government","ransomware":null,"records_affected":3900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8778b2f9a251b977abf14402061fda486af4aaa7","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F3959B62-9D50-438C-9E92-E69E7F271183"},"incident_date":"2010-03-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"9abb2af6dff1","org_name":"North Carolina Baptist Hospital","org_type":"nonprofit","ransomware":null,"records_affected":554,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"78c1969f8fa60ba2b2c2a5a96c9acec6035af8e3","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0D02E0B8-366F-49C4-9508-94462667AABA"},"incident_date":"2010-03-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"86bd96bfee19","org_name":"Lucile Packard Children's Hospital","org_type":"healthcare","ransomware":null,"records_affected":532,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-09","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0e216dddc18ea2805ef38f5b54508bb65a3f7d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0E682AC9-8AE6-4D3D-9571-6BF24A827844"},"incident_date":"2010-03-09","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"298e33983bf7","org_name":"Advanced NeuroSpinal Care","org_type":"healthcare","ransomware":null,"records_affected":3500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"95f2ade9e594d91aebf316dc34a9eb94826652de","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7F8AA7F2-DFE0-4937-935F-3F469A96C1F4"},"incident_date":"2010-03-04","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6689fd44f304","org_name":"MMM Healthcare, Inc.","org_type":"healthcare","ransomware":null,"records_affected":1907,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"552fabc56888210304b35bf9b77965acfbadba68","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"0A231566-C55D-4D36-844D-5DCB191A4280"},"incident_date":"2010-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"22a6a01ba0f7","org_name":"Educators Mutual Insurance Association of Utah","org_type":"financial","ransomware":null,"records_affected":5700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a5e909c6777a3bf6364403b03f69aaf245ad8bbf","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE66E145-4B89-4209-AFC9-0C9D9EAF7AEE"},"incident_date":"2010-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d9e146d92899","org_name":"Center for Neurosciences","org_type":"other","ransomware":null,"records_affected":1101,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ddbe1265c786710bfe631cd5216003837a9e9ac6","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C36CE554-9D91-47AE-91E8-905FC6461EF5"},"incident_date":"2010-03-04","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"52a5daaf45c2","org_name":"Cardiology Consultants/Baptist Health Care Corporation","org_type":"healthcare","ransomware":null,"records_affected":7600,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-03-04","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"86b05267a75074404e5275d342740a4aea9d9fb0","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22EFFE7F-DDC3-4222-8BB5-2F79834D1311"},"incident_date":"2010-03-04","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"32790478fd8a","org_name":"Brown University","org_type":"education","ransomware":null,"records_affected":528,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["credentials"],"disclosed_date":"2010-03-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"24bd7650bc777037f26dff3755cac25d8ccf64f1","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"083EDBD1-6BF4-4F01-80E4-04402650E872"},"incident_date":"2010-03-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5d33d6aaa30d","org_name":"Village View Escrow","org_type":"other","ransomware":null,"records_affected":2,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://krebsonsecurity.com/2011/07/calif-co-sues-bank-over-465k-ebanking-heist/"}],"summary":"Escrow company hacked and money sent overseas","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"unknown","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-03-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4adacec636b360ec203c3026b7484ad036f1788b","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE00B510-EEA7-4CBF-8C3A-ECF6C0A37F60"},"incident_date":"2010-03-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a79a1b052676","org_name":"Educational Credit Management Corporation","org_type":"financial","ransomware":null,"records_affected":3300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2010/03/26/student-loan-company-data-m-people-stolen/"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wsj.com/articles/SB10001424052702304434404575150024174102954;https://www.ifap.ed.gov/presentations/attachments/50DontBeTomorrowsHeadlinesV1.ppt;http://doj.nh.gov/consumer/security-breaches/documents/ecmc-group-20100416.pdf;http://www.prnewswire.com/news-releases/ecmc-notifying-borrowers-of-data-loss-89299342.html;http://dataprivacy.foxrothschild.com/2010/03/articles/data-security-breach-response/data-breach-affecting-33-million-borrowers-with-student-loans/;http://dataprivacy.foxrothschild.com/2010/04/articles/data-security-breach-response/update-on-massive-ecmc-data-breach/;http://experian.consumerinfo.com/triplealert/Message.aspx?PageTypeID=FAQECMC&SiteVersionID=914&SiteID=100231&sc=670676&bcd=;"}],"summary":" A company that guarantees federal student loans said Friday that personal data on about 3.3 million people nationwide has been stolen from its headquarters in Minnesota.  Educational Credit Management Corp. said the data included names, addresses, Social Security numbers and dat","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7e2e1d3cd2f3a20ccad61d2b550d74a60d1804d2","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"98A18CD6-6615-4723-BFF4-E66E4DF280E2"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4d8c14c5d9","org_name":"University of California, San Francisco","org_type":"education","ransomware":null,"records_affected":7300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"223917b47bc35b1ba082ddfa0c12296b7b6e8ab7","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D26DB416-A043-4975-9F72-2E90A579E8C4"},"incident_date":"2010-02-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c80d3338847e","org_name":"Universal American","org_type":"financial","ransomware":null,"records_affected":83000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7dfe655db56e14c09e56aa8c86df3a054b179308","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"614C6EC6-A57E-4B1D-9F3D-6096F72DFE6E"},"incident_date":"2010-02-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Upon completion of visit, a nurse gave Veteran A the O/P routing slip of Veteran B. The slip contained Veteran B's full name, full social security number, home address, home phone, health insurance information, and medication information. There was no 7332 information involved","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"058e12cad4250ad9296df876c094b51fa87de828","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7EE7F751-422B-45F4-A444-5BCFFBF82E0B"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bfaa54d6a191","org_name":"Mid America Kidney Stone Association, LLC","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"85c19f0cc20db9d88398fcee81413af75f36597d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"FED040E0-4A3C-4436-92F6-E4F39A395406"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a4a43570e6d4","org_name":"Michele Del Vicario, MD","org_type":"healthcare","ransomware":null,"records_affected":6145,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f2144bc58c76ba9100bfbb38687d39a6f5deebbb","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3D9D72B1-2FED-48AD-9914-EE2052E6CE37"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1d29c8fc540c","org_name":"Methodist Hospital","org_type":"healthcare","ransomware":null,"records_affected":689,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"762c230278d809220e1fed75e0b274f634c48188","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"ABD551D3-A3A1-4523-A570-7F3DF9937E70"},"incident_date":"2010-02-22","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"aba1c72f4bf4","org_name":"Massachusetts Eye and Ear Infirmary","org_type":"healthcare","ransomware":null,"records_affected":1076,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"39edce9f59f40206ee860ee94258834e05a0d5ff","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DD6E1846-C202-4A63-97B0-2577C31AE32A"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"af2a8dfd43b3","org_name":"Kern Medical Center","org_type":"healthcare","ransomware":null,"records_affected":596,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8e80b9e57552256ef375c8fe5b54545a7203b6af","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"22A009A1-FADF-4E9A-BDDC-C6DA632E7AF6"},"incident_date":"2010-02-22","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"154ab3f802a1","org_name":"Keith W. Mann, DDS, PLLC","org_type":"healthcare","ransomware":null,"records_affected":2000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f196326b9addea9a8a4eb4a92984f47cac42c461","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"7CDF2AA5-CA85-419D-A5B5-D7E026457299"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e968a60b3123","org_name":"Kaiser Permanente Medical Care Program","org_type":"healthcare","ransomware":null,"records_affected":15500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8bd0cd9369a3fafd28eb6244d43dce483042b8ac","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC624C56-1D60-4D51-9B1C-28FFB271B41C"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"2ae90ffc0b79","org_name":"Health Services for Children with Special Needs","org_type":"healthcare","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"005409ed91e0f5769f66211ae60743bf56dc3c2c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"91602D39-0E58-447F-A098-B619B340B628"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"f3eca1c8e70b","org_name":"Goodwill Industries of Greater Grand Rapids, Inc.","org_type":"healthcare","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8463623f33c85c85f4a88075caaca84820de9b95","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"703D827B-8FA2-40A4-AC91-FE17DAC6B7F9"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"903cdcc3d459","org_name":"Detroit Department of Health and Wellness Promotion","org_type":"government","ransomware":null,"records_affected":10000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bbfe7d8f68e3e0bd90546973cd300f00b3826f1e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D7AD0874-C743-471C-AE35-1F22207D01A6"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"7b618af5ae07","org_name":"Daniel J. Sigman MD, PC","org_type":"healthcare","ransomware":null,"records_affected":1860,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1117e2772dd31bbaf690bb78c8032f8a2916840e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70857BCE-8328-4689-9995-81DDEC589F6C"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bdf326f6f857","org_name":"Concentra Health","org_type":"healthcare","ransomware":null,"records_affected":900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"2f92533f254904393691d4b133760bdbf595c806","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BDA7FD92-67FE-437B-9761-13A98BECE20D"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b02093e2454","org_name":"Cogent Healthcare of Wisconsin, S.C.","org_type":"healthcare","ransomware":null,"records_affected":6400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7204c58de4c4f9fe78bcef2b7e08765024915c83","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EC0F69DE-35C7-4FAE-8F3F-4319B97643D6"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"74ef140165e2","org_name":"City of Hope National Medical Center","org_type":"healthcare","ransomware":null,"records_affected":5900,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"88ec6f7e7664054c560444eb495911747990de1e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"11B440A7-D2F0-43B4-865F-25D4517BBF41"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4b3c32d2d6","org_name":"Children's Medical Center of Dallas","org_type":"healthcare","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bb7a36214856dc092ca99912a346d8e9856c2e04","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3ADC5085-DCE3-4318-A933-8C96D3697F9B"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"683471eb9def","org_name":"Children's Hospital of Philadelphia","org_type":"healthcare","ransomware":null,"records_affected":943,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1598"],"confidence":"medium","control_failure":"staff_deceived","credential_source":null,"cve":[],"data_types":["financial","medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4d780932c50be82a116caf1d676f906eabbfd524","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"061AB120-ADAF-4B74-A6DF-426DA1CF2379"},"incident_date":"2010-02-22","initial_access":"vishing_or_social_engineering","initial_access_attack_id":"T1598","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4fee5e8957ad","org_name":"Carle Clinic Association","org_type":"healthcare","ransomware":null,"records_affected":1300,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"social"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"248a8bb67e0ddc8c8e1866dac15a7b40580b9e07","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"855991D0-D671-49DA-B3D0-B0BAB03F31B2"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a112e3b1e731","org_name":"Brooke Army Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0521aca48091fa1fedf70e9c6ed8b4899411231e","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AB2007A4-82AB-44E5-A203-3986349C8C31"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"27f30c1712d3","org_name":"Blue Island Radiology Consultants","org_type":"healthcare","ransomware":null,"records_affected":2562,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c91a2666ce979ba2bea69575642a3c067ae5536b","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AFCDA400-364A-4892-898A-87930213FEB7"},"incident_date":"2010-02-22","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"5395904f1038","org_name":"Blue Cross and Blue Shield Association","org_type":"financial","ransomware":null,"records_affected":3400,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"38d6b4f25e551abbece06a3610adb8511a0483ab","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EEC4A05C-3C03-49A0-8594-A9F60CE48DEC"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"645f30162139","org_name":"Ashley and Gray DDS","org_type":"healthcare","ransomware":null,"records_affected":9309,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"3df5029ae7454a1453c20934e44c07044664cf0d","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"80D741B7-7B13-4370-9223-DF6742BF6761"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3cb03df4f9f","org_name":"Alaska Department of Health and Social Services","org_type":"government","ransomware":null,"records_affected":501,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-02-22","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"fd8bc18bffd9f904bc7debe3ecbe767e462ee54c","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31E771EB-58C2-40CA-8D23-05A2A39436E6"},"incident_date":"2010-02-22","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a6f2013ef16c","org_name":"Advocate Health Care","org_type":"healthcare","ransomware":null,"records_affected":812,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":"VCDB record","type":"other","url":"https://github.com/vz-risk/VCDB"}],"summary":null,"supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-02-16","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4dd3d8da2ded1f03992d765d7f7bca1d81772f80","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"597E31F5-9066-4F0C-A789-2DE40077715A"},"incident_date":"2010-02-16","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":4,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"On 02/11/10, a total of 22 pages containing PHI of 4 different patients were inadvertently faxed to a wrong fax number. The documents consisted of MRI orders, Registration Form for Veteran/Retired Service Member and authorization sheets. The documents contained full names, full s","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-02-14","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"75d745240e65f752224028c2a967acb9e8275d4f","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"636F79EC-BA24-4FF5-9CF6-4F1AF46340DD"},"incident_date":"2010-02-14","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48a5019e8110","org_name":"Texas Auto Center Dealership","org_type":"retail_ecommerce","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://phys.org/news188072264.html"}],"summary":"\"The Texas Auto Center dealership in Austin installs GPS devices that can prevent cars from starting. The system is used to repossess cars when buyers are overdue on payments, said Jeremy Norton, a controller at the dealership where Ramos-Lopez worked. Car horns can be activated ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e31d81cb873fab2c82a6b34179bbdd68ea0b5c1b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"756D3372-63AC-4068-A58F-FEEB67874EC3"},"incident_date":"2010-02-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"6b0c7f34a3f5","org_name":"Owensboro Health, Inc.","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://insurancenewsnet.com/oarticle/2013/11/16/woman-indicted-for-identity-theft-stealing-patient-information-a-422042.html#.UopRAaU2lBU"},{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/2013/11/18/former-owensboro-medical-employee-indicted-for-data-breach/"}],"summary":"A medical office employee was indicted by a federal grand jury this week on charges of using patient information to obtain loans. The indictment says between February 2010 and August 2012, defendant \"disclosed her employer's patients' identifying information by providing names, b","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-02-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bf2bdd6621945fd3a1bcbb4cc725dafb49411b79","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9DD63FB2-F23F-4C6B-B86F-930333C42B2C"},"incident_date":"2010-02-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"00078e26ab5e","org_name":"Lanap & Dental Implants of Pennsylvania","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cyberwarnews.info/2013/12/13/dentrix-data-leak-report-and-analysis/#.UqpPiYInJjU.twitter;http://wnep.com/2013/12/09/stolen-data-on-thousands-of-williamsport-area-dental-patients/;http://www.phiprivacy.net/thousands-of-pennsylvania-dental-patients-may-be-at-lifetime-risk-of-id-theft-after-patient-database-is-uploaded-to-torrent-sites/"}],"summary":"dental center lost both the software and all the data in the software which held patient ID's and SSN, unknown actor, actions and assets, data just found on internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-28","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"669ee425261c00d34390814945e3755666dec73e","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"308FEC48-6EE9-44F4-AF88-78E40CAD6E6C"},"incident_date":"2010-01-29","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"Veteran A received Veteran B's medical record from the Release of Information office. Veteran A will be returning the records to the VA. The medical record \ncontained Veteran B's name, address, social security number, and medical information.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-27","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"c9139a1e384e95c18234e57c549141d2afc69639","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"70413C83-8E3B-444B-BEA2-472F52D5B1F4"},"incident_date":"2010-01-27","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"3da3fd983651","org_name":"Shands at the University of Florida","org_type":"healthcare","ransomware":null,"records_affected":12580,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wcjb.com/local-news/2010/03/shands-computer-stolen-thousands-receive-letter-information-breach"}],"summary":"Shands HealthCare officials have notified about 12,500 individuals that a Shands-owned laptop computer containing their health and other personal information was stolen last month.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-06","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"dedee5df44bfdfe195edc765d8bc40754b9f96bf","impact_type":"exposure_no_theft_confirmed","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9B7804BA-BDBB-47D0-9565-92CDAC35BE81"},"incident_date":"2010-01-15","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"1cc62dc224d5","org_name":"United States Department of Veterans Affairs","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://vcdb.org/pdf/va-security.pdf"}],"summary":"An employee went into his employee records, and found 1 other employee's information in his folder to include the name, social security number, date of birth, \nemployment information, and financial information","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6105959d2858b543bb553328a79ccbfe63dab40c","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"9AB3C928-CC51-48DB-917D-56016EC8CA51"},"incident_date":"2010-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"dbfc4fb607ec","org_name":"Woodwinds Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/local/185820902.html,"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/its-10-pm-do-you-know-where-your-patients-data-are/"}],"summary":"An employee kept 200 pages of confidential information in an effort to prove that Woodwinds Hospital was trying to conceal evidence of medical misconduct.  The employee was discharged in 2010 for reasons unrelated to removing the information.  She claims to have taken them home a","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","internal","medical","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"df4c7ac92c11bf4793efbdf2fca8f8d81ed2596f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F193C96A-AED0-4692-A673-07B17F121C00"},"incident_date":"2010-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"16be1f1aaaeb","org_name":"Wick and Trautwein","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.prnewswire.com/news-releases/herman-gerel-llp-aarons-inc-faces-more-computer-spyware-allegations-263859991.html;"}],"summary":"Rented computers had keyloggers and screen capturing software installed by the renting company w/o notification to the renters.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"42905d3a661c992845183d40568b0bd410e709d5","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BD47CA16-5F24-4192-B1BD-BAAF5F37FF77"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"0429baca0b44","org_name":"Wells Fargo Bank","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.consumerfinance.gov/about-us/newsroom/consumer-financial-protection-bureau-fines-wells-fargo-100-million-widespread-illegal-practice-secretly-opening-unauthorized-accounts/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://files.consumerfinance.gov/f/documents/092016_cfpb_WFBconsentorder.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.mercurynews.com/2016/10/10/wells-fargo-scandal-to-customers-this-is-like-identity-theft/;http://www.ktvu.com/news/211239807-story"}],"summary":"Wells Fargo's embattled CEO John Stumpf is stepping down as the nation's second-largest bank is roiled by a scandal over its sales practices.     The San Francisco bank said Wednesday that Stumpf is retiring effective immediately and also relinquishing his title as chairman. It h","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af635f8cd76dec3d4e8fd57e62de3088370dfe5f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7ECEED8-A64C-4EAD-8225-82148F90A9C3"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"9ce0300cd1a2","org_name":"Vitalit Health Network","org_type":"healthcare","ransomware":null,"records_affected":141,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cbc.ca/news/canada/new-brunswick/vitalit-health-refers-doctor-privacy-breach-to-rcmp-1.2775290"}],"summary":"Vitalit Health Network is asking Codiac Regional RCMP in Moncton to investigate possible criminal charges after one of its doctors accessed the electronic medical records of dozens of female patients without authorization.  An investigation by New Brunswick's Privacy Commissioner","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"ideology","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"09aaa6a860d2f7434f91a8dc2df7f54304dac024","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"18E77873-0DE5-49BA-9C70-AF12610CE28D"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e6f40d379f70","org_name":"US National Security Agency (NSA)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/09/24/usa-courts-leak-factbox-idINDEE98N00220130924"}],"summary":"\"Former National Security Agency official Thomas Drake was suspected in 2010 of revealing information about the agency's warrantless wiretapping program\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"270fe3921f7890cbc7e233c9e11e9013a6c3573a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"84AC81B3-DCC0-4652-8FC7-8BC7B46A133A"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ab756c3e0826","org_name":"US Department of the Army","org_type":"government","ransomware":null,"records_affected":700000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://in.reuters.com/article/2013/09/24/usa-courts-leak-factbox-idINDEE98N00220130924"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/local/10-accused-of-20-million-in-identity-theft-fraud/nf5f7/"}],"summary":"Chelsea Manning, an Army private first class formerly known as Bradley Manning, turned over more than 700,000 classified files to the anti-secrecy website WikiLeaks in the biggest breach of secret data in U.S. history.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b4a24235c53cedb509caa2ae37780b586d0e1509","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CD22644A-93BE-4171-9CC1-D4F69F15A624"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"637d4716fb4e","org_name":"University of California Los Angeles","org_type":"education","ransomware":null,"records_affected":323,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://hipaahealthlaw.foxrothschild.com/2010/05/articles/snoop-through-records-go-directly-to-jail/,"}],"summary":"A former researcher at UCLA has the dubious distinction of being the first person sentenced to prison under HIPAA for snooping through medical records.  The Justice Department press release reports that the researcher, Huping Zhou, who admitted to illegally reading private and co","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d962b31d56c7c0bc7f834a401f4159423b58c3dc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"D3400AD9-BD1A-4DAD-9FA5-95535B058E7D"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ed62d3b716ff","org_name":"Tufts Health Plan","org_type":"financial","ransomware":null,"records_affected":8700,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.healthcareitnews.com/news/snooping-staff-still-top-security-issue"}],"summary":"When it comes to data breaches, hacking and loss or theft of unencrypted devices are far from healthcare security professionals' only concerns. Employee snooping and insider misuse also prove to be among the biggest privacy threats in the healthcare sector today.     Just last we","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8ee5e4384fe4135020805339180497bd7adac968","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BF888119-7379-4ACC-B222-C05781AFA770"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"71023f8127c3","org_name":"Trinity Mirror Digital Recruitment","org_type":"professional_services","ransomware":null,"records_affected":4300000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.pcpro.co.uk/news/security/358282/hack-attack-targets-4-3-million-online-cvs"}],"summary":"The personal details of 4.3 million job seekers may have been compromised in a concerted and sophisticated hack attack on Trinity Mirror's recruitment sites.  According to Trinity Mirror, no actual CV details were exposed during the attack on sites such as Planet Recruit and JobS","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"ideology","name":null,"variety":"activist"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":"unknown","cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7c4f5e3fdd3ac0f6cd6a0ccbb5e859b6aa2ebac8","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"EE357ACF-2472-4781-BECB-F1423C7C5DE8"},"incident_date":"2010-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad3984289914","org_name":"Tribune Co.","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/56170"}],"summary":"A former employee revealed a password and username combination for Tribune Co. to hackers.  The hackers were part of anonymous and used the information to access Tribune Co.'s servers in 2010.  A number of online stories that had been published through Tribune Co. were defaced by","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"56a5b9c2378ce183b2f96c04b28bd4619665011b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"521FE781-73B2-470E-A92B-F0223976E839"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"JP","org_id":"d5f497465e56","org_name":"The Japanese Supreme Court","org_type":"government","ransomware":null,"records_affected":114,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.breitbart.com/national-security/2016/07/01/japanese-supreme-court-confirms-special-surveillance-of-muslims/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.msn.com/en-us/news/world/japans-top-court-has-approved-blanket-surveillance-of-the-countrys-muslims/ar-AAhMfQg?li=BBmkt5R&ocid=spartandhp"}],"summary":"police files were leaked to the public, which revealed widespread monitoring of Muslims","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"unknown"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ced3e294786058d034be2952bc7a8550e915b0d6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"31F90FFD-D294-45DC-9371-6AADCF339730"},"incident_date":"2010-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"807aaf389840","org_name":"Texas Comptrollers office","org_type":"government","ransomware":null,"records_affected":3500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.informationweek.com/attacks/texas-data-breach-exposed-35-million-records-/d/d-id/1097146"}],"summary":"Publishing error in Texas Comptrollers office","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":"RU","motive":"financial","name":null,"variety":"unaffiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","financial","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"web_application","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4ac8f01b613b4eed328825079b8074abd4e2e5fc","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"1EA619DF-3CD1-449A-8F42-2AF824719A13"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"22fb53e33b4e","org_name":"Scottrade","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.ahherald.com/newsbrief/law-and-order/16959-russian-national-sentenced-to-30-months-in-prison-for--million-trading-account-hack;http://www.sheepsheadbites.com/2012/04/petr-murmylyuk-a-k-a-dmitry-tokar-charged-with-fraud-hacking-identity-theft-money-laundering/"}],"summary":"Hackers gained unauthorized access to trading accounts of customers and used those credentials to setup phony accounts to perform fraud. ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"7d4866fccab4b63da05a9600ed77c47ba1403292","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85FB2F01-03BB-4386-A922-4334FAA14676"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"97b6ca8f5926","org_name":"Riseup","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4b0173f3a4bad7b6d0eb2e1b527b02b87a8310f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AC5C6BCC-3C62-4C94-BD70-888019D91778"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"44bd77d2ab7a","org_name":"Platinum Solutions","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://articles.washingtonpost.com/2013-07-19/local/40672569_1_court-filings-computer-robert-steele"}],"summary":"When 38-year-old Robert Steele left the government contractor he worked for in 2010, he was able to maintain a backdoor login to the company computer system — a security breach, prosecutors say, that is becoming increasingly common. What’s worse, prosecutors say, is that he used ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"unknown","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"physical","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d29db6ee0d8a14dd123dee9b5d64779801a2e62a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"159D9559-F9B8-4CE0-970D-E16ACCB19FB0"},"incident_date":"2010-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"51d2ac897b81","org_name":"Perry Hospital","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.foxnews.com/us/2014/04/28/former-georgia-technician-falsified-nearly-1300-mammogram-reports/?intcmp=latestnews"}],"summary":"The tech, Rachael Rapraeger, pleaded guilty earlier this month to 10 misdemeanor charges of reckless conduct and one felony charge of computer forgery. She was sentenced to serve up to six months in a detention center, to serve 10 years on probation during which she can't work in","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"169f67246845c41ca59318eafb5b62eb7d910863","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6DB23568-E73C-4E92-975D-3366D3C13C83"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"unknown","org_id":"9eb292dbaca0","org_name":"Paddy Power PLC","org_type":"other","ransomware":null,"records_affected":649055,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.techcentral.ie/paddy-power-admits-650000-customers-affected-by-data-breach/"}],"summary":"Canadian was in possession of 649,055 personal information records from customers of victim.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"US","motive":"grudge","name":null,"variety":"former_employee"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5b22474ec16929960dca7b24a11ffc629d3168d9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B46C3BF0-E90F-4E16-B7FF-31C93F6AF265"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a263fba031ae","org_name":"PA Online","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.inverse.com/article/12893-fired-network-administrator-takes-revenge-in-a-most-obvious-manner"}],"summary":"Former Network Engineer deletes critical information and drops backdoors on systems using his logins that were not disabled when he was fired.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"malware"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"41c0d5bab8f17d0f2763b6049da1396c157f70a9","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"10095F4C-E09F-4232-A389-CFA4BCAD86C7"},"incident_date":"2010-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"db79ed64a880","org_name":"North Shore University Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://newyork.cbslocal.com/2013/02/05/12-sue-north-shore-university-hospital-in-l-i-after-identity-thefts/?goback=%2Egde_4636751_member_211696786"}],"summary":"Twelve people filed a lawsuit Tuesday against North Shore University Hospital, after medical records with their personal information were stolen, leaving them vulnerable to identity theft. The 12 plaintiffs filed the lawsuit in Queens Supreme Court against the Nassau County hospi","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"4276b299ba5cb1e3114e1eb3f154c741df2b7105","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"96E598D6-AEB9-4CD1-A7B4-933DB95223DE"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"093681dae5a0","org_name":"Misericordia Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.stalbertgazette.com/article/20130328/SAG0801/303289997/-1/sag0801/st-albert-doctor-suspended-for-privacy-breach;"},{"fetched_at":null,"title":null,"type":"press","url":"http://cpsa.ab.ca/Libraries/pro_complaints_disc/011469-000015972511-1.pdf;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/st-albert-doctor-suspended-for-privacy-breach/"}],"summary":"An emergency room doctor from St. Albert has been suspended for at least a month because she illegally tapped into restricted medical files. The College of Physicians & Surgeons of Alberta announced this week that it had found Deanne Dee Gayle Watrich, an emergency room doctor an","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"partner","country":null,"motive":"espionage","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["secrets"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"57fee7e2ce883814d4a16d9b0d304e596bbe4ace","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"44FE0828-4D86-4B6A-AAC4-C921A0C69398"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"f263da1f949e","org_name":"Miller UK","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailymail.co.uk/news/article-3370601/Tiny-British-construction-firm-wins-74million-payout-Caterpillar-U-S-construction-giants-stole-secrets-vital-piece-heavy-machinery.html"}],"summary":"trade secrets used","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["financial","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"94c23f0e3a899405c38519277179f3519f4252b9","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B1FF0AB7-0D3B-446A-8372-A9377677EE42"},"incident_date":"2010-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"8b1e9cadcc76","org_name":"MBNA","org_type":"financial","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.annualcreditreport.co.uk/tagged/credit-card"}],"summary":"A laptop containing personal details of thousands of MBNA credit card customers has been stolen from the offices of NCO Europe.  Data lost includes personal details.  MBNA has confirmed that customer information was ‘compromised’.  An MBNA spokesperson has explained that none of ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"physical"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6d85b75d2ac7fcef19b87d2c99ef5ca26d3b0334","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"BB73703D-E8B7-4629-8233-2C6B666A54D3"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d552beabca09","org_name":"May First/People Link","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"1d2aa5090cbccfc69aaf9f38decddeba1cdb79b0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3717167C-09C4-4AE4-87CF-AA97104B5CAF"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"ZW","org_id":"e3dd55b41f23","org_name":"Mango","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"grudge","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"af5196810223ea5828f01266f51ef9b8e4c6bec0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DE4FE8D2-D571-4B81-A181-905AFA5C89D1"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"e93afd1590ca","org_name":"Legal Aid Ontario","org_type":"professional_services","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://allaboutinformation.ca/2014/11/07/tort-damages-awarded-for-privacy-breach-in-ontario/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.canlii.org/en/on/onsc/doc/2014/2014onsc6136/2014onsc6136.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.canadianlawyermag.com/legalfeeds/2373/legal-aid-employee-to-pay-7-500-for-intrusion-upon-seclusion.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.pogowasright.org/getting-caught-up-news-you-may-have-missed/;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.canlii.org/en/on/onsc/doc/2014/2014onsc6136/2014onsc6136.html"}],"summary":"Legal aid employee accesses case file without authorization and threatens boyfriend's former girlfriend.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"8564900ee251d540425471f060b5ee727fa60555","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"50898BF8-453A-4005-9DDD-79AB9BE0A668"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"KR","org_id":"a34e5ac1dc5d","org_name":"Jinbonet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"6229095ad62b32eabeb3de58316a6d99f8ba12c9","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85295240-5829-43CE-8DE3-F5B0DD4C1870"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ad1151c08071","org_name":"Jacksonville Sheriffs Office","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://members.jacksonville.com/news/crime/2013-12-12/story/jacksonville-sheriffs-office-employee-charged-stealing-inmatesJacksonville"}],"summary":"Corrections officer stealing personal information of inmates for tax fraud.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"bdee474973a5cc20281677e2e24f441280e0c631","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"35F862D2-7056-4EDF-B9D6-A3C1EA189A1D"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"CA","org_id":"c09c92c8d004","org_name":"Humber River Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.insidetoronto.com/news-story/4840921-north-york-hospitals-post-notices-to-patients-after-privacy-breach/"}],"summary":"Humber River Hospital and North York General Hospital were required by the provincial privacy commissioner to post notices on their websites advising maternity patients that their personal information may have been provided to baby photographers.  They were two of six Toronto hos","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"250e1927fb476350f4ce3cfe1e17845ad450ebb4","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"85232D3A-6394-4DCF-8CCE-2BE75AED5053"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"a602eeb87c1f","org_name":"Hospital","org_type":"healthcare","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.databreaches.net/texas-doctor-resentenced-to-prison-following-appeal/"}],"summary":"resentenced to federal prison for health care fraud and identity theft violations ","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ab5107f3cf42d147987fc1b67920f68537cc17f2","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"CFE8DB1C-5E9D-4BEF-AAC1-E2DA2D064627"},"incident_date":"2010-01-01","initial_access":"unknown","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"48264693e184","org_name":"Honda North America, Inc.","org_type":"manufacturing","ransomware":null,"records_affected":4900000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.zdnet.com/data-breach-affects-4-9-million-honda-customers-2062205394/"}],"summary":"  Japanese automaker Honda has put some 2.2 million customers in the United States on a security breach alert after a database containing information on the owners and their cars was hacked, according to reports.  The compromised list contained names, login names, e-mail addresse","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"69d4157f266799cc7ac2a61eff0f49af100076f6","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3E6D8835-5639-42AF-9E10-A619ADEBF6DB"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e008fc560464","org_name":"HealthPartners","org_type":"financial","ransomware":null,"records_affected":38000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.mprnews.org/story/2014/03/22/healthpartners-notifies-members-of-privacy-breach?from=health;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.startribune.com/lifestyle/blogs/251469761.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.twincities.com/health/ci_25393505/healthpartners-reports-breach-insurance-client-data"}],"summary":"Bloomington based HealthPartners is notifying health plan members about a privacy breach.  The company said the data breach happened between 2008 and 2010 when an employee took home electronic health plan information and showed the information to a family member.  The employee wa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"876e200cff85cb6af1b7f3ae38709ad5cefc4b8b","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"3EFE8878-0134-4BE0-A8F3-BED881633A84"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"GB","org_id":"adeaa94f5b58","org_name":"GreenNet","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":["T1566"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b24af8aceb9b0ea2fac7fe18ee279bf67c712ddc","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"508E99C3-7976-498B-BC54-C081A8D477F7"},"incident_date":"2010-01-01","initial_access":"phishing","initial_access_attack_id":"T1566","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"NL","org_id":"be19b86640bd","org_name":"Greenhost","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"\nBritish and US spies hacked into the routers and networks of several victim organizations by feeding telcom engineers malicious\nLinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. Once the computer browsers of\nthe engineers pulled up","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"76e7bcb769dd5d29572741a7fe76e78f504f58e0","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"946EAECE-DAC9-4318-BEE7-D8FF85FCA01F"},"incident_date":"2010-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"fdb1fefb44f3","org_name":"Greene and Letts Law Firm","org_type":"professional_services","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://lawprofessors.typepad.com/legal_profession/2013/01/an-illinois-hearing-board-has-reprimanded-an-attorney-who-disclosed-confidential-information-in-a-court-filing.html;http://www.iardc.org/HB_RB_Disp_Html.asp?id=10819"}],"summary":"Attorney fails to supervise employees posting sensitive documents to US District Court Electronic Case File. Personally Identifiable Information was entered into public record and was viewable on the public Internet.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"0d5f2c61fdb1d6623400427a317c11d7a8146917","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"17E77476-1CB6-4892-8B53-7D645D5A5DEF"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4c834893032d","org_name":"Good Samaritan Hospital","org_type":"healthcare","ransomware":null,"records_affected":49,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.phiprivacy.net/four-women-indicted-for-stealing-750k-in-merchandise-using-patients-information-two-of-them-allegedly-stole-while-employed-at-medical-practices/;http://www.washingtonpost.com/local/4-charged-with-stealing-750k-in-merchandise-using-patients-stolen-information/2013/10/17/81f8efea-3789-11e3-89db-8002ba99b894_story.html"}],"summary":"2 employees stole identities from medical database, used for fraud and lines of credit to purchase personal goods., 4 people indicted.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":["T1078"],"confidence":"medium","control_failure":"staff_deceived","credential_source":"unknown","cve":[],"data_types":["credentials"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e19f79bbd6eda07ec603a25a5c8cd03cd91472a1","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C4559733-8AFC-4689-B813-38B371D02E88"},"incident_date":"2010-01-01","initial_access":"stolen_or_valid_credentials","initial_access_attack_id":"T1078","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e3619cb40d8a","org_name":"Florida A&M University","org_type":"education","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.tallahassee.com/article/20131024/NEWS/131024026/Former-FAMU-student-sentenced-two-years-federal-prison-identity-theft-?gcheck=1"}],"summary":"Using discarded paperwork near the FAMU computer help desk, gathering information via public outlets and grifting students and university employees into providing personal information, the three men accessed student accounts and changed bank account and routing numbers where fina","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"exposed_service_or_storage","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"f8851250d19833df196560c8f2bcedb9fbf79603","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"46932C64-7201-48AB-8BDC-DF72C9ACF15C"},"incident_date":"2010-01-01","initial_access":"misconfiguration_or_exposure","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c7ab62575bb2","org_name":"Federal Bureau of Investigation (FBI)","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://boingboing.net/2013/12/22/fbi-agent-tries-to-copyright-s.html;http://www.motherjones.com/politics/2013/12/fbi-copyrighted-interrogation-manual-unredacted-secrets"}],"summary":"FBI agent tries to copyright super-secret torture manual, inadvertently makes it public","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"external","country":null,"motive":"unknown","name":null,"variety":"unknown"},"attack_techniques":["T1195"],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["credentials","personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52053666ebc6ec6ca8b4039b0f91d72527a51470","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DAE03331-EA43-465D-868B-247BD900C2EC"},"incident_date":"2010-01-01","initial_access":"supply_chain_or_third_party","initial_access_attack_id":"T1195","notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"bff3fb06b043","org_name":"deviantART","org_type":"retail_ecommerce","ransomware":null,"records_affected":13000000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.privacyrights.org/node/3922"}],"summary":"13,000,000 (No SSNs or financial information exposed)  Mirroring the Gawker an McDonald's breaches earlier this month, hackers exposed the email addresses, user names and birth dates of the entire deviantART user database.  Hackers were able to breach deviantART's marketing compa","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":[],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"a293929724abdd95e82af8d9ec5fada980779270","impact_type":"unknown","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"6966A968-9725-4D28-9FA8-FD9F81FD0112"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"c738f70efe1b","org_name":"Department of Defense","org_type":"government","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.washingtonpost.com/local/marine-stationed-at-henderson-hall-charged-with-stealing-32000-in-theft-scheme/2013/09/20/436e4852-2225-11e3-a358-1144dee636dd_story.html"}],"summary":"U.S. Marine Corps corporal who worked as a Defense Department travel administrator reported fake travel expense records for other employees, then directed the reimbursement to his own bank accounts.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"high","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"013caf97f41adcd1a32f6812ce575cbba9df3a64","impact_type":"disruption_or_ransomware","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"66bc8120-e378-11e7-bf7a-0771e1cc9602"},"incident_date":"2010-01-01","initial_access":"lost_or_stolen_device","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b4b3c32d2d6","org_name":"Children’s Medical Center of Dallas","org_type":"healthcare","ransomware":null,"records_affected":3800,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://healthitsecurity.com/news/childrens-medical-center-issued-3.2m-ocr-hipaa-penalty"}],"summary":"A breach report was first filed with OCR on January 28, 2010, when an unencrypted, non-password protected Blackberry was reported lost. Approximately 3,800 individuals had their ePHI on the device.  Nearly three years later, a separate breach notification was submitted. In this c","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"ecccea5015d75fbd499d1fdcc1cc392880fcfd2f","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"F481FC95-C419-4F12-8E35-B80642596B38"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4dc6fbbd2db8","org_name":"Central City Concern","org_type":"other","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://koin.com/2014/04/29/ccc-admits-fault-clients-data-stolen/"}],"summary":"Employee at employment placement service stole personal information over three years, used for tax fraud","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"e0f09335bca70af1941bfb2d14d278b8eb41083d","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AA02CAB8-F9C5-4753-8B72-359CBA8889FC"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"d2fd1e17c52a","org_name":"California Pacific Medical Center","org_type":"healthcare","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.cdph.ca.gov/certlic/facilities/Documents/CaliforniaPacificMedicalCtrBreachAPOctober2010.pdf"}],"summary":"A person who worked at the medical facility was admitted for treatment.  A coworker accessed their files without a medical reason to do so, an audit found.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"b663638ba4043ae3d046fbceeba988c8cb63a09c","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"E7BACF40-1257-4832-AF8D-70AF1812020E"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"ae75d6dec7b0","org_name":"Califormia Police","org_type":"government","ransomware":null,"records_affected":1,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://www.eff.org/document/la-district-attorney-declination-letter-morales;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.eff.org/deeplinks/2015/11/misuse-rampant-oversight-lacking-californias-law-enforcement-network"}],"summary":"officer used database to look up PII he was not authorized to see","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"other"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"5bcfe50203bd6090c74fe1bc81ed27bf5afeffee","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"A3590FBC-5971-4D3C-BC6B-AA716FF5F397"},"incident_date":"2010-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"4b38e6aa66c7","org_name":"Boulder Community Health","org_type":"healthcare","ransomware":null,"records_affected":79,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.dailycamera.com/news/boulder/ci_25719824/boulder-community-health-investigating-stolen-patient-records-3rd"}],"summary":"Article references 3 data breaches, this is modeling the 2010 incident.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"partner","country":null,"motive":"financial","name":null,"variety":"unknown"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["medical"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"d40f5271d5ca9ef53211ba0754981b330abe2a36","impact_type":"both","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"DBAE87C5-B8F4-4921-82C7-1048B6A35BF5"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"DE","org_id":"0fde5a0975de","org_name":"BKK Health","org_type":"healthcare","ransomware":null,"records_affected":1500000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://translate.google.com/translate?hl=en&rurl=translate.google.com&sl=de&tl=en&twu=1&u=http://www.spiegel.de/netzwelt/netzpolitik/0,1518,677280,00.html"}],"summary":"When BKK Health, the largest with 1.5 million policyholders German company health insurance, gave it a report by the TV magazine \"contrasts\", according to a security leak. Perhaps highly sensitive medical data had fallen into the hands of unauthorized persons, reports \"contrasts\"","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":"vendor_connection","involved":true,"vendor":null},"veris_action":"misuse"},{"actor":{"category":"external","country":"GB","motive":"espionage","name":null,"variety":"state_affiliated"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["internal","secrets"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"be13d6068648cd5071cc1e3289001cf36fd90d96","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"B2DF4E04-99C2-425E-8574-94F191C07283"},"incident_date":"2010-01-01","initial_access":"malware_other","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"BE","org_id":"0528e27e2105","org_name":"Belgacom SA","org_type":"technology_saas","ransomware":null,"records_affected":null,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/belgian-telco-belgacom-compromised;"},{"fetched_at":null,"title":null,"type":"press","url":"https://www.net-security.org/secworld.php?id=15619;"},{"fetched_at":null,"title":null,"type":"press","url":"https://threatpost.com/belgian-telco-belgacom-compromised"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.wired.com/threatlevel/2013/11/british-spies-hacked-telecom;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html;"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.scmagazineuk.com/gchq-sued-by-isps-over-state-sponsored-hacking/article/359278/"}],"summary":"A Belgian telecom company that handles some of the undersea cables that carry international voice traffic said Monday that its internal network had been compromised sometime in the last few months and malware had planted on some of its systems. Belgacom said the attack only affec","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"hacking"},{"actor":{"category":"internal","country":null,"motive":"unknown","name":null,"variety":"end_user"},"attack_techniques":[],"confidence":"medium","control_failure":"unknown","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"52bdc9c82e526016d2fae49f5d9684b6df7b989a","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"AEFF14F4-C15B-407B-ADFC-83FC58525138"},"incident_date":"2010-01-01","initial_access":"physical_or_paper","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"e91419c0f801","org_name":"Alabama Securities Commision","org_type":"government","ransomware":null,"records_affected":18500,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://blog.al.com/businessnews/2010/09/update_alabama_regulator_probi.html"}],"summary":"Confidential information on CD erroneously provided to lawyer.","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"error"},{"actor":{"category":"internal","country":null,"motive":"financial","name":null,"variety":"system_admin"},"attack_techniques":[],"confidence":"medium","control_failure":"insider_access_abuse","credential_source":null,"cve":[],"data_types":["personal"],"disclosed_date":"2010-01-01","discovered_date":null,"entry_asset":"unknown","evidence_level":"press_report","extracted_by":{"model":"import:vcdb","prompt_version":"import-v1","run_date":"2026-10-10"},"first_seen":"2026-10-10","id":"02a04a27fd2b19828a454c0224d78acfac8c849e","impact_type":"data_theft","imported_from":{"dataset":"vcdb","license":"CC BY-SA 4.0","mapping_version":"2","record_id":"C312CE5A-7D8E-4739-BDAB-019617BC94F7"},"incident_date":"2010-01-01","initial_access":"insider","initial_access_attack_id":null,"notes":"imported from VCDB; VERIS coding mapped, not re-extracted. disclosed_date = incident date (VCDB has no disclosure date)","org_country":"US","org_id":"df15049da402","org_name":"Alabama Department of Corrections","org_type":"government","ransomware":null,"records_affected":1000,"reviewed":false,"root_cause":null,"schema_version":"1.2","sources":[{"fetched_at":null,"title":null,"type":"press","url":"http://www.esecurityplanet.com/network-security/prison-medical-records-clerk-indicted-for-identity-theft.html;http://www.esecurityplanet.com/network-security/man-charged-with-2.5-million-fraud-scheme-using-prisoners-identities.html;http://www.justice.gov/opa/pr/2013/April/13-tax-482.html;http://www.justice.gov/opa/pr/2014/April/14-tax-453.html;http://www.justice.gov/opa/pr/2013/October/13-tax-1164.html;http://www.justice.gov/opa/pr/2012/October/12-tax-1278.html"},{"fetched_at":null,"title":null,"type":"press","url":"http://www.ajc.com/news/news/local/10-accused-of-20-million-in-identity-theft-fraud/nf5f7/"}],"summary":"Alabama Man Sentenced to Prison for Million Dollar Scheme Using Prisoner Identities to Obtain False Tax Refunds  Harvey James was sentenced today to serve 110 months in prison for his role in a stolen identity refund fraud scheme, announced Assistant Attorney General Kathryn Kene","supporting_quote":null,"technology_involved":[],"third_party":{"archetype":null,"involved":null,"vendor":null},"veris_action":"misuse"}]